/src/libtiff/libtiff/tif_dirread.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * Copyright (c) 1988-1997 Sam Leffler |
3 | | * Copyright (c) 1991-1997 Silicon Graphics, Inc. |
4 | | * |
5 | | * Permission to use, copy, modify, distribute, and sell this software and |
6 | | * its documentation for any purpose is hereby granted without fee, provided |
7 | | * that (i) the above copyright notices and this permission notice appear in |
8 | | * all copies of the software and related documentation, and (ii) the names of |
9 | | * Sam Leffler and Silicon Graphics may not be used in any advertising or |
10 | | * publicity relating to the software without the specific, prior written |
11 | | * permission of Sam Leffler and Silicon Graphics. |
12 | | * |
13 | | * THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND, |
14 | | * EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY |
15 | | * WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. |
16 | | * |
17 | | * IN NO EVENT SHALL SAM LEFFLER OR SILICON GRAPHICS BE LIABLE FOR |
18 | | * ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND, |
19 | | * OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, |
20 | | * WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF |
21 | | * LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE |
22 | | * OF THIS SOFTWARE. |
23 | | */ |
24 | | |
25 | | /* |
26 | | * TIFF Library. |
27 | | * |
28 | | * Directory Read Support Routines. |
29 | | */ |
30 | | |
31 | | /* Suggested pending improvements: |
32 | | * - add a field 'field_info' to the TIFFDirEntry structure, and set that with |
33 | | * the pointer to the appropriate TIFFField structure early on in |
34 | | * TIFFReadDirectory, so as to eliminate current possibly repetitive lookup. |
35 | | */ |
36 | | |
37 | | #include "tiffconf.h" |
38 | | #include "tiffiop.h" |
39 | | #include <float.h> |
40 | | #include <limits.h> |
41 | | #include <stdlib.h> |
42 | | #include <string.h> |
43 | | |
44 | 0 | #define FAILED_FII ((uint32_t)-1) |
45 | | |
46 | | #ifdef HAVE_IEEEFP |
47 | | #define TIFFCvtIEEEFloatToNative(tif, n, fp) |
48 | | #define TIFFCvtIEEEDoubleToNative(tif, n, dp) |
49 | | #else |
50 | | extern void TIFFCvtIEEEFloatToNative(TIFF *, uint32_t, float *); |
51 | | extern void TIFFCvtIEEEDoubleToNative(TIFF *, uint32_t, double *); |
52 | | #endif |
53 | | |
54 | | enum TIFFReadDirEntryErr |
55 | | { |
56 | | TIFFReadDirEntryErrOk = 0, |
57 | | TIFFReadDirEntryErrCount = 1, |
58 | | TIFFReadDirEntryErrType = 2, |
59 | | TIFFReadDirEntryErrIo = 3, |
60 | | TIFFReadDirEntryErrRange = 4, |
61 | | TIFFReadDirEntryErrPsdif = 5, |
62 | | TIFFReadDirEntryErrSizesan = 6, |
63 | | TIFFReadDirEntryErrAlloc = 7, |
64 | | }; |
65 | | |
66 | | static enum TIFFReadDirEntryErr |
67 | | TIFFReadDirEntryByte(TIFF *tif, TIFFDirEntry *direntry, uint8_t *value); |
68 | | static enum TIFFReadDirEntryErr |
69 | | TIFFReadDirEntrySbyte(TIFF *tif, TIFFDirEntry *direntry, int8_t *value); |
70 | | static enum TIFFReadDirEntryErr |
71 | | TIFFReadDirEntryShort(TIFF *tif, TIFFDirEntry *direntry, uint16_t *value); |
72 | | static enum TIFFReadDirEntryErr |
73 | | TIFFReadDirEntrySshort(TIFF *tif, TIFFDirEntry *direntry, int16_t *value); |
74 | | static enum TIFFReadDirEntryErr |
75 | | TIFFReadDirEntryLong(TIFF *tif, TIFFDirEntry *direntry, uint32_t *value); |
76 | | static enum TIFFReadDirEntryErr |
77 | | TIFFReadDirEntrySlong(TIFF *tif, TIFFDirEntry *direntry, int32_t *value); |
78 | | static enum TIFFReadDirEntryErr |
79 | | TIFFReadDirEntryLong8(TIFF *tif, TIFFDirEntry *direntry, uint64_t *value); |
80 | | static enum TIFFReadDirEntryErr |
81 | | TIFFReadDirEntrySlong8(TIFF *tif, TIFFDirEntry *direntry, int64_t *value); |
82 | | static enum TIFFReadDirEntryErr |
83 | | TIFFReadDirEntryFloat(TIFF *tif, TIFFDirEntry *direntry, float *value); |
84 | | static enum TIFFReadDirEntryErr |
85 | | TIFFReadDirEntryDouble(TIFF *tif, TIFFDirEntry *direntry, double *value); |
86 | | static enum TIFFReadDirEntryErr |
87 | | TIFFReadDirEntryIfd8(TIFF *tif, TIFFDirEntry *direntry, uint64_t *value); |
88 | | |
89 | | static enum TIFFReadDirEntryErr |
90 | | TIFFReadDirEntryArray(TIFF *tif, TIFFDirEntry *direntry, uint32_t *count, |
91 | | uint32_t desttypesize, void **value); |
92 | | static enum TIFFReadDirEntryErr |
93 | | TIFFReadDirEntryByteArray(TIFF *tif, TIFFDirEntry *direntry, uint8_t **value); |
94 | | static enum TIFFReadDirEntryErr |
95 | | TIFFReadDirEntrySbyteArray(TIFF *tif, TIFFDirEntry *direntry, int8_t **value); |
96 | | static enum TIFFReadDirEntryErr |
97 | | TIFFReadDirEntryShortArray(TIFF *tif, TIFFDirEntry *direntry, uint16_t **value); |
98 | | static enum TIFFReadDirEntryErr |
99 | | TIFFReadDirEntrySshortArray(TIFF *tif, TIFFDirEntry *direntry, int16_t **value); |
100 | | static enum TIFFReadDirEntryErr |
101 | | TIFFReadDirEntryLongArray(TIFF *tif, TIFFDirEntry *direntry, uint32_t **value); |
102 | | static enum TIFFReadDirEntryErr |
103 | | TIFFReadDirEntrySlongArray(TIFF *tif, TIFFDirEntry *direntry, int32_t **value); |
104 | | static enum TIFFReadDirEntryErr |
105 | | TIFFReadDirEntryLong8Array(TIFF *tif, TIFFDirEntry *direntry, uint64_t **value); |
106 | | static enum TIFFReadDirEntryErr |
107 | | TIFFReadDirEntrySlong8Array(TIFF *tif, TIFFDirEntry *direntry, int64_t **value); |
108 | | static enum TIFFReadDirEntryErr |
109 | | TIFFReadDirEntryFloatArray(TIFF *tif, TIFFDirEntry *direntry, float **value); |
110 | | static enum TIFFReadDirEntryErr |
111 | | TIFFReadDirEntryDoubleArray(TIFF *tif, TIFFDirEntry *direntry, double **value); |
112 | | static enum TIFFReadDirEntryErr |
113 | | TIFFReadDirEntryIfd8Array(TIFF *tif, TIFFDirEntry *direntry, uint64_t **value); |
114 | | |
115 | | static enum TIFFReadDirEntryErr |
116 | | TIFFReadDirEntryPersampleShort(TIFF *tif, TIFFDirEntry *direntry, |
117 | | uint16_t *value); |
118 | | |
119 | | static void TIFFReadDirEntryCheckedByte(TIFF *tif, TIFFDirEntry *direntry, |
120 | | uint8_t *value); |
121 | | static void TIFFReadDirEntryCheckedSbyte(TIFF *tif, TIFFDirEntry *direntry, |
122 | | int8_t *value); |
123 | | static void TIFFReadDirEntryCheckedShort(TIFF *tif, TIFFDirEntry *direntry, |
124 | | uint16_t *value); |
125 | | static void TIFFReadDirEntryCheckedSshort(TIFF *tif, TIFFDirEntry *direntry, |
126 | | int16_t *value); |
127 | | static void TIFFReadDirEntryCheckedLong(TIFF *tif, TIFFDirEntry *direntry, |
128 | | uint32_t *value); |
129 | | static void TIFFReadDirEntryCheckedSlong(TIFF *tif, TIFFDirEntry *direntry, |
130 | | int32_t *value); |
131 | | static enum TIFFReadDirEntryErr |
132 | | TIFFReadDirEntryCheckedLong8(TIFF *tif, TIFFDirEntry *direntry, |
133 | | uint64_t *value); |
134 | | static enum TIFFReadDirEntryErr |
135 | | TIFFReadDirEntryCheckedSlong8(TIFF *tif, TIFFDirEntry *direntry, |
136 | | int64_t *value); |
137 | | static enum TIFFReadDirEntryErr |
138 | | TIFFReadDirEntryCheckedRational(TIFF *tif, TIFFDirEntry *direntry, |
139 | | double *value); |
140 | | static enum TIFFReadDirEntryErr |
141 | | TIFFReadDirEntryCheckedSrational(TIFF *tif, TIFFDirEntry *direntry, |
142 | | double *value); |
143 | | static void TIFFReadDirEntryCheckedFloat(TIFF *tif, TIFFDirEntry *direntry, |
144 | | float *value); |
145 | | static enum TIFFReadDirEntryErr |
146 | | TIFFReadDirEntryCheckedDouble(TIFF *tif, TIFFDirEntry *direntry, double *value); |
147 | | #if 0 |
148 | | static enum TIFFReadDirEntryErr |
149 | | TIFFReadDirEntryCheckedRationalDirect(TIFF *tif, TIFFDirEntry *direntry, |
150 | | TIFFRational_t *value); |
151 | | #endif |
152 | | static enum TIFFReadDirEntryErr |
153 | | TIFFReadDirEntryCheckRangeByteSbyte(int8_t value); |
154 | | static enum TIFFReadDirEntryErr |
155 | | TIFFReadDirEntryCheckRangeByteShort(uint16_t value); |
156 | | static enum TIFFReadDirEntryErr |
157 | | TIFFReadDirEntryCheckRangeByteSshort(int16_t value); |
158 | | static enum TIFFReadDirEntryErr |
159 | | TIFFReadDirEntryCheckRangeByteLong(uint32_t value); |
160 | | static enum TIFFReadDirEntryErr |
161 | | TIFFReadDirEntryCheckRangeByteSlong(int32_t value); |
162 | | static enum TIFFReadDirEntryErr |
163 | | TIFFReadDirEntryCheckRangeByteLong8(uint64_t value); |
164 | | static enum TIFFReadDirEntryErr |
165 | | TIFFReadDirEntryCheckRangeByteSlong8(int64_t value); |
166 | | |
167 | | static enum TIFFReadDirEntryErr |
168 | | TIFFReadDirEntryCheckRangeSbyteByte(uint8_t value); |
169 | | static enum TIFFReadDirEntryErr |
170 | | TIFFReadDirEntryCheckRangeSbyteShort(uint16_t value); |
171 | | static enum TIFFReadDirEntryErr |
172 | | TIFFReadDirEntryCheckRangeSbyteSshort(int16_t value); |
173 | | static enum TIFFReadDirEntryErr |
174 | | TIFFReadDirEntryCheckRangeSbyteLong(uint32_t value); |
175 | | static enum TIFFReadDirEntryErr |
176 | | TIFFReadDirEntryCheckRangeSbyteSlong(int32_t value); |
177 | | static enum TIFFReadDirEntryErr |
178 | | TIFFReadDirEntryCheckRangeSbyteLong8(uint64_t value); |
179 | | static enum TIFFReadDirEntryErr |
180 | | TIFFReadDirEntryCheckRangeSbyteSlong8(int64_t value); |
181 | | |
182 | | static enum TIFFReadDirEntryErr |
183 | | TIFFReadDirEntryCheckRangeShortSbyte(int8_t value); |
184 | | static enum TIFFReadDirEntryErr |
185 | | TIFFReadDirEntryCheckRangeShortSshort(int16_t value); |
186 | | static enum TIFFReadDirEntryErr |
187 | | TIFFReadDirEntryCheckRangeShortLong(uint32_t value); |
188 | | static enum TIFFReadDirEntryErr |
189 | | TIFFReadDirEntryCheckRangeShortSlong(int32_t value); |
190 | | static enum TIFFReadDirEntryErr |
191 | | TIFFReadDirEntryCheckRangeShortLong8(uint64_t value); |
192 | | static enum TIFFReadDirEntryErr |
193 | | TIFFReadDirEntryCheckRangeShortSlong8(int64_t value); |
194 | | |
195 | | static enum TIFFReadDirEntryErr |
196 | | TIFFReadDirEntryCheckRangeSshortShort(uint16_t value); |
197 | | static enum TIFFReadDirEntryErr |
198 | | TIFFReadDirEntryCheckRangeSshortLong(uint32_t value); |
199 | | static enum TIFFReadDirEntryErr |
200 | | TIFFReadDirEntryCheckRangeSshortSlong(int32_t value); |
201 | | static enum TIFFReadDirEntryErr |
202 | | TIFFReadDirEntryCheckRangeSshortLong8(uint64_t value); |
203 | | static enum TIFFReadDirEntryErr |
204 | | TIFFReadDirEntryCheckRangeSshortSlong8(int64_t value); |
205 | | |
206 | | static enum TIFFReadDirEntryErr |
207 | | TIFFReadDirEntryCheckRangeLongSbyte(int8_t value); |
208 | | static enum TIFFReadDirEntryErr |
209 | | TIFFReadDirEntryCheckRangeLongSshort(int16_t value); |
210 | | static enum TIFFReadDirEntryErr |
211 | | TIFFReadDirEntryCheckRangeLongSlong(int32_t value); |
212 | | static enum TIFFReadDirEntryErr |
213 | | TIFFReadDirEntryCheckRangeLongLong8(uint64_t value); |
214 | | static enum TIFFReadDirEntryErr |
215 | | TIFFReadDirEntryCheckRangeLongSlong8(int64_t value); |
216 | | |
217 | | static enum TIFFReadDirEntryErr |
218 | | TIFFReadDirEntryCheckRangeSlongLong(uint32_t value); |
219 | | static enum TIFFReadDirEntryErr |
220 | | TIFFReadDirEntryCheckRangeSlongLong8(uint64_t value); |
221 | | static enum TIFFReadDirEntryErr |
222 | | TIFFReadDirEntryCheckRangeSlongSlong8(int64_t value); |
223 | | |
224 | | static enum TIFFReadDirEntryErr |
225 | | TIFFReadDirEntryCheckRangeLong8Sbyte(int8_t value); |
226 | | static enum TIFFReadDirEntryErr |
227 | | TIFFReadDirEntryCheckRangeLong8Sshort(int16_t value); |
228 | | static enum TIFFReadDirEntryErr |
229 | | TIFFReadDirEntryCheckRangeLong8Slong(int32_t value); |
230 | | static enum TIFFReadDirEntryErr |
231 | | TIFFReadDirEntryCheckRangeLong8Slong8(int64_t value); |
232 | | |
233 | | static enum TIFFReadDirEntryErr |
234 | | TIFFReadDirEntryCheckRangeSlong8Long8(uint64_t value); |
235 | | |
236 | | static enum TIFFReadDirEntryErr TIFFReadDirEntryData(TIFF *tif, uint64_t offset, |
237 | | tmsize_t size, void *dest); |
238 | | static void TIFFReadDirEntryOutputErr(TIFF *tif, enum TIFFReadDirEntryErr err, |
239 | | const char *module, const char *tagname, |
240 | | int recover); |
241 | | |
242 | | static void TIFFReadDirectoryCheckOrder(TIFF *tif, TIFFDirEntry *dir, |
243 | | uint16_t dircount); |
244 | | static TIFFDirEntry *TIFFReadDirectoryFindEntry(TIFF *tif, TIFFDirEntry *dir, |
245 | | uint16_t dircount, |
246 | | uint16_t tagid); |
247 | | static void TIFFReadDirectoryFindFieldInfo(TIFF *tif, uint16_t tagid, |
248 | | uint32_t *fii); |
249 | | |
250 | | static int EstimateStripByteCounts(TIFF *tif, TIFFDirEntry *dir, |
251 | | uint16_t dircount); |
252 | | static void MissingRequired(TIFF *, const char *); |
253 | | static int CheckDirCount(TIFF *, TIFFDirEntry *, uint32_t); |
254 | | static uint16_t TIFFFetchDirectory(TIFF *tif, uint64_t diroff, |
255 | | TIFFDirEntry **pdir, uint64_t *nextdiroff); |
256 | | static int TIFFFetchNormalTag(TIFF *, TIFFDirEntry *, int recover); |
257 | | static int TIFFFetchStripThing(TIFF *tif, TIFFDirEntry *dir, uint32_t nstrips, |
258 | | uint64_t **lpp); |
259 | | static int TIFFFetchSubjectDistance(TIFF *, TIFFDirEntry *); |
260 | | static void ChopUpSingleUncompressedStrip(TIFF *); |
261 | | static void TryChopUpUncompressedBigTiff(TIFF *); |
262 | | static uint64_t TIFFReadUInt64(const uint8_t *value); |
263 | | static int _TIFFGetMaxColorChannels(uint16_t photometric); |
264 | | |
265 | | static int _TIFFFillStrilesInternal(TIFF *tif, int loadStripByteCount); |
266 | | |
267 | | typedef union _UInt64Aligned_t |
268 | | { |
269 | | double d; |
270 | | uint64_t l; |
271 | | uint32_t i[2]; |
272 | | uint16_t s[4]; |
273 | | uint8_t c[8]; |
274 | | } UInt64Aligned_t; |
275 | | |
276 | | /* |
277 | | Unaligned safe copy of a uint64_t value from an octet array. |
278 | | */ |
279 | | static uint64_t TIFFReadUInt64(const uint8_t *value) |
280 | 0 | { |
281 | 0 | UInt64Aligned_t result; |
282 | |
|
283 | 0 | result.c[0] = value[0]; |
284 | 0 | result.c[1] = value[1]; |
285 | 0 | result.c[2] = value[2]; |
286 | 0 | result.c[3] = value[3]; |
287 | 0 | result.c[4] = value[4]; |
288 | 0 | result.c[5] = value[5]; |
289 | 0 | result.c[6] = value[6]; |
290 | 0 | result.c[7] = value[7]; |
291 | |
|
292 | 0 | return result.l; |
293 | 0 | } |
294 | | |
295 | | static enum TIFFReadDirEntryErr |
296 | | TIFFReadDirEntryByte(TIFF *tif, TIFFDirEntry *direntry, uint8_t *value) |
297 | 0 | { |
298 | 0 | enum TIFFReadDirEntryErr err; |
299 | 0 | if (direntry->tdir_count != 1) |
300 | 0 | return (TIFFReadDirEntryErrCount); |
301 | 0 | switch (direntry->tdir_type) |
302 | 0 | { |
303 | 0 | case TIFF_BYTE: |
304 | 0 | case TIFF_UNDEFINED: /* Support to read TIFF_UNDEFINED with |
305 | | field_readcount==1 */ |
306 | 0 | TIFFReadDirEntryCheckedByte(tif, direntry, value); |
307 | 0 | return (TIFFReadDirEntryErrOk); |
308 | 0 | case TIFF_SBYTE: |
309 | 0 | { |
310 | 0 | int8_t m; |
311 | 0 | TIFFReadDirEntryCheckedSbyte(tif, direntry, &m); |
312 | 0 | err = TIFFReadDirEntryCheckRangeByteSbyte(m); |
313 | 0 | if (err != TIFFReadDirEntryErrOk) |
314 | 0 | return (err); |
315 | 0 | *value = (uint8_t)m; |
316 | 0 | return (TIFFReadDirEntryErrOk); |
317 | 0 | } |
318 | 0 | case TIFF_SHORT: |
319 | 0 | { |
320 | 0 | uint16_t m; |
321 | 0 | TIFFReadDirEntryCheckedShort(tif, direntry, &m); |
322 | 0 | err = TIFFReadDirEntryCheckRangeByteShort(m); |
323 | 0 | if (err != TIFFReadDirEntryErrOk) |
324 | 0 | return (err); |
325 | 0 | *value = (uint8_t)m; |
326 | 0 | return (TIFFReadDirEntryErrOk); |
327 | 0 | } |
328 | 0 | case TIFF_SSHORT: |
329 | 0 | { |
330 | 0 | int16_t m; |
331 | 0 | TIFFReadDirEntryCheckedSshort(tif, direntry, &m); |
332 | 0 | err = TIFFReadDirEntryCheckRangeByteSshort(m); |
333 | 0 | if (err != TIFFReadDirEntryErrOk) |
334 | 0 | return (err); |
335 | 0 | *value = (uint8_t)m; |
336 | 0 | return (TIFFReadDirEntryErrOk); |
337 | 0 | } |
338 | 0 | case TIFF_LONG: |
339 | 0 | { |
340 | 0 | uint32_t m; |
341 | 0 | TIFFReadDirEntryCheckedLong(tif, direntry, &m); |
342 | 0 | err = TIFFReadDirEntryCheckRangeByteLong(m); |
343 | 0 | if (err != TIFFReadDirEntryErrOk) |
344 | 0 | return (err); |
345 | 0 | *value = (uint8_t)m; |
346 | 0 | return (TIFFReadDirEntryErrOk); |
347 | 0 | } |
348 | 0 | case TIFF_SLONG: |
349 | 0 | { |
350 | 0 | int32_t m; |
351 | 0 | TIFFReadDirEntryCheckedSlong(tif, direntry, &m); |
352 | 0 | err = TIFFReadDirEntryCheckRangeByteSlong(m); |
353 | 0 | if (err != TIFFReadDirEntryErrOk) |
354 | 0 | return (err); |
355 | 0 | *value = (uint8_t)m; |
356 | 0 | return (TIFFReadDirEntryErrOk); |
357 | 0 | } |
358 | 0 | case TIFF_LONG8: |
359 | 0 | { |
360 | 0 | uint64_t m; |
361 | 0 | err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m); |
362 | 0 | if (err != TIFFReadDirEntryErrOk) |
363 | 0 | return (err); |
364 | 0 | err = TIFFReadDirEntryCheckRangeByteLong8(m); |
365 | 0 | if (err != TIFFReadDirEntryErrOk) |
366 | 0 | return (err); |
367 | 0 | *value = (uint8_t)m; |
368 | 0 | return (TIFFReadDirEntryErrOk); |
369 | 0 | } |
370 | 0 | case TIFF_SLONG8: |
371 | 0 | { |
372 | 0 | int64_t m; |
373 | 0 | err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m); |
374 | 0 | if (err != TIFFReadDirEntryErrOk) |
375 | 0 | return (err); |
376 | 0 | err = TIFFReadDirEntryCheckRangeByteSlong8(m); |
377 | 0 | if (err != TIFFReadDirEntryErrOk) |
378 | 0 | return (err); |
379 | 0 | *value = (uint8_t)m; |
380 | 0 | return (TIFFReadDirEntryErrOk); |
381 | 0 | } |
382 | 0 | default: |
383 | 0 | return (TIFFReadDirEntryErrType); |
384 | 0 | } |
385 | 0 | } |
386 | | |
387 | | static enum TIFFReadDirEntryErr |
388 | | TIFFReadDirEntrySbyte(TIFF *tif, TIFFDirEntry *direntry, int8_t *value) |
389 | 0 | { |
390 | 0 | enum TIFFReadDirEntryErr err; |
391 | 0 | if (direntry->tdir_count != 1) |
392 | 0 | return (TIFFReadDirEntryErrCount); |
393 | 0 | switch (direntry->tdir_type) |
394 | 0 | { |
395 | 0 | case TIFF_BYTE: |
396 | 0 | case TIFF_UNDEFINED: /* Support to read TIFF_UNDEFINED with |
397 | | field_readcount==1 */ |
398 | 0 | { |
399 | 0 | uint8_t m; |
400 | 0 | TIFFReadDirEntryCheckedByte(tif, direntry, &m); |
401 | 0 | err = TIFFReadDirEntryCheckRangeSbyteByte(m); |
402 | 0 | if (err != TIFFReadDirEntryErrOk) |
403 | 0 | return (err); |
404 | 0 | *value = (int8_t)m; |
405 | 0 | return (TIFFReadDirEntryErrOk); |
406 | 0 | } |
407 | 0 | case TIFF_SBYTE: |
408 | 0 | { |
409 | 0 | TIFFReadDirEntryCheckedSbyte(tif, direntry, value); |
410 | 0 | return (TIFFReadDirEntryErrOk); |
411 | 0 | } |
412 | 0 | case TIFF_SHORT: |
413 | 0 | { |
414 | 0 | uint16_t m; |
415 | 0 | TIFFReadDirEntryCheckedShort(tif, direntry, &m); |
416 | 0 | err = TIFFReadDirEntryCheckRangeSbyteShort(m); |
417 | 0 | if (err != TIFFReadDirEntryErrOk) |
418 | 0 | return (err); |
419 | 0 | *value = (int8_t)m; |
420 | 0 | return (TIFFReadDirEntryErrOk); |
421 | 0 | } |
422 | 0 | case TIFF_SSHORT: |
423 | 0 | { |
424 | 0 | int16_t m; |
425 | 0 | TIFFReadDirEntryCheckedSshort(tif, direntry, &m); |
426 | 0 | err = TIFFReadDirEntryCheckRangeSbyteSshort(m); |
427 | 0 | if (err != TIFFReadDirEntryErrOk) |
428 | 0 | return (err); |
429 | 0 | *value = (int8_t)m; |
430 | 0 | return (TIFFReadDirEntryErrOk); |
431 | 0 | } |
432 | 0 | case TIFF_LONG: |
433 | 0 | { |
434 | 0 | uint32_t m; |
435 | 0 | TIFFReadDirEntryCheckedLong(tif, direntry, &m); |
436 | 0 | err = TIFFReadDirEntryCheckRangeSbyteLong(m); |
437 | 0 | if (err != TIFFReadDirEntryErrOk) |
438 | 0 | return (err); |
439 | 0 | *value = (int8_t)m; |
440 | 0 | return (TIFFReadDirEntryErrOk); |
441 | 0 | } |
442 | 0 | case TIFF_SLONG: |
443 | 0 | { |
444 | 0 | int32_t m; |
445 | 0 | TIFFReadDirEntryCheckedSlong(tif, direntry, &m); |
446 | 0 | err = TIFFReadDirEntryCheckRangeSbyteSlong(m); |
447 | 0 | if (err != TIFFReadDirEntryErrOk) |
448 | 0 | return (err); |
449 | 0 | *value = (int8_t)m; |
450 | 0 | return (TIFFReadDirEntryErrOk); |
451 | 0 | } |
452 | 0 | case TIFF_LONG8: |
453 | 0 | { |
454 | 0 | uint64_t m; |
