tif_dirread.c 275 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972197319741975197619771978197919801981198219831984198519861987198819891990199119921993199419951996199719981999200020012002200320042005200620072008200920102011201220132014201520162017201820192020202120222023202420252026202720282029203020312032203320342035203620372038203920402041204220432044204520462047204820492050205120522053205420552056205720582059206020612062206320642065206620672068206920702071207220732074207520762077207820792080208120822083208420852086208720882089209020912092209320942095209620972098209921002101210221032104210521062107210821092110211121122113211421152116211721182119212021212122212321242125212621272128212921302131213221332134213521362137213821392140214121422143214421452146214721482149215021512152215321542155215621572158215921602161216221632164216521662167216821692170217121722173217421752176217721782179218021812182218321842185218621872188218921902191219221932194219521962197219821992200220122022203220422052206220722082209221022112212221322142215221622172218221922202221222222232224222522262227222822292230223122322233223422352236223722382239224022412242224322442245224622472248224922502251225222532254225522562257225822592260226122622263226422652266226722682269227022712272227322742275227622772278227922802281228222832284228522862287228822892290229122922293229422952296229722982299230023012302230323042305230623072308230923102311231223132314231523162317231823192320232123222323232423252326232723282329233023312332233323342335233623372338233923402341234223432344234523462347234823492350235123522353235423552356235723582359236023612362236323642365236623672368236923702371237223732374237523762377237823792380238123822383238423852386238723882389239023912392239323942395239623972398239924002401240224032404240524062407240824092410241124122413241424152416241724182419242024212422242324242425242624272428242924302431243224332434243524362437243824392440244124422443244424452446244724482449245024512452245324542455245624572458245924602461246224632464246524662467246824692470247124722473247424752476247724782479248024812482248324842485248624872488248924902491249224932494249524962497249824992500250125022503250425052506250725082509251025112512251325142515251625172518251925202521252225232524252525262527252825292530253125322533253425352536253725382539254025412542254325442545254625472548254925502551255225532554255525562557255825592560256125622563256425652566256725682569257025712572257325742575257625772578257925802581258225832584258525862587258825892590259125922593259425952596259725982599260026012602260326042605260626072608260926102611261226132614261526162617261826192620262126222623262426252626262726282629263026312632263326342635263626372638263926402641264226432644264526462647264826492650265126522653265426552656265726582659266026612662266326642665266626672668266926702671267226732674267526762677267826792680268126822683268426852686268726882689269026912692269326942695269626972698269927002701270227032704270527062707270827092710271127122713271427152716271727182719272027212722272327242725272627272728272927302731273227332734273527362737273827392740274127422743274427452746274727482749275027512752275327542755275627572758275927602761276227632764276527662767276827692770277127722773277427752776277727782779278027812782278327842785278627872788278927902791279227932794279527962797279827992800280128022803280428052806280728082809281028112812281328142815281628172818281928202821282228232824282528262827282828292830283128322833283428352836283728382839284028412842284328442845284628472848284928502851285228532854285528562857285828592860286128622863286428652866286728682869287028712872287328742875287628772878287928802881288228832884288528862887288828892890289128922893289428952896289728982899290029012902290329042905290629072908290929102911291229132914291529162917291829192920292129222923292429252926292729282929293029312932293329342935293629372938293929402941294229432944294529462947294829492950295129522953295429552956295729582959296029612962296329642965296629672968296929702971297229732974297529762977297829792980298129822983298429852986298729882989299029912992299329942995299629972998299930003001300230033004300530063007300830093010301130123013301430153016301730183019302030213022302330243025302630273028302930303031303230333034303530363037303830393040304130423043304430453046304730483049305030513052305330543055305630573058305930603061306230633064306530663067306830693070307130723073307430753076307730783079308030813082308330843085308630873088308930903091309230933094309530963097309830993100310131023103310431053106310731083109311031113112311331143115311631173118311931203121312231233124312531263127312831293130313131323133313431353136313731383139314031413142314331443145314631473148314931503151315231533154315531563157315831593160316131623163316431653166316731683169317031713172317331743175317631773178317931803181318231833184318531863187318831893190319131923193319431953196319731983199320032013202320332043205320632073208320932103211321232133214321532163217321832193220322132223223322432253226322732283229323032313232323332343235323632373238323932403241324232433244324532463247324832493250325132523253325432553256325732583259326032613262326332643265326632673268326932703271327232733274327532763277327832793280328132823283328432853286328732883289329032913292329332943295329632973298329933003301330233033304330533063307330833093310331133123313331433153316331733183319332033213322332333243325332633273328332933303331333233333334333533363337333833393340334133423343334433453346334733483349335033513352335333543355335633573358335933603361336233633364336533663367336833693370337133723373337433753376337733783379338033813382338333843385338633873388338933903391339233933394339533963397339833993400340134023403340434053406340734083409341034113412341334143415341634173418341934203421342234233424342534263427342834293430343134323433343434353436343734383439344034413442344334443445344634473448344934503451345234533454345534563457345834593460346134623463346434653466346734683469347034713472347334743475347634773478347934803481348234833484348534863487348834893490349134923493349434953496349734983499350035013502350335043505350635073508350935103511351235133514351535163517351835193520352135223523352435253526352735283529353035313532353335343535353635373538353935403541354235433544354535463547354835493550355135523553355435553556355735583559356035613562356335643565356635673568356935703571357235733574357535763577357835793580358135823583358435853586358735883589359035913592359335943595359635973598359936003601360236033604360536063607360836093610361136123613361436153616361736183619362036213622362336243625362636273628362936303631363236333634363536363637363836393640364136423643364436453646364736483649365036513652365336543655365636573658365936603661366236633664366536663667366836693670367136723673367436753676367736783679368036813682368336843685368636873688368936903691369236933694369536963697369836993700370137023703370437053706370737083709371037113712371337143715371637173718371937203721372237233724372537263727372837293730373137323733373437353736373737383739374037413742374337443745374637473748374937503751375237533754375537563757375837593760376137623763376437653766376737683769377037713772377337743775377637773778377937803781378237833784378537863787378837893790379137923793379437953796379737983799380038013802380338043805380638073808380938103811381238133814381538163817381838193820382138223823382438253826382738283829383038313832383338343835383638373838383938403841384238433844384538463847384838493850385138523853385438553856385738583859386038613862386338643865386638673868386938703871387238733874387538763877387838793880388138823883388438853886388738883889389038913892389338943895389638973898389939003901390239033904390539063907390839093910391139123913391439153916391739183919392039213922392339243925392639273928392939303931393239333934393539363937393839393940394139423943394439453946394739483949395039513952395339543955395639573958395939603961396239633964396539663967396839693970397139723973397439753976397739783979398039813982398339843985398639873988398939903991399239933994399539963997399839994000400140024003400440054006400740084009401040114012401340144015401640174018401940204021402240234024402540264027402840294030403140324033403440354036403740384039404040414042404340444045404640474048404940504051405240534054405540564057405840594060406140624063406440654066406740684069407040714072407340744075407640774078407940804081408240834084408540864087408840894090409140924093409440954096409740984099410041014102410341044105410641074108410941104111411241134114411541164117411841194120412141224123412441254126412741284129413041314132413341344135413641374138413941404141414241434144414541464147414841494150415141524153415441554156415741584159416041614162416341644165416641674168416941704171417241734174417541764177417841794180418141824183418441854186418741884189419041914192419341944195419641974198419942004201420242034204420542064207420842094210421142124213421442154216421742184219422042214222422342244225422642274228422942304231423242334234423542364237423842394240424142424243424442454246424742484249425042514252425342544255425642574258425942604261426242634264426542664267426842694270427142724273427442754276427742784279428042814282428342844285428642874288428942904291429242934294429542964297429842994300430143024303430443054306430743084309431043114312431343144315431643174318431943204321432243234324432543264327432843294330433143324333433443354336433743384339434043414342434343444345434643474348434943504351435243534354435543564357435843594360436143624363436443654366436743684369437043714372437343744375437643774378437943804381438243834384438543864387438843894390439143924393439443954396439743984399440044014402440344044405440644074408440944104411441244134414441544164417441844194420442144224423442444254426442744284429443044314432443344344435443644374438443944404441444244434444444544464447444844494450445144524453445444554456445744584459446044614462446344644465446644674468446944704471447244734474447544764477447844794480448144824483448444854486448744884489449044914492449344944495449644974498449945004501450245034504450545064507450845094510451145124513451445154516451745184519452045214522452345244525452645274528452945304531453245334534453545364537453845394540454145424543454445454546454745484549455045514552455345544555455645574558455945604561456245634564456545664567456845694570457145724573457445754576457745784579458045814582458345844585458645874588458945904591459245934594459545964597459845994600460146024603460446054606460746084609461046114612461346144615461646174618461946204621462246234624462546264627462846294630463146324633463446354636463746384639464046414642464346444645464646474648464946504651465246534654465546564657465846594660466146624663466446654666466746684669467046714672467346744675467646774678467946804681468246834684468546864687468846894690469146924693469446954696469746984699470047014702470347044705470647074708470947104711471247134714471547164717471847194720472147224723472447254726472747284729473047314732473347344735473647374738473947404741474247434744474547464747474847494750475147524753475447554756475747584759476047614762476347644765476647674768476947704771477247734774477547764777477847794780478147824783478447854786478747884789479047914792479347944795479647974798479948004801480248034804480548064807480848094810481148124813481448154816481748184819482048214822482348244825482648274828482948304831483248334834483548364837483848394840484148424843484448454846484748484849485048514852485348544855485648574858485948604861486248634864486548664867486848694870487148724873487448754876487748784879488048814882488348844885488648874888488948904891489248934894489548964897489848994900490149024903490449054906490749084909491049114912491349144915491649174918491949204921492249234924492549264927492849294930493149324933493449354936493749384939494049414942494349444945494649474948494949504951495249534954495549564957495849594960496149624963496449654966496749684969497049714972497349744975497649774978497949804981498249834984498549864987498849894990499149924993499449954996499749984999500050015002500350045005500650075008500950105011501250135014501550165017501850195020502150225023502450255026502750285029503050315032503350345035503650375038503950405041504250435044504550465047504850495050505150525053505450555056505750585059506050615062506350645065506650675068506950705071507250735074507550765077507850795080508150825083508450855086508750885089509050915092509350945095509650975098509951005101510251035104510551065107510851095110511151125113511451155116511751185119512051215122512351245125512651275128512951305131513251335134513551365137513851395140514151425143514451455146514751485149515051515152515351545155515651575158515951605161516251635164516551665167516851695170517151725173517451755176517751785179518051815182518351845185518651875188518951905191519251935194519551965197519851995200520152025203520452055206520752085209521052115212521352145215521652175218521952205221522252235224522552265227522852295230523152325233523452355236523752385239524052415242524352445245524652475248524952505251525252535254525552565257525852595260526152625263526452655266526752685269527052715272527352745275527652775278527952805281528252835284528552865287528852895290529152925293529452955296529752985299530053015302530353045305530653075308530953105311531253135314531553165317531853195320532153225323532453255326532753285329533053315332533353345335533653375338533953405341534253435344534553465347534853495350535153525353535453555356535753585359536053615362536353645365536653675368536953705371537253735374537553765377537853795380538153825383538453855386538753885389539053915392539353945395539653975398539954005401540254035404540554065407540854095410541154125413541454155416541754185419542054215422542354245425542654275428542954305431543254335434543554365437543854395440544154425443544454455446544754485449545054515452545354545455545654575458545954605461546254635464546554665467546854695470547154725473547454755476547754785479548054815482548354845485548654875488548954905491549254935494549554965497549854995500550155025503550455055506550755085509551055115512551355145515551655175518551955205521552255235524552555265527552855295530553155325533553455355536553755385539554055415542554355445545554655475548554955505551555255535554555555565557555855595560556155625563556455655566556755685569557055715572557355745575557655775578557955805581558255835584558555865587558855895590559155925593559455955596559755985599560056015602560356045605560656075608560956105611561256135614561556165617561856195620562156225623562456255626562756285629563056315632563356345635563656375638563956405641564256435644564556465647564856495650565156525653565456555656565756585659566056615662566356645665566656675668566956705671567256735674567556765677567856795680568156825683568456855686568756885689569056915692569356945695569656975698569957005701570257035704570557065707570857095710571157125713571457155716571757185719572057215722572357245725572657275728572957305731573257335734573557365737573857395740574157425743574457455746574757485749575057515752575357545755575657575758575957605761576257635764576557665767576857695770577157725773577457755776577757785779578057815782578357845785578657875788578957905791579257935794579557965797579857995800580158025803580458055806580758085809581058115812581358145815581658175818581958205821582258235824582558265827582858295830583158325833583458355836583758385839584058415842584358445845584658475848584958505851585258535854585558565857585858595860586158625863586458655866586758685869587058715872587358745875587658775878587958805881588258835884588558865887588858895890589158925893589458955896589758985899590059015902590359045905590659075908590959105911591259135914591559165917591859195920592159225923592459255926592759285929593059315932593359345935593659375938593959405941594259435944594559465947594859495950595159525953595459555956595759585959596059615962596359645965596659675968596959705971597259735974597559765977597859795980598159825983598459855986598759885989599059915992599359945995599659975998599960006001600260036004600560066007600860096010601160126013601460156016601760186019602060216022602360246025602660276028602960306031603260336034603560366037603860396040604160426043604460456046604760486049605060516052605360546055605660576058605960606061606260636064606560666067606860696070607160726073607460756076607760786079608060816082608360846085608660876088608960906091609260936094609560966097609860996100610161026103610461056106610761086109611061116112611361146115611661176118611961206121612261236124612561266127612861296130613161326133613461356136613761386139614061416142614361446145614661476148614961506151615261536154615561566157615861596160616161626163616461656166616761686169617061716172617361746175617661776178617961806181618261836184618561866187618861896190619161926193619461956196619761986199620062016202620362046205620662076208620962106211621262136214621562166217621862196220622162226223622462256226622762286229623062316232623362346235623662376238623962406241624262436244624562466247624862496250625162526253625462556256625762586259626062616262626362646265626662676268626962706271627262736274627562766277627862796280628162826283628462856286628762886289629062916292629362946295629662976298629963006301630263036304630563066307630863096310631163126313631463156316631763186319632063216322632363246325632663276328632963306331633263336334633563366337633863396340634163426343634463456346634763486349635063516352635363546355635663576358635963606361636263636364636563666367636863696370637163726373637463756376637763786379638063816382638363846385638663876388638963906391639263936394639563966397639863996400640164026403640464056406640764086409641064116412641364146415641664176418641964206421642264236424642564266427642864296430643164326433643464356436643764386439644064416442644364446445644664476448644964506451645264536454645564566457645864596460646164626463646464656466646764686469647064716472647364746475647664776478647964806481648264836484648564866487648864896490649164926493649464956496649764986499650065016502650365046505650665076508650965106511651265136514651565166517651865196520652165226523652465256526652765286529653065316532653365346535653665376538653965406541654265436544654565466547654865496550655165526553655465556556655765586559656065616562656365646565656665676568656965706571657265736574657565766577657865796580658165826583658465856586658765886589659065916592659365946595659665976598659966006601660266036604660566066607660866096610661166126613661466156616661766186619662066216622662366246625662666276628662966306631663266336634663566366637663866396640664166426643664466456646664766486649665066516652665366546655665666576658665966606661666266636664666566666667666866696670667166726673667466756676667766786679668066816682668366846685668666876688668966906691669266936694669566966697669866996700670167026703670467056706670767086709671067116712671367146715671667176718671967206721672267236724672567266727672867296730673167326733673467356736673767386739674067416742674367446745674667476748674967506751675267536754675567566757675867596760676167626763676467656766676767686769677067716772677367746775677667776778677967806781678267836784678567866787678867896790679167926793679467956796679767986799680068016802680368046805680668076808680968106811681268136814681568166817681868196820682168226823682468256826682768286829683068316832683368346835683668376838683968406841684268436844684568466847684868496850685168526853685468556856685768586859686068616862686368646865686668676868686968706871687268736874687568766877687868796880688168826883688468856886688768886889689068916892689368946895689668976898689969006901690269036904690569066907690869096910691169126913691469156916691769186919692069216922692369246925692669276928692969306931693269336934693569366937693869396940694169426943694469456946694769486949695069516952695369546955695669576958695969606961696269636964696569666967696869696970697169726973697469756976697769786979698069816982698369846985698669876988698969906991699269936994699569966997699869997000700170027003700470057006700770087009701070117012701370147015701670177018701970207021702270237024702570267027702870297030703170327033703470357036703770387039704070417042704370447045704670477048704970507051705270537054705570567057705870597060706170627063706470657066706770687069707070717072707370747075707670777078707970807081708270837084708570867087708870897090709170927093709470957096709770987099710071017102710371047105710671077108710971107111711271137114711571167117711871197120712171227123712471257126712771287129713071317132713371347135713671377138713971407141714271437144714571467147714871497150715171527153715471557156715771587159716071617162716371647165716671677168716971707171717271737174717571767177717871797180718171827183718471857186718771887189719071917192719371947195719671977198719972007201720272037204720572067207720872097210721172127213721472157216721772187219722072217222722372247225722672277228722972307231723272337234723572367237723872397240724172427243724472457246724772487249725072517252725372547255725672577258725972607261726272637264726572667267726872697270727172727273727472757276727772787279728072817282728372847285728672877288728972907291729272937294729572967297729872997300730173027303730473057306730773087309731073117312731373147315731673177318731973207321732273237324732573267327732873297330733173327333733473357336733773387339734073417342734373447345734673477348734973507351735273537354735573567357735873597360736173627363736473657366736773687369737073717372737373747375737673777378737973807381738273837384738573867387738873897390739173927393739473957396739773987399740074017402740374047405740674077408740974107411741274137414741574167417741874197420742174227423742474257426742774287429743074317432743374347435743674377438743974407441744274437444744574467447744874497450745174527453745474557456745774587459746074617462746374647465746674677468746974707471747274737474747574767477747874797480748174827483748474857486748774887489749074917492749374947495749674977498749975007501750275037504750575067507750875097510751175127513751475157516751775187519752075217522752375247525752675277528752975307531753275337534753575367537753875397540754175427543754475457546754775487549755075517552755375547555755675577558755975607561756275637564756575667567756875697570757175727573757475757576757775787579758075817582758375847585758675877588758975907591759275937594759575967597759875997600760176027603760476057606760776087609761076117612761376147615761676177618761976207621762276237624762576267627762876297630763176327633763476357636763776387639764076417642764376447645764676477648764976507651765276537654765576567657765876597660766176627663766476657666766776687669767076717672767376747675767676777678767976807681768276837684768576867687768876897690769176927693769476957696769776987699770077017702770377047705770677077708770977107711771277137714771577167717771877197720772177227723772477257726772777287729773077317732773377347735773677377738773977407741774277437744774577467747774877497750775177527753775477557756775777587759776077617762776377647765776677677768776977707771777277737774777577767777777877797780778177827783778477857786778777887789779077917792779377947795779677977798779978007801780278037804780578067807780878097810781178127813781478157816781778187819782078217822782378247825782678277828782978307831783278337834783578367837783878397840784178427843784478457846784778487849785078517852785378547855785678577858785978607861786278637864786578667867786878697870787178727873787478757876787778787879788078817882788378847885788678877888788978907891789278937894789578967897789878997900790179027903790479057906790779087909791079117912791379147915791679177918791979207921792279237924792579267927792879297930793179327933793479357936793779387939794079417942794379447945794679477948794979507951795279537954795579567957795879597960796179627963796479657966796779687969797079717972797379747975797679777978797979807981798279837984798579867987798879897990799179927993799479957996799779987999800080018002800380048005800680078008800980108011801280138014801580168017801880198020802180228023802480258026802780288029803080318032803380348035803680378038803980408041804280438044804580468047804880498050805180528053805480558056805780588059806080618062806380648065806680678068806980708071807280738074807580768077807880798080808180828083808480858086808780888089809080918092809380948095809680978098809981008101810281038104810581068107810881098110811181128113811481158116811781188119812081218122812381248125812681278128812981308131813281338134813581368137813881398140814181428143814481458146814781488149815081518152815381548155815681578158815981608161816281638164816581668167816881698170817181728173817481758176817781788179818081818182818381848185818681878188818981908191819281938194819581968197819881998200820182028203820482058206820782088209821082118212821382148215821682178218821982208221822282238224822582268227822882298230823182328233823482358236823782388239824082418242824382448245824682478248824982508251825282538254825582568257825882598260826182628263826482658266826782688269827082718272827382748275827682778278827982808281828282838284828582868287828882898290829182928293829482958296829782988299830083018302830383048305830683078308830983108311831283138314831583168317831883198320832183228323832483258326832783288329833083318332833383348335833683378338833983408341834283438344834583468347834883498350835183528353835483558356835783588359836083618362836383648365836683678368836983708371837283738374837583768377837883798380838183828383838483858386838783888389839083918392839383948395839683978398839984008401840284038404840584068407840884098410841184128413841484158416841784188419842084218422842384248425842684278428842984308431
  1. /*
  2. * Copyright (c) 1988-1997 Sam Leffler
  3. * Copyright (c) 1991-1997 Silicon Graphics, Inc.
