Coverage Report

Created: 2025-06-13 06:29

/src/gdal/frmts/gtiff/libtiff/tif_ojpeg.c
Line
Count
Source (jump to first uncovered line)
1
/* WARNING: The type of JPEG encapsulation defined by the TIFF Version 6.0
2
   specification is now totally obsolete and deprecated for new applications and
3
   images. This file was was created solely in order to read unconverted images
4
   still present on some users' computer systems. It will never be extended
5
   to write such files. Writing new-style JPEG compressed TIFFs is implemented
6
   in tif_jpeg.c.
7
8
   The code is carefully crafted to robustly read all gathered JPEG-in-TIFF
9
   testfiles, and anticipate as much as possible all other... But still, it may
10
   fail on some. If you encounter problems, please report them on the TIFF
11
   mailing list and/or to Joris Van Damme <info@awaresystems.be>.
12
13
   Please read the file called "TIFF Technical Note #2" if you need to be
14
   convinced this compression scheme is bad and breaks TIFF. That document
15
   is linked to from the LibTiff site <http://www.remotesensing.org/libtiff/>
16
   and from AWare Systems' TIFF section
17
   <http://www.awaresystems.be/imaging/tiff.html>. It is also absorbed
18
   in Adobe's specification supplements, marked "draft" up to this day, but
19
   supported by the TIFF community.
20
21
   This file interfaces with Release 6B of the JPEG Library written by the
22
   Independent JPEG Group. Previous versions of this file required a hack inside
23
   the LibJpeg library. This version no longer requires that. Remember to
24
   remove the hack if you update from the old version.
25
26
   Copyright (c) Joris Van Damme <info@awaresystems.be>
27
   Copyright (c) AWare Systems <http://www.awaresystems.be/>
28
29
   The licence agreement for this file is the same as the rest of the LibTiff
30
   library.
31
32
   IN NO EVENT SHALL JORIS VAN DAMME OR AWARE SYSTEMS BE LIABLE FOR
33
   ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND,
34
   OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
35
   WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF
36
   LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
37
   OF THIS SOFTWARE.
38
39
   Joris Van Damme and/or AWare Systems may be available for custom
40
   development. If you like what you see, and need anything similar or related,
41
   contact <info@awaresystems.be>.
42
*/
43
44
/* What is what, and what is not?
45
46
   This decoder starts with an input stream, that is essentially the
47
   JpegInterchangeFormat stream, if any, followed by the strile data, if any.
48
   This stream is read in OJPEGReadByte and related functions.
49
50
   It analyzes the start of this stream, until it encounters non-marker data,
51
   i.e. compressed image data. Some of the header markers it sees have no actual
52
   content, like the SOI marker, and APP/COM markers that really shouldn't even
53
   be there. Some other markers do have content, and the valuable bits and
54
   pieces of information in these markers are saved, checking all to verify that
55
   the stream is more or less within expected bounds. This happens inside the
56
   OJPEGReadHeaderInfoSecStreamXxx functions.
57
58
   Some OJPEG imagery contains no valid JPEG header markers. This situation is
59
   picked up on if we've seen no SOF marker when we're at the start of the
60
   compressed image data. In this case, the tables are read from JpegXxxTables
61
   tags, and the other bits and pieces of information is initialized to its most
62
   basic value. This is implemented in the OJPEGReadHeaderInfoSecTablesXxx
63
   functions.
64
65
   When this is complete, a good and valid JPEG header can be assembled, and
66
   this is passed through to LibJpeg. When that's done, the remainder of the
67
   input stream, i.e. the compressed image data, can be passed through
68
   unchanged. This is done in OJPEGWriteStream functions.
69
70
   LibTiff rightly expects to know the subsampling values before decompression.
71
   Just like in new-style JPEG-in-TIFF, though, or even more so, actually, the
72
   YCbCrsubsampling tag is notoriously unreliable. To correct these tag values
73
   with the ones inside the JPEG stream, the first part of the input stream is
74
   pre-scanned in OJPEGSubsamplingCorrect, making no note of any other data,
75
   reporting no warnings or errors, up to the point where either these values
76
   are read, or it's clear they aren't there. This means that some of the data
77
   is read twice, but we feel speed in correcting these values is important
78
   enough to warrant this sacrifice. Although there is currently no define or
79
   other configuration mechanism to disable this behavior, the actual header
80
   scanning is build to robustly respond with error report if it should
81
   encounter an uncorrected mismatch of subsampling values. See
82
   OJPEGReadHeaderInfoSecStreamSof.
83
84
   The restart interval and restart markers are the most tricky part... The
85
   restart interval can be specified in a tag. It can also be set inside the
86
   input JPEG stream. It can be used inside the input JPEG stream. If reading
87
   from strile data, we've consistently discovered the need to insert restart
88
   markers in between the different striles, as is also probably the most likely
89
   interpretation of the original TIFF 6.0 specification. With all this setting
90
   of interval, and actual use of markers that is not predictable at the time of
91
   valid JPEG header assembly, the restart thing may turn out the Achilles heel
92
   of this implementation. Fortunately, most OJPEG writer vendors succeed in
93
   reading back what they write, which may be the reason why we've been able to
94
   discover ways that seem to work.
95
96
   Some special provision is made for planarconfig separate OJPEG files. These
97
   seem to consistently contain header info, a SOS marker, a plane, SOS marker,
98
   plane, SOS, and plane. This may or may not be a valid JPEG configuration, we
99
   don't know and don't care. We want LibTiff to be able to access the planes
100
   individually, without huge buffering inside LibJpeg, anyway. So we compose
101
   headers to feed to LibJpeg, in this case, that allow us to pass a single
102
   plane such that LibJpeg sees a valid single-channel JPEG stream. Locating
103
   subsequent SOS markers, and thus subsequent planes, is done inside
104
   OJPEGReadSecondarySos.
105
106
   The benefit of the scheme is... that it works, basically. We know of no other
107
   that does. It works without checking software tag, or otherwise going about
108
   things in an OJPEG flavor specific manner. Instead, it is a single scheme,
109
   that covers the cases with and without JpegInterchangeFormat, with and
110
   without striles, with part of the header in JpegInterchangeFormat and
111
   remainder in first strile, etc. It is forgiving and robust, may likely work
112
   with OJPEG flavors we've not seen yet, and makes most out of the data.
113
114
   Another nice side-effect is that a complete JPEG single valid stream is build
115
   if planarconfig is not separate (vast majority). We may one day use that to
116
   build converters to JPEG, and/or to new-style JPEG compression inside TIFF.
117
118
   A disadvantage is the lack of random access to the individual striles. This
119
   is the reason for much of the complicated restart-and-position stuff inside
120
   OJPEGPreDecode. Applications would do well accessing all striles in order, as
121
   this will result in a single sequential scan of the input stream, and no
122
   restarting of LibJpeg decoding session.
123
*/
124
125
#define WIN32_LEAN_AND_MEAN
126
#define VC_EXTRALEAN
127
128
#include "tiffiop.h"
129
#ifdef OJPEG_SUPPORT
130
131
/* Configuration defines here are:
132
 * JPEG_ENCAP_EXTERNAL: The normal way to call libjpeg, uses longjump. In some
133
 * environments, like eg LibTiffDelphi, this is not possible. For this reason,
134
 * the actual calls to libjpeg, with longjump stuff, are encapsulated in
135
 * dedicated functions. When JPEG_ENCAP_EXTERNAL is defined, these encapsulating
136
 * functions are declared external to this unit, and can be defined elsewhere to
137
 * use stuff other then longjump. The default mode, without JPEG_ENCAP_EXTERNAL,
138
 * implements the call encapsulators here, internally, with normal longjump.
139
 * SETJMP, LONGJMP, JMP_BUF: On some machines/environments a longjump equivalent
140
 * is conveniently available, but still it may be worthwhile to use _setjmp or
141
 * sigsetjmp in place of plain setjmp. These macros will make it easier. It is
142
 * useless to fiddle with these if you define JPEG_ENCAP_EXTERNAL. OJPEG_BUFFER:
143
 * Define the size of the desired buffer here. Should be small enough so as to
144
 * guarantee instant processing, optimal streaming and optimal use of processor
145
 * cache, but also big enough so as to not result in significant call overhead.
146
 * It should be at least a few bytes to accommodate some structures (this is
147
 * verified in asserts), but it would not be sensible to make it this small
148
 * anyway, and it should be at most 64K since it is indexed with uint16_t. We
149
 * recommend 2K. EGYPTIANWALK: You could also define EGYPTIANWALK here, but it
150
 * is not used anywhere and has absolutely no effect. That is why most people
151
 * insist the EGYPTIANWALK is a bit silly.
152
 */
153
154
/* define LIBJPEG_ENCAP_EXTERNAL */
155
0
#define SETJMP(jbuf) setjmp(jbuf)
156
0
#define LONGJMP(jbuf, code) longjmp(jbuf, code)
157
#define JMP_BUF jmp_buf
158
0
#define OJPEG_BUFFER 2048
159
/* define EGYPTIANWALK */
160
161
0
#define JPEG_MARKER_SOF0 0xC0
162
0
#define JPEG_MARKER_SOF1 0xC1
163
0
#define JPEG_MARKER_SOF3 0xC3
164
0
#define JPEG_MARKER_DHT 0xC4
165
0
#define JPEG_MARKER_RST0 0XD0
166
0
#define JPEG_MARKER_SOI 0xD8
167
0
#define JPEG_MARKER_EOI 0xD9
168
0
#define JPEG_MARKER_SOS 0xDA
169
0
#define JPEG_MARKER_DQT 0xDB
170
0
#define JPEG_MARKER_DRI 0xDD
171
0
#define JPEG_MARKER_APP0 0xE0
172
0
#define JPEG_MARKER_COM 0xFE
173
174
#define FIELD_OJPEG_JPEGINTERCHANGEFORMAT (FIELD_CODEC + 0)
175
#define FIELD_OJPEG_JPEGINTERCHANGEFORMATLENGTH (FIELD_CODEC + 1)
176
#define FIELD_OJPEG_JPEGQTABLES (FIELD_CODEC + 2)
177
#define FIELD_OJPEG_JPEGDCTABLES (FIELD_CODEC + 3)
178
#define FIELD_OJPEG_JPEGACTABLES (FIELD_CODEC + 4)
179
#define FIELD_OJPEG_JPEGPROC (FIELD_CODEC + 5)
180
#define FIELD_OJPEG_JPEGRESTARTINTERVAL (FIELD_CODEC + 6)
181
182
static const TIFFField ojpegFields[] = {
183
    {TIFFTAG_JPEGIFOFFSET, 1, 1, TIFF_LONG8, 0, TIFF_SETGET_UINT64,
184
     FIELD_OJPEG_JPEGINTERCHANGEFORMAT, TRUE, FALSE, "JpegInterchangeFormat",
185
     NULL},
186
    {TIFFTAG_JPEGIFBYTECOUNT, 1, 1, TIFF_LONG8, 0, TIFF_SETGET_UINT64,
187
     FIELD_OJPEG_JPEGINTERCHANGEFORMATLENGTH, TRUE, FALSE,
188
     "JpegInterchangeFormatLength", NULL},
189
    {TIFFTAG_JPEGQTABLES, TIFF_VARIABLE2, TIFF_VARIABLE2, TIFF_LONG8, 0,
190
     TIFF_SETGET_C32_UINT64, FIELD_OJPEG_JPEGQTABLES, FALSE, TRUE,
191
     "JpegQTables", NULL},
192
    {TIFFTAG_JPEGDCTABLES, TIFF_VARIABLE2, TIFF_VARIABLE2, TIFF_LONG8, 0,
193
     TIFF_SETGET_C32_UINT64, FIELD_OJPEG_JPEGDCTABLES, FALSE, TRUE,
194
     "JpegDcTables", NULL},
195
    {TIFFTAG_JPEGACTABLES, TIFF_VARIABLE2, TIFF_VARIABLE2, TIFF_LONG8, 0,
196
     TIFF_SETGET_C32_UINT64, FIELD_OJPEG_JPEGACTABLES, FALSE, TRUE,
197
     "JpegAcTables", NULL},
198
    {TIFFTAG_JPEGPROC, 1, 1, TIFF_SHORT, 0, TIFF_SETGET_UINT16,
199
     FIELD_OJPEG_JPEGPROC, FALSE, FALSE, "JpegProc", NULL},
200
    {TIFFTAG_JPEGRESTARTINTERVAL, 1, 1, TIFF_SHORT, 0, TIFF_SETGET_UINT16,
201
     FIELD_OJPEG_JPEGRESTARTINTERVAL, FALSE, FALSE, "JpegRestartInterval",
202
     NULL},
203
};
204
205
#ifndef LIBJPEG_ENCAP_EXTERNAL
206
#include <setjmp.h>
207
#endif
208
209
#include "jerror.h"
210
#include "jpeglib.h"
211
212
#ifndef TIFF_jpeg_source_mgr_defined
213
#define TIFF_jpeg_source_mgr_defined
214
typedef struct jpeg_source_mgr jpeg_source_mgr;
215
#endif
216
217
#ifndef TIFF_jpeg_error_mgr_defined
218
#define TIFF_jpeg_error_mgr_defined
219
typedef struct jpeg_error_mgr jpeg_error_mgr;
220
#endif
221
222
typedef struct jpeg_common_struct jpeg_common_struct;
223
typedef struct jpeg_decompress_struct jpeg_decompress_struct;
224
225
typedef enum
226
{
227
    osibsNotSetYet,
228
    osibsJpegInterchangeFormat,
229
    osibsStrile,
230
    osibsEof
231
} OJPEGStateInBufferSource;
232
233
typedef enum
234
{
235
    ososSoi,
236
    ososQTable0,
237
    ososQTable1,
238
    ososQTable2,
239
    ososQTable3,
240
    ososDcTable0,
241
    ososDcTable1,
242
    ososDcTable2,
243
    ososDcTable3,
244
    ososAcTable0,
245
    ososAcTable1,
246
    ososAcTable2,
247
    ososAcTable3,
248
    ososDri,
249
    ososSof,
250
    ososSos,
251
    ososCompressed,
252
    ososRst,
253
    ososEoi
254
} OJPEGStateOutState;
255
256
typedef struct
257
{
258
    TIFF *tif;
259
    int decoder_ok;
260
    int error_in_raw_data_decoding;
261
#ifndef LIBJPEG_ENCAP_EXTERNAL
262
    JMP_BUF exit_jmpbuf;
263
#endif
264
    TIFFVGetMethod vgetparent;
265
    TIFFVSetMethod vsetparent;
266
    TIFFPrintMethod printdir;
267
    uint64_t file_size;
268
    uint32_t image_width;
269
    uint32_t image_length;
270
    uint32_t strile_width;
271
    uint32_t strile_length;
272
    uint32_t strile_length_total;
273
    uint8_t samples_per_pixel;
274
    uint8_t plane_sample_offset;
275
    uint8_t samples_per_pixel_per_plane;
276
    uint64_t jpeg_interchange_format;
277
    uint64_t jpeg_interchange_format_length;
278
    uint8_t jpeg_proc;
279
    uint8_t subsamplingcorrect;
280
    uint8_t subsamplingcorrect_done;
281
    uint8_t subsampling_tag;
282
    uint8_t subsampling_hor;
283
    uint8_t subsampling_ver;
284
    uint8_t subsampling_force_desubsampling_inside_decompression;
285
    uint8_t qtable_offset_count;
286
    uint8_t dctable_offset_count;
287
    uint8_t actable_offset_count;
288
    uint64_t qtable_offset[3];
289
    uint64_t dctable_offset[3];
290
    uint64_t actable_offset[3];
291
    uint8_t *qtable[4];
292
    uint8_t *dctable[4];
293
    uint8_t *actable[4];
294
    uint16_t restart_interval;
295
    uint8_t restart_index;
296
    uint8_t sof_log;
297
    uint8_t sof_marker_id;
298
    uint32_t sof_x;
299
    uint32_t sof_y;
300
    uint8_t sof_c[3];
301
    uint8_t sof_hv[3];
302
    uint8_t sof_tq[3];
303
    uint8_t sos_cs[3];
304
    uint8_t sos_tda[3];
305
    struct
306
    {
307
        uint8_t log;
308
        OJPEGStateInBufferSource in_buffer_source;
309
        uint32_t in_buffer_next_strile;
