/src/gdal/frmts/gtiff/libtiff/tif_read.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * Copyright (c) 1988-1997 Sam Leffler |
3 | | * Copyright (c) 1991-1997 Silicon Graphics, Inc. |
4 | | * |
5 | | * Permission to use, copy, modify, distribute, and sell this software and |
6 | | * its documentation for any purpose is hereby granted without fee, provided |
7 | | * that (i) the above copyright notices and this permission notice appear in |
8 | | * all copies of the software and related documentation, and (ii) the names of |
9 | | * Sam Leffler and Silicon Graphics may not be used in any advertising or |
10 | | * publicity relating to the software without the specific, prior written |
11 | | * permission of Sam Leffler and Silicon Graphics. |
12 | | * |
13 | | * THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND, |
14 | | * EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY |
15 | | * WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. |
16 | | * |
17 | | * IN NO EVENT SHALL SAM LEFFLER OR SILICON GRAPHICS BE LIABLE FOR |
18 | | * ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND, |
19 | | * OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, |
20 | | * WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF |
21 | | * LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE |
22 | | * OF THIS SOFTWARE. |
23 | | */ |
24 | | |
25 | | /* |
26 | | * TIFF Library. |
27 | | * Scanline-oriented Read Support |
28 | | */ |
29 | | #include "tiffiop.h" |
30 | | #include <stdio.h> |
31 | | |
32 | | int TIFFFillStrip(TIFF *tif, uint32_t strip); |
33 | | int TIFFFillTile(TIFF *tif, uint32_t tile); |
34 | | static int TIFFStartStrip(TIFF *tif, uint32_t strip); |
35 | | static int TIFFStartTile(TIFF *tif, uint32_t tile); |
36 | | static int TIFFCheckRead(TIFF *, int); |
37 | | static tmsize_t TIFFReadRawStrip1(TIFF *tif, uint32_t strip, void *buf, |
38 | | tmsize_t size, const char *module); |
39 | | static tmsize_t TIFFReadRawTile1(TIFF *tif, uint32_t tile, void *buf, |
40 | | tmsize_t size, const char *module); |
41 | | |
42 | 0 | #define NOSTRIP ((uint32_t)(-1)) /* undefined state */ |
43 | 0 | #define NOTILE ((uint32_t)(-1)) /* undefined state */ |
44 | | |
45 | 0 | #define INITIAL_THRESHOLD (1024 * 1024) |
46 | 0 | #define THRESHOLD_MULTIPLIER 10 |
47 | | #define MAX_THRESHOLD \ |
48 | 0 | (THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER * \ |
49 | 0 | INITIAL_THRESHOLD) |
50 | | |
51 | 0 | #define TIFF_INT64_MAX ((((int64_t)0x7FFFFFFF) << 32) | 0xFFFFFFFF) |
52 | | |
53 | | /* Read 'size' bytes in tif_rawdata buffer starting at offset 'rawdata_offset' |
54 | | * Returns 1 in case of success, 0 otherwise. */ |
55 | | static int TIFFReadAndRealloc(TIFF *tif, tmsize_t size, tmsize_t rawdata_offset, |
56 | | int is_strip, uint32_t strip_or_tile, |
57 | | const char *module) |
58 | 0 | { |
59 | 0 | #if SIZEOF_SIZE_T == 8 |
60 | 0 | tmsize_t threshold = INITIAL_THRESHOLD; |
61 | 0 | #endif |
62 | 0 | tmsize_t already_read = 0; |
63 | |
|
64 | | #if SIZEOF_SIZE_T != 8 |
65 | | /* On 32 bit processes, if the request is large enough, check against */ |
66 | | /* file size */ |
67 | | if (size > 1000 * 1000 * 1000) |
68 | | { |
69 | | uint64_t filesize = TIFFGetFileSize(tif); |
70 | | if ((uint64_t)size >= filesize) |
71 | | { |
72 | | TIFFErrorExtR(tif, module, |
73 | | "Chunk size requested is larger than file size."); |
74 | | return 0; |
75 | | } |
76 | | } |
77 | | #endif |
78 | | |
79 | | /* On 64 bit processes, read first a maximum of 1 MB, then 10 MB, etc */ |
80 | | /* so as to avoid allocating too much memory in case the file is too */ |
81 | | /* short. We could ask for the file size, but this might be */ |
82 | | /* expensive with some I/O layers (think of reading a gzipped file) */ |
83 | | /* Restrict to 64 bit processes, so as to avoid reallocs() */ |
84 | | /* on 32 bit processes where virtual memory is scarce. */ |
85 | 0 | while (already_read < size) |
86 | 0 | { |
87 | 0 | tmsize_t bytes_read; |
88 | 0 | tmsize_t to_read = size - already_read; |
89 | 0 | #if SIZEOF_SIZE_T == 8 |
90 | 0 | if (to_read >= threshold && threshold < MAX_THRESHOLD && |
91 | 0 | already_read + to_read + rawdata_offset > tif->tif_rawdatasize) |
92 | 0 | { |
93 | 0 | to_read = threshold; |
94 | 0 | threshold *= THRESHOLD_MULTIPLIER; |
95 | 0 | } |
96 | 0 | #endif |
97 | 0 | if (already_read + to_read + rawdata_offset > tif->tif_rawdatasize) |
98 | 0 | { |
99 | 0 | uint8_t *new_rawdata; |
100 | 0 | assert((tif->tif_flags & TIFF_MYBUFFER) != 0); |
101 | 0 | tif->tif_rawdatasize = (tmsize_t)TIFFroundup_64( |
102 | 0 | (uint64_t)already_read + to_read + rawdata_offset, 1024); |
103 | 0 | if (tif->tif_rawdatasize == 0) |
104 | 0 | { |
105 | 0 | TIFFErrorExtR(tif, module, "Invalid buffer size"); |
106 | 0 | return 0; |
107 | 0 | } |
108 | 0 | new_rawdata = (uint8_t *)_TIFFreallocExt(tif, tif->tif_rawdata, |
109 | 0 | tif->tif_rawdatasize); |
110 | 0 | if (new_rawdata == 0) |
111 | 0 | { |
112 | 0 | TIFFErrorExtR(tif, module, |
113 | 0 | "No space for data buffer at scanline %" PRIu32, |
114 | 0 | tif->tif_row); |
115 | 0 | _TIFFfreeExt(tif, tif->tif_rawdata); |
116 | 0 | tif->tif_rawdata = 0; |
117 | 0 | tif->tif_rawdatasize = 0; |
118 | 0 | return 0; |
119 | 0 | } |
120 | 0 | tif->tif_rawdata = new_rawdata; |
121 | 0 | } |
122 | 0 | if (tif->tif_rawdata == NULL) |
123 | 0 | { |
124 | | /* should not happen in practice but helps CoverityScan */ |
125 | 0 | return 0; |
126 | 0 | } |
127 | | |
128 | 0 | bytes_read = TIFFReadFile( |
129 | 0 | tif, tif->tif_rawdata + rawdata_offset + already_read, to_read); |
130 | 0 | already_read += bytes_read; |
131 | 0 | if (bytes_read != to_read) |
132 | 0 | { |
133 | 0 | memset(tif->tif_rawdata + rawdata_offset + already_read, 0, |
134 | 0 | tif->tif_rawdatasize - rawdata_offset - already_read); |
135 | 0 | if (is_strip) |
136 | 0 | { |
137 | 0 | TIFFErrorExtR(tif, module, |
138 | 0 | "Read error at scanline %" PRIu32 |
139 | 0 | "; got %" TIFF_SSIZE_FORMAT " bytes, " |
140 | 0 | "expected %" TIFF_SSIZE_FORMAT, |
141 | 0 | tif->tif_row, already_read, size); |
142 | 0 | } |
143 | 0 | else |
144 | 0 | { |
145 | 0 | TIFFErrorExtR(tif, module, |
146 | 0 | "Read error at row %" PRIu32 ", col %" PRIu32 |
147 | 0 | ", tile %" PRIu32 "; " |
148 | 0 | "got %" TIFF_SSIZE_FORMAT |
149 | 0 | " bytes, expected %" TIFF_SSIZE_FORMAT "", |
150 | 0 | tif->tif_row, tif->tif_col, strip_or_tile, |
151 | 0 | already_read, size); |
152 | 0 | } |
153 | 0 | return 0; |
154 | 0 | } |
155 | 0 | } |
156 | 0 | return 1; |
157 | 0 | } |
158 | | |
159 | | static int TIFFFillStripPartial(TIFF *tif, int strip, tmsize_t read_ahead, |
160 | | int restart) |
161 | 0 | { |
162 | 0 | static const char module[] = "TIFFFillStripPartial"; |
163 | 0 | register TIFFDirectory *td = &tif->tif_dir; |
164 | 0 | tmsize_t unused_data; |
165 | 0 | uint64_t read_offset; |
166 | 0 | tmsize_t to_read; |
167 | 0 | tmsize_t read_ahead_mod; |
168 | | /* tmsize_t bytecountm; */ |
169 | | |
170 | | /* |
171 | | * Expand raw data buffer, if needed, to hold data |
172 | | * strip coming from file (perhaps should set upper |
173 | | * bound on the size of a buffer we'll use?). |
174 | | */ |
175 | | |
176 | | /* bytecountm=(tmsize_t) TIFFGetStrileByteCount(tif, strip); */ |
177 | | |
178 | | /* Not completely sure where the * 2 comes from, but probably for */ |
179 | | /* an exponentional growth strategy of tif_rawdatasize */ |
180 | 0 | if (read_ahead < TIFF_TMSIZE_T_MAX / 2) |
181 | 0 | read_ahead_mod = read_ahead * 2; |
182 | 0 | else |
183 | 0 | read_ahead_mod = read_ahead; |
184 | 0 | if (read_ahead_mod > tif->tif_rawdatasize) |
185 | 0 | { |
186 | 0 | assert(restart); |
187 | | |