  4. *
  5. * Permission to use, copy, modify, distribute, and sell this software and
  6. * its documentation for any purpose is hereby granted without fee, provided
  7. * that (i) the above copyright notices and this permission notice appear in
  8. * all copies of the software and related documentation, and (ii) the names of
  9. * Sam Leffler and Silicon Graphics may not be used in any advertising or
  10. * publicity relating to the software without the specific, prior written
  11. * permission of Sam Leffler and Silicon Graphics.
  12. *
  13. * THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND,
  14. * EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY
  15. * WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
  16. *
  17. * IN NO EVENT SHALL SAM LEFFLER OR SILICON GRAPHICS BE LIABLE FOR
  18. * ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND,
  19. * OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
  20. * WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF
  21. * LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
  22. * OF THIS SOFTWARE.
  23. */
  24. /*
  25. * TIFF Library.
  26. *
  27. * Directory Read Support Routines.
  28. */
  29. /* Suggested pending improvements:
  30. * - add a field 'field_info' to the TIFFDirEntry structure, and set that with
  31. * the pointer to the appropriate TIFFField structure early on in
  32. * TIFFReadDirectory, so as to eliminate current possibly repetitive lookup.
  33. */
  34. #include "tiffconf.h"
  35. #include "tiffiop.h"
  36. #include <float.h>
  37. #include <limits.h>
  38. #include <stdlib.h>
  39. #include <string.h>
  40. #define FAILED_FII ((uint32_t)-1)
  41. #ifdef HAVE_IEEEFP
  42. #define TIFFCvtIEEEFloatToNative(tif, n, fp)
  43. #define TIFFCvtIEEEDoubleToNative(tif, n, dp)
  44. #else
  45. extern void TIFFCvtIEEEFloatToNative(TIFF *, uint32_t, float *);
  46. extern void TIFFCvtIEEEDoubleToNative(TIFF *, uint32_t, double *);
  47. #endif
  48. enum TIFFReadDirEntryErr
  49. {
  50. TIFFReadDirEntryErrOk = 0,
  51. TIFFReadDirEntryErrCount = 1,
  52. TIFFReadDirEntryErrType = 2,
  53. TIFFReadDirEntryErrIo = 3,
  54. TIFFReadDirEntryErrRange = 4,
  55. TIFFReadDirEntryErrPsdif = 5,
  56. TIFFReadDirEntryErrSizesan = 6,
  57. TIFFReadDirEntryErrAlloc = 7,
  58. };
  59. static enum TIFFReadDirEntryErr
  60. TIFFReadDirEntryByte(TIFF *tif, TIFFDirEntry *direntry, uint8_t *value);
  61. static enum TIFFReadDirEntryErr
  62. TIFFReadDirEntrySbyte(TIFF *tif, TIFFDirEntry *direntry, int8_t *value);
  63. static enum TIFFReadDirEntryErr
  64. TIFFReadDirEntryShort(TIFF *tif, TIFFDirEntry *direntry, uint16_t *value);
  65. static enum TIFFReadDirEntryErr
  66. TIFFReadDirEntrySshort(TIFF *tif, TIFFDirEntry *direntry, int16_t *value);
  67. static enum TIFFReadDirEntryErr
  68. TIFFReadDirEntryLong(TIFF *tif, TIFFDirEntry *direntry, uint32_t *value);
  69. static enum TIFFReadDirEntryErr
  70. TIFFReadDirEntrySlong(TIFF *tif, TIFFDirEntry *direntry, int32_t *value);
  71. static enum TIFFReadDirEntryErr
  72. TIFFReadDirEntryLong8(TIFF *tif, TIFFDirEntry *direntry, uint64_t *value);
  73. static enum TIFFReadDirEntryErr
  74. TIFFReadDirEntrySlong8(TIFF *tif, TIFFDirEntry *direntry, int64_t *value);
  75. static enum TIFFReadDirEntryErr
  76. TIFFReadDirEntryFloat(TIFF *tif, TIFFDirEntry *direntry, float *value);
  77. static enum TIFFReadDirEntryErr
  78. TIFFReadDirEntryDouble(TIFF *tif, TIFFDirEntry *direntry, double *value);
  79. static enum TIFFReadDirEntryErr
  80. TIFFReadDirEntryIfd8(TIFF *tif, TIFFDirEntry *direntry, uint64_t *value);
  81. static enum TIFFReadDirEntryErr
  82. TIFFReadDirEntryArray(TIFF *tif, TIFFDirEntry *direntry, uint32_t *count,
  83. uint32_t desttypesize, void **value);
  84. static enum TIFFReadDirEntryErr
  85. TIFFReadDirEntryByteArray(TIFF *tif, TIFFDirEntry *direntry, uint8_t **value);
  86. static enum TIFFReadDirEntryErr
  87. TIFFReadDirEntrySbyteArray(TIFF *tif, TIFFDirEntry *direntry, int8_t **value);
  88. static enum TIFFReadDirEntryErr
  89. TIFFReadDirEntryShortArray(TIFF *tif, TIFFDirEntry *direntry, uint16_t **value);
  90. static enum TIFFReadDirEntryErr
  91. TIFFReadDirEntrySshortArray(TIFF *tif, TIFFDirEntry *direntry, int16_t **value);
  92. static enum TIFFReadDirEntryErr
  93. TIFFReadDirEntryLongArray(TIFF *tif, TIFFDirEntry *direntry, uint32_t **value);
  94. static enum TIFFReadDirEntryErr
  95. TIFFReadDirEntrySlongArray(TIFF *tif, TIFFDirEntry *direntry, int32_t **value);
  96. static enum TIFFReadDirEntryErr
  97. TIFFReadDirEntryLong8Array(TIFF *tif, TIFFDirEntry *direntry, uint64_t **value);
  98. static enum TIFFReadDirEntryErr
  99. TIFFReadDirEntrySlong8Array(TIFF *tif, TIFFDirEntry *direntry, int64_t **value);
  100. static enum TIFFReadDirEntryErr
  101. TIFFReadDirEntryFloatArray(TIFF *tif, TIFFDirEntry *direntry, float **value);
  102. static enum TIFFReadDirEntryErr
  103. TIFFReadDirEntryDoubleArray(TIFF *tif, TIFFDirEntry *direntry, double **value);
  104. static enum TIFFReadDirEntryErr
  105. TIFFReadDirEntryIfd8Array(TIFF *tif, TIFFDirEntry *direntry, uint64_t **value);
  106. static enum TIFFReadDirEntryErr
  107. TIFFReadDirEntryPersampleShort(TIFF *tif, TIFFDirEntry *direntry,
  108. uint16_t *value);
  109. static void TIFFReadDirEntryCheckedByte(TIFF *tif, TIFFDirEntry *direntry,
  110. uint8_t *value);
  111. static void TIFFReadDirEntryCheckedSbyte(TIFF *tif, TIFFDirEntry *direntry,
  112. int8_t *value);
  113. static void TIFFReadDirEntryCheckedShort(TIFF *tif, TIFFDirEntry *direntry,
  114. uint16_t *value);
  115. static void TIFFReadDirEntryCheckedSshort(TIFF *tif, TIFFDirEntry *direntry,
  116. int16_t *value);
  117. static void TIFFReadDirEntryCheckedLong(TIFF *tif, TIFFDirEntry *direntry,
  118. uint32_t *value);
  119. static void TIFFReadDirEntryCheckedSlong(TIFF *tif, TIFFDirEntry *direntry,
  120. int32_t *value);
  121. static enum TIFFReadDirEntryErr
  122. TIFFReadDirEntryCheckedLong8(TIFF *tif, TIFFDirEntry *direntry,
  123. uint64_t *value);
  124. static enum TIFFReadDirEntryErr
  125. TIFFReadDirEntryCheckedSlong8(TIFF *tif, TIFFDirEntry *direntry,
  126. int64_t *value);
  127. static enum TIFFReadDirEntryErr
  128. TIFFReadDirEntryCheckedRational(TIFF *tif, TIFFDirEntry *direntry,
  129. double *value);
  130. static enum TIFFReadDirEntryErr
  131. TIFFReadDirEntryCheckedSrational(TIFF *tif, TIFFDirEntry *direntry,
  132. double *value);
  133. static void TIFFReadDirEntryCheckedFloat(TIFF *tif, TIFFDirEntry *direntry,
  134. float *value);
  135. static enum TIFFReadDirEntryErr
  136. TIFFReadDirEntryCheckedDouble(TIFF *tif, TIFFDirEntry *direntry, double *value);
  137. #if 0
  138. static enum TIFFReadDirEntryErr
  139. TIFFReadDirEntryCheckedRationalDirect(TIFF *tif, TIFFDirEntry *direntry,
  140. TIFFRational_t *value);
  141. #endif
  142. static enum TIFFReadDirEntryErr
  143. TIFFReadDirEntryCheckRangeByteSbyte(int8_t value);
  144. static enum TIFFReadDirEntryErr
  145. TIFFReadDirEntryCheckRangeByteShort(uint16_t value);
  146. static enum TIFFReadDirEntryErr
  147. TIFFReadDirEntryCheckRangeByteSshort(int16_t value);
  148. static enum TIFFReadDirEntryErr
  149. TIFFReadDirEntryCheckRangeByteLong(uint32_t value);
  150. static enum TIFFReadDirEntryErr
  151. TIFFReadDirEntryCheckRangeByteSlong(int32_t value);
  152. static enum TIFFReadDirEntryErr
  153. TIFFReadDirEntryCheckRangeByteLong8(uint64_t value);
  154. static enum TIFFReadDirEntryErr
  155. TIFFReadDirEntryCheckRangeByteSlong8(int64_t value);
  156. static enum TIFFReadDirEntryErr
  157. TIFFReadDirEntryCheckRangeSbyteByte(uint8_t value);
  158. static enum TIFFReadDirEntryErr
  159. TIFFReadDirEntryCheckRangeSbyteShort(uint16_t value);
  160. static enum TIFFReadDirEntryErr
  161. TIFFReadDirEntryCheckRangeSbyteSshort(int16_t value);
  162. static enum TIFFReadDirEntryErr
  163. TIFFReadDirEntryCheckRangeSbyteLong(uint32_t value);
  164. static enum TIFFReadDirEntryErr
  165. TIFFReadDirEntryCheckRangeSbyteSlong(int32_t value);
  166. static enum TIFFReadDirEntryErr
  167. TIFFReadDirEntryCheckRangeSbyteLong8(uint64_t value);
  168. static enum TIFFReadDirEntryErr
  169. TIFFReadDirEntryCheckRangeSbyteSlong8(int64_t value);
  170. static enum TIFFReadDirEntryErr
  171. TIFFReadDirEntryCheckRangeShortSbyte(int8_t value);
  172. static enum TIFFReadDirEntryErr
  173. TIFFReadDirEntryCheckRangeShortSshort(int16_t value);
  174. static enum TIFFReadDirEntryErr
  175. TIFFReadDirEntryCheckRangeShortLong(uint32_t value);
  176. static enum TIFFReadDirEntryErr
  177. TIFFReadDirEntryCheckRangeShortSlong(int32_t value);
  178. static enum TIFFReadDirEntryErr
  179. TIFFReadDirEntryCheckRangeShortLong8(uint64_t value);
  180. static enum TIFFReadDirEntryErr
  181. TIFFReadDirEntryCheckRangeShortSlong8(int64_t value);
  182. static enum TIFFReadDirEntryErr
  183. TIFFReadDirEntryCheckRangeSshortShort(uint16_t value);
  184. static enum TIFFReadDirEntryErr
  185. TIFFReadDirEntryCheckRangeSshortLong(uint32_t value);
  186. static enum TIFFReadDirEntryErr
  187. TIFFReadDirEntryCheckRangeSshortSlong(int32_t value);
  188. static enum TIFFReadDirEntryErr
  189. TIFFReadDirEntryCheckRangeSshortLong8(uint64_t value);
  190. static enum TIFFReadDirEntryErr
  191. TIFFReadDirEntryCheckRangeSshortSlong8(int64_t value);
  192. static enum TIFFReadDirEntryErr
  193. TIFFReadDirEntryCheckRangeLongSbyte(int8_t value);
  194. static enum TIFFReadDirEntryErr
  195. TIFFReadDirEntryCheckRangeLongSshort(int16_t value);
  196. static enum TIFFReadDirEntryErr
  197. TIFFReadDirEntryCheckRangeLongSlong(int32_t value);
  198. static enum TIFFReadDirEntryErr
  199. TIFFReadDirEntryCheckRangeLongLong8(uint64_t value);
  200. static enum TIFFReadDirEntryErr
  201. TIFFReadDirEntryCheckRangeLongSlong8(int64_t value);
  202. static enum TIFFReadDirEntryErr
  203. TIFFReadDirEntryCheckRangeSlongLong(uint32_t value);
  204. static enum TIFFReadDirEntryErr
  205. TIFFReadDirEntryCheckRangeSlongLong8(uint64_t value);
  206. static enum TIFFReadDirEntryErr
  207. TIFFReadDirEntryCheckRangeSlongSlong8(int64_t value);
  208. static enum TIFFReadDirEntryErr
  209. TIFFReadDirEntryCheckRangeLong8Sbyte(int8_t value);
  210. static enum TIFFReadDirEntryErr
  211. TIFFReadDirEntryCheckRangeLong8Sshort(int16_t value);
  212. static enum TIFFReadDirEntryErr
  213. TIFFReadDirEntryCheckRangeLong8Slong(int32_t value);
  214. static enum TIFFReadDirEntryErr
  215. TIFFReadDirEntryCheckRangeLong8Slong8(int64_t value);
  216. static enum TIFFReadDirEntryErr
  217. TIFFReadDirEntryCheckRangeSlong8Long8(uint64_t value);
  218. static enum TIFFReadDirEntryErr TIFFReadDirEntryData(TIFF *tif, uint64_t offset,
  219. tmsize_t size, void *dest);
  220. static void TIFFReadDirEntryOutputErr(TIFF *tif, enum TIFFReadDirEntryErr err,
  221. const char *module, const char *tagname,
  222. int recover);
  223. static void TIFFReadDirectoryCheckOrder(TIFF *tif, TIFFDirEntry *dir,
  224. uint16_t dircount);
  225. static TIFFDirEntry *TIFFReadDirectoryFindEntry(TIFF *tif, TIFFDirEntry *dir,
  226. uint16_t dircount,
  227. uint16_t tagid);
  228. static void TIFFReadDirectoryFindFieldInfo(TIFF *tif, uint16_t tagid,
  229. uint32_t *fii);
  230. static int EstimateStripByteCounts(TIFF *tif, TIFFDirEntry *dir,
  231. uint16_t dircount);
  232. static void MissingRequired(TIFF *, const char *);
  233. static int CheckDirCount(TIFF *, TIFFDirEntry *, uint32_t);
  234. static uint16_t TIFFFetchDirectory(TIFF *tif, uint64_t diroff,
  235. TIFFDirEntry **pdir, uint64_t *nextdiroff);
  236. static int TIFFFetchNormalTag(TIFF *, TIFFDirEntry *, int recover);
  237. static int TIFFFetchStripThing(TIFF *tif, TIFFDirEntry *dir, uint32_t nstrips,
  238. uint64_t **lpp);
  239. static int TIFFFetchSubjectDistance(TIFF *, TIFFDirEntry *);
  240. static void ChopUpSingleUncompressedStrip(TIFF *);
  241. static void TryChopUpUncompressedBigTiff(TIFF *);
  242. static uint64_t TIFFReadUInt64(const uint8_t *value);
  243. static int _TIFFGetMaxColorChannels(uint16_t photometric);
  244. static int _TIFFFillStrilesInternal(TIFF *tif, int loadStripByteCount);
  245. typedef union _UInt64Aligned_t
  246. {
  247. double d;
  248. uint64_t l;
  249. uint32_t i[2];
  250. uint16_t s[4];
  251. uint8_t c[8];
  252. } UInt64Aligned_t;
