Coverage Report

Created: 2026-07-25 06:50

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/gdal/frmts/gtiff/libtiff/tif_ojpeg.c
Line
Count
Source
1
/* WARNING: The type of JPEG encapsulation defined by the TIFF Version 6.0
2
   specification is now totally obsolete and deprecated for new applications and
3
   images. This file was was created solely in order to read unconverted images
4
   still present on some users' computer systems. It will never be extended
5
   to write such files. Writing new-style JPEG compressed TIFFs is implemented
6
   in tif_jpeg.c.
7
8
   The code is carefully crafted to robustly read all gathered JPEG-in-TIFF
9
   testfiles, and anticipate as much as possible all other... But still, it may
10
   fail on some. If you encounter problems, please report them on the TIFF
11
   mailing list and/or to Joris Van Damme <info@awaresystems.be>.
12
13
   Please read the file called "TIFF Technical Note #2" if you need to be
14
   convinced this compression scheme is bad and breaks TIFF. That document
15
   is linked to from the LibTiff site <http://www.remotesensing.org/libtiff/>
16
   and from AWare Systems' TIFF section
17
   <http://www.awaresystems.be/imaging/tiff.html>. It is also absorbed
18
   in Adobe's specification supplements, marked "draft" up to this day, but
19
   supported by the TIFF community.
20
21
   This file interfaces with Release 6B of the JPEG Library written by the
22
   Independent JPEG Group. Previous versions of this file required a hack inside
23
   the LibJpeg library. This version no longer requires that. Remember to
24
   remove the hack if you update from the old version.
25
26
   Copyright (c) Joris Van Damme <info@awaresystems.be>
27
   Copyright (c) AWare Systems <http://www.awaresystems.be/>
28
29
   The licence agreement for this file is the same as the rest of the LibTiff
30
   library.
31
32
   IN NO EVENT SHALL JORIS VAN DAMME OR AWARE SYSTEMS BE LIABLE FOR
33
   ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND,
34
   OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
35
   WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF
36
   LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
37
   OF THIS SOFTWARE.
38
39
   Joris Van Damme and/or AWare Systems may be available for custom
40
   development. If you like what you see, and need anything similar or related,
41
   contact <info@awaresystems.be>.
42
*/
43
44
/* What is what, and what is not?
45
46
   This decoder starts with an input stream, that is essentially the
47
   JpegInterchangeFormat stream, if any, followed by the strile data, if any.
48
   This stream is read in OJPEGReadByte and related functions.
49
50
   It analyzes the start of this stream, until it encounters non-marker data,
51
   i.e. compressed image data. Some of the header markers it sees have no actual
52
   content, like the SOI marker, and APP/COM markers that really shouldn't even
53
   be there. Some other markers do have content, and the valuable bits and
54
   pieces of information in these markers are saved, checking all to verify that
55
   the stream is more or less within expected bounds. This happens inside the
56
   OJPEGReadHeaderInfoSecStreamXxx functions.
57
58
   Some OJPEG imagery contains no valid JPEG header markers. This situation is
59
   picked up on if we've seen no SOF marker when we're at the start of the
60
   compressed image data. In this case, the tables are read from JpegXxxTables
61
   tags, and the other bits and pieces of information is initialized to its most
62
   basic value. This is implemented in the OJPEGReadHeaderInfoSecTablesXxx
63
   functions.
64
65
   When this is complete, a good and valid JPEG header can be assembled, and
66
   this is passed through to LibJpeg. When that's done, the remainder of the
67
   input stream, i.e. the compressed image data, can be passed through
68
   unchanged. This is done in OJPEGWriteStream functions.
69
70
   LibTiff rightly expects to know the subsampling values before decompression.
71
   Just like in new-style JPEG-in-TIFF, though, or even more so, actually, the
72
   YCbCrsubsampling tag is notoriously unreliable. To correct these tag values
73
   with the ones inside the JPEG stream, the first part of the input stream is
74
   pre-scanned in OJPEGSubsamplingCorrect, making no note of any other data,
75
   reporting no warnings or errors, up to the point where either these values
76
   are read, or it's clear they aren't there. This means that some of the data
77
   is read twice, but we feel speed in correcting these values is important
78
   enough to warrant this sacrifice. Although there is currently no define or
79
   other configuration mechanism to disable this behavior, the actual header
80
   scanning is build to robustly respond with error report if it should
81
   encounter an uncorrected mismatch of subsampling values. See
82
   OJPEGReadHeaderInfoSecStreamSof.
83
84
   The restart interval and restart markers are the most tricky part... The
85
   restart interval can be specified in a tag. It can also be set inside the
86
   input JPEG stream. It can be used inside the input JPEG stream. If reading
87
   from strile data, we've consistently discovered the need to insert restart
88
   markers in between the different striles, as is also probably the most likely
89
   interpretation of the original TIFF 6.0 specification. With all this setting
90
   of interval, and actual use of markers that is not predictable at the time of
91
   valid JPEG header assembly, the restart thing may turn out the Achilles heel
92
   of this implementation. Fortunately, most OJPEG writer vendors succeed in
93
   reading back what they write, which may be the reason why we've been able to
94
   discover ways that seem to work.
95
96
   Some special provision is made for planarconfig separate OJPEG files. These
97
   seem to consistently contain header info, a SOS marker, a plane, SOS marker,
98
   plane, SOS, and plane. This may or may not be a valid JPEG configuration, we
99
   don't know and don't care. We want LibTiff to be able to access the planes
100
   individually, without huge buffering inside LibJpeg, anyway. So we compose
101
   headers to feed to LibJpeg, in this case, that allow us to pass a single
102
   plane such that LibJpeg sees a valid single-channel JPEG stream. Locating
103
   subsequent SOS markers, and thus subsequent planes, is done inside
104
   OJPEGReadSecondarySos.
105
106
   The benefit of the scheme is... that it works, basically. We know of no other
107
   that does. It works without checking software tag, or otherwise going about
108
   things in an OJPEG flavor specific manner. Instead, it is a single scheme,
109
   that covers the cases with and without JpegInterchangeFormat, with and
110
   without striles, with part of the header in JpegInterchangeFormat and
111
   remainder in first strile, etc. It is forgiving and robust, may likely work
112
   with OJPEG flavors we've not seen yet, and makes most out of the data.
113
114
   Another nice side-effect is that a complete JPEG single valid stream is build
115
   if planarconfig is not separate (vast majority). We may one day use that to
116
   build converters to JPEG, and/or to new-style JPEG compression inside TIFF.
117
118
   A disadvantage is the lack of random access to the individual striles. This
119
   is the reason for much of the complicated restart-and-position stuff inside
120
   OJPEGPreDecode. Applications would do well accessing all striles in order, as
121
   this will result in a single sequential scan of the input stream, and no
122
   restarting of LibJpeg decoding session.
123
*/
124
125
#include "tiffiop.h"
126
#ifdef OJPEG_SUPPORT
127
128
/* Configuration defines here are:
129
 * JPEG_ENCAP_EXTERNAL: The normal way to call libjpeg, uses longjump. In some
130
 * environments, like eg LibTiffDelphi, this is not possible. For this reason,
131
 * the actual calls to libjpeg, with longjump stuff, are encapsulated in
132
 * dedicated functions. When JPEG_ENCAP_EXTERNAL is defined, these encapsulating
133
 * functions are declared external to this unit, and can be defined elsewhere to
134
 * use stuff other then longjump. The default mode, without JPEG_ENCAP_EXTERNAL,
135
 * implements the call encapsulators here, internally, with normal longjump.
136
 * SETJMP, LONGJMP, JMP_BUF: On some machines/environments a longjump equivalent
137
 * is conveniently available, but still it may be worthwhile to use _setjmp or
138
 * sigsetjmp in place of plain setjmp. These macros will make it easier. It is
139
 * useless to fiddle with these if you define JPEG_ENCAP_EXTERNAL. OJPEG_BUFFER:
140
 * Define the size of the desired buffer here. Should be small enough so as to
141
 * guarantee instant processing, optimal streaming and optimal use of processor
142
 * cache, but also big enough so as to not result in significant call overhead.
143
 * It should be at least a few bytes to accommodate some structures (this is
144
 * verified in asserts), but it would not be sensible to make it this small
145
 * anyway, and it should be at most 64K since it is indexed with uint16_t. We
146
 * recommend 2K. EGYPTIANWALK: You could also define EGYPTIANWALK here, but it
147
 * is not used anywhere and has absolutely no effect. That is why most people
148
 * insist the EGYPTIANWALK is a bit silly.
149
 */
150
151
/* define LIBJPEG_ENCAP_EXTERNAL */
152
0
#define SETJMP(jbuf) setjmp(jbuf)
153
0
#define LONGJMP(jbuf, code) longjmp(jbuf, code)
154
#define JMP_BUF jmp_buf
155
0
#define OJPEG_BUFFER 2048
156
/* define EGYPTIANWALK */
157
158
0
#define JPEG_MARKER_SOF0 0xC0
159
0
#define JPEG_MARKER_SOF1 0xC1
160
0
#define JPEG_MARKER_SOF3 0xC3
161
0
#define JPEG_MARKER_DHT 0xC4
162
0
#define JPEG_MARKER_RST0 0XD0
163
0
#define JPEG_MARKER_SOI 0xD8
164
0
#define JPEG_MARKER_EOI 0xD9
165
0
#define JPEG_MARKER_SOS 0xDA
166
0
#define JPEG_MARKER_DQT 0xDB
167
0
#define JPEG_MARKER_DRI 0xDD
168
0
#define JPEG_MARKER_APP0 0xE0
169
0
#define JPEG_MARKER_COM 0xFE
170
171
#define FIELD_OJPEG_JPEGINTERCHANGEFORMAT (FIELD_CODEC + 0)
172
#define FIELD_OJPEG_JPEGINTERCHANGEFORMATLENGTH (FIELD_CODEC + 1)
173
#define FIELD_OJPEG_JPEGQTABLES (FIELD_CODEC + 2)
174
#define FIELD_OJPEG_JPEGDCTABLES (FIELD_CODEC + 3)
175
#define FIELD_OJPEG_JPEGACTABLES (FIELD_CODEC + 4)
176
#define FIELD_OJPEG_JPEGPROC (FIELD_CODEC + 5)
177
#define FIELD_OJPEG_JPEGRESTARTINTERVAL (FIELD_CODEC + 6)
178
179
static const TIFFField ojpegFields[] = {
180
    {TIFFTAG_JPEGIFOFFSET, 1, 1, TIFF_LONG8, 0, TIFF_SETGET_UINT64,
181
     FIELD_OJPEG_JPEGINTERCHANGEFORMAT, TRUE, FALSE, "JpegInterchangeFormat",
182
     NULL},
183
    {TIFFTAG_JPEGIFBYTECOUNT, 1, 1, TIFF_LONG8, 0, TIFF_SETGET_UINT64,
184
     FIELD_OJPEG_JPEGINTERCHANGEFORMATLENGTH, TRUE, FALSE,
185
     "JpegInterchangeFormatLength", NULL},
186
    {TIFFTAG_JPEGQTABLES, TIFF_VARIABLE2, TIFF_VARIABLE2, TIFF_LONG8, 0,
187
     TIFF_SETGET_C32_UINT64, FIELD_OJPEG_JPEGQTABLES, FALSE, TRUE,
188
     "JpegQTables", NULL},
189
    {TIFFTAG_JPEGDCTABLES, TIFF_VARIABLE2, TIFF_VARIABLE2, TIFF_LONG8, 0,
190
     TIFF_SETGET_C32_UINT64, FIELD_OJPEG_JPEGDCTABLES, FALSE, TRUE,
191
     "JpegDcTables", NULL},
192
    {TIFFTAG_JPEGACTABLES, TIFF_VARIABLE2, TIFF_VARIABLE2, TIFF_LONG8, 0,
193
     TIFF_SETGET_C32_UINT64, FIELD_OJPEG_JPEGACTABLES, FALSE, TRUE,
194
     "JpegAcTables", NULL},
195
    {TIFFTAG_JPEGPROC, 1, 1, TIFF_SHORT, 0, TIFF_SETGET_UINT16,
196
     FIELD_OJPEG_JPEGPROC, FALSE, FALSE, "JpegProc", NULL},
197
    {TIFFTAG_JPEGRESTARTINTERVAL, 1, 1, TIFF_SHORT, 0, TIFF_SETGET_UINT16,
198
     FIELD_OJPEG_JPEGRESTARTINTERVAL, FALSE, FALSE, "JpegRestartInterval",
199
     NULL},
200
};
201
202
#ifndef LIBJPEG_ENCAP_EXTERNAL
203
#include <setjmp.h>
204
#endif
205
206
#include "jerror.h"
207
#include "jpeglib.h"
208
209
typedef struct jpeg_source_mgr tiff_ojpeg_source_mgr;
210
211
typedef struct jpeg_error_mgr tiff_ojpeg_error_mgr;
212
213
typedef struct jpeg_common_struct tiff_ojpeg_common_struct;
214
typedef struct jpeg_decompress_struct tiff_ojpeg_decompress_struct;
215
216
typedef enum
217
{
218
    osibsNotSetYet,
219
    osibsJpegInterchangeFormat,
220
    osibsStrile,
221
    osibsEof
222
} OJPEGStateInBufferSource;
223
224
typedef enum
225
{
226
    ososSoi,
227
    ososQTable0,
228
    ososQTable1,
229
    ososQTable2,
230
    ososQTable3,
231
    ososDcTable0,
232
    ososDcTable1,
233
    ososDcTable2,
234
    ososDcTable3,
235
    ososAcTable0,
236
    ososAcTable1,
237
    ososAcTable2,
238
    ososAcTable3,
239
    ososDri,
240
    ososSof,
241
    ososSos,
242
    ososCompressed,
243
    ososRst,
244
    ososEoi
245
} OJPEGStateOutState;
246
247
typedef struct
248
{
249
    TIFF *tif;
250
    int decoder_ok;
251
    int error_in_raw_data_decoding;
252
#ifndef LIBJPEG_ENCAP_EXTERNAL
253
    JMP_BUF exit_jmpbuf;
254
#endif
255
    TIFFVGetMethod vgetparent;
256
    TIFFVSetMethod vsetparent;
257
    TIFFPrintMethod printdir;
258
    uint64_t file_size;
259
    uint32_t image_width;
260
    uint32_t image_length;
261
    uint32_t strile_width;
262
    uint32_t strile_length;
263
    uint32_t strile_length_total;
264
    uint8_t samples_per_pixel;
265
    uint8_t plane_sample_offset;
266
    uint8_t samples_per_pixel_per_plane;
267
    uint64_t jpeg_interchange_format;
268
    uint64_t jpeg_interchange_format_length;
269
    uint8_t jpeg_proc;
270
    uint8_t subsamplingcorrect;
271
    uint8_t subsamplingcorrect_done;
272
    uint8_t subsampling_tag;
273
    uint8_t subsampling_hor;
274
    uint8_t subsampling_ver;
275
    uint8_t subsampling_force_desubsampling_inside_decompression;
276
    uint8_t qtable_offset_count;
277
    uint8_t dctable_offset_count;
278
    uint8_t actable_offset_count;
279
    uint64_t qtable_offset[3];
280
    uint64_t dctable_offset[3];
281
    uint64_t actable_offset[3];
282
    uint8_t *qtable[4];
283
    uint8_t *dctable[4];
284
    uint8_t *actable[4];
285
    uint16_t restart_interval;
286
    uint8_t restart_index;
287
    uint8_t sof_log;
288
    uint8_t sof_marker_id;
289
    uint32_t sof_x;
290
    uint32_t sof_y;
291
    uint8_t sof_c[3];
292
    uint8_t sof_hv[3];
293
    uint8_t sof_tq[3];
294
    uint8_t sos_cs[3];
295
    uint8_t sos_tda[3];
296
    struct
297
    {
298
        uint8_t log;
299
        OJPEGStateInBufferSource in_buffer_source;
300
        uint32_t in_buffer_next_strile;
301
        uint64_t in_buffer_file_pos;
302
        uint64_t in_buffer_file_togo;
303
    } sos_end[3];
304
    uint8_t readheader_done;
305
    uint8_t writeheader_done;
306
    uint16_t write_cursample;
307
    uint32_t write_curstrile;
308
    uint8_t libjpeg_session_active;
309
    uint8_t libjpeg_jpeg_query_style;
310
    tiff_ojpeg_error_mgr libjpeg_jpeg_error_mgr;
311
    tiff_ojpeg_decompress_struct libjpeg_jpeg_decompress_struct;
312
    tiff_ojpeg_source_mgr libjpeg_jpeg_source_mgr;
313
    uint8_t subsampling_convert_log;
314
    uint32_t subsampling_convert_ylinelen;
315
    uint32_t subsampling_convert_ylines;
316