455 | 0 | err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m); |
456 | 0 | if (err != TIFFReadDirEntryErrOk) |
457 | 0 | return (err); |
458 | 0 | err = TIFFReadDirEntryCheckRangeSbyteLong8(m); |
459 | 0 | if (err != TIFFReadDirEntryErrOk) |
460 | 0 | return (err); |
461 | 0 | *value = (int8_t)m; |
462 | 0 | return (TIFFReadDirEntryErrOk); |
463 | 0 | } |
464 | 0 | case TIFF_SLONG8: |
465 | 0 | { |
466 | 0 | int64_t m; |
467 | 0 | err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m); |
468 | 0 | if (err != TIFFReadDirEntryErrOk) |
469 | 0 | return (err); |
470 | 0 | err = TIFFReadDirEntryCheckRangeSbyteSlong8(m); |
471 | 0 | if (err != TIFFReadDirEntryErrOk) |
472 | 0 | return (err); |
473 | 0 | *value = (int8_t)m; |
474 | 0 | return (TIFFReadDirEntryErrOk); |
475 | 0 | } |
476 | 0 | default: |
477 | 0 | return (TIFFReadDirEntryErrType); |
478 | 0 | } |
479 | 0 | } /*-- TIFFReadDirEntrySbyte() --*/ |
480 | | |
481 | | static enum TIFFReadDirEntryErr |
482 | | TIFFReadDirEntryShort(TIFF *tif, TIFFDirEntry *direntry, uint16_t *value) |
483 | 0 | { |
484 | 0 | enum TIFFReadDirEntryErr err; |
485 | 0 | if (direntry->tdir_count != 1) |
486 | 0 | return (TIFFReadDirEntryErrCount); |
487 | 0 | switch (direntry->tdir_type) |
488 | 0 | { |
489 | 0 | case TIFF_BYTE: |
490 | 0 | { |
491 | 0 | uint8_t m; |
492 | 0 | TIFFReadDirEntryCheckedByte(tif, direntry, &m); |
493 | 0 | *value = (uint16_t)m; |
494 | 0 | return (TIFFReadDirEntryErrOk); |
495 | 0 | } |
496 | 0 | case TIFF_SBYTE: |
497 | 0 | { |
498 | 0 | int8_t m; |
499 | 0 | TIFFReadDirEntryCheckedSbyte(tif, direntry, &m); |
500 | 0 | err = TIFFReadDirEntryCheckRangeShortSbyte(m); |
501 | 0 | if (err != TIFFReadDirEntryErrOk) |
502 | 0 | return (err); |
503 | 0 | *value = (uint16_t)m; |
504 | 0 | return (TIFFReadDirEntryErrOk); |
505 | 0 | } |
506 | 0 | case TIFF_SHORT: |
507 | 0 | TIFFReadDirEntryCheckedShort(tif, direntry, value); |
508 | 0 | return (TIFFReadDirEntryErrOk); |
509 | 0 | case TIFF_SSHORT: |
510 | 0 | { |
511 | 0 | int16_t m; |
512 | 0 | TIFFReadDirEntryCheckedSshort(tif, direntry, &m); |
513 | 0 | err = TIFFReadDirEntryCheckRangeShortSshort(m); |
514 | 0 | if (err != TIFFReadDirEntryErrOk) |
515 | 0 | return (err); |
516 | 0 | *value = (uint16_t)m; |
517 | 0 | return (TIFFReadDirEntryErrOk); |
518 | 0 | } |
519 | 0 | case TIFF_LONG: |
520 | 0 | { |
521 | 0 | uint32_t m; |
522 | 0 | TIFFReadDirEntryCheckedLong(tif, direntry, &m); |
523 | 0 | err = TIFFReadDirEntryCheckRangeShortLong(m); |
524 | 0 | if (err != TIFFReadDirEntryErrOk) |
525 | 0 | return (err); |
526 | 0 | *value = (uint16_t)m; |
527 | 0 | return (TIFFReadDirEntryErrOk); |
528 | 0 | } |
529 | 0 | case TIFF_SLONG: |
530 | 0 | { |
531 | 0 | int32_t m; |
532 | 0 | TIFFReadDirEntryCheckedSlong(tif, direntry, &m); |
533 | 0 | err = TIFFReadDirEntryCheckRangeShortSlong(m); |
534 | 0 | if (err != TIFFReadDirEntryErrOk) |
535 | 0 | return (err); |
536 | 0 | *value = (uint16_t)m; |
537 | 0 | return (TIFFReadDirEntryErrOk); |
538 | 0 | } |
539 | 0 | case TIFF_LONG8: |
540 | 0 | { |
541 | 0 | uint64_t m; |
542 | 0 | err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m); |
543 | 0 | if (err != TIFFReadDirEntryErrOk) |
544 | 0 | return (err); |
545 | 0 | err = TIFFReadDirEntryCheckRangeShortLong8(m); |
546 | 0 | if (err != TIFFReadDirEntryErrOk) |
547 | 0 | return (err); |
548 | 0 | *value = (uint16_t)m; |
549 | 0 | return (TIFFReadDirEntryErrOk); |
550 | 0 | } |
551 | 0 | case TIFF_SLONG8: |
552 | 0 | { |
553 | 0 | int64_t m; |
554 | 0 | err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m); |
555 | 0 | if (err != TIFFReadDirEntryErrOk) |
556 | 0 | return (err); |
557 | 0 | err = TIFFReadDirEntryCheckRangeShortSlong8(m); |
558 | 0 | if (err != TIFFReadDirEntryErrOk) |
559 | 0 | return (err); |
560 | 0 | *value = (uint16_t)m; |
561 | 0 | return (TIFFReadDirEntryErrOk); |
562 | 0 | } |
563 | 0 | default: |
564 | 0 | return (TIFFReadDirEntryErrType); |
565 | 0 | } |
566 | 0 | } /*-- TIFFReadDirEntryShort() --*/ |
567 | | |
568 | | static enum TIFFReadDirEntryErr |
569 | | TIFFReadDirEntrySshort(TIFF *tif, TIFFDirEntry *direntry, int16_t *value) |
570 | 0 | { |
571 | 0 | enum TIFFReadDirEntryErr err; |
572 | 0 | if (direntry->tdir_count != 1) |
573 | 0 | return (TIFFReadDirEntryErrCount); |
574 | 0 | switch (direntry->tdir_type) |
575 | 0 | { |
576 | 0 | case TIFF_BYTE: |
577 | 0 | { |
578 | 0 | uint8_t m; |
579 | 0 | TIFFReadDirEntryCheckedByte(tif, direntry, &m); |
580 | 0 | *value = (int16_t)m; |
581 | 0 | return (TIFFReadDirEntryErrOk); |
582 | 0 | } |
583 | 0 | case TIFF_SBYTE: |
584 | 0 | { |
585 | 0 | int8_t m; |
586 | 0 | TIFFReadDirEntryCheckedSbyte(tif, direntry, &m); |
587 | 0 | *value = (int16_t)m; |
588 | 0 | return (TIFFReadDirEntryErrOk); |
589 | 0 | } |
590 | 0 | case TIFF_SHORT: |
591 | 0 | { |
592 | 0 | uint16_t m; |
593 | 0 | TIFFReadDirEntryCheckedShort(tif, direntry, &m); |
594 | 0 | err = TIFFReadDirEntryCheckRangeSshortShort(m); |
595 | 0 | if (err != TIFFReadDirEntryErrOk) |
596 | 0 | return (err); |
597 | 0 | *value = (uint16_t)m; |
598 | 0 | return (TIFFReadDirEntryErrOk); |
599 | 0 | } |
600 | 0 | case TIFF_SSHORT: |
601 | 0 | TIFFReadDirEntryCheckedSshort(tif, direntry, value); |
602 | 0 | return (TIFFReadDirEntryErrOk); |
603 | 0 | case TIFF_LONG: |
604 | 0 | { |
605 | 0 | uint32_t m; |
606 | 0 | TIFFReadDirEntryCheckedLong(tif, direntry, &m); |
607 | 0 | err = TIFFReadDirEntryCheckRangeSshortLong(m); |
608 | 0 | if (err != TIFFReadDirEntryErrOk) |
609 | 0 | return (err); |
610 | 0 | *value = (int16_t)m; |
611 | 0 | return (TIFFReadDirEntryErrOk); |
612 | 0 | } |
613 | 0 | case TIFF_SLONG: |
614 | 0 | { |
615 | 0 | int32_t m; |
616 | 0 | TIFFReadDirEntryCheckedSlong(tif, direntry, &m); |
617 | 0 | err = TIFFReadDirEntryCheckRangeSshortSlong(m); |
618 | 0 | if (err != TIFFReadDirEntryErrOk) |
619 | 0 | return (err); |
620 | 0 | *value = (int16_t)m; |
621 | 0 | return (TIFFReadDirEntryErrOk); |
622 | 0 | } |
623 | 0 | case TIFF_LONG8: |
624 | 0 | { |
625 | 0 | uint64_t m; |
626 | 0 | err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m); |
627 | 0 | if (err != TIFFReadDirEntryErrOk) |
628 | 0 | return (err); |
629 | 0 | err = TIFFReadDirEntryCheckRangeSshortLong8(m); |
630 | 0 | if (err != TIFFReadDirEntryErrOk) |
631 | 0 | return (err); |
632 | 0 | *value = (int16_t)m; |
633 | 0 | return (TIFFReadDirEntryErrOk); |
634 | 0 | } |
635 | 0 | case TIFF_SLONG8: |
636 | 0 | { |
637 | 0 | int64_t m; |
638 | 0 | err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m); |
639 | 0 | if (err != TIFFReadDirEntryErrOk) |
640 | 0 | return (err); |
641 | 0 | err = TIFFReadDirEntryCheckRangeSshortSlong8(m); |
642 | 0 | if (err != TIFFReadDirEntryErrOk) |
643 | 0 | return (err); |
644 | 0 | *value = (int16_t)m; |
645 | 0 | return (TIFFReadDirEntryErrOk); |
646 | 0 | } |
647 | 0 | default: |
648 | 0 | return (TIFFReadDirEntryErrType); |
649 | 0 | } |
650 | 0 | } /*-- TIFFReadDirEntrySshort() --*/ |
651 | | |
652 | | static enum TIFFReadDirEntryErr |
653 | | TIFFReadDirEntryLong(TIFF *tif, TIFFDirEntry *direntry, uint32_t *value) |
654 | 0 | { |
655 | 0 | enum TIFFReadDirEntryErr err; |
656 | 0 | if (direntry->tdir_count != 1) |
657 | 0 | return (TIFFReadDirEntryErrCount); |
658 | 0 | switch (direntry->tdir_type) |
659 | 0 | { |
660 | 0 | case TIFF_BYTE: |
661 | 0 | { |
662 | 0 | uint8_t m; |
663 | 0 | TIFFReadDirEntryCheckedByte(tif, direntry, &m); |
664 | 0 | *value = (uint32_t)m; |
665 | 0 | return (TIFFReadDirEntryErrOk); |
666 | 0 | } |
667 | 0 | case TIFF_SBYTE: |
668 | 0 | { |
669 | 0 | int8_t m; |
670 | 0 | TIFFReadDirEntryCheckedSbyte(tif, direntry, &m); |
671 | 0 | err = TIFFReadDirEntryCheckRangeLongSbyte(m); |
672 | 0 | if (err != TIFFReadDirEntryErrOk) |
673 | 0 | return (err); |
674 | 0 | *value = (uint32_t)m; |
675 | 0 | return (TIFFReadDirEntryErrOk); |
676 | 0 | } |
677 | 0 | case TIFF_SHORT: |
678 | 0 | { |
679 | 0 | uint16_t m; |
680 | 0 | TIFFReadDirEntryCheckedShort(tif, direntry, &m); |
681 | 0 | *value = (uint32_t)m; |
682 | 0 | return (TIFFReadDirEntryErrOk); |
683 | 0 | } |
684 | 0 | case TIFF_SSHORT: |
685 | 0 | { |
686 | 0 | int16_t m; |
687 | 0 | TIFFReadDirEntryCheckedSshort(tif, direntry, &m); |
688 | 0 | err = TIFFReadDirEntryCheckRangeLongSshort(m); |
689 | 0 | if (err != TIFFReadDirEntryErrOk) |
690 | 0 | return (err); |
691 | 0 | *value = (uint32_t)m; |
692 | 0 | return (TIFFReadDirEntryErrOk); |
693 | 0 | } |
694 | 0 | case TIFF_LONG: |
695 | 0 | TIFFReadDirEntryCheckedLong(tif, direntry, value); |
696 | 0 | return (TIFFReadDirEntryErrOk); |
697 | 0 | case TIFF_SLONG: |
698 | 0 | { |
699 | 0 | int32_t m; |
700 | 0 | TIFFReadDirEntryCheckedSlong(tif, direntry, &m); |
701 | 0 | err = TIFFReadDirEntryCheckRangeLongSlong(m); |
702 | 0 | if (err != TIFFReadDirEntryErrOk) |
703 | 0 | return (err); |
704 | 0 | *value = (uint32_t)m; |
705 | 0 | return (TIFFReadDirEntryErrOk); |
706 | 0 | } |
707 | 0 | case TIFF_LONG8: |
708 | 0 | { |
709 | 0 | uint64_t m; |
710 | 0 | err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m); |
711 | 0 | if (err != TIFFReadDirEntryErrOk) |
712 | 0 | return (err); |
713 | 0 | err = TIFFReadDirEntryCheckRangeLongLong8(m); |
714 | 0 | if (err != TIFFReadDirEntryErrOk) |
715 | 0 | return (err); |
716 | 0 | *value = (uint32_t)m; |
717 | 0 | return (TIFFReadDirEntryErrOk); |
718 | 0 | } |
719 | 0 | case TIFF_SLONG8: |
720 | 0 | { |
721 | 0 | int64_t m; |
722 | 0 | err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m); |
723 | 0 | if (err != TIFFReadDirEntryErrOk) |
724 | 0 | return (err); |
725 | 0 | err = TIFFReadDirEntryCheckRangeLongSlong8(m); |
726 | 0 | if (err != TIFFReadDirEntryErrOk) |
727 | 0 | return (err); |
728 | 0 | *value = (uint32_t)m; |
729 | 0 | return (TIFFReadDirEntryErrOk); |
730 | 0 | } |
731 | 0 | default: |
732 | 0 | return (TIFFReadDirEntryErrType); |
733 | 0 | } |
734 | 0 | } /*-- TIFFReadDirEntryLong() --*/ |
735 | | |
736 | | static enum TIFFReadDirEntryErr |
737 | | TIFFReadDirEntrySlong(TIFF *tif, TIFFDirEntry *direntry, int32_t *value) |
738 | 0 | { |
739 | 0 | enum TIFFReadDirEntryErr err; |
740 | 0 | if (direntry->tdir_count != 1) |
741 | 0 | return (TIFFReadDirEntryErrCount); |
742 | 0 | switch (direntry->tdir_type) |
743 | 0 | { |
744 | 0 | case TIFF_BYTE: |
745 | 0 | { |
746 | 0 | uint8_t m; |
747 | 0 | TIFFReadDirEntryCheckedByte(tif, direntry, &m); |
748 | 0 | *value = (int32_t)m; |
749 | 0 | return (TIFFReadDirEntryErrOk); |
750 | 0 | } |
751 | 0 | case TIFF_SBYTE: |
752 | 0 | { |
753 | 0 | int8_t m; |
754 | 0 | TIFFReadDirEntryCheckedSbyte(tif, direntry, &m); |
755 | 0 | *value = (int32_t)m; |
756 | 0 | return (TIFFReadDirEntryErrOk); |
757 | 0 | } |
758 | 0 | case TIFF_SHORT: |
759 | 0 | { |
760 | 0 | uint16_t m; |
761 | 0 | TIFFReadDirEntryCheckedShort(tif, direntry, &m); |
762 | 0 | *value = (int32_t)m; |
763 | 0 | return (TIFFReadDirEntryErrOk); |
764 | 0 | } |
765 | 0 | case TIFF_SSHORT: |
766 | 0 | { |
767 | 0 | int16_t m; |
768 | 0 | TIFFReadDirEntryCheckedSshort(tif, direntry, &m); |
769 | 0 | *value = (int32_t)m; |
770 | 0 | return (TIFFReadDirEntryErrOk); |
771 | 0 | } |
772 | 0 | case TIFF_LONG: |
773 | 0 | { |
774 | 0 | uint32_t m; |
775 | 0 | TIFFReadDirEntryCheckedLong(tif, direntry, &m); |
776 | 0 | err = TIFFReadDirEntryCheckRangeSlongLong(m); |
777 | 0 | if (err != TIFFReadDirEntryErrOk) |
778 | 0 | return (err); |
779 | 0 | *value = (int32_t)m; |
780 | 0 | return (TIFFReadDirEntryErrOk); |
781 | 0 | } |
782 | 0 | case TIFF_SLONG: |
783 | 0 | TIFFReadDirEntryCheckedSlong(tif, direntry, value); |
784 | 0 | return (TIFFReadDirEntryErrOk); |
785 | 0 | case TIFF_LONG8: |
786 | 0 | { |
787 | 0 | uint64_t m; |
788 | 0 | err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m); |
789 | 0 | if (err != TIFFReadDirEntryErrOk) |
790 | 0 | return (err); |
791 | 0 | err = TIFFReadDirEntryCheckRangeSlongLong8(m); |
792 | 0 | if (err != TIFFReadDirEntryErrOk) |
793 | 0 | return (err); |
794 | 0 | *value = (int32_t)m; |
795 | 0 | return (TIFFReadDirEntryErrOk); |
796 | 0 | } |
797 | 0 | case TIFF_SLONG8: |
798 | 0 | { |
799 | 0 | int64_t m; |
800 | 0 | err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m); |
801 | 0 | if (err != TIFFReadDirEntryErrOk) |
802 | 0 | return (err); |
803 | 0 | err = TIFFReadDirEntryCheckRangeSlongSlong8(m); |
804 | 0 | if (err != TIFFReadDirEntryErrOk) |
805 | 0 | return (err); |
806 | 0 | *value = (int32_t)m; |
807 | 0 | return (TIFFReadDirEntryErrOk); |
808 | 0 | } |
809 | 0 | default: |
810 | 0 | return (TIFFReadDirEntryErrType); |
811 | 0 | } |
812 | 0 | } /*-- TIFFReadDirEntrySlong() --*/ |
813 | | |
814 | | static enum TIFFReadDirEntryErr |
815 | | TIFFReadDirEntryLong8(TIFF *tif, TIFFDirEntry *direntry, uint64_t *value) |
816 | 0 | { |
817 | 0 | enum TIFFReadDirEntryErr err; |
818 | 0 | if (direntry->tdir_count != 1) |
819 | 0 | return (TIFFReadDirEntryErrCount); |
820 | 0 | switch (direntry->tdir_type) |
821 | 0 | { |
822 | 0 | case TIFF_BYTE: |
823 | 0 | { |
824 | 0 | uint8_t m; |
825 | 0 | TIFFReadDirEntryCheckedByte(tif, direntry, &m); |
826 | 0 | *value = (uint64_t)m; |
827 | 0 | return (TIFFReadDirEntryErrOk); |
828 | 0 | } |
829 | 0 | case TIFF_SBYTE: |
830 | 0 | { |
831 | 0 | int8_t m; |
832 | 0 | TIFFReadDirEntryCheckedSbyte(tif, direntry, &m); |
833 | 0 | err = TIFFReadDirEntryCheckRangeLong8Sbyte(m); |
834 | 0 | if (err != TIFFReadDirEntryErrOk) |
835 | 0 | return (err); |
836 | 0 | *value = (uint64_t)m; |
837 | 0 | return (TIFFReadDirEntryErrOk); |
838 | 0 | } |
839 | 0 | case TIFF_SHORT: |
840 | 0 | { |
841 | 0 | uint16_t m; |
842 | 0 | TIFFReadDirEntryCheckedShort(tif, direntry, &m); |
843 | 0 | *value = (uint64_t)m; |
844 | 0 | return (TIFFReadDirEntryErrOk); |
845 | 0 | } |
846 | 0 | case TIFF_SSHORT: |
847 | 0 | { |
848 | 0 | int16_t m; |
849 | 0 | TIFFReadDirEntryCheckedSshort(tif, direntry, &m); |
850 | 0 | err = TIFFReadDirEntryCheckRangeLong8Sshort(m); |
851 | 0 | if (err != TIFFReadDirEntryErrOk) |
852 | 0 | return (err); |
853 | 0 | *value = (uint64_t)m; |
854 | 0 | return (TIFFReadDirEntryErrOk); |
855 | 0 | } |
856 | 0 | case TIFF_LONG: |
857 | 0 | { |
858 | 0 | uint32_t m; |
859 | 0 | TIFFReadDirEntryCheckedLong(tif, direntry, &m); |
860 | 0 | *value = (uint64_t)m; |
861 | 0 | return (TIFFReadDirEntryErrOk); |
862 | 0 | } |
863 | 0 | case TIFF_SLONG: |
864 | 0 | { |
865 | 0 | int32_t m; |
866 | 0 | TIFFReadDirEntryCheckedSlong(tif, direntry, &m); |
867 | 0 | err = TIFFReadDirEntryCheckRangeLong8Slong(m); |
868 | 0 | if (err != TIFFReadDirEntryErrOk) |
869 | 0 | return (err); |
870 | 0 | *value = (uint64_t)m; |
871 | 0 | return (TIFFReadDirEntryErrOk); |
872 | 0 | } |
873 | 0 | case TIFF_LONG8: |
874 | 0 | err = TIFFReadDirEntryCheckedLong8(tif, direntry, value); |
875 | 0 | return (err); |
876 | 0 | case TIFF_SLONG8: |
877 | 0 | { |
878 | 0 | int64_t m; |
879 | 0 | err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m); |
880 | 0 | if (err != TIFFReadDirEntryErrOk) |
881 | 0 | return (err); |
882 | 0 | err = TIFFReadDirEntryCheckRangeLong8Slong8(m); |
883 | 0 | if (err != TIFFReadDirEntryErrOk) |
884 | 0 | return (err); |
885 | 0 | *value = (uint64_t)m; |
886 | 0 | return (TIFFReadDirEntryErrOk); |
887 | 0 | } |
888 | 0 | default: |
889 | 0 | return (TIFFReadDirEntryErrType); |
890 | 0 | } |
891 | 0 | } /*-- TIFFReadDirEntryLong8() --*/ |
892 | | |
893 | | static enum TIFFReadDirEntryErr |
894 | | TIFFReadDirEntrySlong8(TIFF *tif, TIFFDirEntry *direntry, int64_t *value) |
895 | 0 | { |
896 | 0 | enum TIFFReadDirEntryErr err; |
897 | 0 | if (direntry->tdir_count != 1) |
898 | 0 | return (TIFFReadDirEntryErrCount); |
899 | 0 | switch (direntry->tdir_type) |
900 | 0 | { |
901 | 0 | case TIFF_BYTE: |
902 | 0 | { |
903 | 0 | uint8_t m; |
904 | 0 | TIFFReadDirEntryCheckedByte(tif, direntry, &m); |
905 | 0 | *value = (int64_t)m; |
906 | 0 | return (TIFFReadDirEntryErrOk); |
907 | 0 | } |
908 | 0 | case TIFF_SBYTE: |
909 | 0 | { |
910 | 0 | int8_t m; |
911 | 0 | TIFFReadDirEntryCheckedSbyte(tif, direntry, &m); |
912 | 0 | *value = (int64_t)m; |
913 | 0 | return (TIFFReadDirEntryErrOk); |
914 | 0 | } |
915 | 0 | case TIFF_SHORT: |
916 | 0 | { |
917 | 0 | uint16_t m; |
918 | 0 | TIFFReadDirEntryCheckedShort(tif, direntry, &m); |
919 | 0 | *value = (int64_t)m; |
920 | 0 | return (TIFFReadDirEntryErrOk); |
921 | 0 | } |
922 | 0 | case TIFF_SSHORT: |
923 | 0 | { |
924 | 0 | int16_t m; |
925 | 0 | TIFFReadDirEntryCheckedSshort(tif, direntry, &m); |
926 | 0 | *value = (int64_t)m; |
927 | 0 | return (TIFFReadDirEntryErrOk); |
928 | 0 | } |
929 | 0 | case TIFF_LONG: |
930 | 0 | { |
931 | 0 | uint32_t m; |
932 | 0 | TIFFReadDirEntryCheckedLong(tif, direntry, &m); |
933 | 0 | *value = (int64_t)m; |
934 | 0 | return (TIFFReadDirEntryErrOk); |
935 | 0 | } |
936 | 0 | case TIFF_SLONG: |
937 | 0 | { |
938 | 0 | int32_t m; |
939 | 0 | TIFFReadDirEntryCheckedSlong(tif, direntry, &m); |
940 | 0 | *value = (int64_t)m; |
941 | 0 | return (TIFFReadDirEntryErrOk); |
942 | 0 | } |
943 | 0 | case TIFF_LONG8: |
944 | 0 | { |
945 | 0 | uint64_t m; |
946 | 0 | err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m); |
947 | 0 | if (err != TIFFReadDirEntryErrOk) |
948 | 0 | return (err); |
949 | 0 | err = TIFFReadDirEntryCheckRangeSlong8Long8(m); |
950 | 0 | if (err != TIFFReadDirEntryErrOk) |
951 | 0 | return (err); |
952 | 0 | *value = (int64_t)m; |
953 | 0 | return (TIFFReadDirEntryErrOk); |
954 | 0 | } |
955 | 0 | case TIFF_SLONG8: |
956 | 0 | err = TIFFReadDirEntryCheckedSlong8(tif, direntry, value); |
957 | 0 | return (err); |
958 | 0 | default: |
959 | 0 | return (TIFFReadDirEntryErrType); |
960 | 0 | } |
961 | 0 | } /*-- TIFFReadDirEntrySlong8() --*/ |
962 | | |
963 | | static enum TIFFReadDirEntryErr |
964 | | TIFFReadDirEntryFloat(TIFF *tif, TIFFDirEntry *direntry, float *value) |
965 | 0 | { |
966 | 0 | enum TIFFReadDirEntryErr err; |
967 | 0 | if (direntry->tdir_count != 1) |
968 | 0 | return (TIFFReadDirEntryErrCount); |
969 | 0 | switch (direntry->tdir_type) |
970 | 0 | { |
971 | 0 | case TIFF_BYTE: |
972 | 0 | { |
973 | 0 | uint8_t m; |
974 | 0 | TIFFReadDirEntryCheckedByte(tif, direntry, &m); |
975 | 0 | *value = (float)m; |
976 | 0 | return (TIFFReadDirEntryErrOk); |
977 | 0 | } |
978 | 0 | case TIFF_SBYTE: |
979 | 0 | { |
980 | 0 | int8_t m; |
981 | 0 | TIFFReadDirEntryCheckedSbyte(tif, direntry, &m); |
982 | 0 | *value = (float)m; |
983 | 0 | return (TIFFReadDirEntryErrOk); |
984 | 0 | } |
985 | 0 | case TIFF_SHORT: |
986 | 0 | { |
987 | 0 | uint16_t m; |
988 | 0 | TIFFReadDirEntryCheckedShort(tif, direntry, &m); |
989 | 0 | *value = (float)m; |
990 | 0 | return (TIFFReadDirEntryErrOk); |
991 | 0 | } |
992 | 0 | case TIFF_SSHORT: |
993 | 0 | { |
994 | 0 | int16_t m; |
995 | 0 | TIFFReadDirEntryCheckedSshort(tif, direntry, &m); |
996 | 0 | *value = (float)m; |
997 | 0 | return (TIFFReadDirEntryErrOk); |
998 | 0 | } |
999 | 0 | case TIFF_LONG: |
1000 | 0 | { |
1001 | 0 | uint32_t m; |
1002 | 0 | TIFFReadDirEntryCheckedLong(tif, direntry, &m); |
1003 | 0 | *value = (float)m; |
1004 | 0 | return (TIFFReadDirEntryErrOk); |
1005 | 0 | } |
1006 | 0 | case TIFF_SLONG: |
1007 | 0 | { |
1008 | 0 | int32_t m; |
1009 | 0 | TIFFReadDirEntryCheckedSlong(tif, direntry, &m); |
1010 | 0 | *value = (float)m; |
1011 | 0 | return (TIFFReadDirEntryErrOk); |
1012 | 0 | } |
1013 | 0 | case TIFF_LONG8: |
1014 | 0 | { |
1015 | 0 | uint64_t m; |
1016 | 0 | err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m); |
1017 | 0 | if (err != TIFFReadDirEntryErrOk) |
1018 | 0 | return (err); |
1019 | 0 | *value = (float)m; |
1020 | 0 | return (TIFFReadDirEntryErrOk); |
1021 | 0 | } |
1022 | 0 | case TIFF_SLONG8: |
1023 | 0 | { |
1024 | 0 | int64_t m; |
1025 | 0 | err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m); |
1026 | 0 | if (err != TIFFReadDirEntryErrOk) |