  253. /*
  254. Unaligned safe copy of a uint64_t value from an octet array.
  255. */
  256. static uint64_t TIFFReadUInt64(const uint8_t *value)
  257. {
  258. UInt64Aligned_t result;
  259. result.c[0] = value[0];
  260. result.c[1] = value[1];
  261. result.c[2] = value[2];
  262. result.c[3] = value[3];
  263. result.c[4] = value[4];
  264. result.c[5] = value[5];
  265. result.c[6] = value[6];
  266. result.c[7] = value[7];
  267. return result.l;
  268. }
  269. static enum TIFFReadDirEntryErr
  270. TIFFReadDirEntryByte(TIFF *tif, TIFFDirEntry *direntry, uint8_t *value)
  271. {
  272. enum TIFFReadDirEntryErr err;
  273. if (direntry->tdir_count != 1)
  274. return (TIFFReadDirEntryErrCount);
  275. switch (direntry->tdir_type)
  276. {
  277. case TIFF_BYTE:
  278. case TIFF_UNDEFINED: /* Support to read TIFF_UNDEFINED with
  279. field_readcount==1 */
  280. TIFFReadDirEntryCheckedByte(tif, direntry, value);
  281. return (TIFFReadDirEntryErrOk);
  282. case TIFF_SBYTE:
  283. {
  284. int8_t m;
  285. TIFFReadDirEntryCheckedSbyte(tif, direntry, &m);
  286. err = TIFFReadDirEntryCheckRangeByteSbyte(m);
  287. if (err != TIFFReadDirEntryErrOk)
  288. return (err);
  289. *value = (uint8_t)m;
  290. return (TIFFReadDirEntryErrOk);
  291. }
  292. case TIFF_SHORT:
  293. {
  294. uint16_t m;
  295. TIFFReadDirEntryCheckedShort(tif, direntry, &m);
  296. err = TIFFReadDirEntryCheckRangeByteShort(m);
  297. if (err != TIFFReadDirEntryErrOk)
  298. return (err);
  299. *value = (uint8_t)m;
  300. return (TIFFReadDirEntryErrOk);
  301. }
  302. case TIFF_SSHORT:
  303. {
  304. int16_t m;
  305. TIFFReadDirEntryCheckedSshort(tif, direntry, &m);
  306. err = TIFFReadDirEntryCheckRangeByteSshort(m);
  307. if (err != TIFFReadDirEntryErrOk)
  308. return (err);
  309. *value = (uint8_t)m;
  310. return (TIFFReadDirEntryErrOk);
  311. }
  312. case TIFF_LONG:
  313. {
  314. uint32_t m;
  315. TIFFReadDirEntryCheckedLong(tif, direntry, &m);
  316. err = TIFFReadDirEntryCheckRangeByteLong(m);
  317. if (err != TIFFReadDirEntryErrOk)
  318. return (err);
  319. *value = (uint8_t)m;
  320. return (TIFFReadDirEntryErrOk);
  321. }
  322. case TIFF_SLONG:
  323. {
  324. int32_t m;
  325. TIFFReadDirEntryCheckedSlong(tif, direntry, &m);
  326. err = TIFFReadDirEntryCheckRangeByteSlong(m);
  327. if (err != TIFFReadDirEntryErrOk)
  328. return (err);
  329. *value = (uint8_t)m;
  330. return (TIFFReadDirEntryErrOk);
  331. }
  332. case TIFF_LONG8:
  333. {
  334. uint64_t m;
  335. err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m);
  336. if (err != TIFFReadDirEntryErrOk)
  337. return (err);
  338. err = TIFFReadDirEntryCheckRangeByteLong8(m);
  339. if (err != TIFFReadDirEntryErrOk)
  340. return (err);
  341. *value = (uint8_t)m;
  342. return (TIFFReadDirEntryErrOk);
  343. }
  344. case TIFF_SLONG8:
  345. {
  346. int64_t m;
  347. err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m);
  348. if (err != TIFFReadDirEntryErrOk)
  349. return (err);
  350. err = TIFFReadDirEntryCheckRangeByteSlong8(m);
  351. if (err != TIFFReadDirEntryErrOk)
  352. return (err);
  353. *value = (uint8_t)m;
  354. return (TIFFReadDirEntryErrOk);
  355. }
  356. default:
  357. return (TIFFReadDirEntryErrType);
  358. }
  359. }
  360. static enum TIFFReadDirEntryErr
  361. TIFFReadDirEntrySbyte(TIFF *tif, TIFFDirEntry *direntry, int8_t *value)
  362. {
  363. enum TIFFReadDirEntryErr err;
  364. if (direntry->tdir_count != 1)
  365. return (TIFFReadDirEntryErrCount);
  366. switch (direntry->tdir_type)
  367. {
  368. case TIFF_BYTE:
  369. case TIFF_UNDEFINED: /* Support to read TIFF_UNDEFINED with
  370. field_readcount==1 */
  371. {
  372. uint8_t m;
  373. TIFFReadDirEntryCheckedByte(tif, direntry, &m);
  374. err = TIFFReadDirEntryCheckRangeSbyteByte(m);
  375. if (err != TIFFReadDirEntryErrOk)
  376. return (err);
  377. *value = (int8_t)m;
  378. return (TIFFReadDirEntryErrOk);
  379. }
  380. case TIFF_SBYTE:
  381. {
  382. TIFFReadDirEntryCheckedSbyte(tif, direntry, value);
  383. return (TIFFReadDirEntryErrOk);
  384. }
  385. case TIFF_SHORT:
  386. {
  387. uint16_t m;
  388. TIFFReadDirEntryCheckedShort(tif, direntry, &m);
  389. err = TIFFReadDirEntryCheckRangeSbyteShort(m);
  390. if (err != TIFFReadDirEntryErrOk)
  391. return (err);
  392. *value = (int8_t)m;
  393. return (TIFFReadDirEntryErrOk);
  394. }
  395. case TIFF_SSHORT:
  396. {
  397. int16_t m;
  398. TIFFReadDirEntryCheckedSshort(tif, direntry, &m);
  399. err = TIFFReadDirEntryCheckRangeSbyteSshort(m);
  400. if (err != TIFFReadDirEntryErrOk)
  401. return (err);
  402. *value = (int8_t)m;
  403. return (TIFFReadDirEntryErrOk);
  404. }
  405. case TIFF_LONG:
  406. {
  407. uint32_t m;
  408. TIFFReadDirEntryCheckedLong(tif, direntry, &m);
  409. err = TIFFReadDirEntryCheckRangeSbyteLong(m);
  410. if (err != TIFFReadDirEntryErrOk)
  411. return (err);
  412. *value = (int8_t)m;
  413. return (TIFFReadDirEntryErrOk);
  414. }
  415. case TIFF_SLONG:
  416. {
  417. int32_t m;
  418. TIFFReadDirEntryCheckedSlong(tif, direntry, &m);
  419. err = TIFFReadDirEntryCheckRangeSbyteSlong(m);
  420. if (err != TIFFReadDirEntryErrOk)
  421. return (err);
  422. *value = (int8_t)m;
  423. return (TIFFReadDirEntryErrOk);
  424. }
  425. case TIFF_LONG8:
  426. {
  427. uint64_t m;
  428. err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m);
  429. if (err != TIFFReadDirEntryErrOk)
  430. return (err);
  431. err = TIFFReadDirEntryCheckRangeSbyteLong8(m);
  432. if (err != TIFFReadDirEntryErrOk)
  433. return (err);
  434. *value = (int8_t)m;
  435. return (TIFFReadDirEntryErrOk);
  436. }
  437. case TIFF_SLONG8:
  438. {
  439. int64_t m;
  440. err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m);
  441. if (err != TIFFReadDirEntryErrOk)
  442. return (err);
  443. err = TIFFReadDirEntryCheckRangeSbyteSlong8(m);
  444. if (err != TIFFReadDirEntryErrOk)
  445. return (err);
  446. *value = (int8_t)m;
  447. return (TIFFReadDirEntryErrOk);
  448. }
  449. default:
  450. return (TIFFReadDirEntryErrType);
  451. }
  452. } /*-- TIFFReadDirEntrySbyte() --*/
  453. static enum TIFFReadDirEntryErr
  454. TIFFReadDirEntryShort(TIFF *tif, TIFFDirEntry *direntry, uint16_t *value)
  455. {
  456. enum TIFFReadDirEntryErr err;
  457. if (direntry->tdir_count != 1)
  458. return (TIFFReadDirEntryErrCount);
  459. switch (direntry->tdir_type)
  460. {
  461. case TIFF_BYTE:
  462. {
  463. uint8_t m;
  464. TIFFReadDirEntryCheckedByte(tif, direntry, &m);
  465. *value = (uint16_t)m;
  466. return (TIFFReadDirEntryErrOk);
  467. }
  468. case TIFF_SBYTE:
  469. {
  470. int8_t m;
  471. TIFFReadDirEntryCheckedSbyte(tif, direntry, &m);
  472. err = TIFFReadDirEntryCheckRangeShortSbyte(m);
  473. if (err != TIFFReadDirEntryErrOk)
  474. return (err);
  475. *value = (uint16_t)m;
  476. return (TIFFReadDirEntryErrOk);
  477. }
  478. case TIFF_SHORT:
  479. TIFFReadDirEntryCheckedShort(tif, direntry, value);
  480. return (TIFFReadDirEntryErrOk);
  481. case TIFF_SSHORT:
  482. {
  483. int16_t m;
  484. TIFFReadDirEntryCheckedSshort(tif, direntry, &m);
  485. err = TIFFReadDirEntryCheckRangeShortSshort(m);
  486. if (err != TIFFReadDirEntryErrOk)
  487. return (err);
  488. *value = (uint16_t)m;
  489. return (TIFFReadDirEntryErrOk);
  490. }
  491. case TIFF_LONG:
  492. {
  493. uint32_t m;
  494. TIFFReadDirEntryCheckedLong(tif, direntry, &m);
  495. err = TIFFReadDirEntryCheckRangeShortLong(m);
  496. if (err != TIFFReadDirEntryErrOk)
  497. return (err);
  498. *value = (uint16_t)m;
  499. return (TIFFReadDirEntryErrOk);
  500. }
  501. case TIFF_SLONG:
  502. {
  503. int32_t m;
  504. TIFFReadDirEntryCheckedSlong(tif, direntry, &m);
  505. err = TIFFReadDirEntryCheckRangeShortSlong(m);
  506. if (err != TIFFReadDirEntryErrOk)
  507. return (err);
  508. *value = (uint16_t)m;
  509. return (TIFFReadDirEntryErrOk);
  510. }
  511. case TIFF_LONG8:
  512. {
  513. uint64_t m;
  514. err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m);
  515. if (err != TIFFReadDirEntryErrOk)
  516. return (err);
  517. err = TIFFReadDirEntryCheckRangeShortLong8(m);
  518. if (err != TIFFReadDirEntryErrOk)
  519. return (err);
  520. *value = (uint16_t)m;
  521. return (TIFFReadDirEntryErrOk);
  522. }
  523. case TIFF_SLONG8:
  524. {
  525. int64_t m;
  526. err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m);
  527. if (err != TIFFReadDirEntryErrOk)
  528. return (err);
  529. err = TIFFReadDirEntryCheckRangeShortSlong8(m);
  530. if (err != TIFFReadDirEntryErrOk)
  531. return (err);
  532. *value = (uint16_t)m;
  533. return (TIFFReadDirEntryErrOk);
  534. }
  535. default:
  536. return (TIFFReadDirEntryErrType);
  537. }
  538. } /*-- TIFFReadDirEntryShort() --*/
  539. static enum TIFFReadDirEntryErr
  540. TIFFReadDirEntrySshort(TIFF *tif, TIFFDirEntry *direntry, int16_t *value)
  541. {
  542. enum TIFFReadDirEntryErr err;
  543. if (direntry->tdir_count != 1)
  544. return (TIFFReadDirEntryErrCount);
  545. switch (direntry->tdir_type)
  546. {
  547. case TIFF_BYTE:
  548. {
  549. uint8_t m;
  550. TIFFReadDirEntryCheckedByte(tif, direntry, &m);
  551. *value = (int16_t)m;
  552. return (TIFFReadDirEntryErrOk);
  553. }
  554. case TIFF_SBYTE:
  555. {
  556. int8_t m;
  557. TIFFReadDirEntryCheckedSbyte(tif, direntry, &m);
  558. *value = (int16_t)m;
  559. return (TIFFReadDirEntryErrOk);
  560. }
  561. case TIFF_SHORT:
  562. {
  563. uint16_t m;
  564. TIFFReadDirEntryCheckedShort(tif, direntry, &m);
  565. err = TIFFReadDirEntryCheckRangeSshortShort(m);
  566. if (err != TIFFReadDirEntryErrOk)
  567. return (err);
  568. *value = (uint16_t)m;
  569. return (TIFFReadDirEntryErrOk);
  570. }
  571. case TIFF_SSHORT:
  572. TIFFReadDirEntryCheckedSshort(tif, direntry, value);
  573. return (TIFFReadDirEntryErrOk);
  574. case TIFF_LONG:
  575. {
  576. uint32_t m;
  577. TIFFReadDirEntryCheckedLong(tif, direntry, &m);
  578. err = TIFFReadDirEntryCheckRangeSshortLong(m);
  579. if (err != TIFFReadDirEntryErrOk)
  580. return (err);
  581. *value = (int16_t)m;
  582. return (TIFFReadDirEntryErrOk);
  583. }
  584. case TIFF_SLONG:
  585. {
  586. int32_t m;
  587. TIFFReadDirEntryCheckedSlong(tif, direntry, &m);
  588. err = TIFFReadDirEntryCheckRangeSshortSlong(m);
  589. if (err != TIFFReadDirEntryErrOk)
  590. return (err);
  591. *value = (int16_t)m;
  592. return (TIFFReadDirEntryErrOk);
  593. }
  594. case TIFF_LONG8:
  595. {
  596. uint64_t m;
  597. err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m);
  598. if (err != TIFFReadDirEntryErrOk)
  599. return (err);
  600. err = TIFFReadDirEntryCheckRangeSshortLong8(m);
  601. if (err != TIFFReadDirEntryErrOk)
  602. return (err);
  603. *value = (int16_t)m;
  604. return (TIFFReadDirEntryErrOk);
  605. }
  606. case TIFF_SLONG8:
  607. {
  608. int64_t m;
  609. err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m);
  610. if (err != TIFFReadDirEntryErrOk)
  611. return (err);
  612. err = TIFFReadDirEntryCheckRangeSshortSlong8(m);
  613. if (err != TIFFReadDirEntryErrOk)
  614. return (err);
  615. *value = (int16_t)m;
  616. return (TIFFReadDirEntryErrOk);
  617. }
  618. default:
  619. return (TIFFReadDirEntryErrType);
  620. }
  621. } /*-- TIFFReadDirEntrySshort() --*/
  622. static enum TIFFReadDirEntryErr
  623. TIFFReadDirEntryLong(TIFF *tif, TIFFDirEntry *direntry, uint32_t *value)
  624. {
  625. enum TIFFReadDirEntryErr err;
  626. if (direntry->tdir_count != 1)
  627. return (TIFFReadDirEntryErrCount);
  628. switch (direntry->tdir_type)
  629. {
  630. case TIFF_BYTE:
  631. {
  632. uint8_t m;
  633. TIFFReadDirEntryCheckedByte(tif, direntry, &m);
  634. *value = (uint32_t)m;
  635. return (TIFFReadDirEntryErrOk);
  636. }
  637. case TIFF_SBYTE:
  638. {
  639. int8_t m;
  640. TIFFReadDirEntryCheckedSbyte(tif, direntry, &m);
  641. err = TIFFReadDirEntryCheckRangeLongSbyte(m);
  642. if (err != TIFFReadDirEntryErrOk)
  643. return (err);
  644. *value = (uint32_t)m;
  645. return (TIFFReadDirEntryErrOk);
  646. }
  647. case TIFF_SHORT:
  648. {
  649. uint16_t m;
  650. TIFFReadDirEntryCheckedShort(tif, direntry, &m);
  651. *value = (uint32_t)m;
  652. return (TIFFReadDirEntryErrOk);
  653. }
  654. case TIFF_SSHORT:
  655. {
  656. int16_t m;
  657. TIFFReadDirEntryCheckedSshort(tif, direntry, &m);
  658. err = TIFFReadDirEntryCheckRangeLongSshort(m);
  659. if (err != TIFFReadDirEntryErrOk)
  660. return (err);
  661. *value = (uint32_t)m;
  662. return (TIFFReadDirEntryErrOk);
  663. }
  664. case TIFF_LONG:
  665. TIFFReadDirEntryCheckedLong(tif, direntry, value);
  666. return (TIFFReadDirEntryErrOk);
  667. case TIFF_SLONG:
  668. {
  669. int32_t m;
  670. TIFFReadDirEntryCheckedSlong(tif, direntry, &m);
  671. err = TIFFReadDirEntryCheckRangeLongSlong(m);
  672. if (err != TIFFReadDirEntryErrOk)
  673. return (err);
  674. *value = (uint32_t)m;
  675. return (TIFFReadDirEntryErrOk);
  676. }
  677. case TIFF_LONG8:
  678. {
  679. uint64_t m;
  680. err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m);
  681. if (err != TIFFReadDirEntryErrOk)
  682. return (err);
  683. err = TIFFReadDirEntryCheckRangeLongLong8(m);
  684. if (err != TIFFReadDirEntryErrOk)
  685. return (err);
  686. *value = (uint32_t)m;
  687. return (TIFFReadDirEntryErrOk);
  688. }
  689. case TIFF_SLONG8:
  690. {
  691. int64_t m;
  692. err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m);
  693. if (err != TIFFReadDirEntryErrOk)
  694. return (err);
  695. err = TIFFReadDirEntryCheckRangeLongSlong8(m);
  696. if (err != TIFFReadDirEntryErrOk)
  697. return (err);
  698. *value = (uint32_t)m;
  699. return (TIFFReadDirEntryErrOk);
  700. }
  701. default:
  702. return (TIFFReadDirEntryErrType);
  703. }
  704. } /*-- TIFFReadDirEntryLong() --*/
  705. static enum TIFFReadDirEntryErr
  706. TIFFReadDirEntrySlong(TIFF *tif, TIFFDirEntry *direntry, int32_t *value)
  707. {
  708. enum TIFFReadDirEntryErr err;
  709. if (direntry->tdir_count != 1)
  710. return (TIFFReadDirEntryErrCount);
  711. switch (direntry->tdir_type)
  712. {
  713. case TIFF_BYTE:
  714. {
  715. uint8_t m;
  716. TIFFReadDirEntryCheckedByte(tif, direntry, &m);
  717. *value = (int32_t)m;
  718. return (TIFFReadDirEntryErrOk);
  719. }
  720. case TIFF_SBYTE:
  721. {
  722. int8_t m;
  723. TIFFReadDirEntryCheckedSbyte(tif, direntry, &m);
  724. *value = (int32_t)m;
  725. return (TIFFReadDirEntryErrOk);
  726. }
  727. case TIFF_SHORT:
  728. {
  729. uint16_t m;
  730. TIFFReadDirEntryCheckedShort(tif, direntry, &m);
  731. *value = (int32_t)m;
  732. return (TIFFReadDirEntryErrOk);
  733. }
  734. case TIFF_SSHORT:
  735. {
  736. int16_t m;
  737. TIFFReadDirEntryCheckedSshort(tif, direntry, &m);
  738. *value = (int32_t)m;
  739. return (TIFFReadDirEntryErrOk);
  740. }
  741. case TIFF_LONG:
  742. {
  743. uint32_t m;
  744. TIFFReadDirEntryCheckedLong(tif, direntry, &m);
  745. err = TIFFReadDirEntryCheckRangeSlongLong(m);
  746. if (err != TIFFReadDirEntryErrOk)
  747. return (err);
  748. *value = (int32_t)m;
  749. return (TIFFReadDirEntryErrOk);
  750. }
  751. case TIFF_SLONG:
  752. TIFFReadDirEntryCheckedSlong(tif, direntry, value);
  753. return (TIFFReadDirEntryErrOk);
  754. case TIFF_LONG8:
  755. {
  756. uint64_t m;