    uint32_t subsampling_convert_clinelen;
317
    uint32_t subsampling_convert_clines;
318
    uint32_t subsampling_convert_ybuflen;
319
    uint32_t subsampling_convert_cbuflen;
320
    uint32_t subsampling_convert_ycbcrbuflen;
321
    uint8_t *subsampling_convert_ycbcrbuf;
322
    uint8_t *subsampling_convert_ybuf;
323
    uint8_t *subsampling_convert_cbbuf;
324
    uint8_t *subsampling_convert_crbuf;
325
    uint32_t subsampling_convert_ycbcrimagelen;
326
    uint8_t **subsampling_convert_ycbcrimage;
327
    uint32_t subsampling_convert_clinelenout;
328
    uint32_t subsampling_convert_state;
329
    uint32_t bytes_per_line;   /* if the codec outputs subsampled data, a 'line'
330
                                  in bytes_per_line */
331
    uint32_t lines_per_strile; /* and lines_per_strile means subsampling_ver
332
                                  desubsampled rows     */
333
    OJPEGStateInBufferSource in_buffer_source;
334
    uint32_t in_buffer_next_strile;
335
    uint32_t in_buffer_strile_count;
336
    uint64_t in_buffer_file_pos;
337
    uint8_t in_buffer_file_pos_log;
338
    uint64_t in_buffer_file_togo;
339
    uint16_t in_buffer_togo;
340
    uint8_t *in_buffer_cur;
341
    uint8_t in_buffer[OJPEG_BUFFER];
342
    OJPEGStateOutState out_state;
343
    uint8_t out_buffer[OJPEG_BUFFER];
344
    uint8_t *skip_buffer;
345
} OJPEGState;
346
347
static int OJPEGVGetField(TIFF *tif, uint32_t tag, va_list ap);
348
static int OJPEGVSetField(TIFF *tif, uint32_t tag, va_list ap);
349
static void OJPEGPrintDir(TIFF *tif, FILE *fd, long flags);
350
351
static int OJPEGFixupTags(TIFF *tif);
352
static int OJPEGSetupDecode(TIFF *tif);
353
static int OJPEGPreDecode(TIFF *tif, uint16_t s);
354
static int OJPEGPreDecodeSkipRaw(TIFF *tif);
355
static int OJPEGPreDecodeSkipScanlines(TIFF *tif);
356
static int OJPEGDecode(TIFF *tif, uint8_t *buf, tmsize_t cc, uint16_t s);
357
static int OJPEGDecodeRaw(TIFF *tif, uint8_t *buf, tmsize_t cc);
358
static int OJPEGDecodeScanlines(TIFF *tif, uint8_t *buf, tmsize_t cc);
359
static void OJPEGPostDecode(TIFF *tif, uint8_t *buf, tmsize_t cc);
360
static int OJPEGSetupEncode(TIFF *tif);
361
static int OJPEGPreEncode(TIFF *tif, uint16_t s);
362
static int OJPEGEncode(TIFF *tif, uint8_t *buf, tmsize_t cc, uint16_t s);
363
static int OJPEGPostEncode(TIFF *tif);
364
static void OJPEGCleanup(TIFF *tif);
365
366
static void OJPEGSubsamplingCorrect(TIFF *tif);
367
static int OJPEGReadHeaderInfo(TIFF *tif);
368
static int OJPEGReadSecondarySos(TIFF *tif, uint16_t s);
369
static int OJPEGWriteHeaderInfo(TIFF *tif);
370
static void OJPEGLibjpegSessionAbort(TIFF *tif);
371
372
static int OJPEGReadHeaderInfoSec(TIFF *tif);
373
static int OJPEGReadHeaderInfoSecStreamDri(TIFF *tif);
374
static int OJPEGReadHeaderInfoSecStreamDqt(TIFF *tif);
375
static int OJPEGReadHeaderInfoSecStreamDht(TIFF *tif);
376
static int OJPEGReadHeaderInfoSecStreamSof(TIFF *tif, uint8_t marker_id);
377
static int OJPEGReadHeaderInfoSecStreamSos(TIFF *tif);
378
static int OJPEGReadHeaderInfoSecTablesQTable(TIFF *tif);
379
static int OJPEGReadHeaderInfoSecTablesDcTable(TIFF *tif);
380
static int OJPEGReadHeaderInfoSecTablesAcTable(TIFF *tif);
381
382
static int OJPEGReadBufferFill(OJPEGState *sp);
383
static int OJPEGReadByte(OJPEGState *sp, uint8_t *byte);
384
static int OJPEGReadBytePeek(OJPEGState *sp, uint8_t *byte);
385
static void OJPEGReadByteAdvance(OJPEGState *sp);
386
static int OJPEGReadWord(OJPEGState *sp, uint16_t *word);
387
static int OJPEGReadBlock(OJPEGState *sp, uint16_t len, void *mem);
388
static void OJPEGReadSkip(OJPEGState *sp, uint16_t len);
389
390
static int OJPEGWriteStream(TIFF *tif, void **mem, uint32_t *len);
391
static void OJPEGWriteStreamSoi(TIFF *tif, void **mem, uint32_t *len);
392
static void OJPEGWriteStreamQTable(TIFF *tif, uint8_t table_index, void **mem,
393
                                   uint32_t *len);
394
static void OJPEGWriteStreamDcTable(TIFF *tif, uint8_t table_index, void **mem,
395
                                    uint32_t *len);
396
static void OJPEGWriteStreamAcTable(TIFF *tif, uint8_t table_index, void **mem,
397
                                    uint32_t *len);
398
static void OJPEGWriteStreamDri(TIFF *tif, void **mem, uint32_t *len);
399
static void OJPEGWriteStreamSof(TIFF *tif, void **mem, uint32_t *len);
400
static void OJPEGWriteStreamSos(TIFF *tif, void **mem, uint32_t *len);
401
static int OJPEGWriteStreamCompressed(TIFF *tif, void **mem, uint32_t *len);
402
static void OJPEGWriteStreamRst(TIFF *tif, void **mem, uint32_t *len);
403
static void OJPEGWriteStreamEoi(TIFF *tif, void **mem, uint32_t *len);
404
405
#ifdef LIBJPEG_ENCAP_EXTERNAL
406
extern int jpeg_create_decompress_encap(OJPEGState *sp,
407
                                        tiff_ojpeg_decompress_struct *cinfo);
408
extern int jpeg_read_header_encap(OJPEGState *sp,
409
                                  tiff_ojpeg_decompress_struct *cinfo,
410
                                  uint8_t require_image);
411
extern int jpeg_start_decompress_encap(OJPEGState *sp,
412
                                       tiff_ojpeg_decompress_struct *cinfo);
413
extern int jpeg_read_scanlines_encap(OJPEGState *sp,
414
                                     tiff_ojpeg_decompress_struct *cinfo,
415
                                     void *scanlines, uint32_t max_lines);
416
extern int jpeg_read_raw_data_encap(OJPEGState *sp,
417
                                    tiff_ojpeg_decompress_struct *cinfo,
418
                                    void *data, uint32_t max_lines);
419
extern void jpeg_encap_unwind(TIFF *tif);
420
#else
421
static int jpeg_create_decompress_encap(OJPEGState *sp,
422
                                        tiff_ojpeg_decompress_struct *j);
423
static int jpeg_read_header_encap(OJPEGState *sp,
424
                                  tiff_ojpeg_decompress_struct *cinfo,
425
                                  uint8_t require_image);
426
static int jpeg_start_decompress_encap(OJPEGState *sp,
427
                                       tiff_ojpeg_decompress_struct *cinfo);
428
static int jpeg_read_scanlines_encap(OJPEGState *sp,
429
                                     tiff_ojpeg_decompress_struct *cinfo,
430
                                     void *scanlines, uint32_t max_lines);
431
static int jpeg_read_raw_data_encap(OJPEGState *sp,
432
                                    tiff_ojpeg_decompress_struct *cinfo,
433
                                    void *data, uint32_t max_lines);
434
static void jpeg_encap_unwind(TIFF *tif);
435
#endif
436
437
static void
438
OJPEGLibjpegJpegErrorMgrOutputMessage(tiff_ojpeg_common_struct *cinfo);
439
static void OJPEGLibjpegJpegErrorMgrErrorExit(tiff_ojpeg_common_struct *cinfo);
440
static void
441
OJPEGLibjpegJpegSourceMgrInitSource(tiff_ojpeg_decompress_struct *cinfo);
442
static boolean
443
OJPEGLibjpegJpegSourceMgrFillInputBuffer(tiff_ojpeg_decompress_struct *cinfo);
444
static void
445
OJPEGLibjpegJpegSourceMgrSkipInputData(tiff_ojpeg_decompress_struct *cinfo,
446
                                       long num_bytes);
447
static boolean
448
OJPEGLibjpegJpegSourceMgrResyncToRestart(tiff_ojpeg_decompress_struct *cinfo,
449
                                         int desired);
450
static void
451
OJPEGLibjpegJpegSourceMgrTermSource(tiff_ojpeg_decompress_struct *cinfo);
452
453
int TIFFInitOJPEG(TIFF *tif, int scheme)
454
0
{
455
0
    static const char module[] = "TIFFInitOJPEG";
456
0
    OJPEGState *sp;
457
458
0
    (void)scheme;
459
0
    assert(scheme == COMPRESSION_OJPEG);
460
461
    /*
462
     * Merge codec-specific tag information.
463
     */
464
0
    if (!_TIFFMergeFields(tif, ojpegFields, TIFFArrayCount(ojpegFields)))
465
0
    {
466
0
        TIFFErrorExtR(tif, module,
467
0
                      "Merging Old JPEG codec-specific tags failed");
468
0
        return 0;
469
0
    }
470
471
    /* state block */
472
0
    sp = (OJPEGState *)_TIFFmallocExt(tif, sizeof(OJPEGState));
473
0
    if (sp == NULL)
474
0
    {
475
0
        TIFFErrorExtR(tif, module, "No space for OJPEG state block");
476
0
        return (0);
477
0
    }
478
0
    _TIFFmemset(sp, 0, sizeof(OJPEGState));
479
0
    sp->tif = tif;
480
0
    sp->jpeg_proc = 1;
481
0
    sp->subsampling_hor = 2;
482
0
    sp->subsampling_ver = 2;
483
0
    TIFFSetField(tif, TIFFTAG_YCBCRSUBSAMPLING, 2, 2);
484
    /* tif codec methods */
485
0
    tif->tif_fixuptags = OJPEGFixupTags;
486
0
    tif->tif_setupdecode = OJPEGSetupDecode;
487
0
    tif->tif_predecode = OJPEGPreDecode;
488
0
    tif->tif_postdecode = OJPEGPostDecode;
489
0
    tif->tif_decoderow = OJPEGDecode;
490
0
    tif->tif_decodestrip = OJPEGDecode;
491
0
    tif->tif_decodetile = OJPEGDecode;
492
0
    tif->tif_setupencode = OJPEGSetupEncode;
493
0
    tif->tif_preencode = OJPEGPreEncode;
494
0
    tif->tif_postencode = OJPEGPostEncode;
495
0
    tif->tif_encoderow = OJPEGEncode;
496
0
    tif->tif_encodestrip = OJPEGEncode;
497
0
    tif->tif_encodetile = OJPEGEncode;
498
0
    tif->tif_cleanup = OJPEGCleanup;
499
0
    tif->tif_data = (uint8_t *)sp;
500
    /* tif tag methods */
501
0
    sp->vgetparent = tif->tif_tagmethods.vgetfield;
502
0
    tif->tif_tagmethods.vgetfield = OJPEGVGetField;
503
0
    sp->vsetparent = tif->tif_tagmethods.vsetfield;
504
0
    tif->tif_tagmethods.vsetfield = OJPEGVSetField;
505
0
    sp->printdir = tif->tif_tagmethods.printdir;
506
0
    tif->tif_tagmethods.printdir = OJPEGPrintDir;
507
    /* Some OJPEG files don't have strip or tile offsets or bytecounts tags.
508
       Some others do, but have totally meaningless or corrupt values
509
       in these tags. In these cases, the JpegInterchangeFormat stream is
510
       reliable. In any case, this decoder reads the compressed data itself,
511
       from the most reliable locations, and we need to notify encapsulating
512
       LibTiff not to read raw strips or tiles for us. */
513
0
    tif->tif_flags |= TIFF_NOREADRAW;
514
0
    return (1);
515
0
}
516
517
static int OJPEGVGetField(TIFF *tif, uint32_t tag, va_list ap)
518
0
{
519
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
520
0
    switch (tag)
521
0
    {
522
0
        case TIFFTAG_JPEGIFOFFSET:
523
0
            *va_arg(ap, uint64_t *) = (uint64_t)sp->jpeg_interchange_format;
524
0
            break;
525
0
        case TIFFTAG_JPEGIFBYTECOUNT:
526
0
            *va_arg(ap, uint64_t *) =
527
0
                (uint64_t)sp->jpeg_interchange_format_length;
528
0
            break;
529
0
        case TIFFTAG_YCBCRSUBSAMPLING:
530
0
            if (sp->subsamplingcorrect_done == 0)
531
0
                OJPEGSubsamplingCorrect(tif);
532
0
            *va_arg(ap, uint16_t *) = (uint16_t)sp->subsampling_hor;
533
0
            *va_arg(ap, uint16_t *) = (uint16_t)sp->subsampling_ver;
534
0
            break;
535
0
        case TIFFTAG_JPEGQTABLES:
536
0
            *va_arg(ap, uint32_t *) = (uint32_t)sp->qtable_offset_count;
537
0
            *va_arg(ap, const void **) = (const void *)sp->qtable_offset;
538
0
            break;
539
0
        case TIFFTAG_JPEGDCTABLES:
540
0
            *va_arg(ap, uint32_t *) = (uint32_t)sp->dctable_offset_count;
541
0
            *va_arg(ap, const void **) = (const void *)sp->dctable_offset;
542
0
            break;
543
0
        case TIFFTAG_JPEGACTABLES:
544
0
            *va_arg(ap, uint32_t *) = (uint32_t)sp->actable_offset_count;
545
0
            *va_arg(ap, const void **) = (const void *)sp->actable_offset;
546
0
            break;
547
0
        case TIFFTAG_JPEGPROC:
548
0
            *va_arg(ap, uint16_t *) = (uint16_t)sp->jpeg_proc;
549
0
            break;
550
0
        case TIFFTAG_JPEGRESTARTINTERVAL:
551
0
            *va_arg(ap, uint16_t *) = sp->restart_interval;
552
0
            break;
553
0
        default:
554
0
            return (*sp->vgetparent)(tif, tag, ap);
555
0
    }
556
0
    return (1);
557
0
}
558
559
static int OJPEGVSetField(TIFF *tif, uint32_t tag, va_list ap)
560
0
{
561
0
    static const char module[] = "OJPEGVSetField";
562
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
563
0
    uint32_t ma;
564
0
    uint64_t *mb;
565
0
    uint32_t n;
566
0
    const TIFFField *fip;
567
568
0
    switch (tag)
569
0
    {
570
0
        case TIFFTAG_JPEGIFOFFSET:
571
0
            sp->jpeg_interchange_format = (uint64_t)va_arg(ap, uint64_t);
572
0
            break;
573
0
        case TIFFTAG_JPEGIFBYTECOUNT:
574
0
            sp->jpeg_interchange_format_length = (uint64_t)va_arg(ap, uint64_t);
575
0
            break;
576
0
        case TIFFTAG_YCBCRSUBSAMPLING:
577
0
            sp->subsampling_tag = 1;
578
0
            sp->subsampling_hor = (uint8_t)va_arg(ap, uint16_vap);
579
0
            sp->subsampling_ver = (uint8_t)va_arg(ap, uint16_vap);
580
0
            tif->tif_dir.td_ycbcrsubsampling[0] = sp->subsampling_hor;
581
0
            tif->tif_dir.td_ycbcrsubsampling[1] = sp->subsampling_ver;
582
0
            break;
583
0
        case TIFFTAG_JPEGQTABLES:
584
0
            ma = (uint32_t)va_arg(ap, uint32_t);
585
0
            if (ma != 0)
586
0
            {
587
0
                if (ma > 3)
588
0
                {
589
0
                    TIFFErrorExtR(tif, module,
590
0
                                  "JpegQTables tag has incorrect count");
591
0
                    return (0);
592
0
                }
593
0
                sp->qtable_offset_count = (uint8_t)ma;
594
0
                mb = (uint64_t *)va_arg(ap, uint64_t *);
595
0
                for (n = 0; n < ma; n++)
596
0
                    sp->qtable_offset[n] = mb[n];
597
0
            }
598
0
            break;
599
0
        case TIFFTAG_JPEGDCTABLES:
600
0
            ma = (uint32_t)va_arg(ap, uint32_t);
601
0
            if (ma != 0)
602
0
            {
603
0
                if (ma > 3)
604
0
                {
605
0
                    TIFFErrorExtR(tif, module,
606
0
                                  "JpegDcTables tag has incorrect count");
607
0
                    return (0);
608
0
                }
609
0
                sp->dctable_offset_count = (uint8_t)ma;
610
0
                mb = (uint64_t *)va_arg(ap, uint64_t *);
611
0
                for (n = 0; n < ma; n++)
612
0
                    sp->dctable_offset[n] = mb[n];
613
0
            }
614
0
            break;
615
0
        case TIFFTAG_JPEGACTABLES:
616
0
            ma = (uint32_t)va_arg(ap, uint32_t);
617
0
            if (ma != 0)
618
0
            {
619
0
                if (ma > 3)
620
0
                {
621
0
                    TIFFErrorExtR(tif, module,
622
0
                                  "JpegAcTables tag has incorrect count");
623
0
                    return (0);
624
0
                }
625
0
                sp->actable_offset_count = (uint8_t)ma;
626
0
                mb = (uint64_t *)va_arg(ap, uint64_t *);
627
0
                for (n = 0; n < ma; n++)
628
0
                    sp->actable_offset[n] = mb[n];
629
0
            }
630
0
            break;
631
0
        case TIFFTAG_JPEGPROC:
632
0
            sp->jpeg_proc = (uint8_t)va_arg(ap, uint16_vap);
633
0
            break;
634