188 | 0 | tif->tif_curstrip = NOSTRIP; |
189 | 0 | if ((tif->tif_flags & TIFF_MYBUFFER) == 0) |
190 | 0 | { |
191 | 0 | TIFFErrorExtR(tif, module, |
192 | 0 | "Data buffer too small to hold part of strip %d", |
193 | 0 | strip); |
194 | 0 | return (0); |
195 | 0 | } |
196 | 0 | } |
197 | | |
198 | 0 | if (restart) |
199 | 0 | { |
200 | 0 | tif->tif_rawdataloaded = 0; |
201 | 0 | tif->tif_rawdataoff = 0; |
202 | 0 | } |
203 | | |
204 | | /* |
205 | | ** If we are reading more data, move any unused data to the |
206 | | ** start of the buffer. |
207 | | */ |
208 | 0 | if (tif->tif_rawdataloaded > 0) |
209 | 0 | unused_data = |
210 | 0 | tif->tif_rawdataloaded - (tif->tif_rawcp - tif->tif_rawdata); |
211 | 0 | else |
212 | 0 | unused_data = 0; |
213 | |
|
214 | 0 | if (unused_data > 0) |
215 | 0 | { |
216 | 0 | assert((tif->tif_flags & TIFF_BUFFERMMAP) == 0); |
217 | 0 | memmove(tif->tif_rawdata, tif->tif_rawcp, unused_data); |
218 | 0 | } |
219 | | |
220 | | /* |
221 | | ** Seek to the point in the file where more data should be read. |
222 | | */ |
223 | 0 | read_offset = TIFFGetStrileOffset(tif, strip) + tif->tif_rawdataoff + |
224 | 0 | tif->tif_rawdataloaded; |
225 | |
|
226 | 0 | if (!SeekOK(tif, read_offset)) |
227 | 0 | { |
228 | 0 | TIFFErrorExtR(tif, module, |
229 | 0 | "Seek error at scanline %" PRIu32 ", strip %d", |
230 | 0 | tif->tif_row, strip); |
231 | 0 | return 0; |
232 | 0 | } |
233 | | |
234 | | /* |
235 | | ** How much do we want to read? |
236 | | */ |
237 | 0 | if (read_ahead_mod > tif->tif_rawdatasize) |
238 | 0 | to_read = read_ahead_mod - unused_data; |
239 | 0 | else |
240 | 0 | to_read = tif->tif_rawdatasize - unused_data; |
241 | 0 | if ((uint64_t)to_read > TIFFGetStrileByteCount(tif, strip) - |
242 | 0 | tif->tif_rawdataoff - tif->tif_rawdataloaded) |
243 | 0 | { |
244 | 0 | to_read = (tmsize_t)TIFFGetStrileByteCount(tif, strip) - |
245 | 0 | tif->tif_rawdataoff - tif->tif_rawdataloaded; |
246 | 0 | } |
247 | |
|
248 | 0 | assert((tif->tif_flags & TIFF_BUFFERMMAP) == 0); |
249 | 0 | if (!TIFFReadAndRealloc(tif, to_read, unused_data, 1, /* is_strip */ |
250 | 0 | 0, /* strip_or_tile */ |
251 | 0 | module)) |
252 | 0 | { |
253 | 0 | return 0; |
254 | 0 | } |
255 | | |
256 | 0 | tif->tif_rawdataoff = |
257 | 0 | tif->tif_rawdataoff + tif->tif_rawdataloaded - unused_data; |
258 | 0 | tif->tif_rawdataloaded = unused_data + to_read; |
259 | |
|
260 | 0 | tif->tif_rawcc = tif->tif_rawdataloaded; |
261 | 0 | tif->tif_rawcp = tif->tif_rawdata; |
262 | |
|
263 | 0 | if (!isFillOrder(tif, td->td_fillorder) && |
264 | 0 | (tif->tif_flags & TIFF_NOBITREV) == 0) |
265 | 0 | { |
266 | 0 | assert((tif->tif_flags & TIFF_BUFFERMMAP) == 0); |
267 | 0 | TIFFReverseBits(tif->tif_rawdata + unused_data, to_read); |
268 | 0 | } |
269 | | |
270 | | /* |
271 | | ** When starting a strip from the beginning we need to |
272 | | ** restart the decoder. |
273 | | */ |
274 | 0 | if (restart) |
275 | 0 | { |
276 | |
|
277 | 0 | #ifdef JPEG_SUPPORT |
278 | | /* A bit messy since breaks the codec abstraction. Ultimately */ |
279 | | /* there should be a function pointer for that, but it seems */ |
280 | | /* only JPEG is affected. */ |
281 | | /* For JPEG, if there are multiple scans (can generally be known */ |
282 | | /* with the read_ahead used), we need to read the whole strip */ |
283 | 0 | if (tif->tif_dir.td_compression == COMPRESSION_JPEG && |
284 | 0 | (uint64_t)tif->tif_rawcc < TIFFGetStrileByteCount(tif, strip)) |
285 | 0 | { |
286 | 0 | if (TIFFJPEGIsFullStripRequired(tif)) |
287 | 0 | { |
288 | 0 | return TIFFFillStrip(tif, strip); |
289 | 0 | } |
290 | 0 | } |
291 | 0 | #endif |
292 | | |
293 | 0 | return TIFFStartStrip(tif, strip); |
294 | 0 | } |
295 | 0 | else |
296 | 0 | { |
297 | 0 | return 1; |
298 | 0 | } |
299 | 0 | } |
300 | | |
301 | | /* |
302 | | * Seek to a random row+sample in a file. |
303 | | * |
304 | | * Only used by TIFFReadScanline, and is only used on |
305 | | * strip organized files. We do some tricky stuff to try |
306 | | * and avoid reading the whole compressed raw data for big |
307 | | * strips. |
308 | | */ |
309 | | static int TIFFSeek(TIFF *tif, uint32_t row, uint16_t sample) |
310 | 0 | { |
311 | 0 | register TIFFDirectory *td = &tif->tif_dir; |
312 | 0 | uint32_t strip; |
313 | 0 | int whole_strip; |
314 | 0 | tmsize_t read_ahead = 0; |
315 | | |
316 | | /* |
317 | | ** Establish what strip we are working from. |
318 | | */ |
319 | 0 | if (row >= td->td_imagelength) |
320 | 0 | { /* out of range */ |
321 | 0 | TIFFErrorExtR(tif, tif->tif_name, |
322 | 0 | "%" PRIu32 ": Row out of range, max %" PRIu32 "", row, |
323 | 0 | td->td_imagelength); |
324 | 0 | return (0); |
325 | 0 | } |
326 | 0 | if (td->td_planarconfig == PLANARCONFIG_SEPARATE) |
327 | 0 | { |
328 | 0 | if (sample >= td->td_samplesperpixel) |
329 | 0 | { |
330 | 0 | TIFFErrorExtR(tif, tif->tif_name, |
331 | 0 | "%" PRIu16 ": Sample out of range, max %" PRIu16 "", |
332 | 0 | sample, td->td_samplesperpixel); |
333 | 0 | return (0); |
334 | 0 | } |
335 | 0 | strip = (uint32_t)sample * td->td_stripsperimage + |
336 | 0 | row / td->td_rowsperstrip; |
337 | 0 | } |
338 | 0 | else |
339 | 0 | strip = row / td->td_rowsperstrip; |
340 | | |
341 | | /* |
342 | | * Do we want to treat this strip as one whole chunk or |
343 | | * read it a few lines at a time? |
344 | | */ |
345 | 0 | #if defined(CHUNKY_STRIP_READ_SUPPORT) |
346 | 0 | whole_strip = TIFFGetStrileByteCount(tif, strip) < 10 || isMapped(tif); |
347 | 0 | if (td->td_compression == COMPRESSION_LERC || |
348 | 0 | td->td_compression == COMPRESSION_JBIG) |
349 | 0 | { |
350 | | /* Ideally plugins should have a way to declare they don't support |
351 | | * chunk strip */ |
352 | 0 | whole_strip = 1; |
353 | 0 | } |
354 | |
|
355 | 0 | if (!whole_strip) |
356 | 0 | { |
357 | | /* 16 is for YCbCr mode where we may need to read 16 */ |
358 | | /* lines at a time to get a decompressed line, and 5000 */ |
359 | | /* is some constant value, for example for JPEG tables */ |
360 | |
|
361 | 0 | if (tif->tif_scanlinesize < TIFF_TMSIZE_T_MAX / 16 && |
362 | 0 | tif->tif_scanlinesize * 16 < TIFF_TMSIZE_T_MAX - 5000) |
363 | 0 | { |
364 | 0 | read_ahead = tif->tif_scanlinesize * 16 + 5000; |
365 | 0 | } |
366 | 0 | else |
367 | 0 | { |
368 | 0 | read_ahead = tif->tif_scanlinesize; |
369 | 0 | } |
370 | 0 | } |
371 | | #else |
372 | | whole_strip = 1; |
373 | | #endif |
374 | | |
375 | | /* |
376 | | * If we haven't loaded this strip, do so now, possibly |
377 | | * only reading the first part. |
378 | | */ |
379 | 0 | if (strip != tif->tif_curstrip) |
380 | 0 | { /* different strip, refill */ |
381 | |
|
382 | 0 | if (whole_strip) |
383 | 0 | { |
384 | 0 | if (!TIFFFillStrip(tif, strip)) |
385 | 0 | return (0); |
386 | 0 | } |
387 | 0 | #if defined(CHUNKY_STRIP_READ_SUPPORT) |
388 | 0 | else |
389 | 0 | { |
390 | 0 | if (!TIFFFillStripPartial(tif, strip, read_ahead, 1)) |
391 | 0 | return 0; |
392 | 0 | } |
393 | 0 | #endif |
394 | 0 | } |
395 | | |
396 | 0 | #if defined(CHUNKY_STRIP_READ_SUPPORT) |
397 | | /* |
398 | | ** If we already have some data loaded, do we need to read some more? |
399 | | */ |
400 | 0 | else if (!whole_strip) |
401 | 0 | { |
402 | 0 | if (((tif->tif_rawdata + tif->tif_rawdataloaded) - tif->tif_rawcp) < |
403 | 0 | read_ahead && |
404 | 0 | (uint64_t)tif->tif_rawdataoff + tif->tif_rawdataloaded < |
405 | 0 | TIFFGetStrileByteCount(tif, strip)) |
406 | 0 | { |
407 | 0 | if (!TIFFFillStripPartial(tif, strip, read_ahead, 0)) |
408 | 0 | return 0; |
409 | 0 | } |
410 | 0 | } |
411 | 0 | #endif |
412 | | |
413 | 0 | if (row < tif->tif_row) |
414 | 0 | { |
415 | | /* |
416 | | * Moving backwards within the same strip: backup |