  757. err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m);
  758. if (err != TIFFReadDirEntryErrOk)
  759. return (err);
  760. err = TIFFReadDirEntryCheckRangeSlongLong8(m);
  761. if (err != TIFFReadDirEntryErrOk)
  762. return (err);
  763. *value = (int32_t)m;
  764. return (TIFFReadDirEntryErrOk);
  765. }
  766. case TIFF_SLONG8:
  767. {
  768. int64_t m;
  769. err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m);
  770. if (err != TIFFReadDirEntryErrOk)
  771. return (err);
  772. err = TIFFReadDirEntryCheckRangeSlongSlong8(m);
  773. if (err != TIFFReadDirEntryErrOk)
  774. return (err);
  775. *value = (int32_t)m;
  776. return (TIFFReadDirEntryErrOk);
  777. }
  778. default:
  779. return (TIFFReadDirEntryErrType);
  780. }
  781. } /*-- TIFFReadDirEntrySlong() --*/
  782. static enum TIFFReadDirEntryErr
  783. TIFFReadDirEntryLong8(TIFF *tif, TIFFDirEntry *direntry, uint64_t *value)
  784. {
  785. enum TIFFReadDirEntryErr err;
  786. if (direntry->tdir_count != 1)
  787. return (TIFFReadDirEntryErrCount);
  788. switch (direntry->tdir_type)
  789. {
  790. case TIFF_BYTE:
  791. {
  792. uint8_t m;
  793. TIFFReadDirEntryCheckedByte(tif, direntry, &m);
  794. *value = (uint64_t)m;
  795. return (TIFFReadDirEntryErrOk);
  796. }
  797. case TIFF_SBYTE:
  798. {
  799. int8_t m;
  800. TIFFReadDirEntryCheckedSbyte(tif, direntry, &m);
  801. err = TIFFReadDirEntryCheckRangeLong8Sbyte(m);
  802. if (err != TIFFReadDirEntryErrOk)
  803. return (err);
  804. *value = (uint64_t)m;
  805. return (TIFFReadDirEntryErrOk);
  806. }
  807. case TIFF_SHORT:
  808. {
  809. uint16_t m;
  810. TIFFReadDirEntryCheckedShort(tif, direntry, &m);
  811. *value = (uint64_t)m;
  812. return (TIFFReadDirEntryErrOk);
  813. }
  814. case TIFF_SSHORT:
  815. {
  816. int16_t m;
  817. TIFFReadDirEntryCheckedSshort(tif, direntry, &m);
  818. err = TIFFReadDirEntryCheckRangeLong8Sshort(m);
  819. if (err != TIFFReadDirEntryErrOk)
  820. return (err);
  821. *value = (uint64_t)m;
  822. return (TIFFReadDirEntryErrOk);
  823. }
  824. case TIFF_LONG:
  825. {
  826. uint32_t m;
  827. TIFFReadDirEntryCheckedLong(tif, direntry, &m);
  828. *value = (uint64_t)m;
  829. return (TIFFReadDirEntryErrOk);
  830. }
  831. case TIFF_SLONG:
  832. {
  833. int32_t m;
  834. TIFFReadDirEntryCheckedSlong(tif, direntry, &m);
  835. err = TIFFReadDirEntryCheckRangeLong8Slong(m);
  836. if (err != TIFFReadDirEntryErrOk)
  837. return (err);
  838. *value = (uint64_t)m;
  839. return (TIFFReadDirEntryErrOk);
  840. }
  841. case TIFF_LONG8:
  842. err = TIFFReadDirEntryCheckedLong8(tif, direntry, value);
  843. return (err);
  844. case TIFF_SLONG8:
  845. {
  846. int64_t m;
  847. err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m);
  848. if (err != TIFFReadDirEntryErrOk)
  849. return (err);
  850. err = TIFFReadDirEntryCheckRangeLong8Slong8(m);
  851. if (err != TIFFReadDirEntryErrOk)
  852. return (err);
  853. *value = (uint64_t)m;
  854. return (TIFFReadDirEntryErrOk);
  855. }
  856. default:
  857. return (TIFFReadDirEntryErrType);
  858. }
  859. } /*-- TIFFReadDirEntryLong8() --*/
  860. static enum TIFFReadDirEntryErr
  861. TIFFReadDirEntrySlong8(TIFF *tif, TIFFDirEntry *direntry, int64_t *value)
  862. {
  863. enum TIFFReadDirEntryErr err;
  864. if (direntry->tdir_count != 1)
  865. return (TIFFReadDirEntryErrCount);
  866. switch (direntry->tdir_type)
  867. {
  868. case TIFF_BYTE:
  869. {
  870. uint8_t m;
  871. TIFFReadDirEntryCheckedByte(tif, direntry, &m);
  872. *value = (int64_t)m;
  873. return (TIFFReadDirEntryErrOk);
  874. }
  875. case TIFF_SBYTE:
  876. {
  877. int8_t m;
  878. TIFFReadDirEntryCheckedSbyte(tif, direntry, &m);
  879. *value = (int64_t)m;
  880. return (TIFFReadDirEntryErrOk);
  881. }
  882. case TIFF_SHORT:
  883. {
  884. uint16_t m;
  885. TIFFReadDirEntryCheckedShort(tif, direntry, &m);
  886. *value = (int64_t)m;
  887. return (TIFFReadDirEntryErrOk);
  888. }
  889. case TIFF_SSHORT:
  890. {
  891. int16_t m;
  892. TIFFReadDirEntryCheckedSshort(tif, direntry, &m);
  893. *value = (int64_t)m;
  894. return (TIFFReadDirEntryErrOk);
  895. }
  896. case TIFF_LONG:
  897. {
  898. uint32_t m;
  899. TIFFReadDirEntryCheckedLong(tif, direntry, &m);
  900. *value = (int64_t)m;
  901. return (TIFFReadDirEntryErrOk);
  902. }
  903. case TIFF_SLONG:
  904. {
  905. int32_t m;
  906. TIFFReadDirEntryCheckedSlong(tif, direntry, &m);
  907. *value = (int64_t)m;
  908. return (TIFFReadDirEntryErrOk);
  909. }
  910. case TIFF_LONG8:
  911. {
  912. uint64_t m;
  913. err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m);
  914. if (err != TIFFReadDirEntryErrOk)
  915. return (err);
  916. err = TIFFReadDirEntryCheckRangeSlong8Long8(m);
  917. if (err != TIFFReadDirEntryErrOk)
  918. return (err);
  919. *value = (int64_t)m;
  920. return (TIFFReadDirEntryErrOk);
  921. }
  922. case TIFF_SLONG8:
  923. err = TIFFReadDirEntryCheckedSlong8(tif, direntry, value);
  924. return (err);
  925. default:
  926. return (TIFFReadDirEntryErrType);
  927. }
  928. } /*-- TIFFReadDirEntrySlong8() --*/
  929. static enum TIFFReadDirEntryErr
  930. TIFFReadDirEntryFloat(TIFF *tif, TIFFDirEntry *direntry, float *value)
  931. {
  932. enum TIFFReadDirEntryErr err;
  933. if (direntry->tdir_count != 1)
  934. return (TIFFReadDirEntryErrCount);
  935. switch (direntry->tdir_type)
  936. {
  937. case TIFF_BYTE:
  938. {
  939. uint8_t m;
  940. TIFFReadDirEntryCheckedByte(tif, direntry, &m);
  941. *value = (float)m;
  942. return (TIFFReadDirEntryErrOk);
  943. }
  944. case TIFF_SBYTE:
  945. {
  946. int8_t m;
  947. TIFFReadDirEntryCheckedSbyte(tif, direntry, &m);
  948. *value = (float)m;
  949. return (TIFFReadDirEntryErrOk);
  950. }
  951. case TIFF_SHORT:
  952. {
  953. uint16_t m;
  954. TIFFReadDirEntryCheckedShort(tif, direntry, &m);
  955. *value = (float)m;
  956. return (TIFFReadDirEntryErrOk);
  957. }
  958. case TIFF_SSHORT:
  959. {
  960. int16_t m;
  961. TIFFReadDirEntryCheckedSshort(tif, direntry, &m);
  962. *value = (float)m;
  963. return (TIFFReadDirEntryErrOk);
  964. }
  965. case TIFF_LONG:
  966. {
  967. uint32_t m;
  968. TIFFReadDirEntryCheckedLong(tif, direntry, &m);
  969. *value = (float)m;
  970. return (TIFFReadDirEntryErrOk);
  971. }
  972. case TIFF_SLONG:
  973. {
  974. int32_t m;
  975. TIFFReadDirEntryCheckedSlong(tif, direntry, &m);
  976. *value = (float)m;
  977. return (TIFFReadDirEntryErrOk);
  978. }
  979. case TIFF_LONG8:
  980. {
  981. uint64_t m;
  982. err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m);
  983. if (err != TIFFReadDirEntryErrOk)
  984. return (err);
  985. *value = (float)m;
  986. return (TIFFReadDirEntryErrOk);
  987. }
  988. case TIFF_SLONG8:
  989. {
  990. int64_t m;
  991. err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m);
  992. if (err != TIFFReadDirEntryErrOk)
  993. return (err);
  994. *value = (float)m;
  995. return (TIFFReadDirEntryErrOk);
  996. }
  997. case TIFF_RATIONAL:
  998. {
  999. double m;
  1000. err = TIFFReadDirEntryCheckedRational(tif, direntry, &m);
  1001. if (err != TIFFReadDirEntryErrOk)
  1002. return (err);
  1003. *value = (float)m;
  1004. return (TIFFReadDirEntryErrOk);
  1005. }
  1006. case TIFF_SRATIONAL:
  1007. {
  1008. double m;
  1009. err = TIFFReadDirEntryCheckedSrational(tif, direntry, &m);
  1010. if (err != TIFFReadDirEntryErrOk)
  1011. return (err);
  1012. *value = (float)m;
  1013. return (TIFFReadDirEntryErrOk);
  1014. }
  1015. case TIFF_FLOAT:
  1016. TIFFReadDirEntryCheckedFloat(tif, direntry, value);
  1017. return (TIFFReadDirEntryErrOk);
  1018. case TIFF_DOUBLE:
  1019. {
  1020. double m;
  1021. err = TIFFReadDirEntryCheckedDouble(tif, direntry, &m);
  1022. if (err != TIFFReadDirEntryErrOk)
  1023. return (err);
  1024. if ((m > FLT_MAX) || (m < -FLT_MAX))
  1025. return (TIFFReadDirEntryErrRange);
  1026. *value = (float)m;
  1027. return (TIFFReadDirEntryErrOk);
  1028. }
  1029. default:
  1030. return (TIFFReadDirEntryErrType);
  1031. }
  1032. }
  1033. static enum TIFFReadDirEntryErr
  1034. TIFFReadDirEntryDouble(TIFF *tif, TIFFDirEntry *direntry, double *value)
  1035. {
  1036. enum TIFFReadDirEntryErr err;
  1037. if (direntry->tdir_count != 1)
  1038. return (TIFFReadDirEntryErrCount);
  1039. switch (direntry->tdir_type)
  1040. {
  1041. case TIFF_BYTE:
  1042. {
  1043. uint8_t m;
  1044. TIFFReadDirEntryCheckedByte(tif, direntry, &m);
  1045. *value = (double)m;
  1046. return (TIFFReadDirEntryErrOk);
  1047. }
  1048. case TIFF_SBYTE:
  1049. {
  1050. int8_t m;
  1051. TIFFReadDirEntryCheckedSbyte(tif, direntry, &m);
  1052. *value = (double)m;
  1053. return (TIFFReadDirEntryErrOk);
  1054. }
  1055. case TIFF_SHORT:
  1056. {
  1057. uint16_t m;
  1058. TIFFReadDirEntryCheckedShort(tif, direntry, &m);
  1059. *value = (double)m;
  1060. return (TIFFReadDirEntryErrOk);
  1061. }
  1062. case TIFF_SSHORT:
  1063. {
  1064. int16_t m;
  1065. TIFFReadDirEntryCheckedSshort(tif, direntry, &m);
  1066. *value = (double)m;
  1067. return (TIFFReadDirEntryErrOk);
  1068. }
  1069. case TIFF_LONG:
  1070. {
  1071. uint32_t m;
  1072. TIFFReadDirEntryCheckedLong(tif, direntry, &m);
  1073. *value = (double)m;
  1074. return (TIFFReadDirEntryErrOk);
  1075. }
  1076. case TIFF_SLONG:
  1077. {
  1078. int32_t m;
  1079. TIFFReadDirEntryCheckedSlong(tif, direntry, &m);
  1080. *value = (double)m;
  1081. return (TIFFReadDirEntryErrOk);
  1082. }
  1083. case TIFF_LONG8:
  1084. {
  1085. uint64_t m;
  1086. err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m);
  1087. if (err != TIFFReadDirEntryErrOk)
  1088. return (err);
  1089. *value = (double)m;
  1090. return (TIFFReadDirEntryErrOk);
  1091. }
  1092. case TIFF_SLONG8:
  1093. {
  1094. int64_t m;
  1095. err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m);
  1096. if (err != TIFFReadDirEntryErrOk)
  1097. return (err);
  1098. *value = (double)m;
  1099. return (TIFFReadDirEntryErrOk);
  1100. }
  1101. case TIFF_RATIONAL:
  1102. err = TIFFReadDirEntryCheckedRational(tif, direntry, value);
  1103. return (err);
  1104. case TIFF_SRATIONAL:
  1105. err = TIFFReadDirEntryCheckedSrational(tif, direntry, value);
  1106. return (err);
  1107. case TIFF_FLOAT:
  1108. {
  1109. float m;
  1110. TIFFReadDirEntryCheckedFloat(tif, direntry, &m);
  1111. *value = (double)m;
  1112. return (TIFFReadDirEntryErrOk);
  1113. }
  1114. case TIFF_DOUBLE:
  1115. err = TIFFReadDirEntryCheckedDouble(tif, direntry, value);
  1116. return (err);
  1117. default:
  1118. return (TIFFReadDirEntryErrType);
  1119. }
  1120. }
  1121. static enum TIFFReadDirEntryErr
  1122. TIFFReadDirEntryIfd8(TIFF *tif, TIFFDirEntry *direntry, uint64_t *value)
  1123. {
  1124. enum TIFFReadDirEntryErr err;
  1125. if (direntry->tdir_count != 1)
  1126. return (TIFFReadDirEntryErrCount);
  1127. switch (direntry->tdir_type)
  1128. {
  1129. case TIFF_LONG:
  1130. case TIFF_IFD:
  1131. {
  1132. uint32_t m;
  1133. TIFFReadDirEntryCheckedLong(tif, direntry, &m);
  1134. *value = (uint64_t)m;
  1135. return (TIFFReadDirEntryErrOk);
  1136. }
  1137. case TIFF_LONG8:
  1138. case TIFF_IFD8:
  1139. err = TIFFReadDirEntryCheckedLong8(tif, direntry, value);
  1140. return (err);
  1141. default:
  1142. return (TIFFReadDirEntryErrType);
  1143. }
  1144. }
  1145. #define INITIAL_THRESHOLD (1024 * 1024)
  1146. #define THRESHOLD_MULTIPLIER 10
  1147. #define MAX_THRESHOLD \
  1148. (THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER * \
  1149. INITIAL_THRESHOLD)
  1150. static enum TIFFReadDirEntryErr TIFFReadDirEntryDataAndRealloc(TIFF *tif,
  1151. uint64_t offset,
  1152. tmsize_t size,
  1153. void **pdest)
  1154. {
  1155. #if SIZEOF_SIZE_T == 8
  1156. tmsize_t threshold = INITIAL_THRESHOLD;
  1157. #endif
  1158. tmsize_t already_read = 0;
  1159. assert(!isMapped(tif));
  1160. if (!SeekOK(tif, offset))
  1161. return (TIFFReadDirEntryErrIo);
  1162. /* On 64 bit processes, read first a maximum of 1 MB, then 10 MB, etc */
  1163. /* so as to avoid allocating too much memory in case the file is too */
  1164. /* short. We could ask for the file size, but this might be */
  1165. /* expensive with some I/O layers (think of reading a gzipped file) */
  1166. /* Restrict to 64 bit processes, so as to avoid reallocs() */
  1167. /* on 32 bit processes where virtual memory is scarce. */
  1168. while (already_read < size)
  1169. {
  1170. void *new_dest;
  1171. tmsize_t bytes_read;
  1172. tmsize_t to_read = size - already_read;
  1173. #if SIZEOF_SIZE_T == 8
  1174. if (to_read >= threshold && threshold < MAX_THRESHOLD)
  1175. {
  1176. to_read = threshold;
  1177. threshold *= THRESHOLD_MULTIPLIER;
  1178. }
  1179. #endif
  1180. new_dest =
  1181. (uint8_t *)_TIFFreallocExt(tif, *pdest, already_read + to_read);
  1182. if (new_dest == NULL)
  1183. {
  1184. TIFFErrorExtR(tif, tif->tif_name,
  1185. "Failed to allocate memory for %s "
  1186. "(%" TIFF_SSIZE_FORMAT
  1187. " elements of %" TIFF_SSIZE_FORMAT " bytes each)",
  1188. "TIFFReadDirEntryArray", (tmsize_t)1,
  1189. already_read + to_read);
  1190. return TIFFReadDirEntryErrAlloc;
  1191. }
  1192. *pdest = new_dest;
  1193. bytes_read = TIFFReadFile(tif, (char *)*pdest + already_read, to_read);
  1194. already_read += bytes_read;
  1195. if (bytes_read != to_read)
  1196. {
  1197. return TIFFReadDirEntryErrIo;
  1198. }
  1199. }
  1200. return TIFFReadDirEntryErrOk;
  1201. }
  1202. /* Caution: if raising that value, make sure int32 / uint32 overflows can't
  1203. * occur elsewhere */
  1204. #define MAX_SIZE_TAG_DATA 2147483647U
  1205. static enum TIFFReadDirEntryErr
  1206. TIFFReadDirEntryArrayWithLimit(TIFF *tif, TIFFDirEntry *direntry,
  1207. uint32_t *count, uint32_t desttypesize,
  1208. void **value, uint64_t maxcount)
  1209. {
  1210. int typesize;
  1211. uint32_t datasize;
  1212. void *data;
  1213. uint64_t target_count64;
  1214. int original_datasize_clamped;
  1215. typesize = TIFFDataWidth(direntry->tdir_type);
  1216. target_count64 =
  1217. (direntry->tdir_count > maxcount) ? maxcount : direntry->tdir_count;
  1218. if ((target_count64 == 0) || (typesize == 0))
  1219. {
  1220. *value = 0;
  1221. return (TIFFReadDirEntryErrOk);
  1222. }
  1223. (void)desttypesize;
  1224. /* We just want to know if the original tag size is more than 4 bytes
  1225. * (classic TIFF) or 8 bytes (BigTIFF)
  1226. */
  1227. original_datasize_clamped =
  1228. ((direntry->tdir_count > 10) ? 10 : (int)direntry->tdir_count) *
  1229. typesize;
  1230. /*
  1231. * As a sanity check, make sure we have no more than a 2GB tag array
  1232. * in either the current data type or the dest data type. This also
  1233. * avoids problems with overflow of tmsize_t on 32bit systems.
  1234. */
  1235. if ((uint64_t)(MAX_SIZE_TAG_DATA / typesize) < target_count64)
  1236. return (TIFFReadDirEntryErrSizesan);
  1237. if ((uint64_t)(MAX_SIZE_TAG_DATA / desttypesize) < target_count64)
  1238. return (TIFFReadDirEntryErrSizesan);
  1239. *count = (uint32_t)target_count64;
  1240. datasize = (*count) * typesize;
  1241. assert((tmsize_t)datasize > 0);
  1242. if (datasize > 100 * 1024 * 1024)
  1243. {
  1244. /* Before allocating a huge amount of memory for corrupted files, check
  1245. * if size of requested memory is not greater than file size.