310
        uint64_t in_buffer_file_pos;
311
        uint64_t in_buffer_file_togo;
312
    } sos_end[3];
313
    uint8_t readheader_done;
314
    uint8_t writeheader_done;
315
    uint16_t write_cursample;
316
    uint32_t write_curstrile;
317
    uint8_t libjpeg_session_active;
318
    uint8_t libjpeg_jpeg_query_style;
319
    jpeg_error_mgr libjpeg_jpeg_error_mgr;
320
    jpeg_decompress_struct libjpeg_jpeg_decompress_struct;
321
    jpeg_source_mgr libjpeg_jpeg_source_mgr;
322
    uint8_t subsampling_convert_log;
323
    uint32_t subsampling_convert_ylinelen;
324
    uint32_t subsampling_convert_ylines;
325
    uint32_t subsampling_convert_clinelen;
326
    uint32_t subsampling_convert_clines;
327
    uint32_t subsampling_convert_ybuflen;
328
    uint32_t subsampling_convert_cbuflen;
329
    uint32_t subsampling_convert_ycbcrbuflen;
330
    uint8_t *subsampling_convert_ycbcrbuf;
331
    uint8_t *subsampling_convert_ybuf;
332
    uint8_t *subsampling_convert_cbbuf;
333
    uint8_t *subsampling_convert_crbuf;
334
    uint32_t subsampling_convert_ycbcrimagelen;
335
    uint8_t **subsampling_convert_ycbcrimage;
336
    uint32_t subsampling_convert_clinelenout;
337
    uint32_t subsampling_convert_state;
338
    uint32_t bytes_per_line;   /* if the codec outputs subsampled data, a 'line'
339
                                  in bytes_per_line */
340
    uint32_t lines_per_strile; /* and lines_per_strile means subsampling_ver
341
                                  desubsampled rows     */
342
    OJPEGStateInBufferSource in_buffer_source;
343
    uint32_t in_buffer_next_strile;
344
    uint32_t in_buffer_strile_count;
345
    uint64_t in_buffer_file_pos;
346
    uint8_t in_buffer_file_pos_log;
347
    uint64_t in_buffer_file_togo;
348
    uint16_t in_buffer_togo;
349
    uint8_t *in_buffer_cur;
350
    uint8_t in_buffer[OJPEG_BUFFER];
351
    OJPEGStateOutState out_state;
352
    uint8_t out_buffer[OJPEG_BUFFER];
353
    uint8_t *skip_buffer;
354
} OJPEGState;
355
356
static int OJPEGVGetField(TIFF *tif, uint32_t tag, va_list ap);
357
static int OJPEGVSetField(TIFF *tif, uint32_t tag, va_list ap);
358
static void OJPEGPrintDir(TIFF *tif, FILE *fd, long flags);
359
360
static int OJPEGFixupTags(TIFF *tif);
361
static int OJPEGSetupDecode(TIFF *tif);
362
static int OJPEGPreDecode(TIFF *tif, uint16_t s);
363
static int OJPEGPreDecodeSkipRaw(TIFF *tif);
364
static int OJPEGPreDecodeSkipScanlines(TIFF *tif);
365
static int OJPEGDecode(TIFF *tif, uint8_t *buf, tmsize_t cc, uint16_t s);
366
static int OJPEGDecodeRaw(TIFF *tif, uint8_t *buf, tmsize_t cc);
367
static int OJPEGDecodeScanlines(TIFF *tif, uint8_t *buf, tmsize_t cc);
368
static void OJPEGPostDecode(TIFF *tif, uint8_t *buf, tmsize_t cc);
369
static int OJPEGSetupEncode(TIFF *tif);
370
static int OJPEGPreEncode(TIFF *tif, uint16_t s);
371
static int OJPEGEncode(TIFF *tif, uint8_t *buf, tmsize_t cc, uint16_t s);
372
static int OJPEGPostEncode(TIFF *tif);
373
static void OJPEGCleanup(TIFF *tif);
374
375
static void OJPEGSubsamplingCorrect(TIFF *tif);
376
static int OJPEGReadHeaderInfo(TIFF *tif);
377
static int OJPEGReadSecondarySos(TIFF *tif, uint16_t s);
378
static int OJPEGWriteHeaderInfo(TIFF *tif);
379
static void OJPEGLibjpegSessionAbort(TIFF *tif);
380
381
static int OJPEGReadHeaderInfoSec(TIFF *tif);
382
static int OJPEGReadHeaderInfoSecStreamDri(TIFF *tif);
383
static int OJPEGReadHeaderInfoSecStreamDqt(TIFF *tif);
384
static int OJPEGReadHeaderInfoSecStreamDht(TIFF *tif);
385
static int OJPEGReadHeaderInfoSecStreamSof(TIFF *tif, uint8_t marker_id);
386
static int OJPEGReadHeaderInfoSecStreamSos(TIFF *tif);
387
static int OJPEGReadHeaderInfoSecTablesQTable(TIFF *tif);
388
static int OJPEGReadHeaderInfoSecTablesDcTable(TIFF *tif);
389
static int OJPEGReadHeaderInfoSecTablesAcTable(TIFF *tif);
390
391
static int OJPEGReadBufferFill(OJPEGState *sp);
392
static int OJPEGReadByte(OJPEGState *sp, uint8_t *byte);
393
static int OJPEGReadBytePeek(OJPEGState *sp, uint8_t *byte);
394
static void OJPEGReadByteAdvance(OJPEGState *sp);
395
static int OJPEGReadWord(OJPEGState *sp, uint16_t *word);
396
static int OJPEGReadBlock(OJPEGState *sp, uint16_t len, void *mem);
397
static void OJPEGReadSkip(OJPEGState *sp, uint16_t len);
398
399
static int OJPEGWriteStream(TIFF *tif, void **mem, uint32_t *len);
400
static void OJPEGWriteStreamSoi(TIFF *tif, void **mem, uint32_t *len);
401
static void OJPEGWriteStreamQTable(TIFF *tif, uint8_t table_index, void **mem,
402
                                   uint32_t *len);
403
static void OJPEGWriteStreamDcTable(TIFF *tif, uint8_t table_index, void **mem,
404
                                    uint32_t *len);
405
static void OJPEGWriteStreamAcTable(TIFF *tif, uint8_t table_index, void **mem,
406
                                    uint32_t *len);
407
static void OJPEGWriteStreamDri(TIFF *tif, void **mem, uint32_t *len);
408
static void OJPEGWriteStreamSof(TIFF *tif, void **mem, uint32_t *len);
409
static void OJPEGWriteStreamSos(TIFF *tif, void **mem, uint32_t *len);
410
static int OJPEGWriteStreamCompressed(TIFF *tif, void **mem, uint32_t *len);
411
static void OJPEGWriteStreamRst(TIFF *tif, void **mem, uint32_t *len);
412
static void OJPEGWriteStreamEoi(TIFF *tif, void **mem, uint32_t *len);
413
414
#ifdef LIBJPEG_ENCAP_EXTERNAL
415
extern int jpeg_create_decompress_encap(OJPEGState *sp,
416
                                        jpeg_decompress_struct *cinfo);
417
extern int jpeg_read_header_encap(OJPEGState *sp, jpeg_decompress_struct *cinfo,
418
                                  uint8_t require_image);
419
extern int jpeg_start_decompress_encap(OJPEGState *sp,
420
                                       jpeg_decompress_struct *cinfo);
421
extern int jpeg_read_scanlines_encap(OJPEGState *sp,
422
                                     jpeg_decompress_struct *cinfo,
423
                                     void *scanlines, uint32_t max_lines);
424
extern int jpeg_read_raw_data_encap(OJPEGState *sp,
425
                                    jpeg_decompress_struct *cinfo, void *data,
426
                                    uint32_t max_lines);
427
extern void jpeg_encap_unwind(TIFF *tif);
428
#else
429
static int jpeg_create_decompress_encap(OJPEGState *sp,
430
                                        jpeg_decompress_struct *j);
431
static int jpeg_read_header_encap(OJPEGState *sp, jpeg_decompress_struct *cinfo,
432
                                  uint8_t require_image);
433
static int jpeg_start_decompress_encap(OJPEGState *sp,
434
                                       jpeg_decompress_struct *cinfo);
435
static int jpeg_read_scanlines_encap(OJPEGState *sp,
436
                                     jpeg_decompress_struct *cinfo,
437
                                     void *scanlines, uint32_t max_lines);
438
static int jpeg_read_raw_data_encap(OJPEGState *sp,
439
                                    jpeg_decompress_struct *cinfo, void *data,
440
                                    uint32_t max_lines);
441
static void jpeg_encap_unwind(TIFF *tif);
442
#endif
443
444
static void OJPEGLibjpegJpegErrorMgrOutputMessage(jpeg_common_struct *cinfo);
445
static void OJPEGLibjpegJpegErrorMgrErrorExit(jpeg_common_struct *cinfo);
446
static void OJPEGLibjpegJpegSourceMgrInitSource(jpeg_decompress_struct *cinfo);
447
static boolean
448
OJPEGLibjpegJpegSourceMgrFillInputBuffer(jpeg_decompress_struct *cinfo);
449
static void
450
OJPEGLibjpegJpegSourceMgrSkipInputData(jpeg_decompress_struct *cinfo,
451
                                       long num_bytes);
452
static boolean
453
OJPEGLibjpegJpegSourceMgrResyncToRestart(jpeg_decompress_struct *cinfo,
454
                                         int desired);
455
static void OJPEGLibjpegJpegSourceMgrTermSource(jpeg_decompress_struct *cinfo);
456
457
int TIFFInitOJPEG(TIFF *tif, int scheme)
458
0
{
459
0
    static const char module[] = "TIFFInitOJPEG";
460
0
    OJPEGState *sp;
461
462
0
    (void)scheme;
463
0
    assert(scheme == COMPRESSION_OJPEG);
464
465
    /*
466
     * Merge codec-specific tag information.
467
     */
468
0
    if (!_TIFFMergeFields(tif, ojpegFields, TIFFArrayCount(ojpegFields)))
469
0
    {
470
0
        TIFFErrorExtR(tif, module,
471
0
                      "Merging Old JPEG codec-specific tags failed");
472
0
        return 0;
473
0
    }
474
475
    /* state block */
476
0
    sp = _TIFFmallocExt(tif, sizeof(OJPEGState));
477
0
    if (sp == NULL)
478
0
    {
479
0
        TIFFErrorExtR(tif, module, "No space for OJPEG state block");
480
0
        return (0);
481
0
    }
482
0
    _TIFFmemset(sp, 0, sizeof(OJPEGState));
483
0
    sp->tif = tif;
484
0
    sp->jpeg_proc = 1;
485
0
    sp->subsampling_hor = 2;
486
0
    sp->subsampling_ver = 2;
487
0
    TIFFSetField(tif, TIFFTAG_YCBCRSUBSAMPLING, 2, 2);
488
    /* tif codec methods */
489
0
    tif->tif_fixuptags = OJPEGFixupTags;
490
0
    tif->tif_setupdecode = OJPEGSetupDecode;
491
0
    tif->tif_predecode = OJPEGPreDecode;
492
0
    tif->tif_postdecode = OJPEGPostDecode;
493
0
    tif->tif_decoderow = OJPEGDecode;
494
0
    tif->tif_decodestrip = OJPEGDecode;
495
0
    tif->tif_decodetile = OJPEGDecode;
496
0
    tif->tif_setupencode = OJPEGSetupEncode;
497
0
    tif->tif_preencode = OJPEGPreEncode;
498
0
    tif->tif_postencode = OJPEGPostEncode;
499
0
    tif->tif_encoderow = OJPEGEncode;
500
0
    tif->tif_encodestrip = OJPEGEncode;
501
0
    tif->tif_encodetile = OJPEGEncode;
502
0
    tif->tif_cleanup = OJPEGCleanup;
503
0
    tif->tif_data = (uint8_t *)sp;
504
    /* tif tag methods */
505
0
    sp->vgetparent = tif->tif_tagmethods.vgetfield;
506
0
    tif->tif_tagmethods.vgetfield = OJPEGVGetField;
507
0
    sp->vsetparent = tif->tif_tagmethods.vsetfield;
508
0
    tif->tif_tagmethods.vsetfield = OJPEGVSetField;
509
0
    sp->printdir = tif->tif_tagmethods.printdir;
510
0
    tif->tif_tagmethods.printdir = OJPEGPrintDir;
511
    /* Some OJPEG files don't have strip or tile offsets or bytecounts tags.
512
       Some others do, but have totally meaningless or corrupt values
513
       in these tags. In these cases, the JpegInterchangeFormat stream is
514
       reliable. In any case, this decoder reads the compressed data itself,
515
       from the most reliable locations, and we need to notify encapsulating
516
       LibTiff not to read raw strips or tiles for us. */
517
0
    tif->tif_flags |= TIFF_NOREADRAW;
518
0
    return (1);
519
0
}
520
521
static int OJPEGVGetField(TIFF *tif, uint32_t tag, va_list ap)
522
0
{
523
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
524
0
    switch (tag)
525
0
    {
526
0
        case TIFFTAG_JPEGIFOFFSET:
527
0
            *va_arg(ap, uint64_t *) = (uint64_t)sp->jpeg_interchange_format;
528
0
            break;
529
0
        case TIFFTAG_JPEGIFBYTECOUNT:
530
0
            *va_arg(ap, uint64_t *) =
531
0
                (uint64_t)sp->jpeg_interchange_format_length;
532
0
            break;
533
0
        case TIFFTAG_YCBCRSUBSAMPLING:
534
0
            if (sp->subsamplingcorrect_done == 0)
535
0
                OJPEGSubsamplingCorrect(tif);
536
0
            *va_arg(ap, uint16_t *) = (uint16_t)sp->subsampling_hor;
537
0
            *va_arg(ap, uint16_t *) = (uint16_t)sp->subsampling_ver;
538
0
            break;
539
0
        case TIFFTAG_JPEGQTABLES:
540
0
            *va_arg(ap, uint32_t *) = (uint32_t)sp->qtable_offset_count;
541
0
            *va_arg(ap, const void **) = (const void *)sp->qtable_offset;
542
0
            break;
543
0
        case TIFFTAG_JPEGDCTABLES:
544
0
            *va_arg(ap, uint32_t *) = (uint32_t)sp->dctable_offset_count;
545
0
            *va_arg(ap, const void **) = (const void *)sp->dctable_offset;
546
0
            break;
547
0
        case TIFFTAG_JPEGACTABLES:
548
0
            *va_arg(ap, uint32_t *) = (uint32_t)sp->actable_offset_count;
549
0
            *va_arg(ap, const void **) = (const void *)sp->actable_offset;
550
0
            break;
551
0
        case TIFFTAG_JPEGPROC:
552
0
            *va_arg(ap, uint16_t *) = (uint16_t)sp->jpeg_proc;
553
0
            break;
554
0
        case TIFFTAG_JPEGRESTARTINTERVAL:
555
0
            *va_arg(ap, uint16_t *) = sp->restart_interval;
556
0
            break;
557
0
        default:
558
0
            return (*sp->vgetparent)(tif, tag, ap);
559
0
    }
560
0
    return (1);
561
0
}
562
563
static int OJPEGVSetField(TIFF *tif, uint32_t tag, va_list ap)
564
0
{
565
0
    static const char module[] = "OJPEGVSetField";
566
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
567
0
    uint32_t ma;
568
0
    uint64_t *mb;
569
0
    uint32_t n;
570
0
    const TIFFField *fip;
571
572
0
    switch (tag)
573
0
    {
574
0
        case TIFFTAG_JPEGIFOFFSET:
575
0
            sp->jpeg_interchange_format = (uint64_t)va_arg(ap, uint64_t);
576
0
            break;
577
0
        case TIFFTAG_JPEGIFBYTECOUNT:
578
0
            sp->jpeg_interchange_format_length = (uint64_t)va_arg(ap, uint64_t);
579
0
            break;
580
0
        case TIFFTAG_YCBCRSUBSAMPLING:
581
0
            sp->subsampling_tag = 1;
582
0
            sp->subsampling_hor = (uint8_t)va_arg(ap, uint16_vap);
583
0
            sp->subsampling_ver = (uint8_t)va_arg(ap, uint16_vap);
584
0
            tif->tif_dir.td_ycbcrsubsampling[0] = sp->subsampling_hor;
585
0
            tif->tif_dir.td_ycbcrsubsampling[1] = sp->subsampling_ver;
586
0
            break;
587
0
        case TIFFTAG_JPEGQTABLES:
588
0
            ma = (uint32_t)va_arg(ap, uint32_t);
589
0
            if (ma != 0)
590
0
            {
591
0
                if (ma > 3)
592
0
                {
593
0
                    TIFFErrorExtR(tif, module,
594
0
                                  "JpegQTables tag has incorrect count");
595
0
                    return (0);
596
0
                }
597
0
                sp->qtable_offset_count = (uint8_t)ma;
598
0
                mb = (uint64_t *)va_arg(ap, uint64_t *);
599
0
                for (n = 0; n < ma; n++)
600
0
                    sp->qtable_offset[n] = mb[n];
601
0
            }
602
0
            break;
603
0
        case TIFFTAG_JPEGDCTABLES:
604
0
            ma = (uint32_t)va_arg(ap, uint32_t);
605
0
            if (ma != 0)
606
0
            {
607
0
                if (ma > 3)
608
0
                {
609
0
                    TIFFErrorExtR(tif, module,
610
0
                                  "JpegDcTables tag has incorrect count");
611
0
                    return (0);
612
0
                }
613
0
                sp->dctable_offset_count = (uint8_t)ma;
614
0
                mb = (uint64_t *)va_arg(ap, uint64_t *);
615
0
                for (n = 0; n < ma; n++)
616
0