417 | | * to the start and then decode forward (below). |
418 | | * |
419 | | * NB: If you're planning on lots of random access within a |
420 | | * strip, it's better to just read and decode the entire |
421 | | * strip, and then access the decoded data in a random fashion. |
422 | | */ |
423 | |
|
424 | 0 | if (tif->tif_rawdataoff != 0) |
425 | 0 | { |
426 | 0 | if (!TIFFFillStripPartial(tif, strip, read_ahead, 1)) |
427 | 0 | return 0; |
428 | 0 | } |
429 | 0 | else |
430 | 0 | { |
431 | 0 | if (!TIFFStartStrip(tif, strip)) |
432 | 0 | return (0); |
433 | 0 | } |
434 | 0 | } |
435 | | |
436 | 0 | if (row != tif->tif_row) |
437 | 0 | { |
438 | | /* |
439 | | * Seek forward to the desired row. |
440 | | */ |
441 | | |
442 | | /* TODO: Will this really work with partial buffers? */ |
443 | |
|
444 | 0 | if (!(*tif->tif_seek)(tif, row - tif->tif_row)) |
445 | 0 | return (0); |
446 | 0 | tif->tif_row = row; |
447 | 0 | } |
448 | | |
449 | 0 | return (1); |
450 | 0 | } |
451 | | |
452 | | int TIFFReadScanline(TIFF *tif, void *buf, uint32_t row, uint16_t sample) |
453 | 0 | { |
454 | 0 | int e; |
455 | |
|
456 | 0 | if (!TIFFCheckRead(tif, 0)) |
457 | 0 | return (-1); |
458 | 0 | if ((e = TIFFSeek(tif, row, sample)) != 0) |
459 | 0 | { |
460 | | /* |
461 | | * Decompress desired row into user buffer. |
462 | | */ |
463 | 0 | e = (*tif->tif_decoderow)(tif, (uint8_t *)buf, tif->tif_scanlinesize, |
464 | 0 | sample); |
465 | | |
466 | | /* we are now poised at the beginning of the next row */ |
467 | 0 | tif->tif_row = row + 1; |
468 | |
|
469 | 0 | if (e) |
470 | 0 | (*tif->tif_postdecode)(tif, (uint8_t *)buf, tif->tif_scanlinesize); |
471 | 0 | } |
472 | 0 | else |
473 | 0 | { |
474 | | /* See TIFFReadEncodedStrip comment regarding TIFFTAG_FAXFILLFUNC. */ |
475 | 0 | if (buf) |
476 | 0 | memset(buf, 0, (size_t)tif->tif_scanlinesize); |
477 | 0 | } |
478 | 0 | return (e > 0 ? 1 : -1); |
479 | 0 | } |
480 | | |
481 | | /* |
482 | | * Calculate the strip size according to the number of |
483 | | * rows in the strip (check for truncated last strip on any |
484 | | * of the separations). |
485 | | */ |
486 | | static tmsize_t TIFFReadEncodedStripGetStripSize(TIFF *tif, uint32_t strip, |
487 | | uint16_t *pplane) |
488 | 0 | { |
489 | 0 | static const char module[] = "TIFFReadEncodedStrip"; |
490 | 0 | TIFFDirectory *td = &tif->tif_dir; |
491 | 0 | uint32_t rowsperstrip; |
492 | 0 | uint32_t stripsperplane; |
493 | 0 | uint32_t stripinplane; |
494 | 0 | uint32_t rows; |
495 | 0 | tmsize_t stripsize; |
496 | 0 | if (!TIFFCheckRead(tif, 0)) |
497 | 0 | return ((tmsize_t)(-1)); |
498 | 0 | if (strip >= td->td_nstrips) |
499 | 0 | { |
500 | 0 | TIFFErrorExtR(tif, module, |
501 | 0 | "%" PRIu32 ": Strip out of range, max %" PRIu32, strip, |
502 | 0 | td->td_nstrips); |
503 | 0 | return ((tmsize_t)(-1)); |
504 | 0 | } |
505 | | |
506 | 0 | rowsperstrip = td->td_rowsperstrip; |
507 | 0 | if (rowsperstrip > td->td_imagelength) |
508 | 0 | rowsperstrip = td->td_imagelength; |
509 | 0 | if (rowsperstrip == 0) |
510 | 0 | { |
511 | 0 | TIFFErrorExtR(tif, module, "rowsperstrip is zero"); |
512 | 0 | return ((tmsize_t)(-1)); |
513 | 0 | } |
514 | 0 | stripsperplane = |
515 | 0 | TIFFhowmany_32_maxuint_compat(td->td_imagelength, rowsperstrip); |
516 | 0 | stripinplane = (strip % stripsperplane); |
517 | 0 | if (pplane) |
518 | 0 | *pplane = (uint16_t)(strip / stripsperplane); |
519 | 0 | rows = td->td_imagelength - stripinplane * rowsperstrip; |
520 | 0 | if (rows > rowsperstrip) |
521 | 0 | rows = rowsperstrip; |
522 | 0 | stripsize = TIFFVStripSize(tif, rows); |
523 | 0 | if (stripsize == 0) |
524 | 0 | return ((tmsize_t)(-1)); |
525 | 0 | return stripsize; |
526 | 0 | } |
527 | | |
528 | | /* |
529 | | * Read a strip of data and decompress the specified |
530 | | * amount into the user-supplied buffer. |
531 | | */ |
532 | | tmsize_t TIFFReadEncodedStrip(TIFF *tif, uint32_t strip, void *buf, |
533 | | tmsize_t size) |
534 | 0 | { |
535 | 0 | static const char module[] = "TIFFReadEncodedStrip"; |
536 | 0 | TIFFDirectory *td = &tif->tif_dir; |
537 | 0 | tmsize_t stripsize; |
538 | 0 | uint16_t plane; |
539 | |
|
540 | 0 | stripsize = TIFFReadEncodedStripGetStripSize(tif, strip, &plane); |
541 | 0 | if (stripsize == ((tmsize_t)(-1))) |
542 | 0 | return ((tmsize_t)(-1)); |
543 | | |
544 | | /* shortcut to avoid an extra memcpy() */ |
545 | 0 | if (td->td_compression == COMPRESSION_NONE && size != (tmsize_t)(-1) && |
546 | 0 | size >= stripsize && !isMapped(tif) && |
547 | 0 | ((tif->tif_flags & TIFF_NOREADRAW) == 0)) |
548 | 0 | { |
549 | 0 | if (TIFFReadRawStrip1(tif, strip, buf, stripsize, module) != stripsize) |
550 | 0 | return ((tmsize_t)(-1)); |
551 | | |
552 | 0 | if (!isFillOrder(tif, td->td_fillorder) && |
553 | 0 | (tif->tif_flags & TIFF_NOBITREV) == 0) |
554 | 0 | TIFFReverseBits(buf, stripsize); |
555 | |
|
556 | 0 | (*tif->tif_postdecode)(tif, buf, stripsize); |
557 | 0 | return (stripsize); |
558 | 0 | } |
559 | | |
560 | 0 | if ((size != (tmsize_t)(-1)) && (size < stripsize)) |
561 | 0 | stripsize = size; |
562 | 0 | if (!TIFFFillStrip(tif, strip)) |
563 | 0 | { |
564 | | /* The output buf may be NULL, in particular if TIFFTAG_FAXFILLFUNC |
565 | | is being used. Thus, memset must be conditional on buf not NULL. */ |
566 | 0 | if (buf) |
567 | 0 | memset(buf, 0, (size_t)stripsize); |
568 | 0 | return ((tmsize_t)(-1)); |
569 | 0 | } |
570 | 0 | if ((*tif->tif_decodestrip)(tif, buf, stripsize, plane) <= 0) |
571 | 0 | return ((tmsize_t)(-1)); |
572 | 0 | (*tif->tif_postdecode)(tif, buf, stripsize); |
573 | 0 | return (stripsize); |
574 | 0 | } |
575 | | |
576 | | /* Variant of TIFFReadEncodedStrip() that does |
577 | | * * if *buf == NULL, *buf = _TIFFmallocExt(tif, bufsizetoalloc) only after |
578 | | * TIFFFillStrip() has succeeded. This avoid excessive memory allocation in case |
579 | | * of truncated file. |
580 | | * * calls regular TIFFReadEncodedStrip() if *buf != NULL |
581 | | */ |
582 | | tmsize_t _TIFFReadEncodedStripAndAllocBuffer(TIFF *tif, uint32_t strip, |
583 | | void **buf, |
584 | | tmsize_t bufsizetoalloc, |
585 | | tmsize_t size_to_read) |
586 | 0 | { |
587 | 0 | tmsize_t this_stripsize; |
588 | 0 | uint16_t plane; |
589 | |
|
590 | 0 | if (*buf != NULL) |
591 | 0 | { |
592 | 0 | return TIFFReadEncodedStrip(tif, strip, *buf, size_to_read); |
593 | 0 | } |
594 | | |
595 | 0 | this_stripsize = TIFFReadEncodedStripGetStripSize(tif, strip, &plane); |
596 | 0 | if (this_stripsize == ((tmsize_t)(-1))) |
597 | 0 | return ((tmsize_t)(-1)); |
598 | | |
599 | 0 | if ((size_to_read != (tmsize_t)(-1)) && (size_to_read < this_stripsize)) |
600 | 0 | this_stripsize = size_to_read; |
601 | 0 | if (!TIFFFillStrip(tif, strip)) |
602 | 0 | return ((tmsize_t)(-1)); |
603 | | |
604 | 0 | *buf = _TIFFmallocExt(tif, bufsizetoalloc); |
605 | 0 | if (*buf == NULL) |
606 | 0 | { |
607 | 0 | TIFFErrorExtR(tif, TIFFFileName(tif), "No space for strip buffer"); |
608 | 0 | return ((tmsize_t)(-1)); |
609 | 0 | } |
610 | 0 | _TIFFmemset(*buf, 0, bufsizetoalloc); |
611 | |
|
612 | 0 | if ((*tif->tif_decodestrip)(tif, *buf, this_stripsize, plane) <= 0) |
613 | 0 | return ((tmsize_t)(-1)); |
614 | 0 | (*tif->tif_postdecode)(tif, *buf, this_stripsize); |
615 | 0 | return (this_stripsize); |
616 | 0 | } |
617 | | |
618 | | static tmsize_t TIFFReadRawStrip1(TIFF *tif, uint32_t strip, void *buf, |
619 | | tmsize_t size, const char *module) |
620 | 0 | { |
621 | 0 | assert((tif->tif_flags & TIFF_NOREADRAW) == 0); |
622 | 0 | if (!isMapped(tif)) |
623 | 0 | { |
624 | 0 | tmsize_t cc; |
625 | |
|
626 | 0 | if (!SeekOK(tif, TIFFGetStrileOffset(tif, strip))) |
627 | 0 | { |