  1246. */
  1247. const uint64_t filesize = TIFFGetFileSize(tif);
  1248. if (datasize > filesize)
  1249. {
  1250. TIFFWarningExtR(tif, "ReadDirEntryArray",
  1251. "Requested memory size for tag %d (0x%x) %" PRIu32
  1252. " is greater than filesize %" PRIu64
  1253. ". Memory not allocated, tag not read",
  1254. direntry->tdir_tag, direntry->tdir_tag, datasize,
  1255. filesize);
  1256. return (TIFFReadDirEntryErrAlloc);
  1257. }
  1258. }
  1259. if (isMapped(tif) && datasize > (uint64_t)tif->tif_size)
  1260. return TIFFReadDirEntryErrIo;
  1261. if (!isMapped(tif) && (((tif->tif_flags & TIFF_BIGTIFF) && datasize > 8) ||
  1262. (!(tif->tif_flags & TIFF_BIGTIFF) && datasize > 4)))
  1263. {
  1264. data = NULL;
  1265. }
  1266. else
  1267. {
  1268. data = _TIFFCheckMalloc(tif, *count, typesize, "ReadDirEntryArray");
  1269. if (data == 0)
  1270. return (TIFFReadDirEntryErrAlloc);
  1271. }
  1272. if (!(tif->tif_flags & TIFF_BIGTIFF))
  1273. {
  1274. /* Only the condition on original_datasize_clamped. The second
  1275. * one is implied, but Coverity Scan cannot see it. */
  1276. if (original_datasize_clamped <= 4 && datasize <= 4)
  1277. _TIFFmemcpy(data, &direntry->tdir_offset, datasize);
  1278. else
  1279. {
  1280. enum TIFFReadDirEntryErr err;
  1281. uint32_t offset = direntry->tdir_offset.toff_long;
  1282. if (tif->tif_flags & TIFF_SWAB)
  1283. TIFFSwabLong(&offset);
  1284. if (isMapped(tif))
  1285. err = TIFFReadDirEntryData(tif, (uint64_t)offset,
  1286. (tmsize_t)datasize, data);
  1287. else
  1288. err = TIFFReadDirEntryDataAndRealloc(tif, (uint64_t)offset,
  1289. (tmsize_t)datasize, &data);
  1290. if (err != TIFFReadDirEntryErrOk)
  1291. {
  1292. _TIFFfreeExt(tif, data);
  1293. return (err);
  1294. }
  1295. }
  1296. }
  1297. else
  1298. {
  1299. /* See above comment for the Classic TIFF case */
  1300. if (original_datasize_clamped <= 8 && datasize <= 8)
  1301. _TIFFmemcpy(data, &direntry->tdir_offset, datasize);
  1302. else
  1303. {
  1304. enum TIFFReadDirEntryErr err;
  1305. uint64_t offset = direntry->tdir_offset.toff_long8;
  1306. if (tif->tif_flags & TIFF_SWAB)
  1307. TIFFSwabLong8(&offset);
  1308. if (isMapped(tif))
  1309. err = TIFFReadDirEntryData(tif, (uint64_t)offset,
  1310. (tmsize_t)datasize, data);
  1311. else
  1312. err = TIFFReadDirEntryDataAndRealloc(tif, (uint64_t)offset,
  1313. (tmsize_t)datasize, &data);
  1314. if (err != TIFFReadDirEntryErrOk)
  1315. {
  1316. _TIFFfreeExt(tif, data);
  1317. return (err);
  1318. }
  1319. }
  1320. }
  1321. *value = data;
  1322. return (TIFFReadDirEntryErrOk);
  1323. }
  1324. static enum TIFFReadDirEntryErr
  1325. TIFFReadDirEntryArray(TIFF *tif, TIFFDirEntry *direntry, uint32_t *count,
  1326. uint32_t desttypesize, void **value)
  1327. {
  1328. return TIFFReadDirEntryArrayWithLimit(tif, direntry, count, desttypesize,
  1329. value, ~((uint64_t)0));
  1330. }
  1331. static enum TIFFReadDirEntryErr
  1332. TIFFReadDirEntryByteArray(TIFF *tif, TIFFDirEntry *direntry, uint8_t **value)
  1333. {
  1334. enum TIFFReadDirEntryErr err;
  1335. uint32_t count;
  1336. void *origdata;
  1337. uint8_t *data;
  1338. switch (direntry->tdir_type)
  1339. {
  1340. case TIFF_ASCII:
  1341. case TIFF_UNDEFINED:
  1342. case TIFF_BYTE:
  1343. case TIFF_SBYTE:
  1344. case TIFF_SHORT:
  1345. case TIFF_SSHORT:
  1346. case TIFF_LONG:
  1347. case TIFF_SLONG:
  1348. case TIFF_LONG8:
  1349. case TIFF_SLONG8:
  1350. break;
  1351. default:
  1352. return (TIFFReadDirEntryErrType);
  1353. }
  1354. err = TIFFReadDirEntryArray(tif, direntry, &count, 1, &origdata);
  1355. if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
  1356. {
  1357. *value = 0;
  1358. return (err);
  1359. }
  1360. switch (direntry->tdir_type)
  1361. {
  1362. case TIFF_ASCII:
  1363. case TIFF_UNDEFINED:
  1364. case TIFF_BYTE:
  1365. *value = (uint8_t *)origdata;
  1366. return (TIFFReadDirEntryErrOk);
  1367. case TIFF_SBYTE:
  1368. {
  1369. int8_t *m;
  1370. uint32_t n;
  1371. m = (int8_t *)origdata;
  1372. for (n = 0; n < count; n++)
  1373. {
  1374. err = TIFFReadDirEntryCheckRangeByteSbyte(*m);
  1375. if (err != TIFFReadDirEntryErrOk)
  1376. {
  1377. _TIFFfreeExt(tif, origdata);
  1378. return (err);
  1379. }
  1380. m++;
  1381. }
  1382. *value = (uint8_t *)origdata;
  1383. return (TIFFReadDirEntryErrOk);
  1384. }
  1385. }
  1386. data = (uint8_t *)_TIFFmallocExt(tif, count);
  1387. if (data == 0)
  1388. {
  1389. _TIFFfreeExt(tif, origdata);
  1390. return (TIFFReadDirEntryErrAlloc);
  1391. }
  1392. switch (direntry->tdir_type)
  1393. {
  1394. case TIFF_SHORT:
  1395. {
  1396. uint16_t *ma;
  1397. uint8_t *mb;
  1398. uint32_t n;
  1399. ma = (uint16_t *)origdata;
  1400. mb = data;
  1401. for (n = 0; n < count; n++)
  1402. {
  1403. if (tif->tif_flags & TIFF_SWAB)
  1404. TIFFSwabShort(ma);
  1405. err = TIFFReadDirEntryCheckRangeByteShort(*ma);
  1406. if (err != TIFFReadDirEntryErrOk)
  1407. break;
  1408. *mb++ = (uint8_t)(*ma++);
  1409. }
  1410. }
  1411. break;
  1412. case TIFF_SSHORT:
  1413. {
  1414. int16_t *ma;
  1415. uint8_t *mb;
  1416. uint32_t n;
  1417. ma = (int16_t *)origdata;
  1418. mb = data;
  1419. for (n = 0; n < count; n++)
  1420. {
  1421. if (tif->tif_flags & TIFF_SWAB)
  1422. TIFFSwabShort((uint16_t *)ma);
  1423. err = TIFFReadDirEntryCheckRangeByteSshort(*ma);
  1424. if (err != TIFFReadDirEntryErrOk)
  1425. break;
  1426. *mb++ = (uint8_t)(*ma++);
  1427. }
  1428. }
  1429. break;
  1430. case TIFF_LONG:
  1431. {
  1432. uint32_t *ma;
  1433. uint8_t *mb;
  1434. uint32_t n;
  1435. ma = (uint32_t *)origdata;
  1436. mb = data;
  1437. for (n = 0; n < count; n++)
  1438. {
  1439. if (tif->tif_flags & TIFF_SWAB)
  1440. TIFFSwabLong(ma);
  1441. err = TIFFReadDirEntryCheckRangeByteLong(*ma);
  1442. if (err != TIFFReadDirEntryErrOk)
  1443. break;
  1444. *mb++ = (uint8_t)(*ma++);
  1445. }
  1446. }
  1447. break;
  1448. case TIFF_SLONG:
  1449. {
  1450. int32_t *ma;
  1451. uint8_t *mb;
  1452. uint32_t n;
  1453. ma = (int32_t *)origdata;
  1454. mb = data;
  1455. for (n = 0; n < count; n++)
  1456. {
  1457. if (tif->tif_flags & TIFF_SWAB)
  1458. TIFFSwabLong((uint32_t *)ma);
  1459. err = TIFFReadDirEntryCheckRangeByteSlong(*ma);
  1460. if (err != TIFFReadDirEntryErrOk)
  1461. break;
  1462. *mb++ = (uint8_t)(*ma++);
  1463. }
  1464. }
  1465. break;
  1466. case TIFF_LONG8:
  1467. {
  1468. uint64_t *ma;
  1469. uint8_t *mb;
  1470. uint32_t n;
  1471. ma = (uint64_t *)origdata;
  1472. mb = data;
  1473. for (n = 0; n < count; n++)
  1474. {
  1475. if (tif->tif_flags & TIFF_SWAB)
  1476. TIFFSwabLong8(ma);
  1477. err = TIFFReadDirEntryCheckRangeByteLong8(*ma);
  1478. if (err != TIFFReadDirEntryErrOk)
  1479. break;
  1480. *mb++ = (uint8_t)(*ma++);
  1481. }
  1482. }
  1483. break;
  1484. case TIFF_SLONG8:
  1485. {
  1486. int64_t *ma;
  1487. uint8_t *mb;
  1488. uint32_t n;
  1489. ma = (int64_t *)origdata;
  1490. mb = data;
  1491. for (n = 0; n < count; n++)
  1492. {
  1493. if (tif->tif_flags & TIFF_SWAB)
  1494. TIFFSwabLong8((uint64_t *)ma);
  1495. err = TIFFReadDirEntryCheckRangeByteSlong8(*ma);
  1496. if (err != TIFFReadDirEntryErrOk)
  1497. break;
  1498. *mb++ = (uint8_t)(*ma++);
  1499. }
  1500. }
  1501. break;
  1502. }
  1503. _TIFFfreeExt(tif, origdata);
  1504. if (err != TIFFReadDirEntryErrOk)
  1505. {
  1506. _TIFFfreeExt(tif, data);
  1507. return (err);
  1508. }
  1509. *value = data;
  1510. return (TIFFReadDirEntryErrOk);
  1511. }
  1512. static enum TIFFReadDirEntryErr
  1513. TIFFReadDirEntrySbyteArray(TIFF *tif, TIFFDirEntry *direntry, int8_t **value)
  1514. {
  1515. enum TIFFReadDirEntryErr err;
  1516. uint32_t count;
  1517. void *origdata;
  1518. int8_t *data;
  1519. switch (direntry->tdir_type)
  1520. {
  1521. case TIFF_UNDEFINED:
  1522. case TIFF_BYTE:
  1523. case TIFF_SBYTE:
  1524. case TIFF_SHORT:
  1525. case TIFF_SSHORT:
  1526. case TIFF_LONG:
  1527. case TIFF_SLONG:
  1528. case TIFF_LONG8:
  1529. case TIFF_SLONG8:
  1530. break;
  1531. default:
  1532. return (TIFFReadDirEntryErrType);
  1533. }
  1534. err = TIFFReadDirEntryArray(tif, direntry, &count, 1, &origdata);
  1535. if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
  1536. {
  1537. *value = 0;
  1538. return (err);
  1539. }
  1540. switch (direntry->tdir_type)
  1541. {
  1542. case TIFF_UNDEFINED:
  1543. case TIFF_BYTE:
  1544. {
  1545. uint8_t *m;
  1546. uint32_t n;
  1547. m = (uint8_t *)origdata;
  1548. for (n = 0; n < count; n++)
  1549. {
  1550. err = TIFFReadDirEntryCheckRangeSbyteByte(*m);
  1551. if (err != TIFFReadDirEntryErrOk)
  1552. {
  1553. _TIFFfreeExt(tif, origdata);
  1554. return (err);
  1555. }
  1556. m++;
  1557. }
  1558. *value = (int8_t *)origdata;
  1559. return (TIFFReadDirEntryErrOk);
  1560. }
  1561. case TIFF_SBYTE:
  1562. *value = (int8_t *)origdata;
  1563. return (TIFFReadDirEntryErrOk);
  1564. }
  1565. data = (int8_t *)_TIFFmallocExt(tif, count);
  1566. if (data == 0)
  1567. {
  1568. _TIFFfreeExt(tif, origdata);
  1569. return (TIFFReadDirEntryErrAlloc);
  1570. }
  1571. switch (direntry->tdir_type)
  1572. {
  1573. case TIFF_SHORT:
  1574. {
  1575. uint16_t *ma;
  1576. int8_t *mb;
  1577. uint32_t n;
  1578. ma = (uint16_t *)origdata;
  1579. mb = data;
  1580. for (n = 0; n < count; n++)
  1581. {
  1582. if (tif->tif_flags & TIFF_SWAB)
  1583. TIFFSwabShort(ma);
  1584. err = TIFFReadDirEntryCheckRangeSbyteShort(*ma);
  1585. if (err != TIFFReadDirEntryErrOk)
  1586. break;
  1587. *mb++ = (int8_t)(*ma++);
  1588. }
  1589. }
  1590. break;
  1591. case TIFF_SSHORT:
  1592. {
  1593. int16_t *ma;
  1594. int8_t *mb;
  1595. uint32_t n;
  1596. ma = (int16_t *)origdata;
  1597. mb = data;
  1598. for (n = 0; n < count; n++)
  1599. {
  1600. if (tif->tif_flags & TIFF_SWAB)
  1601. TIFFSwabShort((uint16_t *)ma);
  1602. err = TIFFReadDirEntryCheckRangeSbyteSshort(*ma);
  1603. if (err != TIFFReadDirEntryErrOk)
  1604. break;
  1605. *mb++ = (int8_t)(*ma++);
  1606. }
  1607. }
  1608. break;
  1609. case TIFF_LONG:
  1610. {
  1611. uint32_t *ma;
  1612. int8_t *mb;
  1613. uint32_t n;
  1614. ma = (uint32_t *)origdata;
  1615. mb = data;
  1616. for (n = 0; n < count; n++)
  1617. {
  1618. if (tif->tif_flags & TIFF_SWAB)
  1619. TIFFSwabLong(ma);
  1620. err = TIFFReadDirEntryCheckRangeSbyteLong(*ma);
  1621. if (err != TIFFReadDirEntryErrOk)
  1622. break;
  1623. *mb++ = (int8_t)(*ma++);
  1624. }
  1625. }
  1626. break;
  1627. case TIFF_SLONG:
  1628. {
  1629. int32_t *ma;
  1630. int8_t *mb;
  1631. uint32_t n;
  1632. ma = (int32_t *)origdata;
  1633. mb = data;
  1634. for (n = 0; n < count; n++)
  1635. {
  1636. if (tif->tif_flags & TIFF_SWAB)
  1637. TIFFSwabLong((uint32_t *)ma);
  1638. err = TIFFReadDirEntryCheckRangeSbyteSlong(*ma);
  1639. if (err != TIFFReadDirEntryErrOk)
  1640. break;
  1641. *mb++ = (int8_t)(*ma++);
  1642. }
  1643. }
  1644. break;
  1645. case TIFF_LONG8:
  1646. {
  1647. uint64_t *ma;
  1648. int8_t *mb;
  1649. uint32_t n;
  1650. ma = (uint64_t *)origdata;
  1651. mb = data;
  1652. for (n = 0; n < count; n++)
  1653. {
  1654. if (tif->tif_flags & TIFF_SWAB)
  1655. TIFFSwabLong8(ma);
  1656. err = TIFFReadDirEntryCheckRangeSbyteLong8(*ma);
  1657. if (err != TIFFReadDirEntryErrOk)
  1658. break;
  1659. *mb++ = (int8_t)(*ma++);
  1660. }
  1661. }
  1662. break;
  1663. case TIFF_SLONG8:
  1664. {
  1665. int64_t *ma;
  1666. int8_t *mb;
  1667. uint32_t n;
  1668. ma = (int64_t *)origdata;
  1669. mb = data;
  1670. for (n = 0; n < count; n++)
  1671. {
  1672. if (tif->tif_flags & TIFF_SWAB)
  1673. TIFFSwabLong8((uint64_t *)ma);
  1674. err = TIFFReadDirEntryCheckRangeSbyteSlong8(*ma);
  1675. if (err != TIFFReadDirEntryErrOk)
  1676. break;
  1677. *mb++ = (int8_t)(*ma++);
  1678. }
  1679. }
  1680. break;
  1681. }
  1682. _TIFFfreeExt(tif, origdata);
  1683. if (err != TIFFReadDirEntryErrOk)
  1684. {
  1685. _TIFFfreeExt(tif, data);
  1686. return (err);
  1687. }
  1688. *value = data;
  1689. return (TIFFReadDirEntryErrOk);
  1690. }
  1691. static enum TIFFReadDirEntryErr
  1692. TIFFReadDirEntryShortArray(TIFF *tif, TIFFDirEntry *direntry, uint16_t **value)
  1693. {
  1694. enum TIFFReadDirEntryErr err;
  1695. uint32_t count;
  1696. void *origdata;
  1697. uint16_t *data;
  1698. switch (direntry->tdir_type)
  1699. {
  1700. case TIFF_BYTE:
  1701. case TIFF_SBYTE:
  1702. case TIFF_SHORT:
  1703. case TIFF_SSHORT:
  1704. case TIFF_LONG:
  1705. case TIFF_SLONG:
  1706. case TIFF_LONG8:
  1707. case TIFF_SLONG8:
  1708. break;
  1709. default:
  1710. return (TIFFReadDirEntryErrType);
  1711. }
  1712. err = TIFFReadDirEntryArray(tif, direntry, &count, 2, &origdata);
  1713. if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
  1714. {
  1715. *value = 0;
  1716. return (err);
  1717. }
  1718. switch (direntry->tdir_type)
  1719. {
  1720. case TIFF_SHORT:
  1721. *value = (uint16_t *)origdata;
  1722. if (tif->tif_flags & TIFF_SWAB)
  1723. TIFFSwabArrayOfShort(*value, count);
  1724. return (TIFFReadDirEntryErrOk);
  1725. case TIFF_SSHORT:
  1726. {
  1727. int16_t *m;
  1728. uint32_t n;
  1729. m = (int16_t *)origdata;
  1730. for (n = 0; n < count; n++)
  1731. {
  1732. if (tif->tif_flags & TIFF_SWAB)
  1733. TIFFSwabShort((uint16_t *)m);
  1734. err = TIFFReadDirEntryCheckRangeShortSshort(*m);
  1735. if (err != TIFFReadDirEntryErrOk)
  1736. {
  1737. _TIFFfreeExt(tif, origdata);
  1738. return (err);
  1739. }
  1740. m++;
  1741. }
  1742. *value = (uint16_t *)origdata;
  1743. return (TIFFReadDirEntryErrOk);
  1744. }
  1745. }
  1746. data = (uint16_t *)_TIFFmallocExt(tif, count * 2);
  1747. if (data == 0)
  1748. {
  1749. _TIFFfreeExt(tif, origdata);
  1750. return (TIFFReadDirEntryErrAlloc);
  1751. }
  1752. switch (direntry->tdir_type)
  1753. {
  1754. case TIFF_BYTE:
  1755. {
  1756. uint8_t *ma;
  1757. uint16_t *mb;
  1758. uint32_t n;
  1759. ma = (uint8_t *)origdata;
  1760. mb = data;
  1761. for (n = 0; n < count; n++)
  1762. *mb++ = (uint16_t)(*ma++);
  1763. }
  1764. break;
  1765. case TIFF_SBYTE:
  1766. {
  1767. int8_t *ma;
  1768. uint16_t *mb;
  1769. uint32_t n;
  1770. ma = (int8_t *)origdata;
  1771. mb = data;
  1772. for (n = 0; n < count; n++)
  1773. {
  1774. err = TIFFReadDirEntryCheckRangeShortSbyte(*ma);
  1775. if (err != TIFFReadDirEntryErrOk)
  1776. break;
  1777. *mb++ = (uint16_t)(*ma++);
  1778. }
  1779. }
  1780. break;
  1781. case TIFF_LONG:
  1782. {
  1783. uint32_t *ma;
  1784. uint16_t *mb;
  1785. uint32_t n;
  1786. ma = (uint32_t *)origdata;
  1787. mb = data;
  1788. for (n = 0; n < count; n++)
  1789. {
  1790. if (tif->tif_flags & TIFF_SWAB)
  1791. TIFFSwabLong(ma);
  1792. err = TIFFReadDirEntryCheckRangeShortLong(*ma);
  1793. if (err != TIFFReadDirEntryErrOk)
  1794. break;
  1795. *mb++ = (uint16_t)(*ma++);
  1796. }
  1797. }
  1798. break;
  1799. case TIFF_SLONG:
  1800. {
  1801. int32_t *ma;
  1802. uint16_t *mb;
  1803. uint32_t n;
  1804. ma = (int32_t *)origdata;
  1805. mb = data;
  1806. for (n = 0; n < count; n++)
  1807. {
  1808. if (tif->tif_flags & TIFF_SWAB)
  1809. TIFFSwabLong((uint32_t *)ma);
  1810. err = TIFFReadDirEntryCheckRangeShortSlong(*ma);
  1811. if (err != TIFFReadDirEntryErrOk)
  1812. break;
  1813. *mb++ = (uint16_t)(*ma++);
  1814. }
  1815. }
  1816. break;
  1817. case TIFF_LONG8:
  1818. {
  1819. uint64_t *ma;
  1820. uint16_t *mb;
  1821. uint32_t n;
  1822. ma = (uint64_t *)origdata;
  1823. mb = data;
  1824. for (n = 0; n < count; n++)
  1825. {
  1826. if (tif->tif_flags & TIFF_SWAB)
  1827. TIFFSwabLong8(ma);
  1828. err = TIFFReadDirEntryCheckRangeShortLong8(*ma);
  1829. if (err != TIFFReadDirEntryErrOk)
  1830. break;
  1831. *mb++ = (uint16_t)(*ma++);