0
        case TIFFTAG_JPEGRESTARTINTERVAL:
635
0
            sp->restart_interval = (uint16_t)va_arg(ap, uint16_vap);
636
0
            break;
637
0
        default:
638
0
            return (*sp->vsetparent)(tif, tag, ap);
639
0
    }
640
0
    fip = TIFFFieldWithTag(tif, tag);
641
0
    if (fip == NULL) /* shouldn't happen */
642
0
        return (0);
643
0
    TIFFSetFieldBit(tif, fip->field_bit);
644
0
    tif->tif_flags |= TIFF_DIRTYDIRECT;
645
0
    return (1);
646
0
}
647
648
static void OJPEGPrintDir(TIFF *tif, FILE *fd, long flags)
649
0
{
650
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
651
0
    uint8_t m;
652
0
    (void)flags;
653
0
    assert(sp != NULL);
654
0
    if (TIFFFieldSet(tif, FIELD_OJPEG_JPEGINTERCHANGEFORMAT))
655
0
        fprintf(fd, "  JpegInterchangeFormat: %" PRIu64 "\n",
656
0
                (uint64_t)sp->jpeg_interchange_format);
657
0
    if (TIFFFieldSet(tif, FIELD_OJPEG_JPEGINTERCHANGEFORMATLENGTH))
658
0
        fprintf(fd, "  JpegInterchangeFormatLength: %" PRIu64 "\n",
659
0
                (uint64_t)sp->jpeg_interchange_format_length);
660
0
    if (TIFFFieldSet(tif, FIELD_OJPEG_JPEGQTABLES))
661
0
    {
662
0
        fprintf(fd, "  JpegQTables:");
663
0
        for (m = 0; m < sp->qtable_offset_count; m++)
664
0
            fprintf(fd, " %" PRIu64, (uint64_t)sp->qtable_offset[m]);
665
0
        fprintf(fd, "\n");
666
0
    }
667
0
    if (TIFFFieldSet(tif, FIELD_OJPEG_JPEGDCTABLES))
668
0
    {
669
0
        fprintf(fd, "  JpegDcTables:");
670
0
        for (m = 0; m < sp->dctable_offset_count; m++)
671
0
            fprintf(fd, " %" PRIu64, (uint64_t)sp->dctable_offset[m]);
672
0
        fprintf(fd, "\n");
673
0
    }
674
0
    if (TIFFFieldSet(tif, FIELD_OJPEG_JPEGACTABLES))
675
0
    {
676
0
        fprintf(fd, "  JpegAcTables:");
677
0
        for (m = 0; m < sp->actable_offset_count; m++)
678
0
            fprintf(fd, " %" PRIu64, (uint64_t)sp->actable_offset[m]);
679
0
        fprintf(fd, "\n");
680
0
    }
681
0
    if (TIFFFieldSet(tif, FIELD_OJPEG_JPEGPROC))
682
0
        fprintf(fd, "  JpegProc: %" PRIu8 "\n", sp->jpeg_proc);
683
0
    if (TIFFFieldSet(tif, FIELD_OJPEG_JPEGRESTARTINTERVAL))
684
0
        fprintf(fd, "  JpegRestartInterval: %" PRIu16 "\n",
685
0
                sp->restart_interval);
686
0
    if (sp->printdir)
687
0
        (*sp->printdir)(tif, fd, flags);
688
0
}
689
690
static int OJPEGFixupTags(TIFF *tif)
691
0
{
692
0
    (void)tif;
693
0
    return (1);
694
0
}
695
696
static int OJPEGSetupDecode(TIFF *tif)
697
0
{
698
0
    static const char module[] = "OJPEGSetupDecode";
699
0
    TIFFWarningExtR(tif, module,
700
0
                    "Deprecated and troublesome old-style JPEG compression "
701
0
                    "mode, please convert to new-style JPEG compression and "
702
0
                    "notify vendor of writing software");
703
0
    return (1);
704
0
}
705
706
static int OJPEGPreDecode(TIFF *tif, uint16_t s)
707
0
{
708
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
709
0
    uint32_t m;
710
0
    if (sp->subsamplingcorrect_done == 0)
711
0
        OJPEGSubsamplingCorrect(tif);
712
0
    if (sp->readheader_done == 0)
713
0
    {
714
0
        if (OJPEGReadHeaderInfo(tif) == 0)
715
0
            return (0);
716
0
    }
717
0
    if (sp->sos_end[s].log == 0)
718
0
    {
719
0
        if (OJPEGReadSecondarySos(tif, s) == 0)
720
0
            return (0);
721
0
    }
722
0
    if (isTiled(tif))
723
0
        m = tif->tif_dir.td_curtile;
724
0
    else
725
0
        m = tif->tif_dir.td_curstrip;
726
0
    if ((sp->writeheader_done != 0) &&
727
0
        ((sp->write_cursample != s) || (sp->write_curstrile > m)))
728
0
    {
729
0
        if (sp->libjpeg_session_active != 0)
730
0
            OJPEGLibjpegSessionAbort(tif);
731
0
        sp->writeheader_done = 0;
732
0
    }
733
0
    if (sp->writeheader_done == 0)
734
0
    {
735
0
        sp->plane_sample_offset = (uint8_t)s;
736
0
        sp->write_cursample = s;
737
0
        sp->write_curstrile = s * tif->tif_dir.td_stripsperimage;
738
0
        if ((sp->in_buffer_file_pos_log == 0) ||
739
0
            (sp->in_buffer_file_pos - sp->in_buffer_togo !=
740
0
             sp->sos_end[s].in_buffer_file_pos))
741
0
        {
742
0
            sp->in_buffer_source = sp->sos_end[s].in_buffer_source;
743
0
            sp->in_buffer_next_strile = sp->sos_end[s].in_buffer_next_strile;
744
0
            sp->in_buffer_file_pos = sp->sos_end[s].in_buffer_file_pos;
745
0
            sp->in_buffer_file_pos_log = 0;
746
0
            sp->in_buffer_file_togo = sp->sos_end[s].in_buffer_file_togo;
747
0
            sp->in_buffer_togo = 0;
748
0
            sp->in_buffer_cur = 0;
749
0
        }
750
0
        if (OJPEGWriteHeaderInfo(tif) == 0)
751
0
            return (0);
752
0
    }
753
754
0
    sp->subsampling_convert_state = 0;
755
756
0
    while (sp->write_curstrile < m)
757
0
    {
758
0
        if (sp->libjpeg_jpeg_query_style == 0)
759
0
        {
760
0
            if (OJPEGPreDecodeSkipRaw(tif) == 0)
761
0
                return (0);
762
0
        }
763
0
        else
764
0
        {
765
0
            if (OJPEGPreDecodeSkipScanlines(tif) == 0)
766
0
                return (0);
767
0
        }
768
0
        sp->write_curstrile++;
769
0
    }
770
0
    sp->decoder_ok = 1;
771
0
    return (1);
772
0
}
773
774
static int OJPEGPreDecodeSkipRaw(TIFF *tif)
775
0
{
776
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
777
0
    uint32_t m;
778
0
    m = sp->lines_per_strile;
779
0
    if (sp->subsampling_convert_state != 0)
780
0
    {
781
0
        if (sp->subsampling_convert_clines - sp->subsampling_convert_state >= m)
782
0
        {
783
0
            sp->subsampling_convert_state += m;
784
0
            if (sp->subsampling_convert_state == sp->subsampling_convert_clines)
785
0
                sp->subsampling_convert_state = 0;
786
0
            return (1);
787
0
        }
788
0
        m -= sp->subsampling_convert_clines - sp->subsampling_convert_state;
789
0
        sp->subsampling_convert_state = 0;
790
0
        sp->error_in_raw_data_decoding = 0;
791
0
    }
792
0
    while (m >= sp->subsampling_convert_clines)
793
0
    {
794
0
        if (jpeg_read_raw_data_encap(sp, &(sp->libjpeg_jpeg_decompress_struct),
795
0
                                     sp->subsampling_convert_ycbcrimage,
796
0
                                     (uint32_t)sp->subsampling_ver * 8) == 0)
797
0
            return (0);
798
0
        m -= sp->subsampling_convert_clines;
799
0
    }
800
0
    if (m > 0)
801
0
    {
802
0
        if (jpeg_read_raw_data_encap(sp, &(sp->libjpeg_jpeg_decompress_struct),
803
0
                                     sp->subsampling_convert_ycbcrimage,
804
0
                                     (uint32_t)sp->subsampling_ver * 8) == 0)
805
0
            return (0);
806
0
        sp->subsampling_convert_state = m;
807
0
    }
808
0
    return (1);
809
0
}
810
811
static int OJPEGPreDecodeSkipScanlines(TIFF *tif)
812
0
{
813
0
    static const char module[] = "OJPEGPreDecodeSkipScanlines";
814
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
815
0
    uint32_t m;
816
0
    if (sp->skip_buffer == NULL)
817
0
    {
818
0
        sp->skip_buffer = (uint8_t *)_TIFFmallocExt(tif, sp->bytes_per_line);
819
0
        if (sp->skip_buffer == NULL)
820
0
        {
821
0
            TIFFErrorExtR(tif, module, "Out of memory");
822
0
            return (0);
823
0
        }
824
0
    }
825
0
    for (m = 0; m < sp->lines_per_strile; m++)
826
0
    {
827
0
        if (jpeg_read_scanlines_encap(sp, &(sp->libjpeg_jpeg_decompress_struct),
828
0
                                      &sp->skip_buffer, 1) == 0)
829
0
            return (0);
830
0
    }
831
0
    return (1);
832
0
}
833
834
static int OJPEGDecode(TIFF *tif, uint8_t *buf, tmsize_t cc, uint16_t s)
835
0
{
836
0
    static const char module[] = "OJPEGDecode";
837
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
838
0
    (void)s;
839
0
    if (!sp->decoder_ok)
840
0
    {
841
0
        memset(buf, 0, (size_t)cc);
842
0
        TIFFErrorExtR(tif, module,
843
0
                      "Cannot decode: decoder not correctly initialized");
844
0
        return 0;
845
0
    }
846
0
    if (sp->libjpeg_session_active == 0)
847
0
    {
848
0
        memset(buf, 0, (size_t)cc);
849
        /* This should normally not happen, except that it does when */
850
        /* using TIFFReadScanline() which calls OJPEGPostDecode() for */
851
        /* each scanline, which assumes that a whole strile was read */
852
        /* and may thus incorrectly consider it has read the whole image,
853
         * causing */
854
        /* OJPEGLibjpegSessionAbort() to be called prematurely. */
855
        /* Triggered by https://gitlab.com/libtiff/libtiff/-/issues/337 */
856
0
        TIFFErrorExtR(tif, module,
857
0
                      "Cannot decode: libjpeg_session_active == 0");
858
0
        return 0;
859
0
    }
860
0
    if (sp->error_in_raw_data_decoding)
861
0
    {
862
0
        memset(buf, 0, (size_t)cc);
863
0
        return 0;
864
0
    }
865
0
    if (sp->libjpeg_jpeg_query_style == 0)
866
0
    {
867
0
        if (OJPEGDecodeRaw(tif, buf, cc) == 0)
868
0
        {
869
0
            memset(buf, 0, (size_t)cc);
870
0
            return (0);
871
0
        }
872
0
    }
873
0
    else
874
0
    {
875
0
        if (OJPEGDecodeScanlines(tif, buf, cc) == 0)
876
0
        {
877
0
            memset(buf, 0, (size_t)cc);
878
0
            return (0);
879
0
        }
880
0
    }
881
0
    return (1);
882
0
}
883
884
static int OJPEGDecodeRaw(TIFF *tif, uint8_t *buf, tmsize_t cc)
885
0
{
886
0
    static const char module[] = "OJPEGDecodeRaw";
887
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
888
0
    uint8_t *m;
889
0
    tmsize_t n;
890
0
    uint8_t *oy;
891
0
    uint8_t *ocb;
892
0
    uint8_t *ocr;
893
0
    uint8_t *p;
894
0
    uint32_t q;
895
0
    uint8_t *r;
896
0
    uint8_t sx, sy;
897
0
    if (cc % sp->bytes_per_line != 0)
898
0
    {
899
0
        TIFFErrorExtR(tif, module, "Fractional scanline not read");
900
0
        return (0);
901
0
    }
902
0
    assert(cc > 0);
903
0
    m = buf;
904
0
    n = cc;
905
0
    do
906
0
    {
907
0
        if (sp->subsampling_convert_state == 0)
908
0
        {
909
0
            if (jpeg_read_raw_data_encap(
910
0
                    sp, &(sp->libjpeg_jpeg_decompress_struct),
911
0
                    sp->subsampling_convert_ycbcrimage,
912
0
                    (uint32_t)sp->subsampling_ver * 8) == 0)
913
0
            {
914
0
                sp->error_in_raw_data_decoding = 1;
915
0
                return (0);
916
0
            }
917
0
        }
918
0
        oy = sp->subsampling_convert_ybuf +
919
0
             sp->subsampling_convert_state * sp->subsampling_ver *
920
0
                 sp->subsampling_convert_ylinelen;
921
0
        ocb = sp->subsampling_convert_cbbuf +
922
0
              sp->subsampling_convert_state * sp->subsampling_convert_clinelen;
923
0
        ocr = sp->subsampling_convert_crbuf +
924
0
              sp->subsampling_convert_state * sp->subsampling_convert_clinelen;
925
0
        p = m;
926
0
        for (q = 0; q < sp->subsampling_convert_clinelenout; q++)
927
0
        {
928
0
            r = oy;
929
0
            for (sy = 0; sy < sp->subsampling_ver; sy++)
930
0
            {
931
0
                for (sx = 0; sx < sp->subsampling_hor; sx++)
932
0
                    *p++ = *r++;
933
0
                r += sp->subsampling_convert_ylinelen - sp->subsampling_hor;
934
0
            }
935
0
            oy += sp->subsampling_hor;
936
0
            *p++ = *ocb++;
937
0
            *p++ = *ocr++;
938
0
        }
939
0
        sp->subsampling_convert_state++;
940
0
        if (sp->subsampling_convert_state == sp->subsampling_convert_clines)
941
0
            sp->subsampling_convert_state = 0;
942
0
        m += sp->bytes_per_line;
943
0
        n -= sp->bytes_per_line;
944
0
    } while (n > 0);
945
0
    return (1);
946
0
}
947
948
static int OJPEGDecodeScanlines(TIFF *tif, uint8_t *buf, tmsize_t cc)
949
0
{
950
0
    static const char module[] = "OJPEGDecodeScanlines";
951
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
952
0
    uint8_t *m;
953
0
    tmsize_t n;
954
0
    if (cc % sp->bytes_per_line != 0)
955
0
    {
956
0
        TIFFErrorExtR(tif, module, "Fractional scanline not read");
957
0
        return (0);
958
0
    }
959
0
    assert(cc > 0);
960
0
    m = buf;
961
0
    n = cc;
962
0
    do
963
0
    {
964
0
        if (jpeg_read_scanlines_encap(sp, &(sp->libjpeg_jpeg_decompress_struct),
965
0
                                      &m, 1) == 0)
966
0
            return (0);
967
0
        m += sp->bytes_per_line;
968
0
        n -= sp->bytes_per_line;
969
0
    } while (n > 0);
970
0
    return (1);
971
0
}
972
973
static void OJPEGPostDecode(TIFF *tif, uint8_t *buf, tmsize_t cc)
974
0
{
975
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
976
0
    (void)buf;
977
0
    (void)cc;
978
    /* This function somehow incorrectly assumes that a whole strile was read,
979
     */
980
    /* which is not true when TIFFReadScanline() is called, */
981
    /* and may thus incorrectly consider it has read the whole image, causing */
982
    /* OJPEGLibjpegSessionAbort() to be called prematurely. */
983
    /* So this logic should be fixed to take into account cc, or disable */
984
    /* the scan line reading interface. */
985
    /* Triggered by https://gitlab.com/libtiff/libtiff/-/issues/337 */
986
0
    sp->write_curstrile++;
987
0
    if (sp->write_curstrile % tif->tif_dir.td_stripsperimage == 0)
988
0
    {
989
0
        assert(sp->libjpeg_session_active != 0);
990
0
        OJPEGLibjpegSessionAbort(tif);
991
0
        sp->writeheader_done = 0;
992
0
    }
993
0
}
994
995
static int OJPEGSetupEncode(TIFF *tif)
996
0
{
997
0
    static const char module[] = "OJPEGSetupEncode";
998
0
    TIFFErrorExtR(
999
0
        tif, module,
1000
0
        "OJPEG encoding not supported; use new-style JPEG compression instead");
1001
0
    return (0);
1002
0
}
1003
1004
static int OJPEGPreEncode(TIFF *tif, uint16_t s)
1005
0
{
1006
0
    static const char module[] = "OJPEGPreEncode";
1007
0
    (void)s;
1008
0
    TIFFErrorExtR(
1009
0
        tif, module,
1010
0
        "OJPEG encoding not supported; use new-style JPEG compression instead");
1011
0
    return (0);
1012
0
}
1013
1014
static int OJPEGEncode(TIFF *tif, uint8_t *buf, tmsize_t cc, uint16_t s)
1015
0
{
1016
0
    static const char module[] = "OJPEGEncode";
1017
0
    (void)buf;
1018
0
    (void)cc;
1019
0
    (void)s;
1020
0
    TIFFErrorExtR(
1021
0
        tif, module,
1022
0
        "OJPEG encoding not supported; use new-style JPEG compression instead");
1023
0
    return (0);
1024
0
}
1025
1026
static int OJPEGPostEncode(TIFF *tif)
1027
0
{
1028
0
    static const char module[] = "OJPEGPostEncode";
1029
0
    TIFFErrorExtR(
1030
0
        tif, module,
1031
0
        "OJPEG encoding not supported; use new-style JPEG compression instead");
1032
0
    return (0);
1033
0
}
1034
1035
static void OJPEGCleanup(TIFF *tif)