628 | 0 | TIFFErrorExtR(tif, module, |
629 | 0 | "Seek error at scanline %" PRIu32 ", strip %" PRIu32, |
630 | 0 | tif->tif_row, strip); |
631 | 0 | return ((tmsize_t)(-1)); |
632 | 0 | } |
633 | 0 | cc = TIFFReadFile(tif, buf, size); |
634 | 0 | if (cc != size) |
635 | 0 | { |
636 | 0 | TIFFErrorExtR(tif, module, |
637 | 0 | "Read error at scanline %" PRIu32 |
638 | 0 | "; got %" TIFF_SSIZE_FORMAT |
639 | 0 | " bytes, expected %" TIFF_SSIZE_FORMAT, |
640 | 0 | tif->tif_row, cc, size); |
641 | 0 | return ((tmsize_t)(-1)); |
642 | 0 | } |
643 | 0 | } |
644 | 0 | else |
645 | 0 | { |
646 | 0 | tmsize_t ma = 0; |
647 | 0 | tmsize_t n; |
648 | 0 | if ((TIFFGetStrileOffset(tif, strip) > (uint64_t)TIFF_TMSIZE_T_MAX) || |
649 | 0 | ((ma = (tmsize_t)TIFFGetStrileOffset(tif, strip)) > tif->tif_size)) |
650 | 0 | { |
651 | 0 | n = 0; |
652 | 0 | } |
653 | 0 | else if (ma > TIFF_TMSIZE_T_MAX - size) |
654 | 0 | { |
655 | 0 | n = 0; |
656 | 0 | } |
657 | 0 | else |
658 | 0 | { |
659 | 0 | tmsize_t mb = ma + size; |
660 | 0 | if (mb > tif->tif_size) |
661 | 0 | n = tif->tif_size - ma; |
662 | 0 | else |
663 | 0 | n = size; |
664 | 0 | } |
665 | 0 | if (n != size) |
666 | 0 | { |
667 | 0 | TIFFErrorExtR(tif, module, |
668 | 0 | "Read error at scanline %" PRIu32 ", strip %" PRIu32 |
669 | 0 | "; got %" TIFF_SSIZE_FORMAT |
670 | 0 | " bytes, expected %" TIFF_SSIZE_FORMAT, |
671 | 0 | tif->tif_row, strip, n, size); |
672 | 0 | return ((tmsize_t)(-1)); |
673 | 0 | } |
674 | 0 | _TIFFmemcpy(buf, tif->tif_base + ma, size); |
675 | 0 | } |
676 | 0 | return (size); |
677 | 0 | } |
678 | | |
679 | | static tmsize_t TIFFReadRawStripOrTile2(TIFF *tif, uint32_t strip_or_tile, |
680 | | int is_strip, tmsize_t size, |
681 | | const char *module) |
682 | 0 | { |
683 | 0 | assert(!isMapped(tif)); |
684 | 0 | assert((tif->tif_flags & TIFF_NOREADRAW) == 0); |
685 | | |
686 | 0 | if (!SeekOK(tif, TIFFGetStrileOffset(tif, strip_or_tile))) |
687 | 0 | { |
688 | 0 | if (is_strip) |
689 | 0 | { |
690 | 0 | TIFFErrorExtR(tif, module, |
691 | 0 | "Seek error at scanline %" PRIu32 ", strip %" PRIu32, |
692 | 0 | tif->tif_row, strip_or_tile); |
693 | 0 | } |
694 | 0 | else |
695 | 0 | { |
696 | 0 | TIFFErrorExtR(tif, module, |
697 | 0 | "Seek error at row %" PRIu32 ", col %" PRIu32 |
698 | 0 | ", tile %" PRIu32, |
699 | 0 | tif->tif_row, tif->tif_col, strip_or_tile); |
700 | 0 | } |
701 | 0 | return ((tmsize_t)(-1)); |
702 | 0 | } |
703 | | |
704 | 0 | if (!TIFFReadAndRealloc(tif, size, 0, is_strip, strip_or_tile, module)) |
705 | 0 | { |
706 | 0 | return ((tmsize_t)(-1)); |
707 | 0 | } |
708 | | |
709 | 0 | return (size); |
710 | 0 | } |
711 | | |
712 | | /* |
713 | | * Read a strip of data from the file. |
714 | | */ |
715 | | tmsize_t TIFFReadRawStrip(TIFF *tif, uint32_t strip, void *buf, tmsize_t size) |
716 | 0 | { |
717 | 0 | static const char module[] = "TIFFReadRawStrip"; |
718 | 0 | TIFFDirectory *td = &tif->tif_dir; |
719 | 0 | uint64_t bytecount64; |
720 | 0 | tmsize_t bytecountm; |
721 | |
|
722 | 0 | if (!TIFFCheckRead(tif, 0)) |
723 | 0 | return ((tmsize_t)(-1)); |
724 | 0 | if (strip >= td->td_nstrips) |
725 | 0 | { |
726 | 0 | TIFFErrorExtR(tif, module, |
727 | 0 | "%" PRIu32 ": Strip out of range, max %" PRIu32, strip, |
728 | 0 | td->td_nstrips); |
729 | 0 | return ((tmsize_t)(-1)); |
730 | 0 | } |
731 | 0 | if (tif->tif_flags & TIFF_NOREADRAW) |
732 | 0 | { |
733 | 0 | TIFFErrorExtR(tif, module, |
734 | 0 | "Compression scheme does not support access to raw " |
735 | 0 | "uncompressed data"); |
736 | 0 | return ((tmsize_t)(-1)); |
737 | 0 | } |
738 | 0 | bytecount64 = TIFFGetStrileByteCount(tif, strip); |
739 | 0 | if (size != (tmsize_t)(-1) && (uint64_t)size <= bytecount64) |
740 | 0 | bytecountm = size; |
741 | 0 | else |
742 | 0 | bytecountm = _TIFFCastUInt64ToSSize(tif, bytecount64, module); |
743 | 0 | if (bytecountm == 0) |
744 | 0 | { |
745 | 0 | return ((tmsize_t)(-1)); |
746 | 0 | } |
747 | 0 | return (TIFFReadRawStrip1(tif, strip, buf, bytecountm, module)); |
748 | 0 | } |
749 | | |
750 | | TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW |
751 | 0 | static uint64_t NoSanitizeSubUInt64(uint64_t a, uint64_t b) { return a - b; } |
752 | | |
753 | | /* |
754 | | * Read the specified strip and setup for decoding. The data buffer is |
755 | | * expanded, as necessary, to hold the strip's data. |
756 | | */ |
757 | | int TIFFFillStrip(TIFF *tif, uint32_t strip) |
758 | 0 | { |
759 | 0 | static const char module[] = "TIFFFillStrip"; |
760 | 0 | TIFFDirectory *td = &tif->tif_dir; |
761 | |
|
762 | 0 | if ((tif->tif_flags & TIFF_NOREADRAW) == 0) |
763 | 0 | { |
764 | 0 | uint64_t bytecount = TIFFGetStrileByteCount(tif, strip); |
765 | 0 | if (bytecount == 0 || bytecount > (uint64_t)TIFF_INT64_MAX) |
766 | 0 | { |
767 | 0 | TIFFErrorExtR(tif, module, |
768 | 0 | "Invalid strip byte count %" PRIu64 |
769 | 0 | ", strip %" PRIu32, |
770 | 0 | bytecount, strip); |
771 | 0 | return (0); |
772 | 0 | } |
773 | | |
774 | | /* To avoid excessive memory allocations: */ |
775 | | /* Byte count should normally not be larger than a number of */ |
776 | | /* times the uncompressed size plus some margin */ |
777 | 0 | if (bytecount > 1024 * 1024) |
778 | 0 | { |
779 | | /* 10 and 4096 are just values that could be adjusted. */ |
780 | | /* Hopefully they are safe enough for all codecs */ |
781 | 0 | tmsize_t stripsize = TIFFStripSize(tif); |
782 | 0 | if (stripsize != 0 && (bytecount - 4096) / 10 > (uint64_t)stripsize) |
783 | 0 | { |
784 | 0 | uint64_t newbytecount = (uint64_t)stripsize * 10 + 4096; |
785 | 0 | TIFFErrorExtR(tif, module, |
786 | 0 | "Too large strip byte count %" PRIu64 |
787 | 0 | ", strip %" PRIu32 ". Limiting to %" PRIu64, |
788 | 0 | bytecount, strip, newbytecount); |
789 | 0 | bytecount = newbytecount; |
790 | 0 | } |
791 | 0 | } |
792 | |
|
793 | 0 | if (isMapped(tif)) |
794 | 0 | { |
795 | | /* |
796 | | * We must check for overflow, potentially causing |
797 | | * an OOB read. Instead of simple |
798 | | * |
799 | | * TIFFGetStrileOffset(tif, strip)+bytecount > tif->tif_size |
800 | | * |
801 | | * comparison (which can overflow) we do the following |
802 | | * two comparisons: |
803 | | */ |
804 | 0 | if (bytecount > (uint64_t)tif->tif_size || |
805 | 0 | TIFFGetStrileOffset(tif, strip) > |
806 | 0 | (uint64_t)tif->tif_size - bytecount) |
807 | 0 | { |
808 | | /* |
809 | | * This error message might seem strange, but |
810 | | * it's what would happen if a read were done |
811 | | * instead. |
812 | | */ |
813 | 0 | TIFFErrorExtR( |
814 | 0 | tif, module, |
815 | |
|
816 | 0 | "Read error on strip %" PRIu32 "; " |
817 | 0 | "got %" PRIu64 " bytes, expected %" PRIu64, |
818 | 0 | strip, |
819 | 0 | NoSanitizeSubUInt64(tif->tif_size, |
820 | 0 | TIFFGetStrileOffset(tif, strip)), |
821 | 0 | bytecount); |
822 | 0 | tif->tif_curstrip = NOSTRIP; |
823 | 0 | return (0); |
824 | 0 | } |
825 | 0 | } |
826 | | |
827 | 0 | if (isMapped(tif) && (isFillOrder(tif, td->td_fillorder) || |
828 | 0 | (tif->tif_flags & TIFF_NOBITREV))) |
829 | 0 | { |
830 | | /* |
831 | | * The image is mapped into memory and we either don't |
832 | | * need to flip bits or the compression routine is |
833 | | * going to handle this operation itself. In this |
834 | | * case, avoid copying the raw data and instead just |
835 | | * reference the data from the memory mapped file |
836 | | * image. This assumes that the decompression |
837 | | * routines do not modify the contents of the raw data |
838 | | * buffer (if they try to, the application will get a |
839 | | * fault since the file is mapped read-only). |
840 | | */ |
841 | 0 | if ((tif->tif_flags & TIFF_MYBUFFER) && tif->tif_rawdata) |
842 | 0 | { |