1027 | 0 | return (err); |
1028 | 0 | *value = (float)m; |
1029 | 0 | return (TIFFReadDirEntryErrOk); |
1030 | 0 | } |
1031 | 0 | case TIFF_RATIONAL: |
1032 | 0 | { |
1033 | 0 | double m; |
1034 | 0 | err = TIFFReadDirEntryCheckedRational(tif, direntry, &m); |
1035 | 0 | if (err != TIFFReadDirEntryErrOk) |
1036 | 0 | return (err); |
1037 | 0 | *value = (float)m; |
1038 | 0 | return (TIFFReadDirEntryErrOk); |
1039 | 0 | } |
1040 | 0 | case TIFF_SRATIONAL: |
1041 | 0 | { |
1042 | 0 | double m; |
1043 | 0 | err = TIFFReadDirEntryCheckedSrational(tif, direntry, &m); |
1044 | 0 | if (err != TIFFReadDirEntryErrOk) |
1045 | 0 | return (err); |
1046 | 0 | *value = (float)m; |
1047 | 0 | return (TIFFReadDirEntryErrOk); |
1048 | 0 | } |
1049 | 0 | case TIFF_FLOAT: |
1050 | 0 | TIFFReadDirEntryCheckedFloat(tif, direntry, value); |
1051 | 0 | return (TIFFReadDirEntryErrOk); |
1052 | 0 | case TIFF_DOUBLE: |
1053 | 0 | { |
1054 | 0 | double m; |
1055 | 0 | err = TIFFReadDirEntryCheckedDouble(tif, direntry, &m); |
1056 | 0 | if (err != TIFFReadDirEntryErrOk) |
1057 | 0 | return (err); |
1058 | 0 | if ((m > FLT_MAX) || (m < -FLT_MAX)) |
1059 | 0 | return (TIFFReadDirEntryErrRange); |
1060 | 0 | *value = (float)m; |
1061 | 0 | return (TIFFReadDirEntryErrOk); |
1062 | 0 | } |
1063 | 0 | default: |
1064 | 0 | return (TIFFReadDirEntryErrType); |
1065 | 0 | } |
1066 | 0 | } |
1067 | | |
1068 | | static enum TIFFReadDirEntryErr |
1069 | | TIFFReadDirEntryDouble(TIFF *tif, TIFFDirEntry *direntry, double *value) |
1070 | 0 | { |
1071 | 0 | enum TIFFReadDirEntryErr err; |
1072 | 0 | if (direntry->tdir_count != 1) |
1073 | 0 | return (TIFFReadDirEntryErrCount); |
1074 | 0 | switch (direntry->tdir_type) |
1075 | 0 | { |
1076 | 0 | case TIFF_BYTE: |
1077 | 0 | { |
1078 | 0 | uint8_t m; |
1079 | 0 | TIFFReadDirEntryCheckedByte(tif, direntry, &m); |
1080 | 0 | *value = (double)m; |
1081 | 0 | return (TIFFReadDirEntryErrOk); |
1082 | 0 | } |
1083 | 0 | case TIFF_SBYTE: |
1084 | 0 | { |
1085 | 0 | int8_t m; |
1086 | 0 | TIFFReadDirEntryCheckedSbyte(tif, direntry, &m); |
1087 | 0 | *value = (double)m; |
1088 | 0 | return (TIFFReadDirEntryErrOk); |
1089 | 0 | } |
1090 | 0 | case TIFF_SHORT: |
1091 | 0 | { |
1092 | 0 | uint16_t m; |
1093 | 0 | TIFFReadDirEntryCheckedShort(tif, direntry, &m); |
1094 | 0 | *value = (double)m; |
1095 | 0 | return (TIFFReadDirEntryErrOk); |
1096 | 0 | } |
1097 | 0 | case TIFF_SSHORT: |
1098 | 0 | { |
1099 | 0 | int16_t m; |
1100 | 0 | TIFFReadDirEntryCheckedSshort(tif, direntry, &m); |
1101 | 0 | *value = (double)m; |
1102 | 0 | return (TIFFReadDirEntryErrOk); |
1103 | 0 | } |
1104 | 0 | case TIFF_LONG: |
1105 | 0 | { |
1106 | 0 | uint32_t m; |
1107 | 0 | TIFFReadDirEntryCheckedLong(tif, direntry, &m); |
1108 | 0 | *value = (double)m; |
1109 | 0 | return (TIFFReadDirEntryErrOk); |
1110 | 0 | } |
1111 | 0 | case TIFF_SLONG: |
1112 | 0 | { |
1113 | 0 | int32_t m; |
1114 | 0 | TIFFReadDirEntryCheckedSlong(tif, direntry, &m); |
1115 | 0 | *value = (double)m; |
1116 | 0 | return (TIFFReadDirEntryErrOk); |
1117 | 0 | } |
1118 | 0 | case TIFF_LONG8: |
1119 | 0 | { |
1120 | 0 | uint64_t m; |
1121 | 0 | err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m); |
1122 | 0 | if (err != TIFFReadDirEntryErrOk) |
1123 | 0 | return (err); |
1124 | 0 | *value = (double)m; |
1125 | 0 | return (TIFFReadDirEntryErrOk); |
1126 | 0 | } |
1127 | 0 | case TIFF_SLONG8: |
1128 | 0 | { |
1129 | 0 | int64_t m; |
1130 | 0 | err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m); |
1131 | 0 | if (err != TIFFReadDirEntryErrOk) |
1132 | 0 | return (err); |
1133 | 0 | *value = (double)m; |
1134 | 0 | return (TIFFReadDirEntryErrOk); |
1135 | 0 | } |
1136 | 0 | case TIFF_RATIONAL: |
1137 | 0 | err = TIFFReadDirEntryCheckedRational(tif, direntry, value); |
1138 | 0 | return (err); |
1139 | 0 | case TIFF_SRATIONAL: |
1140 | 0 | err = TIFFReadDirEntryCheckedSrational(tif, direntry, value); |
1141 | 0 | return (err); |
1142 | 0 | case TIFF_FLOAT: |
1143 | 0 | { |
1144 | 0 | float m; |
1145 | 0 | TIFFReadDirEntryCheckedFloat(tif, direntry, &m); |
1146 | 0 | *value = (double)m; |
1147 | 0 | return (TIFFReadDirEntryErrOk); |
1148 | 0 | } |
1149 | 0 | case TIFF_DOUBLE: |
1150 | 0 | err = TIFFReadDirEntryCheckedDouble(tif, direntry, value); |
1151 | 0 | return (err); |
1152 | 0 | default: |
1153 | 0 | return (TIFFReadDirEntryErrType); |
1154 | 0 | } |
1155 | 0 | } |
1156 | | |
1157 | | static enum TIFFReadDirEntryErr |
1158 | | TIFFReadDirEntryIfd8(TIFF *tif, TIFFDirEntry *direntry, uint64_t *value) |
1159 | 0 | { |
1160 | 0 | enum TIFFReadDirEntryErr err; |
1161 | 0 | if (direntry->tdir_count != 1) |
1162 | 0 | return (TIFFReadDirEntryErrCount); |
1163 | 0 | switch (direntry->tdir_type) |
1164 | 0 | { |
1165 | 0 | case TIFF_LONG: |
1166 | 0 | case TIFF_IFD: |
1167 | 0 | { |
1168 | 0 | uint32_t m; |
1169 | 0 | TIFFReadDirEntryCheckedLong(tif, direntry, &m); |
1170 | 0 | *value = (uint64_t)m; |
1171 | 0 | return (TIFFReadDirEntryErrOk); |
1172 | 0 | } |
1173 | 0 | case TIFF_LONG8: |
1174 | 0 | case TIFF_IFD8: |
1175 | 0 | err = TIFFReadDirEntryCheckedLong8(tif, direntry, value); |
1176 | 0 | return (err); |
1177 | 0 | default: |
1178 | 0 | return (TIFFReadDirEntryErrType); |
1179 | 0 | } |
1180 | 0 | } |
1181 | | |
1182 | 0 | #define INITIAL_THRESHOLD (1024 * 1024) |
1183 | 0 | #define THRESHOLD_MULTIPLIER 10 |
1184 | | #define MAX_THRESHOLD \ |
1185 | 0 | (THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER * \ |
1186 | 0 | INITIAL_THRESHOLD) |
1187 | | |
1188 | | static enum TIFFReadDirEntryErr TIFFReadDirEntryDataAndRealloc(TIFF *tif, |
1189 | | uint64_t offset, |
1190 | | tmsize_t size, |
1191 | | void **pdest) |
1192 | 0 | { |
1193 | 0 | #if SIZEOF_SIZE_T == 8 |
1194 | 0 | tmsize_t threshold = INITIAL_THRESHOLD; |
1195 | 0 | #endif |
1196 | 0 | tmsize_t already_read = 0; |
1197 | |
|
1198 | 0 | assert(!isMapped(tif)); |
1199 | | |
1200 | 0 | if (!SeekOK(tif, offset)) |
1201 | 0 | return (TIFFReadDirEntryErrIo); |
1202 | | |
1203 | | /* On 64 bit processes, read first a maximum of 1 MB, then 10 MB, etc */ |
1204 | | /* so as to avoid allocating too much memory in case the file is too */ |
1205 | | /* short. We could ask for the file size, but this might be */ |
1206 | | /* expensive with some I/O layers (think of reading a gzipped file) */ |
1207 | | /* Restrict to 64 bit processes, so as to avoid reallocs() */ |
1208 | | /* on 32 bit processes where virtual memory is scarce. */ |
1209 | 0 | while (already_read < size) |
1210 | 0 | { |
1211 | 0 | void *new_dest; |
1212 | 0 | tmsize_t bytes_read; |
1213 | 0 | tmsize_t to_read = size - already_read; |
1214 | 0 | #if SIZEOF_SIZE_T == 8 |
1215 | 0 | if (to_read >= threshold && threshold < MAX_THRESHOLD) |
1216 | 0 | { |
1217 | 0 | to_read = threshold; |
1218 | 0 | threshold *= THRESHOLD_MULTIPLIER; |
1219 | 0 | } |
1220 | 0 | #endif |
1221 | |
|
1222 | 0 | new_dest = |
1223 | 0 | (uint8_t *)_TIFFreallocExt(tif, *pdest, already_read + to_read); |
1224 | 0 | if (new_dest == NULL) |
1225 | 0 | { |
1226 | 0 | TIFFErrorExtR(tif, tif->tif_name, |
1227 | 0 | "Failed to allocate memory for %s " |
1228 | 0 | "(%" TIFF_SSIZE_FORMAT |
1229 | 0 | " elements of %" TIFF_SSIZE_FORMAT " bytes each)", |
1230 | 0 | "TIFFReadDirEntryArray", (tmsize_t)1, |
1231 | 0 | already_read + to_read); |
1232 | 0 | return TIFFReadDirEntryErrAlloc; |
1233 | 0 | } |
1234 | 0 | *pdest = new_dest; |
1235 | |
|
1236 | 0 | bytes_read = TIFFReadFile(tif, (char *)*pdest + already_read, to_read); |
1237 | 0 | already_read += bytes_read; |
1238 | 0 | if (bytes_read != to_read) |
1239 | 0 | { |
1240 | 0 | return TIFFReadDirEntryErrIo; |
1241 | 0 | } |
1242 | 0 | } |
1243 | 0 | return TIFFReadDirEntryErrOk; |
1244 | 0 | } |
1245 | | |
1246 | | /* Caution: if raising that value, make sure int32 / uint32 overflows can't |
1247 | | * occur elsewhere */ |
1248 | 0 | #define MAX_SIZE_TAG_DATA 2147483647U |
1249 | | |
1250 | | static enum TIFFReadDirEntryErr |
1251 | | TIFFReadDirEntryArrayWithLimit(TIFF *tif, TIFFDirEntry *direntry, |
1252 | | uint32_t *count, uint32_t desttypesize, |
1253 | | void **value, uint64_t maxcount) |
1254 | 0 | { |
1255 | 0 | int typesize; |
1256 | 0 | uint32_t datasize; |
1257 | 0 | void *data; |
1258 | 0 | uint64_t target_count64; |
1259 | 0 | int original_datasize_clamped; |
1260 | 0 | typesize = TIFFDataWidth(direntry->tdir_type); |
1261 | |
|
1262 | 0 | target_count64 = |
1263 | 0 | (direntry->tdir_count > maxcount) ? maxcount : direntry->tdir_count; |
1264 | |
|
1265 | 0 | if ((target_count64 == 0) || (typesize == 0)) |
1266 | 0 | { |
1267 | 0 | *value = 0; |
1268 | 0 | return (TIFFReadDirEntryErrOk); |
1269 | 0 | } |
1270 | 0 | (void)desttypesize; |
1271 | | |
1272 | | /* We just want to know if the original tag size is more than 4 bytes |
1273 | | * (classic TIFF) or 8 bytes (BigTIFF) |
1274 | | */ |
1275 | 0 | original_datasize_clamped = |
1276 | 0 | ((direntry->tdir_count > 10) ? 10 : (int)direntry->tdir_count) * |
1277 | 0 | typesize; |
1278 | | |
1279 | | /* |
1280 | | * As a sanity check, make sure we have no more than a 2GB tag array |
1281 | | * in either the current data type or the dest data type. This also |
1282 | | * avoids problems with overflow of tmsize_t on 32bit systems. |
1283 | | */ |
1284 | 0 | if ((uint64_t)(MAX_SIZE_TAG_DATA / typesize) < target_count64) |
1285 | 0 | return (TIFFReadDirEntryErrSizesan); |
1286 | 0 | if ((uint64_t)(MAX_SIZE_TAG_DATA / desttypesize) < target_count64) |
1287 | 0 | return (TIFFReadDirEntryErrSizesan); |
1288 | | |
1289 | 0 | *count = (uint32_t)target_count64; |
1290 | 0 | datasize = (*count) * typesize; |
1291 | 0 | assert((tmsize_t)datasize > 0); |
1292 | | |
1293 | 0 | if (datasize > 100 * 1024 * 1024) |
1294 | 0 | { |
1295 | | /* Before allocating a huge amount of memory for corrupted files, check |
1296 | | * if size of requested memory is not greater than file size. |
1297 | | */ |
1298 | 0 | const uint64_t filesize = TIFFGetFileSize(tif); |
1299 | 0 | if (datasize > filesize) |
1300 | 0 | { |
1301 | 0 | TIFFWarningExtR(tif, "ReadDirEntryArray", |
1302 | 0 | "Requested memory size for tag %d (0x%x) %" PRIu32 |
1303 | 0 | " is greater than filesize %" PRIu64 |
1304 | 0 | ". Memory not allocated, tag not read", |
1305 | 0 | direntry->tdir_tag, direntry->tdir_tag, datasize, |
1306 | 0 | filesize); |
1307 | 0 | return (TIFFReadDirEntryErrAlloc); |
1308 | 0 | } |
1309 | 0 | } |
1310 | | |
1311 | 0 | if (isMapped(tif) && datasize > (uint64_t)tif->tif_size) |
1312 | 0 | return TIFFReadDirEntryErrIo; |
1313 | | |
1314 | 0 | if (!isMapped(tif) && (((tif->tif_flags & TIFF_BIGTIFF) && datasize > 8) || |
1315 | 0 | (!(tif->tif_flags & TIFF_BIGTIFF) && datasize > 4))) |
1316 | 0 | { |
1317 | 0 | data = NULL; |
1318 | 0 | } |
1319 | 0 | else |
1320 | 0 | { |
1321 | 0 | data = _TIFFCheckMalloc(tif, *count, typesize, "ReadDirEntryArray"); |
1322 | 0 | if (data == 0) |
1323 | 0 | return (TIFFReadDirEntryErrAlloc); |
1324 | 0 | } |
1325 | 0 | if (!(tif->tif_flags & TIFF_BIGTIFF)) |
1326 | 0 | { |
1327 | | /* Only the condition on original_datasize_clamped. The second |
1328 | | * one is implied, but Coverity Scan cannot see it. */ |
1329 | 0 | if (original_datasize_clamped <= 4 && datasize <= 4) |
1330 | 0 | _TIFFmemcpy(data, &direntry->tdir_offset, datasize); |
1331 | 0 | else |
1332 | 0 | { |
1333 | 0 | enum TIFFReadDirEntryErr err; |
1334 | 0 | uint32_t offset = direntry->tdir_offset.toff_long; |
1335 | 0 | if (tif->tif_flags & TIFF_SWAB) |
1336 | 0 | TIFFSwabLong(&offset); |
1337 | 0 | if (isMapped(tif)) |
1338 | 0 | err = TIFFReadDirEntryData(tif, (uint64_t)offset, |
1339 | 0 | (tmsize_t)datasize, data); |
1340 | 0 | else |
1341 | 0 | err = TIFFReadDirEntryDataAndRealloc(tif, (uint64_t)offset, |
1342 | 0 | (tmsize_t)datasize, &data); |
1343 | 0 | if (err != TIFFReadDirEntryErrOk) |
1344 | 0 | { |
1345 | 0 | _TIFFfreeExt(tif, data); |
1346 | 0 | return (err); |
1347 | 0 | } |
1348 | 0 | } |
1349 | 0 | } |
1350 | 0 | else |
1351 | 0 | { |
1352 | | /* See above comment for the Classic TIFF case */ |
1353 | 0 | if (original_datasize_clamped <= 8 && datasize <= 8) |
1354 | 0 | _TIFFmemcpy(data, &direntry->tdir_offset, datasize); |
1355 | 0 | else |
1356 | 0 | { |
1357 | 0 | enum TIFFReadDirEntryErr err; |
1358 | 0 | uint64_t offset = direntry->tdir_offset.toff_long8; |
1359 | 0 | if (tif->tif_flags & TIFF_SWAB) |
1360 | 0 | TIFFSwabLong8(&offset); |
1361 | 0 | if (isMapped(tif)) |
1362 | 0 | err = TIFFReadDirEntryData(tif, (uint64_t)offset, |
1363 | 0 | (tmsize_t)datasize, data); |
1364 | 0 | else |
1365 | 0 | err = TIFFReadDirEntryDataAndRealloc(tif, (uint64_t)offset, |
1366 | 0 | (tmsize_t)datasize, &data); |
1367 | 0 | if (err != TIFFReadDirEntryErrOk) |
1368 | 0 | { |
1369 | 0 | _TIFFfreeExt(tif, data); |
1370 | 0 | return (err); |
1371 | 0 | } |
1372 | 0 | } |
1373 | 0 | } |
1374 | 0 | *value = data; |
1375 | 0 | return (TIFFReadDirEntryErrOk); |
1376 | 0 | } |
1377 | | |
1378 | | static enum TIFFReadDirEntryErr |
1379 | | TIFFReadDirEntryArray(TIFF *tif, TIFFDirEntry *direntry, uint32_t *count, |
1380 | | uint32_t desttypesize, void **value) |
1381 | 0 | { |
1382 | 0 | return TIFFReadDirEntryArrayWithLimit(tif, direntry, count, desttypesize, |
1383 | 0 | value, ~((uint64_t)0)); |
1384 | 0 | } |
1385 | | |
1386 | | static enum TIFFReadDirEntryErr |
1387 | | TIFFReadDirEntryByteArray(TIFF *tif, TIFFDirEntry *direntry, uint8_t **value) |
1388 | 0 | { |
1389 | 0 | enum TIFFReadDirEntryErr err; |
1390 | 0 | uint32_t count; |
1391 | 0 | void *origdata; |
1392 | 0 | uint8_t *data; |
1393 | 0 | switch (direntry->tdir_type) |
1394 | 0 | { |
1395 | 0 | case TIFF_ASCII: |
1396 | 0 | case TIFF_UNDEFINED: |
1397 | 0 | case TIFF_BYTE: |
1398 | 0 | case TIFF_SBYTE: |
1399 | 0 | case TIFF_SHORT: |
1400 | 0 | case TIFF_SSHORT: |
1401 | 0 | case TIFF_LONG: |
1402 | 0 | case TIFF_SLONG: |
1403 | 0 | case TIFF_LONG8: |
1404 | 0 | case TIFF_SLONG8: |
1405 | 0 | break; |
1406 | 0 | default: |
1407 | 0 | return (TIFFReadDirEntryErrType); |
1408 | 0 | } |
1409 | 0 | err = TIFFReadDirEntryArray(tif, direntry, &count, 1, &origdata); |
1410 | 0 | if ((err != TIFFReadDirEntryErrOk) || (origdata == 0)) |
1411 | 0 | { |
1412 | 0 | *value = 0; |
1413 | 0 | return (err); |
1414 | 0 | } |
1415 | 0 | switch (direntry->tdir_type) |
1416 | 0 | { |
1417 | 0 | case TIFF_ASCII: |
1418 | 0 | case TIFF_UNDEFINED: |
1419 | 0 | case TIFF_BYTE: |
1420 | 0 | *value = (uint8_t *)origdata; |
1421 | 0 | return (TIFFReadDirEntryErrOk); |
1422 | 0 | case TIFF_SBYTE: |
1423 | 0 | { |
1424 | 0 | int8_t *m; |
1425 | 0 | uint32_t n; |
1426 | 0 | m = (int8_t *)origdata; |
1427 | 0 | for (n = 0; n < count; n++) |
1428 | 0 | { |
1429 | 0 | err = TIFFReadDirEntryCheckRangeByteSbyte(*m); |
1430 | 0 | if (err != TIFFReadDirEntryErrOk) |
1431 | 0 | { |
1432 | 0 | _TIFFfreeExt(tif, origdata); |
1433 | 0 | return (err); |
1434 | 0 | } |
1435 | 0 | m++; |
1436 | 0 | } |
1437 | 0 | *value = (uint8_t *)origdata; |
1438 | 0 | return (TIFFReadDirEntryErrOk); |
1439 | 0 | } |
1440 | 0 | } |
1441 | 0 | data = (uint8_t *)_TIFFmallocExt(tif, count); |
1442 | 0 | if (data == 0) |
1443 | 0 | { |
1444 | 0 | _TIFFfreeExt(tif, origdata); |
1445 | 0 | return (TIFFReadDirEntryErrAlloc); |
1446 | 0 | } |
1447 | 0 | switch (direntry->tdir_type) |
1448 | 0 | { |
1449 | 0 | case TIFF_SHORT: |
1450 | 0 | { |
1451 | 0 | uint16_t *ma; |
1452 | 0 | uint8_t *mb; |
1453 | 0 | uint32_t n; |
1454 | 0 | ma = (uint16_t *)origdata; |
1455 | 0 | mb = data; |
1456 | 0 | for (n = 0; n < count; n++) |
1457 | 0 | { |
1458 | 0 | if (tif->tif_flags & TIFF_SWAB) |
1459 | 0 | TIFFSwabShort(ma); |
1460 | 0 | err = TIFFReadDirEntryCheckRangeByteShort(*ma); |
1461 | 0 | if (err != TIFFReadDirEntryErrOk) |
1462 | 0 | break; |
1463 | 0 | *mb++ = (uint8_t)(*ma++); |
1464 | 0 | } |
1465 | 0 | } |
1466 | 0 | break; |
1467 | 0 | case TIFF_SSHORT: |
1468 | 0 | { |
1469 | 0 | int16_t *ma; |
1470 | 0 | uint8_t *mb; |
1471 | 0 | uint32_t n; |
1472 | 0 | ma = (int16_t *)origdata; |
1473 | 0 | mb = data; |
1474 | 0 | for (n = 0; n < count; n++) |
1475 | 0 | { |
1476 | 0 | if (tif->tif_flags & TIFF_SWAB) |
1477 | 0 | TIFFSwabShort((uint16_t *)ma); |
1478 | 0 | err = TIFFReadDirEntryCheckRangeByteSshort(*ma); |
1479 | 0 | if (err != TIFFReadDirEntryErrOk) |
1480 | 0 | break; |
1481 | 0 | *mb++ = (uint8_t)(*ma++); |
1482 | 0 | } |
1483 | 0 | } |
1484 | 0 | break; |
1485 | 0 | case TIFF_LONG: |
1486 | 0 | { |
1487 | 0 | uint32_t *ma; |
1488 | 0 | uint8_t *mb; |
1489 | 0 | uint32_t n; |
1490 | 0 | ma = (uint32_t *)origdata; |
1491 | 0 | mb = data; |
1492 | 0 | for (n = 0; n < count; n++) |
1493 | 0 | { |
1494 | 0 | if (tif->tif_flags & TIFF_SWAB) |
1495 | 0 | TIFFSwabLong(ma); |
1496 | 0 | err = TIFFReadDirEntryCheckRangeByteLong(*ma); |
1497 | 0 | if (err != TIFFReadDirEntryErrOk) |
1498 | 0 | break; |
1499 | 0 | *mb++ = (uint8_t)(*ma++); |
1500 | 0 | } |
1501 | 0 | } |
1502 | 0 | break; |
1503 | 0 | case TIFF_SLONG: |
1504 | 0 | { |
1505 | 0 | int32_t *ma; |
1506 | 0 | uint8_t *mb; |
1507 | 0 | uint32_t n; |
1508 | 0 | ma = (int32_t *)origdata; |
1509 | 0 | mb = data; |
1510 | 0 | for (n = 0; n < count; n++) |
1511 | 0 | { |
1512 | 0 | if (tif->tif_flags & TIFF_SWAB) |
1513 | 0 | TIFFSwabLong((uint32_t *)ma); |
1514 | 0 | err = TIFFReadDirEntryCheckRangeByteSlong(*ma); |
1515 | 0 | if (err != TIFFReadDirEntryErrOk) |
1516 | 0 | break; |
1517 | 0 | *mb++ = (uint8_t)(*ma++); |
1518 | 0 | } |
1519 | 0 | } |
1520 | 0 | break; |
1521 | 0 | case TIFF_LONG8: |
1522 | 0 | { |
1523 | 0 | uint64_t *ma; |
1524 | 0 | uint8_t *mb; |
1525 | 0 | uint32_t n; |
1526 | 0 | ma = (uint64_t *)origdata; |
1527 | 0 | mb = data; |
1528 | 0 | for (n = 0; n < count; n++) |
1529 | 0 | { |
1530 | 0 | if (tif->tif_flags & TIFF_SWAB) |
1531 | 0 | TIFFSwabLong8(ma); |
1532 | 0 | err = TIFFReadDirEntryCheckRangeByteLong8(*ma); |
1533 | 0 | if (err != TIFFReadDirEntryErrOk) |
1534 | 0 | break; |
1535 | 0 | *mb++ = (uint8_t)(*ma++); |
1536 | 0 | } |
1537 | 0 | } |
1538 | 0 | break; |
1539 | 0 | case TIFF_SLONG8: |
1540 | 0 | { |
1541 | 0 | int64_t *ma; |
1542 | 0 | uint8_t *mb; |
1543 | 0 | uint32_t n; |
1544 | 0 | ma = (int64_t *)origdata; |
1545 | 0 | mb = data; |
1546 | 0 | for (n = 0; n < count; n++) |
1547 | 0 | { |
1548 | 0 | if (tif->tif_flags & TIFF_SWAB) |
1549 | 0 | TIFFSwabLong8((uint64_t *)ma); |
1550 | 0 | err = TIFFReadDirEntryCheckRangeByteSlong8(*ma); |
1551 | 0 | if (err != TIFFReadDirEntryErrOk) |
1552 | 0 | break; |
1553 | 0 | *mb++ = (uint8_t)(*ma++); |
1554 | 0 | } |
1555 | 0 | } |
1556 | 0 | break; |
1557 | 0 | } |
1558 | 0 | _TIFFfreeExt(tif, origdata); |
1559 | 0 | if (err != TIFFReadDirEntryErrOk) |
1560 | 0 | { |
1561 | 0 | _TIFFfreeExt(tif, data); |
1562 | 0 | return (err); |
1563 | 0 | } |
1564 | 0 | *value = data; |
1565 | 0 | return (TIFFReadDirEntryErrOk); |
1566 | 0 | } |
1567 | | |
1568 | | static enum TIFFReadDirEntryErr |
1569 | | TIFFReadDirEntrySbyteArray(TIFF *tif, TIFFDirEntry *direntry, int8_t **value) |
1570 | 0 | { |
1571 | 0 | enum TIFFReadDirEntryErr err; |
1572 | 0 | uint32_t count; |
1573 | 0 | void *origdata; |
1574 | 0 | int8_t *data; |
1575 | 0 | switch (direntry->tdir_type) |
1576 | 0 | { |
1577 | 0 | case TIFF_UNDEFINED: |
1578 | 0 | case TIFF_BYTE: |
1579 | 0 | case TIFF_SBYTE: |
1580 | 0 | case TIFF_SHORT: |
1581 | 0 | case TIFF_SSHORT: |
1582 | 0 | case TIFF_LONG: |
1583 | 0 | case TIFF_SLONG: |
1584 | 0 | case TIFF_LONG8: |
1585 | 0 | case TIFF_SLONG8: |
1586 | 0 | break; |
1587 | 0 | default: |
1588 | 0 | return (TIFFReadDirEntryErrType); |
1589 | 0 | } |
1590 | 0 | err = TIFFReadDirEntryArray(tif, direntry, &count, 1, &origdata); |
1591 | 0 | if ((err != TIFFReadDirEntryErrOk) || (origdata == 0)) |
1592 | 0 | { |
1593 | 0 | *value = 0; |
1594 | 0 | return (err); |