                    sp->dctable_offset[n] = mb[n];
617
0
            }
618
0
            break;
619
0
        case TIFFTAG_JPEGACTABLES:
620
0
            ma = (uint32_t)va_arg(ap, uint32_t);
621
0
            if (ma != 0)
622
0
            {
623
0
                if (ma > 3)
624
0
                {
625
0
                    TIFFErrorExtR(tif, module,
626
0
                                  "JpegAcTables tag has incorrect count");
627
0
                    return (0);
628
0
                }
629
0
                sp->actable_offset_count = (uint8_t)ma;
630
0
                mb = (uint64_t *)va_arg(ap, uint64_t *);
631
0
                for (n = 0; n < ma; n++)
632
0
                    sp->actable_offset[n] = mb[n];
633
0
            }
634
0
            break;
635
0
        case TIFFTAG_JPEGPROC:
636
0
            sp->jpeg_proc = (uint8_t)va_arg(ap, uint16_vap);
637
0
            break;
638
0
        case TIFFTAG_JPEGRESTARTINTERVAL:
639
0
            sp->restart_interval = (uint16_t)va_arg(ap, uint16_vap);
640
0
            break;
641
0
        default:
642
0
            return (*sp->vsetparent)(tif, tag, ap);
643
0
    }
644
0
    fip = TIFFFieldWithTag(tif, tag);
645
0
    if (fip == NULL) /* shouldn't happen */
646
0
        return (0);
647
0
    TIFFSetFieldBit(tif, fip->field_bit);
648
0
    tif->tif_flags |= TIFF_DIRTYDIRECT;
649
0
    return (1);
650
0
}
651
652
static void OJPEGPrintDir(TIFF *tif, FILE *fd, long flags)
653
0
{
654
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
655
0
    uint8_t m;
656
0
    (void)flags;
657
0
    assert(sp != NULL);
658
0
    if (TIFFFieldSet(tif, FIELD_OJPEG_JPEGINTERCHANGEFORMAT))
659
0
        fprintf(fd, "  JpegInterchangeFormat: %" PRIu64 "\n",
660
0
                (uint64_t)sp->jpeg_interchange_format);
661
0
    if (TIFFFieldSet(tif, FIELD_OJPEG_JPEGINTERCHANGEFORMATLENGTH))
662
0
        fprintf(fd, "  JpegInterchangeFormatLength: %" PRIu64 "\n",
663
0
                (uint64_t)sp->jpeg_interchange_format_length);
664
0
    if (TIFFFieldSet(tif, FIELD_OJPEG_JPEGQTABLES))
665
0
    {
666
0
        fprintf(fd, "  JpegQTables:");
667
0
        for (m = 0; m < sp->qtable_offset_count; m++)
668
0
            fprintf(fd, " %" PRIu64, (uint64_t)sp->qtable_offset[m]);
669
0
        fprintf(fd, "\n");
670
0
    }
671
0
    if (TIFFFieldSet(tif, FIELD_OJPEG_JPEGDCTABLES))
672
0
    {
673
0
        fprintf(fd, "  JpegDcTables:");
674
0
        for (m = 0; m < sp->dctable_offset_count; m++)
675
0
            fprintf(fd, " %" PRIu64, (uint64_t)sp->dctable_offset[m]);
676
0
        fprintf(fd, "\n");
677
0
    }
678
0
    if (TIFFFieldSet(tif, FIELD_OJPEG_JPEGACTABLES))
679
0
    {
680
0
        fprintf(fd, "  JpegAcTables:");
681
0
        for (m = 0; m < sp->actable_offset_count; m++)
682
0
            fprintf(fd, " %" PRIu64, (uint64_t)sp->actable_offset[m]);
683
0
        fprintf(fd, "\n");
684
0
    }
685
0
    if (TIFFFieldSet(tif, FIELD_OJPEG_JPEGPROC))
686
0
        fprintf(fd, "  JpegProc: %" PRIu8 "\n", sp->jpeg_proc);
687
0
    if (TIFFFieldSet(tif, FIELD_OJPEG_JPEGRESTARTINTERVAL))
688
0
        fprintf(fd, "  JpegRestartInterval: %" PRIu16 "\n",
689
0
                sp->restart_interval);
690
0
    if (sp->printdir)
691
0
        (*sp->printdir)(tif, fd, flags);
692
0
}
693
694
static int OJPEGFixupTags(TIFF *tif)
695
0
{
696
0
    (void)tif;
697
0
    return (1);
698
0
}
699
700
static int OJPEGSetupDecode(TIFF *tif)
701
0
{
702
0
    static const char module[] = "OJPEGSetupDecode";
703
0
    TIFFWarningExtR(tif, module,
704
0
                    "Deprecated and troublesome old-style JPEG compression "
705
0
                    "mode, please convert to new-style JPEG compression and "
706
0
                    "notify vendor of writing software");
707
0
    return (1);
708
0
}
709
710
static int OJPEGPreDecode(TIFF *tif, uint16_t s)
711
0
{
712
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
713
0
    uint32_t m;
714
0
    if (sp->subsamplingcorrect_done == 0)
715
0
        OJPEGSubsamplingCorrect(tif);
716
0
    if (sp->readheader_done == 0)
717
0
    {
718
0
        if (OJPEGReadHeaderInfo(tif) == 0)
719
0
            return (0);
720
0
    }
721
0
    if (sp->sos_end[s].log == 0)
722
0
    {
723
0
        if (OJPEGReadSecondarySos(tif, s) == 0)
724
0
            return (0);
725
0
    }
726
0
    if (isTiled(tif))
727
0
        m = tif->tif_curtile;
728
0
    else
729
0
        m = tif->tif_curstrip;
730
0
    if ((sp->writeheader_done != 0) &&
731
0
        ((sp->write_cursample != s) || (sp->write_curstrile > m)))
732
0
    {
733
0
        if (sp->libjpeg_session_active != 0)
734
0
            OJPEGLibjpegSessionAbort(tif);
735
0
        sp->writeheader_done = 0;
736
0
    }
737
0
    if (sp->writeheader_done == 0)
738
0
    {
739
0
        sp->plane_sample_offset = (uint8_t)s;
740
0
        sp->write_cursample = s;
741
0
        sp->write_curstrile = s * tif->tif_dir.td_stripsperimage;
742
0
        if ((sp->in_buffer_file_pos_log == 0) ||
743
0
            (sp->in_buffer_file_pos - sp->in_buffer_togo !=
744
0
             sp->sos_end[s].in_buffer_file_pos))
745
0
        {
746
0
            sp->in_buffer_source = sp->sos_end[s].in_buffer_source;
747
0
            sp->in_buffer_next_strile = sp->sos_end[s].in_buffer_next_strile;
748
0
            sp->in_buffer_file_pos = sp->sos_end[s].in_buffer_file_pos;
749
0
            sp->in_buffer_file_pos_log = 0;
750
0
            sp->in_buffer_file_togo = sp->sos_end[s].in_buffer_file_togo;
751
0
            sp->in_buffer_togo = 0;
752
0
            sp->in_buffer_cur = 0;
753
0
        }
754
0
        if (OJPEGWriteHeaderInfo(tif) == 0)
755
0
            return (0);
756
0
    }
757
758
0
    sp->subsampling_convert_state = 0;
759
760
0
    while (sp->write_curstrile < m)
761
0
    {
762
0
        if (sp->libjpeg_jpeg_query_style == 0)
763
0
        {
764
0
            if (OJPEGPreDecodeSkipRaw(tif) == 0)
765
0
                return (0);
766
0
        }
767
0
        else
768
0
        {
769
0
            if (OJPEGPreDecodeSkipScanlines(tif) == 0)
770
0
                return (0);
771
0
        }
772
0
        sp->write_curstrile++;
773
0
    }
774
0
    sp->decoder_ok = 1;
775
0
    return (1);
776
0
}
777
778
static int OJPEGPreDecodeSkipRaw(TIFF *tif)
779
0
{
780
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
781
0
    uint32_t m;
782
0
    m = sp->lines_per_strile;
783
0
    if (sp->subsampling_convert_state != 0)
784
0
    {
785
0
        if (sp->subsampling_convert_clines - sp->subsampling_convert_state >= m)
786
0
        {
787
0
            sp->subsampling_convert_state += m;
788
0
            if (sp->subsampling_convert_state == sp->subsampling_convert_clines)
789
0
                sp->subsampling_convert_state = 0;
790
0
            return (1);
791
0
        }
792
0
        m -= sp->subsampling_convert_clines - sp->subsampling_convert_state;
793
0
        sp->subsampling_convert_state = 0;
794
0
        sp->error_in_raw_data_decoding = 0;
795
0
    }
796
0
    while (m >= sp->subsampling_convert_clines)
797
0
    {
798
0
        if (jpeg_read_raw_data_encap(sp, &(sp->libjpeg_jpeg_decompress_struct),
799
0
                                     sp->subsampling_convert_ycbcrimage,
800
0
                                     sp->subsampling_ver * 8) == 0)
801
0
            return (0);
802
0
        m -= sp->subsampling_convert_clines;
803
0
    }
804
0
    if (m > 0)
805
0
    {
806
0
        if (jpeg_read_raw_data_encap(sp, &(sp->libjpeg_jpeg_decompress_struct),
807
0
                                     sp->subsampling_convert_ycbcrimage,
808
0
                                     sp->subsampling_ver * 8) == 0)
809
0
            return (0);
810
0
        sp->subsampling_convert_state = m;
811
0
    }
812
0
    return (1);
813
0
}
814
815
static int OJPEGPreDecodeSkipScanlines(TIFF *tif)
816
0
{
817
0
    static const char module[] = "OJPEGPreDecodeSkipScanlines";
818
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
819
0
    uint32_t m;
820
0
    if (sp->skip_buffer == NULL)
821
0
    {
822
0
        sp->skip_buffer = _TIFFmallocExt(tif, sp->bytes_per_line);
823
0
        if (sp->skip_buffer == NULL)
824
0
        {
825
0
            TIFFErrorExtR(tif, module, "Out of memory");
826
0
            return (0);
827
0
        }
828
0
    }
829
0
    for (m = 0; m < sp->lines_per_strile; m++)
830
0
    {
831
0
        if (jpeg_read_scanlines_encap(sp, &(sp->libjpeg_jpeg_decompress_struct),
832
0
                                      &sp->skip_buffer, 1) == 0)
833
0
            return (0);
834
0
    }
835
0
    return (1);
836
0
}
837
838
static int OJPEGDecode(TIFF *tif, uint8_t *buf, tmsize_t cc, uint16_t s)
839
0
{
840
0
    static const char module[] = "OJPEGDecode";
841
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
842
0
    (void)s;
843
0
    if (!sp->decoder_ok)
844
0
    {
845
0
        memset(buf, 0, (size_t)cc);
846
0
        TIFFErrorExtR(tif, module,
847
0
                      "Cannot decode: decoder not correctly initialized");
848
0
        return 0;
849
0
    }
850
0
    if (sp->libjpeg_session_active == 0)
851
0
    {
852
0
        memset(buf, 0, (size_t)cc);
853
        /* This should normally not happen, except that it does when */
854
        /* using TIFFReadScanline() which calls OJPEGPostDecode() for */
855
        /* each scanline, which assumes that a whole strile was read */
856
        /* and may thus incorrectly consider it has read the whole image,
857
         * causing */
858
        /* OJPEGLibjpegSessionAbort() to be called prematurely. */
859
        /* Triggered by https://gitlab.com/libtiff/libtiff/-/issues/337 */
860
0
        TIFFErrorExtR(tif, module,
861
0
                      "Cannot decode: libjpeg_session_active == 0");
862
0
        return 0;
863
0
    }
864
0
    if (sp->error_in_raw_data_decoding)
865
0
    {
866
0
        memset(buf, 0, (size_t)cc);
867
0
        return 0;
868
0
    }
869
0
    if (sp->libjpeg_jpeg_query_style == 0)
870
0
    {
871
0
        if (OJPEGDecodeRaw(tif, buf, cc) == 0)
872
0
        {
873
0
            memset(buf, 0, (size_t)cc);
874
0
            return (0);
875
0
        }
876
0
    }
877
0
    else
878
0
    {
879
0
        if (OJPEGDecodeScanlines(tif, buf, cc) == 0)
880
0
        {
881
0
            memset(buf, 0, (size_t)cc);
882
0
            return (0);
883
0
        }
884
0
    }
885
0
    return (1);
886
0
}
887
888
static int OJPEGDecodeRaw(TIFF *tif, uint8_t *buf, tmsize_t cc)
889
0
{
890
0
    static const char module[] = "OJPEGDecodeRaw";
891
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
892
0
    uint8_t *m;
893
0
    tmsize_t n;
894
0
    uint8_t *oy;
895
0
    uint8_t *ocb;
896
0
    uint8_t *ocr;
897
0
    uint8_t *p;
898
0
    uint32_t q;
899
0
    uint8_t *r;
900
0
    uint8_t sx, sy;
901
0
    if (cc % sp->bytes_per_line != 0)
902
0
    {
903
0
        TIFFErrorExtR(tif, module, "Fractional scanline not read");
904
0
        return (0);
905
0
    }
906
0
    assert(cc > 0);
907
0
    m = buf;
908
0
    n = cc;
909
0
    do
910
0
    {
911
0
        if (sp->subsampling_convert_state == 0)
912
0
        {
913
0
            if (jpeg_read_raw_data_encap(sp,
914
0
                                         &(sp->libjpeg_jpeg_decompress_struct),
915
0
                                         sp->subsampling_convert_ycbcrimage,
916
0
                                         sp->subsampling_ver * 8) == 0)
917
0
            {
918
0
                sp->error_in_raw_data_decoding = 1;
919
0
                return (0);
920
0
            }
921
0
        }
922
0
        oy = sp->subsampling_convert_ybuf +
923
0
             sp->subsampling_convert_state * sp->subsampling_ver *
924
0
                 sp->subsampling_convert_ylinelen;
925
0
        ocb = sp->subsampling_convert_cbbuf +
926
0
              sp->subsampling_convert_state * sp->subsampling_convert_clinelen;
927
0
        ocr = sp->subsampling_convert_crbuf +
928
0
              sp->subsampling_convert_state * sp->subsampling_convert_clinelen;
929
0
        p = m;
930
0
        for (q = 0; q < sp->subsampling_convert_clinelenout; q++)
931
0
        {
932
0
            r = oy;
933
0
            for (sy = 0; sy < sp->subsampling_ver; sy++)
934
0
            {
935
0
                for (sx = 0; sx < sp->subsampling_hor; sx++)
936
0
                    *p++ = *r++;
937
0
                r += sp->subsampling_convert_ylinelen - sp->subsampling_hor;
938
0
            }
939
0
            oy += sp->subsampling_hor;
940
0
            *p++ = *ocb++;
941
0
            *p++ = *ocr++;
942
0
        }
943
0
        sp->subsampling_convert_state++;
944
0
        if (sp->subsampling_convert_state == sp->subsampling_convert_clines)
945
0
            sp->subsampling_convert_state = 0;
946
0
        m += sp->bytes_per_line;
947
0
        n -= sp->bytes_per_line;
948
0
    } while (n > 0);
949
0
    return (1);
950
0
}
951
952
static int OJPEGDecodeScanlines(TIFF *tif, uint8_t *buf, tmsize_t cc)
953
0
{
954
0
    static const char module[] = "OJPEGDecodeScanlines";
955
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
956
0
    uint8_t *m;
957
0
    tmsize_t n;
958
0
    if (cc % sp->bytes_per_line != 0)
959
0
    {
960
0
        TIFFErrorExtR(tif, module, "Fractional scanline not read");
961
0
        return (0);
962
0
    }
963
0
    assert(cc > 0);
964
0
    m = buf;
965
0
    n = cc;
966
0
    do
967
0
    {
968
0
        if (jpeg_read_scanlines_encap(sp, &(sp->libjpeg_jpeg_decompress_struct),
969
0
                                      &m, 1) == 0)
970
0
            return (0);
971
0
        m += sp->bytes_per_line;
972
0
        n -= sp->bytes_per_line;
973
0
    } while (n > 0);
974
0
    return (1);
975
0
}
976
977
static void OJPEGPostDecode(TIFF *tif, uint8_t *buf, tmsize_t cc)
978
0
{
979
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
980
0
    (void)buf;
981
0
    (void)cc;
982
    /* This function somehow incorrectly assumes that a whole strile was read,
983
     */
984
    /* which is not true when TIFFReadScanline() is called, */
985
    /* and may thus incorrectly consider it has read the whole image, causing */
986
    /* OJPEGLibjpegSessionAbort() to be called prematurely. */
987
    /* So this logic should be fixed to take into account cc, or disable */
988
    /* the scan line reading interface. */
989
    /* Triggered by https://gitlab.com/libtiff/libtiff/-/issues/337 */
990
0
    sp->write_curstrile++;
991
0
    if (sp->write_curstrile % tif->tif_dir.td_stripsperimage == 0)
992
0
    {
993
0
        assert(sp->libjpeg_session_active != 0);
994
0
        OJPEGLibjpegSessionAbort(tif);
995
0
        sp->writeheader_done = 0;