843 | 0 | _TIFFfreeExt(tif, tif->tif_rawdata); |
844 | 0 | tif->tif_rawdata = NULL; |
845 | 0 | tif->tif_rawdatasize = 0; |
846 | 0 | } |
847 | 0 | tif->tif_flags &= ~TIFF_MYBUFFER; |
848 | 0 | tif->tif_rawdatasize = (tmsize_t)bytecount; |
849 | 0 | tif->tif_rawdata = |
850 | 0 | tif->tif_base + (tmsize_t)TIFFGetStrileOffset(tif, strip); |
851 | 0 | tif->tif_rawdataoff = 0; |
852 | 0 | tif->tif_rawdataloaded = (tmsize_t)bytecount; |
853 | | |
854 | | /* |
855 | | * When we have tif_rawdata reference directly into the memory |
856 | | * mapped file we need to be pretty careful about how we use the |
857 | | * rawdata. It is not a general purpose working buffer as it |
858 | | * normally otherwise is. So we keep track of this fact to avoid |
859 | | * using it improperly. |
860 | | */ |
861 | 0 | tif->tif_flags |= TIFF_BUFFERMMAP; |
862 | 0 | } |
863 | 0 | else |
864 | 0 | { |
865 | | /* |
866 | | * Expand raw data buffer, if needed, to hold data |
867 | | * strip coming from file (perhaps should set upper |
868 | | * bound on the size of a buffer we'll use?). |
869 | | */ |
870 | 0 | tmsize_t bytecountm; |
871 | 0 | bytecountm = (tmsize_t)bytecount; |
872 | 0 | if ((uint64_t)bytecountm != bytecount) |
873 | 0 | { |
874 | 0 | TIFFErrorExtR(tif, module, "Integer overflow"); |
875 | 0 | return (0); |
876 | 0 | } |
877 | 0 | if (bytecountm > tif->tif_rawdatasize) |
878 | 0 | { |
879 | 0 | tif->tif_curstrip = NOSTRIP; |
880 | 0 | if ((tif->tif_flags & TIFF_MYBUFFER) == 0) |
881 | 0 | { |
882 | 0 | TIFFErrorExtR( |
883 | 0 | tif, module, |
884 | 0 | "Data buffer too small to hold strip %" PRIu32, strip); |
885 | 0 | return (0); |
886 | 0 | } |
887 | 0 | } |
888 | 0 | if (tif->tif_flags & TIFF_BUFFERMMAP) |
889 | 0 | { |
890 | 0 | tif->tif_curstrip = NOSTRIP; |
891 | 0 | tif->tif_rawdata = NULL; |
892 | 0 | tif->tif_rawdatasize = 0; |
893 | 0 | tif->tif_flags &= ~TIFF_BUFFERMMAP; |
894 | 0 | } |
895 | |
|
896 | 0 | if (isMapped(tif)) |
897 | 0 | { |
898 | 0 | if (bytecountm > tif->tif_rawdatasize && |
899 | 0 | !TIFFReadBufferSetup(tif, 0, bytecountm)) |
900 | 0 | { |
901 | 0 | return (0); |
902 | 0 | } |
903 | 0 | if (TIFFReadRawStrip1(tif, strip, tif->tif_rawdata, bytecountm, |
904 | 0 | module) != bytecountm) |
905 | 0 | { |
906 | 0 | return (0); |
907 | 0 | } |
908 | 0 | } |
909 | 0 | else |
910 | 0 | { |
911 | 0 | if (TIFFReadRawStripOrTile2(tif, strip, 1, bytecountm, |
912 | 0 | module) != bytecountm) |
913 | 0 | { |
914 | 0 | return (0); |
915 | 0 | } |
916 | 0 | } |
917 | | |
918 | 0 | tif->tif_rawdataoff = 0; |
919 | 0 | tif->tif_rawdataloaded = bytecountm; |
920 | |
|
921 | 0 | if (!isFillOrder(tif, td->td_fillorder) && |
922 | 0 | (tif->tif_flags & TIFF_NOBITREV) == 0) |
923 | 0 | TIFFReverseBits(tif->tif_rawdata, bytecountm); |
924 | 0 | } |
925 | 0 | } |
926 | 0 | return (TIFFStartStrip(tif, strip)); |
927 | 0 | } |
928 | | |
929 | | /* |
930 | | * Tile-oriented Read Support |
931 | | * Contributed by Nancy Cam (Silicon Graphics). |
932 | | */ |
933 | | |
934 | | /* |
935 | | * Read and decompress a tile of data. The |
936 | | * tile is selected by the (x,y,z,s) coordinates. |
937 | | */ |
938 | | tmsize_t TIFFReadTile(TIFF *tif, void *buf, uint32_t x, uint32_t y, uint32_t z, |
939 | | uint16_t s) |
940 | 0 | { |
941 | 0 | if (!TIFFCheckRead(tif, 1) || !TIFFCheckTile(tif, x, y, z, s)) |
942 | 0 | return ((tmsize_t)(-1)); |
943 | 0 | return (TIFFReadEncodedTile(tif, TIFFComputeTile(tif, x, y, z, s), buf, |
944 | 0 | (tmsize_t)(-1))); |
945 | 0 | } |
946 | | |
947 | | /* |
948 | | * Read a tile of data and decompress the specified |
949 | | * amount into the user-supplied buffer. |
950 | | */ |
951 | | tmsize_t TIFFReadEncodedTile(TIFF *tif, uint32_t tile, void *buf, tmsize_t size) |
952 | 0 | { |
953 | 0 | static const char module[] = "TIFFReadEncodedTile"; |
954 | 0 | TIFFDirectory *td = &tif->tif_dir; |
955 | 0 | tmsize_t tilesize = tif->tif_tilesize; |
956 | |
|
957 | 0 | if (!TIFFCheckRead(tif, 1)) |
958 | 0 | return ((tmsize_t)(-1)); |
959 | 0 | if (tile >= td->td_nstrips) |
960 | 0 | { |
961 | 0 | TIFFErrorExtR(tif, module, |
962 | 0 | "%" PRIu32 ": Tile out of range, max %" PRIu32, tile, |
963 | 0 | td->td_nstrips); |
964 | 0 | return ((tmsize_t)(-1)); |
965 | 0 | } |
966 | | |
967 | | /* shortcut to avoid an extra memcpy() */ |
968 | 0 | if (td->td_compression == COMPRESSION_NONE && size != (tmsize_t)(-1) && |
969 | 0 | size >= tilesize && !isMapped(tif) && |
970 | 0 | ((tif->tif_flags & TIFF_NOREADRAW) == 0)) |
971 | 0 | { |
972 | 0 | if (TIFFReadRawTile1(tif, tile, buf, tilesize, module) != tilesize) |
973 | 0 | return ((tmsize_t)(-1)); |
974 | | |
975 | 0 | if (!isFillOrder(tif, td->td_fillorder) && |
976 | 0 | (tif->tif_flags & TIFF_NOBITREV) == 0) |
977 | 0 | TIFFReverseBits(buf, tilesize); |
978 | |
|
979 | 0 | (*tif->tif_postdecode)(tif, buf, tilesize); |
980 | 0 | return (tilesize); |
981 | 0 | } |
982 | | |
983 | 0 | if (size == (tmsize_t)(-1)) |
984 | 0 | size = tilesize; |
985 | 0 | else if (size > tilesize) |
986 | 0 | size = tilesize; |
987 | 0 | if (!TIFFFillTile(tif, tile)) |
988 | 0 | { |
989 | | /* See TIFFReadEncodedStrip comment regarding TIFFTAG_FAXFILLFUNC. */ |
990 | 0 | if (buf) |
991 | 0 | memset(buf, 0, (size_t)size); |
992 | 0 | return ((tmsize_t)(-1)); |
993 | 0 | } |
994 | 0 | else if ((*tif->tif_decodetile)(tif, (uint8_t *)buf, size, |
995 | 0 | (uint16_t)(tile / td->td_stripsperimage))) |
996 | 0 | { |
997 | 0 | (*tif->tif_postdecode)(tif, (uint8_t *)buf, size); |
998 | 0 | return (size); |
999 | 0 | } |
1000 | 0 | else |
1001 | 0 | return ((tmsize_t)(-1)); |
1002 | 0 | } |
1003 | | |
1004 | | /* Variant of TIFFReadTile() that does |
1005 | | * * if *buf == NULL, *buf = _TIFFmallocExt(tif, bufsizetoalloc) only after |
1006 | | * TIFFFillTile() has succeeded. This avoid excessive memory allocation in case |
1007 | | * of truncated file. |
1008 | | * * calls regular TIFFReadEncodedTile() if *buf != NULL |
1009 | | */ |
1010 | | tmsize_t _TIFFReadTileAndAllocBuffer(TIFF *tif, void **buf, |
1011 | | tmsize_t bufsizetoalloc, uint32_t x, |
1012 | | uint32_t y, uint32_t z, uint16_t s) |
1013 | 0 | { |
1014 | 0 | if (!TIFFCheckRead(tif, 1) || !TIFFCheckTile(tif, x, y, z, s)) |
1015 | 0 | return ((tmsize_t)(-1)); |
1016 | 0 | return (_TIFFReadEncodedTileAndAllocBuffer( |
1017 | 0 | tif, TIFFComputeTile(tif, x, y, z, s), buf, bufsizetoalloc, |
1018 | 0 | (tmsize_t)(-1))); |
1019 | 0 | } |
1020 | | |
1021 | | /* Variant of TIFFReadEncodedTile() that does |
1022 | | * * if *buf == NULL, *buf = _TIFFmallocExt(tif, bufsizetoalloc) only after |
1023 | | * TIFFFillTile() has succeeded. This avoid excessive memory allocation in case |
1024 | | * of truncated file. |
1025 | | * * calls regular TIFFReadEncodedTile() if *buf != NULL |
1026 | | */ |
1027 | | tmsize_t _TIFFReadEncodedTileAndAllocBuffer(TIFF *tif, uint32_t tile, |
1028 | | void **buf, tmsize_t bufsizetoalloc, |
1029 | | tmsize_t size_to_read) |
1030 | 0 | { |
1031 | 0 | static const char module[] = "_TIFFReadEncodedTileAndAllocBuffer"; |
1032 | 0 | TIFFDirectory *td = &tif->tif_dir; |
1033 | 0 | tmsize_t tilesize = tif->tif_tilesize; |
1034 | |
|
1035 | 0 | if (*buf != NULL) |
1036 | 0 | { |
1037 | 0 | return TIFFReadEncodedTile(tif, tile, *buf, size_to_read); |
1038 | 0 | } |
1039 | | |
1040 | 0 | if (!TIFFCheckRead(tif, 1)) |
1041 | 0 | return ((tmsize_t)(-1)); |
1042 | 0 | if (tile >= td->td_nstrips) |
1043 | 0 | { |
1044 | 0 | TIFFErrorExtR(tif, module, |
1045 | 0 | "%" PRIu32 ": Tile out of range, max %" PRIu32, tile, |
1046 | 0 | td->td_nstrips); |
1047 | 0 | return ((tmsize_t)(-1)); |
1048 | 0 | } |
1049 | | |
1050 | 0 | if (!TIFFFillTile(tif, tile)) |
1051 | 0 | return ((tmsize_t)(-1)); |