1595 | 0 | } |
1596 | 0 | switch (direntry->tdir_type) |
1597 | 0 | { |
1598 | 0 | case TIFF_UNDEFINED: |
1599 | 0 | case TIFF_BYTE: |
1600 | 0 | { |
1601 | 0 | uint8_t *m; |
1602 | 0 | uint32_t n; |
1603 | 0 | m = (uint8_t *)origdata; |
1604 | 0 | for (n = 0; n < count; n++) |
1605 | 0 | { |
1606 | 0 | err = TIFFReadDirEntryCheckRangeSbyteByte(*m); |
1607 | 0 | if (err != TIFFReadDirEntryErrOk) |
1608 | 0 | { |
1609 | 0 | _TIFFfreeExt(tif, origdata); |
1610 | 0 | return (err); |
1611 | 0 | } |
1612 | 0 | m++; |
1613 | 0 | } |
1614 | 0 | *value = (int8_t *)origdata; |
1615 | 0 | return (TIFFReadDirEntryErrOk); |
1616 | 0 | } |
1617 | 0 | case TIFF_SBYTE: |
1618 | 0 | *value = (int8_t *)origdata; |
1619 | 0 | return (TIFFReadDirEntryErrOk); |
1620 | 0 | } |
1621 | 0 | data = (int8_t *)_TIFFmallocExt(tif, count); |
1622 | 0 | if (data == 0) |
1623 | 0 | { |
1624 | 0 | _TIFFfreeExt(tif, origdata); |
1625 | 0 | return (TIFFReadDirEntryErrAlloc); |
1626 | 0 | } |
1627 | 0 | switch (direntry->tdir_type) |
1628 | 0 | { |
1629 | 0 | case TIFF_SHORT: |
1630 | 0 | { |
1631 | 0 | uint16_t *ma; |
1632 | 0 | int8_t *mb; |
1633 | 0 | uint32_t n; |
1634 | 0 | ma = (uint16_t *)origdata; |
1635 | 0 | mb = data; |
1636 | 0 | for (n = 0; n < count; n++) |
1637 | 0 | { |
1638 | 0 | if (tif->tif_flags & TIFF_SWAB) |
1639 | 0 | TIFFSwabShort(ma); |
1640 | 0 | err = TIFFReadDirEntryCheckRangeSbyteShort(*ma); |
1641 | 0 | if (err != TIFFReadDirEntryErrOk) |
1642 | 0 | break; |
1643 | 0 | *mb++ = (int8_t)(*ma++); |
1644 | 0 | } |
1645 | 0 | } |
1646 | 0 | break; |
1647 | 0 | case TIFF_SSHORT: |
1648 | 0 | { |
1649 | 0 | int16_t *ma; |
1650 | 0 | int8_t *mb; |
1651 | 0 | uint32_t n; |
1652 | 0 | ma = (int16_t *)origdata; |
1653 | 0 | mb = data; |
1654 | 0 | for (n = 0; n < count; n++) |
1655 | 0 | { |
1656 | 0 | if (tif->tif_flags & TIFF_SWAB) |
1657 | 0 | TIFFSwabShort((uint16_t *)ma); |
1658 | 0 | err = TIFFReadDirEntryCheckRangeSbyteSshort(*ma); |
1659 | 0 | if (err != TIFFReadDirEntryErrOk) |
1660 | 0 | break; |
1661 | 0 | *mb++ = (int8_t)(*ma++); |
1662 | 0 | } |
1663 | 0 | } |
1664 | 0 | break; |
1665 | 0 | case TIFF_LONG: |
1666 | 0 | { |
1667 | 0 | uint32_t *ma; |
1668 | 0 | int8_t *mb; |
1669 | 0 | uint32_t n; |
1670 | 0 | ma = (uint32_t *)origdata; |
1671 | 0 | mb = data; |
1672 | 0 | for (n = 0; n < count; n++) |
1673 | 0 | { |
1674 | 0 | if (tif->tif_flags & TIFF_SWAB) |
1675 | 0 | TIFFSwabLong(ma); |
1676 | 0 | err = TIFFReadDirEntryCheckRangeSbyteLong(*ma); |
1677 | 0 | if (err != TIFFReadDirEntryErrOk) |
1678 | 0 | break; |
1679 | 0 | *mb++ = (int8_t)(*ma++); |
1680 | 0 | } |
1681 | 0 | } |
1682 | 0 | break; |
1683 | 0 | case TIFF_SLONG: |
1684 | 0 | { |
1685 | 0 | int32_t *ma; |
1686 | 0 | int8_t *mb; |
1687 | 0 | uint32_t n; |
1688 | 0 | ma = (int32_t *)origdata; |
1689 | 0 | mb = data; |
1690 | 0 | for (n = 0; n < count; n++) |
1691 | 0 | { |
1692 | 0 | if (tif->tif_flags & TIFF_SWAB) |
1693 | 0 | TIFFSwabLong((uint32_t *)ma); |
1694 | 0 | err = TIFFReadDirEntryCheckRangeSbyteSlong(*ma); |
1695 | 0 | if (err != TIFFReadDirEntryErrOk) |
1696 | 0 | break; |
1697 | 0 | *mb++ = (int8_t)(*ma++); |
1698 | 0 | } |
1699 | 0 | } |
1700 | 0 | break; |
1701 | 0 | case TIFF_LONG8: |
1702 | 0 | { |
1703 | 0 | uint64_t *ma; |
1704 | 0 | int8_t *mb; |
1705 | 0 | uint32_t n; |
1706 | 0 | ma = (uint64_t *)origdata; |
1707 | 0 | mb = data; |
1708 | 0 | for (n = 0; n < count; n++) |
1709 | 0 | { |
1710 | 0 | if (tif->tif_flags & TIFF_SWAB) |
1711 | 0 | TIFFSwabLong8(ma); |
1712 | 0 | err = TIFFReadDirEntryCheckRangeSbyteLong8(*ma); |
1713 | 0 | if (err != TIFFReadDirEntryErrOk) |
1714 | 0 | break; |
1715 | 0 | *mb++ = (int8_t)(*ma++); |
1716 | 0 | } |
1717 | 0 | } |
1718 | 0 | break; |
1719 | 0 | case TIFF_SLONG8: |
1720 | 0 | { |
1721 | 0 | int64_t *ma; |
1722 | 0 | int8_t *mb; |
1723 | 0 | uint32_t n; |
1724 | 0 | ma = (int64_t *)origdata; |
1725 | 0 | mb = data; |
1726 | 0 | for (n = 0; n < count; n++) |
1727 | 0 | { |
1728 | 0 | if (tif->tif_flags & TIFF_SWAB) |
1729 | 0 | TIFFSwabLong8((uint64_t *)ma); |
1730 | 0 | err = TIFFReadDirEntryCheckRangeSbyteSlong8(*ma); |
1731 | 0 | if (err != TIFFReadDirEntryErrOk) |
1732 | 0 | break; |
1733 | 0 | *mb++ = (int8_t)(*ma++); |
1734 | 0 | } |
1735 | 0 | } |
1736 | 0 | break; |
1737 | 0 | } |
1738 | 0 | _TIFFfreeExt(tif, origdata); |
1739 | 0 | if (err != TIFFReadDirEntryErrOk) |
1740 | 0 | { |
1741 | 0 | _TIFFfreeExt(tif, data); |
1742 | 0 | return (err); |
1743 | 0 | } |
1744 | 0 | *value = data; |
1745 | 0 | return (TIFFReadDirEntryErrOk); |
1746 | 0 | } |
1747 | | |
1748 | | static enum TIFFReadDirEntryErr |
1749 | | TIFFReadDirEntryShortArray(TIFF *tif, TIFFDirEntry *direntry, uint16_t **value) |
1750 | 0 | { |
1751 | 0 | enum TIFFReadDirEntryErr err; |
1752 | 0 | uint32_t count; |
1753 | 0 | void *origdata; |
1754 | 0 | uint16_t *data; |
1755 | 0 | switch (direntry->tdir_type) |
1756 | 0 | { |
1757 | 0 | case TIFF_BYTE: |
1758 | 0 | case TIFF_SBYTE: |
1759 | 0 | case TIFF_SHORT: |
1760 | 0 | case TIFF_SSHORT: |
1761 | 0 | case TIFF_LONG: |
1762 | 0 | case TIFF_SLONG: |
1763 | 0 | case TIFF_LONG8: |
1764 | 0 | case TIFF_SLONG8: |
1765 | 0 | break; |
1766 | 0 | default: |
1767 | 0 | return (TIFFReadDirEntryErrType); |
1768 | 0 | } |
1769 | 0 | err = TIFFReadDirEntryArray(tif, direntry, &count, 2, &origdata); |
1770 | 0 | if ((err != TIFFReadDirEntryErrOk) || (origdata == 0)) |
1771 | 0 | { |
1772 | 0 | *value = 0; |
1773 | 0 | return (err); |
1774 | 0 | } |
1775 | 0 | switch (direntry->tdir_type) |
1776 | 0 | { |
1777 | 0 | case TIFF_SHORT: |
1778 | 0 | *value = (uint16_t *)origdata; |
1779 | 0 | if (tif->tif_flags & TIFF_SWAB) |
1780 | 0 | TIFFSwabArrayOfShort(*value, count); |
1781 | 0 | return (TIFFReadDirEntryErrOk); |
1782 | 0 | case TIFF_SSHORT: |
1783 | 0 | { |
1784 | 0 | int16_t *m; |
1785 | 0 | uint32_t n; |
1786 | 0 | m = (int16_t *)origdata; |
1787 | 0 | for (n = 0; n < count; n++) |
1788 | 0 | { |
1789 | 0 | if (tif->tif_flags & TIFF_SWAB) |
1790 | 0 | TIFFSwabShort((uint16_t *)m); |
1791 | 0 | err = TIFFReadDirEntryCheckRangeShortSshort(*m); |
1792 | 0 | if (err != TIFFReadDirEntryErrOk) |
1793 | 0 | { |
1794 | 0 | _TIFFfreeExt(tif, origdata); |
1795 | 0 | return (err); |
1796 | 0 | } |
1797 | 0 | m++; |
1798 | 0 | } |
1799 | 0 | *value = (uint16_t *)origdata; |
1800 | 0 | return (TIFFReadDirEntryErrOk); |
1801 | 0 | } |
1802 | 0 | } |
1803 | 0 | data = (uint16_t *)_TIFFmallocExt(tif, count * 2); |
1804 | 0 | if (data == 0) |
1805 | 0 | { |
1806 | 0 | _TIFFfreeExt(tif, origdata); |
1807 | 0 | return (TIFFReadDirEntryErrAlloc); |
1808 | 0 | } |
1809 | 0 | switch (direntry->tdir_type) |
1810 | 0 | { |
1811 | 0 | case TIFF_BYTE: |
1812 | 0 | { |
1813 | 0 | uint8_t *ma; |
1814 | 0 | uint16_t *mb; |
1815 | 0 | uint32_t n; |
1816 | 0 | ma = (uint8_t *)origdata; |
1817 | 0 | mb = data; |
1818 | 0 | for (n = 0; n < count; n++) |
1819 | 0 | *mb++ = (uint16_t)(*ma++); |
1820 | 0 | } |
1821 | 0 | break; |
1822 | 0 | case TIFF_SBYTE: |
1823 | 0 | { |
1824 | 0 | int8_t *ma; |
1825 | 0 | uint16_t *mb; |
1826 | 0 | uint32_t n; |
1827 | 0 | ma = (int8_t *)origdata; |
1828 | 0 | mb = data; |
1829 | 0 | for (n = 0; n < count; n++) |
1830 | 0 | { |
1831 | 0 | err = TIFFReadDirEntryCheckRangeShortSbyte(*ma); |
1832 | 0 | if (err != TIFFReadDirEntryErrOk) |
1833 | 0 | break; |
1834 | 0 | *mb++ = (uint16_t)(*ma++); |
1835 | 0 | } |
1836 | 0 | } |
1837 | 0 | break; |
1838 | 0 | case TIFF_LONG: |
1839 | 0 | { |
1840 | 0 | uint32_t *ma; |
1841 | 0 | uint16_t *mb; |
1842 | 0 | uint32_t n; |
1843 | 0 | ma = (uint32_t *)origdata; |
1844 | 0 | mb = data; |
1845 | 0 | for (n = 0; n < count; n++) |
1846 | 0 | { |
1847 | 0 | if (tif->tif_flags & TIFF_SWAB) |
1848 | 0 | TIFFSwabLong(ma); |
1849 | 0 | err = TIFFReadDirEntryCheckRangeShortLong(*ma); |
1850 | 0 | if (err != TIFFReadDirEntryErrOk) |
1851 | 0 | break; |
1852 | 0 | *mb++ = (uint16_t)(*ma++); |
1853 | 0 | } |
1854 | 0 | } |
1855 | 0 | break; |
1856 | 0 | case TIFF_SLONG: |
1857 | 0 | { |
1858 | 0 | int32_t *ma; |
1859 | 0 | uint16_t *mb; |
1860 | 0 | uint32_t n; |
1861 | 0 | ma = (int32_t *)origdata; |
1862 | 0 | mb = data; |
1863 | 0 | for (n = 0; n < count; n++) |
1864 | 0 | { |
1865 | 0 | if (tif->tif_flags & TIFF_SWAB) |
1866 | 0 | TIFFSwabLong((uint32_t *)ma); |
1867 | 0 | err = TIFFReadDirEntryCheckRangeShortSlong(*ma); |
1868 | 0 | if (err != TIFFReadDirEntryErrOk) |
1869 | 0 | break; |
1870 | 0 | *mb++ = (uint16_t)(*ma++); |
1871 | 0 | } |
1872 | 0 | } |
1873 | 0 | break; |
1874 | 0 | case TIFF_LONG8: |
1875 | 0 | { |
1876 | 0 | uint64_t *ma; |
1877 | 0 | uint16_t *mb; |
1878 | 0 | uint32_t n; |
1879 | 0 | ma = (uint64_t *)origdata; |
1880 | 0 | mb = data; |
1881 | 0 | for (n = 0; n < count; n++) |
1882 | 0 | { |
1883 | 0 | if (tif->tif_flags & TIFF_SWAB) |
1884 | 0 | TIFFSwabLong8(ma); |
1885 | 0 | err = TIFFReadDirEntryCheckRangeShortLong8(*ma); |
1886 | 0 | if (err != TIFFReadDirEntryErrOk) |
1887 | 0 | break; |
1888 | 0 | *mb++ = (uint16_t)(*ma++); |
1889 | 0 | } |
1890 | 0 | } |
1891 | 0 | break; |
1892 | 0 | case TIFF_SLONG8: |
1893 | 0 | { |
1894 | 0 | int64_t *ma; |
1895 | 0 | uint16_t *mb; |
1896 | 0 | uint32_t n; |
1897 | 0 | ma = (int64_t *)origdata; |
1898 | 0 | mb = data; |
1899 | 0 | for (n = 0; n < count; n++) |
1900 | 0 | { |
1901 | 0 | if (tif->tif_flags & TIFF_SWAB) |
1902 | 0 | TIFFSwabLong8((uint64_t *)ma); |
1903 | 0 | err = TIFFReadDirEntryCheckRangeShortSlong8(*ma); |
1904 | 0 | if (err != TIFFReadDirEntryErrOk) |
1905 | 0 | break; |
1906 | 0 | *mb++ = (uint16_t)(*ma++); |
1907 | 0 | } |
1908 | 0 | } |
1909 | 0 | break; |
1910 | 0 | } |
1911 | 0 | _TIFFfreeExt(tif, origdata); |
1912 | 0 | if (err != TIFFReadDirEntryErrOk) |
1913 | 0 | { |
1914 | 0 | _TIFFfreeExt(tif, data); |
1915 | 0 | return (err); |
1916 | 0 | } |
1917 | 0 | *value = data; |
1918 | 0 | return (TIFFReadDirEntryErrOk); |
1919 | 0 | } |
1920 | | |
1921 | | static enum TIFFReadDirEntryErr |
1922 | | TIFFReadDirEntrySshortArray(TIFF *tif, TIFFDirEntry *direntry, int16_t **value) |
1923 | 0 | { |
1924 | 0 | enum TIFFReadDirEntryErr err; |
1925 | 0 | uint32_t count; |
1926 | 0 | void *origdata; |
1927 | 0 | int16_t *data; |
1928 | 0 | switch (direntry->tdir_type) |
1929 | 0 | { |
1930 | 0 | case TIFF_BYTE: |
1931 | 0 | case TIFF_SBYTE: |
1932 | 0 | case TIFF_SHORT: |
1933 | 0 | case TIFF_SSHORT: |
1934 | 0 | case TIFF_LONG: |
1935 | 0 | case TIFF_SLONG: |
1936 | 0 | case TIFF_LONG8: |
1937 | 0 | case TIFF_SLONG8: |
1938 | 0 | break; |
1939 | 0 | default: |
1940 | 0 | return (TIFFReadDirEntryErrType); |
1941 | 0 | } |
1942 | 0 | err = TIFFReadDirEntryArray(tif, direntry, &count, 2, &origdata); |
1943 | 0 | if ((err != TIFFReadDirEntryErrOk) || (origdata == 0)) |
1944 | 0 | { |
1945 | 0 | *value = 0; |
1946 | 0 | return (err); |
1947 | 0 | } |
1948 | 0 | switch (direntry->tdir_type) |
1949 | 0 | { |
1950 | 0 | case TIFF_SHORT: |
1951 | 0 | { |
1952 | 0 | uint16_t *m; |
1953 | 0 | uint32_t n; |
1954 | 0 | m = (uint16_t *)origdata; |
1955 | 0 | for (n = 0; n < count; n++) |
1956 | 0 | { |
1957 | 0 | if (tif->tif_flags & TIFF_SWAB) |
1958 | 0 | TIFFSwabShort(m); |
1959 | 0 | err = TIFFReadDirEntryCheckRangeSshortShort(*m); |
1960 | 0 | if (err != TIFFReadDirEntryErrOk) |
1961 | 0 | { |
1962 | 0 | _TIFFfreeExt(tif, origdata); |
1963 | 0 | return (err); |
1964 | 0 | } |
1965 | 0 | m++; |
1966 | 0 | } |
1967 | 0 | *value = (int16_t *)origdata; |
1968 | 0 | return (TIFFReadDirEntryErrOk); |
1969 | 0 | } |
1970 | 0 | case TIFF_SSHORT: |
1971 | 0 | *value = (int16_t *)origdata; |
1972 | 0 | if (tif->tif_flags & TIFF_SWAB) |
1973 | 0 | TIFFSwabArrayOfShort((uint16_t *)(*value), count); |
1974 | 0 | return (TIFFReadDirEntryErrOk); |
1975 | 0 | } |
1976 | 0 | data = (int16_t *)_TIFFmallocExt(tif, count * 2); |
1977 | 0 | if (data == 0) |
1978 | 0 | { |
1979 | 0 | _TIFFfreeExt(tif, origdata); |
1980 | 0 | return (TIFFReadDirEntryErrAlloc); |
1981 | 0 | } |
1982 | 0 | switch (direntry->tdir_type) |
1983 | 0 | { |
1984 | 0 | case TIFF_BYTE: |
1985 | 0 | { |
1986 | 0 | uint8_t *ma; |
1987 | 0 | int16_t *mb; |
1988 | 0 | uint32_t n; |
1989 | 0 | ma = (uint8_t *)origdata; |
1990 | 0 | mb = data; |
1991 | 0 | for (n = 0; n < count; n++) |
1992 | 0 | *mb++ = (int16_t)(*ma++); |
1993 | 0 | } |
1994 | 0 | break; |
1995 | 0 | case TIFF_SBYTE: |
1996 | 0 | { |
1997 | 0 | int8_t *ma; |
1998 | 0 | int16_t *mb; |
1999 | 0 | uint32_t n; |
2000 | 0 | ma = (int8_t *)origdata; |
2001 | 0 | mb = data; |
2002 | 0 | for (n = 0; n < count; n++) |
2003 | 0 | *mb++ = (int16_t)(*ma++); |
2004 | 0 | } |
2005 | 0 | break; |
2006 | 0 | case TIFF_LONG: |
2007 | 0 | { |
2008 | 0 | uint32_t *ma; |
2009 | 0 | int16_t *mb; |
2010 | 0 | uint32_t n; |
2011 | 0 | ma = (uint32_t *)origdata; |
2012 | 0 | mb = data; |
2013 | 0 | for (n = 0; n < count; n++) |
2014 | 0 | { |
2015 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2016 | 0 | TIFFSwabLong(ma); |
2017 | 0 | err = TIFFReadDirEntryCheckRangeSshortLong(*ma); |
2018 | 0 | if (err != TIFFReadDirEntryErrOk) |
2019 | 0 | break; |
2020 | 0 | *mb++ = (int16_t)(*ma++); |
2021 | 0 | } |
2022 | 0 | } |
2023 | 0 | break; |
2024 | 0 | case TIFF_SLONG: |
2025 | 0 | { |
2026 | 0 | int32_t *ma; |
2027 | 0 | int16_t *mb; |
2028 | 0 | uint32_t n; |
2029 | 0 | ma = (int32_t *)origdata; |
2030 | 0 | mb = data; |
2031 | 0 | for (n = 0; n < count; n++) |
2032 | 0 | { |
2033 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2034 | 0 | TIFFSwabLong((uint32_t *)ma); |
2035 | 0 | err = TIFFReadDirEntryCheckRangeSshortSlong(*ma); |
2036 | 0 | if (err != TIFFReadDirEntryErrOk) |
2037 | 0 | break; |
2038 | 0 | *mb++ = (int16_t)(*ma++); |
2039 | 0 | } |
2040 | 0 | } |
2041 | 0 | break; |
2042 | 0 | case TIFF_LONG8: |
2043 | 0 | { |
2044 | 0 | uint64_t *ma; |
2045 | 0 | int16_t *mb; |
2046 | 0 | uint32_t n; |
2047 | 0 | ma = (uint64_t *)origdata; |
2048 | 0 | mb = data; |
2049 | 0 | for (n = 0; n < count; n++) |
2050 | 0 | { |
2051 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2052 | 0 | TIFFSwabLong8(ma); |
2053 | 0 | err = TIFFReadDirEntryCheckRangeSshortLong8(*ma); |
2054 | 0 | if (err != TIFFReadDirEntryErrOk) |
2055 | 0 | break; |
2056 | 0 | *mb++ = (int16_t)(*ma++); |
2057 | 0 | } |
2058 | 0 | } |
2059 | 0 | break; |
2060 | 0 | case TIFF_SLONG8: |
2061 | 0 | { |
2062 | 0 | int64_t *ma; |
2063 | 0 | int16_t *mb; |
2064 | 0 | uint32_t n; |
2065 | 0 | ma = (int64_t *)origdata; |
2066 | 0 | mb = data; |
2067 | 0 | for (n = 0; n < count; n++) |
2068 | 0 | { |
2069 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2070 | 0 | TIFFSwabLong8((uint64_t *)ma); |
2071 | 0 | err = TIFFReadDirEntryCheckRangeSshortSlong8(*ma); |
2072 | 0 | if (err != TIFFReadDirEntryErrOk) |
2073 | 0 | break; |
2074 | 0 | *mb++ = (int16_t)(*ma++); |
2075 | 0 | } |
2076 | 0 | } |
2077 | 0 | break; |
2078 | 0 | } |
2079 | 0 | _TIFFfreeExt(tif, origdata); |
2080 | 0 | if (err != TIFFReadDirEntryErrOk) |
2081 | 0 | { |
2082 | 0 | _TIFFfreeExt(tif, data); |
2083 | 0 | return (err); |
2084 | 0 | } |
2085 | 0 | *value = data; |
2086 | 0 | return (TIFFReadDirEntryErrOk); |
2087 | 0 | } |
2088 | | |
2089 | | static enum TIFFReadDirEntryErr |
2090 | | TIFFReadDirEntryLongArray(TIFF *tif, TIFFDirEntry *direntry, uint32_t **value) |
2091 | 0 | { |
2092 | 0 | enum TIFFReadDirEntryErr err; |
2093 | 0 | uint32_t count; |
2094 | 0 | void *origdata; |
2095 | 0 | uint32_t *data; |
2096 | 0 | switch (direntry->tdir_type) |
2097 | 0 | { |
2098 | 0 | case TIFF_BYTE: |
2099 | 0 | case TIFF_SBYTE: |
2100 | 0 | case TIFF_SHORT: |
2101 | 0 | case TIFF_SSHORT: |
2102 | 0 | case TIFF_LONG: |
2103 | 0 | case TIFF_SLONG: |
2104 | 0 | case TIFF_LONG8: |
2105 | 0 | case TIFF_SLONG8: |
2106 | 0 | break; |
2107 | 0 | default: |
2108 | 0 | return (TIFFReadDirEntryErrType); |
2109 | 0 | } |
2110 | 0 | err = TIFFReadDirEntryArray(tif, direntry, &count, 4, &origdata); |
2111 | 0 | if ((err != TIFFReadDirEntryErrOk) || (origdata == 0)) |
2112 | 0 | { |
2113 | 0 | *value = 0; |
2114 | 0 | return (err); |
2115 | 0 | } |
2116 | 0 | switch (direntry->tdir_type) |
2117 | 0 | { |
2118 | 0 | case TIFF_LONG: |
2119 | 0 | *value = (uint32_t *)origdata; |
2120 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2121 | 0 | TIFFSwabArrayOfLong(*value, count); |
2122 | 0 | return (TIFFReadDirEntryErrOk); |
2123 | 0 | case TIFF_SLONG: |
2124 | 0 | { |
2125 | 0 | int32_t *m; |
2126 | 0 | uint32_t n; |
2127 | 0 | m = (int32_t *)origdata; |
2128 | 0 | for (n = 0; n < count; n++) |
2129 | 0 | { |
2130 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2131 | 0 | TIFFSwabLong((uint32_t *)m); |
2132 | 0 | err = TIFFReadDirEntryCheckRangeLongSlong(*m); |
2133 | 0 | if (err != TIFFReadDirEntryErrOk) |
2134 | 0 | { |
2135 | 0 | _TIFFfreeExt(tif, origdata); |
2136 | 0 | return (err); |
2137 | 0 | } |
2138 | 0 | m++; |
2139 | 0 | } |
2140 | 0 | *value = (uint32_t *)origdata; |
2141 | 0 | return (TIFFReadDirEntryErrOk); |
2142 | 0 | } |
2143 | 0 | } |
2144 | 0 | data = (uint32_t *)_TIFFmallocExt(tif, count * 4); |
2145 | 0 | if (data == 0) |
2146 | 0 | { |
2147 | 0 | _TIFFfreeExt(tif, origdata); |
2148 | 0 | return (TIFFReadDirEntryErrAlloc); |
2149 | 0 | } |
2150 | 0 | switch (direntry->tdir_type) |
2151 | 0 | { |
2152 | 0 | case TIFF_BYTE: |
2153 | 0 | { |
2154 | 0 | uint8_t *ma; |
2155 | 0 | uint32_t *mb; |
2156 | 0 | uint32_t n; |
2157 | 0 | ma = (uint8_t *)origdata; |
2158 | 0 | mb = data; |
2159 | 0 | for (n = 0; n < count; n++) |
2160 | 0 | *mb++ = (uint32_t)(*ma++); |
2161 | 0 | } |
2162 | 0 | break; |
2163 | 0 | case TIFF_SBYTE: |
2164 | 0 | { |
2165 | 0 | int8_t *ma; |
2166 | 0 | uint32_t *mb; |
2167 | 0 | uint32_t n; |
2168 | 0 | ma = (int8_t *)origdata; |
2169 | 0 | mb = data; |
2170 | 0 | for (n = 0; n < count; n++) |
2171 | 0 | { |
2172 | 0 | err = TIFFReadDirEntryCheckRangeLongSbyte(*ma); |
2173 | 0 | if (err != TIFFReadDirEntryErrOk) |
2174 | 0 | break; |
2175 | 0 | *mb++ = (uint32_t)(*ma++); |
2176 | 0 | } |
2177 | 0 | } |
2178 | 0 | break; |
2179 | 0 | case TIFF_SHORT: |
2180 | 0 | { |
2181 | 0 | uint16_t *ma; |
2182 | 0 | uint32_t *mb; |
2183 | 0 | uint32_t n; |
2184 | 0 | ma = (uint16_t *)origdata; |
2185 | 0 | mb = data; |
2186 | 0 | for (n = 0; n < count; n++) |
2187 | 0 | { |
2188 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2189 | 0 | TIFFSwabShort(ma); |
2190 | 0 | *mb++ = (uint32_t)(*ma++); |
2191 | 0 | } |
2192 | 0 | } |
2193 | 0 | break; |
2194 | 0 | case TIFF_SSHORT: |
2195 | 0 | { |
2196 | 0 | int16_t *ma; |
2197 | 0 | uint32_t *mb; |
2198 | 0 | uint32_t n; |
2199 | 0 | ma = (int16_t *)origdata; |
2200 | 0 | mb = data; |
2201 | 0 | for (n = 0; n < count; n++) |
2202 | 0 | { |
2203 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2204 | 0 | TIFFSwabShort((uint16_t *)ma); |
2205 | 0 | err = TIFFReadDirEntryCheckRangeLongSshort(*ma); |
2206 | 0 | if (err != TIFFReadDirEntryErrOk) |
2207 | 0 | break; |
2208 | 0 | *mb++ = (uint32_t)(*ma++); |
2209 | 0 | } |
2210 | 0 | } |
2211 | 0 | break; |
2212 | 0 | case TIFF_LONG8: |
2213 | 0 | { |
2214 | 0 | uint64_t *ma; |
2215 | 0 | uint32_t *mb; |
2216 | 0 | uint32_t n; |
2217 | 0 | ma = (uint64_t *)origdata; |
2218 | 0 | mb = data; |
2219 | 0 | for (n = 0; n < count; n++) |
2220 | 0 | { |
2221 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2222 | 0 | TIFFSwabLong8(ma); |
2223 | 0 | err = TIFFReadDirEntryCheckRangeLongLong8(*ma); |
2224 | 0 | if (err != TIFFReadDirEntryErrOk) |
2225 | 0 | break; |
2226 | 0 | *mb++ = (uint32_t)(*ma++); |
2227 | 0 | } |
2228 | 0 | } |
2229 | 0 | break; |
2230 | 0 | case TIFF_SLONG8: |
2231 | 0 | { |
2232 | 0 | int64_t *ma; |
2233 | 0 | uint32_t *mb; |
2234 | 0 | uint32_t n; |
2235 | 0 | ma = (int64_t *)origdata; |
2236 | 0 | mb = data; |
2237 | 0 | for (n = 0; n < count; n++) |
2238 | 0 | { |