1036
0
{
1037
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
1038
0
    if (sp != 0)
1039
0
    {
1040
0
        tif->tif_tagmethods.vgetfield = sp->vgetparent;
1041
0
        tif->tif_tagmethods.vsetfield = sp->vsetparent;
1042
0
        tif->tif_tagmethods.printdir = sp->printdir;
1043
0
        if (sp->qtable[0] != 0)
1044
0
            _TIFFfreeExt(tif, sp->qtable[0]);
1045
0
        if (sp->qtable[1] != 0)
1046
0
            _TIFFfreeExt(tif, sp->qtable[1]);
1047
0
        if (sp->qtable[2] != 0)
1048
0
            _TIFFfreeExt(tif, sp->qtable[2]);
1049
0
        if (sp->qtable[3] != 0)
1050
0
            _TIFFfreeExt(tif, sp->qtable[3]);
1051
0
        if (sp->dctable[0] != 0)
1052
0
            _TIFFfreeExt(tif, sp->dctable[0]);
1053
0
        if (sp->dctable[1] != 0)
1054
0
            _TIFFfreeExt(tif, sp->dctable[1]);
1055
0
        if (sp->dctable[2] != 0)
1056
0
            _TIFFfreeExt(tif, sp->dctable[2]);
1057
0
        if (sp->dctable[3] != 0)
1058
0
            _TIFFfreeExt(tif, sp->dctable[3]);
1059
0
        if (sp->actable[0] != 0)
1060
0
            _TIFFfreeExt(tif, sp->actable[0]);
1061
0
        if (sp->actable[1] != 0)
1062
0
            _TIFFfreeExt(tif, sp->actable[1]);
1063
0
        if (sp->actable[2] != 0)
1064
0
            _TIFFfreeExt(tif, sp->actable[2]);
1065
0
        if (sp->actable[3] != 0)
1066
0
            _TIFFfreeExt(tif, sp->actable[3]);
1067
0
        if (sp->libjpeg_session_active != 0)
1068
0
            OJPEGLibjpegSessionAbort(tif);
1069
0
        if (sp->subsampling_convert_ycbcrbuf != 0)
1070
0
            _TIFFfreeExt(tif, sp->subsampling_convert_ycbcrbuf);
1071
0
        if (sp->subsampling_convert_ycbcrimage != 0)
1072
0
            _TIFFfreeExt(tif, sp->subsampling_convert_ycbcrimage);
1073
0
        if (sp->skip_buffer != 0)
1074
0
            _TIFFfreeExt(tif, sp->skip_buffer);
1075
0
        _TIFFfreeExt(tif, sp);
1076
0
        tif->tif_data = NULL;
1077
0
        _TIFFSetDefaultCompressionState(tif);
1078
0
    }
1079
0
}
1080
1081
static void OJPEGSubsamplingCorrect(TIFF *tif)
1082
0
{
1083
0
    static const char module[] = "OJPEGSubsamplingCorrect";
1084
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
1085
0
    uint8_t mh;
1086
0
    uint8_t mv;
1087
1088
0
    assert(sp->subsamplingcorrect_done == 0);
1089
0
    if ((tif->tif_dir.td_samplesperpixel != 3) ||
1090
0
        ((tif->tif_dir.td_photometric != PHOTOMETRIC_YCBCR) &&
1091
0
         (tif->tif_dir.td_photometric != PHOTOMETRIC_ITULAB)))
1092
0
    {
1093
0
        if (sp->subsampling_tag != 0)
1094
0
            TIFFWarningExtR(tif, module,
1095
0
                            "Subsampling tag not appropriate for this "
1096
0
                            "Photometric and/or SamplesPerPixel");
1097
0
        sp->subsampling_hor = 1;
1098
0
        sp->subsampling_ver = 1;
1099
0
        sp->subsampling_force_desubsampling_inside_decompression = 0;
1100
0
    }
1101
0
    else
1102
0
    {
1103
0
        sp->subsamplingcorrect_done = 1;
1104
0
        mh = sp->subsampling_hor;
1105
0
        mv = sp->subsampling_ver;
1106
0
        sp->subsamplingcorrect = 1;
1107
0
        OJPEGReadHeaderInfoSec(tif);
1108
0
        if (sp->subsampling_force_desubsampling_inside_decompression != 0)
1109
0
        {
1110
0
            sp->subsampling_hor = 1;
1111
0
            sp->subsampling_ver = 1;
1112
0
        }
1113
0
        sp->subsamplingcorrect = 0;
1114
0
        if (((sp->subsampling_hor != mh) || (sp->subsampling_ver != mv)) &&
1115
0
            (sp->subsampling_force_desubsampling_inside_decompression == 0))
1116
0
        {
1117
0
            if (sp->subsampling_tag == 0)
1118
0
                TIFFWarningExtR(
1119
0
                    tif, module,
1120
0
                    "Subsampling tag is not set, yet subsampling inside JPEG "
1121
0
                    "data [%" PRIu8 ",%" PRIu8
1122
0
                    "] does not match default values [2,2]; assuming "
1123
0
                    "subsampling inside JPEG data is correct",
1124
0
                    sp->subsampling_hor, sp->subsampling_ver);
1125
0
            else
1126
0
                TIFFWarningExtR(
1127
0
                    tif, module,
1128
0
                    "Subsampling inside JPEG data [%" PRIu8 ",%" PRIu8
1129
0
                    "] does not match subsampling tag values [%" PRIu8
1130
0
                    ",%" PRIu8
1131
0
                    "]; assuming subsampling inside JPEG data is correct",
1132
0
                    sp->subsampling_hor, sp->subsampling_ver, mh, mv);
1133
0
        }
1134
0
        if (sp->subsampling_force_desubsampling_inside_decompression != 0)
1135
0
        {
1136
0
            if (sp->subsampling_tag == 0)
1137
0
                TIFFWarningExtR(
1138
0
                    tif, module,
1139
0
                    "Subsampling tag is not set, yet subsampling inside JPEG "
1140
0
                    "data does not match default values [2,2] (nor any other "
1141
0
                    "values allowed in TIFF); assuming subsampling inside JPEG "
1142
0
                    "data is correct and desubsampling inside JPEG "
1143
0
                    "decompression");
1144
0
            else
1145
0
                TIFFWarningExtR(
1146
0
                    tif, module,
1147
0
                    "Subsampling inside JPEG data does not match subsampling "
1148
0
                    "tag values [%" PRIu8 ",%" PRIu8
1149
0
                    "] (nor any other values allowed in TIFF); assuming "
1150
0
                    "subsampling inside JPEG data is correct and desubsampling "
1151
0
                    "inside JPEG decompression",
1152
0
                    mh, mv);
1153
0
        }
1154
0
        if (sp->subsampling_force_desubsampling_inside_decompression == 0)
1155
0
        {
1156
0
            if (sp->subsampling_hor < sp->subsampling_ver)
1157
0
                TIFFWarningExtR(tif, module,
1158
0
                                "Subsampling values [%" PRIu8 ",%" PRIu8
1159
0
                                "] are not allowed in TIFF",
1160
0
                                sp->subsampling_hor, sp->subsampling_ver);
1161
0
        }
1162
0
    }
1163
0
    sp->subsamplingcorrect_done = 1;
1164
0
}
1165
1166
static int OJPEGReadHeaderInfo(TIFF *tif)
1167
0
{
1168
0
    static const char module[] = "OJPEGReadHeaderInfo";
1169
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
1170
0
    assert(sp->readheader_done == 0);
1171
0
    sp->image_width = tif->tif_dir.td_imagewidth;
1172
0
    sp->image_length = tif->tif_dir.td_imagelength;
1173
0
    if (isTiled(tif))
1174
0
    {
1175
0
        sp->strile_width = tif->tif_dir.td_tilewidth;
1176
0
        sp->strile_length = tif->tif_dir.td_tilelength;
1177
0
        sp->strile_length_total =
1178
0
            ((sp->image_length + sp->strile_length - 1) / sp->strile_length) *
1179
0
            sp->strile_length;
1180
0
    }
1181
0
    else
1182
0
    {
1183
0
        sp->strile_width = sp->image_width;
1184
0
        sp->strile_length = tif->tif_dir.td_rowsperstrip;
1185
0
        if (sp->strile_length == (uint32_t)-1)
1186
0
            sp->strile_length = sp->image_length;
1187
0
        sp->strile_length_total = sp->image_length;
1188
0
    }
1189
0
    if (tif->tif_dir.td_samplesperpixel == 1)
1190
0
    {
1191
0
        sp->samples_per_pixel = 1;
1192
0
        sp->plane_sample_offset = 0;
1193
0
        sp->samples_per_pixel_per_plane = sp->samples_per_pixel;
1194
0
        sp->subsampling_hor = 1;
1195
0
        sp->subsampling_ver = 1;
1196
0
    }
1197
0
    else
1198
0
    {
1199
0
        if (tif->tif_dir.td_samplesperpixel != 3)
1200
0
        {
1201
0
            TIFFErrorExtR(tif, module,
1202
0
                          "SamplesPerPixel %" PRIu8
1203
0
                          " not supported for this compression scheme",
1204
0
                          sp->samples_per_pixel);
1205
0
            return (0);
1206
0
        }
1207
0
        sp->samples_per_pixel = 3;
1208
0
        sp->plane_sample_offset = 0;
1209
0
        if (tif->tif_dir.td_planarconfig == PLANARCONFIG_CONTIG)
1210
0
            sp->samples_per_pixel_per_plane = 3;
1211
0
        else
1212
0
            sp->samples_per_pixel_per_plane = 1;
1213
0
    }
1214
0
    if (sp->strile_length < sp->image_length)
1215
0
    {
1216
0
        if (((sp->subsampling_hor != 1) && (sp->subsampling_hor != 2) &&
1217
0
             (sp->subsampling_hor != 4)) ||
1218
0
            ((sp->subsampling_ver != 1) && (sp->subsampling_ver != 2) &&
1219
0
             (sp->subsampling_ver != 4)))
1220
0
        {
1221
0
            TIFFErrorExtR(tif, module, "Invalid subsampling values");
1222
0
            return (0);
1223
0
        }
1224
0
        if (sp->strile_length % ((uint32_t)sp->subsampling_ver * 8) != 0)
1225
0
        {
1226
0
            TIFFErrorExtR(tif, module,
1227
0
                          "Incompatible vertical subsampling and image "
1228
0
                          "strip/tile length");
1229
0
            return (0);
1230
0
        }
1231
0
        sp->restart_interval =
1232
0
            (uint16_t)(((sp->strile_width + (uint32_t)sp->subsampling_hor * 8 -
1233
0
                         1) /
1234
0
                        ((uint32_t)sp->subsampling_hor * 8)) *
1235
0
                       (sp->strile_length /
1236
0
                        ((uint32_t)sp->subsampling_ver * 8)));
1237
0
    }
1238
0
    if (OJPEGReadHeaderInfoSec(tif) == 0)
1239
0
        return (0);
1240
0
    sp->sos_end[0].log = 1;
1241
0
    sp->sos_end[0].in_buffer_source = sp->in_buffer_source;
1242
0
    sp->sos_end[0].in_buffer_next_strile = sp->in_buffer_next_strile;
1243
0
    sp->sos_end[0].in_buffer_file_pos =
1244
0
        sp->in_buffer_file_pos - sp->in_buffer_togo;
1245
0
    sp->sos_end[0].in_buffer_file_togo =
1246
0
        sp->in_buffer_file_togo + sp->in_buffer_togo;
1247
0
    sp->readheader_done = 1;
1248
0
    return (1);
1249
0
}
1250
1251
static int OJPEGReadSecondarySos(TIFF *tif, uint16_t s)
1252
0
{
1253
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
1254
0
    uint8_t m;
1255
0
    assert(s > 0);
1256
0
    assert(s < 3);
1257
0
    assert(sp->sos_end[0].log != 0);
1258
0
    assert(sp->sos_end[s].log == 0);
1259
0
    sp->plane_sample_offset = (uint8_t)(s - 1);
1260
0
    while (sp->sos_end[sp->plane_sample_offset].log == 0)
1261
0
        sp->plane_sample_offset--;
1262
0
    sp->in_buffer_source =
1263
0
        sp->sos_end[sp->plane_sample_offset].in_buffer_source;
1264
0
    sp->in_buffer_next_strile =
1265
0
        sp->sos_end[sp->plane_sample_offset].in_buffer_next_strile;
1266
0
    sp->in_buffer_file_pos =
1267
0
        sp->sos_end[sp->plane_sample_offset].in_buffer_file_pos;
1268
0
    sp->in_buffer_file_pos_log = 0;
1269
0
    sp->in_buffer_file_togo =
1270
0
        sp->sos_end[sp->plane_sample_offset].in_buffer_file_togo;
1271
0
    sp->in_buffer_togo = 0;
1272
0
    sp->in_buffer_cur = 0;
1273
0
    while (sp->plane_sample_offset < s)
1274
0
    {
1275
0
        do
1276
0
        {
1277
0
            if (OJPEGReadByte(sp, &m) == 0)
1278
0
                return (0);
1279
0
            if (m == 255)
1280
0
            {
1281
0
                do
1282
0
                {
1283
0
                    if (OJPEGReadByte(sp, &m) == 0)
1284
0
                        return (0);
1285
0
                    if (m != 255)
1286
0
                        break;
1287
0
                } while (1);
1288
0
                if (m == JPEG_MARKER_SOS)
1289
0
                    break;
1290
0
            }
1291
0
        } while (1);
1292
0
        sp->plane_sample_offset++;
1293
0
        if (OJPEGReadHeaderInfoSecStreamSos(tif) == 0)
1294
0
            return (0);
1295
0
        sp->sos_end[sp->plane_sample_offset].log = 1;
1296
0
        sp->sos_end[sp->plane_sample_offset].in_buffer_source =
1297
0
            sp->in_buffer_source;
1298
0
        sp->sos_end[sp->plane_sample_offset].in_buffer_next_strile =
1299
0
            sp->in_buffer_next_strile;
1300
0
        sp->sos_end[sp->plane_sample_offset].in_buffer_file_pos =
1301
0
            sp->in_buffer_file_pos - sp->in_buffer_togo;
1302
0
        sp->sos_end[sp->plane_sample_offset].in_buffer_file_togo =
1303
0
            sp->in_buffer_file_togo + sp->in_buffer_togo;
1304
0
    }
1305
0
    return (1);
1306
0
}
1307
1308
static int OJPEGWriteHeaderInfo(TIFF *tif)
1309
0
{
1310
0
    static const char module[] = "OJPEGWriteHeaderInfo";
1311
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
1312
0
    uint8_t **m;
1313
0
    uint32_t n;
1314
    /* if a previous attempt failed, don't try again */
1315
0
    if (sp->libjpeg_session_active != 0)
1316
0
        return 0;
1317
0
    sp->out_state = ososSoi;
1318
0
    sp->restart_index = 0;
1319
0
    jpeg_std_error(&(sp->libjpeg_jpeg_error_mgr));
1320
0
    sp->libjpeg_jpeg_error_mgr.output_message =
1321
0
        OJPEGLibjpegJpegErrorMgrOutputMessage;
1322
0
    sp->libjpeg_jpeg_error_mgr.error_exit = OJPEGLibjpegJpegErrorMgrErrorExit;
1323
0
    sp->libjpeg_jpeg_decompress_struct.err = &(sp->libjpeg_jpeg_error_mgr);
1324
0
    sp->libjpeg_jpeg_decompress_struct.client_data = (void *)tif;
1325
0
    if (jpeg_create_decompress_encap(
1326
0
            sp, &(sp->libjpeg_jpeg_decompress_struct)) == 0)
1327
0
        return (0);
1328
0
    sp->libjpeg_session_active = 1;
1329
0
    sp->libjpeg_jpeg_source_mgr.bytes_in_buffer = 0;
1330
0
    sp->libjpeg_jpeg_source_mgr.init_source =
1331
0
        OJPEGLibjpegJpegSourceMgrInitSource;
1332
0
    sp->libjpeg_jpeg_source_mgr.fill_input_buffer =
1333
0
        OJPEGLibjpegJpegSourceMgrFillInputBuffer;
1334
0
    sp->libjpeg_jpeg_source_mgr.skip_input_data =
1335
0
        OJPEGLibjpegJpegSourceMgrSkipInputData;
1336
0
    sp->libjpeg_jpeg_source_mgr.resync_to_restart =
1337
0
        OJPEGLibjpegJpegSourceMgrResyncToRestart;
1338
0
    sp->libjpeg_jpeg_source_mgr.term_source =
1339
0
        OJPEGLibjpegJpegSourceMgrTermSource;
1340
0
    sp->libjpeg_jpeg_decompress_struct.src = &(sp->libjpeg_jpeg_source_mgr);
1341
0
    if (jpeg_read_header_encap(sp, &(sp->libjpeg_jpeg_decompress_struct), 1) ==
1342
0
        0)
1343
0
        return (0);
1344
0
    if ((sp->subsampling_force_desubsampling_inside_decompression == 0) &&
1345
0
        (sp->samples_per_pixel_per_plane > 1))
1346
0
    {
1347
0
        sp->libjpeg_jpeg_decompress_struct.raw_data_out = 1;
1348
0
#if JPEG_LIB_VERSION >= 70
1349
0
        sp->libjpeg_jpeg_decompress_struct.do_fancy_upsampling = FALSE;
1350
0
#endif
1351
0
        sp->libjpeg_jpeg_query_style = 0;
1352
0
        if (sp->subsampling_convert_log == 0)
1353
0
        {
1354
0
            assert(sp->subsampling_convert_ycbcrbuf == 0);
1355
0
            assert(sp->subsampling_convert_ycbcrimage == 0);
1356
            /* Check for division by zero. */
1357
0
            if (sp->subsampling_hor == 0 || sp->subsampling_ver == 0)
1358
0
                return (0);
1359
            /* Check for potential overflow in subsampling_convert_ylinelen
1360
             * computation.