1052 | | |
1053 | | /* Sanity checks to avoid excessive memory allocation */ |
1054 | | /* Cf https://gitlab.com/libtiff/libtiff/-/issues/479 */ |
1055 | 0 | if (td->td_compression == COMPRESSION_NONE) |
1056 | 0 | { |
1057 | 0 | if (tif->tif_rawdatasize != tilesize) |
1058 | 0 | { |
1059 | 0 | TIFFErrorExtR(tif, TIFFFileName(tif), |
1060 | 0 | "Invalid tile byte count for tile %u. " |
1061 | 0 | "Expected %" PRIu64 ", got %" PRIu64, |
1062 | 0 | tile, (uint64_t)tilesize, |
1063 | 0 | (uint64_t)tif->tif_rawdatasize); |
1064 | 0 | return ((tmsize_t)(-1)); |
1065 | 0 | } |
1066 | 0 | } |
1067 | 0 | else |
1068 | 0 | { |
1069 | | /* Max compression ratio experimentally determined. Might be fragile... |
1070 | | * Only apply this heuristics to situations where the memory allocation |
1071 | | * would be big, to avoid breaking nominal use cases. |
1072 | | */ |
1073 | 0 | const int maxCompressionRatio = |
1074 | 0 | td->td_compression == COMPRESSION_ZSTD ? 33000 |
1075 | 0 | : td->td_compression == COMPRESSION_JXL |
1076 | 0 | ? |
1077 | | /* Evaluated on a 8000x8000 tile */ |
1078 | 0 | 25000 * (td->td_planarconfig == PLANARCONFIG_CONTIG |
1079 | 0 | ? td->td_samplesperpixel |
1080 | 0 | : 1) |
1081 | 0 | : td->td_compression == COMPRESSION_LZMA ? 7000 : 1000; |
1082 | 0 | if (bufsizetoalloc > 100 * 1000 * 1000 && |
1083 | 0 | tif->tif_rawdatasize < tilesize / maxCompressionRatio) |
1084 | 0 | { |
1085 | 0 | TIFFErrorExtR(tif, TIFFFileName(tif), |
1086 | 0 | "Likely invalid tile byte count for tile %u. " |
1087 | 0 | "Uncompressed tile size is %" PRIu64 ", " |
1088 | 0 | "compressed one is %" PRIu64, |
1089 | 0 | tile, (uint64_t)tilesize, |
1090 | 0 | (uint64_t)tif->tif_rawdatasize); |
1091 | 0 | return ((tmsize_t)(-1)); |
1092 | 0 | } |
1093 | 0 | } |
1094 | | |
1095 | 0 | *buf = _TIFFmallocExt(tif, bufsizetoalloc); |
1096 | 0 | if (*buf == NULL) |
1097 | 0 | { |
1098 | 0 | TIFFErrorExtR(tif, TIFFFileName(tif), "No space for tile buffer"); |
1099 | 0 | return ((tmsize_t)(-1)); |
1100 | 0 | } |
1101 | 0 | _TIFFmemset(*buf, 0, bufsizetoalloc); |
1102 | |
|
1103 | 0 | if (size_to_read == (tmsize_t)(-1)) |
1104 | 0 | size_to_read = tilesize; |
1105 | 0 | else if (size_to_read > tilesize) |
1106 | 0 | size_to_read = tilesize; |
1107 | 0 | if ((*tif->tif_decodetile)(tif, (uint8_t *)*buf, size_to_read, |
1108 | 0 | (uint16_t)(tile / td->td_stripsperimage))) |
1109 | 0 | { |
1110 | 0 | (*tif->tif_postdecode)(tif, (uint8_t *)*buf, size_to_read); |
1111 | 0 | return (size_to_read); |
1112 | 0 | } |
1113 | 0 | else |
1114 | 0 | return ((tmsize_t)(-1)); |
1115 | 0 | } |
1116 | | |
1117 | | static tmsize_t TIFFReadRawTile1(TIFF *tif, uint32_t tile, void *buf, |
1118 | | tmsize_t size, const char *module) |
1119 | 0 | { |
1120 | 0 | assert((tif->tif_flags & TIFF_NOREADRAW) == 0); |
1121 | 0 | if (!isMapped(tif)) |
1122 | 0 | { |
1123 | 0 | tmsize_t cc; |
1124 | |
|
1125 | 0 | if (!SeekOK(tif, TIFFGetStrileOffset(tif, tile))) |
1126 | 0 | { |
1127 | 0 | TIFFErrorExtR(tif, module, |
1128 | 0 | "Seek error at row %" PRIu32 ", col %" PRIu32 |
1129 | 0 | ", tile %" PRIu32, |
1130 | 0 | tif->tif_row, tif->tif_col, tile); |
1131 | 0 | return ((tmsize_t)(-1)); |
1132 | 0 | } |
1133 | 0 | cc = TIFFReadFile(tif, buf, size); |
1134 | 0 | if (cc != size) |
1135 | 0 | { |
1136 | 0 | TIFFErrorExtR(tif, module, |
1137 | 0 | "Read error at row %" PRIu32 ", col %" PRIu32 |
1138 | 0 | "; got %" TIFF_SSIZE_FORMAT |
1139 | 0 | " bytes, expected %" TIFF_SSIZE_FORMAT, |
1140 | 0 | tif->tif_row, tif->tif_col, cc, size); |
1141 | 0 | return ((tmsize_t)(-1)); |
1142 | 0 | } |
1143 | 0 | } |
1144 | 0 | else |
1145 | 0 | { |
1146 | 0 | tmsize_t ma, mb; |
1147 | 0 | tmsize_t n; |
1148 | 0 | ma = (tmsize_t)TIFFGetStrileOffset(tif, tile); |
1149 | 0 | mb = ma + size; |
1150 | 0 | if ((TIFFGetStrileOffset(tif, tile) > (uint64_t)TIFF_TMSIZE_T_MAX) || |
1151 | 0 | (ma > tif->tif_size)) |
1152 | 0 | n = 0; |
1153 | 0 | else if ((mb < ma) || (mb < size) || (mb > tif->tif_size)) |
1154 | 0 | n = tif->tif_size - ma; |
1155 | 0 | else |
1156 | 0 | n = size; |
1157 | 0 | if (n != size) |
1158 | 0 | { |
1159 | 0 | TIFFErrorExtR(tif, module, |
1160 | 0 | "Read error at row %" PRIu32 ", col %" PRIu32 |
1161 | 0 | ", tile %" PRIu32 "; got %" TIFF_SSIZE_FORMAT |
1162 | 0 | " bytes, expected %" TIFF_SSIZE_FORMAT, |
1163 | 0 | tif->tif_row, tif->tif_col, tile, n, size); |
1164 | 0 | return ((tmsize_t)(-1)); |
1165 | 0 | } |
1166 | 0 | _TIFFmemcpy(buf, tif->tif_base + ma, size); |
1167 | 0 | } |
1168 | 0 | return (size); |
1169 | 0 | } |
1170 | | |
1171 | | /* |
1172 | | * Read a tile of data from the file. |
1173 | | */ |
1174 | | tmsize_t TIFFReadRawTile(TIFF *tif, uint32_t tile, void *buf, tmsize_t size) |
1175 | 0 | { |
1176 | 0 | static const char module[] = "TIFFReadRawTile"; |
1177 | 0 | TIFFDirectory *td = &tif->tif_dir; |
1178 | 0 | uint64_t bytecount64; |
1179 | 0 | tmsize_t bytecountm; |
1180 | |
|
1181 | 0 | if (!TIFFCheckRead(tif, 1)) |
1182 | 0 | return ((tmsize_t)(-1)); |
1183 | 0 | if (tile >= td->td_nstrips) |
1184 | 0 | { |
1185 | 0 | TIFFErrorExtR(tif, module, |
1186 | 0 | "%" PRIu32 ": Tile out of range, max %" PRIu32, tile, |
1187 | 0 | td->td_nstrips); |
1188 | 0 | return ((tmsize_t)(-1)); |
1189 | 0 | } |
1190 | 0 | if (tif->tif_flags & TIFF_NOREADRAW) |
1191 | 0 | { |
1192 | 0 | TIFFErrorExtR(tif, module, |
1193 | 0 | "Compression scheme does not support access to raw " |
1194 | 0 | "uncompressed data"); |
1195 | 0 | return ((tmsize_t)(-1)); |
1196 | 0 | } |
1197 | 0 | bytecount64 = TIFFGetStrileByteCount(tif, tile); |
1198 | 0 | if (size != (tmsize_t)(-1) && (uint64_t)size <= bytecount64) |
1199 | 0 | bytecountm = size; |
1200 | 0 | else |
1201 | 0 | bytecountm = _TIFFCastUInt64ToSSize(tif, bytecount64, module); |
1202 | 0 | if (bytecountm == 0) |
1203 | 0 | { |
1204 | 0 | return ((tmsize_t)(-1)); |
1205 | 0 | } |
1206 | 0 | return (TIFFReadRawTile1(tif, tile, buf, bytecountm, module)); |
1207 | 0 | } |
1208 | | |
1209 | | /* |
1210 | | * Read the specified tile and setup for decoding. The data buffer is |
1211 | | * expanded, as necessary, to hold the tile's data. |
1212 | | */ |
1213 | | int TIFFFillTile(TIFF *tif, uint32_t tile) |
1214 | 0 | { |
1215 | 0 | static const char module[] = "TIFFFillTile"; |
1216 | 0 | TIFFDirectory *td = &tif->tif_dir; |
1217 | |
|
1218 | 0 | if ((tif->tif_flags & TIFF_NOREADRAW) == 0) |
1219 | 0 | { |
1220 | 0 | uint64_t bytecount = TIFFGetStrileByteCount(tif, tile); |
1221 | 0 | if (bytecount == 0 || bytecount > (uint64_t)TIFF_INT64_MAX) |
1222 | 0 | { |
1223 | 0 | TIFFErrorExtR(tif, module, |
1224 | 0 | "%" PRIu64 ": Invalid tile byte count, tile %" PRIu32, |
1225 | 0 | bytecount, tile); |
1226 | 0 | return (0); |
1227 | 0 | } |
1228 | | |
1229 | | /* To avoid excessive memory allocations: */ |
1230 | | /* Byte count should normally not be larger than a number of */ |
1231 | | /* times the uncompressed size plus some margin */ |
1232 | 0 | if (bytecount > 1024 * 1024) |
1233 | 0 | { |
1234 | | /* 10 and 4096 are just values that could be adjusted. */ |
1235 | | /* Hopefully they are safe enough for all codecs */ |
1236 | 0 | tmsize_t stripsize = TIFFTileSize(tif); |
1237 | 0 | if (stripsize != 0 && (bytecount - 4096) / 10 > (uint64_t)stripsize) |
1238 | 0 | { |
1239 | 0 | uint64_t newbytecount = (uint64_t)stripsize * 10 + 4096; |
1240 | 0 | TIFFErrorExtR(tif, module, |
1241 | 0 | "Too large tile byte count %" PRIu64 |
1242 | 0 | ", tile %" PRIu32 ". Limiting to %" PRIu64, |
1243 | 0 | bytecount, tile, newbytecount); |
1244 | 0 | bytecount = newbytecount; |
1245 | 0 | } |
1246 | 0 | } |
1247 | |
|
1248 | 0 | if (isMapped(tif)) |
1249 | 0 | { |
1250 | | /* |