2239 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2240 | 0 | TIFFSwabLong8((uint64_t *)ma); |
2241 | 0 | err = TIFFReadDirEntryCheckRangeLongSlong8(*ma); |
2242 | 0 | if (err != TIFFReadDirEntryErrOk) |
2243 | 0 | break; |
2244 | 0 | *mb++ = (uint32_t)(*ma++); |
2245 | 0 | } |
2246 | 0 | } |
2247 | 0 | break; |
2248 | 0 | } |
2249 | 0 | _TIFFfreeExt(tif, origdata); |
2250 | 0 | if (err != TIFFReadDirEntryErrOk) |
2251 | 0 | { |
2252 | 0 | _TIFFfreeExt(tif, data); |
2253 | 0 | return (err); |
2254 | 0 | } |
2255 | 0 | *value = data; |
2256 | 0 | return (TIFFReadDirEntryErrOk); |
2257 | 0 | } |
2258 | | |
2259 | | static enum TIFFReadDirEntryErr |
2260 | | TIFFReadDirEntrySlongArray(TIFF *tif, TIFFDirEntry *direntry, int32_t **value) |
2261 | 0 | { |
2262 | 0 | enum TIFFReadDirEntryErr err; |
2263 | 0 | uint32_t count; |
2264 | 0 | void *origdata; |
2265 | 0 | int32_t *data; |
2266 | 0 | switch (direntry->tdir_type) |
2267 | 0 | { |
2268 | 0 | case TIFF_BYTE: |
2269 | 0 | case TIFF_SBYTE: |
2270 | 0 | case TIFF_SHORT: |
2271 | 0 | case TIFF_SSHORT: |
2272 | 0 | case TIFF_LONG: |
2273 | 0 | case TIFF_SLONG: |
2274 | 0 | case TIFF_LONG8: |
2275 | 0 | case TIFF_SLONG8: |
2276 | 0 | break; |
2277 | 0 | default: |
2278 | 0 | return (TIFFReadDirEntryErrType); |
2279 | 0 | } |
2280 | 0 | err = TIFFReadDirEntryArray(tif, direntry, &count, 4, &origdata); |
2281 | 0 | if ((err != TIFFReadDirEntryErrOk) || (origdata == 0)) |
2282 | 0 | { |
2283 | 0 | *value = 0; |
2284 | 0 | return (err); |
2285 | 0 | } |
2286 | 0 | switch (direntry->tdir_type) |
2287 | 0 | { |
2288 | 0 | case TIFF_LONG: |
2289 | 0 | { |
2290 | 0 | uint32_t *m; |
2291 | 0 | uint32_t n; |
2292 | 0 | m = (uint32_t *)origdata; |
2293 | 0 | for (n = 0; n < count; n++) |
2294 | 0 | { |
2295 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2296 | 0 | TIFFSwabLong((uint32_t *)m); |
2297 | 0 | err = TIFFReadDirEntryCheckRangeSlongLong(*m); |
2298 | 0 | if (err != TIFFReadDirEntryErrOk) |
2299 | 0 | { |
2300 | 0 | _TIFFfreeExt(tif, origdata); |
2301 | 0 | return (err); |
2302 | 0 | } |
2303 | 0 | m++; |
2304 | 0 | } |
2305 | 0 | *value = (int32_t *)origdata; |
2306 | 0 | return (TIFFReadDirEntryErrOk); |
2307 | 0 | } |
2308 | 0 | case TIFF_SLONG: |
2309 | 0 | *value = (int32_t *)origdata; |
2310 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2311 | 0 | TIFFSwabArrayOfLong((uint32_t *)(*value), count); |
2312 | 0 | return (TIFFReadDirEntryErrOk); |
2313 | 0 | } |
2314 | 0 | data = (int32_t *)_TIFFmallocExt(tif, count * 4); |
2315 | 0 | if (data == 0) |
2316 | 0 | { |
2317 | 0 | _TIFFfreeExt(tif, origdata); |
2318 | 0 | return (TIFFReadDirEntryErrAlloc); |
2319 | 0 | } |
2320 | 0 | switch (direntry->tdir_type) |
2321 | 0 | { |
2322 | 0 | case TIFF_BYTE: |
2323 | 0 | { |
2324 | 0 | uint8_t *ma; |
2325 | 0 | int32_t *mb; |
2326 | 0 | uint32_t n; |
2327 | 0 | ma = (uint8_t *)origdata; |
2328 | 0 | mb = data; |
2329 | 0 | for (n = 0; n < count; n++) |
2330 | 0 | *mb++ = (int32_t)(*ma++); |
2331 | 0 | } |
2332 | 0 | break; |
2333 | 0 | case TIFF_SBYTE: |
2334 | 0 | { |
2335 | 0 | int8_t *ma; |
2336 | 0 | int32_t *mb; |
2337 | 0 | uint32_t n; |
2338 | 0 | ma = (int8_t *)origdata; |
2339 | 0 | mb = data; |
2340 | 0 | for (n = 0; n < count; n++) |
2341 | 0 | *mb++ = (int32_t)(*ma++); |
2342 | 0 | } |
2343 | 0 | break; |
2344 | 0 | case TIFF_SHORT: |
2345 | 0 | { |
2346 | 0 | uint16_t *ma; |
2347 | 0 | int32_t *mb; |
2348 | 0 | uint32_t n; |
2349 | 0 | ma = (uint16_t *)origdata; |
2350 | 0 | mb = data; |
2351 | 0 | for (n = 0; n < count; n++) |
2352 | 0 | { |
2353 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2354 | 0 | TIFFSwabShort(ma); |
2355 | 0 | *mb++ = (int32_t)(*ma++); |
2356 | 0 | } |
2357 | 0 | } |
2358 | 0 | break; |
2359 | 0 | case TIFF_SSHORT: |
2360 | 0 | { |
2361 | 0 | int16_t *ma; |
2362 | 0 | int32_t *mb; |
2363 | 0 | uint32_t n; |
2364 | 0 | ma = (int16_t *)origdata; |
2365 | 0 | mb = data; |
2366 | 0 | for (n = 0; n < count; n++) |
2367 | 0 | { |
2368 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2369 | 0 | TIFFSwabShort((uint16_t *)ma); |
2370 | 0 | *mb++ = (int32_t)(*ma++); |
2371 | 0 | } |
2372 | 0 | } |
2373 | 0 | break; |
2374 | 0 | case TIFF_LONG8: |
2375 | 0 | { |
2376 | 0 | uint64_t *ma; |
2377 | 0 | int32_t *mb; |
2378 | 0 | uint32_t n; |
2379 | 0 | ma = (uint64_t *)origdata; |
2380 | 0 | mb = data; |
2381 | 0 | for (n = 0; n < count; n++) |
2382 | 0 | { |
2383 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2384 | 0 | TIFFSwabLong8(ma); |
2385 | 0 | err = TIFFReadDirEntryCheckRangeSlongLong8(*ma); |
2386 | 0 | if (err != TIFFReadDirEntryErrOk) |
2387 | 0 | break; |
2388 | 0 | *mb++ = (int32_t)(*ma++); |
2389 | 0 | } |
2390 | 0 | } |
2391 | 0 | break; |
2392 | 0 | case TIFF_SLONG8: |
2393 | 0 | { |
2394 | 0 | int64_t *ma; |
2395 | 0 | int32_t *mb; |
2396 | 0 | uint32_t n; |
2397 | 0 | ma = (int64_t *)origdata; |
2398 | 0 | mb = data; |
2399 | 0 | for (n = 0; n < count; n++) |
2400 | 0 | { |
2401 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2402 | 0 | TIFFSwabLong8((uint64_t *)ma); |
2403 | 0 | err = TIFFReadDirEntryCheckRangeSlongSlong8(*ma); |
2404 | 0 | if (err != TIFFReadDirEntryErrOk) |
2405 | 0 | break; |
2406 | 0 | *mb++ = (int32_t)(*ma++); |
2407 | 0 | } |
2408 | 0 | } |
2409 | 0 | break; |
2410 | 0 | } |
2411 | 0 | _TIFFfreeExt(tif, origdata); |
2412 | 0 | if (err != TIFFReadDirEntryErrOk) |
2413 | 0 | { |
2414 | 0 | _TIFFfreeExt(tif, data); |
2415 | 0 | return (err); |
2416 | 0 | } |
2417 | 0 | *value = data; |
2418 | 0 | return (TIFFReadDirEntryErrOk); |
2419 | 0 | } |
2420 | | |
2421 | | static enum TIFFReadDirEntryErr |
2422 | | TIFFReadDirEntryLong8ArrayWithLimit(TIFF *tif, TIFFDirEntry *direntry, |
2423 | | uint64_t **value, uint64_t maxcount) |
2424 | 0 | { |
2425 | 0 | enum TIFFReadDirEntryErr err; |
2426 | 0 | uint32_t count; |
2427 | 0 | void *origdata; |
2428 | 0 | uint64_t *data; |
2429 | 0 | switch (direntry->tdir_type) |
2430 | 0 | { |
2431 | 0 | case TIFF_BYTE: |
2432 | 0 | case TIFF_SBYTE: |
2433 | 0 | case TIFF_SHORT: |
2434 | 0 | case TIFF_SSHORT: |
2435 | 0 | case TIFF_LONG: |
2436 | 0 | case TIFF_SLONG: |
2437 | 0 | case TIFF_LONG8: |
2438 | 0 | case TIFF_SLONG8: |
2439 | 0 | break; |
2440 | 0 | default: |
2441 | 0 | return (TIFFReadDirEntryErrType); |
2442 | 0 | } |
2443 | 0 | err = TIFFReadDirEntryArrayWithLimit(tif, direntry, &count, 8, &origdata, |
2444 | 0 | maxcount); |
2445 | 0 | if ((err != TIFFReadDirEntryErrOk) || (origdata == 0)) |
2446 | 0 | { |
2447 | 0 | *value = 0; |
2448 | 0 | return (err); |
2449 | 0 | } |
2450 | 0 | switch (direntry->tdir_type) |
2451 | 0 | { |
2452 | 0 | case TIFF_LONG8: |
2453 | 0 | *value = (uint64_t *)origdata; |
2454 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2455 | 0 | TIFFSwabArrayOfLong8(*value, count); |
2456 | 0 | return (TIFFReadDirEntryErrOk); |
2457 | 0 | case TIFF_SLONG8: |
2458 | 0 | { |
2459 | 0 | int64_t *m; |
2460 | 0 | uint32_t n; |
2461 | 0 | m = (int64_t *)origdata; |
2462 | 0 | for (n = 0; n < count; n++) |
2463 | 0 | { |
2464 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2465 | 0 | TIFFSwabLong8((uint64_t *)m); |
2466 | 0 | err = TIFFReadDirEntryCheckRangeLong8Slong8(*m); |
2467 | 0 | if (err != TIFFReadDirEntryErrOk) |
2468 | 0 | { |
2469 | 0 | _TIFFfreeExt(tif, origdata); |
2470 | 0 | return (err); |
2471 | 0 | } |
2472 | 0 | m++; |
2473 | 0 | } |
2474 | 0 | *value = (uint64_t *)origdata; |
2475 | 0 | return (TIFFReadDirEntryErrOk); |
2476 | 0 | } |
2477 | 0 | } |
2478 | 0 | data = (uint64_t *)_TIFFmallocExt(tif, count * 8); |
2479 | 0 | if (data == 0) |
2480 | 0 | { |
2481 | 0 | _TIFFfreeExt(tif, origdata); |
2482 | 0 | return (TIFFReadDirEntryErrAlloc); |
2483 | 0 | } |
2484 | 0 | switch (direntry->tdir_type) |
2485 | 0 | { |
2486 | 0 | case TIFF_BYTE: |
2487 | 0 | { |
2488 | 0 | uint8_t *ma; |
2489 | 0 | uint64_t *mb; |
2490 | 0 | uint32_t n; |
2491 | 0 | ma = (uint8_t *)origdata; |
2492 | 0 | mb = data; |
2493 | 0 | for (n = 0; n < count; n++) |
2494 | 0 | *mb++ = (uint64_t)(*ma++); |
2495 | 0 | } |
2496 | 0 | break; |
2497 | 0 | case TIFF_SBYTE: |
2498 | 0 | { |
2499 | 0 | int8_t *ma; |
2500 | 0 | uint64_t *mb; |
2501 | 0 | uint32_t n; |
2502 | 0 | ma = (int8_t *)origdata; |
2503 | 0 | mb = data; |
2504 | 0 | for (n = 0; n < count; n++) |
2505 | 0 | { |
2506 | 0 | err = TIFFReadDirEntryCheckRangeLong8Sbyte(*ma); |
2507 | 0 | if (err != TIFFReadDirEntryErrOk) |
2508 | 0 | break; |
2509 | 0 | *mb++ = (uint64_t)(*ma++); |
2510 | 0 | } |
2511 | 0 | } |
2512 | 0 | break; |
2513 | 0 | case TIFF_SHORT: |
2514 | 0 | { |
2515 | 0 | uint16_t *ma; |
2516 | 0 | uint64_t *mb; |
2517 | 0 | uint32_t n; |
2518 | 0 | ma = (uint16_t *)origdata; |
2519 | 0 | mb = data; |
2520 | 0 | for (n = 0; n < count; n++) |
2521 | 0 | { |
2522 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2523 | 0 | TIFFSwabShort(ma); |
2524 | 0 | *mb++ = (uint64_t)(*ma++); |
2525 | 0 | } |
2526 | 0 | } |
2527 | 0 | break; |
2528 | 0 | case TIFF_SSHORT: |
2529 | 0 | { |
2530 | 0 | int16_t *ma; |
2531 | 0 | uint64_t *mb; |
2532 | 0 | uint32_t n; |
2533 | 0 | ma = (int16_t *)origdata; |
2534 | 0 | mb = data; |
2535 | 0 | for (n = 0; n < count; n++) |
2536 | 0 | { |
2537 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2538 | 0 | TIFFSwabShort((uint16_t *)ma); |
2539 | 0 | err = TIFFReadDirEntryCheckRangeLong8Sshort(*ma); |
2540 | 0 | if (err != TIFFReadDirEntryErrOk) |
2541 | 0 | break; |
2542 | 0 | *mb++ = (uint64_t)(*ma++); |
2543 | 0 | } |
2544 | 0 | } |
2545 | 0 | break; |
2546 | 0 | case TIFF_LONG: |
2547 | 0 | { |
2548 | 0 | uint32_t *ma; |
2549 | 0 | uint64_t *mb; |
2550 | 0 | uint32_t n; |
2551 | 0 | ma = (uint32_t *)origdata; |
2552 | 0 | mb = data; |
2553 | 0 | for (n = 0; n < count; n++) |
2554 | 0 | { |
2555 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2556 | 0 | TIFFSwabLong(ma); |
2557 | 0 | *mb++ = (uint64_t)(*ma++); |
2558 | 0 | } |
2559 | 0 | } |
2560 | 0 | break; |
2561 | 0 | case TIFF_SLONG: |
2562 | 0 | { |
2563 | 0 | int32_t *ma; |
2564 | 0 | uint64_t *mb; |
2565 | 0 | uint32_t n; |
2566 | 0 | ma = (int32_t *)origdata; |
2567 | 0 | mb = data; |
2568 | 0 | for (n = 0; n < count; n++) |
2569 | 0 | { |
2570 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2571 | 0 | TIFFSwabLong((uint32_t *)ma); |
2572 | 0 | err = TIFFReadDirEntryCheckRangeLong8Slong(*ma); |
2573 | 0 | if (err != TIFFReadDirEntryErrOk) |
2574 | 0 | break; |
2575 | 0 | *mb++ = (uint64_t)(*ma++); |
2576 | 0 | } |
2577 | 0 | } |
2578 | 0 | break; |
2579 | 0 | } |
2580 | 0 | _TIFFfreeExt(tif, origdata); |
2581 | 0 | if (err != TIFFReadDirEntryErrOk) |
2582 | 0 | { |
2583 | 0 | _TIFFfreeExt(tif, data); |
2584 | 0 | return (err); |
2585 | 0 | } |
2586 | 0 | *value = data; |
2587 | 0 | return (TIFFReadDirEntryErrOk); |
2588 | 0 | } |
2589 | | |
2590 | | static enum TIFFReadDirEntryErr |
2591 | | TIFFReadDirEntryLong8Array(TIFF *tif, TIFFDirEntry *direntry, uint64_t **value) |
2592 | 0 | { |
2593 | 0 | return TIFFReadDirEntryLong8ArrayWithLimit(tif, direntry, value, |
2594 | 0 | ~((uint64_t)0)); |
2595 | 0 | } |
2596 | | |
2597 | | static enum TIFFReadDirEntryErr |
2598 | | TIFFReadDirEntrySlong8Array(TIFF *tif, TIFFDirEntry *direntry, int64_t **value) |
2599 | 0 | { |
2600 | 0 | enum TIFFReadDirEntryErr err; |
2601 | 0 | uint32_t count; |
2602 | 0 | void *origdata; |
2603 | 0 | int64_t *data; |
2604 | 0 | switch (direntry->tdir_type) |
2605 | 0 | { |
2606 | 0 | case TIFF_BYTE: |
2607 | 0 | case TIFF_SBYTE: |
2608 | 0 | case TIFF_SHORT: |
2609 | 0 | case TIFF_SSHORT: |
2610 | 0 | case TIFF_LONG: |
2611 | 0 | case TIFF_SLONG: |
2612 | 0 | case TIFF_LONG8: |
2613 | 0 | case TIFF_SLONG8: |
2614 | 0 | break; |
2615 | 0 | default: |
2616 | 0 | return (TIFFReadDirEntryErrType); |
2617 | 0 | } |
2618 | 0 | err = TIFFReadDirEntryArray(tif, direntry, &count, 8, &origdata); |
2619 | 0 | if ((err != TIFFReadDirEntryErrOk) || (origdata == 0)) |
2620 | 0 | { |
2621 | 0 | *value = 0; |
2622 | 0 | return (err); |
2623 | 0 | } |
2624 | 0 | switch (direntry->tdir_type) |
2625 | 0 | { |
2626 | 0 | case TIFF_LONG8: |
2627 | 0 | { |
2628 | 0 | uint64_t *m; |
2629 | 0 | uint32_t n; |
2630 | 0 | m = (uint64_t *)origdata; |
2631 | 0 | for (n = 0; n < count; n++) |
2632 | 0 | { |
2633 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2634 | 0 | TIFFSwabLong8(m); |
2635 | 0 | err = TIFFReadDirEntryCheckRangeSlong8Long8(*m); |
2636 | 0 | if (err != TIFFReadDirEntryErrOk) |
2637 | 0 | { |
2638 | 0 | _TIFFfreeExt(tif, origdata); |
2639 | 0 | return (err); |
2640 | 0 | } |
2641 | 0 | m++; |
2642 | 0 | } |
2643 | 0 | *value = (int64_t *)origdata; |
2644 | 0 | return (TIFFReadDirEntryErrOk); |
2645 | 0 | } |
2646 | 0 | case TIFF_SLONG8: |
2647 | 0 | *value = (int64_t *)origdata; |
2648 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2649 | 0 | TIFFSwabArrayOfLong8((uint64_t *)(*value), count); |
2650 | 0 | return (TIFFReadDirEntryErrOk); |
2651 | 0 | } |
2652 | 0 | data = (int64_t *)_TIFFmallocExt(tif, count * 8); |
2653 | 0 | if (data == 0) |
2654 | 0 | { |
2655 | 0 | _TIFFfreeExt(tif, origdata); |
2656 | 0 | return (TIFFReadDirEntryErrAlloc); |
2657 | 0 | } |
2658 | 0 | switch (direntry->tdir_type) |
2659 | 0 | { |
2660 | 0 | case TIFF_BYTE: |
2661 | 0 | { |
2662 | 0 | uint8_t *ma; |
2663 | 0 | int64_t *mb; |
2664 | 0 | uint32_t n; |
2665 | 0 | ma = (uint8_t *)origdata; |
2666 | 0 | mb = data; |
2667 | 0 | for (n = 0; n < count; n++) |
2668 | 0 | *mb++ = (int64_t)(*ma++); |
2669 | 0 | } |
2670 | 0 | break; |
2671 | 0 | case TIFF_SBYTE: |
2672 | 0 | { |
2673 | 0 | int8_t *ma; |
2674 | 0 | int64_t *mb; |
2675 | 0 | uint32_t n; |
2676 | 0 | ma = (int8_t *)origdata; |
2677 | 0 | mb = data; |
2678 | 0 | for (n = 0; n < count; n++) |
2679 | 0 | *mb++ = (int64_t)(*ma++); |
2680 | 0 | } |
2681 | 0 | break; |
2682 | 0 | case TIFF_SHORT: |
2683 | 0 | { |
2684 | 0 | uint16_t *ma; |
2685 | 0 | int64_t *mb; |
2686 | 0 | uint32_t n; |
2687 | 0 | ma = (uint16_t *)origdata; |
2688 | 0 | mb = data; |
2689 | 0 | for (n = 0; n < count; n++) |
2690 | 0 | { |
2691 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2692 | 0 | TIFFSwabShort(ma); |
2693 | 0 | *mb++ = (int64_t)(*ma++); |
2694 | 0 | } |
2695 | 0 | } |
2696 | 0 | break; |
2697 | 0 | case TIFF_SSHORT: |
2698 | 0 | { |
2699 | 0 | int16_t *ma; |
2700 | 0 | int64_t *mb; |
2701 | 0 | uint32_t n; |
2702 | 0 | ma = (int16_t *)origdata; |
2703 | 0 | mb = data; |
2704 | 0 | for (n = 0; n < count; n++) |
2705 | 0 | { |
2706 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2707 | 0 | TIFFSwabShort((uint16_t *)ma); |
2708 | 0 | *mb++ = (int64_t)(*ma++); |
2709 | 0 | } |
2710 | 0 | } |
2711 | 0 | break; |
2712 | 0 | case TIFF_LONG: |
2713 | 0 | { |
2714 | 0 | uint32_t *ma; |
2715 | 0 | int64_t *mb; |
2716 | 0 | uint32_t n; |
2717 | 0 | ma = (uint32_t *)origdata; |
2718 | 0 | mb = data; |
2719 | 0 | for (n = 0; n < count; n++) |
2720 | 0 | { |
2721 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2722 | 0 | TIFFSwabLong(ma); |
2723 | 0 | *mb++ = (int64_t)(*ma++); |
2724 | 0 | } |
2725 | 0 | } |
2726 | 0 | break; |
2727 | 0 | case TIFF_SLONG: |
2728 | 0 | { |
2729 | 0 | int32_t *ma; |
2730 | 0 | int64_t *mb; |
2731 | 0 | uint32_t n; |
2732 | 0 | ma = (int32_t *)origdata; |
2733 | 0 | mb = data; |
2734 | 0 | for (n = 0; n < count; n++) |
2735 | 0 | { |
2736 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2737 | 0 | TIFFSwabLong((uint32_t *)ma); |
2738 | 0 | *mb++ = (int64_t)(*ma++); |
2739 | 0 | } |
2740 | 0 | } |
2741 | 0 | break; |
2742 | 0 | } |
2743 | 0 | _TIFFfreeExt(tif, origdata); |
2744 | 0 | *value = data; |
2745 | 0 | return (TIFFReadDirEntryErrOk); |
2746 | 0 | } |
2747 | | |
2748 | | static enum TIFFReadDirEntryErr |
2749 | | TIFFReadDirEntryFloatArray(TIFF *tif, TIFFDirEntry *direntry, float **value) |
2750 | 0 | { |
2751 | 0 | enum TIFFReadDirEntryErr err; |
2752 | 0 | uint32_t count; |
2753 | 0 | void *origdata; |
2754 | 0 | float *data; |
2755 | 0 | switch (direntry->tdir_type) |
2756 | 0 | { |
2757 | 0 | case TIFF_BYTE: |
2758 | 0 | case TIFF_SBYTE: |
2759 | 0 | case TIFF_SHORT: |
2760 | 0 | case TIFF_SSHORT: |
2761 | 0 | case TIFF_LONG: |
2762 | 0 | case TIFF_SLONG: |
2763 | 0 | case TIFF_LONG8: |
2764 | 0 | case TIFF_SLONG8: |
2765 | 0 | case TIFF_RATIONAL: |
2766 | 0 | case TIFF_SRATIONAL: |
2767 | 0 | case TIFF_FLOAT: |
2768 | 0 | case TIFF_DOUBLE: |
2769 | 0 | break; |
2770 | 0 | default: |
2771 | 0 | return (TIFFReadDirEntryErrType); |
2772 | 0 | } |
2773 | 0 | err = TIFFReadDirEntryArray(tif, direntry, &count, 4, &origdata); |
2774 | 0 | if ((err != TIFFReadDirEntryErrOk) || (origdata == 0)) |
2775 | 0 | { |
2776 | 0 | *value = 0; |
2777 | 0 | return (err); |
2778 | 0 | } |
2779 | 0 | switch (direntry->tdir_type) |
2780 | 0 | { |
2781 | 0 | case TIFF_FLOAT: |
2782 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2783 | 0 | TIFFSwabArrayOfLong((uint32_t *)origdata, count); |
2784 | 0 | TIFFCvtIEEEDoubleToNative(tif, count, (float *)origdata); |
2785 | 0 | *value = (float *)origdata; |
2786 | 0 | return (TIFFReadDirEntryErrOk); |
2787 | 0 | } |
2788 | 0 | data = (float *)_TIFFmallocExt(tif, count * sizeof(float)); |
2789 | 0 | if (data == 0) |
2790 | 0 | { |
2791 | 0 | _TIFFfreeExt(tif, origdata); |
2792 | 0 | return (TIFFReadDirEntryErrAlloc); |
2793 | 0 | } |
2794 | 0 | switch (direntry->tdir_type) |
2795 | 0 | { |
2796 | 0 | case TIFF_BYTE: |
2797 | 0 | { |
2798 | 0 | uint8_t *ma; |
2799 | 0 | float *mb; |
2800 | 0 | uint32_t n; |
2801 | 0 | ma = (uint8_t *)origdata; |
2802 | 0 | mb = data; |
2803 | 0 | for (n = 0; n < count; n++) |
2804 | 0 | *mb++ = (float)(*ma++); |
2805 | 0 | } |
2806 | 0 | break; |
2807 | 0 | case TIFF_SBYTE: |
2808 | 0 | { |
2809 | 0 | int8_t *ma; |
2810 | 0 | float *mb; |
2811 | 0 | uint32_t n; |
2812 | 0 | ma = (int8_t *)origdata; |
2813 | 0 | mb = data; |
2814 | 0 | for (n = 0; n < count; n++) |
2815 | 0 | *mb++ = (float)(*ma++); |
2816 | 0 | } |
2817 | 0 | break; |
2818 | 0 | case TIFF_SHORT: |
2819 | 0 | { |
2820 | 0 | uint16_t *ma; |
2821 | 0 | float *mb; |
2822 | 0 | uint32_t n; |
2823 | 0 | ma = (uint16_t *)origdata; |
2824 | 0 | mb = data; |
2825 | 0 | for (n = 0; n < count; n++) |
2826 | 0 | { |
2827 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2828 | 0 | TIFFSwabShort(ma); |
2829 | 0 | *mb++ = (float)(*ma++); |
2830 | 0 | } |
2831 | 0 | } |
2832 | 0 | break; |
2833 | 0 | case TIFF_SSHORT: |
2834 | 0 | { |
2835 | 0 | int16_t *ma; |
2836 | 0 | float *mb; |
2837 | 0 | uint32_t n; |
2838 | 0 | ma = (int16_t *)origdata; |
2839 | 0 | mb = data; |
2840 | 0 | for (n = 0; n < count; n++) |
2841 | 0 | { |
2842 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2843 | 0 | TIFFSwabShort((uint16_t *)ma); |
2844 | 0 | *mb++ = (float)(*ma++); |
2845 | 0 | } |
2846 | 0 | } |
2847 | 0 | break; |
2848 | 0 | case TIFF_LONG: |
2849 | 0 | { |
2850 | 0 | uint32_t *ma; |
2851 | 0 | float *mb; |
2852 | 0 | uint32_t n; |
2853 | 0 | ma = (uint32_t *)origdata; |
2854 | 0 | mb = data; |
2855 | 0 | for (n = 0; n < count; n++) |
2856 | 0 | { |
2857 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2858 | 0 | TIFFSwabLong(ma); |
2859 | 0 | *mb++ = (float)(*ma++); |
2860 | 0 | } |
2861 | 0 | } |
2862 | 0 | break; |
2863 | 0 | case TIFF_SLONG: |
2864 | 0 | { |
2865 | 0 | int32_t *ma; |
2866 | 0 | float *mb; |
2867 | 0 | uint32_t n; |
2868 | 0 | ma = (int32_t *)origdata; |
2869 | 0 | mb = data; |
2870 | 0 | for (n = 0; n < count; n++) |
2871 | 0 | { |
2872 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2873 | 0 | TIFFSwabLong((uint32_t *)ma); |
2874 | 0 | *mb++ = (float)(*ma++); |
2875 | 0 | } |
2876 | 0 | } |
2877 | 0 | break; |
2878 | 0 | case TIFF_LONG8: |
2879 | 0 | { |
2880 | 0 | uint64_t *ma; |
2881 | 0 | float *mb; |
2882 | 0 | uint32_t n; |
2883 | 0 | ma = (uint64_t *)origdata; |
2884 | 0 | mb = data; |