1361
             */
1362
0
            if (sp->strile_width >
1363
0
                UINT32_MAX - ((uint32_t)sp->subsampling_hor * 8 - 1))
1364
0
                return (0);
1365
0
            sp->subsampling_convert_ylinelen =
1366
0
                ((sp->strile_width + (uint32_t)sp->subsampling_hor * 8 - 1) /
1367
0
                 ((uint32_t)sp->subsampling_hor * 8) *
1368
0
                 ((uint32_t)sp->subsampling_hor * 8));
1369
0
            sp->subsampling_convert_ylines = (uint32_t)sp->subsampling_ver * 8;
1370
0
            sp->subsampling_convert_clinelen =
1371
0
                sp->subsampling_convert_ylinelen / sp->subsampling_hor;
1372
0
            sp->subsampling_convert_clines = 8;
1373
            /* Check for potential overflow in buffer length computations.
1374
             * Use 64-bit intermediates to detect uint32_t overflow in
1375
             * ylinelen * ylines, clinelen * clines, and their sum.
1376
             */
1377
0
            {
1378
0
                uint64_t ybuflen64 =
1379
0
                    (uint64_t)sp->subsampling_convert_ylinelen *
1380
0
                    sp->subsampling_convert_ylines;
1381
0
                uint64_t cbuflen64 =
1382
0
                    (uint64_t)sp->subsampling_convert_clinelen *
1383
0
                    sp->subsampling_convert_clines;
1384
0
                uint64_t ycbcrbuflen64 = ybuflen64 + 2 * cbuflen64;
1385
0
                if (ybuflen64 > UINT32_MAX || cbuflen64 > UINT32_MAX ||
1386
0
                    ycbcrbuflen64 > UINT32_MAX)
1387
0
                {
1388
0
                    TIFFErrorExtR(tif, module,
1389
0
                                  "Integer overflow in OJPEG buffer size");
1390
0
                    return (0);
1391
0
                }
1392
0
                sp->subsampling_convert_ybuflen = (uint32_t)ybuflen64;
1393
0
                sp->subsampling_convert_cbuflen = (uint32_t)cbuflen64;
1394
0
                sp->subsampling_convert_ycbcrbuflen = (uint32_t)ycbcrbuflen64;
1395
0
            }
1396
            /* The calloc is not normally necessary, except in some edge/broken
1397
             * cases */
1398
            /* for example for a tiled image of height 1 with a tile height of 1
1399
             * and subsampling_hor=subsampling_ver=2 */
1400
            /* In that case, libjpeg will only fill the 8 first lines of the 16
1401
             * lines */
1402
            /* See https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16844
1403
             */
1404
            /* Even if this case is allowed (?), its handling is broken because
1405
             * OJPEGPreDecode() should also likely */
1406
            /* reset subsampling_convert_state to 0 when changing tile. */
1407
0
            sp->subsampling_convert_ycbcrbuf = (uint8_t *)_TIFFcallocExt(
1408
0
                tif, 1, sp->subsampling_convert_ycbcrbuflen);
1409
0
            if (sp->subsampling_convert_ycbcrbuf == 0)
1410
0
            {
1411
0
                TIFFErrorExtR(tif, module, "Out of memory");
1412
0
                return (0);
1413
0
            }
1414
0
            sp->subsampling_convert_ybuf = sp->subsampling_convert_ycbcrbuf;
1415
0
            sp->subsampling_convert_cbbuf =
1416
0
                sp->subsampling_convert_ybuf + sp->subsampling_convert_ybuflen;
1417
0
            sp->subsampling_convert_crbuf =
1418
0
                sp->subsampling_convert_cbbuf + sp->subsampling_convert_cbuflen;
1419
0
            sp->subsampling_convert_ycbcrimagelen =
1420
0
                3 + sp->subsampling_convert_ylines +
1421
0
                2 * sp->subsampling_convert_clines;
1422
0
            sp->subsampling_convert_ycbcrimage = (uint8_t **)_TIFFmallocExt(
1423
0
                tif, (tmsize_t)((size_t)sp->subsampling_convert_ycbcrimagelen *
1424
0
                                sizeof(uint8_t *)));
1425
0
            if (sp->subsampling_convert_ycbcrimage == 0)
1426
0
            {
1427
0
                TIFFErrorExtR(tif, module, "Out of memory");
1428
0
                return (0);
1429
0
            }
1430
0
            m = sp->subsampling_convert_ycbcrimage;
1431
0
            *m++ = (uint8_t *)(sp->subsampling_convert_ycbcrimage + 3);
1432
0
            *m++ = (uint8_t *)(sp->subsampling_convert_ycbcrimage + 3 +
1433
0
                               sp->subsampling_convert_ylines);
1434
0
            *m++ = (uint8_t *)(sp->subsampling_convert_ycbcrimage + 3 +
1435
0
                               sp->subsampling_convert_ylines +
1436
0
                               sp->subsampling_convert_clines);
1437
0
            for (n = 0; n < sp->subsampling_convert_ylines; n++)
1438
0
                *m++ = sp->subsampling_convert_ybuf +
1439
0
                       n * sp->subsampling_convert_ylinelen;
1440
0
            for (n = 0; n < sp->subsampling_convert_clines; n++)
1441
0
                *m++ = sp->subsampling_convert_cbbuf +
1442
0
                       n * sp->subsampling_convert_clinelen;
1443
0
            for (n = 0; n < sp->subsampling_convert_clines; n++)
1444
0
                *m++ = sp->subsampling_convert_crbuf +
1445
0
                       n * sp->subsampling_convert_clinelen;
1446
0
            sp->subsampling_convert_clinelenout =
1447
0
                sp->strile_width / sp->subsampling_hor +
1448
0
                ((sp->strile_width % sp->subsampling_hor) != 0 ? 1 : 0);
1449
0
            sp->subsampling_convert_state = 0;
1450
0
            sp->error_in_raw_data_decoding = 0;
1451
1452
0
            const uint64_t bpl =
1453
0
                (uint64_t)sp->subsampling_convert_clinelenout *
1454
0
                ((uint64_t)sp->subsampling_ver * sp->subsampling_hor + 2);
1455
0
            if (bpl > UINT32_MAX)
1456
0
                return (0);
1457
0
            sp->bytes_per_line = (uint32_t)bpl;
1458
1459
0
            sp->lines_per_strile =
1460
0
                sp->strile_length / sp->subsampling_ver +
1461
0
                ((sp->strile_length % sp->subsampling_ver) != 0 ? 1 : 0);
1462
0
            sp->subsampling_convert_log = 1;
1463
0
        }
1464
0
    }
1465
0
    else
1466
0
    {
1467
0
        sp->libjpeg_jpeg_decompress_struct.jpeg_color_space = JCS_UNKNOWN;
1468
0
        sp->libjpeg_jpeg_decompress_struct.out_color_space = JCS_UNKNOWN;
1469
0
        sp->libjpeg_jpeg_query_style = 1;
1470
0
        sp->bytes_per_line =
1471
0
            _TIFFMultiply32(tif, sp->samples_per_pixel_per_plane,
1472
0
                            sp->strile_width, "OJPEGWriteHeaderInfo");
1473
0
        if (sp->bytes_per_line == 0)
1474
0
            return (0);
1475
0
        sp->lines_per_strile = sp->strile_length;
1476
0
    }
1477
0
    if (jpeg_start_decompress_encap(sp,
1478
0
                                    &(sp->libjpeg_jpeg_decompress_struct)) == 0)
1479
0
        return (0);
1480
0
    if (sp->libjpeg_jpeg_decompress_struct.image_width != sp->strile_width)
1481
0
    {
1482
0
        TIFFErrorExtR(tif, module,
1483
0
                      "jpeg_start_decompress() returned image_width = %u, "
1484
0
                      "expected %" PRIu32,
1485
0
                      sp->libjpeg_jpeg_decompress_struct.image_width,
1486
0
                      sp->strile_width);
1487
0
        return 0;
1488
0
    }
1489
0
    if (sp->libjpeg_jpeg_decompress_struct.max_h_samp_factor !=
1490
0
            sp->subsampling_hor ||
1491
0
        sp->libjpeg_jpeg_decompress_struct.max_v_samp_factor !=
1492
0
            sp->subsampling_ver)
1493
0
    {
1494
0
        TIFFErrorExtR(tif, module,
1495
0
                      "jpeg_start_decompress() returned max_h_samp_factor = %d "
1496
0
                      "and max_v_samp_factor = %d, expected %" PRIu8
1497
0
                      " and %" PRIu8,
1498
0
                      sp->libjpeg_jpeg_decompress_struct.max_h_samp_factor,
1499
0
                      sp->libjpeg_jpeg_decompress_struct.max_v_samp_factor,
1500
0
                      sp->subsampling_hor, sp->subsampling_ver);
1501
0
        return 0;
1502
0
    }
1503
1504
0
    sp->writeheader_done = 1;
1505
0
    return (1);
1506
0
}
1507
1508
static void OJPEGLibjpegSessionAbort(TIFF *tif)
1509
0
{
1510
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
1511
0
    assert(sp->libjpeg_session_active != 0);
1512
0
    jpeg_destroy(
1513
0
        (tiff_ojpeg_common_struct *)(&(sp->libjpeg_jpeg_decompress_struct)));
1514
0
    sp->libjpeg_session_active = 0;
1515
0
}
1516
1517
static int OJPEGReadHeaderInfoSec(TIFF *tif)
1518
0
{
1519
0
    static const char module[] = "OJPEGReadHeaderInfoSec";
1520
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
1521
0
    uint8_t m;
1522
0
    uint16_t n;
1523
0
    uint8_t o;
1524
0
    if (sp->file_size == 0)
1525
0
        sp->file_size = TIFFGetFileSize(tif);
1526
0
    if (sp->jpeg_interchange_format != 0)
1527
0
    {
1528
0
        if (sp->jpeg_interchange_format >= sp->file_size)
1529
0
        {
1530
0
            sp->jpeg_interchange_format = 0;
1531
0
            sp->jpeg_interchange_format_length = 0;
1532
0
        }
1533
0
        else
1534
0
        {
1535
0
            if ((sp->jpeg_interchange_format_length == 0) ||
1536
0
                (sp->jpeg_interchange_format >
1537
0
                 UINT64_MAX - sp->jpeg_interchange_format_length) ||
1538
0
                (sp->jpeg_interchange_format +
1539
0
                     sp->jpeg_interchange_format_length >
1540
0
                 sp->file_size))
1541
0
                sp->jpeg_interchange_format_length =
1542
0
                    sp->file_size - sp->jpeg_interchange_format;
1543
0
        }
1544
0
    }
1545
0
    sp->in_buffer_source = osibsNotSetYet;
1546
0
    sp->in_buffer_next_strile = 0;
1547
0
    sp->in_buffer_strile_count = tif->tif_dir.td_nstrips;
1548
0
    sp->in_buffer_file_togo = 0;
1549
0
    sp->in_buffer_togo = 0;
1550
0
    do
1551
0
    {
1552
0
        if (OJPEGReadBytePeek(sp, &m) == 0)
1553
0
            return (0);
1554
0
        if (m != 255)
1555
0
            break;
1556
0
        OJPEGReadByteAdvance(sp);
1557
0
        do
1558
0
        {
1559
0
            if (OJPEGReadByte(sp, &m) == 0)
1560
0
                return (0);
1561
0
        } while (m == 255);
1562
0
        switch (m)
1563
0
        {
1564
0
            case JPEG_MARKER_SOI:
1565
                /* this type of marker has no data, and should be skipped */
1566
0
                break;
1567
0
            case JPEG_MARKER_COM:
1568
0
            case JPEG_MARKER_APP0:
1569
0
            case JPEG_MARKER_APP0 + 1:
1570
0
            case JPEG_MARKER_APP0 + 2:
1571
0
            case JPEG_MARKER_APP0 + 3:
1572
0
            case JPEG_MARKER_APP0 + 4:
1573
0
            case JPEG_MARKER_APP0 + 5:
1574
0
            case JPEG_MARKER_APP0 + 6:
1575
0
            case JPEG_MARKER_APP0 + 7:
1576
0
            case JPEG_MARKER_APP0 + 8:
1577
0
            case JPEG_MARKER_APP0 + 9:
1578
0
            case JPEG_MARKER_APP0 + 10:
1579
0
            case JPEG_MARKER_APP0 + 11:
1580
0
            case JPEG_MARKER_APP0 + 12:
1581
0
            case JPEG_MARKER_APP0 + 13:
1582
0
            case JPEG_MARKER_APP0 + 14:
1583
0
            case JPEG_MARKER_APP0 + 15:
1584
                /* this type of marker has data, but it has no use to us (and no
1585
                 * place here) and should be skipped */
1586
0
                if (OJPEGReadWord(sp, &n) == 0)
1587
0
                    return (0);
1588
0
                if (n < 2)
1589
0
                {
1590
0
                    if (sp->subsamplingcorrect == 0)
1591
0
                        TIFFErrorExtR(tif, module, "Corrupt JPEG data");
1592
0
                    return (0);
1593
0
                }
1594
0
                if (n > 2)
1595
0
                    OJPEGReadSkip(sp, (uint16_t)(n - 2));
1596
0
                break;
1597
0
            case JPEG_MARKER_DRI:
1598
0
                if (OJPEGReadHeaderInfoSecStreamDri(tif) == 0)
1599
0
                    return (0);
1600
0
                break;
1601
0
            case JPEG_MARKER_DQT:
1602
0
                if (OJPEGReadHeaderInfoSecStreamDqt(tif) == 0)
1603
0
                    return (0);
1604
0
                break;
1605
0
            case JPEG_MARKER_DHT:
1606
0
                if (OJPEGReadHeaderInfoSecStreamDht(tif) == 0)
1607
0
                    return (0);
1608
0
                break;
1609
0
            case JPEG_MARKER_SOF0:
1610
0
            case JPEG_MARKER_SOF1:
1611
0
            case JPEG_MARKER_SOF3:
1612
0
                if (OJPEGReadHeaderInfoSecStreamSof(tif, m) == 0)
1613
0
                    return (0);
1614
0
                if (sp->subsamplingcorrect != 0)
1615
0
                    return (1);
1616
0
                break;
1617
0
            case JPEG_MARKER_SOS:
1618
0
                if (sp->subsamplingcorrect != 0)
1619
0
                    return (1);
1620
0
                assert(sp->plane_sample_offset == 0);
1621
0
                if (OJPEGReadHeaderInfoSecStreamSos(tif) == 0)
1622
0
                    return (0);
1623
0
                break;
1624
0
            default:
1625
0
                TIFFErrorExtR(tif, module,
1626
0
                              "Unknown marker type %" PRIu8 " in JPEG data", m);
1627
0
                return (0);
1628
0
        }
1629
0
    } while (m != JPEG_MARKER_SOS);
1630
0
    if (sp->subsamplingcorrect)
1631
0
        return (1);
1632
0
    if (sp->sof_log == 0)
1633
0
    {
1634
0
        if (OJPEGReadHeaderInfoSecTablesQTable(tif) == 0)
1635
0
            return (0);
1636
0
        sp->sof_marker_id = JPEG_MARKER_SOF0;
1637
0
        for (o = 0; o < sp->samples_per_pixel; o++)
1638
0
            sp->sof_c[o] = (uint8_t)o;
1639
0
        sp->sof_hv[0] =
1640
0
            (uint8_t)((sp->subsampling_hor << 4) | sp->subsampling_ver);
1641
0
        for (o = 1; o < sp->samples_per_pixel; o++)
1642
0
            sp->sof_hv[o] = 17;
1643
0
        sp->sof_x = sp->strile_width;
1644
0
        sp->sof_y = sp->strile_length_total;
1645
0
        sp->sof_log = 1;
1646
0
        if (OJPEGReadHeaderInfoSecTablesDcTable(tif) == 0)
1647
0
            return (0);
1648
0
        if (OJPEGReadHeaderInfoSecTablesAcTable(tif) == 0)
1649
0
            return (0);
1650
0
        for (o = 1; o < sp->samples_per_pixel; o++)
1651
0
            sp->sos_cs[o] = o;
1652
0
    }
1653
0
    return (1);
1654
0
}
1655
1656
static int OJPEGReadHeaderInfoSecStreamDri(TIFF *tif)
1657
0
{
1658
    /* This could easily cause trouble in some cases... but no such cases have
1659
       occurred so far */
1660
0
    static const char module[] = "OJPEGReadHeaderInfoSecStreamDri";
1661
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
1662
0
    uint16_t m;
1663
0
    if (OJPEGReadWord(sp, &m) == 0)
1664
0
        return (0);