  1832. }
  1833. }
  1834. break;
  1835. case TIFF_SLONG8:
  1836. {
  1837. int64_t *ma;
  1838. uint16_t *mb;
  1839. uint32_t n;
  1840. ma = (int64_t *)origdata;
  1841. mb = data;
  1842. for (n = 0; n < count; n++)
  1843. {
  1844. if (tif->tif_flags & TIFF_SWAB)
  1845. TIFFSwabLong8((uint64_t *)ma);
  1846. err = TIFFReadDirEntryCheckRangeShortSlong8(*ma);
  1847. if (err != TIFFReadDirEntryErrOk)
  1848. break;
  1849. *mb++ = (uint16_t)(*ma++);
  1850. }
  1851. }
  1852. break;
  1853. }
  1854. _TIFFfreeExt(tif, origdata);
  1855. if (err != TIFFReadDirEntryErrOk)
  1856. {
  1857. _TIFFfreeExt(tif, data);
  1858. return (err);
  1859. }
  1860. *value = data;
  1861. return (TIFFReadDirEntryErrOk);
  1862. }
  1863. static enum TIFFReadDirEntryErr
  1864. TIFFReadDirEntrySshortArray(TIFF *tif, TIFFDirEntry *direntry, int16_t **value)
  1865. {
  1866. enum TIFFReadDirEntryErr err;
  1867. uint32_t count;
  1868. void *origdata;
  1869. int16_t *data;
  1870. switch (direntry->tdir_type)
  1871. {
  1872. case TIFF_BYTE:
  1873. case TIFF_SBYTE:
  1874. case TIFF_SHORT:
  1875. case TIFF_SSHORT:
  1876. case TIFF_LONG:
  1877. case TIFF_SLONG:
  1878. case TIFF_LONG8:
  1879. case TIFF_SLONG8:
  1880. break;
  1881. default:
  1882. return (TIFFReadDirEntryErrType);
  1883. }
  1884. err = TIFFReadDirEntryArray(tif, direntry, &count, 2, &origdata);
  1885. if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
  1886. {
  1887. *value = 0;
  1888. return (err);
  1889. }
  1890. switch (direntry->tdir_type)
  1891. {
  1892. case TIFF_SHORT:
  1893. {
  1894. uint16_t *m;
  1895. uint32_t n;
  1896. m = (uint16_t *)origdata;
  1897. for (n = 0; n < count; n++)
  1898. {
  1899. if (tif->tif_flags & TIFF_SWAB)
  1900. TIFFSwabShort(m);
  1901. err = TIFFReadDirEntryCheckRangeSshortShort(*m);
  1902. if (err != TIFFReadDirEntryErrOk)
  1903. {
  1904. _TIFFfreeExt(tif, origdata);
  1905. return (err);
  1906. }
  1907. m++;
  1908. }
  1909. *value = (int16_t *)origdata;
  1910. return (TIFFReadDirEntryErrOk);
  1911. }
  1912. case TIFF_SSHORT:
  1913. *value = (int16_t *)origdata;
  1914. if (tif->tif_flags & TIFF_SWAB)
  1915. TIFFSwabArrayOfShort((uint16_t *)(*value), count);
  1916. return (TIFFReadDirEntryErrOk);
  1917. }
  1918. data = (int16_t *)_TIFFmallocExt(tif, count * 2);
  1919. if (data == 0)
  1920. {
  1921. _TIFFfreeExt(tif, origdata);
  1922. return (TIFFReadDirEntryErrAlloc);
  1923. }
  1924. switch (direntry->tdir_type)
  1925. {
  1926. case TIFF_BYTE:
  1927. {
  1928. uint8_t *ma;
  1929. int16_t *mb;
  1930. uint32_t n;
  1931. ma = (uint8_t *)origdata;
  1932. mb = data;
  1933. for (n = 0; n < count; n++)
  1934. *mb++ = (int16_t)(*ma++);
  1935. }
  1936. break;
  1937. case TIFF_SBYTE:
  1938. {
  1939. int8_t *ma;
  1940. int16_t *mb;
  1941. uint32_t n;
  1942. ma = (int8_t *)origdata;
  1943. mb = data;
  1944. for (n = 0; n < count; n++)
  1945. *mb++ = (int16_t)(*ma++);
  1946. }
  1947. break;
  1948. case TIFF_LONG:
  1949. {
  1950. uint32_t *ma;
  1951. int16_t *mb;
  1952. uint32_t n;
  1953. ma = (uint32_t *)origdata;
  1954. mb = data;
  1955. for (n = 0; n < count; n++)
  1956. {
  1957. if (tif->tif_flags & TIFF_SWAB)
  1958. TIFFSwabLong(ma);
  1959. err = TIFFReadDirEntryCheckRangeSshortLong(*ma);
  1960. if (err != TIFFReadDirEntryErrOk)
  1961. break;
  1962. *mb++ = (int16_t)(*ma++);
  1963. }
  1964. }
  1965. break;
  1966. case TIFF_SLONG:
  1967. {
  1968. int32_t *ma;
  1969. int16_t *mb;
  1970. uint32_t n;
  1971. ma = (int32_t *)origdata;
  1972. mb = data;
  1973. for (n = 0; n < count; n++)
  1974. {
  1975. if (tif->tif_flags & TIFF_SWAB)
  1976. TIFFSwabLong((uint32_t *)ma);
  1977. err = TIFFReadDirEntryCheckRangeSshortSlong(*ma);
  1978. if (err != TIFFReadDirEntryErrOk)
  1979. break;
  1980. *mb++ = (int16_t)(*ma++);
  1981. }
  1982. }
  1983. break;
  1984. case TIFF_LONG8:
  1985. {
  1986. uint64_t *ma;
  1987. int16_t *mb;
  1988. uint32_t n;
  1989. ma = (uint64_t *)origdata;
  1990. mb = data;
  1991. for (n = 0; n < count; n++)
  1992. {
  1993. if (tif->tif_flags & TIFF_SWAB)
  1994. TIFFSwabLong8(ma);
  1995. err = TIFFReadDirEntryCheckRangeSshortLong8(*ma);
  1996. if (err != TIFFReadDirEntryErrOk)
  1997. break;
  1998. *mb++ = (int16_t)(*ma++);
  1999. }
  2000. }
  2001. break;
  2002. case TIFF_SLONG8:
  2003. {
  2004. int64_t *ma;
  2005. int16_t *mb;
  2006. uint32_t n;
  2007. ma = (int64_t *)origdata;
  2008. mb = data;
  2009. for (n = 0; n < count; n++)
  2010. {
  2011. if (tif->tif_flags & TIFF_SWAB)
  2012. TIFFSwabLong8((uint64_t *)ma);
  2013. err = TIFFReadDirEntryCheckRangeSshortSlong8(*ma);
  2014. if (err != TIFFReadDirEntryErrOk)
  2015. break;
  2016. *mb++ = (int16_t)(*ma++);
  2017. }
  2018. }
  2019. break;
  2020. }
  2021. _TIFFfreeExt(tif, origdata);
  2022. if (err != TIFFReadDirEntryErrOk)
  2023. {
  2024. _TIFFfreeExt(tif, data);
  2025. return (err);
  2026. }
  2027. *value = data;
  2028. return (TIFFReadDirEntryErrOk);
  2029. }
  2030. static enum TIFFReadDirEntryErr
  2031. TIFFReadDirEntryLongArray(TIFF *tif, TIFFDirEntry *direntry, uint32_t **value)
  2032. {
  2033. enum TIFFReadDirEntryErr err;
  2034. uint32_t count;
  2035. void *origdata;
  2036. uint32_t *data;
  2037. switch (direntry->tdir_type)
  2038. {
  2039. case TIFF_BYTE:
  2040. case TIFF_SBYTE:
  2041. case TIFF_SHORT:
  2042. case TIFF_SSHORT:
  2043. case TIFF_LONG:
  2044. case TIFF_SLONG:
  2045. case TIFF_LONG8:
  2046. case TIFF_SLONG8:
  2047. break;
  2048. default:
  2049. return (TIFFReadDirEntryErrType);
  2050. }
  2051. err = TIFFReadDirEntryArray(tif, direntry, &count, 4, &origdata);
  2052. if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
  2053. {
  2054. *value = 0;
  2055. return (err);
  2056. }
  2057. switch (direntry->tdir_type)
  2058. {
  2059. case TIFF_LONG:
  2060. *value = (uint32_t *)origdata;
  2061. if (tif->tif_flags & TIFF_SWAB)
  2062. TIFFSwabArrayOfLong(*value, count);
  2063. return (TIFFReadDirEntryErrOk);
  2064. case TIFF_SLONG:
  2065. {
  2066. int32_t *m;
  2067. uint32_t n;
  2068. m = (int32_t *)origdata;
  2069. for (n = 0; n < count; n++)
  2070. {
  2071. if (tif->tif_flags & TIFF_SWAB)
  2072. TIFFSwabLong((uint32_t *)m);
  2073. err = TIFFReadDirEntryCheckRangeLongSlong(*m);
  2074. if (err != TIFFReadDirEntryErrOk)
  2075. {
  2076. _TIFFfreeExt(tif, origdata);
  2077. return (err);
  2078. }
  2079. m++;
  2080. }
  2081. *value = (uint32_t *)origdata;
  2082. return (TIFFReadDirEntryErrOk);
  2083. }
  2084. }
  2085. data = (uint32_t *)_TIFFmallocExt(tif, count * 4);
  2086. if (data == 0)
  2087. {
  2088. _TIFFfreeExt(tif, origdata);
  2089. return (TIFFReadDirEntryErrAlloc);
  2090. }
  2091. switch (direntry->tdir_type)
  2092. {
  2093. case TIFF_BYTE:
  2094. {
  2095. uint8_t *ma;
  2096. uint32_t *mb;
  2097. uint32_t n;
  2098. ma = (uint8_t *)origdata;
  2099. mb = data;
  2100. for (n = 0; n < count; n++)
  2101. *mb++ = (uint32_t)(*ma++);
  2102. }
  2103. break;
  2104. case TIFF_SBYTE:
  2105. {
  2106. int8_t *ma;
  2107. uint32_t *mb;
  2108. uint32_t n;
  2109. ma = (int8_t *)origdata;
  2110. mb = data;
  2111. for (n = 0; n < count; n++)
  2112. {
  2113. err = TIFFReadDirEntryCheckRangeLongSbyte(*ma);
  2114. if (err != TIFFReadDirEntryErrOk)
  2115. break;
  2116. *mb++ = (uint32_t)(*ma++);
  2117. }
  2118. }
  2119. break;
  2120. case TIFF_SHORT:
  2121. {
  2122. uint16_t *ma;
  2123. uint32_t *mb;
  2124. uint32_t n;
  2125. ma = (uint16_t *)origdata;
  2126. mb = data;
  2127. for (n = 0; n < count; n++)
  2128. {
  2129. if (tif->tif_flags & TIFF_SWAB)
  2130. TIFFSwabShort(ma);
  2131. *mb++ = (uint32_t)(*ma++);
  2132. }
  2133. }
  2134. break;
  2135. case TIFF_SSHORT:
  2136. {
  2137. int16_t *ma;
  2138. uint32_t *mb;
  2139. uint32_t n;
  2140. ma = (int16_t *)origdata;
  2141. mb = data;
  2142. for (n = 0; n < count; n++)
  2143. {
  2144. if (tif->tif_flags & TIFF_SWAB)
  2145. TIFFSwabShort((uint16_t *)ma);
  2146. err = TIFFReadDirEntryCheckRangeLongSshort(*ma);
  2147. if (err != TIFFReadDirEntryErrOk)
  2148. break;
  2149. *mb++ = (uint32_t)(*ma++);
  2150. }
  2151. }
  2152. break;
  2153. case TIFF_LONG8:
  2154. {
  2155. uint64_t *ma;
  2156. uint32_t *mb;
  2157. uint32_t n;
  2158. ma = (uint64_t *)origdata;
  2159. mb = data;
  2160. for (n = 0; n < count; n++)
  2161. {
  2162. if (tif->tif_flags & TIFF_SWAB)
  2163. TIFFSwabLong8(ma);
  2164. err = TIFFReadDirEntryCheckRangeLongLong8(*ma);
  2165. if (err != TIFFReadDirEntryErrOk)
  2166. break;
  2167. *mb++ = (uint32_t)(*ma++);
  2168. }
  2169. }
  2170. break;
  2171. case TIFF_SLONG8:
  2172. {
  2173. int64_t *ma;
  2174. uint32_t *mb;
  2175. uint32_t n;
  2176. ma = (int64_t *)origdata;
  2177. mb = data;
  2178. for (n = 0; n < count; n++)
  2179. {
  2180. if (tif->tif_flags & TIFF_SWAB)
  2181. TIFFSwabLong8((uint64_t *)ma);
  2182. err = TIFFReadDirEntryCheckRangeLongSlong8(*ma);
  2183. if (err != TIFFReadDirEntryErrOk)
  2184. break;
  2185. *mb++ = (uint32_t)(*ma++);
  2186. }
  2187. }
  2188. break;
  2189. }
  2190. _TIFFfreeExt(tif, origdata);
  2191. if (err != TIFFReadDirEntryErrOk)
  2192. {
  2193. _TIFFfreeExt(tif, data);
  2194. return (err);
  2195. }
  2196. *value = data;
  2197. return (TIFFReadDirEntryErrOk);
  2198. }
  2199. static enum TIFFReadDirEntryErr
  2200. TIFFReadDirEntrySlongArray(TIFF *tif, TIFFDirEntry *direntry, int32_t **value)
  2201. {
  2202. enum TIFFReadDirEntryErr err;
  2203. uint32_t count;
  2204. void *origdata;
  2205. int32_t *data;
  2206. switch (direntry->tdir_type)
  2207. {
  2208. case TIFF_BYTE:
  2209. case TIFF_SBYTE:
  2210. case TIFF_SHORT:
  2211. case TIFF_SSHORT:
  2212. case TIFF_LONG:
  2213. case TIFF_SLONG:
  2214. case TIFF_LONG8:
  2215. case TIFF_SLONG8:
  2216. break;
  2217. default:
  2218. return (TIFFReadDirEntryErrType);
  2219. }
  2220. err = TIFFReadDirEntryArray(tif, direntry, &count, 4, &origdata);
  2221. if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
  2222. {
  2223. *value = 0;
  2224. return (err);
  2225. }
  2226. switch (direntry->tdir_type)
  2227. {
  2228. case TIFF_LONG:
  2229. {
  2230. uint32_t *m;
  2231. uint32_t n;
  2232. m = (uint32_t *)origdata;
  2233. for (n = 0; n < count; n++)
  2234. {
  2235. if (tif->tif_flags & TIFF_SWAB)
  2236. TIFFSwabLong((uint32_t *)m);
  2237. err = TIFFReadDirEntryCheckRangeSlongLong(*m);
  2238. if (err != TIFFReadDirEntryErrOk)
  2239. {
  2240. _TIFFfreeExt(tif, origdata);
  2241. return (err);
  2242. }
  2243. m++;
  2244. }
  2245. *value = (int32_t *)origdata;
  2246. return (TIFFReadDirEntryErrOk);
  2247. }
  2248. case TIFF_SLONG:
  2249. *value = (int32_t *)origdata;
  2250. if (tif->tif_flags & TIFF_SWAB)
  2251. TIFFSwabArrayOfLong((uint32_t *)(*value), count);
  2252. return (TIFFReadDirEntryErrOk);
  2253. }
  2254. data = (int32_t *)_TIFFmallocExt(tif, count * 4);
  2255. if (data == 0)
  2256. {
  2257. _TIFFfreeExt(tif, origdata);
  2258. return (TIFFReadDirEntryErrAlloc);
  2259. }
  2260. switch (direntry->tdir_type)
  2261. {
  2262. case TIFF_BYTE:
  2263. {
  2264. uint8_t *ma;
  2265. int32_t *mb;
  2266. uint32_t n;
  2267. ma = (uint8_t *)origdata;
  2268. mb = data;
  2269. for (n = 0; n < count; n++)
  2270. *mb++ = (int32_t)(*ma++);
  2271. }
  2272. break;
  2273. case TIFF_SBYTE:
  2274. {
  2275. int8_t *ma;
  2276. int32_t *mb;
  2277. uint32_t n;
  2278. ma = (int8_t *)origdata;
  2279. mb = data;
  2280. for (n = 0; n < count; n++)
  2281. *mb++ = (int32_t)(*ma++);
  2282. }
  2283. break;
  2284. case TIFF_SHORT:
  2285. {
  2286. uint16_t *ma;
  2287. int32_t *mb;
  2288. uint32_t n;
  2289. ma = (uint16_t *)origdata;
  2290. mb = data;
  2291. for (n = 0; n < count; n++)
  2292. {
  2293. if (tif->tif_flags & TIFF_SWAB)
  2294. TIFFSwabShort(ma);
  2295. *mb++ = (int32_t)(*ma++);
  2296. }
  2297. }
  2298. break;
  2299. case TIFF_SSHORT:
  2300. {
  2301. int16_t *ma;
  2302. int32_t *mb;
  2303. uint32_t n;
  2304. ma = (int16_t *)origdata;
  2305. mb = data;
  2306. for (n = 0; n < count; n++)
  2307. {
  2308. if (tif->tif_flags & TIFF_SWAB)
  2309. TIFFSwabShort((uint16_t *)ma);
  2310. *mb++ = (int32_t)(*ma++);
  2311. }
  2312. }
  2313. break;
  2314. case TIFF_LONG8:
  2315. {
  2316. uint64_t *ma;
  2317. int32_t *mb;
  2318. uint32_t n;
  2319. ma = (uint64_t *)origdata;
  2320. mb = data;
  2321. for (n = 0; n < count; n++)
  2322. {
  2323. if (tif->tif_flags & TIFF_SWAB)
  2324. TIFFSwabLong8(ma);
  2325. err = TIFFReadDirEntryCheckRangeSlongLong8(*ma);
  2326. if (err != TIFFReadDirEntryErrOk)
  2327. break;
  2328. *mb++ = (int32_t)(*ma++);
  2329. }
  2330. }
  2331. break;
  2332. case TIFF_SLONG8:
  2333. {
  2334. int64_t *ma;
  2335. int32_t *mb;
  2336. uint32_t n;
  2337. ma = (int64_t *)origdata;
  2338. mb = data;
  2339. for (n = 0; n < count; n++)
  2340. {
  2341. if (tif->tif_flags & TIFF_SWAB)
  2342. TIFFSwabLong8((uint64_t *)ma);
  2343. err = TIFFReadDirEntryCheckRangeSlongSlong8(*ma);
  2344. if (err != TIFFReadDirEntryErrOk)
  2345. break;
  2346. *mb++ = (int32_t)(*ma++);
  2347. }
  2348. }
  2349. break;
  2350. }
  2351. _TIFFfreeExt(tif, origdata);
  2352. if (err != TIFFReadDirEntryErrOk)
  2353. {
  2354. _TIFFfreeExt(tif, data);
  2355. return (err);
  2356. }
  2357. *value = data;
  2358. return (TIFFReadDirEntryErrOk);
  2359. }
  2360. static enum TIFFReadDirEntryErr
  2361. TIFFReadDirEntryLong8ArrayWithLimit(TIFF *tif, TIFFDirEntry *direntry,
  2362. uint64_t **value, uint64_t maxcount)
  2363. {
  2364. enum TIFFReadDirEntryErr err;
  2365. uint32_t count;
  2366. void *origdata;
  2367. uint64_t *data;
  2368. switch (direntry->tdir_type)
  2369. {
  2370. case TIFF_BYTE:
  2371. case TIFF_SBYTE:
  2372. case TIFF_SHORT:
  2373. case TIFF_SSHORT:
  2374. case TIFF_LONG:
  2375. case TIFF_SLONG:
  2376. case TIFF_LONG8:
  2377. case TIFF_SLONG8:
  2378. break;
  2379. default:
  2380. return (TIFFReadDirEntryErrType);
  2381. }
  2382. err = TIFFReadDirEntryArrayWithLimit(tif, direntry, &count, 8, &origdata,
  2383. maxcount);
  2384. if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
  2385. {
  2386. *value = 0;
  2387. return (err);
  2388. }
  2389. switch (direntry->tdir_type)
  2390. {
  2391. case TIFF_LONG8:
  2392. *value = (uint64_t *)origdata;
  2393. if (tif->tif_flags & TIFF_SWAB)
  2394. TIFFSwabArrayOfLong8(*value, count);
  2395. return (TIFFReadDirEntryErrOk);
  2396. case TIFF_SLONG8:
  2397. {
  2398. int64_t *m;
  2399. uint32_t n;
  2400. m = (int64_t *)origdata;
  2401. for (n = 0; n < count; n++)
  2402. {
  2403. if (tif->tif_flags & TIFF_SWAB)
  2404. TIFFSwabLong8((uint64_t *)m);
  2405. err = TIFFReadDirEntryCheckRangeLong8Slong8(*m);
  2406. if (err != TIFFReadDirEntryErrOk)
  2407. {
  2408. _TIFFfreeExt(tif, origdata);
  2409. return (err);
  2410. }
  2411. m++;
  2412. }
  2413. *value = (uint64_t *)origdata;
  2414. return (TIFFReadDirEntryErrOk);
  2415. }
  2416. }
  2417. data = (uint64_t *)_TIFFmallocExt(tif, count * 8);
  2418. if (data == 0)
  2419. {
  2420. _TIFFfreeExt(tif, origdata);
  2421. return (TIFFReadDirEntryErrAlloc);
  2422. }
  2423. switch (direntry->tdir_type)
  2424. {
  2425. case TIFF_BYTE:
  2426. {
  2427. uint8_t *ma;
  2428. uint64_t *mb;
  2429. uint32_t n;
  2430. ma = (uint8_t *)origdata;
  2431. mb = data;
  2432. for (n = 0; n < count; n++)
  2433. *mb++ = (uint64_t)(*ma++);
  2434. }
  2435. break;
  2436. case TIFF_SBYTE:
  2437. {
  2438. int8_t *ma;
  2439. uint64_t *mb;
  2440. uint32_t n;
  2441. ma = (int8_t *)origdata;
  2442. mb = data;
  2443. for (n = 0; n < count; n++)
  2444. {
  2445. err = TIFFReadDirEntryCheckRangeLong8Sbyte(*ma);
  2446. if (err != TIFFReadDirEntryErrOk)
  2447. break;