996
0
    }
997
0
}
998
999
static int OJPEGSetupEncode(TIFF *tif)
1000
0
{
1001
0
    static const char module[] = "OJPEGSetupEncode";
1002
0
    TIFFErrorExtR(
1003
0
        tif, module,
1004
0
        "OJPEG encoding not supported; use new-style JPEG compression instead");
1005
0
    return (0);
1006
0
}
1007
1008
static int OJPEGPreEncode(TIFF *tif, uint16_t s)
1009
0
{
1010
0
    static const char module[] = "OJPEGPreEncode";
1011
0
    (void)s;
1012
0
    TIFFErrorExtR(
1013
0
        tif, module,
1014
0
        "OJPEG encoding not supported; use new-style JPEG compression instead");
1015
0
    return (0);
1016
0
}
1017
1018
static int OJPEGEncode(TIFF *tif, uint8_t *buf, tmsize_t cc, uint16_t s)
1019
0
{
1020
0
    static const char module[] = "OJPEGEncode";
1021
0
    (void)buf;
1022
0
    (void)cc;
1023
0
    (void)s;
1024
0
    TIFFErrorExtR(
1025
0
        tif, module,
1026
0
        "OJPEG encoding not supported; use new-style JPEG compression instead");
1027
0
    return (0);
1028
0
}
1029
1030
static int OJPEGPostEncode(TIFF *tif)
1031
0
{
1032
0
    static const char module[] = "OJPEGPostEncode";
1033
0
    TIFFErrorExtR(
1034
0
        tif, module,
1035
0
        "OJPEG encoding not supported; use new-style JPEG compression instead");
1036
0
    return (0);
1037
0
}
1038
1039
static void OJPEGCleanup(TIFF *tif)
1040
0
{
1041
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
1042
0
    if (sp != 0)
1043
0
    {
1044
0
        tif->tif_tagmethods.vgetfield = sp->vgetparent;
1045
0
        tif->tif_tagmethods.vsetfield = sp->vsetparent;
1046
0
        tif->tif_tagmethods.printdir = sp->printdir;
1047
0
        if (sp->qtable[0] != 0)
1048
0
            _TIFFfreeExt(tif, sp->qtable[0]);
1049
0
        if (sp->qtable[1] != 0)
1050
0
            _TIFFfreeExt(tif, sp->qtable[1]);
1051
0
        if (sp->qtable[2] != 0)
1052
0
            _TIFFfreeExt(tif, sp->qtable[2]);
1053
0
        if (sp->qtable[3] != 0)
1054
0
            _TIFFfreeExt(tif, sp->qtable[3]);
1055
0
        if (sp->dctable[0] != 0)
1056
0
            _TIFFfreeExt(tif, sp->dctable[0]);
1057
0
        if (sp->dctable[1] != 0)
1058
0
            _TIFFfreeExt(tif, sp->dctable[1]);
1059
0
        if (sp->dctable[2] != 0)
1060
0
            _TIFFfreeExt(tif, sp->dctable[2]);
1061
0
        if (sp->dctable[3] != 0)
1062
0
            _TIFFfreeExt(tif, sp->dctable[3]);
1063
0
        if (sp->actable[0] != 0)
1064
0
            _TIFFfreeExt(tif, sp->actable[0]);
1065
0
        if (sp->actable[1] != 0)
1066
0
            _TIFFfreeExt(tif, sp->actable[1]);
1067
0
        if (sp->actable[2] != 0)
1068
0
            _TIFFfreeExt(tif, sp->actable[2]);
1069
0
        if (sp->actable[3] != 0)
1070
0
            _TIFFfreeExt(tif, sp->actable[3]);
1071
0
        if (sp->libjpeg_session_active != 0)
1072
0
            OJPEGLibjpegSessionAbort(tif);
1073
0
        if (sp->subsampling_convert_ycbcrbuf != 0)
1074
0
            _TIFFfreeExt(tif, sp->subsampling_convert_ycbcrbuf);
1075
0
        if (sp->subsampling_convert_ycbcrimage != 0)
1076
0
            _TIFFfreeExt(tif, sp->subsampling_convert_ycbcrimage);
1077
0
        if (sp->skip_buffer != 0)
1078
0
            _TIFFfreeExt(tif, sp->skip_buffer);
1079
0
        _TIFFfreeExt(tif, sp);
1080
0
        tif->tif_data = NULL;
1081
0
        _TIFFSetDefaultCompressionState(tif);
1082
0
    }
1083
0
}
1084
1085
static void OJPEGSubsamplingCorrect(TIFF *tif)
1086
0
{
1087
0
    static const char module[] = "OJPEGSubsamplingCorrect";
1088
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
1089
0
    uint8_t mh;
1090
0
    uint8_t mv;
1091
1092
0
    assert(sp->subsamplingcorrect_done == 0);
1093
0
    if ((tif->tif_dir.td_samplesperpixel != 3) ||
1094
0
        ((tif->tif_dir.td_photometric != PHOTOMETRIC_YCBCR) &&
1095
0
         (tif->tif_dir.td_photometric != PHOTOMETRIC_ITULAB)))
1096
0
    {
1097
0
        if (sp->subsampling_tag != 0)
1098
0
            TIFFWarningExtR(tif, module,
1099
0
                            "Subsampling tag not appropriate for this "
1100
0
                            "Photometric and/or SamplesPerPixel");
1101
0
        sp->subsampling_hor = 1;
1102
0
        sp->subsampling_ver = 1;
1103
0
        sp->subsampling_force_desubsampling_inside_decompression = 0;
1104
0
    }
1105
0
    else
1106
0
    {
1107
0
        sp->subsamplingcorrect_done = 1;
1108
0
        mh = sp->subsampling_hor;
1109
0
        mv = sp->subsampling_ver;
1110
0
        sp->subsamplingcorrect = 1;
1111
0
        OJPEGReadHeaderInfoSec(tif);
1112
0
        if (sp->subsampling_force_desubsampling_inside_decompression != 0)
1113
0
        {
1114
0
            sp->subsampling_hor = 1;
1115
0
            sp->subsampling_ver = 1;
1116
0
        }
1117
0
        sp->subsamplingcorrect = 0;
1118
0
        if (((sp->subsampling_hor != mh) || (sp->subsampling_ver != mv)) &&
1119
0
            (sp->subsampling_force_desubsampling_inside_decompression == 0))
1120
0
        {
1121
0
            if (sp->subsampling_tag == 0)
1122
0
                TIFFWarningExtR(
1123
0
                    tif, module,
1124
0
                    "Subsampling tag is not set, yet subsampling inside JPEG "
1125
0
                    "data [%" PRIu8 ",%" PRIu8
1126
0
                    "] does not match default values [2,2]; assuming "
1127
0
                    "subsampling inside JPEG data is correct",
1128
0
                    sp->subsampling_hor, sp->subsampling_ver);
1129
0
            else
1130
0
                TIFFWarningExtR(
1131
0
                    tif, module,
1132
0
                    "Subsampling inside JPEG data [%" PRIu8 ",%" PRIu8
1133
0
                    "] does not match subsampling tag values [%" PRIu8
1134
0
                    ",%" PRIu8
1135
0
                    "]; assuming subsampling inside JPEG data is correct",
1136
0
                    sp->subsampling_hor, sp->subsampling_ver, mh, mv);
1137
0
        }
1138
0
        if (sp->subsampling_force_desubsampling_inside_decompression != 0)
1139
0
        {
1140
0
            if (sp->subsampling_tag == 0)
1141
0
                TIFFWarningExtR(
1142
0
                    tif, module,
1143
0
                    "Subsampling tag is not set, yet subsampling inside JPEG "
1144
0
                    "data does not match default values [2,2] (nor any other "
1145
0
                    "values allowed in TIFF); assuming subsampling inside JPEG "
1146
0
                    "data is correct and desubsampling inside JPEG "
1147
0
                    "decompression");
1148
0
            else
1149
0
                TIFFWarningExtR(
1150
0
                    tif, module,
1151
0
                    "Subsampling inside JPEG data does not match subsampling "
1152
0
                    "tag values [%" PRIu8 ",%" PRIu8
1153
0
                    "] (nor any other values allowed in TIFF); assuming "
1154
0
                    "subsampling inside JPEG data is correct and desubsampling "
1155
0
                    "inside JPEG decompression",
1156
0
                    mh, mv);
1157
0
        }
1158
0
        if (sp->subsampling_force_desubsampling_inside_decompression == 0)
1159
0
        {
1160
0
            if (sp->subsampling_hor < sp->subsampling_ver)
1161
0
                TIFFWarningExtR(tif, module,
1162
0
                                "Subsampling values [%" PRIu8 ",%" PRIu8
1163
0
                                "] are not allowed in TIFF",
1164
0
                                sp->subsampling_hor, sp->subsampling_ver);
1165
0
        }
1166
0
    }
1167
0
    sp->subsamplingcorrect_done = 1;
1168
0
}
1169
1170
static int OJPEGReadHeaderInfo(TIFF *tif)
1171
0
{
1172
0
    static const char module[] = "OJPEGReadHeaderInfo";
1173
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
1174
0
    assert(sp->readheader_done == 0);
1175
0
    sp->image_width = tif->tif_dir.td_imagewidth;
1176
0
    sp->image_length = tif->tif_dir.td_imagelength;
1177
0
    if (isTiled(tif))
1178
0
    {
1179
0
        sp->strile_width = tif->tif_dir.td_tilewidth;
1180
0
        sp->strile_length = tif->tif_dir.td_tilelength;
1181
0
        sp->strile_length_total =
1182
0
            ((sp->image_length + sp->strile_length - 1) / sp->strile_length) *
1183
0
            sp->strile_length;
1184
0
    }
1185
0
    else
1186
0
    {
1187
0
        sp->strile_width = sp->image_width;
1188
0
        sp->strile_length = tif->tif_dir.td_rowsperstrip;
1189
0
        if (sp->strile_length == (uint32_t)-1)
1190
0
            sp->strile_length = sp->image_length;
1191
0
        sp->strile_length_total = sp->image_length;
1192
0
    }
1193
0
    if (tif->tif_dir.td_samplesperpixel == 1)
1194
0
    {
1195
0
        sp->samples_per_pixel = 1;
1196
0
        sp->plane_sample_offset = 0;
1197
0
        sp->samples_per_pixel_per_plane = sp->samples_per_pixel;
1198
0
        sp->subsampling_hor = 1;
1199
0
        sp->subsampling_ver = 1;
1200
0
    }
1201
0
    else
1202
0
    {
1203
0
        if (tif->tif_dir.td_samplesperpixel != 3)
1204
0
        {
1205
0
            TIFFErrorExtR(tif, module,
1206
0
                          "SamplesPerPixel %" PRIu8
1207
0
                          " not supported for this compression scheme",
1208
0
                          sp->samples_per_pixel);
1209
0
            return (0);
1210
0
        }
1211
0
        sp->samples_per_pixel = 3;
1212
0
        sp->plane_sample_offset = 0;
1213
0
        if (tif->tif_dir.td_planarconfig == PLANARCONFIG_CONTIG)
1214
0
            sp->samples_per_pixel_per_plane = 3;
1215
0
        else
1216
0
            sp->samples_per_pixel_per_plane = 1;
1217
0
    }
1218
0
    if (sp->strile_length < sp->image_length)
1219
0
    {
1220
0
        if (((sp->subsampling_hor != 1) && (sp->subsampling_hor != 2) &&
1221
0
             (sp->subsampling_hor != 4)) ||
1222
0
            ((sp->subsampling_ver != 1) && (sp->subsampling_ver != 2) &&
1223
0
             (sp->subsampling_ver != 4)))
1224
0
        {
1225
0
            TIFFErrorExtR(tif, module, "Invalid subsampling values");
1226
0
            return (0);
1227
0
        }
1228
0
        if (sp->strile_length % (sp->subsampling_ver * 8) != 0)
1229
0
        {
1230
0
            TIFFErrorExtR(tif, module,
1231
0
                          "Incompatible vertical subsampling and image "
1232
0
                          "strip/tile length");
1233
0
            return (0);
1234
0
        }
1235
0
        sp->restart_interval =
1236
0
            (uint16_t)(((sp->strile_width + sp->subsampling_hor * 8 - 1) /
1237
0
                        (sp->subsampling_hor * 8)) *
1238
0
                       (sp->strile_length / (sp->subsampling_ver * 8)));
1239
0
    }
1240
0
    if (OJPEGReadHeaderInfoSec(tif) == 0)
1241
0
        return (0);
1242
0
    sp->sos_end[0].log = 1;
1243
0
    sp->sos_end[0].in_buffer_source = sp->in_buffer_source;
1244
0
    sp->sos_end[0].in_buffer_next_strile = sp->in_buffer_next_strile;
1245
0
    sp->sos_end[0].in_buffer_file_pos =
1246
0
        sp->in_buffer_file_pos - sp->in_buffer_togo;
1247
0
    sp->sos_end[0].in_buffer_file_togo =
1248
0
        sp->in_buffer_file_togo + sp->in_buffer_togo;
1249
0
    sp->readheader_done = 1;
1250
0
    return (1);
1251
0
}
1252
1253
static int OJPEGReadSecondarySos(TIFF *tif, uint16_t s)
1254
0
{
1255
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
1256
0
    uint8_t m;
1257
0
    assert(s > 0);
1258
0
    assert(s < 3);
1259
0
    assert(sp->sos_end[0].log != 0);
1260
0
    assert(sp->sos_end[s].log == 0);
1261
0
    sp->plane_sample_offset = (uint8_t)(s - 1);
1262
0
    while (sp->sos_end[sp->plane_sample_offset].log == 0)
1263
0
        sp->plane_sample_offset--;
1264
0
    sp->in_buffer_source =
1265
0
        sp->sos_end[sp->plane_sample_offset].in_buffer_source;
1266
0
    sp->in_buffer_next_strile =
1267
0
        sp->sos_end[sp->plane_sample_offset].in_buffer_next_strile;
1268
0
    sp->in_buffer_file_pos =
1269
0
        sp->sos_end[sp->plane_sample_offset].in_buffer_file_pos;
1270
0
    sp->in_buffer_file_pos_log = 0;
1271
0
    sp->in_buffer_file_togo =
1272
0
        sp->sos_end[sp->plane_sample_offset].in_buffer_file_togo;
1273
0
    sp->in_buffer_togo = 0;
1274
0
    sp->in_buffer_cur = 0;
1275
0
    while (sp->plane_sample_offset < s)
1276
0
    {
1277
0
        do
1278
0
        {
1279
0
            if (OJPEGReadByte(sp, &m) == 0)
1280
0
                return (0);
1281
0
            if (m == 255)
1282
0
            {
1283
0
                do
1284
0
                {
1285
0
                    if (OJPEGReadByte(sp, &m) == 0)
1286
0
                        return (0);
1287
0
                    if (m != 255)
1288
0
                        break;
1289
0
                } while (1);
1290
0
                if (m == JPEG_MARKER_SOS)
1291
0
                    break;
1292
0
            }
1293
0
        } while (1);
1294
0
        sp->plane_sample_offset++;
1295
0
        if (OJPEGReadHeaderInfoSecStreamSos(tif) == 0)
1296
0
            return (0);
1297
0
        sp->sos_end[sp->plane_sample_offset].log = 1;
1298
0
        sp->sos_end[sp->plane_sample_offset].in_buffer_source =
1299
0
            sp->in_buffer_source;
1300
0
        sp->sos_end[sp->plane_sample_offset].in_buffer_next_strile =
1301
0
            sp->in_buffer_next_strile;
1302
0
        sp->sos_end[sp->plane_sample_offset].in_buffer_file_pos =
1303
0
            sp->in_buffer_file_pos - sp->in_buffer_togo;
1304
0
        sp->sos_end[sp->plane_sample_offset].in_buffer_file_togo =
1305
0
            sp->in_buffer_file_togo + sp->in_buffer_togo;
1306
0
    }
1307
0
    return (1);
1308
0
}
1309
1310
static int OJPEGWriteHeaderInfo(TIFF *tif)
1311
0
{
1312
0
    static const char module[] = "OJPEGWriteHeaderInfo";
1313
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
1314
0
    uint8_t **m;
1315
0
    uint32_t n;
1316
    /* if a previous attempt failed, don't try again */
1317
0
    if (sp->libjpeg_session_active != 0)
1318
0
        return 0;
1319
0
    sp->out_state = ososSoi;
1320
0
    sp->restart_index = 0;
1321
0
    jpeg_std_error(&(sp->libjpeg_jpeg_error_mgr));
1322
0
    sp->libjpeg_jpeg_error_mgr.output_message =
1323
0
        OJPEGLibjpegJpegErrorMgrOutputMessage;
1324
0
    sp->libjpeg_jpeg_error_mgr.error_exit = OJPEGLibjpegJpegErrorMgrErrorExit;
1325
0
    sp->libjpeg_jpeg_decompress_struct.err = &(sp->libjpeg_jpeg_error_mgr);
1326
0
    sp->libjpeg_jpeg_decompress_struct.client_data = (void *)tif;
1327
0
    if (jpeg_create_decompress_encap(
1328
0
            sp, &(sp->libjpeg_jpeg_decompress_struct)) == 0)
1329
0
        return (0);
1330
0
    sp->libjpeg_session_active = 1;
1331
0