1665
0
    if (m != 4)
1666
0
    {
1667
0
        TIFFErrorExtR(tif, module, "Corrupt DRI marker in JPEG data");
1668
0
        return (0);
1669
0
    }
1670
0
    if (OJPEGReadWord(sp, &m) == 0)
1671
0
        return (0);
1672
0
    sp->restart_interval = m;
1673
0
    return (1);
1674
0
}
1675
1676
static int OJPEGReadHeaderInfoSecStreamDqt(TIFF *tif)
1677
0
{
1678
    /* this is a table marker, and it is to be saved as a whole for exact
1679
     * pushing on the jpeg stream later on */
1680
0
    static const char module[] = "OJPEGReadHeaderInfoSecStreamDqt";
1681
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
1682
0
    uint16_t m;
1683
0
    uint32_t na;
1684
0
    uint8_t *nb;
1685
0
    uint8_t o;
1686
0
    if (OJPEGReadWord(sp, &m) == 0)
1687
0
        return (0);
1688
0
    if (m <= 2)
1689
0
    {
1690
0
        if (sp->subsamplingcorrect == 0)
1691
0
            TIFFErrorExtR(tif, module, "Corrupt DQT marker in JPEG data");
1692
0
        return (0);
1693
0
    }
1694
0
    if (sp->subsamplingcorrect != 0)
1695
0
        OJPEGReadSkip(sp, (uint16_t)(m - 2));
1696
0
    else
1697
0
    {
1698
0
        m = (uint16_t)(m - 2);
1699
0
        do
1700
0
        {
1701
0
            if (m < 65)
1702
0
            {
1703
0
                TIFFErrorExtR(tif, module, "Corrupt DQT marker in JPEG data");
1704
0
                return (0);
1705
0
            }
1706
0
            na = sizeof(uint32_t) + 69;
1707
0
            nb = (uint8_t *)_TIFFmallocExt(tif, na);
1708
0
            if (nb == 0)
1709
0
            {
1710
0
                TIFFErrorExtR(tif, module, "Out of memory");
1711
0
                return (0);
1712
0
            }
1713
0
            *(uint32_t *)nb = na;
1714
0
            nb[sizeof(uint32_t)] = 255;
1715
0
            nb[sizeof(uint32_t) + 1] = JPEG_MARKER_DQT;
1716
0
            nb[sizeof(uint32_t) + 2] = 0;
1717
0
            nb[sizeof(uint32_t) + 3] = 67;
1718
0
            if (OJPEGReadBlock(sp, 65, &nb[sizeof(uint32_t) + 4]) == 0)
1719
0
            {
1720
0
                _TIFFfreeExt(tif, nb);
1721
0
                return (0);
1722
0
            }
1723
0
            o = nb[sizeof(uint32_t) + 4] & 15;
1724
0
            if (3 < o)
1725
0
            {
1726
0
                TIFFErrorExtR(tif, module, "Corrupt DQT marker in JPEG data");
1727
0
                _TIFFfreeExt(tif, nb);
1728
0
                return (0);
1729
0
            }
1730
0
            if (sp->qtable[o] != 0)
1731
0
                _TIFFfreeExt(tif, sp->qtable[o]);
1732
0
            sp->qtable[o] = nb;
1733
0
            m = (uint16_t)(m - 65);
1734
0
        } while (m > 0);
1735
0
    }
1736
0
    return (1);
1737
0
}
1738
1739
static int OJPEGReadHeaderInfoSecStreamDht(TIFF *tif)
1740
0
{
1741
    /* this is a table marker, and it is to be saved as a whole for exact
1742
     * pushing on the jpeg stream later on */
1743
    /* TODO: the following assumes there is only one table in this marker... but
1744
     * i'm not quite sure that assumption is guaranteed correct */
1745
0
    static const char module[] = "OJPEGReadHeaderInfoSecStreamDht";
1746
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
1747
0
    uint16_t m;
1748
0
    uint32_t na;
1749
0
    uint8_t *nb;
1750
0
    uint8_t o;
1751
0
    if (OJPEGReadWord(sp, &m) == 0)
1752
0
        return (0);
1753
0
    if (m <= 2)
1754
0
    {
1755
0
        if (sp->subsamplingcorrect == 0)
1756
0
            TIFFErrorExtR(tif, module, "Corrupt DHT marker in JPEG data");
1757
0
        return (0);
1758
0
    }
1759
0
    if (sp->subsamplingcorrect != 0)
1760
0
    {
1761
0
        OJPEGReadSkip(sp, (uint16_t)(m - 2));
1762
0
    }
1763
0
    else
1764
0
    {
1765
0
        na = (uint32_t)(sizeof(uint32_t) + 2 + m);
1766
0
        nb = (uint8_t *)_TIFFmallocExt(tif, na);
1767
0
        if (nb == 0)
1768
0
        {
1769
0
            TIFFErrorExtR(tif, module, "Out of memory");
1770
0
            return (0);
1771
0
        }
1772
0
        *(uint32_t *)nb = na;
1773
0
        nb[sizeof(uint32_t)] = 255;
1774
0
        nb[sizeof(uint32_t) + 1] = JPEG_MARKER_DHT;
1775
0
        nb[sizeof(uint32_t) + 2] = (uint8_t)(m >> 8);
1776
0
        nb[sizeof(uint32_t) + 3] = (uint8_t)(m & 255);
1777
0
        if (OJPEGReadBlock(sp, (uint16_t)(m - 2), &nb[sizeof(uint32_t) + 4]) ==
1778
0
            0)
1779
0
        {
1780
0
            _TIFFfreeExt(tif, nb);
1781
0
            return (0);
1782
0
        }
1783
0
        o = nb[sizeof(uint32_t) + 4];
1784
0
        if ((o & 240) == 0)
1785
0
        {
1786
0
            if (3 < o)
1787
0
            {
1788
0
                TIFFErrorExtR(tif, module, "Corrupt DHT marker in JPEG data");
1789
0
                _TIFFfreeExt(tif, nb);
1790
0
                return (0);
1791
0
            }
1792
0
            if (sp->dctable[o] != 0)
1793
0
                _TIFFfreeExt(tif, sp->dctable[o]);
1794
0
            sp->dctable[o] = nb;
1795
0
        }
1796
0
        else
1797
0
        {
1798
0
            if ((o & 240) != 16)
1799
0
            {
1800
0
                TIFFErrorExtR(tif, module, "Corrupt DHT marker in JPEG data");
1801
0
                _TIFFfreeExt(tif, nb);
1802
0
                return (0);
1803
0
            }
1804
0
            o &= 15;
1805
0
            if (3 < o)
1806
0
            {
1807
0
                TIFFErrorExtR(tif, module, "Corrupt DHT marker in JPEG data");
1808
0
                _TIFFfreeExt(tif, nb);
1809
0
                return (0);
1810
0
            }
1811
0
            if (sp->actable[o] != 0)
1812
0
                _TIFFfreeExt(tif, sp->actable[o]);
1813
0
            sp->actable[o] = nb;
1814
0
        }
1815
0
    }
1816
0
    return (1);
1817
0
}
1818
1819
static int OJPEGReadHeaderInfoSecStreamSof(TIFF *tif, uint8_t marker_id)
1820
0
{
1821
    /* this marker needs to be checked, and part of its data needs to be saved
1822
     * for regeneration later on */
1823
0
    static const char module[] = "OJPEGReadHeaderInfoSecStreamSof";
1824
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
1825
0
    uint16_t m;
1826
0
    uint16_t n;
1827
0
    uint8_t o;
1828
0
    uint16_t p;
1829
0
    uint16_t q;
1830
0
    if (sp->sof_log != 0)
1831
0
    {
1832
0
        TIFFErrorExtR(tif, module, "Corrupt JPEG data");
1833
0
        return (0);
1834
0
    }
1835
0
    if (sp->subsamplingcorrect == 0)
1836
0
        sp->sof_marker_id = marker_id;
1837
    /* Lf: data length */
1838
0
    if (OJPEGReadWord(sp, &m) == 0)
1839
0
        return (0);
1840
0
    if (m < 11)
1841
0
    {
1842
0
        if (sp->subsamplingcorrect == 0)
1843
0
            TIFFErrorExtR(tif, module, "Corrupt SOF marker in JPEG data");
1844
0
        return (0);
1845
0
    }
1846
0
    m = (uint16_t)(m - 8);
1847
0
    if (m % 3 != 0)
1848
0
    {
1849
0
        if (sp->subsamplingcorrect == 0)
1850
0
            TIFFErrorExtR(tif, module, "Corrupt SOF marker in JPEG data");
1851
0
        return (0);
1852
0
    }
1853
0
    n = m / 3;
1854
0
    if (sp->subsamplingcorrect == 0)
1855
0
    {
1856
0
        if (n != sp->samples_per_pixel)
1857
0
        {
1858
0
            TIFFErrorExtR(
1859
0
                tif, module,
1860
0
                "JPEG compressed data indicates unexpected number of samples");
1861
0
            return (0);
1862
0
        }
1863
0
    }
1864
    /* P: Sample precision */
1865
0
    if (OJPEGReadByte(sp, &o) == 0)
1866
0
        return (0);
1867
0
    if (o != 8)
1868
0
    {
1869
0
        if (sp->subsamplingcorrect == 0)
1870
0
            TIFFErrorExtR(tif, module,
1871
0
                          "JPEG compressed data indicates unexpected number of "
1872
0
                          "bits per sample");
1873
0
        return (0);
1874
0
    }
1875
    /* Y: Number of lines, X: Number of samples per line */
1876
0
    if (sp->subsamplingcorrect)
1877
0
        OJPEGReadSkip(sp, 4);
1878
0
    else
1879
0
    {
1880
        /* Y: Number of lines */
1881
0
        if (OJPEGReadWord(sp, &p) == 0)
1882
0
            return (0);
1883
0
        if (((uint32_t)p < sp->image_length) &&
1884
0
            ((uint32_t)p < sp->strile_length_total))
1885
0
        {
1886
0
            TIFFErrorExtR(tif, module,
1887
0
                          "JPEG compressed data indicates unexpected height");
1888
0
            return (0);
1889
0
        }
1890
0
        sp->sof_y = p;
1891
        /* X: Number of samples per line */
1892
0
        if (OJPEGReadWord(sp, &p) == 0)
1893
0
            return (0);
1894
0
        if (((uint32_t)p < sp->image_width) && ((uint32_t)p < sp->strile_width))
1895
0
        {
1896
0
            TIFFErrorExtR(tif, module,
1897
0
                          "JPEG compressed data indicates unexpected width");
1898
0
            return (0);
1899
0
        }
1900
0
        if ((uint32_t)p > sp->strile_width)
1901
0
        {
1902
0
            TIFFErrorExtR(tif, module,
1903
0
                          "JPEG compressed data image width exceeds expected "
1904
0
                          "image width");
1905
0
            return (0);
1906
0
        }
1907
0
        sp->sof_x = p;
1908
0
    }
1909
    /* Nf: Number of image components in frame */
1910
0
    if (OJPEGReadByte(sp, &o) == 0)
1911
0
        return (0);
1912
0
    if (o != n)
1913
0
    {
1914
0
        if (sp->subsamplingcorrect == 0)
1915
0
            TIFFErrorExtR(tif, module, "Corrupt SOF marker in JPEG data");
1916
0
        return (0);
1917
0
    }
1918
    /* per component stuff */
1919
    /* TODO: double-check that flow implies that n cannot be as big as to make
1920
     * us overflow sof_c, sof_hv and sof_tq arrays */
1921
0
    for (q = 0; q < n; q++)
1922
0
    {
1923
        /* C: Component identifier */
1924
0
        if (OJPEGReadByte(sp, &o) == 0)
1925
0
            return (0);
1926
0
        if (sp->subsamplingcorrect == 0)
1927
0
            sp->sof_c[q] = o;
1928
        /* H: Horizontal sampling factor, and V: Vertical sampling factor */
1929
0
        if (OJPEGReadByte(sp, &o) == 0)
1930
0
            return (0);
1931
0
        if (sp->subsamplingcorrect != 0)
1932
0
        {
1933
0
            if (q == 0)
1934
0
            {
1935
0
                sp->subsampling_hor = (o >> 4);
1936
0
                sp->subsampling_ver = (o & 15);
1937
0
                if (((sp->subsampling_hor != 1) && (sp->subsampling_hor != 2) &&
1938
0
                     (sp->subsampling_hor != 4)) ||
1939
0
                    ((sp->subsampling_ver != 1) && (sp->subsampling_ver != 2) &&
1940
0
                     (sp->subsampling_ver != 4)))
1941
0
                    sp->subsampling_force_desubsampling_inside_decompression =
1942
0
                        1;
1943
0
            }
1944
0
            else
1945
0
            {
1946
0
                if (o != 17)
1947
0
                    sp->subsampling_force_desubsampling_inside_decompression =
1948
0
                        1;
1949
0
            }
1950
0
        }
1951
0
        else
1952
0
        {
1953
0
            sp->sof_hv[q] = o;
1954
0
            if (sp->subsampling_force_desubsampling_inside_decompression == 0)
1955
0
            {
1956
0
                if (q == 0)
1957
0
                {
1958
0
                    if (o != ((sp->subsampling_hor << 4) | sp->subsampling_ver))
1959
0
                    {
1960
0
                        TIFFErrorExtR(tif, module,
1961
0
                                      "JPEG compressed data indicates "
1962
0
                                      "unexpected subsampling values");
1963
0
                        return (0);
1964
0
                    }
1965
0
                }
1966
0
                else
1967
0
                {
1968
0
                    if (o != 17)
1969
0
                    {
1970
0
                        TIFFErrorExtR(tif, module,
1971
0
                                      "JPEG compressed data indicates "
1972
0
                                      "unexpected subsampling values");
1973
0
                        return (0);
1974
0
                    }
1975
0
                }
1976
0
            }
1977
0
        }
1978
        /* Tq: Quantization table destination selector */
1979
0
        if (OJPEGReadByte(sp, &o) == 0)
1980
0
            return (0);
1981
0
        if (sp->subsamplingcorrect == 0)
1982
0
            sp->sof_tq[q] = o;
1983
0
    }
1984
0
    if (sp->subsamplingcorrect == 0)
1985
0
        sp->sof_log = 1;
1986
0
    return (1);
1987
0
}
1988
1989
static int OJPEGReadHeaderInfoSecStreamSos(TIFF *tif)
1990
0
{
1991
    /* this marker needs to be checked, and part of its data needs to be saved
1992
     * for regeneration later on */
1993
0
    static const char module[] = "OJPEGReadHeaderInfoSecStreamSos";
1994
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
1995
0
    uint16_t m;
1996
0
    uint8_t n;
1997
0
    uint8_t o;
1998
0
    assert(sp->subsamplingcorrect == 0);
1999
0
    if (sp->sof_log == 0)
2000
0
    {
2001
0
        TIFFErrorExtR(tif, module, "Corrupt SOS marker in JPEG data");
2002
0
        return (0);
2003
0
    }
2004
    /* Ls */
2005
0
    if (OJPEGReadWord(sp, &m) == 0)
2006
0
        return (0);
2007
0
    if (m != 6 + sp->samples_per_pixel_per_plane * 2)
2008
0
    {
2009
0
        TIFFErrorExtR(tif, module, "Corrupt SOS marker in JPEG data");
2010
0
        return (0);
2011
0
    }
2012
    /* Ns */
2013
0
    if (OJPEGReadByte(sp, &n) == 0)
2014
0
        return (0);
2015
0
    if (n != sp->samples_per_pixel_per_plane)
2016
0
    {
2017
0
        TIFFErrorExtR(tif, module, "Corrupt SOS marker in JPEG data");
2018
0
        return (0);
2019
0
    }
2020
    /* Cs, Td, and Ta */
2021
0
    for (o = 0; o < sp->samples_per_pixel_per_plane; o++)
2022
0
    {
2023
        /* Cs */
2024
0
        if (OJPEGReadByte(sp, &n) == 0)
2025
0
            return (0);
2026
0
        sp->sos_cs[sp->plane_sample_offset + o] = n;
2027
        /* Td and Ta */
2028
0
        if (OJPEGReadByte(sp, &n) == 0)
2029
0
            return (0);
2030
0
        sp->sos_tda[sp->plane_sample_offset + o] = n;
2031
0
    }
2032
    /* skip Ss, Se, Ah, en Al -> no check, as per Tom Lane recommendation, as
2033
     * per LibJpeg source */
2034
0
    OJPEGReadSkip(sp, 3);
2035
0
    return (1);
2036
0
}
2037
2038
static int OJPEGReadHeaderInfoSecTablesQTable(TIFF *tif)
2039
0
{
2040
0
    static const char module[] = "OJPEGReadHeaderInfoSecTablesQTable";
2041
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2042
0
    uint8_t m;
2043
0
    uint8_t n;
2044
0
    uint32_t oa;
2045
0
    uint8_t *ob;
2046
0
    uint32_t p;
2047
0
    if (sp->qtable_offset[0] == 0)
2048
0
    {
2049
0
        TIFFErrorExtR(tif, module, "Missing JPEG tables");
2050
0
        return (0);
2051
0
    }
2052
0
    sp->in_buffer_file_pos_log = 0;
2053
0