  2448. *mb++ = (uint64_t)(*ma++);
  2449. }
  2450. }
  2451. break;
  2452. case TIFF_SHORT:
  2453. {
  2454. uint16_t *ma;
  2455. uint64_t *mb;
  2456. uint32_t n;
  2457. ma = (uint16_t *)origdata;
  2458. mb = data;
  2459. for (n = 0; n < count; n++)
  2460. {
  2461. if (tif->tif_flags & TIFF_SWAB)
  2462. TIFFSwabShort(ma);
  2463. *mb++ = (uint64_t)(*ma++);
  2464. }
  2465. }
  2466. break;
  2467. case TIFF_SSHORT:
  2468. {
  2469. int16_t *ma;
  2470. uint64_t *mb;
  2471. uint32_t n;
  2472. ma = (int16_t *)origdata;
  2473. mb = data;
  2474. for (n = 0; n < count; n++)
  2475. {
  2476. if (tif->tif_flags & TIFF_SWAB)
  2477. TIFFSwabShort((uint16_t *)ma);
  2478. err = TIFFReadDirEntryCheckRangeLong8Sshort(*ma);
  2479. if (err != TIFFReadDirEntryErrOk)
  2480. break;
  2481. *mb++ = (uint64_t)(*ma++);
  2482. }
  2483. }
  2484. break;
  2485. case TIFF_LONG:
  2486. {
  2487. uint32_t *ma;
  2488. uint64_t *mb;
  2489. uint32_t n;
  2490. ma = (uint32_t *)origdata;
  2491. mb = data;
  2492. for (n = 0; n < count; n++)
  2493. {
  2494. if (tif->tif_flags & TIFF_SWAB)
  2495. TIFFSwabLong(ma);
  2496. *mb++ = (uint64_t)(*ma++);
  2497. }
  2498. }
  2499. break;
  2500. case TIFF_SLONG:
  2501. {
  2502. int32_t *ma;
  2503. uint64_t *mb;
  2504. uint32_t n;
  2505. ma = (int32_t *)origdata;
  2506. mb = data;
  2507. for (n = 0; n < count; n++)
  2508. {
  2509. if (tif->tif_flags & TIFF_SWAB)
  2510. TIFFSwabLong((uint32_t *)ma);
  2511. err = TIFFReadDirEntryCheckRangeLong8Slong(*ma);
  2512. if (err != TIFFReadDirEntryErrOk)
  2513. break;
  2514. *mb++ = (uint64_t)(*ma++);
  2515. }
  2516. }
  2517. break;
  2518. }
  2519. _TIFFfreeExt(tif, origdata);
  2520. if (err != TIFFReadDirEntryErrOk)
  2521. {
  2522. _TIFFfreeExt(tif, data);
  2523. return (err);
  2524. }
  2525. *value = data;
  2526. return (TIFFReadDirEntryErrOk);
  2527. }
  2528. static enum TIFFReadDirEntryErr
  2529. TIFFReadDirEntryLong8Array(TIFF *tif, TIFFDirEntry *direntry, uint64_t **value)
  2530. {
  2531. return TIFFReadDirEntryLong8ArrayWithLimit(tif, direntry, value,
  2532. ~((uint64_t)0));
  2533. }
  2534. static enum TIFFReadDirEntryErr
  2535. TIFFReadDirEntrySlong8Array(TIFF *tif, TIFFDirEntry *direntry, int64_t **value)
  2536. {
  2537. enum TIFFReadDirEntryErr err;
  2538. uint32_t count;
  2539. void *origdata;
  2540. int64_t *data;
  2541. switch (direntry->tdir_type)
  2542. {
  2543. case TIFF_BYTE:
  2544. case TIFF_SBYTE:
  2545. case TIFF_SHORT:
  2546. case TIFF_SSHORT:
  2547. case TIFF_LONG:
  2548. case TIFF_SLONG:
  2549. case TIFF_LONG8:
  2550. case TIFF_SLONG8:
  2551. break;
  2552. default:
  2553. return (TIFFReadDirEntryErrType);
  2554. }
  2555. err = TIFFReadDirEntryArray(tif, direntry, &count, 8, &origdata);
  2556. if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
  2557. {
  2558. *value = 0;
  2559. return (err);
  2560. }
  2561. switch (direntry->tdir_type)
  2562. {
  2563. case TIFF_LONG8:
  2564. {
  2565. uint64_t *m;
  2566. uint32_t n;
  2567. m = (uint64_t *)origdata;
  2568. for (n = 0; n < count; n++)
  2569. {
  2570. if (tif->tif_flags & TIFF_SWAB)
  2571. TIFFSwabLong8(m);
  2572. err = TIFFReadDirEntryCheckRangeSlong8Long8(*m);
  2573. if (err != TIFFReadDirEntryErrOk)
  2574. {
  2575. _TIFFfreeExt(tif, origdata);
  2576. return (err);
  2577. }
  2578. m++;
  2579. }
  2580. *value = (int64_t *)origdata;
  2581. return (TIFFReadDirEntryErrOk);
  2582. }
  2583. case TIFF_SLONG8:
  2584. *value = (int64_t *)origdata;
  2585. if (tif->tif_flags & TIFF_SWAB)
  2586. TIFFSwabArrayOfLong8((uint64_t *)(*value), count);
  2587. return (TIFFReadDirEntryErrOk);
  2588. }
  2589. data = (int64_t *)_TIFFmallocExt(tif, count * 8);
  2590. if (data == 0)
  2591. {
  2592. _TIFFfreeExt(tif, origdata);
  2593. return (TIFFReadDirEntryErrAlloc);
  2594. }
  2595. switch (direntry->tdir_type)
  2596. {
  2597. case TIFF_BYTE:
  2598. {
  2599. uint8_t *ma;
  2600. int64_t *mb;
  2601. uint32_t n;
  2602. ma = (uint8_t *)origdata;
  2603. mb = data;
  2604. for (n = 0; n < count; n++)
  2605. *mb++ = (int64_t)(*ma++);
  2606. }
  2607. break;
  2608. case TIFF_SBYTE:
  2609. {
  2610. int8_t *ma;
  2611. int64_t *mb;
  2612. uint32_t n;
  2613. ma = (int8_t *)origdata;
  2614. mb = data;
  2615. for (n = 0; n < count; n++)
  2616. *mb++ = (int64_t)(*ma++);
  2617. }
  2618. break;
  2619. case TIFF_SHORT:
  2620. {
  2621. uint16_t *ma;
  2622. int64_t *mb;
  2623. uint32_t n;
  2624. ma = (uint16_t *)origdata;
  2625. mb = data;
  2626. for (n = 0; n < count; n++)
  2627. {
  2628. if (tif->tif_flags & TIFF_SWAB)
  2629. TIFFSwabShort(ma);
  2630. *mb++ = (int64_t)(*ma++);
  2631. }
  2632. }
  2633. break;
  2634. case TIFF_SSHORT:
  2635. {
  2636. int16_t *ma;
  2637. int64_t *mb;
  2638. uint32_t n;
  2639. ma = (int16_t *)origdata;
  2640. mb = data;
  2641. for (n = 0; n < count; n++)
  2642. {
  2643. if (tif->tif_flags & TIFF_SWAB)
  2644. TIFFSwabShort((uint16_t *)ma);
  2645. *mb++ = (int64_t)(*ma++);
  2646. }
  2647. }
  2648. break;
  2649. case TIFF_LONG:
  2650. {
  2651. uint32_t *ma;
  2652. int64_t *mb;
  2653. uint32_t n;
  2654. ma = (uint32_t *)origdata;
  2655. mb = data;
  2656. for (n = 0; n < count; n++)
  2657. {
  2658. if (tif->tif_flags & TIFF_SWAB)
  2659. TIFFSwabLong(ma);
  2660. *mb++ = (int64_t)(*ma++);
  2661. }
  2662. }
  2663. break;
  2664. case TIFF_SLONG:
  2665. {
  2666. int32_t *ma;
  2667. int64_t *mb;
  2668. uint32_t n;
  2669. ma = (int32_t *)origdata;
  2670. mb = data;
  2671. for (n = 0; n < count; n++)
  2672. {
  2673. if (tif->tif_flags & TIFF_SWAB)
  2674. TIFFSwabLong((uint32_t *)ma);
  2675. *mb++ = (int64_t)(*ma++);
  2676. }
  2677. }
  2678. break;
  2679. }
  2680. _TIFFfreeExt(tif, origdata);
  2681. *value = data;
  2682. return (TIFFReadDirEntryErrOk);
  2683. }
  2684. static enum TIFFReadDirEntryErr
  2685. TIFFReadDirEntryFloatArray(TIFF *tif, TIFFDirEntry *direntry, float **value)
  2686. {
  2687. enum TIFFReadDirEntryErr err;
  2688. uint32_t count;
  2689. void *origdata;
  2690. float *data;
  2691. switch (direntry->tdir_type)
  2692. {
  2693. case TIFF_BYTE:
  2694. case TIFF_SBYTE:
  2695. case TIFF_SHORT:
  2696. case TIFF_SSHORT:
  2697. case TIFF_LONG:
  2698. case TIFF_SLONG:
  2699. case TIFF_LONG8:
  2700. case TIFF_SLONG8:
  2701. case TIFF_RATIONAL:
  2702. case TIFF_SRATIONAL:
  2703. case TIFF_FLOAT:
  2704. case TIFF_DOUBLE:
  2705. break;
  2706. default:
  2707. return (TIFFReadDirEntryErrType);
  2708. }
  2709. err = TIFFReadDirEntryArray(tif, direntry, &count, 4, &origdata);
  2710. if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
  2711. {
  2712. *value = 0;
  2713. return (err);
  2714. }
  2715. switch (direntry->tdir_type)
  2716. {
  2717. case TIFF_FLOAT:
  2718. if (tif->tif_flags & TIFF_SWAB)
  2719. TIFFSwabArrayOfLong((uint32_t *)origdata, count);
  2720. TIFFCvtIEEEDoubleToNative(tif, count, (float *)origdata);
  2721. *value = (float *)origdata;
  2722. return (TIFFReadDirEntryErrOk);
  2723. }
  2724. data = (float *)_TIFFmallocExt(tif, count * sizeof(float));
  2725. if (data == 0)
  2726. {
  2727. _TIFFfreeExt(tif, origdata);
  2728. return (TIFFReadDirEntryErrAlloc);
  2729. }
  2730. switch (direntry->tdir_type)
  2731. {
  2732. case TIFF_BYTE:
  2733. {
  2734. uint8_t *ma;
  2735. float *mb;
  2736. uint32_t n;
  2737. ma = (uint8_t *)origdata;
  2738. mb = data;
  2739. for (n = 0; n < count; n++)
  2740. *mb++ = (float)(*ma++);
  2741. }
  2742. break;
  2743. case TIFF_SBYTE:
  2744. {
  2745. int8_t *ma;
  2746. float *mb;
  2747. uint32_t n;
  2748. ma = (int8_t *)origdata;
  2749. mb = data;
  2750. for (n = 0; n < count; n++)
  2751. *mb++ = (float)(*ma++);
  2752. }
  2753. break;
  2754. case TIFF_SHORT:
  2755. {
  2756. uint16_t *ma;
  2757. float *mb;
  2758. uint32_t n;
  2759. ma = (uint16_t *)origdata;
  2760. mb = data;
  2761. for (n = 0; n < count; n++)
  2762. {
  2763. if (tif->tif_flags & TIFF_SWAB)
  2764. TIFFSwabShort(ma);
  2765. *mb++ = (float)(*ma++);
  2766. }
  2767. }
  2768. break;
  2769. case TIFF_SSHORT:
  2770. {
  2771. int16_t *ma;
  2772. float *mb;
  2773. uint32_t n;
  2774. ma = (int16_t *)origdata;
  2775. mb = data;
  2776. for (n = 0; n < count; n++)
  2777. {
  2778. if (tif->tif_flags & TIFF_SWAB)
  2779. TIFFSwabShort((uint16_t *)ma);
  2780. *mb++ = (float)(*ma++);
  2781. }
  2782. }
  2783. break;
  2784. case TIFF_LONG:
  2785. {
  2786. uint32_t *ma;
  2787. float *mb;
  2788. uint32_t n;
  2789. ma = (uint32_t *)origdata;
  2790. mb = data;
  2791. for (n = 0; n < count; n++)
  2792. {
  2793. if (tif->tif_flags & TIFF_SWAB)
  2794. TIFFSwabLong(ma);
  2795. *mb++ = (float)(*ma++);
  2796. }
  2797. }
  2798. break;
  2799. case TIFF_SLONG:
  2800. {
  2801. int32_t *ma;
  2802. float *mb;
  2803. uint32_t n;
  2804. ma = (int32_t *)origdata;
  2805. mb = data;
  2806. for (n = 0; n < count; n++)
  2807. {
  2808. if (tif->tif_flags & TIFF_SWAB)
  2809. TIFFSwabLong((uint32_t *)ma);
  2810. *mb++ = (float)(*ma++);
  2811. }
  2812. }
  2813. break;
  2814. case TIFF_LONG8:
  2815. {
  2816. uint64_t *ma;
  2817. float *mb;
  2818. uint32_t n;
  2819. ma = (uint64_t *)origdata;
  2820. mb = data;
  2821. for (n = 0; n < count; n++)
  2822. {
  2823. if (tif->tif_flags & TIFF_SWAB)
  2824. TIFFSwabLong8(ma);
  2825. *mb++ = (float)(*ma++);
  2826. }
  2827. }
  2828. break;
  2829. case TIFF_SLONG8:
  2830. {
  2831. int64_t *ma;
  2832. float *mb;
  2833. uint32_t n;
  2834. ma = (int64_t *)origdata;
  2835. mb = data;
  2836. for (n = 0; n < count; n++)
  2837. {
  2838. if (tif->tif_flags & TIFF_SWAB)
  2839. TIFFSwabLong8((uint64_t *)ma);
  2840. *mb++ = (float)(*ma++);
  2841. }
  2842. }
  2843. break;
  2844. case TIFF_RATIONAL:
  2845. {
  2846. uint32_t *ma;
  2847. uint32_t maa;
  2848. uint32_t mab;
  2849. float *mb;
  2850. uint32_t n;
  2851. ma = (uint32_t *)origdata;
  2852. mb = data;
  2853. for (n = 0; n < count; n++)
  2854. {
  2855. if (tif->tif_flags & TIFF_SWAB)
  2856. TIFFSwabLong(ma);
  2857. maa = *ma++;
  2858. if (tif->tif_flags & TIFF_SWAB)
  2859. TIFFSwabLong(ma);
  2860. mab = *ma++;
  2861. if (mab == 0)
  2862. *mb++ = 0.0;
  2863. else
  2864. *mb++ = (float)maa / (float)mab;
  2865. }
  2866. }
  2867. break;
  2868. case TIFF_SRATIONAL:
  2869. {
  2870. uint32_t *ma;
  2871. int32_t maa;
  2872. uint32_t mab;
  2873. float *mb;
  2874. uint32_t n;
  2875. ma = (uint32_t *)origdata;
  2876. mb = data;
  2877. for (n = 0; n < count; n++)
  2878. {
  2879. if (tif->tif_flags & TIFF_SWAB)
  2880. TIFFSwabLong(ma);
  2881. maa = *(int32_t *)ma;
  2882. ma++;
  2883. if (tif->tif_flags & TIFF_SWAB)
  2884. TIFFSwabLong(ma);
  2885. mab = *ma++;
  2886. if (mab == 0)
  2887. *mb++ = 0.0;
  2888. else
  2889. *mb++ = (float)maa / (float)mab;
  2890. }
  2891. }
  2892. break;
  2893. case TIFF_DOUBLE:
  2894. {
  2895. double *ma;
  2896. float *mb;
  2897. uint32_t n;
  2898. if (tif->tif_flags & TIFF_SWAB)
  2899. TIFFSwabArrayOfLong8((uint64_t *)origdata, count);
  2900. TIFFCvtIEEEDoubleToNative(tif, count, (double *)origdata);
  2901. ma = (double *)origdata;
  2902. mb = data;
  2903. for (n = 0; n < count; n++)
  2904. {
  2905. double val = *ma++;
  2906. if (val > FLT_MAX)
  2907. val = FLT_MAX;
  2908. else if (val < -FLT_MAX)
  2909. val = -FLT_MAX;
  2910. *mb++ = (float)val;
  2911. }
  2912. }
  2913. break;
  2914. }
  2915. _TIFFfreeExt(tif, origdata);
  2916. *value = data;
  2917. return (TIFFReadDirEntryErrOk);
  2918. }
  2919. static enum TIFFReadDirEntryErr
  2920. TIFFReadDirEntryDoubleArray(TIFF *tif, TIFFDirEntry *direntry, double **value)
  2921. {
  2922. enum TIFFReadDirEntryErr err;
  2923. uint32_t count;
  2924. void *origdata;
  2925. double *data;
  2926. switch (direntry->tdir_type)
  2927. {
  2928. case TIFF_BYTE:
  2929. case TIFF_SBYTE:
  2930. case TIFF_SHORT:
  2931. case TIFF_SSHORT:
  2932. case TIFF_LONG:
  2933. case TIFF_SLONG:
  2934. case TIFF_LONG8:
  2935. case TIFF_SLONG8:
  2936. case TIFF_RATIONAL:
  2937. case TIFF_SRATIONAL:
  2938. case TIFF_FLOAT:
  2939. case TIFF_DOUBLE:
  2940. break;
  2941. default:
  2942. return (TIFFReadDirEntryErrType);
  2943. }
  2944. err = TIFFReadDirEntryArray(tif, direntry, &count, 8, &origdata);
  2945. if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
  2946. {
  2947. *value = 0;
  2948. return (err);
  2949. }
  2950. switch (direntry->tdir_type)
  2951. {
  2952. case TIFF_DOUBLE:
  2953. if (tif->tif_flags & TIFF_SWAB)
  2954. TIFFSwabArrayOfLong8((uint64_t *)origdata, count);
  2955. TIFFCvtIEEEDoubleToNative(tif, count, (double *)origdata);
  2956. *value = (double *)origdata;
  2957. return (TIFFReadDirEntryErrOk);
  2958. }
  2959. data = (double *)_TIFFmallocExt(tif, count * sizeof(double));
  2960. if (data == 0)
  2961. {
  2962. _TIFFfreeExt(tif, origdata);
  2963. return (TIFFReadDirEntryErrAlloc);
  2964. }
  2965. switch (direntry->tdir_type)
  2966. {
  2967. case TIFF_BYTE:
  2968. {
  2969. uint8_t *ma;
  2970. double *mb;
  2971. uint32_t n;
  2972. ma = (uint8_t *)origdata;
  2973. mb = data;
  2974. for (n = 0; n < count; n++)
  2975. *mb++ = (double)(*ma++);
  2976. }
  2977. break;
  2978. case TIFF_SBYTE:
  2979. {
  2980. int8_t *ma;
  2981. double *mb;
  2982. uint32_t n;
  2983. ma = (int8_t *)origdata;
  2984. mb = data;
  2985. for (n = 0; n < count; n++)
  2986. *mb++ = (double)(*ma++);
  2987. }
  2988. break;
  2989. case TIFF_SHORT:
  2990. {
  2991. uint16_t *ma;
  2992. double *mb;
  2993. uint32_t n;
  2994. ma = (uint16_t *)origdata;
  2995. mb = data;
  2996. for (n = 0; n < count; n++)
  2997. {
  2998. if (tif->tif_flags & TIFF_SWAB)
  2999. TIFFSwabShort(ma);
  3000. *mb++ = (double)(*ma++);
  3001. }
  3002. }
  3003. break;
  3004. case TIFF_SSHORT:
  3005. {
  3006. int16_t *ma;
  3007. double *mb;
  3008. uint32_t n;
  3009. ma = (int16_t *)origdata;
  3010. mb = data;
  3011. for (n = 0; n < count; n++)
  3012. {
  3013. if (tif->tif_flags & TIFF_SWAB)
  3014. TIFFSwabShort((uint16_t *)ma);
  3015. *mb++ = (double)(*ma++);
  3016. }
  3017. }
  3018. break;
  3019. case TIFF_LONG:
  3020. {
  3021. uint32_t *ma;
  3022. double *mb;
  3023. uint32_t n;
  3024. ma = (uint32_t *)origdata;
  3025. mb = data;
  3026. for (n = 0; n < count; n++)
  3027. {
  3028. if (tif->tif_flags & TIFF_SWAB)
  3029. TIFFSwabLong(ma);
  3030. *mb++ = (double)(*ma++);
  3031. }
  3032. }
  3033. break;
  3034. case TIFF_SLONG:
  3035. {
  3036. int32_t *ma;
  3037. double *mb;
  3038. uint32_t n;
  3039. ma = (int32_t *)origdata;
  3040. mb = data;
  3041. for (n = 0; n < count; n++)
  3042. {
  3043. if (tif->tif_flags & TIFF_SWAB)
  3044. TIFFSwabLong((uint32_t *)ma);
  3045. *mb++ = (double)(*ma++);
  3046. }
  3047. }
  3048. break;
  3049. case TIFF_LONG8:
  3050. {
  3051. uint64_t *ma;
  3052. double *mb;
  3053. uint32_t n;
  3054. ma = (uint64_t *)origdata;
  3055. mb = data;
  3056. for (n = 0; n < count; n++)
  3057. {
  3058. if (tif->tif_flags & TIFF_SWAB)
  3059. TIFFSwabLong8(ma);
  3060. *mb++ = (double)(*ma++);
  3061. }
  3062. }
  3063. break;
  3064. case TIFF_SLONG8:
  3065. {
  3066. int64_t *ma;
  3067. double *mb;
  3068. uint32_t n;
  3069. ma = (int64_t *)origdata;
  3070. mb = data;
  3071. for (n = 0; n < count; n++)
  3072. {
  3073. if (tif->tif_flags & TIFF_SWAB)
  3074. TIFFSwabLong8((uint64_t *)ma);
  3075. *mb++ = (double)(*ma++);
  3076. }
  3077. }
  3078. break;
  3079. case TIFF_RATIONAL:
  3080. {
  3081. uint32_t *ma;
  3082. uint32_t maa;
  3083. uint32_t mab;
  3084. double *mb;
  3085. uint32_t n;
  3086. ma = (uint32_t *)origdata;
  3087. mb = data;
  3088. for (n = 0; n < count; n++)
  3089. {
  3090. if (tif->tif_flags & TIFF_SWAB)
  3091. TIFFSwabLong(ma);
  3092. maa = *ma++;