    sp->libjpeg_jpeg_source_mgr.bytes_in_buffer = 0;
1332
0
    sp->libjpeg_jpeg_source_mgr.init_source =
1333
0
        OJPEGLibjpegJpegSourceMgrInitSource;
1334
0
    sp->libjpeg_jpeg_source_mgr.fill_input_buffer =
1335
0
        OJPEGLibjpegJpegSourceMgrFillInputBuffer;
1336
0
    sp->libjpeg_jpeg_source_mgr.skip_input_data =
1337
0
        OJPEGLibjpegJpegSourceMgrSkipInputData;
1338
0
    sp->libjpeg_jpeg_source_mgr.resync_to_restart =
1339
0
        OJPEGLibjpegJpegSourceMgrResyncToRestart;
1340
0
    sp->libjpeg_jpeg_source_mgr.term_source =
1341
0
        OJPEGLibjpegJpegSourceMgrTermSource;
1342
0
    sp->libjpeg_jpeg_decompress_struct.src = &(sp->libjpeg_jpeg_source_mgr);
1343
0
    if (jpeg_read_header_encap(sp, &(sp->libjpeg_jpeg_decompress_struct), 1) ==
1344
0
        0)
1345
0
        return (0);
1346
0
    if ((sp->subsampling_force_desubsampling_inside_decompression == 0) &&
1347
0
        (sp->samples_per_pixel_per_plane > 1))
1348
0
    {
1349
0
        sp->libjpeg_jpeg_decompress_struct.raw_data_out = 1;
1350
0
#if JPEG_LIB_VERSION >= 70
1351
0
        sp->libjpeg_jpeg_decompress_struct.do_fancy_upsampling = FALSE;
1352
0
#endif
1353
0
        sp->libjpeg_jpeg_query_style = 0;
1354
0
        if (sp->subsampling_convert_log == 0)
1355
0
        {
1356
0
            assert(sp->subsampling_convert_ycbcrbuf == 0);
1357
0
            assert(sp->subsampling_convert_ycbcrimage == 0);
1358
            /* Check for division by zero. */
1359
0
            if (sp->subsampling_hor == 0 || sp->subsampling_ver == 0)
1360
0
                return (0);
1361
0
            sp->subsampling_convert_ylinelen =
1362
0
                ((sp->strile_width + sp->subsampling_hor * 8 - 1) /
1363
0
                 (sp->subsampling_hor * 8) * sp->subsampling_hor * 8);
1364
0
            sp->subsampling_convert_ylines = sp->subsampling_ver * 8;
1365
0
            sp->subsampling_convert_clinelen =
1366
0
                sp->subsampling_convert_ylinelen / sp->subsampling_hor;
1367
0
            sp->subsampling_convert_clines = 8;
1368
0
            sp->subsampling_convert_ybuflen = sp->subsampling_convert_ylinelen *
1369
0
                                              sp->subsampling_convert_ylines;
1370
0
            sp->subsampling_convert_cbuflen = sp->subsampling_convert_clinelen *
1371
0
                                              sp->subsampling_convert_clines;
1372
0
            sp->subsampling_convert_ycbcrbuflen =
1373
0
                sp->subsampling_convert_ybuflen +
1374
0
                2 * sp->subsampling_convert_cbuflen;
1375
            /* The calloc is not normally necessary, except in some edge/broken
1376
             * cases */
1377
            /* for example for a tiled image of height 1 with a tile height of 1
1378
             * and subsampling_hor=subsampling_ver=2 */
1379
            /* In that case, libjpeg will only fill the 8 first lines of the 16
1380
             * lines */
1381
            /* See https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16844
1382
             */
1383
            /* Even if this case is allowed (?), its handling is broken because
1384
             * OJPEGPreDecode() should also likely */
1385
            /* reset subsampling_convert_state to 0 when changing tile. */
1386
0
            sp->subsampling_convert_ycbcrbuf =
1387
0
                _TIFFcallocExt(tif, 1, sp->subsampling_convert_ycbcrbuflen);
1388
0
            if (sp->subsampling_convert_ycbcrbuf == 0)
1389
0
            {
1390
0
                TIFFErrorExtR(tif, module, "Out of memory");
1391
0
                return (0);
1392
0
            }
1393
0
            sp->subsampling_convert_ybuf = sp->subsampling_convert_ycbcrbuf;
1394
0
            sp->subsampling_convert_cbbuf =
1395
0
                sp->subsampling_convert_ybuf + sp->subsampling_convert_ybuflen;
1396
0
            sp->subsampling_convert_crbuf =
1397
0
                sp->subsampling_convert_cbbuf + sp->subsampling_convert_cbuflen;
1398
0
            sp->subsampling_convert_ycbcrimagelen =
1399
0
                3 + sp->subsampling_convert_ylines +
1400
0
                2 * sp->subsampling_convert_clines;
1401
0
            sp->subsampling_convert_ycbcrimage = _TIFFmallocExt(
1402
0
                tif, sp->subsampling_convert_ycbcrimagelen * sizeof(uint8_t *));
1403
0
            if (sp->subsampling_convert_ycbcrimage == 0)
1404
0
            {
1405
0
                TIFFErrorExtR(tif, module, "Out of memory");
1406
0
                return (0);
1407
0
            }
1408
0
            m = sp->subsampling_convert_ycbcrimage;
1409
0
            *m++ = (uint8_t *)(sp->subsampling_convert_ycbcrimage + 3);
1410
0
            *m++ = (uint8_t *)(sp->subsampling_convert_ycbcrimage + 3 +
1411
0
                               sp->subsampling_convert_ylines);
1412
0
            *m++ = (uint8_t *)(sp->subsampling_convert_ycbcrimage + 3 +
1413
0
                               sp->subsampling_convert_ylines +
1414
0
                               sp->subsampling_convert_clines);
1415
0
            for (n = 0; n < sp->subsampling_convert_ylines; n++)
1416
0
                *m++ = sp->subsampling_convert_ybuf +
1417
0
                       n * sp->subsampling_convert_ylinelen;
1418
0
            for (n = 0; n < sp->subsampling_convert_clines; n++)
1419
0
                *m++ = sp->subsampling_convert_cbbuf +
1420
0
                       n * sp->subsampling_convert_clinelen;
1421
0
            for (n = 0; n < sp->subsampling_convert_clines; n++)
1422
0
                *m++ = sp->subsampling_convert_crbuf +
1423
0
                       n * sp->subsampling_convert_clinelen;
1424
0
            sp->subsampling_convert_clinelenout =
1425
0
                sp->strile_width / sp->subsampling_hor +
1426
0
                ((sp->strile_width % sp->subsampling_hor) != 0 ? 1 : 0);
1427
0
            sp->subsampling_convert_state = 0;
1428
0
            sp->error_in_raw_data_decoding = 0;
1429
0
            sp->bytes_per_line =
1430
0
                sp->subsampling_convert_clinelenout *
1431
0
                (sp->subsampling_ver * sp->subsampling_hor + 2);
1432
0
            sp->lines_per_strile =
1433
0
                sp->strile_length / sp->subsampling_ver +
1434
0
                ((sp->strile_length % sp->subsampling_ver) != 0 ? 1 : 0);
1435
0
            sp->subsampling_convert_log = 1;
1436
0
        }
1437
0
    }
1438
0
    else
1439
0
    {
1440
0
        sp->libjpeg_jpeg_decompress_struct.jpeg_color_space = JCS_UNKNOWN;
1441
0
        sp->libjpeg_jpeg_decompress_struct.out_color_space = JCS_UNKNOWN;
1442
0
        sp->libjpeg_jpeg_query_style = 1;
1443
0
        sp->bytes_per_line = sp->samples_per_pixel_per_plane * sp->strile_width;
1444
0
        sp->lines_per_strile = sp->strile_length;
1445
0
    }
1446
0
    if (jpeg_start_decompress_encap(sp,
1447
0
                                    &(sp->libjpeg_jpeg_decompress_struct)) == 0)
1448
0
        return (0);
1449
0
    if (sp->libjpeg_jpeg_decompress_struct.image_width != sp->strile_width)
1450
0
    {
1451
0
        TIFFErrorExtR(tif, module,
1452
0
                      "jpeg_start_decompress() returned image_width = %u, "
1453
0
                      "expected %" PRIu32,
1454
0
                      sp->libjpeg_jpeg_decompress_struct.image_width,
1455
0
                      sp->strile_width);
1456
0
        return 0;
1457
0
    }
1458
0
    if (sp->libjpeg_jpeg_decompress_struct.max_h_samp_factor !=
1459
0
            sp->subsampling_hor ||
1460
0
        sp->libjpeg_jpeg_decompress_struct.max_v_samp_factor !=
1461
0
            sp->subsampling_ver)
1462
0
    {
1463
0
        TIFFErrorExtR(tif, module,
1464
0
                      "jpeg_start_decompress() returned max_h_samp_factor = %d "
1465
0
                      "and max_v_samp_factor = %d, expected %" PRIu8
1466
0
                      " and %" PRIu8,
1467
0
                      sp->libjpeg_jpeg_decompress_struct.max_h_samp_factor,
1468
0
                      sp->libjpeg_jpeg_decompress_struct.max_v_samp_factor,
1469
0
                      sp->subsampling_hor, sp->subsampling_ver);
1470
0
        return 0;
1471
0
    }
1472
1473
0
    sp->writeheader_done = 1;
1474
0
    return (1);
1475
0
}
1476
1477
static void OJPEGLibjpegSessionAbort(TIFF *tif)
1478
0
{
1479
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
1480
0
    assert(sp->libjpeg_session_active != 0);
1481
0
    jpeg_destroy((jpeg_common_struct *)(&(sp->libjpeg_jpeg_decompress_struct)));
1482
0
    sp->libjpeg_session_active = 0;
1483
0
}
1484
1485
static int OJPEGReadHeaderInfoSec(TIFF *tif)
1486
0
{
1487
0
    static const char module[] = "OJPEGReadHeaderInfoSec";
1488
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
1489
0
    uint8_t m;
1490
0
    uint16_t n;
1491
0
    uint8_t o;
1492
0
    if (sp->file_size == 0)
1493
0
        sp->file_size = TIFFGetFileSize(tif);
1494
0
    if (sp->jpeg_interchange_format != 0)
1495
0
    {
1496
0
        if (sp->jpeg_interchange_format >= sp->file_size)
1497
0
        {
1498
0
            sp->jpeg_interchange_format = 0;
1499
0
            sp->jpeg_interchange_format_length = 0;
1500
0
        }
1501
0
        else
1502
0
        {
1503
0
            if ((sp->jpeg_interchange_format_length == 0) ||
1504
0
                (sp->jpeg_interchange_format >
1505
0
                 UINT64_MAX - sp->jpeg_interchange_format_length) ||
1506
0
                (sp->jpeg_interchange_format +
1507
0
                     sp->jpeg_interchange_format_length >
1508
0
                 sp->file_size))
1509
0
                sp->jpeg_interchange_format_length =
1510
0
                    sp->file_size - sp->jpeg_interchange_format;
1511
0
        }
1512
0
    }
1513
0
    sp->in_buffer_source = osibsNotSetYet;
1514
0
    sp->in_buffer_next_strile = 0;
1515
0
    sp->in_buffer_strile_count = tif->tif_dir.td_nstrips;
1516
0
    sp->in_buffer_file_togo = 0;
1517
0
    sp->in_buffer_togo = 0;
1518
0
    do
1519
0
    {
1520
0
        if (OJPEGReadBytePeek(sp, &m) == 0)
1521
0
            return (0);
1522
0
        if (m != 255)
1523
0
            break;
1524
0
        OJPEGReadByteAdvance(sp);
1525
0
        do
1526
0
        {
1527
0
            if (OJPEGReadByte(sp, &m) == 0)
1528
0
                return (0);
1529
0
        } while (m == 255);
1530
0
        switch (m)
1531
0
        {
1532
0
            case JPEG_MARKER_SOI:
1533
                /* this type of marker has no data, and should be skipped */
1534
0
                break;
1535
0
            case JPEG_MARKER_COM:
1536
0
            case JPEG_MARKER_APP0:
1537
0
            case JPEG_MARKER_APP0 + 1:
1538
0
            case JPEG_MARKER_APP0 + 2:
1539
0
            case JPEG_MARKER_APP0 + 3:
1540
0
            case JPEG_MARKER_APP0 + 4:
1541
0
            case JPEG_MARKER_APP0 + 5:
1542
0
            case JPEG_MARKER_APP0 + 6:
1543
0
            case JPEG_MARKER_APP0 + 7:
1544
0
            case JPEG_MARKER_APP0 + 8:
1545
0
            case JPEG_MARKER_APP0 + 9:
1546
0
            case JPEG_MARKER_APP0 + 10:
1547
0
            case JPEG_MARKER_APP0 + 11:
1548
0
            case JPEG_MARKER_APP0 + 12:
1549
0
            case JPEG_MARKER_APP0 + 13:
1550
0
            case JPEG_MARKER_APP0 + 14:
1551
0
            case JPEG_MARKER_APP0 + 15:
1552
                /* this type of marker has data, but it has no use to us (and no
1553
                 * place here) and should be skipped */
1554
0
                if (OJPEGReadWord(sp, &n) == 0)
1555
0
                    return (0);
1556
0
                if (n < 2)
1557
0
                {
1558
0
                    if (sp->subsamplingcorrect == 0)
1559
0
                        TIFFErrorExtR(tif, module, "Corrupt JPEG data");
1560
0
                    return (0);
1561
0
                }
1562
0
                if (n > 2)
1563
0
                    OJPEGReadSkip(sp, n - 2);
1564
0
                break;
1565
0
            case JPEG_MARKER_DRI:
1566
0
                if (OJPEGReadHeaderInfoSecStreamDri(tif) == 0)
1567
0
                    return (0);
1568
0
                break;
1569
0
            case JPEG_MARKER_DQT:
1570
0
                if (OJPEGReadHeaderInfoSecStreamDqt(tif) == 0)
1571
0
                    return (0);
1572
0
                break;
1573
0
            case JPEG_MARKER_DHT:
1574
0
                if (OJPEGReadHeaderInfoSecStreamDht(tif) == 0)
1575
0
                    return (0);
1576
0
                break;
1577
0
            case JPEG_MARKER_SOF0:
1578
0
            case JPEG_MARKER_SOF1:
1579
0
            case JPEG_MARKER_SOF3:
1580
0
                if (OJPEGReadHeaderInfoSecStreamSof(tif, m) == 0)
1581
0
                    return (0);
1582
0
                if (sp->subsamplingcorrect != 0)
1583
0
                    return (1);
1584
0
                break;
1585
0
            case JPEG_MARKER_SOS:
1586
0
                if (sp->subsamplingcorrect != 0)
1587
0
                    return (1);
1588
0
                assert(sp->plane_sample_offset == 0);
1589
0
                if (OJPEGReadHeaderInfoSecStreamSos(tif) == 0)
1590
0
                    return (0);
1591
0
                break;
1592
0
            default:
1593
0
                TIFFErrorExtR(tif, module,
1594
0
                              "Unknown marker type %" PRIu8 " in JPEG data", m);
1595
0
                return (0);
1596
0
        }
1597
0
    } while (m != JPEG_MARKER_SOS);
1598
0
    if (sp->subsamplingcorrect)
1599
0
        return (1);
1600
0
    if (sp->sof_log == 0)
1601
0
    {
1602
0
        if (OJPEGReadHeaderInfoSecTablesQTable(tif) == 0)
1603
0
            return (0);
1604
0
        sp->sof_marker_id = JPEG_MARKER_SOF0;
1605
0
        for (o = 0; o < sp->samples_per_pixel; o++)
1606
0
            sp->sof_c[o] = o;
1607
0
        sp->sof_hv[0] = ((sp->subsampling_hor << 4) | sp->subsampling_ver);
1608
0
        for (o = 1; o < sp->samples_per_pixel; o++)
1609
0
            sp->sof_hv[o] = 17;
1610
0
        sp->sof_x = sp->strile_width;
1611
0
        sp->sof_y = sp->strile_length_total;
1612
0
        sp->sof_log = 1;
1613
0
        if (OJPEGReadHeaderInfoSecTablesDcTable(tif) == 0)
1614
0
            return (0);
1615
0
        if (OJPEGReadHeaderInfoSecTablesAcTable(tif) == 0)
1616
0
            return (0);
1617
0
        for (o = 1; o < sp->samples_per_pixel; o++)
1618
0
            sp->sos_cs[o] = o;
1619
0
    }
1620
0
    return (1);
1621
0
}
1622
1623
static int OJPEGReadHeaderInfoSecStreamDri(TIFF *tif)
1624
0
{
1625
    /* This could easily cause trouble in some cases... but no such cases have
1626
       occurred so far */
1627
0
    static const char module[] = "OJPEGReadHeaderInfoSecStreamDri";