    for (m = 0; m < sp->samples_per_pixel; m++)
2054
0
    {
2055
0
        if ((sp->qtable_offset[m] != 0) &&
2056
0
            ((m == 0) || (sp->qtable_offset[m] != sp->qtable_offset[m - 1])))
2057
0
        {
2058
0
            for (n = 0; n < m - 1; n++)
2059
0
            {
2060
0
                if (sp->qtable_offset[m] == sp->qtable_offset[n])
2061
0
                {
2062
0
                    TIFFErrorExtR(tif, module, "Corrupt JpegQTables tag value");
2063
0
                    return (0);
2064
0
                }
2065
0
            }
2066
0
            oa = sizeof(uint32_t) + 69;
2067
0
            ob = (uint8_t *)_TIFFmallocExt(tif, oa);
2068
0
            if (ob == 0)
2069
0
            {
2070
0
                TIFFErrorExtR(tif, module, "Out of memory");
2071
0
                return (0);
2072
0
            }
2073
0
            *(uint32_t *)ob = oa;
2074
0
            ob[sizeof(uint32_t)] = 255;
2075
0
            ob[sizeof(uint32_t) + 1] = JPEG_MARKER_DQT;
2076
0
            ob[sizeof(uint32_t) + 2] = 0;
2077
0
            ob[sizeof(uint32_t) + 3] = 67;
2078
0
            ob[sizeof(uint32_t) + 4] = m;
2079
0
            TIFFSeekFile(tif, sp->qtable_offset[m], SEEK_SET);
2080
0
            p = (uint32_t)TIFFReadFile(tif, &ob[sizeof(uint32_t) + 5], 64);
2081
0
            if (p != 64)
2082
0
            {
2083
0
                _TIFFfreeExt(tif, ob);
2084
0
                return (0);
2085
0
            }
2086
0
            if (sp->qtable[m] != 0)
2087
0
                _TIFFfreeExt(tif, sp->qtable[m]);
2088
0
            sp->qtable[m] = ob;
2089
0
            sp->sof_tq[m] = m;
2090
0
        }
2091
0
        else
2092
0
            sp->sof_tq[m] = sp->sof_tq[m - 1];
2093
0
    }
2094
0
    return (1);
2095
0
}
2096
2097
static int OJPEGReadHeaderInfoSecTablesDcTable(TIFF *tif)
2098
0
{
2099
0
    static const char module[] = "OJPEGReadHeaderInfoSecTablesDcTable";
2100
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2101
0
    uint8_t m;
2102
0
    uint8_t n;
2103
0
    uint8_t o[16];
2104
0
    uint32_t p;
2105
0
    uint32_t q;
2106
0
    uint32_t ra;
2107
0
    uint8_t *rb;
2108
0
    if (sp->dctable_offset[0] == 0)
2109
0
    {
2110
0
        TIFFErrorExtR(tif, module, "Missing JPEG tables");
2111
0
        return (0);
2112
0
    }
2113
0
    sp->in_buffer_file_pos_log = 0;
2114
0
    for (m = 0; m < sp->samples_per_pixel; m++)
2115
0
    {
2116
0
        if ((sp->dctable_offset[m] != 0) &&
2117
0
            ((m == 0) || (sp->dctable_offset[m] != sp->dctable_offset[m - 1])))
2118
0
        {
2119
0
            for (n = 0; n < m - 1; n++)
2120
0
            {
2121
0
                if (sp->dctable_offset[m] == sp->dctable_offset[n])
2122
0
                {
2123
0
                    TIFFErrorExtR(tif, module,
2124
0
                                  "Corrupt JpegDcTables tag value");
2125
0
                    return (0);
2126
0
                }
2127
0
            }
2128
0
            TIFFSeekFile(tif, sp->dctable_offset[m], SEEK_SET);
2129
0
            p = (uint32_t)TIFFReadFile(tif, o, 16);
2130
0
            if (p != 16)
2131
0
                return (0);
2132
0
            q = 0;
2133
0
            for (n = 0; n < 16; n++)
2134
0
                q += o[n];
2135
0
            ra = (uint32_t)(sizeof(uint32_t) + 21 + q);
2136
0
            rb = (uint8_t *)_TIFFmallocExt(tif, ra);
2137
0
            if (rb == 0)
2138
0
            {
2139
0
                TIFFErrorExtR(tif, module, "Out of memory");
2140
0
                return (0);
2141
0
            }
2142
0
            *(uint32_t *)rb = ra;
2143
0
            rb[sizeof(uint32_t)] = 255;
2144
0
            rb[sizeof(uint32_t) + 1] = JPEG_MARKER_DHT;
2145
0
            rb[sizeof(uint32_t) + 2] = (uint8_t)((19 + q) >> 8);
2146
0
            rb[sizeof(uint32_t) + 3] = ((19 + q) & 255);
2147
0
            rb[sizeof(uint32_t) + 4] = m;
2148
0
            for (n = 0; n < 16; n++)
2149
0
                rb[sizeof(uint32_t) + 5 + n] = o[n];
2150
0
            p = (uint32_t)TIFFReadFile(tif, &(rb[sizeof(uint32_t) + 21]), q);
2151
0
            if (p != q)
2152
0
            {
2153
0
                _TIFFfreeExt(tif, rb);
2154
0
                return (0);
2155
0
            }
2156
0
            if (sp->dctable[m] != 0)
2157
0
                _TIFFfreeExt(tif, sp->dctable[m]);
2158
0
            sp->dctable[m] = rb;
2159
0
            sp->sos_tda[m] = (uint8_t)(m << 4);
2160
0
        }
2161
0
        else
2162
0
            sp->sos_tda[m] = sp->sos_tda[m - 1];
2163
0
    }
2164
0
    return (1);
2165
0
}
2166
2167
static int OJPEGReadHeaderInfoSecTablesAcTable(TIFF *tif)
2168
0
{
2169
0
    static const char module[] = "OJPEGReadHeaderInfoSecTablesAcTable";
2170
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2171
0
    uint8_t m;
2172
0
    uint8_t n;
2173
0
    uint8_t o[16];
2174
0
    uint32_t p;
2175
0
    uint32_t q;
2176
0
    uint32_t ra;
2177
0
    uint8_t *rb;
2178
0
    if (sp->actable_offset[0] == 0)
2179
0
    {
2180
0
        TIFFErrorExtR(tif, module, "Missing JPEG tables");
2181
0
        return (0);
2182
0
    }
2183
0
    sp->in_buffer_file_pos_log = 0;
2184
0
    for (m = 0; m < sp->samples_per_pixel; m++)
2185
0
    {
2186
0
        if ((sp->actable_offset[m] != 0) &&
2187
0
            ((m == 0) || (sp->actable_offset[m] != sp->actable_offset[m - 1])))
2188
0
        {
2189
0
            for (n = 0; n < m - 1; n++)
2190
0
            {
2191
0
                if (sp->actable_offset[m] == sp->actable_offset[n])
2192
0
                {
2193
0
                    TIFFErrorExtR(tif, module,
2194
0
                                  "Corrupt JpegAcTables tag value");
2195
0
                    return (0);
2196
0
                }
2197
0
            }
2198
0
            TIFFSeekFile(tif, sp->actable_offset[m], SEEK_SET);
2199
0
            p = (uint32_t)TIFFReadFile(tif, o, 16);
2200
0
            if (p != 16)
2201
0
                return (0);
2202
0
            q = 0;
2203
0
            for (n = 0; n < 16; n++)
2204
0
                q += o[n];
2205
0
            ra = (uint32_t)(sizeof(uint32_t) + 21 + q);
2206
0
            rb = (uint8_t *)_TIFFmallocExt(tif, ra);
2207
0
            if (rb == 0)
2208
0
            {
2209
0
                TIFFErrorExtR(tif, module, "Out of memory");
2210
0
                return (0);
2211
0
            }
2212
0
            *(uint32_t *)rb = ra;
2213
0
            rb[sizeof(uint32_t)] = 255;
2214
0
            rb[sizeof(uint32_t) + 1] = JPEG_MARKER_DHT;
2215
0
            rb[sizeof(uint32_t) + 2] = (uint8_t)((19 + q) >> 8);
2216
0
            rb[sizeof(uint32_t) + 3] = ((19 + q) & 255);
2217
0
            rb[sizeof(uint32_t) + 4] = (16 | m);
2218
0
            for (n = 0; n < 16; n++)
2219
0
                rb[sizeof(uint32_t) + 5 + n] = o[n];
2220
0
            p = (uint32_t)TIFFReadFile(tif, &(rb[sizeof(uint32_t) + 21]), q);
2221
0
            if (p != q)
2222
0
            {
2223
0
                _TIFFfreeExt(tif, rb);
2224
0
                return (0);
2225
0
            }
2226
0
            if (sp->actable[m] != 0)
2227
0
                _TIFFfreeExt(tif, sp->actable[m]);
2228
0
            sp->actable[m] = rb;
2229
0
            sp->sos_tda[m] = (sp->sos_tda[m] | m);
2230
0
        }
2231
0
        else
2232
0
            sp->sos_tda[m] = (sp->sos_tda[m] | (sp->sos_tda[m - 1] & 15));
2233
0
    }
2234
0
    return (1);
2235
0
}
2236
2237
static int OJPEGReadBufferFill(OJPEGState *sp)
2238
0
{
2239
0
    uint16_t m;
2240
0
    tmsize_t n;
2241
    /* TODO: double-check: when subsamplingcorrect is set, no call to
2242
     * TIFFErrorExt or TIFFWarningExt should be made in any other case, seek or
2243
     * read errors should be passed through */
2244
0
    do
2245
0
    {
2246
0
        if (sp->in_buffer_file_togo != 0)
2247
0
        {
2248
0
            if (sp->in_buffer_file_pos_log == 0)
2249
0
            {
2250
0
                TIFFSeekFile(sp->tif, sp->in_buffer_file_pos, SEEK_SET);
2251
0
                sp->in_buffer_file_pos_log = 1;
2252
0
            }
2253
0
            m = OJPEG_BUFFER;
2254
0
            if ((uint64_t)m > sp->in_buffer_file_togo)
2255
0
                m = (uint16_t)sp->in_buffer_file_togo;
2256
0
            n = TIFFReadFile(sp->tif, sp->in_buffer, (tmsize_t)m);
2257
0
            if (n <= 0)
2258
0
                return (0);
2259
0
            assert(n > 0);
2260
0
            assert(n <= OJPEG_BUFFER);
2261
0
            assert(n < 65536);
2262
0
            assert((uint64_t)n <= sp->in_buffer_file_togo);
2263
0
            m = (uint16_t)n;
2264
0
            sp->in_buffer_togo = m;
2265
0
            sp->in_buffer_cur = sp->in_buffer;
2266
0
            sp->in_buffer_file_togo -= m;
2267
0
            sp->in_buffer_file_pos += m;
2268
0
            break;
2269
0
        }
2270
0
        sp->in_buffer_file_pos_log = 0;
2271
0
        switch (sp->in_buffer_source)
2272
0
        {
2273
0
            case osibsNotSetYet:
2274
0
                if (sp->jpeg_interchange_format != 0)
2275
0
                {
2276
0
                    sp->in_buffer_file_pos = sp->jpeg_interchange_format;
2277
0
                    sp->in_buffer_file_togo =
2278
0
                        sp->jpeg_interchange_format_length;
2279
0
                }
2280
0
                sp->in_buffer_source = osibsJpegInterchangeFormat;
2281
0
                break;
2282
0
            case osibsJpegInterchangeFormat:
2283
0
                sp->in_buffer_source = osibsStrile;
2284
0
                break;
2285
0
            case osibsStrile:
2286
0
                if (sp->in_buffer_next_strile == sp->in_buffer_strile_count)
2287
0
                    sp->in_buffer_source = osibsEof;
2288
0
                else
2289
0
                {
2290
0
                    int err = 0;
2291
0
                    sp->in_buffer_file_pos = TIFFGetStrileOffsetWithErr(
2292
0
                        sp->tif, sp->in_buffer_next_strile, &err);
2293
0
                    if (err)
2294
0
                        return 0;
2295
0
                    if (sp->in_buffer_file_pos != 0)
2296
0
                    {
2297
0
                        uint64_t bytecount = TIFFGetStrileByteCountWithErr(
2298
0
                            sp->tif, sp->in_buffer_next_strile, &err);
2299
0
                        if (err)
2300
0
                            return 0;
2301
0
                        if (sp->in_buffer_file_pos >= sp->file_size)
2302
0
                            sp->in_buffer_file_pos = 0;
2303
0
                        else if (bytecount == 0)
2304
0
                            sp->in_buffer_file_togo =
2305
0
                                sp->file_size - sp->in_buffer_file_pos;
2306
0
                        else
2307
0
                        {
2308
0
                            sp->in_buffer_file_togo = bytecount;
2309
0
                            if (sp->in_buffer_file_togo == 0)
2310
0
                                sp->in_buffer_file_pos = 0;
2311
0
                            else if (sp->in_buffer_file_pos >
2312
0
                                         UINT64_MAX - sp->in_buffer_file_togo ||
2313
0
                                     sp->in_buffer_file_pos +
2314
0
                                             sp->in_buffer_file_togo >
2315
0
                                         sp->file_size)
2316
0
                                sp->in_buffer_file_togo =
2317
0
                                    sp->file_size - sp->in_buffer_file_pos;
2318
0
                        }
2319
0
                    }
2320
0
                    sp->in_buffer_next_strile++;
2321
0
                }
2322
0
                break;
2323
0
            case osibsEof:
2324
0
            default:
2325
0
                return (0);
2326
0
        }
2327
0
    } while (1);
2328
0
    return (1);
2329
0
}
2330
2331
static int OJPEGReadByte(OJPEGState *sp, uint8_t *byte)
2332
0
{
2333
0
    if (sp->in_buffer_togo == 0)
2334
0
    {
2335
0
        if (OJPEGReadBufferFill(sp) == 0)
2336
0
            return (0);
2337
0
        assert(sp->in_buffer_togo > 0);
2338
0
    }
2339
0
    *byte = *(sp->in_buffer_cur);
2340
0
    sp->in_buffer_cur++;
2341
0
    sp->in_buffer_togo--;
2342
0
    return (1);
2343
0
}
2344
2345
static int OJPEGReadBytePeek(OJPEGState *sp, uint8_t *byte)
2346
0
{
2347
0
    if (sp->in_buffer_togo == 0)
2348
0
    {
2349
0
        if (OJPEGReadBufferFill(sp) == 0)
2350
0
            return (0);
2351
0
        assert(sp->in_buffer_togo > 0);
2352
0
    }
2353
0
    *byte = *(sp->in_buffer_cur);
2354
0
    return (1);
2355
0
}
2356
2357
static void OJPEGReadByteAdvance(OJPEGState *sp)
2358
0
{
2359
0
    assert(sp->in_buffer_togo > 0);
2360
0
    sp->in_buffer_cur++;
2361
0
    sp->in_buffer_togo--;
2362
0
}
2363
2364
static int OJPEGReadWord(OJPEGState *sp, uint16_t *word)
2365
0
{
2366
0
    uint8_t m;
2367
0
    if (OJPEGReadByte(sp, &m) == 0)
2368
0
        return (0);
2369
0
    *word = (uint16_t)(m << 8);
2370
0
    if (OJPEGReadByte(sp, &m) == 0)
2371
0
        return (0);
2372
0
    *word |= m;
2373
0
    return (1);
2374
0
}
2375
2376
static int OJPEGReadBlock(OJPEGState *sp, uint16_t len, void *mem)
2377
0
{
2378
0
    uint16_t mlen;
2379
0
    uint8_t *mmem;
2380
0
    uint16_t n;
2381
0
    assert(len > 0);
2382
0
    mlen = len;
2383
0
    mmem = (uint8_t *)mem;
2384
0
    do
2385
0
    {
2386
0
        if (sp->in_buffer_togo == 0)
2387
0
        {
2388
0
            if (OJPEGReadBufferFill(sp) == 0)
2389
0
                return (0);
2390
0
            assert(sp->in_buffer_togo > 0);
2391
0
        }
2392
0
        n = mlen;
2393
0
        if (n > sp->in_buffer_togo)
2394
0
            n = sp->in_buffer_togo;
2395
0
        _TIFFmemcpy(mmem, sp->in_buffer_cur, n);
2396
0
        sp->in_buffer_cur += n;
2397
0
        sp->in_buffer_togo = (uint16_t)(sp->in_buffer_togo - n);
2398
0
        mlen = (uint16_t)(mlen - n);
2399
0
        mmem += n;
2400
0
    } while (mlen > 0);
2401
0
    return (1);
2402
0
}
2403
2404
static void OJPEGReadSkip(OJPEGState *sp, uint16_t len)
2405
0
{
2406
0
    uint16_t m;
2407
0
    uint16_t n;
2408
0
    m = len;
2409
0
    n = m;
2410
0
    if (n > sp->in_buffer_togo)
2411
0
        n = sp->in_buffer_togo;
2412
0
    sp->in_buffer_cur += n;
2413
0
    sp->in_buffer_togo = (uint16_t)(sp->in_buffer_togo - n);
2414
0
    m = (uint16_t)(m - n);
2415
0
    if (m > 0)
2416
0
    {
2417
0
        assert(sp->in_buffer_togo == 0);
2418
0
        n = m;
2419
0
        if ((uint64_t)n > sp->in_buffer_file_togo)
2420
0
            n = (uint16_t)sp->in_buffer_file_togo;
2421
0
        sp->in_buffer_file_pos += n;
2422
0
        sp->in_buffer_file_togo -= n;
2423
0
        sp->in_buffer_file_pos_log = 0;
2424
        /* we don't skip past jpeginterchangeformat/strile block...