2885 | 0 | for (n = 0; n < count; n++) |
2886 | 0 | { |
2887 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2888 | 0 | TIFFSwabLong8(ma); |
2889 | 0 | *mb++ = (float)(*ma++); |
2890 | 0 | } |
2891 | 0 | } |
2892 | 0 | break; |
2893 | 0 | case TIFF_SLONG8: |
2894 | 0 | { |
2895 | 0 | int64_t *ma; |
2896 | 0 | float *mb; |
2897 | 0 | uint32_t n; |
2898 | 0 | ma = (int64_t *)origdata; |
2899 | 0 | mb = data; |
2900 | 0 | for (n = 0; n < count; n++) |
2901 | 0 | { |
2902 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2903 | 0 | TIFFSwabLong8((uint64_t *)ma); |
2904 | 0 | *mb++ = (float)(*ma++); |
2905 | 0 | } |
2906 | 0 | } |
2907 | 0 | break; |
2908 | 0 | case TIFF_RATIONAL: |
2909 | 0 | { |
2910 | 0 | uint32_t *ma; |
2911 | 0 | uint32_t maa; |
2912 | 0 | uint32_t mab; |
2913 | 0 | float *mb; |
2914 | 0 | uint32_t n; |
2915 | 0 | ma = (uint32_t *)origdata; |
2916 | 0 | mb = data; |
2917 | 0 | for (n = 0; n < count; n++) |
2918 | 0 | { |
2919 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2920 | 0 | TIFFSwabLong(ma); |
2921 | 0 | maa = *ma++; |
2922 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2923 | 0 | TIFFSwabLong(ma); |
2924 | 0 | mab = *ma++; |
2925 | 0 | if (mab == 0) |
2926 | 0 | *mb++ = 0.0; |
2927 | 0 | else |
2928 | 0 | *mb++ = (float)maa / (float)mab; |
2929 | 0 | } |
2930 | 0 | } |
2931 | 0 | break; |
2932 | 0 | case TIFF_SRATIONAL: |
2933 | 0 | { |
2934 | 0 | uint32_t *ma; |
2935 | 0 | int32_t maa; |
2936 | 0 | uint32_t mab; |
2937 | 0 | float *mb; |
2938 | 0 | uint32_t n; |
2939 | 0 | ma = (uint32_t *)origdata; |
2940 | 0 | mb = data; |
2941 | 0 | for (n = 0; n < count; n++) |
2942 | 0 | { |
2943 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2944 | 0 | TIFFSwabLong(ma); |
2945 | 0 | maa = *(int32_t *)ma; |
2946 | 0 | ma++; |
2947 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2948 | 0 | TIFFSwabLong(ma); |
2949 | 0 | mab = *ma++; |
2950 | 0 | if (mab == 0) |
2951 | 0 | *mb++ = 0.0; |
2952 | 0 | else |
2953 | 0 | *mb++ = (float)maa / (float)mab; |
2954 | 0 | } |
2955 | 0 | } |
2956 | 0 | break; |
2957 | 0 | case TIFF_DOUBLE: |
2958 | 0 | { |
2959 | 0 | double *ma; |
2960 | 0 | float *mb; |
2961 | 0 | uint32_t n; |
2962 | 0 | if (tif->tif_flags & TIFF_SWAB) |
2963 | 0 | TIFFSwabArrayOfLong8((uint64_t *)origdata, count); |
2964 | 0 | TIFFCvtIEEEDoubleToNative(tif, count, (double *)origdata); |
2965 | 0 | ma = (double *)origdata; |
2966 | 0 | mb = data; |
2967 | 0 | for (n = 0; n < count; n++) |
2968 | 0 | { |
2969 | 0 | double val = *ma++; |
2970 | 0 | if (val > FLT_MAX) |
2971 | 0 | val = FLT_MAX; |
2972 | 0 | else if (val < -FLT_MAX) |
2973 | 0 | val = -FLT_MAX; |
2974 | 0 | *mb++ = (float)val; |
2975 | 0 | } |
2976 | 0 | } |
2977 | 0 | break; |
2978 | 0 | } |
2979 | 0 | _TIFFfreeExt(tif, origdata); |
2980 | 0 | *value = data; |
2981 | 0 | return (TIFFReadDirEntryErrOk); |
2982 | 0 | } |
2983 | | |
2984 | | static enum TIFFReadDirEntryErr |
2985 | | TIFFReadDirEntryDoubleArray(TIFF *tif, TIFFDirEntry *direntry, double **value) |
2986 | 0 | { |
2987 | 0 | enum TIFFReadDirEntryErr err; |
2988 | 0 | uint32_t count; |
2989 | 0 | void *origdata; |
2990 | 0 | double *data; |
2991 | 0 | switch (direntry->tdir_type) |
2992 | 0 | { |
2993 | 0 | case TIFF_BYTE: |
2994 | 0 | case TIFF_SBYTE: |
2995 | 0 | case TIFF_SHORT: |
2996 | 0 | case TIFF_SSHORT: |
2997 | 0 | case TIFF_LONG: |
2998 | 0 | case TIFF_SLONG: |
2999 | 0 | case TIFF_LONG8: |
3000 | 0 | case TIFF_SLONG8: |
3001 | 0 | case TIFF_RATIONAL: |
3002 | 0 | case TIFF_SRATIONAL: |
3003 | 0 | case TIFF_FLOAT: |
3004 | 0 | case TIFF_DOUBLE: |
3005 | 0 | break; |
3006 | 0 | default: |
3007 | 0 | return (TIFFReadDirEntryErrType); |
3008 | 0 | } |
3009 | 0 | err = TIFFReadDirEntryArray(tif, direntry, &count, 8, &origdata); |
3010 | 0 | if ((err != TIFFReadDirEntryErrOk) || (origdata == 0)) |
3011 | 0 | { |
3012 | 0 | *value = 0; |
3013 | 0 | return (err); |
3014 | 0 | } |
3015 | 0 | switch (direntry->tdir_type) |
3016 | 0 | { |
3017 | 0 | case TIFF_DOUBLE: |
3018 | 0 | if (tif->tif_flags & TIFF_SWAB) |
3019 | 0 | TIFFSwabArrayOfLong8((uint64_t *)origdata, count); |
3020 | 0 | TIFFCvtIEEEDoubleToNative(tif, count, (double *)origdata); |
3021 | 0 | *value = (double *)origdata; |
3022 | 0 | return (TIFFReadDirEntryErrOk); |
3023 | 0 | } |
3024 | 0 | data = (double *)_TIFFmallocExt(tif, count * sizeof(double)); |
3025 | 0 | if (data == 0) |
3026 | 0 | { |
3027 | 0 | _TIFFfreeExt(tif, origdata); |
3028 | 0 | return (TIFFReadDirEntryErrAlloc); |
3029 | 0 | } |
3030 | 0 | switch (direntry->tdir_type) |
3031 | 0 | { |
3032 | 0 | case TIFF_BYTE: |
3033 | 0 | { |
3034 | 0 | uint8_t *ma; |
3035 | 0 | double *mb; |
3036 | 0 | uint32_t n; |
3037 | 0 | ma = (uint8_t *)origdata; |
3038 | 0 | mb = data; |
3039 | 0 | for (n = 0; n < count; n++) |
3040 | 0 | *mb++ = (double)(*ma++); |
3041 | 0 | } |
3042 | 0 | break; |
3043 | 0 | case TIFF_SBYTE: |
3044 | 0 | { |
3045 | 0 | int8_t *ma; |
3046 | 0 | double *mb; |
3047 | 0 | uint32_t n; |
3048 | 0 | ma = (int8_t *)origdata; |
3049 | 0 | mb = data; |
3050 | 0 | for (n = 0; n < count; n++) |
3051 | 0 | *mb++ = (double)(*ma++); |
3052 | 0 | } |
3053 | 0 | break; |
3054 | 0 | case TIFF_SHORT: |
3055 | 0 | { |
3056 | 0 | uint16_t *ma; |
3057 | 0 | double *mb; |
3058 | 0 | uint32_t n; |
3059 | 0 | ma = (uint16_t *)origdata; |
3060 | 0 | mb = data; |
3061 | 0 | for (n = 0; n < count; n++) |
3062 | 0 | { |
3063 | 0 | if (tif->tif_flags & TIFF_SWAB) |
3064 | 0 | TIFFSwabShort(ma); |
3065 | 0 | *mb++ = (double)(*ma++); |
3066 | 0 | } |
3067 | 0 | } |
3068 | 0 | break; |
3069 | 0 | case TIFF_SSHORT: |
3070 | 0 | { |
3071 | 0 | int16_t *ma; |
3072 | 0 | double *mb; |
3073 | 0 | uint32_t n; |
3074 | 0 | ma = (int16_t *)origdata; |
3075 | 0 | mb = data; |
3076 | 0 | for (n = 0; n < count; n++) |
3077 | 0 | { |
3078 | 0 | if (tif->tif_flags & TIFF_SWAB) |
3079 | 0 | TIFFSwabShort((uint16_t *)ma); |
3080 | 0 | *mb++ = (double)(*ma++); |
3081 | 0 | } |
3082 | 0 | } |
3083 | 0 | break; |
3084 | 0 | case TIFF_LONG: |
3085 | 0 | { |
3086 | 0 | uint32_t *ma; |
3087 | 0 | double *mb; |
3088 | 0 | uint32_t n; |
3089 | 0 | ma = (uint32_t *)origdata; |
3090 | 0 | mb = data; |
3091 | 0 | for (n = 0; n < count; n++) |
3092 | 0 | { |
3093 | 0 | if (tif->tif_flags & TIFF_SWAB) |
3094 | 0 | TIFFSwabLong(ma); |
3095 | 0 | *mb++ = (double)(*ma++); |
3096 | 0 | } |
3097 | 0 | } |
3098 | 0 | break; |
3099 | 0 | case TIFF_SLONG: |
3100 | 0 | { |
3101 | 0 | int32_t *ma; |
3102 | 0 | double *mb; |
3103 | 0 | uint32_t n; |
3104 | 0 | ma = (int32_t *)origdata; |
3105 | 0 | mb = data; |
3106 | 0 | for (n = 0; n < count; n++) |
3107 | 0 | { |
3108 | 0 | if (tif->tif_flags & TIFF_SWAB) |
3109 | 0 | TIFFSwabLong((uint32_t *)ma); |
3110 | 0 | *mb++ = (double)(*ma++); |
3111 | 0 | } |
3112 | 0 | } |
3113 | 0 | break; |
3114 | 0 | case TIFF_LONG8: |
3115 | 0 | { |
3116 | 0 | uint64_t *ma; |
3117 | 0 | double *mb; |
3118 | 0 | uint32_t n; |
3119 | 0 | ma = (uint64_t *)origdata; |
3120 | 0 | mb = data; |
3121 | 0 | for (n = 0; n < count; n++) |
3122 | 0 | { |
3123 | 0 | if (tif->tif_flags & TIFF_SWAB) |
3124 | 0 | TIFFSwabLong8(ma); |
3125 | 0 | *mb++ = (double)(*ma++); |
3126 | 0 | } |
3127 | 0 | } |
3128 | 0 | break; |
3129 | 0 | case TIFF_SLONG8: |
3130 | 0 | { |
3131 | 0 | int64_t *ma; |
3132 | 0 | double *mb; |
3133 | 0 | uint32_t n; |
3134 | 0 | ma = (int64_t *)origdata; |
3135 | 0 | mb = data; |
3136 | 0 | for (n = 0; n < count; n++) |
3137 | 0 | { |
3138 | 0 | if (tif->tif_flags & TIFF_SWAB) |
3139 | 0 | TIFFSwabLong8((uint64_t *)ma); |
3140 | 0 | *mb++ = (double)(*ma++); |
3141 | 0 | } |
3142 | 0 | } |
3143 | 0 | break; |
3144 | 0 | case TIFF_RATIONAL: |
3145 | 0 | { |
3146 | 0 | uint32_t *ma; |
3147 | 0 | uint32_t maa; |
3148 | 0 | uint32_t mab; |
3149 | 0 | double *mb; |
3150 | 0 | uint32_t n; |
3151 | 0 | ma = (uint32_t *)origdata; |
3152 | 0 | mb = data; |
3153 | 0 | for (n = 0; n < count; n++) |
3154 | 0 | { |
3155 | 0 | if (tif->tif_flags & TIFF_SWAB) |
3156 | 0 | TIFFSwabLong(ma); |
3157 | 0 | maa = *ma++; |
3158 | 0 | if (tif->tif_flags & TIFF_SWAB) |
3159 | 0 | TIFFSwabLong(ma); |
3160 | 0 | mab = *ma++; |
3161 | 0 | if (mab == 0) |
3162 | 0 | *mb++ = 0.0; |
3163 | 0 | else |
3164 | 0 | *mb++ = (double)maa / (double)mab; |
3165 | 0 | } |
3166 | 0 | } |
3167 | 0 | break; |
3168 | 0 | case TIFF_SRATIONAL: |
3169 | 0 | { |
3170 | 0 | uint32_t *ma; |
3171 | 0 | int32_t maa; |
3172 | 0 | uint32_t mab; |
3173 | 0 | double *mb; |
3174 | 0 | uint32_t n; |
3175 | 0 | ma = (uint32_t *)origdata; |
3176 | 0 | mb = data; |
3177 | 0 | for (n = 0; n < count; n++) |
3178 | 0 | { |
3179 | 0 | if (tif->tif_flags & TIFF_SWAB) |
3180 | 0 | TIFFSwabLong(ma); |
3181 | 0 | maa = *(int32_t *)ma; |
3182 | 0 | ma++; |
3183 | 0 | if (tif->tif_flags & TIFF_SWAB) |
3184 | 0 | TIFFSwabLong(ma); |
3185 | 0 | mab = *ma++; |
3186 | 0 | if (mab == 0) |
3187 | 0 | *mb++ = 0.0; |
3188 | 0 | else |
3189 | 0 | *mb++ = (double)maa / (double)mab; |
3190 | 0 | } |
3191 | 0 | } |
3192 | 0 | break; |
3193 | 0 | case TIFF_FLOAT: |
3194 | 0 | { |
3195 | 0 | float *ma; |
3196 | 0 | double *mb; |
3197 | 0 | uint32_t n; |
3198 | 0 | if (tif->tif_flags & TIFF_SWAB) |
3199 | 0 | TIFFSwabArrayOfLong((uint32_t *)origdata, count); |
3200 | 0 | TIFFCvtIEEEFloatToNative(tif, count, (float *)origdata); |
3201 | 0 | ma = (float *)origdata; |
3202 | 0 | mb = data; |
3203 | 0 | for (n = 0; n < count; n++) |
3204 | 0 | *mb++ = (double)(*ma++); |
3205 | 0 | } |
3206 | 0 | break; |
3207 | 0 | } |
3208 | 0 | _TIFFfreeExt(tif, origdata); |
3209 | 0 | *value = data; |
3210 | 0 | return (TIFFReadDirEntryErrOk); |
3211 | 0 | } |
3212 | | |
3213 | | static enum TIFFReadDirEntryErr |
3214 | | TIFFReadDirEntryIfd8Array(TIFF *tif, TIFFDirEntry *direntry, uint64_t **value) |
3215 | 0 | { |
3216 | 0 | enum TIFFReadDirEntryErr err; |
3217 | 0 | uint32_t count; |
3218 | 0 | void *origdata; |
3219 | 0 | uint64_t *data; |
3220 | 0 | switch (direntry->tdir_type) |
3221 | 0 | { |
3222 | 0 | case TIFF_LONG: |
3223 | 0 | case TIFF_LONG8: |
3224 | 0 | case TIFF_IFD: |
3225 | 0 | case TIFF_IFD8: |
3226 | 0 | break; |
3227 | 0 | default: |
3228 | 0 | return (TIFFReadDirEntryErrType); |
3229 | 0 | } |
3230 | 0 | err = TIFFReadDirEntryArray(tif, direntry, &count, 8, &origdata); |
3231 | 0 | if ((err != TIFFReadDirEntryErrOk) || (origdata == 0)) |
3232 | 0 | { |
3233 | 0 | *value = 0; |
3234 | 0 | return (err); |
3235 | 0 | } |
3236 | 0 | switch (direntry->tdir_type) |
3237 | 0 | { |
3238 | 0 | case TIFF_LONG8: |
3239 | 0 | case TIFF_IFD8: |
3240 | 0 | *value = (uint64_t *)origdata; |
3241 | 0 | if (tif->tif_flags & TIFF_SWAB) |
3242 | 0 | TIFFSwabArrayOfLong8(*value, count); |
3243 | 0 | return (TIFFReadDirEntryErrOk); |
3244 | 0 | } |
3245 | 0 | data = (uint64_t *)_TIFFmallocExt(tif, count * 8); |
3246 | 0 | if (data == 0) |
3247 | 0 | { |
3248 | 0 | _TIFFfreeExt(tif, origdata); |
3249 | 0 | return (TIFFReadDirEntryErrAlloc); |
3250 | 0 | } |
3251 | 0 | switch (direntry->tdir_type) |
3252 | 0 | { |
3253 | 0 | case TIFF_LONG: |
3254 | 0 | case TIFF_IFD: |
3255 | 0 | { |
3256 | 0 | uint32_t *ma; |
3257 | 0 | uint64_t *mb; |
3258 | 0 | uint32_t n; |
3259 | 0 | ma = (uint32_t *)origdata; |
3260 | 0 | mb = data; |
3261 | 0 | for (n = 0; n < count; n++) |
3262 | 0 | { |
3263 | 0 | if (tif->tif_flags & TIFF_SWAB) |
3264 | 0 | TIFFSwabLong(ma); |
3265 | 0 | *mb++ = (uint64_t)(*ma++); |
3266 | 0 | } |
3267 | 0 | } |
3268 | 0 | break; |
3269 | 0 | } |
3270 | 0 | _TIFFfreeExt(tif, origdata); |
3271 | 0 | *value = data; |
3272 | 0 | return (TIFFReadDirEntryErrOk); |
3273 | 0 | } |
3274 | | |
3275 | | static enum TIFFReadDirEntryErr |
3276 | | TIFFReadDirEntryPersampleShort(TIFF *tif, TIFFDirEntry *direntry, |
3277 | | uint16_t *value) |
3278 | 0 | { |
3279 | 0 | enum TIFFReadDirEntryErr err; |
3280 | 0 | uint16_t *m; |
3281 | 0 | uint16_t *na; |
3282 | 0 | uint16_t nb; |
3283 | 0 | if (direntry->tdir_count < (uint64_t)tif->tif_dir.td_samplesperpixel) |
3284 | 0 | return (TIFFReadDirEntryErrCount); |
3285 | 0 | err = TIFFReadDirEntryShortArray(tif, direntry, &m); |
3286 | 0 | if (err != TIFFReadDirEntryErrOk || m == NULL) |
3287 | 0 | return (err); |
3288 | 0 | na = m; |
3289 | 0 | nb = tif->tif_dir.td_samplesperpixel; |
3290 | 0 | *value = *na++; |
3291 | 0 | nb--; |
3292 | 0 | while (nb > 0) |
3293 | 0 | { |
3294 | 0 | if (*na++ != *value) |
3295 | 0 | { |
3296 | 0 | err = TIFFReadDirEntryErrPsdif; |
3297 | 0 | break; |
3298 | 0 | } |
3299 | 0 | nb--; |
3300 | 0 | } |
3301 | 0 | _TIFFfreeExt(tif, m); |
3302 | 0 | return (err); |
3303 | 0 | } |
3304 | | |
3305 | | static void TIFFReadDirEntryCheckedByte(TIFF *tif, TIFFDirEntry *direntry, |
3306 | | uint8_t *value) |
3307 | 0 | { |
3308 | 0 | (void)tif; |
3309 | 0 | *value = *(uint8_t *)(&direntry->tdir_offset); |
3310 | 0 | } |
3311 | | |
3312 | | static void TIFFReadDirEntryCheckedSbyte(TIFF *tif, TIFFDirEntry *direntry, |
3313 | | int8_t *value) |
3314 | 0 | { |
3315 | 0 | (void)tif; |
3316 | 0 | *value = *(int8_t *)(&direntry->tdir_offset); |
3317 | 0 | } |
3318 | | |
3319 | | static void TIFFReadDirEntryCheckedShort(TIFF *tif, TIFFDirEntry *direntry, |
3320 | | uint16_t *value) |
3321 | 0 | { |
3322 | 0 | *value = direntry->tdir_offset.toff_short; |
3323 | | /* *value=*(uint16_t*)(&direntry->tdir_offset); */ |
3324 | 0 | if (tif->tif_flags & TIFF_SWAB) |
3325 | 0 | TIFFSwabShort(value); |
3326 | 0 | } |
3327 | | |
3328 | | static void TIFFReadDirEntryCheckedSshort(TIFF *tif, TIFFDirEntry *direntry, |
3329 | | int16_t *value) |
3330 | 0 | { |
3331 | 0 | *value = *(int16_t *)(&direntry->tdir_offset); |
3332 | 0 | if (tif->tif_flags & TIFF_SWAB) |
3333 | 0 | TIFFSwabShort((uint16_t *)value); |
3334 | 0 | } |
3335 | | |
3336 | | static void TIFFReadDirEntryCheckedLong(TIFF *tif, TIFFDirEntry *direntry, |
3337 | | uint32_t *value) |
3338 | 0 | { |
3339 | 0 | *value = *(uint32_t *)(&direntry->tdir_offset); |
3340 | 0 | if (tif->tif_flags & TIFF_SWAB) |
3341 | 0 | TIFFSwabLong(value); |
3342 | 0 | } |
3343 | | |
3344 | | static void TIFFReadDirEntryCheckedSlong(TIFF *tif, TIFFDirEntry *direntry, |
3345 | | int32_t *value) |
3346 | 0 | { |
3347 | 0 | *value = *(int32_t *)(&direntry->tdir_offset); |
3348 | 0 | if (tif->tif_flags & TIFF_SWAB) |
3349 | 0 | TIFFSwabLong((uint32_t *)value); |
3350 | 0 | } |
3351 | | |
3352 | | static enum TIFFReadDirEntryErr |
3353 | | TIFFReadDirEntryCheckedLong8(TIFF *tif, TIFFDirEntry *direntry, uint64_t *value) |
3354 | 0 | { |
3355 | 0 | if (!(tif->tif_flags & TIFF_BIGTIFF)) |
3356 | 0 | { |
3357 | 0 | enum TIFFReadDirEntryErr err; |
3358 | 0 | uint32_t offset = direntry->tdir_offset.toff_long; |
3359 | 0 | if (tif->tif_flags & TIFF_SWAB) |
3360 | 0 | TIFFSwabLong(&offset); |
3361 | 0 | err = TIFFReadDirEntryData(tif, offset, 8, value); |
3362 | 0 | if (err != TIFFReadDirEntryErrOk) |
3363 | 0 | return (err); |
3364 | 0 | } |
3365 | 0 | else |
3366 | 0 | *value = direntry->tdir_offset.toff_long8; |
3367 | 0 | if (tif->tif_flags & TIFF_SWAB) |
3368 | 0 | TIFFSwabLong8(value); |
3369 | 0 | return (TIFFReadDirEntryErrOk); |
3370 | 0 | } |
3371 | | |
3372 | | static enum TIFFReadDirEntryErr |
3373 | | TIFFReadDirEntryCheckedSlong8(TIFF *tif, TIFFDirEntry *direntry, int64_t *value) |
3374 | 0 | { |
3375 | 0 | if (!(tif->tif_flags & TIFF_BIGTIFF)) |
3376 | 0 | { |
3377 | 0 | enum TIFFReadDirEntryErr err; |
3378 | 0 | uint32_t offset = direntry->tdir_offset.toff_long; |
3379 | 0 | if (tif->tif_flags & TIFF_SWAB) |
3380 | 0 | TIFFSwabLong(&offset); |
3381 | 0 | err = TIFFReadDirEntryData(tif, offset, 8, value); |
3382 | 0 | if (err != TIFFReadDirEntryErrOk) |
3383 | 0 | return (err); |
3384 | 0 | } |
3385 | 0 | else |
3386 | 0 | *value = *(int64_t *)(&direntry->tdir_offset); |
3387 | 0 | if (tif->tif_flags & TIFF_SWAB) |
3388 | 0 | TIFFSwabLong8((uint64_t *)value); |
3389 | 0 | return (TIFFReadDirEntryErrOk); |
3390 | 0 | } |
3391 | | |
3392 | | static enum TIFFReadDirEntryErr |
3393 | | TIFFReadDirEntryCheckedRational(TIFF *tif, TIFFDirEntry *direntry, |
3394 | | double *value) |
3395 | 0 | { |
3396 | 0 | UInt64Aligned_t m; |
3397 | |
|
3398 | 0 | assert(sizeof(double) == 8); |
3399 | 0 | assert(sizeof(uint64_t) == 8); |
3400 | 0 | assert(sizeof(uint32_t) == 4); |
3401 | 0 | if (!(tif->tif_flags & TIFF_BIGTIFF)) |
3402 | 0 | { |
3403 | 0 | enum TIFFReadDirEntryErr err; |
3404 | 0 | uint32_t offset = direntry->tdir_offset.toff_long; |
3405 | 0 | if (tif->tif_flags & TIFF_SWAB) |
3406 | 0 | TIFFSwabLong(&offset); |
3407 | 0 | err = TIFFReadDirEntryData(tif, offset, 8, m.i); |
3408 | 0 | if (err != TIFFReadDirEntryErrOk) |
3409 | 0 | return (err); |
3410 | 0 | } |
3411 | 0 | else |
3412 | 0 | m.l = direntry->tdir_offset.toff_long8; |
3413 | 0 | if (tif->tif_flags & TIFF_SWAB) |
3414 | 0 | TIFFSwabArrayOfLong(m.i, 2); |
3415 | | /* Not completely sure what we should do when m.i[1]==0, but some */ |
3416 | | /* sanitizers do not like division by 0.0: */ |
3417 | | /* http://bugzilla.maptools.org/show_bug.cgi?id=2644 */ |
3418 | 0 | if (m.i[0] == 0 || m.i[1] == 0) |
3419 | 0 | *value = 0.0; |
3420 | 0 | else |
3421 | 0 | *value = (double)m.i[0] / (double)m.i[1]; |
3422 | 0 | return (TIFFReadDirEntryErrOk); |
3423 | 0 | } |
3424 | | |
3425 | | static enum TIFFReadDirEntryErr |
3426 | | TIFFReadDirEntryCheckedSrational(TIFF *tif, TIFFDirEntry *direntry, |
3427 | | double *value) |
3428 | 0 | { |
3429 | 0 | UInt64Aligned_t m; |
3430 | 0 | assert(sizeof(double) == 8); |
3431 | 0 | assert(sizeof(uint64_t) == 8); |
3432 | 0 | assert(sizeof(int32_t) == 4); |
3433 | 0 | assert(sizeof(uint32_t) == 4); |
3434 | 0 | if (!(tif->tif_flags & TIFF_BIGTIFF)) |
3435 | 0 | { |
3436 | 0 | enum TIFFReadDirEntryErr err; |
3437 | 0 | uint32_t offset = direntry->tdir_offset.toff_long; |
3438 | 0 | if (tif->tif_flags & TIFF_SWAB) |
3439 | 0 | TIFFSwabLong(&offset); |
3440 | 0 | err = TIFFReadDirEntryData(tif, offset, 8, m.i); |
3441 | 0 | if (err != TIFFReadDirEntryErrOk) |
3442 | 0 | return (err); |
3443 | 0 | } |
3444 | 0 | else |
3445 | 0 | m.l = direntry->tdir_offset.toff_long8; |
3446 | 0 | if (tif->tif_flags & TIFF_SWAB) |
3447 | 0 | TIFFSwabArrayOfLong(m.i, 2); |
3448 | | /* Not completely sure what we should do when m.i[1]==0, but some */ |
3449 | | /* sanitizers do not like division by 0.0: */ |
3450 | | /* http://bugzilla.maptools.org/show_bug.cgi?id=2644 */ |
3451 | 0 | if ((int32_t)m.i[0] == 0 || m.i[1] == 0) |
3452 | 0 | *value = 0.0; |
3453 | 0 | else |
3454 | 0 | *value = (double)((int32_t)m.i[0]) / (double)m.i[1]; |
3455 | 0 | return (TIFFReadDirEntryErrOk); |
3456 | 0 | } |
3457 | | |
3458 | | #if 0 |
3459 | | static enum TIFFReadDirEntryErr |
3460 | | TIFFReadDirEntryCheckedRationalDirect(TIFF *tif, TIFFDirEntry *direntry, |
3461 | | TIFFRational_t *value) |
3462 | | { /*--: SetGetRATIONAL_directly:_CustomTag: Read rational (and signed rationals) |
3463 | | directly --*/ |
3464 | | UInt64Aligned_t m; |
3465 | | |
3466 | | assert(sizeof(double) == 8); |
3467 | | assert(sizeof(uint64_t) == 8); |
3468 | | assert(sizeof(uint32_t) == 4); |
3469 | | |
3470 | | if (direntry->tdir_count != 1) |
3471 | | return (TIFFReadDirEntryErrCount); |
3472 | | |
3473 | | if (direntry->tdir_type != TIFF_RATIONAL && |
3474 | | direntry->tdir_type != TIFF_SRATIONAL) |
3475 | | return (TIFFReadDirEntryErrType); |
3476 | | |
3477 | | if (!(tif->tif_flags & TIFF_BIGTIFF)) |
3478 | | { |
3479 | | enum TIFFReadDirEntryErr err; |
3480 | | uint32_t offset = direntry->tdir_offset.toff_long; |
3481 | | if (tif->tif_flags & TIFF_SWAB) |
3482 | | TIFFSwabLong(&offset); |
3483 | | err = TIFFReadDirEntryData(tif, offset, 8, m.i); |
3484 | | if (err != TIFFReadDirEntryErrOk) |
3485 | | return (err); |
3486 | | } |
3487 | | else |
3488 | | { |
3489 | | m.l = direntry->tdir_offset.toff_long8; |