1628
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
1629
0
    uint16_t m;
1630
0
    if (OJPEGReadWord(sp, &m) == 0)
1631
0
        return (0);
1632
0
    if (m != 4)
1633
0
    {
1634
0
        TIFFErrorExtR(tif, module, "Corrupt DRI marker in JPEG data");
1635
0
        return (0);
1636
0
    }
1637
0
    if (OJPEGReadWord(sp, &m) == 0)
1638
0
        return (0);
1639
0
    sp->restart_interval = m;
1640
0
    return (1);
1641
0
}
1642
1643
static int OJPEGReadHeaderInfoSecStreamDqt(TIFF *tif)
1644
0
{
1645
    /* this is a table marker, and it is to be saved as a whole for exact
1646
     * pushing on the jpeg stream later on */
1647
0
    static const char module[] = "OJPEGReadHeaderInfoSecStreamDqt";
1648
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
1649
0
    uint16_t m;
1650
0
    uint32_t na;
1651
0
    uint8_t *nb;
1652
0
    uint8_t o;
1653
0
    if (OJPEGReadWord(sp, &m) == 0)
1654
0
        return (0);
1655
0
    if (m <= 2)
1656
0
    {
1657
0
        if (sp->subsamplingcorrect == 0)
1658
0
            TIFFErrorExtR(tif, module, "Corrupt DQT marker in JPEG data");
1659
0
        return (0);
1660
0
    }
1661
0
    if (sp->subsamplingcorrect != 0)
1662
0
        OJPEGReadSkip(sp, m - 2);
1663
0
    else
1664
0
    {
1665
0
        m -= 2;
1666
0
        do
1667
0
        {
1668
0
            if (m < 65)
1669
0
            {
1670
0
                TIFFErrorExtR(tif, module, "Corrupt DQT marker in JPEG data");
1671
0
                return (0);
1672
0
            }
1673
0
            na = sizeof(uint32_t) + 69;
1674
0
            nb = _TIFFmallocExt(tif, na);
1675
0
            if (nb == 0)
1676
0
            {
1677
0
                TIFFErrorExtR(tif, module, "Out of memory");
1678
0
                return (0);
1679
0
            }
1680
0
            *(uint32_t *)nb = na;
1681
0
            nb[sizeof(uint32_t)] = 255;
1682
0
            nb[sizeof(uint32_t) + 1] = JPEG_MARKER_DQT;
1683
0
            nb[sizeof(uint32_t) + 2] = 0;
1684
0
            nb[sizeof(uint32_t) + 3] = 67;
1685
0
            if (OJPEGReadBlock(sp, 65, &nb[sizeof(uint32_t) + 4]) == 0)
1686
0
            {
1687
0
                _TIFFfreeExt(tif, nb);
1688
0
                return (0);
1689
0
            }
1690
0
            o = nb[sizeof(uint32_t) + 4] & 15;
1691
0
            if (3 < o)
1692
0
            {
1693
0
                TIFFErrorExtR(tif, module, "Corrupt DQT marker in JPEG data");
1694
0
                _TIFFfreeExt(tif, nb);
1695
0
                return (0);
1696
0
            }
1697
0
            if (sp->qtable[o] != 0)
1698
0
                _TIFFfreeExt(tif, sp->qtable[o]);
1699
0
            sp->qtable[o] = nb;
1700
0
            m -= 65;
1701
0
        } while (m > 0);
1702
0
    }
1703
0
    return (1);
1704
0
}
1705
1706
static int OJPEGReadHeaderInfoSecStreamDht(TIFF *tif)
1707
0
{
1708
    /* this is a table marker, and it is to be saved as a whole for exact
1709
     * pushing on the jpeg stream later on */
1710
    /* TODO: the following assumes there is only one table in this marker... but
1711
     * i'm not quite sure that assumption is guaranteed correct */
1712
0
    static const char module[] = "OJPEGReadHeaderInfoSecStreamDht";
1713
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
1714
0
    uint16_t m;
1715
0
    uint32_t na;
1716
0
    uint8_t *nb;
1717
0
    uint8_t o;
1718
0
    if (OJPEGReadWord(sp, &m) == 0)
1719
0
        return (0);
1720
0
    if (m <= 2)
1721
0
    {
1722
0
        if (sp->subsamplingcorrect == 0)
1723
0
            TIFFErrorExtR(tif, module, "Corrupt DHT marker in JPEG data");
1724
0
        return (0);
1725
0
    }
1726
0
    if (sp->subsamplingcorrect != 0)
1727
0
    {
1728
0
        OJPEGReadSkip(sp, m - 2);
1729
0
    }
1730
0
    else
1731
0
    {
1732
0
        na = sizeof(uint32_t) + 2 + m;
1733
0
        nb = _TIFFmallocExt(tif, na);
1734
0
        if (nb == 0)
1735
0
        {
1736
0
            TIFFErrorExtR(tif, module, "Out of memory");
1737
0
            return (0);
1738
0
        }
1739
0
        *(uint32_t *)nb = na;
1740
0
        nb[sizeof(uint32_t)] = 255;
1741
0
        nb[sizeof(uint32_t) + 1] = JPEG_MARKER_DHT;
1742
0
        nb[sizeof(uint32_t) + 2] = (m >> 8);
1743
0
        nb[sizeof(uint32_t) + 3] = (m & 255);
1744
0
        if (OJPEGReadBlock(sp, m - 2, &nb[sizeof(uint32_t) + 4]) == 0)
1745
0
        {
1746
0
            _TIFFfreeExt(tif, nb);
1747
0
            return (0);
1748
0
        }
1749
0
        o = nb[sizeof(uint32_t) + 4];
1750
0
        if ((o & 240) == 0)
1751
0
        {
1752
0
            if (3 < o)
1753
0
            {
1754
0
                TIFFErrorExtR(tif, module, "Corrupt DHT marker in JPEG data");
1755
0
                _TIFFfreeExt(tif, nb);
1756
0
                return (0);
1757
0
            }
1758
0
            if (sp->dctable[o] != 0)
1759
0
                _TIFFfreeExt(tif, sp->dctable[o]);
1760
0
            sp->dctable[o] = nb;
1761
0
        }
1762
0
        else
1763
0
        {
1764
0
            if ((o & 240) != 16)
1765
0
            {
1766
0
                TIFFErrorExtR(tif, module, "Corrupt DHT marker in JPEG data");
1767
0
                _TIFFfreeExt(tif, nb);
1768
0
                return (0);
1769
0
            }
1770
0
            o &= 15;
1771
0
            if (3 < o)
1772
0
            {
1773
0
                TIFFErrorExtR(tif, module, "Corrupt DHT marker in JPEG data");
1774
0
                _TIFFfreeExt(tif, nb);
1775
0
                return (0);
1776
0
            }
1777
0
            if (sp->actable[o] != 0)
1778
0
                _TIFFfreeExt(tif, sp->actable[o]);
1779
0
            sp->actable[o] = nb;
1780
0
        }
1781
0
    }
1782
0
    return (1);
1783
0
}
1784
1785
static int OJPEGReadHeaderInfoSecStreamSof(TIFF *tif, uint8_t marker_id)
1786
0
{
1787
    /* this marker needs to be checked, and part of its data needs to be saved
1788
     * for regeneration later on */
1789
0
    static const char module[] = "OJPEGReadHeaderInfoSecStreamSof";
1790
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
1791
0
    uint16_t m;
1792
0
    uint16_t n;
1793
0
    uint8_t o;
1794
0
    uint16_t p;
1795
0
    uint16_t q;
1796
0
    if (sp->sof_log != 0)
1797
0
    {
1798
0
        TIFFErrorExtR(tif, module, "Corrupt JPEG data");
1799
0
        return (0);
1800
0
    }
1801
0
    if (sp->subsamplingcorrect == 0)
1802
0
        sp->sof_marker_id = marker_id;
1803
    /* Lf: data length */
1804
0
    if (OJPEGReadWord(sp, &m) == 0)
1805
0
        return (0);
1806
0
    if (m < 11)
1807
0
    {
1808
0
        if (sp->subsamplingcorrect == 0)
1809
0
            TIFFErrorExtR(tif, module, "Corrupt SOF marker in JPEG data");
1810
0
        return (0);
1811
0
    }
1812
0
    m -= 8;
1813
0
    if (m % 3 != 0)
1814
0
    {
1815
0
        if (sp->subsamplingcorrect == 0)
1816
0
            TIFFErrorExtR(tif, module, "Corrupt SOF marker in JPEG data");
1817
0
        return (0);
1818
0
    }
1819
0
    n = m / 3;
1820
0
    if (sp->subsamplingcorrect == 0)
1821
0
    {
1822
0
        if (n != sp->samples_per_pixel)
1823
0
        {
1824
0
            TIFFErrorExtR(
1825
0
                tif, module,
1826
0
                "JPEG compressed data indicates unexpected number of samples");
1827
0
            return (0);
1828
0
        }
1829
0
    }
1830
    /* P: Sample precision */
1831
0
    if (OJPEGReadByte(sp, &o) == 0)
1832
0
        return (0);
1833
0
    if (o != 8)
1834
0
    {
1835
0
        if (sp->subsamplingcorrect == 0)
1836
0
            TIFFErrorExtR(tif, module,
1837
0
                          "JPEG compressed data indicates unexpected number of "
1838
0
                          "bits per sample");
1839
0
        return (0);
1840
0
    }
1841
    /* Y: Number of lines, X: Number of samples per line */
1842
0
    if (sp->subsamplingcorrect)
1843
0
        OJPEGReadSkip(sp, 4);
1844
0
    else
1845
0
    {
1846
        /* Y: Number of lines */
1847
0
        if (OJPEGReadWord(sp, &p) == 0)
1848
0
            return (0);
1849
0
        if (((uint32_t)p < sp->image_length) &&
1850
0
            ((uint32_t)p < sp->strile_length_total))
1851
0
        {
1852
0
            TIFFErrorExtR(tif, module,
1853
0
                          "JPEG compressed data indicates unexpected height");
1854
0
            return (0);
1855
0
        }
1856
0
        sp->sof_y = p;
1857
        /* X: Number of samples per line */
1858
0
        if (OJPEGReadWord(sp, &p) == 0)
1859
0
            return (0);
1860
0
        if (((uint32_t)p < sp->image_width) && ((uint32_t)p < sp->strile_width))
1861
0
        {
1862
0
            TIFFErrorExtR(tif, module,
1863
0
                          "JPEG compressed data indicates unexpected width");
1864
0
            return (0);
1865
0
        }
1866
0
        if ((uint32_t)p > sp->strile_width)
1867
0
        {
1868
0
            TIFFErrorExtR(tif, module,
1869
0
                          "JPEG compressed data image width exceeds expected "
1870
0
                          "image width");
1871
0
            return (0);
1872
0
        }
1873
0
        sp->sof_x = p;
1874
0
    }
1875
    /* Nf: Number of image components in frame */
1876
0
    if (OJPEGReadByte(sp, &o) == 0)
1877
0
        return (0);
1878
0
    if (o != n)
1879
0
    {
1880
0
        if (sp->subsamplingcorrect == 0)
1881
0
            TIFFErrorExtR(tif, module, "Corrupt SOF marker in JPEG data");
1882
0
        return (0);
1883
0
    }
1884
    /* per component stuff */
1885
    /* TODO: double-check that flow implies that n cannot be as big as to make
1886
     * us overflow sof_c, sof_hv and sof_tq arrays */
1887
0
    for (q = 0; q < n; q++)
1888
0
    {
1889
        /* C: Component identifier */
1890
0
        if (OJPEGReadByte(sp, &o) == 0)
1891
0
            return (0);
1892
0
        if (sp->subsamplingcorrect == 0)
1893
0
            sp->sof_c[q] = o;
1894
        /* H: Horizontal sampling factor, and V: Vertical sampling factor */
1895
0
        if (OJPEGReadByte(sp, &o) == 0)
1896
0
            return (0);
1897
0
        if (sp->subsamplingcorrect != 0)
1898
0
        {
1899
0
            if (q == 0)
1900
0
            {
1901
0
                sp->subsampling_hor = (o >> 4);
1902
0
                sp->subsampling_ver = (o & 15);
1903
0
                if (((sp->subsampling_hor != 1) && (sp->subsampling_hor != 2) &&
1904
0
                     (sp->subsampling_hor != 4)) ||
1905
0
                    ((sp->subsampling_ver != 1) && (sp->subsampling_ver != 2) &&
1906
0
                     (sp->subsampling_ver != 4)))
1907
0
                    sp->subsampling_force_desubsampling_inside_decompression =
1908
0
                        1;
1909
0
            }
1910
0
            else
1911
0
            {
1912
0
                if (o != 17)
1913
0
                    sp->subsampling_force_desubsampling_inside_decompression =
1914
0
                        1;
1915
0
            }
1916
0
        }
1917
0
        else
1918
0
        {
1919
0
            sp->sof_hv[q] = o;
1920
0
            if (sp->subsampling_force_desubsampling_inside_decompression == 0)
1921
0
            {
1922
0
                if (q == 0)
1923
0
                {
1924
0
                    if (o != ((sp->subsampling_hor << 4) | sp->subsampling_ver))
1925
0
                    {
1926
0
                        TIFFErrorExtR(tif, module,
1927
0
                                      "JPEG compressed data indicates "
1928
0
                                      "unexpected subsampling values");
1929
0
                        return (0);
1930
0
                    }
1931
0
                }
1932
0
                else
1933
0
                {
1934
0
                    if (o != 17)
1935
0
                    {
1936
0
                        TIFFErrorExtR(tif, module,
1937
0
                                      "JPEG compressed data indicates "
1938
0
                                      "unexpected subsampling values");
1939
0
                        return (0);
1940
0
                    }
1941
0
                }
1942
0
            }
1943
0
        }
1944
        /* Tq: Quantization table destination selector */
1945
0
        if (OJPEGReadByte(sp, &o) == 0)
1946
0
            return (0);
1947
0
        if (sp->subsamplingcorrect == 0)
1948
0
            sp->sof_tq[q] = o;
1949
0
    }
1950
0
    if (sp->subsamplingcorrect == 0)
1951
0
        sp->sof_log = 1;
1952
0
    return (1);
1953
0
}
1954
1955
static int OJPEGReadHeaderInfoSecStreamSos(TIFF *tif)
1956
0
{
1957
    /* this marker needs to be checked, and part of its data needs to be saved
1958
     * for regeneration later on */
1959
0
    static const char module[] = "OJPEGReadHeaderInfoSecStreamSos";
1960
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
1961
0
    uint16_t m;
1962
0
    uint8_t n;
1963
0
    uint8_t o;
1964
0
    assert(sp->subsamplingcorrect == 0);
1965
0
    if (sp->sof_log == 0)
1966
0
    {
1967
0
        TIFFErrorExtR(tif, module, "Corrupt SOS marker in JPEG data");
1968
0
        return (0);
1969
0
    }
1970
    /* Ls */
1971
0
    if (OJPEGReadWord(sp, &m) == 0)
1972
0
        return (0);
1973
0
    if (m != 6 + sp->samples_per_pixel_per_plane * 2)
1974
0
    {
1975
0
        TIFFErrorExtR(tif, module, "Corrupt SOS marker in JPEG data");
1976
0
        return (0);
1977
0
    }
1978
    /* Ns */
1979
0
    if (OJPEGReadByte(sp, &n) == 0)
1980
0
        return (0);
1981
0
    if (n != sp->samples_per_pixel_per_plane)
1982
0
    {
1983
0
        TIFFErrorExtR(tif, module, "Corrupt SOS marker in JPEG data");
1984
0
        return (0);
1985
0
    }
1986
    /* Cs, Td, and Ta */
1987
0
    for (o = 0; o < sp->samples_per_pixel_per_plane; o++)
1988
0
    {
1989
        /* Cs */
1990
0
        if (OJPEGReadByte(sp, &n) == 0)
1991
0
            return (0);
1992
0
        sp->sos_cs[sp->plane_sample_offset + o] = n;
1993
        /* Td and Ta */
1994
0
        if (OJPEGReadByte(sp, &n) == 0)
1995
0
            return (0);
1996
0
        sp->sos_tda[sp->plane_sample_offset + o] = n;
1997
0
    }
1998
    /* skip Ss, Se, Ah, en Al -> no check, as per Tom Lane recommendation, as
1999
     * per LibJpeg source */
2000
0
    OJPEGReadSkip(sp, 3);
2001
0
    return (1);
2002
0
}
2003
2004
static int OJPEGReadHeaderInfoSecTablesQTable(TIFF *tif)
2005
0
{
2006
0
    static const char module[] = "OJPEGReadHeaderInfoSecTablesQTable";
2007
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2008
0
    uint8_t m;
2009
0
    uint8_t n;
2010
0
    uint32_t oa;
2011
0
    uint8_t *ob;
2012
0
    uint32_t p;
2013
0
    if (sp->qtable_offset[0] == 0)
2014
0
    {
2015
0
        TIFFErrorExtR(tif, module, "Missing JPEG tables");