2425
         * if that is asked from us, we're dealing with totally bazurk
2426
         * data anyway, and we've not seen this happening on any
2427
         * testfile, so we might as well likely cause some other
2428
         * meaningless error to be passed at some later time
2429
         */
2430
0
    }
2431
0
}
2432
2433
static int OJPEGWriteStream(TIFF *tif, void **mem, uint32_t *len)
2434
0
{
2435
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2436
0
    *len = 0;
2437
0
    do
2438
0
    {
2439
0
        assert(sp->out_state <= ososEoi);
2440
0
        switch (sp->out_state)
2441
0
        {
2442
0
            case ososSoi:
2443
0
                OJPEGWriteStreamSoi(tif, mem, len);
2444
0
                break;
2445
0
            case ososQTable0:
2446
0
                OJPEGWriteStreamQTable(tif, 0, mem, len);
2447
0
                break;
2448
0
            case ososQTable1:
2449
0
                OJPEGWriteStreamQTable(tif, 1, mem, len);
2450
0
                break;
2451
0
            case ososQTable2:
2452
0
                OJPEGWriteStreamQTable(tif, 2, mem, len);
2453
0
                break;
2454
0
            case ososQTable3:
2455
0
                OJPEGWriteStreamQTable(tif, 3, mem, len);
2456
0
                break;
2457
0
            case ososDcTable0:
2458
0
                OJPEGWriteStreamDcTable(tif, 0, mem, len);
2459
0
                break;
2460
0
            case ososDcTable1:
2461
0
                OJPEGWriteStreamDcTable(tif, 1, mem, len);
2462
0
                break;
2463
0
            case ososDcTable2:
2464
0
                OJPEGWriteStreamDcTable(tif, 2, mem, len);
2465
0
                break;
2466
0
            case ososDcTable3:
2467
0
                OJPEGWriteStreamDcTable(tif, 3, mem, len);
2468
0
                break;
2469
0
            case ososAcTable0:
2470
0
                OJPEGWriteStreamAcTable(tif, 0, mem, len);
2471
0
                break;
2472
0
            case ososAcTable1:
2473
0
                OJPEGWriteStreamAcTable(tif, 1, mem, len);
2474
0
                break;
2475
0
            case ososAcTable2:
2476
0
                OJPEGWriteStreamAcTable(tif, 2, mem, len);
2477
0
                break;
2478
0
            case ososAcTable3:
2479
0
                OJPEGWriteStreamAcTable(tif, 3, mem, len);
2480
0
                break;
2481
0
            case ososDri:
2482
0
                OJPEGWriteStreamDri(tif, mem, len);
2483
0
                break;
2484
0
            case ososSof:
2485
0
                OJPEGWriteStreamSof(tif, mem, len);
2486
0
                break;
2487
0
            case ososSos:
2488
0
                OJPEGWriteStreamSos(tif, mem, len);
2489
0
                break;
2490
0
            case ososCompressed:
2491
0
                if (OJPEGWriteStreamCompressed(tif, mem, len) == 0)
2492
0
                    return (0);
2493
0
                break;
2494
0
            case ososRst:
2495
0
                OJPEGWriteStreamRst(tif, mem, len);
2496
0
                break;
2497
0
            case ososEoi:
2498
0
                OJPEGWriteStreamEoi(tif, mem, len);
2499
0
                break;
2500
0
            default:
2501
0
                break;
2502
0
        }
2503
0
    } while (*len == 0);
2504
0
    return (1);
2505
0
}
2506
2507
static void OJPEGWriteStreamSoi(TIFF *tif, void **mem, uint32_t *len)
2508
0
{
2509
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2510
0
    assert(OJPEG_BUFFER >= 2);
2511
0
    sp->out_buffer[0] = 255;
2512
0
    sp->out_buffer[1] = JPEG_MARKER_SOI;
2513
0
    *len = 2;
2514
0
    *mem = (void *)sp->out_buffer;
2515
0
    sp->out_state = (OJPEGStateOutState)(sp->out_state + 1);
2516
0
}
2517
2518
static void OJPEGWriteStreamQTable(TIFF *tif, uint8_t table_index, void **mem,
2519
                                   uint32_t *len)
2520
0
{
2521
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2522
0
    if (sp->qtable[table_index] != 0)
2523
0
    {
2524
0
        *mem = (void *)(sp->qtable[table_index] + sizeof(uint32_t));
2525
0
        *len = (uint32_t)(*((uint32_t *)sp->qtable[table_index]) -
2526
0
                          sizeof(uint32_t));
2527
0
    }
2528
0
    sp->out_state = (OJPEGStateOutState)(sp->out_state + 1);
2529
0
}
2530
2531
static void OJPEGWriteStreamDcTable(TIFF *tif, uint8_t table_index, void **mem,
2532
                                    uint32_t *len)
2533
0
{
2534
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2535
0
    if (sp->dctable[table_index] != 0)
2536
0
    {
2537
0
        *mem = (void *)(sp->dctable[table_index] + sizeof(uint32_t));
2538
0
        *len = (uint32_t)(*((uint32_t *)sp->dctable[table_index]) -
2539
0
                          sizeof(uint32_t));
2540
0
    }
2541
0
    sp->out_state = (OJPEGStateOutState)(sp->out_state + 1);
2542
0
}
2543
2544
static void OJPEGWriteStreamAcTable(TIFF *tif, uint8_t table_index, void **mem,
2545
                                    uint32_t *len)
2546
0
{
2547
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2548
0
    if (sp->actable[table_index] != 0)
2549
0
    {
2550
0
        *mem = (void *)(sp->actable[table_index] + sizeof(uint32_t));
2551
0
        *len = (uint32_t)(*((uint32_t *)sp->actable[table_index]) -
2552
0
                          sizeof(uint32_t));
2553
0
    }
2554
0
    sp->out_state = (OJPEGStateOutState)(sp->out_state + 1);
2555
0
}
2556
2557
static void OJPEGWriteStreamDri(TIFF *tif, void **mem, uint32_t *len)
2558
0
{
2559
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2560
0
    assert(OJPEG_BUFFER >= 6);
2561
0
    if (sp->restart_interval != 0)
2562
0
    {
2563
0
        sp->out_buffer[0] = 255;
2564
0
        sp->out_buffer[1] = JPEG_MARKER_DRI;
2565
0
        sp->out_buffer[2] = 0;
2566
0
        sp->out_buffer[3] = 4;
2567
0
        sp->out_buffer[4] = (uint8_t)(sp->restart_interval >> 8);
2568
0
        sp->out_buffer[5] = (uint8_t)(sp->restart_interval & 255);
2569
0
        *len = 6;
2570
0
        *mem = (void *)sp->out_buffer;
2571
0
    }
2572
0
    sp->out_state = (OJPEGStateOutState)(sp->out_state + 1);
2573
0
}
2574
2575
static void OJPEGWriteStreamSof(TIFF *tif, void **mem, uint32_t *len)
2576
0
{
2577
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2578
0
    uint8_t m;
2579
0
    assert(OJPEG_BUFFER >= 2 + 8 + sp->samples_per_pixel_per_plane * 3);
2580
0
    assert(255 >= 8 + sp->samples_per_pixel_per_plane * 3);
2581
0
    sp->out_buffer[0] = 255;
2582
0
    sp->out_buffer[1] = sp->sof_marker_id;
2583
    /* Lf */
2584
0
    sp->out_buffer[2] = 0;
2585
0
    sp->out_buffer[3] = (uint8_t)(8 + sp->samples_per_pixel_per_plane * 3);
2586
    /* P */
2587
0
    sp->out_buffer[4] = 8;
2588
    /* Y */
2589
0
    sp->out_buffer[5] = (uint8_t)(sp->sof_y >> 8);
2590
0
    sp->out_buffer[6] = (uint8_t)(sp->sof_y & 255);
2591
    /* X */
2592
0
    sp->out_buffer[7] = (uint8_t)(sp->sof_x >> 8);
2593
0
    sp->out_buffer[8] = (uint8_t)(sp->sof_x & 255);
2594
    /* Nf */
2595
0
    sp->out_buffer[9] = sp->samples_per_pixel_per_plane;
2596
0
    for (m = 0; m < sp->samples_per_pixel_per_plane; m++)
2597
0
    {
2598
        /* C */
2599
0
        sp->out_buffer[10 + m * 3] = sp->sof_c[sp->plane_sample_offset + m];
2600
        /* H and V */
2601
0
        sp->out_buffer[10 + m * 3 + 1] =
2602
0
            sp->sof_hv[sp->plane_sample_offset + m];
2603
        /* Tq */
2604
0
        sp->out_buffer[10 + m * 3 + 2] =
2605
0
            sp->sof_tq[sp->plane_sample_offset + m];
2606
0
    }
2607
0
    *len = 10 + (uint32_t)sp->samples_per_pixel_per_plane * 3;
2608
0
    *mem = (void *)sp->out_buffer;
2609
0
    sp->out_state = (OJPEGStateOutState)(sp->out_state + 1);
2610
0
}
2611
2612
static void OJPEGWriteStreamSos(TIFF *tif, void **mem, uint32_t *len)
2613
0
{
2614
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2615
0
    uint8_t m;
2616
0
    assert(OJPEG_BUFFER >= 2 + 6 + sp->samples_per_pixel_per_plane * 2);
2617
0
    assert(255 >= 6 + sp->samples_per_pixel_per_plane * 2);
2618
0
    sp->out_buffer[0] = 255;
2619
0
    sp->out_buffer[1] = JPEG_MARKER_SOS;
2620
    /* Ls */
2621
0
    sp->out_buffer[2] = 0;
2622
0
    sp->out_buffer[3] = (uint8_t)(6 + sp->samples_per_pixel_per_plane * 2);
2623
    /* Ns */
2624
0
    sp->out_buffer[4] = sp->samples_per_pixel_per_plane;
2625
0
    for (m = 0; m < sp->samples_per_pixel_per_plane; m++)
2626
0
    {
2627
        /* Cs */
2628
0
        sp->out_buffer[5 + m * 2] = sp->sos_cs[sp->plane_sample_offset + m];
2629
        /* Td and Ta */
2630
0
        sp->out_buffer[5 + m * 2 + 1] =
2631
0
            sp->sos_tda[sp->plane_sample_offset + m];
2632
0
    }
2633
    /* Ss */
2634
0
    sp->out_buffer[5 + sp->samples_per_pixel_per_plane * 2] = 0;
2635
    /* Se */
2636
0
    sp->out_buffer[5 + sp->samples_per_pixel_per_plane * 2 + 1] = 63;
2637
    /* Ah and Al */
2638
0
    sp->out_buffer[5 + sp->samples_per_pixel_per_plane * 2 + 2] = 0;
2639
0
    *len = 8 + (uint32_t)sp->samples_per_pixel_per_plane * 2;
2640
0
    *mem = (void *)sp->out_buffer;
2641
0
    sp->out_state = (OJPEGStateOutState)(sp->out_state + 1);
2642
0
}
2643
2644
static int OJPEGWriteStreamCompressed(TIFF *tif, void **mem, uint32_t *len)
2645
0
{
2646
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2647
0
    if (sp->in_buffer_togo == 0)
2648
0
    {
2649
0
        if (OJPEGReadBufferFill(sp) == 0)
2650
0
            return (0);
2651
0
        assert(sp->in_buffer_togo > 0);
2652
0
    }
2653
0
    *len = sp->in_buffer_togo;
2654
0
    *mem = (void *)sp->in_buffer_cur;
2655
0
    sp->in_buffer_togo = 0;
2656
0
    if (sp->in_buffer_file_togo == 0)
2657
0
    {
2658
0
        switch (sp->in_buffer_source)
2659
0
        {
2660
0
            case osibsStrile:
2661
0
                if (sp->in_buffer_next_strile < sp->in_buffer_strile_count)
2662
0
                    sp->out_state = ososRst;
2663
0
                else
2664
0
                    sp->out_state = ososEoi;
2665
0
                break;
2666
0
            case osibsEof:
2667
0
                sp->out_state = ososEoi;
2668
0
                break;
2669
0
            case osibsNotSetYet:
2670
0
            case osibsJpegInterchangeFormat:
2671
0
            default:
2672
0
                break;
2673
0
        }
2674
0
    }
2675
0
    return (1);
2676
0
}
2677
2678
static void OJPEGWriteStreamRst(TIFF *tif, void **mem, uint32_t *len)
2679
0
{
2680
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2681
0
    assert(OJPEG_BUFFER >= 2);
2682
0
    sp->out_buffer[0] = 255;
2683
0
    sp->out_buffer[1] = (uint8_t)(JPEG_MARKER_RST0 + sp->restart_index);
2684
0
    sp->restart_index++;
2685
0
    if (sp->restart_index == 8)
2686
0
        sp->restart_index = 0;
2687
0
    *len = 2;
2688
0
    *mem = (void *)sp->out_buffer;
2689
0
    sp->out_state = ososCompressed;
2690
0
}
2691
2692
static void OJPEGWriteStreamEoi(TIFF *tif, void **mem, uint32_t *len)
2693
0
{
2694
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2695
0
    assert(OJPEG_BUFFER >= 2);
2696
0
    sp->out_buffer[0] = 255;
2697
0
    sp->out_buffer[1] = JPEG_MARKER_EOI;
2698
0
    *len = 2;
2699
0
    *mem = (void *)sp->out_buffer;
2700
0
}
2701
2702
#ifndef LIBJPEG_ENCAP_EXTERNAL
2703
static int jpeg_create_decompress_encap(OJPEGState *sp,
2704
                                        tiff_ojpeg_decompress_struct *cinfo)
2705
0
{
2706
0
    if (SETJMP(sp->exit_jmpbuf))
2707
0
        return 0;
2708
0
    else
2709
0
    {
2710
0
        jpeg_create_decompress(cinfo);
2711
0
        return 1;
2712
0
    }
2713
0
}
2714
#endif
2715
2716
#ifndef LIBJPEG_ENCAP_EXTERNAL
2717
static int jpeg_read_header_encap(OJPEGState *sp,
2718
                                  tiff_ojpeg_decompress_struct *cinfo,
2719
                                  uint8_t require_image)
2720
0
{
2721
0
    if (SETJMP(sp->exit_jmpbuf))
2722
0
        return 0;
2723
0
    else
2724
0
    {
2725
0
        jpeg_read_header(cinfo, require_image);
2726
0
        return 1;
2727
0
    }
2728
0
}
2729
#endif
2730
2731
#ifndef LIBJPEG_ENCAP_EXTERNAL
2732
static int jpeg_start_decompress_encap(OJPEGState *sp,
2733
                                       tiff_ojpeg_decompress_struct *cinfo)
2734
0
{
2735
0
    if (SETJMP(sp->exit_jmpbuf))
2736
0
        return 0;
2737
0
    else
2738
0
    {
2739
0
        jpeg_start_decompress(cinfo);
2740
0
        return 1;
2741
0
    }
2742
0
}
2743
#endif
2744
2745
#ifndef LIBJPEG_ENCAP_EXTERNAL
2746
static int jpeg_read_scanlines_encap(OJPEGState *sp,
2747
                                     tiff_ojpeg_decompress_struct *cinfo,
2748
                                     void *scanlines, uint32_t max_lines)
2749
0
{
2750
0
    if (SETJMP(sp->exit_jmpbuf))
2751
0
        return 0;
2752
0
    else
2753
0
    {
2754
0
        jpeg_read_scanlines(cinfo, (JSAMPARRAY)scanlines, max_lines);
2755
0
        return 1;
2756
0
    }
2757
0
}
2758
#endif
2759
2760
#ifndef LIBJPEG_ENCAP_EXTERNAL
2761
static int jpeg_read_raw_data_encap(OJPEGState *sp,
2762
                                    tiff_ojpeg_decompress_struct *cinfo,
2763
                                    void *data, uint32_t max_lines)
2764
0
{
2765
0
    if (SETJMP(sp->exit_jmpbuf))
2766
0
        return 0;
2767
0
    else
2768
0
    {
2769
0
        jpeg_read_raw_data(cinfo, (JSAMPIMAGE)data, max_lines);
2770
0
        return 1;
2771
0
    }
2772
0
}
2773
#endif
2774
2775
#ifndef LIBJPEG_ENCAP_EXTERNAL
2776
static void jpeg_encap_unwind(TIFF *tif)
2777
0
{
2778
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2779
0
    LONGJMP(sp->exit_jmpbuf, 1);
2780
0
}
2781
#endif
2782
2783
static void
2784
OJPEGLibjpegJpegErrorMgrOutputMessage(tiff_ojpeg_common_struct *cinfo)
2785
0
{
2786
0
    char buffer[JMSG_LENGTH_MAX];
2787
0
    (*cinfo->err->format_message)(cinfo, buffer);
2788
0
    TIFFWarningExtR(((TIFF *)(cinfo->client_data)), "LibJpeg", "%s", buffer);
2789
0
}
2790
2791
static void OJPEGLibjpegJpegErrorMgrErrorExit(tiff_ojpeg_common_struct *cinfo)
2792
0
{
2793
0
    char buffer[JMSG_LENGTH_MAX];
2794
0
    (*cinfo->err->format_message)(cinfo, buffer);
2795
0
    TIFFErrorExtR(((TIFF *)(cinfo->client_data)), "LibJpeg", "%s", buffer);
2796
0
    jpeg_encap_unwind((TIFF *)(cinfo->client_data));
2797
0
}
2798
2799
static void
2800
OJPEGLibjpegJpegSourceMgrInitSource(tiff_ojpeg_decompress_struct *cinfo)
2801
0
{
2802
0
    (void)cinfo;
2803
0
}
2804
2805
static boolean
2806
OJPEGLibjpegJpegSourceMgrFillInputBuffer(tiff_ojpeg_decompress_struct *cinfo)
2807
0
{
2808
0
    TIFF *tif = (TIFF *)cinfo->client_data;
2809
0
    OJPEGState *sp = (OJPEGState *)tif->tif_data;
2810
0
    void *mem = 0;
2811
0
    uint32_t len = 0U;
2812
0
    if (OJPEGWriteStream(tif, &mem, &len) == 0)
2813
0
    {
2814
0
        TIFFErrorExtR(tif, "LibJpeg", "Premature end of JPEG data");
2815
0
        jpeg_encap_unwind(tif);
2816
0
    }
2817
0
    sp->libjpeg_jpeg_source_mgr.bytes_in_buffer = len;
2818
0
    sp->libjpeg_jpeg_source_mgr.next_input_byte = (const JOCTET *)mem;
2819
0
    return (1);
2820
0
}
2821
2822
static void
2823
OJPEGLibjpegJpegSourceMgrSkipInputData(tiff_ojpeg_decompress_struct *cinfo,
2824
                                       long num_bytes)
2825
0
{
2826
0
    TIFF *tif = (TIFF *)cinfo->client_data;
2827
0
    (void)num_bytes;
2828
0
    TIFFErrorExtR(tif, "LibJpeg", "Unexpected error");
2829
0
    jpeg_encap_unwind(tif);
2830
0
}
2831
2832
#ifdef _MSC_VER
2833
#pragma warning(push)
2834
#pragma warning(disable : 4702) /* unreachable code */
2835
#endif
2836
static boolean
2837
OJPEGLibjpegJpegSourceMgrResyncToRestart(tiff_ojpeg_decompress_struct *cinfo,
2838
                                         int desired)
2839
0
{
2840
0
    TIFF *tif = (TIFF *)cinfo->client_data;
2841
0
    (void)desired;
2842
0
    TIFFErrorExtR(tif, "LibJpeg", "Unexpected error");
2843
0
    jpeg_encap_unwind(tif);
2844
0
    return (0);
2845
0
}
2846
#ifdef _MSC_VER
2847
#pragma warning(pop)
2848
#endif
2849
2850
static void
2851
OJPEGLibjpegJpegSourceMgrTermSource(tiff_ojpeg_decompress_struct *cinfo)
2852
0
{
2853
0
    (void)cinfo;
2854
0
}
2855
2856
#endif