1251 | | * We must check for overflow, potentially causing |
1252 | | * an OOB read. Instead of simple |
1253 | | * |
1254 | | * TIFFGetStrileOffset(tif, tile)+bytecount > tif->tif_size |
1255 | | * |
1256 | | * comparison (which can overflow) we do the following |
1257 | | * two comparisons: |
1258 | | */ |
1259 | 0 | if (bytecount > (uint64_t)tif->tif_size || |
1260 | 0 | TIFFGetStrileOffset(tif, tile) > |
1261 | 0 | (uint64_t)tif->tif_size - bytecount) |
1262 | 0 | { |
1263 | 0 | tif->tif_curtile = NOTILE; |
1264 | 0 | return (0); |
1265 | 0 | } |
1266 | 0 | } |
1267 | | |
1268 | 0 | if (isMapped(tif) && (isFillOrder(tif, td->td_fillorder) || |
1269 | 0 | (tif->tif_flags & TIFF_NOBITREV))) |
1270 | 0 | { |
1271 | | /* |
1272 | | * The image is mapped into memory and we either don't |
1273 | | * need to flip bits or the compression routine is |
1274 | | * going to handle this operation itself. In this |
1275 | | * case, avoid copying the raw data and instead just |
1276 | | * reference the data from the memory mapped file |
1277 | | * image. This assumes that the decompression |
1278 | | * routines do not modify the contents of the raw data |
1279 | | * buffer (if they try to, the application will get a |
1280 | | * fault since the file is mapped read-only). |
1281 | | */ |
1282 | 0 | if ((tif->tif_flags & TIFF_MYBUFFER) && tif->tif_rawdata) |
1283 | 0 | { |
1284 | 0 | _TIFFfreeExt(tif, tif->tif_rawdata); |
1285 | 0 | tif->tif_rawdata = NULL; |
1286 | 0 | tif->tif_rawdatasize = 0; |
1287 | 0 | } |
1288 | 0 | tif->tif_flags &= ~TIFF_MYBUFFER; |
1289 | |
|
1290 | 0 | tif->tif_rawdatasize = (tmsize_t)bytecount; |
1291 | 0 | tif->tif_rawdata = |
1292 | 0 | tif->tif_base + (tmsize_t)TIFFGetStrileOffset(tif, tile); |
1293 | 0 | tif->tif_rawdataoff = 0; |
1294 | 0 | tif->tif_rawdataloaded = (tmsize_t)bytecount; |
1295 | 0 | tif->tif_flags |= TIFF_BUFFERMMAP; |
1296 | 0 | } |
1297 | 0 | else |
1298 | 0 | { |
1299 | | /* |
1300 | | * Expand raw data buffer, if needed, to hold data |
1301 | | * tile coming from file (perhaps should set upper |
1302 | | * bound on the size of a buffer we'll use?). |
1303 | | */ |
1304 | 0 | tmsize_t bytecountm; |
1305 | 0 | bytecountm = (tmsize_t)bytecount; |
1306 | 0 | if ((uint64_t)bytecountm != bytecount) |
1307 | 0 | { |
1308 | 0 | TIFFErrorExtR(tif, module, "Integer overflow"); |
1309 | 0 | return (0); |
1310 | 0 | } |
1311 | 0 | if (bytecountm > tif->tif_rawdatasize) |
1312 | 0 | { |
1313 | 0 | tif->tif_curtile = NOTILE; |
1314 | 0 | if ((tif->tif_flags & TIFF_MYBUFFER) == 0) |
1315 | 0 | { |
1316 | 0 | TIFFErrorExtR(tif, module, |
1317 | 0 | "Data buffer too small to hold tile %" PRIu32, |
1318 | 0 | tile); |
1319 | 0 | return (0); |
1320 | 0 | } |
1321 | 0 | } |
1322 | 0 | if (tif->tif_flags & TIFF_BUFFERMMAP) |
1323 | 0 | { |
1324 | 0 | tif->tif_curtile = NOTILE; |
1325 | 0 | tif->tif_rawdata = NULL; |
1326 | 0 | tif->tif_rawdatasize = 0; |
1327 | 0 | tif->tif_flags &= ~TIFF_BUFFERMMAP; |
1328 | 0 | } |
1329 | |
|
1330 | 0 | if (isMapped(tif)) |
1331 | 0 | { |
1332 | 0 | if (bytecountm > tif->tif_rawdatasize && |
1333 | 0 | !TIFFReadBufferSetup(tif, 0, bytecountm)) |
1334 | 0 | { |
1335 | 0 | return (0); |
1336 | 0 | } |
1337 | 0 | if (TIFFReadRawTile1(tif, tile, tif->tif_rawdata, bytecountm, |
1338 | 0 | module) != bytecountm) |
1339 | 0 | { |
1340 | 0 | return (0); |
1341 | 0 | } |
1342 | 0 | } |
1343 | 0 | else |
1344 | 0 | { |
1345 | 0 | if (TIFFReadRawStripOrTile2(tif, tile, 0, bytecountm, module) != |
1346 | 0 | bytecountm) |
1347 | 0 | { |
1348 | 0 | return (0); |
1349 | 0 | } |
1350 | 0 | } |
1351 | | |
1352 | 0 | tif->tif_rawdataoff = 0; |
1353 | 0 | tif->tif_rawdataloaded = bytecountm; |
1354 | |
|
1355 | 0 | if (tif->tif_rawdata != NULL && |
1356 | 0 | !isFillOrder(tif, td->td_fillorder) && |
1357 | 0 | (tif->tif_flags & TIFF_NOBITREV) == 0) |
1358 | 0 | TIFFReverseBits(tif->tif_rawdata, tif->tif_rawdataloaded); |
1359 | 0 | } |
1360 | 0 | } |
1361 | 0 | return (TIFFStartTile(tif, tile)); |
1362 | 0 | } |
1363 | | |
1364 | | /* |
1365 | | * Setup the raw data buffer in preparation for |
1366 | | * reading a strip of raw data. If the buffer |
1367 | | * is specified as zero, then a buffer of appropriate |
1368 | | * size is allocated by the library. Otherwise, |
1369 | | * the client must guarantee that the buffer is |
1370 | | * large enough to hold any individual strip of |
1371 | | * raw data. |
1372 | | */ |
1373 | | int TIFFReadBufferSetup(TIFF *tif, void *bp, tmsize_t size) |
1374 | 0 | { |
1375 | 0 | static const char module[] = "TIFFReadBufferSetup"; |
1376 | |
|
1377 | 0 | assert((tif->tif_flags & TIFF_NOREADRAW) == 0); |
1378 | 0 | tif->tif_flags &= ~TIFF_BUFFERMMAP; |
1379 | |
|
1380 | 0 | if (tif->tif_rawdata) |
1381 | 0 | { |
1382 | 0 | if (tif->tif_flags & TIFF_MYBUFFER) |
1383 | 0 | _TIFFfreeExt(tif, tif->tif_rawdata); |
1384 | 0 | tif->tif_rawdata = NULL; |
1385 | 0 | tif->tif_rawdatasize = 0; |
1386 | 0 | } |
1387 | 0 | if (bp) |
1388 | 0 | { |
1389 | 0 | tif->tif_rawdatasize = size; |
1390 | 0 | tif->tif_rawdata = (uint8_t *)bp; |
1391 | 0 | tif->tif_flags &= ~TIFF_MYBUFFER; |
1392 | 0 | } |
1393 | 0 | else |
1394 | 0 | { |
1395 | 0 | tif->tif_rawdatasize = (tmsize_t)TIFFroundup_64((uint64_t)size, 1024); |
1396 | 0 | if (tif->tif_rawdatasize == 0) |
1397 | 0 | { |
1398 | 0 | TIFFErrorExtR(tif, module, "Invalid buffer size"); |
1399 | 0 | return (0); |
1400 | 0 | } |
1401 | | /* Initialize to zero to avoid uninitialized buffers in case of */ |
1402 | | /* short reads (http://bugzilla.maptools.org/show_bug.cgi?id=2651) */ |
1403 | 0 | tif->tif_rawdata = |
1404 | 0 | (uint8_t *)_TIFFcallocExt(tif, 1, tif->tif_rawdatasize); |
1405 | 0 | tif->tif_flags |= TIFF_MYBUFFER; |
1406 | 0 | } |
1407 | 0 | if (tif->tif_rawdata == NULL) |
1408 | 0 | { |
1409 | 0 | TIFFErrorExtR(tif, module, |
1410 | 0 | "No space for data buffer at scanline %" PRIu32, |
1411 | 0 | tif->tif_row); |
1412 | 0 | tif->tif_rawdatasize = 0; |
1413 | 0 | return (0); |
1414 | 0 | } |
1415 | 0 | return (1); |
1416 | 0 | } |
1417 | | |
1418 | | /* |
1419 | | * Set state to appear as if a |
1420 | | * strip has just been read in. |
1421 | | */ |
1422 | | static int TIFFStartStrip(TIFF *tif, uint32_t strip) |
1423 | 0 | { |
1424 | 0 | TIFFDirectory *td = &tif->tif_dir; |
1425 | |
|
1426 | 0 | if ((tif->tif_flags & TIFF_CODERSETUP) == 0) |
1427 | 0 | { |
1428 | 0 | if (!(*tif->tif_setupdecode)(tif)) |
1429 | 0 | return (0); |
1430 | 0 | tif->tif_flags |= TIFF_CODERSETUP; |
1431 | 0 | } |
1432 | 0 | tif->tif_curstrip = strip; |
1433 | 0 | tif->tif_row = (strip % td->td_stripsperimage) * td->td_rowsperstrip; |
1434 | 0 | tif->tif_flags &= ~TIFF_BUF4WRITE; |
1435 | |
|
1436 | 0 | if (tif->tif_flags & TIFF_NOREADRAW) |
1437 | 0 | { |
1438 | 0 | tif->tif_rawcp = NULL; |
1439 | 0 | tif->tif_rawcc = 0; |
1440 | 0 | } |
1441 | 0 | else |
1442 | 0 | { |
1443 | 0 | tif->tif_rawcp = tif->tif_rawdata; |
1444 | 0 | if (tif->tif_rawdataloaded > 0) |
1445 | 0 | tif->tif_rawcc = tif->tif_rawdataloaded; |
1446 | 0 | else |
1447 | 0 | tif->tif_rawcc = (tmsize_t)TIFFGetStrileByteCount(tif, strip); |
1448 | 0 | } |
1449 | 0 | if ((*tif->tif_predecode)(tif, (uint16_t)(strip / td->td_stripsperimage)) == |
1450 | 0 | 0) |
1451 | 0 | { |
1452 | | /* Needed for example for scanline access, if tif_predecode */ |
1453 | | /* fails, and we try to read the same strip again. Without invalidating |
1454 | | */ |
1455 | | /* tif_curstrip, we'd call tif_decoderow() on a possibly invalid */ |
1456 | | /* codec state. */ |
1457 | 0 | tif->tif_curstrip = NOSTRIP; |
1458 | 0 | return 0; |
1459 | 0 | } |
1460 | 0 | return 1; |
1461 | 0 | } |
1462 | | |
1463 | | /* |