2016
0
        return (0);
2017
0
    }
2018
0
    sp->in_buffer_file_pos_log = 0;
2019
0
    for (m = 0; m < sp->samples_per_pixel; m++)
2020
0
    {
2021
0
        if ((sp->qtable_offset[m] != 0) &&
2022
0
            ((m == 0) || (sp->qtable_offset[m] != sp->qtable_offset[m - 1])))
2023
0
        {
2024
0
            for (n = 0; n < m - 1; n++)
2025
0
            {
2026
0
                if (sp->qtable_offset[m] == sp->qtable_offset[n])
2027
0
                {
2028
0
                    TIFFErrorExtR(tif, module, "Corrupt JpegQTables tag value");
2029
0
                    return (0);
2030
0
                }
2031
0
            }
2032
0
            oa = sizeof(uint32_t) + 69;
2033
0
            ob = _TIFFmallocExt(tif, oa);
2034
0
            if (ob == 0)
2035
0
            {
2036
0
                TIFFErrorExtR(tif, module, "Out of memory");
2037
0
                return (0);
2038
0
            }
2039
0
            *(uint32_t *)ob = oa;
2040
0
            ob[sizeof(uint32_t)] = 255;
2041
0
            ob[sizeof(uint32_t) + 1] = JPEG_MARKER_DQT;
2042
0
            ob[sizeof(uint32_t) + 2] = 0;
2043
0
            ob[sizeof(uint32_t) + 3] = 67;
2044
0
            ob[sizeof(uint32_t) + 4] = m;
2045
0
            TIFFSeekFile(tif, sp->qtable_offset[m], SEEK_SET);
2046
0
            p = (uint32_t)TIFFReadFile(tif, &ob[sizeof(uint32_t) + 5], 64);
2047
0
            if (p != 64)
2048
0
            {
2049
0
                _TIFFfreeExt(tif, ob);
2050
0
                return (0);
2051
0
            }
2052
0
            if (sp->qtable[m] != 0)
2053
0
                _TIFFfreeExt(tif, sp->qtable[m]);
2054
0
            sp->qtable[m] = ob;
2055
0
            sp->sof_tq[m] = m;
2056
0
        }
2057
0
        else
2058
0
            sp->sof_tq[m] = sp->sof_tq[m - 1];
2059
0
    }
2060
0
    return (1);
2061
0
}
2062
2063
static int OJPEGReadHeaderInfoSecTablesDcTable(TIFF *tif)
2064
0
{
2065
0
    static const char module[] = "OJPEGReadHeaderInfoSecTablesDcTable";
2066
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2067
0
    uint8_t m;
2068
0
    uint8_t n;
2069
0
    uint8_t o[16];
2070
0
    uint32_t p;
2071
0
    uint32_t q;
2072
0
    uint32_t ra;
2073
0
    uint8_t *rb;
2074
0
    if (sp->dctable_offset[0] == 0)
2075
0
    {
2076
0
        TIFFErrorExtR(tif, module, "Missing JPEG tables");
2077
0
        return (0);
2078
0
    }
2079
0
    sp->in_buffer_file_pos_log = 0;
2080
0
    for (m = 0; m < sp->samples_per_pixel; m++)
2081
0
    {
2082
0
        if ((sp->dctable_offset[m] != 0) &&
2083
0
            ((m == 0) || (sp->dctable_offset[m] != sp->dctable_offset[m - 1])))
2084
0
        {
2085
0
            for (n = 0; n < m - 1; n++)
2086
0
            {
2087
0
                if (sp->dctable_offset[m] == sp->dctable_offset[n])
2088
0
                {
2089
0
                    TIFFErrorExtR(tif, module,
2090
0
                                  "Corrupt JpegDcTables tag value");
2091
0
                    return (0);
2092
0
                }
2093
0
            }
2094
0
            TIFFSeekFile(tif, sp->dctable_offset[m], SEEK_SET);
2095
0
            p = (uint32_t)TIFFReadFile(tif, o, 16);
2096
0
            if (p != 16)
2097
0
                return (0);
2098
0
            q = 0;
2099
0
            for (n = 0; n < 16; n++)
2100
0
                q += o[n];
2101
0
            ra = sizeof(uint32_t) + 21 + q;
2102
0
            rb = _TIFFmallocExt(tif, ra);
2103
0
            if (rb == 0)
2104
0
            {
2105
0
                TIFFErrorExtR(tif, module, "Out of memory");
2106
0
                return (0);
2107
0
            }
2108
0
            *(uint32_t *)rb = ra;
2109
0
            rb[sizeof(uint32_t)] = 255;
2110
0
            rb[sizeof(uint32_t) + 1] = JPEG_MARKER_DHT;
2111
0
            rb[sizeof(uint32_t) + 2] = (uint8_t)((19 + q) >> 8);
2112
0
            rb[sizeof(uint32_t) + 3] = ((19 + q) & 255);
2113
0
            rb[sizeof(uint32_t) + 4] = m;
2114
0
            for (n = 0; n < 16; n++)
2115
0
                rb[sizeof(uint32_t) + 5 + n] = o[n];
2116
0
            p = (uint32_t)TIFFReadFile(tif, &(rb[sizeof(uint32_t) + 21]), q);
2117
0
            if (p != q)
2118
0
            {
2119
0
                _TIFFfreeExt(tif, rb);
2120
0
                return (0);
2121
0
            }
2122
0
            if (sp->dctable[m] != 0)
2123
0
                _TIFFfreeExt(tif, sp->dctable[m]);
2124
0
            sp->dctable[m] = rb;
2125
0
            sp->sos_tda[m] = (m << 4);
2126
0
        }
2127
0
        else
2128
0
            sp->sos_tda[m] = sp->sos_tda[m - 1];
2129
0
    }
2130
0
    return (1);
2131
0
}
2132
2133
static int OJPEGReadHeaderInfoSecTablesAcTable(TIFF *tif)
2134
0
{
2135
0
    static const char module[] = "OJPEGReadHeaderInfoSecTablesAcTable";
2136
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2137
0
    uint8_t m;
2138
0
    uint8_t n;
2139
0
    uint8_t o[16];
2140
0
    uint32_t p;
2141
0
    uint32_t q;
2142
0
    uint32_t ra;
2143
0
    uint8_t *rb;
2144
0
    if (sp->actable_offset[0] == 0)
2145
0
    {
2146
0
        TIFFErrorExtR(tif, module, "Missing JPEG tables");
2147
0
        return (0);
2148
0
    }
2149
0
    sp->in_buffer_file_pos_log = 0;
2150
0
    for (m = 0; m < sp->samples_per_pixel; m++)
2151
0
    {
2152
0
        if ((sp->actable_offset[m] != 0) &&
2153
0
            ((m == 0) || (sp->actable_offset[m] != sp->actable_offset[m - 1])))
2154
0
        {
2155
0
            for (n = 0; n < m - 1; n++)
2156
0
            {
2157
0
                if (sp->actable_offset[m] == sp->actable_offset[n])
2158
0
                {
2159
0
                    TIFFErrorExtR(tif, module,
2160
0
                                  "Corrupt JpegAcTables tag value");
2161
0
                    return (0);
2162
0
                }
2163
0
            }
2164
0
            TIFFSeekFile(tif, sp->actable_offset[m], SEEK_SET);
2165
0
            p = (uint32_t)TIFFReadFile(tif, o, 16);
2166
0
            if (p != 16)
2167
0
                return (0);
2168
0
            q = 0;
2169
0
            for (n = 0; n < 16; n++)
2170
0
                q += o[n];
2171
0
            ra = sizeof(uint32_t) + 21 + q;
2172
0
            rb = _TIFFmallocExt(tif, ra);
2173
0
            if (rb == 0)
2174
0
            {
2175
0
                TIFFErrorExtR(tif, module, "Out of memory");
2176
0
                return (0);
2177
0
            }
2178
0
            *(uint32_t *)rb = ra;
2179
0
            rb[sizeof(uint32_t)] = 255;
2180
0
            rb[sizeof(uint32_t) + 1] = JPEG_MARKER_DHT;
2181
0
            rb[sizeof(uint32_t) + 2] = (uint8_t)((19 + q) >> 8);
2182
0
            rb[sizeof(uint32_t) + 3] = ((19 + q) & 255);
2183
0
            rb[sizeof(uint32_t) + 4] = (16 | m);
2184
0
            for (n = 0; n < 16; n++)
2185
0
                rb[sizeof(uint32_t) + 5 + n] = o[n];
2186
0
            p = (uint32_t)TIFFReadFile(tif, &(rb[sizeof(uint32_t) + 21]), q);
2187
0
            if (p != q)
2188
0
            {
2189
0
                _TIFFfreeExt(tif, rb);
2190
0
                return (0);
2191
0
            }
2192
0
            if (sp->actable[m] != 0)
2193
0
                _TIFFfreeExt(tif, sp->actable[m]);
2194
0
            sp->actable[m] = rb;
2195
0
            sp->sos_tda[m] = (sp->sos_tda[m] | m);
2196
0
        }
2197
0
        else
2198
0
            sp->sos_tda[m] = (sp->sos_tda[m] | (sp->sos_tda[m - 1] & 15));
2199
0
    }
2200
0
    return (1);
2201
0
}
2202
2203
static int OJPEGReadBufferFill(OJPEGState *sp)
2204
0
{
2205
0
    uint16_t m;
2206
0
    tmsize_t n;
2207
    /* TODO: double-check: when subsamplingcorrect is set, no call to
2208
     * TIFFErrorExt or TIFFWarningExt should be made in any other case, seek or
2209
     * read errors should be passed through */
2210
0
    do
2211
0
    {
2212
0
        if (sp->in_buffer_file_togo != 0)
2213
0
        {
2214
0
            if (sp->in_buffer_file_pos_log == 0)
2215
0
            {
2216
0
                TIFFSeekFile(sp->tif, sp->in_buffer_file_pos, SEEK_SET);
2217
0
                sp->in_buffer_file_pos_log = 1;
2218
0
            }
2219
0
            m = OJPEG_BUFFER;
2220
0
            if ((uint64_t)m > sp->in_buffer_file_togo)
2221
0
                m = (uint16_t)sp->in_buffer_file_togo;
2222
0
            n = TIFFReadFile(sp->tif, sp->in_buffer, (tmsize_t)m);
2223
0
            if (n == 0)
2224
0
                return (0);
2225
0
            assert(n > 0);
2226
0
            assert(n <= OJPEG_BUFFER);
2227
0
            assert(n < 65536);
2228
0
            assert((uint64_t)n <= sp->in_buffer_file_togo);
2229
0
            m = (uint16_t)n;
2230
0
            sp->in_buffer_togo = m;
2231
0
            sp->in_buffer_cur = sp->in_buffer;
2232
0
            sp->in_buffer_file_togo -= m;
2233
0
            sp->in_buffer_file_pos += m;
2234
0
            break;
2235
0
        }
2236
0
        sp->in_buffer_file_pos_log = 0;
2237
0
        switch (sp->in_buffer_source)
2238
0
        {
2239
0
            case osibsNotSetYet:
2240
0
                if (sp->jpeg_interchange_format != 0)
2241
0
                {
2242
0
                    sp->in_buffer_file_pos = sp->jpeg_interchange_format;
2243
0
                    sp->in_buffer_file_togo =
2244
0
                        sp->jpeg_interchange_format_length;
2245
0
                }
2246
0
                sp->in_buffer_source = osibsJpegInterchangeFormat;
2247
0
                break;
2248
0
            case osibsJpegInterchangeFormat:
2249
0
                sp->in_buffer_source = osibsStrile;
2250
0
                break;
2251
0
            case osibsStrile:
2252
0
                if (sp->in_buffer_next_strile == sp->in_buffer_strile_count)
2253
0
                    sp->in_buffer_source = osibsEof;
2254
0
                else
2255
0
                {
2256
0
                    int err = 0;
2257
0
                    sp->in_buffer_file_pos = TIFFGetStrileOffsetWithErr(
2258
0
                        sp->tif, sp->in_buffer_next_strile, &err);
2259
0
                    if (err)
2260
0
                        return 0;
2261
0
                    if (sp->in_buffer_file_pos != 0)
2262
0
                    {
2263
0
                        uint64_t bytecount = TIFFGetStrileByteCountWithErr(
2264
0
                            sp->tif, sp->in_buffer_next_strile, &err);
2265
0
                        if (err)
2266
0
                            return 0;
2267
0
                        if (sp->in_buffer_file_pos >= sp->file_size)
2268
0
                            sp->in_buffer_file_pos = 0;
2269
0
                        else if (bytecount == 0)
2270
0
                            sp->in_buffer_file_togo =
2271
0
                                sp->file_size - sp->in_buffer_file_pos;
2272
0
                        else
2273
0
                        {
2274
0
                            sp->in_buffer_file_togo = bytecount;
2275
0
                            if (sp->in_buffer_file_togo == 0)
2276
0
                                sp->in_buffer_file_pos = 0;
2277
0
                            else if (sp->in_buffer_file_pos >
2278
0
                                         UINT64_MAX - sp->in_buffer_file_togo ||
2279
0
                                     sp->in_buffer_file_pos +
2280
0
                                             sp->in_buffer_file_togo >
2281
0
                                         sp->file_size)
2282
0
                                sp->in_buffer_file_togo =
2283
0
                                    sp->file_size - sp->in_buffer_file_pos;
2284
0
                        }
2285
0
                    }
2286
0
                    sp->in_buffer_next_strile++;
2287
0
                }
2288
0
                break;
2289
0
            default:
2290
0
                return (0);
2291
0
        }
2292
0
    } while (1);
2293
0
    return (1);
2294
0
}
2295
2296
static int OJPEGReadByte(OJPEGState *sp, uint8_t *byte)
2297
0
{
2298
0
    if (sp->in_buffer_togo == 0)
2299
0
    {
2300
0
        if (OJPEGReadBufferFill(sp) == 0)
2301
0
            return (0);
2302
0
        assert(sp->in_buffer_togo > 0);
2303
0
    }
2304
0
    *byte = *(sp->in_buffer_cur);
2305
0
    sp->in_buffer_cur++;
2306
0
    sp->in_buffer_togo--;
2307
0
    return (1);
2308
0
}
2309
2310
static int OJPEGReadBytePeek(OJPEGState *sp, uint8_t *byte)
2311
0
{
2312
0
    if (sp->in_buffer_togo == 0)
2313
0
    {
2314
0
        if (OJPEGReadBufferFill(sp) == 0)
2315
0
            return (0);
2316
0
        assert(sp->in_buffer_togo > 0);
2317
0
    }
2318
0
    *byte = *(sp->in_buffer_cur);
2319
0
    return (1);
2320
0
}
2321
2322
static void OJPEGReadByteAdvance(OJPEGState *sp)
2323
0
{
2324
0
    assert(sp->in_buffer_togo > 0);
2325
0
    sp->in_buffer_cur++;
2326
0
    sp->in_buffer_togo--;
2327
0
}
2328
2329
static int OJPEGReadWord(OJPEGState *sp, uint16_t *word)
2330
0
{
2331
0
    uint8_t m;
2332
0
    if (OJPEGReadByte(sp, &m) == 0)
2333
0
        return (0);
2334
0
    *word = (m << 8);
2335
0
    if (OJPEGReadByte(sp, &m) == 0)
2336
0
        return (0);
2337
0
    *word |= m;
2338
0
    return (1);
2339
0
}
2340
2341
static int OJPEGReadBlock(OJPEGState *sp, uint16_t len, void *mem)
2342
0
{
2343
0
    uint16_t mlen;
2344
0
    uint8_t *mmem;
2345
0
    uint16_t n;
2346
0
    assert(len > 0);
2347
0
    mlen = len;
2348
0
    mmem = mem;
2349
0
    do
2350
0
    {
2351
0
        if (sp->in_buffer_togo == 0)
2352
0
        {
2353
0
            if (OJPEGReadBufferFill(sp) == 0)
2354
0
                return (0);
2355
0
            assert(sp->in_buffer_togo > 0);
2356
0
        }
2357
0
        n = mlen;
2358
0
        if (n > sp->in_buffer_togo)
2359
0
            n = sp->in_buffer_togo;
2360
0
        _TIFFmemcpy(mmem, sp->in_buffer_cur, n);
2361
0
        sp->in_buffer_cur += n;
2362
0
        sp->in_buffer_togo -= n;
2363
0
        mlen -= n;
2364
0
        mmem += n;
2365
0
    } while (mlen > 0);
2366
0
    return (1);
2367
0
}
2368
2369
static void OJPEGReadSkip(OJPEGState *sp, uint16_t len)
2370
0
{
2371
0
    uint16_t m;
2372
0
    uint16_t n;
2373
0
    m = len;
2374
0
    n = m;
2375
0
    if (n > sp->in_buffer_togo)
2376
0
        n = sp->in_buffer_togo;
2377
0
    sp->in_buffer_cur += n;
2378
0
    sp->in_buffer_togo -= n;
2379
0
    m -= n;
2380
0
    if (m > 0)
2381
0
    {
2382
0
        assert(sp->in_buffer_togo == 0);
2383
0
        n = m;
2384
0
        if ((uint64_t)n > sp->in_buffer_file_togo)
2385
0
            n = (uint16_t)sp->in_buffer_file_togo;
2386
0
        sp->in_buffer_file_pos += n;
2387
0
        sp->in_buffer_file_togo -= n;
2388
0
        sp->in_buffer_file_pos_log = 0;
2389
        /* we don't skip past jpeginterchangeformat/strile block...