3490 | | } |
3491 | | |
3492 | | if (tif->tif_flags & TIFF_SWAB) |
3493 | | TIFFSwabArrayOfLong(m.i, 2); |
3494 | | |
3495 | | value->uNum = m.i[0]; |
3496 | | value->uDenom = m.i[1]; |
3497 | | return (TIFFReadDirEntryErrOk); |
3498 | | } /*-- TIFFReadDirEntryCheckedRationalDirect() --*/ |
3499 | | #endif |
3500 | | |
3501 | | static void TIFFReadDirEntryCheckedFloat(TIFF *tif, TIFFDirEntry *direntry, |
3502 | | float *value) |
3503 | 0 | { |
3504 | 0 | union |
3505 | 0 | { |
3506 | 0 | float f; |
3507 | 0 | uint32_t i; |
3508 | 0 | } float_union; |
3509 | 0 | assert(sizeof(float) == 4); |
3510 | 0 | assert(sizeof(uint32_t) == 4); |
3511 | 0 | assert(sizeof(float_union) == 4); |
3512 | 0 | float_union.i = *(uint32_t *)(&direntry->tdir_offset); |
3513 | 0 | *value = float_union.f; |
3514 | 0 | if (tif->tif_flags & TIFF_SWAB) |
3515 | 0 | TIFFSwabLong((uint32_t *)value); |
3516 | 0 | } |
3517 | | |
3518 | | static enum TIFFReadDirEntryErr |
3519 | | TIFFReadDirEntryCheckedDouble(TIFF *tif, TIFFDirEntry *direntry, double *value) |
3520 | 0 | { |
3521 | 0 | assert(sizeof(double) == 8); |
3522 | 0 | assert(sizeof(uint64_t) == 8); |
3523 | 0 | assert(sizeof(UInt64Aligned_t) == 8); |
3524 | 0 | if (!(tif->tif_flags & TIFF_BIGTIFF)) |
3525 | 0 | { |
3526 | 0 | enum TIFFReadDirEntryErr err; |
3527 | 0 | uint32_t offset = direntry->tdir_offset.toff_long; |
3528 | 0 | if (tif->tif_flags & TIFF_SWAB) |
3529 | 0 | TIFFSwabLong(&offset); |
3530 | 0 | err = TIFFReadDirEntryData(tif, offset, 8, value); |
3531 | 0 | if (err != TIFFReadDirEntryErrOk) |
3532 | 0 | return (err); |
3533 | 0 | } |
3534 | 0 | else |
3535 | 0 | { |
3536 | 0 | UInt64Aligned_t uint64_union; |
3537 | 0 | uint64_union.l = direntry->tdir_offset.toff_long8; |
3538 | 0 | *value = uint64_union.d; |
3539 | 0 | } |
3540 | 0 | if (tif->tif_flags & TIFF_SWAB) |
3541 | 0 | TIFFSwabLong8((uint64_t *)value); |
3542 | 0 | return (TIFFReadDirEntryErrOk); |
3543 | 0 | } |
3544 | | |
3545 | | static enum TIFFReadDirEntryErr |
3546 | | TIFFReadDirEntryCheckRangeByteSbyte(int8_t value) |
3547 | 0 | { |
3548 | 0 | if (value < 0) |
3549 | 0 | return (TIFFReadDirEntryErrRange); |
3550 | 0 | else |
3551 | 0 | return (TIFFReadDirEntryErrOk); |
3552 | 0 | } |
3553 | | |
3554 | | static enum TIFFReadDirEntryErr |
3555 | | TIFFReadDirEntryCheckRangeByteShort(uint16_t value) |
3556 | 0 | { |
3557 | 0 | if (value > 0xFF) |
3558 | 0 | return (TIFFReadDirEntryErrRange); |
3559 | 0 | else |
3560 | 0 | return (TIFFReadDirEntryErrOk); |
3561 | 0 | } |
3562 | | |
3563 | | static enum TIFFReadDirEntryErr |
3564 | | TIFFReadDirEntryCheckRangeByteSshort(int16_t value) |
3565 | 0 | { |
3566 | 0 | if ((value < 0) || (value > 0xFF)) |
3567 | 0 | return (TIFFReadDirEntryErrRange); |
3568 | 0 | else |
3569 | 0 | return (TIFFReadDirEntryErrOk); |
3570 | 0 | } |
3571 | | |
3572 | | static enum TIFFReadDirEntryErr |
3573 | | TIFFReadDirEntryCheckRangeByteLong(uint32_t value) |
3574 | 0 | { |
3575 | 0 | if (value > 0xFF) |
3576 | 0 | return (TIFFReadDirEntryErrRange); |
3577 | 0 | else |
3578 | 0 | return (TIFFReadDirEntryErrOk); |
3579 | 0 | } |
3580 | | |
3581 | | static enum TIFFReadDirEntryErr |
3582 | | TIFFReadDirEntryCheckRangeByteSlong(int32_t value) |
3583 | 0 | { |
3584 | 0 | if ((value < 0) || (value > 0xFF)) |
3585 | 0 | return (TIFFReadDirEntryErrRange); |
3586 | 0 | else |
3587 | 0 | return (TIFFReadDirEntryErrOk); |
3588 | 0 | } |
3589 | | |
3590 | | static enum TIFFReadDirEntryErr |
3591 | | TIFFReadDirEntryCheckRangeByteLong8(uint64_t value) |
3592 | 0 | { |
3593 | 0 | if (value > 0xFF) |
3594 | 0 | return (TIFFReadDirEntryErrRange); |
3595 | 0 | else |
3596 | 0 | return (TIFFReadDirEntryErrOk); |
3597 | 0 | } |
3598 | | |
3599 | | static enum TIFFReadDirEntryErr |
3600 | | TIFFReadDirEntryCheckRangeByteSlong8(int64_t value) |
3601 | 0 | { |
3602 | 0 | if ((value < 0) || (value > 0xFF)) |
3603 | 0 | return (TIFFReadDirEntryErrRange); |
3604 | 0 | else |
3605 | 0 | return (TIFFReadDirEntryErrOk); |
3606 | 0 | } |
3607 | | |
3608 | | static enum TIFFReadDirEntryErr |
3609 | | TIFFReadDirEntryCheckRangeSbyteByte(uint8_t value) |
3610 | 0 | { |
3611 | 0 | if (value > 0x7F) |
3612 | 0 | return (TIFFReadDirEntryErrRange); |
3613 | 0 | else |
3614 | 0 | return (TIFFReadDirEntryErrOk); |
3615 | 0 | } |
3616 | | |
3617 | | static enum TIFFReadDirEntryErr |
3618 | | TIFFReadDirEntryCheckRangeSbyteShort(uint16_t value) |
3619 | 0 | { |
3620 | 0 | if (value > 0x7F) |
3621 | 0 | return (TIFFReadDirEntryErrRange); |
3622 | 0 | else |
3623 | 0 | return (TIFFReadDirEntryErrOk); |
3624 | 0 | } |
3625 | | |
3626 | | static enum TIFFReadDirEntryErr |
3627 | | TIFFReadDirEntryCheckRangeSbyteSshort(int16_t value) |
3628 | 0 | { |
3629 | 0 | if ((value < -0x80) || (value > 0x7F)) |
3630 | 0 | return (TIFFReadDirEntryErrRange); |
3631 | 0 | else |
3632 | 0 | return (TIFFReadDirEntryErrOk); |
3633 | 0 | } |
3634 | | |
3635 | | static enum TIFFReadDirEntryErr |
3636 | | TIFFReadDirEntryCheckRangeSbyteLong(uint32_t value) |
3637 | 0 | { |
3638 | 0 | if (value > 0x7F) |
3639 | 0 | return (TIFFReadDirEntryErrRange); |
3640 | 0 | else |
3641 | 0 | return (TIFFReadDirEntryErrOk); |
3642 | 0 | } |
3643 | | |
3644 | | static enum TIFFReadDirEntryErr |
3645 | | TIFFReadDirEntryCheckRangeSbyteSlong(int32_t value) |
3646 | 0 | { |
3647 | 0 | if ((value < -0x80) || (value > 0x7F)) |
3648 | 0 | return (TIFFReadDirEntryErrRange); |
3649 | 0 | else |
3650 | 0 | return (TIFFReadDirEntryErrOk); |
3651 | 0 | } |
3652 | | |
3653 | | static enum TIFFReadDirEntryErr |
3654 | | TIFFReadDirEntryCheckRangeSbyteLong8(uint64_t value) |
3655 | 0 | { |
3656 | 0 | if (value > 0x7F) |
3657 | 0 | return (TIFFReadDirEntryErrRange); |
3658 | 0 | else |
3659 | 0 | return (TIFFReadDirEntryErrOk); |
3660 | 0 | } |
3661 | | |
3662 | | static enum TIFFReadDirEntryErr |
3663 | | TIFFReadDirEntryCheckRangeSbyteSlong8(int64_t value) |
3664 | 0 | { |
3665 | 0 | if ((value < -0x80) || (value > 0x7F)) |
3666 | 0 | return (TIFFReadDirEntryErrRange); |
3667 | 0 | else |
3668 | 0 | return (TIFFReadDirEntryErrOk); |
3669 | 0 | } |
3670 | | |
3671 | | static enum TIFFReadDirEntryErr |
3672 | | TIFFReadDirEntryCheckRangeShortSbyte(int8_t value) |
3673 | 0 | { |
3674 | 0 | if (value < 0) |
3675 | 0 | return (TIFFReadDirEntryErrRange); |
3676 | 0 | else |
3677 | 0 | return (TIFFReadDirEntryErrOk); |
3678 | 0 | } |
3679 | | |
3680 | | static enum TIFFReadDirEntryErr |
3681 | | TIFFReadDirEntryCheckRangeShortSshort(int16_t value) |
3682 | 0 | { |
3683 | 0 | if (value < 0) |
3684 | 0 | return (TIFFReadDirEntryErrRange); |
3685 | 0 | else |
3686 | 0 | return (TIFFReadDirEntryErrOk); |
3687 | 0 | } |
3688 | | |
3689 | | static enum TIFFReadDirEntryErr |
3690 | | TIFFReadDirEntryCheckRangeShortLong(uint32_t value) |
3691 | 0 | { |
3692 | 0 | if (value > 0xFFFF) |
3693 | 0 | return (TIFFReadDirEntryErrRange); |
3694 | 0 | else |
3695 | 0 | return (TIFFReadDirEntryErrOk); |
3696 | 0 | } |
3697 | | |
3698 | | static enum TIFFReadDirEntryErr |
3699 | | TIFFReadDirEntryCheckRangeShortSlong(int32_t value) |
3700 | 0 | { |
3701 | 0 | if ((value < 0) || (value > 0xFFFF)) |
3702 | 0 | return (TIFFReadDirEntryErrRange); |
3703 | 0 | else |
3704 | 0 | return (TIFFReadDirEntryErrOk); |
3705 | 0 | } |
3706 | | |
3707 | | static enum TIFFReadDirEntryErr |
3708 | | TIFFReadDirEntryCheckRangeShortLong8(uint64_t value) |
3709 | 0 | { |
3710 | 0 | if (value > 0xFFFF) |
3711 | 0 | return (TIFFReadDirEntryErrRange); |
3712 | 0 | else |
3713 | 0 | return (TIFFReadDirEntryErrOk); |
3714 | 0 | } |
3715 | | |
3716 | | static enum TIFFReadDirEntryErr |
3717 | | TIFFReadDirEntryCheckRangeShortSlong8(int64_t value) |
3718 | 0 | { |
3719 | 0 | if ((value < 0) || (value > 0xFFFF)) |
3720 | 0 | return (TIFFReadDirEntryErrRange); |
3721 | 0 | else |
3722 | 0 | return (TIFFReadDirEntryErrOk); |
3723 | 0 | } |
3724 | | |
3725 | | static enum TIFFReadDirEntryErr |
3726 | | TIFFReadDirEntryCheckRangeSshortShort(uint16_t value) |
3727 | 0 | { |
3728 | 0 | if (value > 0x7FFF) |
3729 | 0 | return (TIFFReadDirEntryErrRange); |
3730 | 0 | else |
3731 | 0 | return (TIFFReadDirEntryErrOk); |
3732 | 0 | } |
3733 | | |
3734 | | static enum TIFFReadDirEntryErr |
3735 | | TIFFReadDirEntryCheckRangeSshortLong(uint32_t value) |
3736 | 0 | { |
3737 | 0 | if (value > 0x7FFF) |
3738 | 0 | return (TIFFReadDirEntryErrRange); |
3739 | 0 | else |
3740 | 0 | return (TIFFReadDirEntryErrOk); |
3741 | 0 | } |
3742 | | |
3743 | | static enum TIFFReadDirEntryErr |
3744 | | TIFFReadDirEntryCheckRangeSshortSlong(int32_t value) |
3745 | 0 | { |
3746 | 0 | if ((value < -0x8000) || (value > 0x7FFF)) |
3747 | 0 | return (TIFFReadDirEntryErrRange); |
3748 | 0 | else |
3749 | 0 | return (TIFFReadDirEntryErrOk); |
3750 | 0 | } |
3751 | | |
3752 | | static enum TIFFReadDirEntryErr |
3753 | | TIFFReadDirEntryCheckRangeSshortLong8(uint64_t value) |
3754 | 0 | { |
3755 | 0 | if (value > 0x7FFF) |
3756 | 0 | return (TIFFReadDirEntryErrRange); |
3757 | 0 | else |
3758 | 0 | return (TIFFReadDirEntryErrOk); |
3759 | 0 | } |
3760 | | |
3761 | | static enum TIFFReadDirEntryErr |
3762 | | TIFFReadDirEntryCheckRangeSshortSlong8(int64_t value) |
3763 | 0 | { |
3764 | 0 | if ((value < -0x8000) || (value > 0x7FFF)) |
3765 | 0 | return (TIFFReadDirEntryErrRange); |
3766 | 0 | else |
3767 | 0 | return (TIFFReadDirEntryErrOk); |
3768 | 0 | } |
3769 | | |
3770 | | static enum TIFFReadDirEntryErr |
3771 | | TIFFReadDirEntryCheckRangeLongSbyte(int8_t value) |
3772 | 0 | { |
3773 | 0 | if (value < 0) |
3774 | 0 | return (TIFFReadDirEntryErrRange); |
3775 | 0 | else |
3776 | 0 | return (TIFFReadDirEntryErrOk); |
3777 | 0 | } |
3778 | | |
3779 | | static enum TIFFReadDirEntryErr |
3780 | | TIFFReadDirEntryCheckRangeLongSshort(int16_t value) |
3781 | 0 | { |
3782 | 0 | if (value < 0) |
3783 | 0 | return (TIFFReadDirEntryErrRange); |
3784 | 0 | else |
3785 | 0 | return (TIFFReadDirEntryErrOk); |
3786 | 0 | } |
3787 | | |
3788 | | static enum TIFFReadDirEntryErr |
3789 | | TIFFReadDirEntryCheckRangeLongSlong(int32_t value) |
3790 | 0 | { |
3791 | 0 | if (value < 0) |
3792 | 0 | return (TIFFReadDirEntryErrRange); |
3793 | 0 | else |
3794 | 0 | return (TIFFReadDirEntryErrOk); |
3795 | 0 | } |
3796 | | |
3797 | | static enum TIFFReadDirEntryErr |
3798 | | TIFFReadDirEntryCheckRangeLongLong8(uint64_t value) |
3799 | 0 | { |
3800 | 0 | if (value > UINT32_MAX) |
3801 | 0 | return (TIFFReadDirEntryErrRange); |
3802 | 0 | else |
3803 | 0 | return (TIFFReadDirEntryErrOk); |
3804 | 0 | } |
3805 | | |
3806 | | static enum TIFFReadDirEntryErr |
3807 | | TIFFReadDirEntryCheckRangeLongSlong8(int64_t value) |
3808 | 0 | { |
3809 | 0 | if ((value < 0) || (value > (int64_t)UINT32_MAX)) |
3810 | 0 | return (TIFFReadDirEntryErrRange); |
3811 | 0 | else |
3812 | 0 | return (TIFFReadDirEntryErrOk); |
3813 | 0 | } |
3814 | | |
3815 | | static enum TIFFReadDirEntryErr |
3816 | | TIFFReadDirEntryCheckRangeSlongLong(uint32_t value) |
3817 | 0 | { |
3818 | 0 | if (value > 0x7FFFFFFFUL) |
3819 | 0 | return (TIFFReadDirEntryErrRange); |
3820 | 0 | else |
3821 | 0 | return (TIFFReadDirEntryErrOk); |
3822 | 0 | } |
3823 | | |
3824 | | /* Check that the 8-byte unsigned value can fit in a 4-byte unsigned range */ |
3825 | | static enum TIFFReadDirEntryErr |
3826 | | TIFFReadDirEntryCheckRangeSlongLong8(uint64_t value) |
3827 | 0 | { |
3828 | 0 | if (value > 0x7FFFFFFF) |
3829 | 0 | return (TIFFReadDirEntryErrRange); |
3830 | 0 | else |
3831 | 0 | return (TIFFReadDirEntryErrOk); |
3832 | 0 | } |
3833 | | |
3834 | | /* Check that the 8-byte signed value can fit in a 4-byte signed range */ |
3835 | | static enum TIFFReadDirEntryErr |
3836 | | TIFFReadDirEntryCheckRangeSlongSlong8(int64_t value) |
3837 | 0 | { |
3838 | 0 | if ((value < 0 - ((int64_t)0x7FFFFFFF + 1)) || (value > 0x7FFFFFFF)) |
3839 | 0 | return (TIFFReadDirEntryErrRange); |
3840 | 0 | else |
3841 | 0 | return (TIFFReadDirEntryErrOk); |
3842 | 0 | } |
3843 | | |
3844 | | static enum TIFFReadDirEntryErr |
3845 | | TIFFReadDirEntryCheckRangeLong8Sbyte(int8_t value) |
3846 | 0 | { |
3847 | 0 | if (value < 0) |
3848 | 0 | return (TIFFReadDirEntryErrRange); |
3849 | 0 | else |
3850 | 0 | return (TIFFReadDirEntryErrOk); |
3851 | 0 | } |
3852 | | |
3853 | | static enum TIFFReadDirEntryErr |
3854 | | TIFFReadDirEntryCheckRangeLong8Sshort(int16_t value) |
3855 | 0 | { |
3856 | 0 | if (value < 0) |
3857 | 0 | return (TIFFReadDirEntryErrRange); |
3858 | 0 | else |
3859 | 0 | return (TIFFReadDirEntryErrOk); |
3860 | 0 | } |
3861 | | |
3862 | | static enum TIFFReadDirEntryErr |
3863 | | TIFFReadDirEntryCheckRangeLong8Slong(int32_t value) |
3864 | 0 | { |
3865 | 0 | if (value < 0) |
3866 | 0 | return (TIFFReadDirEntryErrRange); |
3867 | 0 | else |
3868 | 0 | return (TIFFReadDirEntryErrOk); |
3869 | 0 | } |
3870 | | |
3871 | | static enum TIFFReadDirEntryErr |
3872 | | TIFFReadDirEntryCheckRangeLong8Slong8(int64_t value) |
3873 | 0 | { |
3874 | 0 | if (value < 0) |
3875 | 0 | return (TIFFReadDirEntryErrRange); |
3876 | 0 | else |
3877 | 0 | return (TIFFReadDirEntryErrOk); |
3878 | 0 | } |
3879 | | |
3880 | | static enum TIFFReadDirEntryErr |
3881 | | TIFFReadDirEntryCheckRangeSlong8Long8(uint64_t value) |
3882 | 0 | { |
3883 | 0 | if (value > INT64_MAX) |
3884 | 0 | return (TIFFReadDirEntryErrRange); |
3885 | 0 | else |
3886 | 0 | return (TIFFReadDirEntryErrOk); |
3887 | 0 | } |
3888 | | |
3889 | | static enum TIFFReadDirEntryErr TIFFReadDirEntryData(TIFF *tif, uint64_t offset, |
3890 | | tmsize_t size, void *dest) |
3891 | 0 | { |
3892 | 0 | assert(size > 0); |
3893 | 0 | if (!isMapped(tif)) |
3894 | 0 | { |
3895 | 0 | if (!SeekOK(tif, offset)) |
3896 | 0 | return (TIFFReadDirEntryErrIo); |
3897 | 0 | if (!ReadOK(tif, dest, size)) |
3898 | 0 | return (TIFFReadDirEntryErrIo); |
3899 | 0 | } |
3900 | 0 | else |
3901 | 0 | { |
3902 | 0 | size_t ma, mb; |
3903 | 0 | ma = (size_t)offset; |
3904 | 0 | if ((uint64_t)ma != offset || ma > (~(size_t)0) - (size_t)size) |
3905 | 0 | { |
3906 | 0 | return TIFFReadDirEntryErrIo; |
3907 | 0 | } |
3908 | 0 | mb = ma + size; |
3909 | 0 | if (mb > (uint64_t)tif->tif_size) |
3910 | 0 | return (TIFFReadDirEntryErrIo); |
3911 | 0 | _TIFFmemcpy(dest, tif->tif_base + ma, size); |
3912 | 0 | } |
3913 | 0 | return (TIFFReadDirEntryErrOk); |
3914 | 0 | } |
3915 | | |
3916 | | static void TIFFReadDirEntryOutputErr(TIFF *tif, enum TIFFReadDirEntryErr err, |
3917 | | const char *module, const char *tagname, |
3918 | | int recover) |
3919 | 0 | { |
3920 | 0 | if (!recover) |
3921 | 0 | { |
3922 | 0 | switch (err) |
3923 | 0 | { |
3924 | 0 | case TIFFReadDirEntryErrCount: |
3925 | 0 | TIFFErrorExtR(tif, module, "Incorrect count for \"%s\"", |
3926 | 0 | tagname); |
3927 | 0 | break; |
3928 | 0 | case TIFFReadDirEntryErrType: |
3929 | 0 | TIFFErrorExtR(tif, module, "Incompatible type for \"%s\"", |
3930 | 0 | tagname); |
3931 | 0 | break; |
3932 | 0 | case TIFFReadDirEntryErrIo: |
3933 | 0 | TIFFErrorExtR(tif, module, "IO error during reading of \"%s\"", |
3934 | 0 | tagname); |
3935 | 0 | break; |
3936 | 0 | case TIFFReadDirEntryErrRange: |
3937 | 0 | TIFFErrorExtR(tif, module, "Incorrect value for \"%s\"", |
3938 | 0 | tagname); |
3939 | 0 | break; |
3940 | 0 | case TIFFReadDirEntryErrPsdif: |
3941 | 0 | TIFFErrorExtR( |
3942 | 0 | tif, module, |
3943 | 0 | "Cannot handle different values per sample for \"%s\"", |
3944 | 0 | tagname); |
3945 | 0 | break; |
3946 | 0 | case TIFFReadDirEntryErrSizesan: |
3947 | 0 | TIFFErrorExtR(tif, module, |
3948 | 0 | "Sanity check on size of \"%s\" value failed", |
3949 | 0 | tagname); |
3950 | 0 | break; |
3951 | 0 | case TIFFReadDirEntryErrAlloc: |
3952 | 0 | TIFFErrorExtR(tif, module, "Out of memory reading of \"%s\"", |
3953 | 0 | tagname); |
3954 | 0 | break; |
3955 | 0 | default: |
3956 | 0 | assert(0); /* we should never get here */ |
3957 | 0 | break; |
3958 | 0 | } |
3959 | 0 | } |
3960 | 0 | else |
3961 | 0 | { |
3962 | 0 | switch (err) |
3963 | 0 | { |
3964 | 0 | case TIFFReadDirEntryErrCount: |
3965 | 0 | TIFFWarningExtR(tif, module, |
3966 | 0 | "Incorrect count for \"%s\"; tag ignored", |
3967 | 0 | tagname); |
3968 | 0 | break; |
3969 | 0 | case TIFFReadDirEntryErrType: |
3970 | 0 | TIFFWarningExtR(tif, module, |
3971 | 0 | "Incompatible type for \"%s\"; tag ignored", |
3972 | 0 | tagname); |
3973 | 0 | break; |
3974 | 0 | case TIFFReadDirEntryErrIo: |
3975 | 0 | TIFFWarningExtR( |
3976 | 0 | tif, module, |
3977 | 0 | "IO error during reading of \"%s\"; tag ignored", tagname); |
3978 | 0 | break; |
3979 | 0 | case TIFFReadDirEntryErrRange: |
3980 | 0 | TIFFWarningExtR(tif, module, |
3981 | 0 | "Incorrect value for \"%s\"; tag ignored", |
3982 | 0 | tagname); |
3983 | 0 | break; |
3984 | 0 | case TIFFReadDirEntryErrPsdif: |
3985 | 0 | TIFFWarningExtR(tif, module, |
3986 | 0 | "Cannot handle different values per sample for " |
3987 | 0 | "\"%s\"; tag ignored", |
3988 | 0 | tagname); |
3989 | 0 | break; |
3990 | 0 | case TIFFReadDirEntryErrSizesan: |
3991 | 0 | TIFFWarningExtR( |
3992 | 0 | tif, module, |
3993 | 0 | "Sanity check on size of \"%s\" value failed; tag ignored", |
3994 | 0 | tagname); |
3995 | 0 | break; |
3996 | 0 | case TIFFReadDirEntryErrAlloc: |
3997 | 0 | TIFFWarningExtR(tif, module, |
3998 | 0 | "Out of memory reading of \"%s\"; tag ignored", |
3999 | 0 | tagname); |
4000 | 0 | break; |
4001 | 0 | default: |
4002 | 0 | assert(0); /* we should never get here */ |
4003 | 0 | break; |
4004 | 0 | } |
4005 | 0 | } |
4006 | 0 | } |
4007 | | |
4008 | | /* |
4009 | | * Return the maximum number of color channels specified for a given photometric |
4010 | | * type. 0 is returned if photometric type isn't supported or no default value |
4011 | | * is defined by the specification. |
4012 | | */ |
4013 | | static int _TIFFGetMaxColorChannels(uint16_t photometric) |
4014 | 0 | { |
4015 | 0 | switch (photometric) |
4016 | 0 | { |
4017 | 0 | case PHOTOMETRIC_PALETTE: |
4018 | 0 | case PHOTOMETRIC_MINISWHITE: |
4019 | 0 | case PHOTOMETRIC_MINISBLACK: |
4020 | 0 | return 1; |
4021 | 0 | case PHOTOMETRIC_YCBCR: |
4022 | 0 | case PHOTOMETRIC_RGB: |
4023 | 0 | case PHOTOMETRIC_CIELAB: |
4024 | 0 | case PHOTOMETRIC_LOGLUV: |
4025 | 0 | case PHOTOMETRIC_ITULAB: |
4026 | 0 | case PHOTOMETRIC_ICCLAB: |
4027 | 0 | return 3; |
4028 | 0 | case PHOTOMETRIC_SEPARATED: |
4029 | 0 | case PHOTOMETRIC_MASK: |
4030 | 0 | return 4; |
4031 | 0 | case PHOTOMETRIC_LOGL: |
4032 | 0 | case PHOTOMETRIC_CFA: |
4033 | 0 | default: |
4034 | 0 | return 0; |
4035 | 0 | } |
4036 | 0 | } |
4037 | | |
4038 | | static int ByteCountLooksBad(TIFF *tif) |
4039 | 0 | { |
4040 | | /* |
4041 | | * Assume we have wrong StripByteCount value (in case |
4042 | | * of single strip) in following cases: |
4043 | | * - it is equal to zero along with StripOffset; |
4044 | | * - it is larger than file itself (in case of uncompressed |
4045 | | * image); |
4046 | | * - it is smaller than the size of the bytes per row |
4047 | | * multiplied on the number of rows. The last case should |
4048 | | * not be checked in the case of writing new image, |
4049 | | * because we may do not know the exact strip size |
4050 | | * until the whole image will be written and directory |
4051 | | * dumped out. |
4052 | | */ |
4053 | 0 | uint64_t bytecount = TIFFGetStrileByteCount(tif, 0); |
4054 | 0 | uint64_t offset = TIFFGetStrileOffset(tif, 0); |
4055 | 0 | uint64_t filesize; |
4056 | |
|
4057 | 0 | if (offset == 0) |
4058 | 0 | return 0; |
4059 | 0 | if (bytecount == 0) |
4060 | 0 | return 1; |
4061 | 0 | if (tif->tif_dir.td_compression != COMPRESSION_NONE) |
4062 | 0 | return 0; |
4063 | 0 | filesize = TIFFGetFileSize(tif); |
4064 | 0 | if (offset <= filesize && bytecount > filesize - offset) |
4065 | 0 | return 1; |