1464 | | * Set state to appear as if a |
1465 | | * tile has just been read in. |
1466 | | */ |
1467 | | static int TIFFStartTile(TIFF *tif, uint32_t tile) |
1468 | 0 | { |
1469 | 0 | static const char module[] = "TIFFStartTile"; |
1470 | 0 | TIFFDirectory *td = &tif->tif_dir; |
1471 | 0 | uint32_t howmany32; |
1472 | |
|
1473 | 0 | if ((tif->tif_flags & TIFF_CODERSETUP) == 0) |
1474 | 0 | { |
1475 | 0 | if (!(*tif->tif_setupdecode)(tif)) |
1476 | 0 | return (0); |
1477 | 0 | tif->tif_flags |= TIFF_CODERSETUP; |
1478 | 0 | } |
1479 | 0 | tif->tif_curtile = tile; |
1480 | 0 | if (td->td_tilewidth == 0) |
1481 | 0 | { |
1482 | 0 | TIFFErrorExtR(tif, module, "Zero tilewidth"); |
1483 | 0 | return 0; |
1484 | 0 | } |
1485 | 0 | howmany32 = TIFFhowmany_32(td->td_imagewidth, td->td_tilewidth); |
1486 | 0 | if (howmany32 == 0) |
1487 | 0 | { |
1488 | 0 | TIFFErrorExtR(tif, module, "Zero tiles"); |
1489 | 0 | return 0; |
1490 | 0 | } |
1491 | 0 | tif->tif_row = (tile % howmany32) * td->td_tilelength; |
1492 | 0 | howmany32 = TIFFhowmany_32(td->td_imagelength, td->td_tilelength); |
1493 | 0 | if (howmany32 == 0) |
1494 | 0 | { |
1495 | 0 | TIFFErrorExtR(tif, module, "Zero tiles"); |
1496 | 0 | return 0; |
1497 | 0 | } |
1498 | 0 | tif->tif_col = (tile % howmany32) * td->td_tilewidth; |
1499 | 0 | tif->tif_flags &= ~TIFF_BUF4WRITE; |
1500 | 0 | if (tif->tif_flags & TIFF_NOREADRAW) |
1501 | 0 | { |
1502 | 0 | tif->tif_rawcp = NULL; |
1503 | 0 | tif->tif_rawcc = 0; |
1504 | 0 | } |
1505 | 0 | else |
1506 | 0 | { |
1507 | 0 | tif->tif_rawcp = tif->tif_rawdata; |
1508 | 0 | if (tif->tif_rawdataloaded > 0) |
1509 | 0 | tif->tif_rawcc = tif->tif_rawdataloaded; |
1510 | 0 | else |
1511 | 0 | tif->tif_rawcc = (tmsize_t)TIFFGetStrileByteCount(tif, tile); |
1512 | 0 | } |
1513 | 0 | return ( |
1514 | 0 | (*tif->tif_predecode)(tif, (uint16_t)(tile / td->td_stripsperimage))); |
1515 | 0 | } |
1516 | | |
1517 | | static int TIFFCheckRead(TIFF *tif, int tiles) |
1518 | 0 | { |
1519 | 0 | if (tif->tif_mode == O_WRONLY) |
1520 | 0 | { |
1521 | 0 | TIFFErrorExtR(tif, tif->tif_name, "File not open for reading"); |
1522 | 0 | return (0); |
1523 | 0 | } |
1524 | 0 | if (tiles ^ isTiled(tif)) |
1525 | 0 | { |
1526 | 0 | TIFFErrorExtR(tif, tif->tif_name, |
1527 | 0 | tiles ? "Can not read tiles from a striped image" |
1528 | 0 | : "Can not read scanlines from a tiled image"); |
1529 | 0 | return (0); |
1530 | 0 | } |
1531 | 0 | return (1); |
1532 | 0 | } |
1533 | | |
1534 | | /* Use the provided input buffer (inbuf, insize) and decompress it into |
1535 | | * (outbuf, outsize). |
1536 | | * This function replaces the use of |
1537 | | * TIFFReadEncodedStrip()/TIFFReadEncodedTile() when the user can provide the |
1538 | | * buffer for the input data, for example when he wants to avoid libtiff to read |
1539 | | * the strile offset/count values from the [Strip|Tile][Offsets/ByteCounts] |
1540 | | * array. inbuf content must be writable (if bit reversal is needed) Returns 1 |
1541 | | * in case of success, 0 otherwise. |
1542 | | */ |
1543 | | int TIFFReadFromUserBuffer(TIFF *tif, uint32_t strile, void *inbuf, |
1544 | | tmsize_t insize, void *outbuf, tmsize_t outsize) |
1545 | 0 | { |
1546 | 0 | static const char module[] = "TIFFReadFromUserBuffer"; |
1547 | 0 | TIFFDirectory *td = &tif->tif_dir; |
1548 | 0 | int ret = 1; |
1549 | 0 | uint32_t old_tif_flags = tif->tif_flags; |
1550 | 0 | tmsize_t old_rawdatasize = tif->tif_rawdatasize; |
1551 | 0 | void *old_rawdata = tif->tif_rawdata; |
1552 | |
|
1553 | 0 | if (tif->tif_mode == O_WRONLY) |
1554 | 0 | { |
1555 | 0 | TIFFErrorExtR(tif, tif->tif_name, "File not open for reading"); |
1556 | 0 | return 0; |
1557 | 0 | } |
1558 | 0 | if (tif->tif_flags & TIFF_NOREADRAW) |
1559 | 0 | { |
1560 | 0 | TIFFErrorExtR(tif, module, |
1561 | 0 | "Compression scheme does not support access to raw " |
1562 | 0 | "uncompressed data"); |
1563 | 0 | return 0; |
1564 | 0 | } |
1565 | | |
1566 | 0 | tif->tif_flags &= ~TIFF_MYBUFFER; |
1567 | 0 | tif->tif_flags |= TIFF_BUFFERMMAP; |
1568 | 0 | tif->tif_rawdatasize = insize; |
1569 | 0 | tif->tif_rawdata = inbuf; |
1570 | 0 | tif->tif_rawdataoff = 0; |
1571 | 0 | tif->tif_rawdataloaded = insize; |
1572 | |
|
1573 | 0 | if (!isFillOrder(tif, td->td_fillorder) && |
1574 | 0 | (tif->tif_flags & TIFF_NOBITREV) == 0) |
1575 | 0 | { |
1576 | 0 | TIFFReverseBits(inbuf, insize); |
1577 | 0 | } |
1578 | |
|
1579 | 0 | if (TIFFIsTiled(tif)) |
1580 | 0 | { |
1581 | 0 | if (!TIFFStartTile(tif, strile)) |
1582 | 0 | { |
1583 | 0 | ret = 0; |
1584 | | /* See related TIFFReadEncodedStrip comment. */ |
1585 | 0 | if (outbuf) |
1586 | 0 | memset(outbuf, 0, (size_t)outsize); |
1587 | 0 | } |
1588 | 0 | else if (!(*tif->tif_decodetile)( |
1589 | 0 | tif, (uint8_t *)outbuf, outsize, |
1590 | 0 | (uint16_t)(strile / td->td_stripsperimage))) |
1591 | 0 | { |
1592 | 0 | ret = 0; |
1593 | 0 | } |
1594 | 0 | } |
1595 | 0 | else |
1596 | 0 | { |
1597 | 0 | uint32_t rowsperstrip = td->td_rowsperstrip; |
1598 | 0 | uint32_t stripsperplane; |
1599 | 0 | if (rowsperstrip > td->td_imagelength) |
1600 | 0 | rowsperstrip = td->td_imagelength; |
1601 | 0 | if (rowsperstrip == 0) |
1602 | 0 | { |
1603 | 0 | TIFFErrorExtR(tif, module, "rowsperstrip is zero"); |
1604 | 0 | ret = 0; |
1605 | 0 | } |
1606 | 0 | else |
1607 | 0 | { |
1608 | 0 | stripsperplane = |
1609 | 0 | TIFFhowmany_32_maxuint_compat(td->td_imagelength, rowsperstrip); |
1610 | 0 | if (!TIFFStartStrip(tif, strile)) |
1611 | 0 | { |
1612 | 0 | ret = 0; |
1613 | | /* See related TIFFReadEncodedStrip comment. */ |
1614 | 0 | if (outbuf) |
1615 | 0 | memset(outbuf, 0, (size_t)outsize); |
1616 | 0 | } |
1617 | 0 | else if (!(*tif->tif_decodestrip)( |
1618 | 0 | tif, (uint8_t *)outbuf, outsize, |
1619 | 0 | (uint16_t)(strile / stripsperplane))) |
1620 | 0 | { |
1621 | 0 | ret = 0; |
1622 | 0 | } |
1623 | 0 | } |
1624 | 0 | } |
1625 | 0 | if (ret) |
1626 | 0 | { |
1627 | 0 | (*tif->tif_postdecode)(tif, (uint8_t *)outbuf, outsize); |
1628 | 0 | } |
1629 | |
|
1630 | 0 | if (!isFillOrder(tif, td->td_fillorder) && |
1631 | 0 | (tif->tif_flags & TIFF_NOBITREV) == 0) |
1632 | 0 | { |
1633 | 0 | TIFFReverseBits(inbuf, insize); |
1634 | 0 | } |
1635 | |
|
1636 | 0 | tif->tif_flags = (old_tif_flags & (TIFF_MYBUFFER | TIFF_BUFFERMMAP)) | |
1637 | 0 | (tif->tif_flags & ~(TIFF_MYBUFFER | TIFF_BUFFERMMAP)); |
1638 | 0 | tif->tif_rawdatasize = old_rawdatasize; |
1639 | 0 | tif->tif_rawdata = old_rawdata; |
1640 | 0 | tif->tif_rawdataoff = 0; |
1641 | 0 | tif->tif_rawdataloaded = 0; |
1642 | |
|
1643 | 0 | return ret; |
1644 | 0 | } |
1645 | | |
1646 | | void _TIFFNoPostDecode(TIFF *tif, uint8_t *buf, tmsize_t cc) |
1647 | 0 | { |
1648 | 0 | (void)tif; |
1649 | 0 | (void)buf; |
1650 | 0 | (void)cc; |
1651 | 0 | } |
1652 | | |
1653 | | void _TIFFSwab16BitData(TIFF *tif, uint8_t *buf, tmsize_t cc) |
1654 | 0 | { |
1655 | 0 | (void)tif; |
1656 | 0 | assert((cc & 1) == 0); |
1657 | 0 | TIFFSwabArrayOfShort((uint16_t *)buf, cc / 2); |
1658 | 0 | } |
1659 | | |
1660 | | void _TIFFSwab24BitData(TIFF *tif, uint8_t *buf, tmsize_t cc) |
1661 | 0 | { |
1662 | 0 | (void)tif; |
1663 | 0 | assert((cc % 3) == 0); |
1664 | 0 | TIFFSwabArrayOfTriples((uint8_t *)buf, cc / 3); |
1665 | 0 | } |
1666 | | |
1667 | | void _TIFFSwab32BitData(TIFF *tif, uint8_t *buf, tmsize_t cc) |
1668 | 0 | { |
1669 | 0 | (void)tif; |
1670 | 0 | assert((cc & 3) == 0); |
1671 | 0 | TIFFSwabArrayOfLong((uint32_t *)buf, cc / 4); |
1672 | 0 | } |
1673 | | |
1674 | | void _TIFFSwab64BitData(TIFF *tif, uint8_t *buf, tmsize_t cc) |
1675 | 0 | { |
1676 | 0 | (void)tif; |
1677 | 0 | assert((cc & 7) == 0); |
1678 | 0 | TIFFSwabArrayOfDouble((double *)buf, cc / 8); |
1679 | 0 | } |