2390
         * if that is asked from us, we're dealing with totally bazurk
2391
         * data anyway, and we've not seen this happening on any
2392
         * testfile, so we might as well likely cause some other
2393
         * meaningless error to be passed at some later time
2394
         */
2395
0
    }
2396
0
}
2397
2398
static int OJPEGWriteStream(TIFF *tif, void **mem, uint32_t *len)
2399
0
{
2400
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2401
0
    *len = 0;
2402
0
    do
2403
0
    {
2404
0
        assert(sp->out_state <= ososEoi);
2405
0
        switch (sp->out_state)
2406
0
        {
2407
0
            case ososSoi:
2408
0
                OJPEGWriteStreamSoi(tif, mem, len);
2409
0
                break;
2410
0
            case ososQTable0:
2411
0
                OJPEGWriteStreamQTable(tif, 0, mem, len);
2412
0
                break;
2413
0
            case ososQTable1:
2414
0
                OJPEGWriteStreamQTable(tif, 1, mem, len);
2415
0
                break;
2416
0
            case ososQTable2:
2417
0
                OJPEGWriteStreamQTable(tif, 2, mem, len);
2418
0
                break;
2419
0
            case ososQTable3:
2420
0
                OJPEGWriteStreamQTable(tif, 3, mem, len);
2421
0
                break;
2422
0
            case ososDcTable0:
2423
0
                OJPEGWriteStreamDcTable(tif, 0, mem, len);
2424
0
                break;
2425
0
            case ososDcTable1:
2426
0
                OJPEGWriteStreamDcTable(tif, 1, mem, len);
2427
0
                break;
2428
0
            case ososDcTable2:
2429
0
                OJPEGWriteStreamDcTable(tif, 2, mem, len);
2430
0
                break;
2431
0
            case ososDcTable3:
2432
0
                OJPEGWriteStreamDcTable(tif, 3, mem, len);
2433
0
                break;
2434
0
            case ososAcTable0:
2435
0
                OJPEGWriteStreamAcTable(tif, 0, mem, len);
2436
0
                break;
2437
0
            case ososAcTable1:
2438
0
                OJPEGWriteStreamAcTable(tif, 1, mem, len);
2439
0
                break;
2440
0
            case ososAcTable2:
2441
0
                OJPEGWriteStreamAcTable(tif, 2, mem, len);
2442
0
                break;
2443
0
            case ososAcTable3:
2444
0
                OJPEGWriteStreamAcTable(tif, 3, mem, len);
2445
0
                break;
2446
0
            case ososDri:
2447
0
                OJPEGWriteStreamDri(tif, mem, len);
2448
0
                break;
2449
0
            case ososSof:
2450
0
                OJPEGWriteStreamSof(tif, mem, len);
2451
0
                break;
2452
0
            case ososSos:
2453
0
                OJPEGWriteStreamSos(tif, mem, len);
2454
0
                break;
2455
0
            case ososCompressed:
2456
0
                if (OJPEGWriteStreamCompressed(tif, mem, len) == 0)
2457
0
                    return (0);
2458
0
                break;
2459
0
            case ososRst:
2460
0
                OJPEGWriteStreamRst(tif, mem, len);
2461
0
                break;
2462
0
            case ososEoi:
2463
0
                OJPEGWriteStreamEoi(tif, mem, len);
2464
0
                break;
2465
0
        }
2466
0
    } while (*len == 0);
2467
0
    return (1);
2468
0
}
2469
2470
static void OJPEGWriteStreamSoi(TIFF *tif, void **mem, uint32_t *len)
2471
0
{
2472
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2473
0
    assert(OJPEG_BUFFER >= 2);
2474
0
    sp->out_buffer[0] = 255;
2475
0
    sp->out_buffer[1] = JPEG_MARKER_SOI;
2476
0
    *len = 2;
2477
0
    *mem = (void *)sp->out_buffer;
2478
0
    sp->out_state++;
2479
0
}
2480
2481
static void OJPEGWriteStreamQTable(TIFF *tif, uint8_t table_index, void **mem,
2482
                                   uint32_t *len)
2483
0
{
2484
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2485
0
    if (sp->qtable[table_index] != 0)
2486
0
    {
2487
0
        *mem = (void *)(sp->qtable[table_index] + sizeof(uint32_t));
2488
0
        *len = *((uint32_t *)sp->qtable[table_index]) - sizeof(uint32_t);
2489
0
    }
2490
0
    sp->out_state++;
2491
0
}
2492
2493
static void OJPEGWriteStreamDcTable(TIFF *tif, uint8_t table_index, void **mem,
2494
                                    uint32_t *len)
2495
0
{
2496
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2497
0
    if (sp->dctable[table_index] != 0)
2498
0
    {
2499
0
        *mem = (void *)(sp->dctable[table_index] + sizeof(uint32_t));
2500
0
        *len = *((uint32_t *)sp->dctable[table_index]) - sizeof(uint32_t);
2501
0
    }
2502
0
    sp->out_state++;
2503
0
}
2504
2505
static void OJPEGWriteStreamAcTable(TIFF *tif, uint8_t table_index, void **mem,
2506
                                    uint32_t *len)
2507
0
{
2508
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2509
0
    if (sp->actable[table_index] != 0)
2510
0
    {
2511
0
        *mem = (void *)(sp->actable[table_index] + sizeof(uint32_t));
2512
0
        *len = *((uint32_t *)sp->actable[table_index]) - sizeof(uint32_t);
2513
0
    }
2514
0
    sp->out_state++;
2515
0
}
2516
2517
static void OJPEGWriteStreamDri(TIFF *tif, void **mem, uint32_t *len)
2518
0
{
2519
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2520
0
    assert(OJPEG_BUFFER >= 6);
2521
0
    if (sp->restart_interval != 0)
2522
0
    {
2523
0
        sp->out_buffer[0] = 255;
2524
0
        sp->out_buffer[1] = JPEG_MARKER_DRI;
2525
0
        sp->out_buffer[2] = 0;
2526
0
        sp->out_buffer[3] = 4;
2527
0
        sp->out_buffer[4] = (sp->restart_interval >> 8);
2528
0
        sp->out_buffer[5] = (sp->restart_interval & 255);
2529
0
        *len = 6;
2530
0
        *mem = (void *)sp->out_buffer;
2531
0
    }
2532
0
    sp->out_state++;
2533
0
}
2534
2535
static void OJPEGWriteStreamSof(TIFF *tif, void **mem, uint32_t *len)
2536
0
{
2537
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2538
0
    uint8_t m;
2539
0
    assert(OJPEG_BUFFER >= 2 + 8 + sp->samples_per_pixel_per_plane * 3);
2540
0
    assert(255 >= 8 + sp->samples_per_pixel_per_plane * 3);
2541
0
    sp->out_buffer[0] = 255;
2542
0
    sp->out_buffer[1] = sp->sof_marker_id;
2543
    /* Lf */
2544
0
    sp->out_buffer[2] = 0;
2545
0
    sp->out_buffer[3] = 8 + sp->samples_per_pixel_per_plane * 3;
2546
    /* P */
2547
0
    sp->out_buffer[4] = 8;
2548
    /* Y */
2549
0
    sp->out_buffer[5] = (uint8_t)(sp->sof_y >> 8);
2550
0
    sp->out_buffer[6] = (sp->sof_y & 255);
2551
    /* X */
2552
0
    sp->out_buffer[7] = (uint8_t)(sp->sof_x >> 8);
2553
0
    sp->out_buffer[8] = (sp->sof_x & 255);
2554
    /* Nf */
2555
0
    sp->out_buffer[9] = sp->samples_per_pixel_per_plane;
2556
0
    for (m = 0; m < sp->samples_per_pixel_per_plane; m++)
2557
0
    {
2558
        /* C */
2559
0
        sp->out_buffer[10 + m * 3] = sp->sof_c[sp->plane_sample_offset + m];
2560
        /* H and V */
2561
0
        sp->out_buffer[10 + m * 3 + 1] =
2562
0
            sp->sof_hv[sp->plane_sample_offset + m];
2563
        /* Tq */
2564
0
        sp->out_buffer[10 + m * 3 + 2] =
2565
0
            sp->sof_tq[sp->plane_sample_offset + m];
2566
0
    }
2567
0
    *len = 10 + sp->samples_per_pixel_per_plane * 3;
2568
0
    *mem = (void *)sp->out_buffer;
2569
0
    sp->out_state++;
2570
0
}
2571
2572
static void OJPEGWriteStreamSos(TIFF *tif, void **mem, uint32_t *len)
2573
0
{
2574
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2575
0
    uint8_t m;
2576
0
    assert(OJPEG_BUFFER >= 2 + 6 + sp->samples_per_pixel_per_plane * 2);
2577
0
    assert(255 >= 6 + sp->samples_per_pixel_per_plane * 2);
2578
0
    sp->out_buffer[0] = 255;
2579
0
    sp->out_buffer[1] = JPEG_MARKER_SOS;
2580
    /* Ls */
2581
0
    sp->out_buffer[2] = 0;
2582
0
    sp->out_buffer[3] = 6 + sp->samples_per_pixel_per_plane * 2;
2583
    /* Ns */
2584
0
    sp->out_buffer[4] = sp->samples_per_pixel_per_plane;
2585
0
    for (m = 0; m < sp->samples_per_pixel_per_plane; m++)
2586
0
    {
2587
        /* Cs */
2588
0
        sp->out_buffer[5 + m * 2] = sp->sos_cs[sp->plane_sample_offset + m];
2589
        /* Td and Ta */
2590
0
        sp->out_buffer[5 + m * 2 + 1] =
2591
0
            sp->sos_tda[sp->plane_sample_offset + m];
2592
0
    }
2593
    /* Ss */
2594
0
    sp->out_buffer[5 + sp->samples_per_pixel_per_plane * 2] = 0;
2595
    /* Se */
2596
0
    sp->out_buffer[5 + sp->samples_per_pixel_per_plane * 2 + 1] = 63;
2597
    /* Ah and Al */
2598
0
    sp->out_buffer[5 + sp->samples_per_pixel_per_plane * 2 + 2] = 0;
2599
0
    *len = 8 + sp->samples_per_pixel_per_plane * 2;
2600
0
    *mem = (void *)sp->out_buffer;
2601
0
    sp->out_state++;
2602
0
}
2603
2604
static int OJPEGWriteStreamCompressed(TIFF *tif, void **mem, uint32_t *len)
2605
0
{
2606
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2607
0
    if (sp->in_buffer_togo == 0)
2608
0
    {
2609
0
        if (OJPEGReadBufferFill(sp) == 0)
2610
0
            return (0);
2611
0
        assert(sp->in_buffer_togo > 0);
2612
0
    }
2613
0
    *len = sp->in_buffer_togo;
2614
0
    *mem = (void *)sp->in_buffer_cur;
2615
0
    sp->in_buffer_togo = 0;
2616
0
    if (sp->in_buffer_file_togo == 0)
2617
0
    {
2618
0
        switch (sp->in_buffer_source)
2619
0
        {
2620
0
            case osibsStrile:
2621
0
                if (sp->in_buffer_next_strile < sp->in_buffer_strile_count)
2622
0
                    sp->out_state = ososRst;
2623
0
                else
2624
0
                    sp->out_state = ososEoi;
2625
0
                break;
2626
0
            case osibsEof:
2627
0
                sp->out_state = ososEoi;
2628
0
                break;
2629
0
            default:
2630
0
                break;
2631
0
        }
2632
0
    }
2633
0
    return (1);
2634
0
}
2635
2636
static void OJPEGWriteStreamRst(TIFF *tif, void **mem, uint32_t *len)
2637
0
{
2638
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2639
0
    assert(OJPEG_BUFFER >= 2);
2640
0
    sp->out_buffer[0] = 255;
2641
0
    sp->out_buffer[1] = JPEG_MARKER_RST0 + sp->restart_index;
2642
0
    sp->restart_index++;
2643
0
    if (sp->restart_index == 8)
2644
0
        sp->restart_index = 0;
2645
0
    *len = 2;
2646
0
    *mem = (void *)sp->out_buffer;
2647
0
    sp->out_state = ososCompressed;
2648
0
}
2649
2650
static void OJPEGWriteStreamEoi(TIFF *tif, void **mem, uint32_t *len)
2651
0
{
2652
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2653
0
    assert(OJPEG_BUFFER >= 2);
2654
0
    sp->out_buffer[0] = 255;
2655
0
    sp->out_buffer[1] = JPEG_MARKER_EOI;
2656
0
    *len = 2;
2657
0
    *mem = (void *)sp->out_buffer;
2658
0
}
2659
2660
#ifndef LIBJPEG_ENCAP_EXTERNAL
2661
static int jpeg_create_decompress_encap(OJPEGState *sp,
2662
                                        jpeg_decompress_struct *cinfo)
2663
0
{
2664
0
    if (SETJMP(sp->exit_jmpbuf))
2665
0
        return 0;
2666
0
    else
2667
0
    {
2668
0
        jpeg_create_decompress(cinfo);
2669
0
        return 1;
2670
0
    }
2671
0
}
2672
#endif
2673
2674
#ifndef LIBJPEG_ENCAP_EXTERNAL
2675
static int jpeg_read_header_encap(OJPEGState *sp, jpeg_decompress_struct *cinfo,
2676
                                  uint8_t require_image)
2677
0
{
2678
0
    if (SETJMP(sp->exit_jmpbuf))
2679
0
        return 0;
2680
0
    else
2681
0
    {
2682
0
        jpeg_read_header(cinfo, require_image);
2683
0
        return 1;
2684
0
    }
2685
0
}
2686
#endif
2687
2688
#ifndef LIBJPEG_ENCAP_EXTERNAL
2689
static int jpeg_start_decompress_encap(OJPEGState *sp,
2690
                                       jpeg_decompress_struct *cinfo)
2691
0
{
2692
0
    if (SETJMP(sp->exit_jmpbuf))
2693
0
        return 0;
2694
0
    else
2695
0
    {
2696
0
        jpeg_start_decompress(cinfo);
2697
0
        return 1;
2698
0
    }
2699
0
}
2700
#endif
2701
2702
#ifndef LIBJPEG_ENCAP_EXTERNAL
2703
static int jpeg_read_scanlines_encap(OJPEGState *sp,
2704
                                     jpeg_decompress_struct *cinfo,
2705
                                     void *scanlines, uint32_t max_lines)
2706
0
{
2707
0
    if (SETJMP(sp->exit_jmpbuf))
2708
0
        return 0;
2709
0
    else
2710
0
    {
2711
0
        jpeg_read_scanlines(cinfo, scanlines, max_lines);
2712
0
        return 1;
2713
0
    }
2714
0
}
2715
#endif
2716
2717
#ifndef LIBJPEG_ENCAP_EXTERNAL
2718
static int jpeg_read_raw_data_encap(OJPEGState *sp,
2719
                                    jpeg_decompress_struct *cinfo, void *data,
2720
                                    uint32_t max_lines)
2721
0
{
2722
0
    if (SETJMP(sp->exit_jmpbuf))
2723
0
        return 0;
2724
0
    else
2725
0
    {
2726
0
        jpeg_read_raw_data(cinfo, data, max_lines);
2727
0
        return 1;
2728
0
    }
2729
0
}
2730
#endif
2731
2732
#ifndef LIBJPEG_ENCAP_EXTERNAL
2733
static void jpeg_encap_unwind(TIFF *tif)
2734
0
{
2735
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2736
0
    LONGJMP(sp->exit_jmpbuf, 1);
2737
0
}
2738
#endif
2739
2740
static void OJPEGLibjpegJpegErrorMgrOutputMessage(jpeg_common_struct *cinfo)
2741
0
{
2742
0
    char buffer[JMSG_LENGTH_MAX];
2743
0
    (*cinfo->err->format_message)(cinfo, buffer);
2744
0
    TIFFWarningExtR(((TIFF *)(cinfo->client_data)), "LibJpeg", "%s", buffer);
2745
0
}
2746
2747
static void OJPEGLibjpegJpegErrorMgrErrorExit(jpeg_common_struct *cinfo)
2748
0
{
2749
0
    char buffer[JMSG_LENGTH_MAX];
2750
0
    (*cinfo->err->format_message)(cinfo, buffer);
2751
0
    TIFFErrorExtR(((TIFF *)(cinfo->client_data)), "LibJpeg", "%s", buffer);
2752
0
    jpeg_encap_unwind((TIFF *)(cinfo->client_data));
2753
0
}
2754
2755
static void OJPEGLibjpegJpegSourceMgrInitSource(jpeg_decompress_struct *cinfo)
2756
0
{
2757
0
    (void)cinfo;
2758
0
}
2759
2760
static boolean
2761
OJPEGLibjpegJpegSourceMgrFillInputBuffer(jpeg_decompress_struct *cinfo)
2762
0
{
2763
0
    TIFF *tif = (TIFF *)cinfo->client_data;
2764
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2765
0
    void *mem = 0;
2766
0
    uint32_t len = 0U;
2767
0
    if (OJPEGWriteStream(tif, &mem, &len) == 0)
2768
0
    {
2769
0
        TIFFErrorExtR(tif, "LibJpeg", "Premature end of JPEG data");
2770
0
        jpeg_encap_unwind(tif);
2771
0
    }
2772
0
    sp->libjpeg_jpeg_source_mgr.bytes_in_buffer = len;
2773
0
    sp->libjpeg_jpeg_source_mgr.next_input_byte = mem;
2774
0
    return (1);
2775
0
}
2776
2777
static void
2778
OJPEGLibjpegJpegSourceMgrSkipInputData(jpeg_decompress_struct *cinfo,
2779
                                       long num_bytes)
2780
0
{
2781
0
    TIFF *tif = (TIFF *)cinfo->client_data;
2782
0
    (void)num_bytes;
2783
0
    TIFFErrorExtR(tif, "LibJpeg", "Unexpected error");
2784
0
    jpeg_encap_unwind(tif);
2785
0
}
2786
2787
#ifdef _MSC_VER
2788
#pragma warning(push)
2789
#pragma warning(disable : 4702) /* unreachable code */
2790
#endif
2791
static boolean
2792
OJPEGLibjpegJpegSourceMgrResyncToRestart(jpeg_decompress_struct *cinfo,
2793
                                         int desired)
2794
0
{
2795
0
    TIFF *tif = (TIFF *)cinfo->client_data;
2796
0
    (void)desired;
2797
0
    TIFFErrorExtR(tif, "LibJpeg", "Unexpected error");
2798
0
    jpeg_encap_unwind(tif);
2799
0
    return (0);
2800
0
}
2801
#ifdef _MSC_VER
2802
#pragma warning(pop)
2803
#endif
2804
2805
static void OJPEGLibjpegJpegSourceMgrTermSource(jpeg_decompress_struct *cinfo)
2806
0
{
2807
0
    (void)cinfo;
2808
0
}
2809
2810
#endif