4066 | 0 | if (tif->tif_mode == O_RDONLY) |
4067 | 0 | { |
4068 | 0 | uint64_t scanlinesize = TIFFScanlineSize64(tif); |
4069 | 0 | if (tif->tif_dir.td_imagelength > 0 && |
4070 | 0 | scanlinesize > UINT64_MAX / tif->tif_dir.td_imagelength) |
4071 | 0 | { |
4072 | 0 | return 1; |
4073 | 0 | } |
4074 | 0 | if (bytecount < scanlinesize * tif->tif_dir.td_imagelength) |
4075 | 0 | return 1; |
4076 | 0 | } |
4077 | 0 | return 0; |
4078 | 0 | } |
4079 | | |
4080 | | /* |
4081 | | * To evaluate the IFD data size when reading, save the offset and data size of |
4082 | | * all data that does not fit into the IFD entries themselves. |
4083 | | */ |
4084 | | static bool EvaluateIFDdatasizeReading(TIFF *tif, TIFFDirEntry *dp) |
4085 | 0 | { |
4086 | 0 | const uint64_t data_width = TIFFDataWidth(dp->tdir_type); |
4087 | 0 | if (data_width != 0 && dp->tdir_count > UINT64_MAX / data_width) |
4088 | 0 | { |
4089 | 0 | TIFFErrorExtR(tif, "EvaluateIFDdatasizeReading", |
4090 | 0 | "Too large IFD data size"); |
4091 | 0 | return false; |
4092 | 0 | } |
4093 | 0 | const uint64_t datalength = dp->tdir_count * data_width; |
4094 | 0 | if (datalength > ((tif->tif_flags & TIFF_BIGTIFF) ? 0x8U : 0x4U)) |
4095 | 0 | { |
4096 | 0 | if (tif->tif_dir.td_dirdatasize_read > UINT64_MAX - datalength) |
4097 | 0 | { |
4098 | 0 | TIFFErrorExtR(tif, "EvaluateIFDdatasizeReading", |
4099 | 0 | "Too large IFD data size"); |
4100 | 0 | return false; |
4101 | 0 | } |
4102 | 0 | tif->tif_dir.td_dirdatasize_read += datalength; |
4103 | 0 | if (!(tif->tif_flags & TIFF_BIGTIFF)) |
4104 | 0 | { |
4105 | | /* The offset of TIFFDirEntry are not swapped when read in. That has |
4106 | | * to be done when used. */ |
4107 | 0 | uint32_t offset = dp->tdir_offset.toff_long; |
4108 | 0 | if (tif->tif_flags & TIFF_SWAB) |
4109 | 0 | TIFFSwabLong(&offset); |
4110 | 0 | tif->tif_dir |
4111 | 0 | .td_dirdatasize_offsets[tif->tif_dir.td_dirdatasize_Noffsets] |
4112 | 0 | .offset = (uint64_t)offset; |
4113 | 0 | } |
4114 | 0 | else |
4115 | 0 | { |
4116 | 0 | tif->tif_dir |
4117 | 0 | .td_dirdatasize_offsets[tif->tif_dir.td_dirdatasize_Noffsets] |
4118 | 0 | .offset = dp->tdir_offset.toff_long8; |
4119 | 0 | if (tif->tif_flags & TIFF_SWAB) |
4120 | 0 | TIFFSwabLong8( |
4121 | 0 | &tif->tif_dir |
4122 | 0 | .td_dirdatasize_offsets[tif->tif_dir |
4123 | 0 | .td_dirdatasize_Noffsets] |
4124 | 0 | .offset); |
4125 | 0 | } |
4126 | 0 | tif->tif_dir |
4127 | 0 | .td_dirdatasize_offsets[tif->tif_dir.td_dirdatasize_Noffsets] |
4128 | 0 | .length = datalength; |
4129 | 0 | tif->tif_dir.td_dirdatasize_Noffsets++; |
4130 | 0 | } |
4131 | 0 | return true; |
4132 | 0 | } |
4133 | | |
4134 | | /* |
4135 | | * Compare function for qsort() sorting TIFFEntryOffsetAndLength array entries. |
4136 | | */ |
4137 | | static int cmpTIFFEntryOffsetAndLength(const void *a, const void *b) |
4138 | 0 | { |
4139 | 0 | const TIFFEntryOffsetAndLength *ta = (const TIFFEntryOffsetAndLength *)a; |
4140 | 0 | const TIFFEntryOffsetAndLength *tb = (const TIFFEntryOffsetAndLength *)b; |
4141 | | /* Compare offsets */ |
4142 | 0 | if (ta->offset > tb->offset) |
4143 | 0 | return 1; |
4144 | 0 | else if (ta->offset < tb->offset) |
4145 | 0 | return -1; |
4146 | 0 | else |
4147 | 0 | return 0; |
4148 | 0 | } |
4149 | | |
4150 | | /* |
4151 | | * Determine the IFD data size after reading an IFD from the file that can be |
4152 | | * overwritten and saving it in tif_dir.td_dirdatasize_read. This data size |
4153 | | * includes the IFD entries themselves as well as the data that does not fit |
4154 | | * directly into the IFD entries but is located directly after the IFD entries |
4155 | | * in the file. |
4156 | | */ |
4157 | | static void CalcFinalIFDdatasizeReading(TIFF *tif, uint16_t dircount) |
4158 | 0 | { |
4159 | | /* IFD data size is only needed if file-writing is enabled. |
4160 | | * This also avoids the seek() to EOF to determine the file size, which |
4161 | | * causes the stdin-streaming-friendly mode of libtiff for GDAL to fail. */ |
4162 | 0 | if (tif->tif_mode == O_RDONLY) |
4163 | 0 | return; |
4164 | | |
4165 | | /* Sort TIFFEntryOffsetAndLength array in ascending order. */ |
4166 | 0 | qsort(tif->tif_dir.td_dirdatasize_offsets, |
4167 | 0 | tif->tif_dir.td_dirdatasize_Noffsets, |
4168 | 0 | sizeof(TIFFEntryOffsetAndLength), cmpTIFFEntryOffsetAndLength); |
4169 | | |
4170 | | /* Get offset of end of IFD entry space. */ |
4171 | 0 | uint64_t IFDendoffset; |
4172 | 0 | if (!(tif->tif_flags & TIFF_BIGTIFF)) |
4173 | 0 | IFDendoffset = tif->tif_diroff + 2 + dircount * 12 + 4; |
4174 | 0 | else |
4175 | 0 | IFDendoffset = tif->tif_diroff + 8 + dircount * 20 + 8; |
4176 | | |
4177 | | /* Check which offsets are right behind IFD entries. However, LibTIFF |
4178 | | * increments the writing address for every external data to an even offset. |
4179 | | * Thus gaps of 1 byte can occur. */ |
4180 | 0 | uint64_t size = 0; |
4181 | 0 | uint64_t offset; |
4182 | 0 | uint32_t i; |
4183 | 0 | for (i = 0; i < tif->tif_dir.td_dirdatasize_Noffsets; i++) |
4184 | 0 | { |
4185 | 0 | offset = tif->tif_dir.td_dirdatasize_offsets[i].offset; |
4186 | 0 | if (offset == IFDendoffset) |
4187 | 0 | { |
4188 | 0 | size += tif->tif_dir.td_dirdatasize_offsets[i].length; |
4189 | 0 | IFDendoffset += tif->tif_dir.td_dirdatasize_offsets[i].length; |
4190 | 0 | } |
4191 | 0 | else if (offset == IFDendoffset + 1) |
4192 | 0 | { |
4193 | | /* Add gap byte after previous IFD data set. */ |
4194 | 0 | size += tif->tif_dir.td_dirdatasize_offsets[i].length + 1; |
4195 | 0 | IFDendoffset += tif->tif_dir.td_dirdatasize_offsets[i].length; |
4196 | 0 | } |
4197 | 0 | else |
4198 | 0 | { |
4199 | | /* Further data is no more continuously after IFD */ |
4200 | 0 | break; |
4201 | 0 | } |
4202 | 0 | } |
4203 | | /* Check for gap byte of some easy cases. This should cover 90% of cases. |
4204 | | * Otherwise, IFD will be re-written even it might be safely overwritten. */ |
4205 | 0 | if (tif->tif_nextdiroff != 0) |
4206 | 0 | { |
4207 | 0 | if (tif->tif_nextdiroff == IFDendoffset + 1) |
4208 | 0 | size++; |
4209 | 0 | } |
4210 | 0 | else |
4211 | 0 | { |
4212 | | /* Check for IFD data ends at EOF. Then IFD can always be safely |
4213 | | * overwritten. */ |
4214 | 0 | offset = TIFFSeekFile(tif, 0, SEEK_END); |
4215 | 0 | if (offset == IFDendoffset) |
4216 | 0 | { |
4217 | 0 | tif->tif_dir.td_dirdatasize_read = UINT64_MAX; |
4218 | 0 | return; |
4219 | 0 | } |
4220 | 0 | } |
4221 | | |
4222 | | /* Finally, add the size of the IFD tag entries themselves. */ |
4223 | 0 | if (!(tif->tif_flags & TIFF_BIGTIFF)) |
4224 | 0 | tif->tif_dir.td_dirdatasize_read = 2 + dircount * 12 + 4 + size; |
4225 | 0 | else |
4226 | 0 | tif->tif_dir.td_dirdatasize_read = 8 + dircount * 20 + 8 + size; |
4227 | 0 | } /*-- CalcFinalIFDdatasizeReading() --*/ |
4228 | | |
4229 | | /* |
4230 | | * Read the next TIFF directory from a file and convert it to the internal |
4231 | | * format. We read directories sequentially. |
4232 | | */ |
4233 | | int TIFFReadDirectory(TIFF *tif) |
4234 | 0 | { |
4235 | 0 | static const char module[] = "TIFFReadDirectory"; |
4236 | 0 | TIFFDirEntry *dir; |
4237 | 0 | uint16_t dircount; |
4238 | 0 | TIFFDirEntry *dp; |
4239 | 0 | uint16_t di; |
4240 | 0 | const TIFFField *fip; |
4241 | 0 | uint32_t fii = FAILED_FII; |
4242 | 0 | toff_t nextdiroff; |
4243 | 0 | int bitspersample_read = FALSE; |
4244 | 0 | int color_channels; |
4245 | |
|
4246 | 0 | if (tif->tif_nextdiroff == 0) |
4247 | 0 | { |
4248 | | /* In this special case, tif_diroff needs also to be set to 0. |
4249 | | * This is behind the last IFD, thus no checking or reading necessary. |
4250 | | */ |
4251 | 0 | tif->tif_diroff = tif->tif_nextdiroff; |
4252 | 0 | return 0; |
4253 | 0 | } |
4254 | | |
4255 | 0 | nextdiroff = tif->tif_nextdiroff; |
4256 | | /* tif_curdir++ and tif_nextdiroff should only be updated after SUCCESSFUL |
4257 | | * reading of the directory. Otherwise, invalid IFD offsets could corrupt |
4258 | | * the IFD list. */ |
4259 | 0 | if (!_TIFFCheckDirNumberAndOffset(tif, |
4260 | 0 | tif->tif_curdir == |
4261 | 0 | TIFF_NON_EXISTENT_DIR_NUMBER |
4262 | 0 | ? 0 |
4263 | 0 | : tif->tif_curdir + 1, |
4264 | 0 | nextdiroff)) |
4265 | 0 | { |
4266 | 0 | return 0; /* bad offset (IFD looping or more than TIFF_MAX_DIR_COUNT |
4267 | | IFDs) */ |
4268 | 0 | } |
4269 | 0 | dircount = TIFFFetchDirectory(tif, nextdiroff, &dir, &tif->tif_nextdiroff); |
4270 | 0 | if (!dircount) |
4271 | 0 | { |
4272 | 0 | TIFFErrorExtR(tif, module, |
4273 | 0 | "Failed to read directory at offset %" PRIu64, |
4274 | 0 | nextdiroff); |
4275 | 0 | return 0; |
4276 | 0 | } |
4277 | | /* Set global values after a valid directory has been fetched. |
4278 | | * tif_diroff is already set to nextdiroff in TIFFFetchDirectory() in the |
4279 | | * beginning. */ |
4280 | 0 | if (tif->tif_curdir == TIFF_NON_EXISTENT_DIR_NUMBER) |
4281 | 0 | tif->tif_curdir = 0; |
4282 | 0 | else |
4283 | 0 | tif->tif_curdir++; |
4284 | 0 | (*tif->tif_cleanup)(tif); /* cleanup any previous compression state */ |
4285 | |
|
4286 | 0 | TIFFReadDirectoryCheckOrder(tif, dir, dircount); |
4287 | | |
4288 | | /* |
4289 | | * Mark duplicates of any tag to be ignored (bugzilla 1994) |
4290 | | * to avoid certain pathological problems. |
4291 | | */ |
4292 | 0 | { |
4293 | 0 | TIFFDirEntry *ma; |
4294 | 0 | uint16_t mb; |
4295 | 0 | for (ma = dir, mb = 0; mb < dircount; ma++, mb++) |
4296 | 0 | { |
4297 | 0 | TIFFDirEntry *na; |
4298 | 0 | uint16_t nb; |
4299 | 0 | for (na = ma + 1, nb = mb + 1; nb < dircount; na++, nb++) |
4300 | 0 | { |
4301 | 0 | if (ma->tdir_tag == na->tdir_tag) |
4302 | 0 | { |
4303 | 0 | na->tdir_ignore = TRUE; |
4304 | 0 | } |
4305 | 0 | } |
4306 | 0 | } |
4307 | 0 | } |
4308 | |
|
4309 | 0 | tif->tif_flags &= ~TIFF_BEENWRITING; /* reset before new dir */ |
4310 | 0 | tif->tif_flags &= ~TIFF_BUF4WRITE; /* reset before new dir */ |
4311 | 0 | tif->tif_flags &= ~TIFF_CHOPPEDUPARRAYS; |
4312 | | |
4313 | | /* free any old stuff and reinit */ |
4314 | 0 | TIFFFreeDirectory(tif); |
4315 | 0 | TIFFDefaultDirectory(tif); |
4316 | | |
4317 | | /* Allocate arrays for offset values outside IFD entry for IFD data size |
4318 | | * checking. Note: Counter are reset within TIFFFreeDirectory(). */ |
4319 | 0 | tif->tif_dir.td_dirdatasize_offsets = |
4320 | 0 | (TIFFEntryOffsetAndLength *)_TIFFmallocExt( |
4321 | 0 | tif, dircount * sizeof(TIFFEntryOffsetAndLength)); |
4322 | 0 | if (tif->tif_dir.td_dirdatasize_offsets == NULL) |
4323 | 0 | { |
4324 | 0 | TIFFErrorExtR( |
4325 | 0 | tif, module, |
4326 | 0 | "Failed to allocate memory for counting IFD data size at reading"); |
4327 | 0 | goto bad; |
4328 | 0 | } |
4329 | | /* |
4330 | | * Electronic Arts writes gray-scale TIFF files |
4331 | | * without a PlanarConfiguration directory entry. |
4332 | | * Thus we setup a default value here, even though |
4333 | | * the TIFF spec says there is no default value. |
4334 | | * After PlanarConfiguration is preset in TIFFDefaultDirectory() |
4335 | | * the following setting is not needed, but does not harm either. |
4336 | | */ |
4337 | 0 | TIFFSetField(tif, TIFFTAG_PLANARCONFIG, PLANARCONFIG_CONTIG); |
4338 | | /* |
4339 | | * Setup default value and then make a pass over |
4340 | | * the fields to check type and tag information, |
4341 | | * and to extract info required to size data |
4342 | | * structures. A second pass is made afterwards |
4343 | | * to read in everything not taken in the first pass. |
4344 | | * But we must process the Compression tag first |
4345 | | * in order to merge in codec-private tag definitions (otherwise |
4346 | | * we may get complaints about unknown tags). However, the |
4347 | | * Compression tag may be dependent on the SamplesPerPixel |
4348 | | * tag value because older TIFF specs permitted Compression |
4349 | | * to be written as a SamplesPerPixel-count tag entry. |
4350 | | * Thus if we don't first figure out the correct SamplesPerPixel |
4351 | | * tag value then we may end up ignoring the Compression tag |
4352 | | * value because it has an incorrect count value (if the |
4353 | | * true value of SamplesPerPixel is not 1). |
4354 | | */ |
4355 | 0 | dp = |
4356 | 0 | TIFFReadDirectoryFindEntry(tif, dir, dircount, TIFFTAG_SAMPLESPERPIXEL); |
4357 | 0 | if (dp) |
4358 | 0 | { |
4359 | 0 | if (!TIFFFetchNormalTag(tif, dp, 0)) |
4360 | 0 | goto bad; |
4361 | 0 | dp->tdir_ignore = TRUE; |
4362 | 0 | } |
4363 | 0 | dp = TIFFReadDirectoryFindEntry(tif, dir, dircount, TIFFTAG_COMPRESSION); |
4364 | 0 | if (dp) |
4365 | 0 | { |
4366 | | /* |
4367 | | * The 5.0 spec says the Compression tag has one value, while |
4368 | | * earlier specs say it has one value per sample. Because of |
4369 | | * this, we accept the tag if one value is supplied with either |
4370 | | * count. |
4371 | | */ |
4372 | 0 | uint16_t value; |
4373 | 0 | enum TIFFReadDirEntryErr err; |
4374 | 0 | err = TIFFReadDirEntryShort(tif, dp, &value); |
4375 | 0 | if (err == TIFFReadDirEntryErrCount) |
4376 | 0 | err = TIFFReadDirEntryPersampleShort(tif, dp, &value); |
4377 | 0 | if (err != TIFFReadDirEntryErrOk) |
4378 | 0 | { |
4379 | 0 | TIFFReadDirEntryOutputErr(tif, err, module, "Compression", 0); |
4380 | 0 | goto bad; |
4381 | 0 | } |
4382 | 0 | if (!TIFFSetField(tif, TIFFTAG_COMPRESSION, value)) |
4383 | 0 | goto bad; |
4384 | 0 | dp->tdir_ignore = TRUE; |
4385 | 0 | } |
4386 | 0 | else |
4387 | 0 | { |
4388 | 0 | if (!TIFFSetField(tif, TIFFTAG_COMPRESSION, COMPRESSION_NONE)) |
4389 | 0 | goto bad; |
4390 | 0 | } |
4391 | | /* |
4392 | | * First real pass over the directory. |
4393 | | */ |
4394 | 0 | for (di = 0, dp = dir; di < dircount; di++, dp++) |
4395 | 0 | { |
4396 | 0 | if (!dp->tdir_ignore) |
4397 | 0 | { |
4398 | 0 | TIFFReadDirectoryFindFieldInfo(tif, dp->tdir_tag, &fii); |
4399 | 0 | if (fii == FAILED_FII) |
4400 | 0 | { |
4401 | 0 | TIFFWarningExtR(tif, module, |
4402 | 0 | "Unknown field with tag %" PRIu16 " (0x%" PRIx16 |
4403 | 0 | ") encountered", |
4404 | 0 | dp->tdir_tag, dp->tdir_tag); |
4405 | | /* the following knowingly leaks the |
4406 | | anonymous field structure */ |
4407 | 0 | const TIFFField *fld = _TIFFCreateAnonField( |
4408 | 0 | tif, dp->tdir_tag, (TIFFDataType)dp->tdir_type); |
4409 | 0 | if (fld == NULL || !_TIFFMergeFields(tif, fld, 1)) |
4410 | 0 | { |
4411 | 0 | TIFFWarningExtR( |
4412 | 0 | tif, module, |
4413 | 0 | "Registering anonymous field with tag %" PRIu16 |
4414 | 0 | " (0x%" PRIx16 ") failed", |
4415 | 0 | dp->tdir_tag, dp->tdir_tag); |
4416 | 0 | dp->tdir_ignore = TRUE; |
4417 | 0 | } |
4418 | 0 | else |
4419 | 0 | { |
4420 | 0 | TIFFReadDirectoryFindFieldInfo(tif, dp->tdir_tag, &fii); |
4421 | 0 | assert(fii != FAILED_FII); |
4422 | 0 | } |
4423 | 0 | } |
4424 | 0 | } |
4425 | 0 | if (!dp->tdir_ignore) |
4426 | 0 | { |
4427 | 0 | fip = tif->tif_fields[fii]; |
4428 | 0 | if (fip->field_bit == FIELD_IGNORE) |
4429 | 0 | dp->tdir_ignore = TRUE; |
4430 | 0 | else |
4431 | 0 | { |
4432 | 0 | switch (dp->tdir_tag) |
4433 | 0 | { |
4434 | 0 | case TIFFTAG_STRIPOFFSETS: |
4435 | 0 | case TIFFTAG_STRIPBYTECOUNTS: |
4436 | 0 | case TIFFTAG_TILEOFFSETS: |
4437 | 0 | case TIFFTAG_TILEBYTECOUNTS: |
4438 | 0 | TIFFSetFieldBit(tif, fip->field_bit); |
4439 | 0 | break; |
4440 | 0 | case TIFFTAG_IMAGEWIDTH: |
4441 | 0 | case TIFFTAG_IMAGELENGTH: |
4442 | 0 | case TIFFTAG_IMAGEDEPTH: |
4443 | 0 | case TIFFTAG_TILELENGTH: |
4444 | 0 | case TIFFTAG_TILEWIDTH: |
4445 | 0 | case TIFFTAG_TILEDEPTH: |
4446 | 0 | case TIFFTAG_PLANARCONFIG: |
4447 | 0 | case TIFFTAG_ROWSPERSTRIP: |
4448 | 0 | case TIFFTAG_EXTRASAMPLES: |
4449 | 0 | if (!TIFFFetchNormalTag(tif, dp, 0)) |
4450 | 0 | goto bad; |
4451 | 0 | dp->tdir_ignore = TRUE; |
4452 | 0 | break; |
4453 | 0 | default: |
4454 | 0 | if (!_TIFFCheckFieldIsValidForCodec(tif, dp->tdir_tag)) |
4455 | 0 | dp->tdir_ignore = TRUE; |
4456 | 0 | break; |
4457 | 0 | } |
4458 | 0 | } |
4459 | 0 | } |
4460 | 0 | } |
4461 | | /* |
4462 | | * XXX: OJPEG hack. |
4463 | | * If a) compression is OJPEG, b) planarconfig tag says it's separate, |
4464 | | * c) strip offsets/bytecounts tag are both present and |
4465 | | * d) both contain exactly one value, then we consistently find |
4466 | | * that the buggy implementation of the buggy compression scheme |
4467 | | * matches contig planarconfig best. So we 'fix-up' the tag here |
4468 | | */ |
4469 | 0 | if ((tif->tif_dir.td_compression == COMPRESSION_OJPEG) && |
4470 | 0 | (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE)) |
4471 | 0 | { |
4472 | 0 | if (!_TIFFFillStriles(tif)) |
4473 | 0 | goto bad; |
4474 | 0 | dp = TIFFReadDirectoryFindEntry(tif, dir, dircount, |
4475 | 0 | TIFFTAG_STRIPOFFSETS); |
4476 | 0 | if ((dp != 0) && (dp->tdir_count == 1)) |
4477 | 0 | { |
4478 | 0 | dp = TIFFReadDirectoryFindEntry(tif, dir, dircount, |
4479 | 0 | TIFFTAG_STRIPBYTECOUNTS); |
4480 | 0 | if ((dp != 0) && (dp->tdir_count == 1)) |
4481 | 0 | { |
4482 | 0 | tif->tif_dir.td_planarconfig = PLANARCONFIG_CONTIG; |
4483 | 0 | TIFFWarningExtR(tif, module, |
4484 | 0 | "Planarconfig tag value assumed incorrect, " |
4485 | 0 | "assuming data is contig instead of chunky"); |
4486 | 0 | } |
4487 | 0 | } |
4488 | 0 | } |
4489 | | /* |
4490 | | * Allocate directory structure and setup defaults. |
4491 | | */ |
4492 | 0 | if (!TIFFFieldSet(tif, FIELD_IMAGEDIMENSIONS)) |
4493 | 0 | { |
4494 | 0 | MissingRequired(tif, "ImageLength"); |
4495 | 0 | goto bad; |
4496 | 0 | } |
4497 | | |
4498 | | /* |
4499 | | * Second pass: extract other information. |
4500 | | */ |
4501 | 0 | for (di = 0, dp = dir; di < dircount; di++, dp++) |
4502 | 0 | { |
4503 | 0 | if (!dp->tdir_ignore) |
4504 | 0 | { |
4505 | 0 | switch (dp->tdir_tag) |
4506 | 0 | { |
4507 | 0 | case TIFFTAG_MINSAMPLEVALUE: |
4508 | 0 | case TIFFTAG_MAXSAMPLEVALUE: |
4509 | 0 | case TIFFTAG_BITSPERSAMPLE: |
4510 | 0 | case TIFFTAG_DATATYPE: |
4511 | 0 | case TIFFTAG_SAMPLEFORMAT: |
4512 | | /* |
4513 | | * The MinSampleValue, MaxSampleValue, BitsPerSample |
4514 | | * DataType and SampleFormat tags are supposed to be |
4515 | | * written as one value/sample, but some vendors |
4516 | | * incorrectly write one value only -- so we accept |
4517 | | * that as well (yuck). Other vendors write correct |
4518 | | * value for NumberOfSamples, but incorrect one for |
4519 | | * BitsPerSample and friends, and we will read this |
4520 | | * too. |
4521 | | */ |
4522 | 0 | { |
4523 | 0 | uint16_t value; |
4524 | 0 | enum TIFFReadDirEntryErr err; |
4525 | 0 | err = TIFFReadDirEntryShort(tif, dp, &value); |
4526 | 0 | if (!EvaluateIFDdatasizeReading(tif, dp)) |
4527 | 0 | goto bad; |
4528 | 0 | if (err == TIFFReadDirEntryErrCount) |
4529 | 0 | err = |
4530 | 0 | TIFFReadDirEntryPersampleShort(tif, dp, &value); |
4531 | 0 | if (err != TIFFReadDirEntryErrOk) |
4532 | 0 | { |
4533 | 0 | fip = TIFFFieldWithTag(tif, dp->tdir_tag); |
4534 | 0 | TIFFReadDirEntryOutputErr( |
4535 | 0 | tif, err, module, |
4536 | 0 | fip ? fip->field_name : "unknown tagname", 0); |
4537 | 0 | goto bad; |
4538 | 0 | } |
4539 | 0 | if (!TIFFSetField(tif, dp->tdir_tag, value)) |
4540 | 0 | goto bad; |
4541 | 0 | if (dp->tdir_tag == TIFFTAG_BITSPERSAMPLE) |
4542 | 0 | bitspersample_read = TRUE; |
4543 | 0 | } |
4544 | 0 | break; |
4545 | 0 | case TIFFTAG_SMINSAMPLEVALUE: |
4546 | 0 | case TIFFTAG_SMAXSAMPLEVALUE: |
4547 | 0 | { |
4548 | |
|
4549 | 0 | double *data = NULL; |
4550 | 0 | enum TIFFReadDirEntryErr err; |
4551 | 0 | uint32_t saved_flags; |
4552 | 0 | int m; |
4553 | 0 | if (dp->tdir_count != |
4554 | 0 | (uint64_t)tif->tif_dir.td_samplesperpixel) |
4555 | 0 | err = TIFFReadDirEntryErrCount; |
4556 | 0 | else |
4557 | 0 | err = TIFFReadDirEntryDoubleArray(tif, dp, &data); |
4558 | 0 | if (!EvaluateIFDdatasizeReading(tif, dp)) |
4559 | |