  3093. if (tif->tif_flags & TIFF_SWAB)
  3094. TIFFSwabLong(ma);
  3095. mab = *ma++;
  3096. if (mab == 0)
  3097. *mb++ = 0.0;
  3098. else
  3099. *mb++ = (double)maa / (double)mab;
  3100. }
  3101. }
  3102. break;
  3103. case TIFF_SRATIONAL:
  3104. {
  3105. uint32_t *ma;
  3106. int32_t maa;
  3107. uint32_t mab;
  3108. double *mb;
  3109. uint32_t n;
  3110. ma = (uint32_t *)origdata;
  3111. mb = data;
  3112. for (n = 0; n < count; n++)
  3113. {
  3114. if (tif->tif_flags & TIFF_SWAB)
  3115. TIFFSwabLong(ma);
  3116. maa = *(int32_t *)ma;
  3117. ma++;
  3118. if (tif->tif_flags & TIFF_SWAB)
  3119. TIFFSwabLong(ma);
  3120. mab = *ma++;
  3121. if (mab == 0)
  3122. *mb++ = 0.0;
  3123. else
  3124. *mb++ = (double)maa / (double)mab;
  3125. }
  3126. }
  3127. break;
  3128. case TIFF_FLOAT:
  3129. {
  3130. float *ma;
  3131. double *mb;
  3132. uint32_t n;
  3133. if (tif->tif_flags & TIFF_SWAB)
  3134. TIFFSwabArrayOfLong((uint32_t *)origdata, count);
  3135. TIFFCvtIEEEFloatToNative(tif, count, (float *)origdata);
  3136. ma = (float *)origdata;
  3137. mb = data;
  3138. for (n = 0; n < count; n++)
  3139. *mb++ = (double)(*ma++);
  3140. }
  3141. break;
  3142. }
  3143. _TIFFfreeExt(tif, origdata);
  3144. *value = data;
  3145. return (TIFFReadDirEntryErrOk);
  3146. }
  3147. static enum TIFFReadDirEntryErr
  3148. TIFFReadDirEntryIfd8Array(TIFF *tif, TIFFDirEntry *direntry, uint64_t **value)
  3149. {
  3150. enum TIFFReadDirEntryErr err;
  3151. uint32_t count;
  3152. void *origdata;
  3153. uint64_t *data;
  3154. switch (direntry->tdir_type)
  3155. {
  3156. case TIFF_LONG:
  3157. case TIFF_LONG8:
  3158. case TIFF_IFD:
  3159. case TIFF_IFD8:
  3160. break;
  3161. default:
  3162. return (TIFFReadDirEntryErrType);
  3163. }
  3164. err = TIFFReadDirEntryArray(tif, direntry, &count, 8, &origdata);
  3165. if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
  3166. {
  3167. *value = 0;
  3168. return (err);
  3169. }
  3170. switch (direntry->tdir_type)
  3171. {
  3172. case TIFF_LONG8:
  3173. case TIFF_IFD8:
  3174. *value = (uint64_t *)origdata;
  3175. if (tif->tif_flags & TIFF_SWAB)
  3176. TIFFSwabArrayOfLong8(*value, count);
  3177. return (TIFFReadDirEntryErrOk);
  3178. }
  3179. data = (uint64_t *)_TIFFmallocExt(tif, count * 8);
  3180. if (data == 0)
  3181. {
  3182. _TIFFfreeExt(tif, origdata);
  3183. return (TIFFReadDirEntryErrAlloc);
  3184. }
  3185. switch (direntry->tdir_type)
  3186. {
  3187. case TIFF_LONG:
  3188. case TIFF_IFD:
  3189. {
  3190. uint32_t *ma;
  3191. uint64_t *mb;
  3192. uint32_t n;
  3193. ma = (uint32_t *)origdata;
  3194. mb = data;
  3195. for (n = 0; n < count; n++)
  3196. {
  3197. if (tif->tif_flags & TIFF_SWAB)
  3198. TIFFSwabLong(ma);
  3199. *mb++ = (uint64_t)(*ma++);
  3200. }
  3201. }
  3202. break;
  3203. }
  3204. _TIFFfreeExt(tif, origdata);
  3205. *value = data;
  3206. return (TIFFReadDirEntryErrOk);
  3207. }
  3208. static enum TIFFReadDirEntryErr
  3209. TIFFReadDirEntryPersampleShort(TIFF *tif, TIFFDirEntry *direntry,
  3210. uint16_t *value)
  3211. {
  3212. enum TIFFReadDirEntryErr err;
  3213. uint16_t *m;
  3214. uint16_t *na;
  3215. uint16_t nb;
  3216. if (direntry->tdir_count < (uint64_t)tif->tif_dir.td_samplesperpixel)
  3217. return (TIFFReadDirEntryErrCount);
  3218. err = TIFFReadDirEntryShortArray(tif, direntry, &m);
  3219. if (err != TIFFReadDirEntryErrOk || m == NULL)
  3220. return (err);
  3221. na = m;
  3222. nb = tif->tif_dir.td_samplesperpixel;
  3223. *value = *na++;
  3224. nb--;
  3225. while (nb > 0)
  3226. {
  3227. if (*na++ != *value)
  3228. {
  3229. err = TIFFReadDirEntryErrPsdif;
  3230. break;
  3231. }
  3232. nb--;
  3233. }
  3234. _TIFFfreeExt(tif, m);
  3235. return (err);
  3236. }
  3237. static void TIFFReadDirEntryCheckedByte(TIFF *tif, TIFFDirEntry *direntry,
  3238. uint8_t *value)
  3239. {
  3240. (void)tif;
  3241. *value = *(uint8_t *)(&direntry->tdir_offset);
  3242. }
  3243. static void TIFFReadDirEntryCheckedSbyte(TIFF *tif, TIFFDirEntry *direntry,
  3244. int8_t *value)
  3245. {
  3246. (void)tif;
  3247. *value = *(int8_t *)(&direntry->tdir_offset);
  3248. }
  3249. static void TIFFReadDirEntryCheckedShort(TIFF *tif, TIFFDirEntry *direntry,
  3250. uint16_t *value)
  3251. {
  3252. *value = direntry->tdir_offset.toff_short;
  3253. /* *value=*(uint16_t*)(&direntry->tdir_offset); */
  3254. if (tif->tif_flags & TIFF_SWAB)
  3255. TIFFSwabShort(value);
  3256. }
  3257. static void TIFFReadDirEntryCheckedSshort(TIFF *tif, TIFFDirEntry *direntry,
  3258. int16_t *value)
  3259. {
  3260. *value = *(int16_t *)(&direntry->tdir_offset);
  3261. if (tif->tif_flags & TIFF_SWAB)
  3262. TIFFSwabShort((uint16_t *)value);
  3263. }
  3264. static void TIFFReadDirEntryCheckedLong(TIFF *tif, TIFFDirEntry *direntry,
  3265. uint32_t *value)
  3266. {
  3267. *value = *(uint32_t *)(&direntry->tdir_offset);
  3268. if (tif->tif_flags & TIFF_SWAB)
  3269. TIFFSwabLong(value);
  3270. }
  3271. static void TIFFReadDirEntryCheckedSlong(TIFF *tif, TIFFDirEntry *direntry,
  3272. int32_t *value)
  3273. {
  3274. *value = *(int32_t *)(&direntry->tdir_offset);
  3275. if (tif->tif_flags & TIFF_SWAB)
  3276. TIFFSwabLong((uint32_t *)value);
  3277. }
  3278. static enum TIFFReadDirEntryErr
  3279. TIFFReadDirEntryCheckedLong8(TIFF *tif, TIFFDirEntry *direntry, uint64_t *value)
  3280. {
  3281. if (!(tif->tif_flags & TIFF_BIGTIFF))
  3282. {
  3283. enum TIFFReadDirEntryErr err;
  3284. uint32_t offset = direntry->tdir_offset.toff_long;
  3285. if (tif->tif_flags & TIFF_SWAB)
  3286. TIFFSwabLong(&offset);
  3287. err = TIFFReadDirEntryData(tif, offset, 8, value);
  3288. if (err != TIFFReadDirEntryErrOk)
  3289. return (err);
  3290. }
  3291. else
  3292. *value = direntry->tdir_offset.toff_long8;
  3293. if (tif->tif_flags & TIFF_SWAB)
  3294. TIFFSwabLong8(value);
  3295. return (TIFFReadDirEntryErrOk);
  3296. }
  3297. static enum TIFFReadDirEntryErr
  3298. TIFFReadDirEntryCheckedSlong8(TIFF *tif, TIFFDirEntry *direntry, int64_t *value)
  3299. {
  3300. if (!(tif->tif_flags & TIFF_BIGTIFF))
  3301. {
  3302. enum TIFFReadDirEntryErr err;
  3303. uint32_t offset = direntry->tdir_offset.toff_long;
  3304. if (tif->tif_flags & TIFF_SWAB)
  3305. TIFFSwabLong(&offset);
  3306. err = TIFFReadDirEntryData(tif, offset, 8, value);
  3307. if (err != TIFFReadDirEntryErrOk)
  3308. return (err);
  3309. }
  3310. else
  3311. *value = *(int64_t *)(&direntry->tdir_offset);
  3312. if (tif->tif_flags & TIFF_SWAB)
  3313. TIFFSwabLong8((uint64_t *)value);
  3314. return (TIFFReadDirEntryErrOk);
  3315. }
  3316. static enum TIFFReadDirEntryErr
  3317. TIFFReadDirEntryCheckedRational(TIFF *tif, TIFFDirEntry *direntry,
  3318. double *value)
  3319. {
  3320. UInt64Aligned_t m;
  3321. assert(sizeof(double) == 8);
  3322. assert(sizeof(uint64_t) == 8);
  3323. assert(sizeof(uint32_t) == 4);
  3324. if (!(tif->tif_flags & TIFF_BIGTIFF))
  3325. {
  3326. enum TIFFReadDirEntryErr err;
  3327. uint32_t offset = direntry->tdir_offset.toff_long;
  3328. if (tif->tif_flags & TIFF_SWAB)
  3329. TIFFSwabLong(&offset);
  3330. err = TIFFReadDirEntryData(tif, offset, 8, m.i);
  3331. if (err != TIFFReadDirEntryErrOk)
  3332. return (err);
  3333. }
  3334. else
  3335. m.l = direntry->tdir_offset.toff_long8;
  3336. if (tif->tif_flags & TIFF_SWAB)
  3337. TIFFSwabArrayOfLong(m.i, 2);
  3338. /* Not completely sure what we should do when m.i[1]==0, but some */
  3339. /* sanitizers do not like division by 0.0: */
  3340. /* http://bugzilla.maptools.org/show_bug.cgi?id=2644 */
  3341. if (m.i[0] == 0 || m.i[1] == 0)
  3342. *value = 0.0;
  3343. else
  3344. *value = (double)m.i[0] / (double)m.i[1];
  3345. return (TIFFReadDirEntryErrOk);
  3346. }
  3347. static enum TIFFReadDirEntryErr
  3348. TIFFReadDirEntryCheckedSrational(TIFF *tif, TIFFDirEntry *direntry,
  3349. double *value)
  3350. {
  3351. UInt64Aligned_t m;
  3352. assert(sizeof(double) == 8);
  3353. assert(sizeof(uint64_t) == 8);
  3354. assert(sizeof(int32_t) == 4);
  3355. assert(sizeof(uint32_t) == 4);
  3356. if (!(tif->tif_flags & TIFF_BIGTIFF))
  3357. {
  3358. enum TIFFReadDirEntryErr err;
  3359. uint32_t offset = direntry->tdir_offset.toff_long;
  3360. if (tif->tif_flags & TIFF_SWAB)
  3361. TIFFSwabLong(&offset);
  3362. err = TIFFReadDirEntryData(tif, offset, 8, m.i);
  3363. if (err != TIFFReadDirEntryErrOk)
  3364. return (err);
  3365. }
  3366. else
  3367. m.l = direntry->tdir_offset.toff_long8;
  3368. if (tif->tif_flags & TIFF_SWAB)
  3369. TIFFSwabArrayOfLong(m.i, 2);
  3370. /* Not completely sure what we should do when m.i[1]==0, but some */
  3371. /* sanitizers do not like division by 0.0: */
  3372. /* http://bugzilla.maptools.org/show_bug.cgi?id=2644 */
  3373. if ((int32_t)m.i[0] == 0 || m.i[1] == 0)
  3374. *value = 0.0;
  3375. else
  3376. *value = (double)((int32_t)m.i[0]) / (double)m.i[1];
  3377. return (TIFFReadDirEntryErrOk);
  3378. }
  3379. #if 0
  3380. static enum TIFFReadDirEntryErr
  3381. TIFFReadDirEntryCheckedRationalDirect(TIFF *tif, TIFFDirEntry *direntry,
  3382. TIFFRational_t *value)
  3383. { /*--: SetGetRATIONAL_directly:_CustomTag: Read rational (and signed rationals)
  3384. directly --*/
  3385. UInt64Aligned_t m;
  3386. assert(sizeof(double) == 8);
  3387. assert(sizeof(uint64_t) == 8);
  3388. assert(sizeof(uint32_t) == 4);
  3389. if (direntry->tdir_count != 1)
  3390. return (TIFFReadDirEntryErrCount);
  3391. if (direntry->tdir_type != TIFF_RATIONAL &&
  3392. direntry->tdir_type != TIFF_SRATIONAL)
  3393. return (TIFFReadDirEntryErrType);
  3394. if (!(tif->tif_flags & TIFF_BIGTIFF))
  3395. {
  3396. enum TIFFReadDirEntryErr err;
  3397. uint32_t offset = direntry->tdir_offset.toff_long;
  3398. if (tif->tif_flags & TIFF_SWAB)
  3399. TIFFSwabLong(&offset);
  3400. err = TIFFReadDirEntryData(tif, offset, 8, m.i);
  3401. if (err != TIFFReadDirEntryErrOk)
  3402. return (err);
  3403. }
  3404. else
  3405. {
  3406. m.l = direntry->tdir_offset.toff_long8;
  3407. }
  3408. if (tif->tif_flags & TIFF_SWAB)
  3409. TIFFSwabArrayOfLong(m.i, 2);
  3410. value->uNum = m.i[0];
  3411. value->uDenom = m.i[1];
  3412. return (TIFFReadDirEntryErrOk);
  3413. } /*-- TIFFReadDirEntryCheckedRationalDirect() --*/
  3414. #endif
  3415. static void TIFFReadDirEntryCheckedFloat(TIFF *tif, TIFFDirEntry *direntry,
  3416. float *value)
  3417. {
  3418. union
  3419. {
  3420. float f;
  3421. uint32_t i;
  3422. } float_union;
  3423. assert(sizeof(float) == 4);
  3424. assert(sizeof(uint32_t) == 4);
  3425. assert(sizeof(float_union) == 4);
  3426. float_union.i = *(uint32_t *)(&direntry->tdir_offset);
  3427. *value = float_union.f;
  3428. if (tif->tif_flags & TIFF_SWAB)
  3429. TIFFSwabLong((uint32_t *)value);
  3430. }
  3431. static enum TIFFReadDirEntryErr
  3432. TIFFReadDirEntryCheckedDouble(TIFF *tif, TIFFDirEntry *direntry, double *value)
  3433. {
  3434. assert(sizeof(double) == 8);
  3435. assert(sizeof(uint64_t) == 8);
  3436. assert(sizeof(UInt64Aligned_t) == 8);
  3437. if (!(tif->tif_flags & TIFF_BIGTIFF))
  3438. {
  3439. enum TIFFReadDirEntryErr err;
  3440. uint32_t offset = direntry->tdir_offset.toff_long;
  3441. if (tif->tif_flags & TIFF_SWAB)
  3442. TIFFSwabLong(&offset);
  3443. err = TIFFReadDirEntryData(tif, offset, 8, value);
  3444. if (err != TIFFReadDirEntryErrOk)
  3445. return (err);
  3446. }
  3447. else
  3448. {
  3449. UInt64Aligned_t uint64_union;
  3450. uint64_union.l = direntry->tdir_offset.toff_long8;
  3451. *value = uint64_union.d;
  3452. }
  3453. if (tif->tif_flags & TIFF_SWAB)
  3454. TIFFSwabLong8((uint64_t *)value);
  3455. return (TIFFReadDirEntryErrOk);
  3456. }
  3457. static enum TIFFReadDirEntryErr
  3458. TIFFReadDirEntryCheckRangeByteSbyte(int8_t value)
  3459. {
  3460. if (value < 0)
  3461. return (TIFFReadDirEntryErrRange);
  3462. else
  3463. return (TIFFReadDirEntryErrOk);
  3464. }
  3465. static enum TIFFReadDirEntryErr
  3466. TIFFReadDirEntryCheckRangeByteShort(uint16_t value)
  3467. {
  3468. if (value > 0xFF)
  3469. return (TIFFReadDirEntryErrRange);
  3470. else
  3471. return (TIFFReadDirEntryErrOk);
  3472. }
  3473. static enum TIFFReadDirEntryErr
  3474. TIFFReadDirEntryCheckRangeByteSshort(int16_t value)
  3475. {
  3476. if ((value < 0) || (value > 0xFF))
  3477. return (TIFFReadDirEntryErrRange);
  3478. else
  3479. return (TIFFReadDirEntryErrOk);
  3480. }
  3481. static enum TIFFReadDirEntryErr
  3482. TIFFReadDirEntryCheckRangeByteLong(uint32_t value)
  3483. {
  3484. if (value > 0xFF)
  3485. return (TIFFReadDirEntryErrRange);
  3486. else
  3487. return (TIFFReadDirEntryErrOk);
  3488. }
  3489. static enum TIFFReadDirEntryErr
  3490. TIFFReadDirEntryCheckRangeByteSlong(int32_t value)
  3491. {
  3492. if ((value < 0) || (value > 0xFF))
  3493. return (TIFFReadDirEntryErrRange);
  3494. else
  3495. return (TIFFReadDirEntryErrOk);
  3496. }
  3497. static enum TIFFReadDirEntryErr
  3498. TIFFReadDirEntryCheckRangeByteLong8(uint64_t value)
  3499. {
  3500. if (value > 0xFF)
  3501. return (TIFFReadDirEntryErrRange);
  3502. else
  3503. return (TIFFReadDirEntryErrOk);
  3504. }
  3505. static enum TIFFReadDirEntryErr
  3506. TIFFReadDirEntryCheckRangeByteSlong8(int64_t value)
  3507. {
  3508. if ((value < 0) || (value > 0xFF))
  3509. return (TIFFReadDirEntryErrRange);
  3510. else
  3511. return (TIFFReadDirEntryErrOk);
  3512. }
  3513. static enum TIFFReadDirEntryErr
  3514. TIFFReadDirEntryCheckRangeSbyteByte(uint8_t value)
  3515. {
  3516. if (value > 0x7F)
  3517. return (TIFFReadDirEntryErrRange);
  3518. else
  3519. return (TIFFReadDirEntryErrOk);
  3520. }
  3521. static enum TIFFReadDirEntryErr
  3522. TIFFReadDirEntryCheckRangeSbyteShort(uint16_t value)
  3523. {
  3524. if (value > 0x7F)
  3525. return (TIFFReadDirEntryErrRange);
  3526. else
  3527. return (TIFFReadDirEntryErrOk);
  3528. }
  3529. static enum TIFFReadDirEntryErr
  3530. TIFFReadDirEntryCheckRangeSbyteSshort(int16_t value)
  3531. {
  3532. if ((value < -0x80) || (value > 0x7F))
  3533. return (TIFFReadDirEntryErrRange);
  3534. else
  3535. return (TIFFReadDirEntryErrOk);
  3536. }
  3537. static enum TIFFReadDirEntryErr
  3538. TIFFReadDirEntryCheckRangeSbyteLong(uint32_t value)
  3539. {
  3540. if (value > 0x7F)
  3541. return (TIFFReadDirEntryErrRange);
  3542. else
  3543. return (TIFFReadDirEntryErrOk);
  3544. }
  3545. static enum TIFFReadDirEntryErr
  3546. TIFFReadDirEntryCheckRangeSbyteSlong(int32_t value)
  3547. {
  3548. if ((value < -0x80) || (value > 0x7F))
  3549. return (TIFFReadDirEntryErrRange);
  3550. else
  3551. return (TIFFReadDirEntryErrOk);
  3552. }
  3553. static enum TIFFReadDirEntryErr
  3554. TIFFReadDirEntryCheckRangeSbyteLong8(uint64_t value)
  3555. {
  3556. if (value > 0x7F)
  3557. return (TIFFReadDirEntryErrRange);
  3558. else
  3559. return (TIFFReadDirEntryErrOk);
  3560. }
  3561. static enum TIFFReadDirEntryErr
  3562. TIFFReadDirEntryCheckRangeSbyteSlong8(int64_t value)
  3563. {
  3564. if ((value < -0x80) || (value > 0x7F))
  3565. return (TIFFReadDirEntryErrRange);
  3566. else
  3567. return (TIFFReadDirEntryErrOk);
  3568. }
  3569. static enum TIFFReadDirEntryErr
  3570. TIFFReadDirEntryCheckRangeShortSbyte(int8_t value)
  3571. {
  3572. if (value < 0)
  3573. return (TIFFReadDirEntryErrRange);
  3574. else
  3575. return (TIFFReadDirEntryErrOk);
  3576. }
  3577. static enum TIFFReadDirEntryErr
  3578. TIFFReadDirEntryCheckRangeShortSshort(int16_t value)
  3579. {
  3580. if (value < 0)
  3581. return (TIFFReadDirEntryErrRange);
  3582. else
  3583. return (TIFFReadDirEntryErrOk);
  3584. }
  3585. static enum TIFFReadDirEntryErr
  3586. TIFFReadDirEntryCheckRangeShortLong(uint32_t value)
  3587. {
  3588. if (value > 0xFFFF)
  3589. return (TIFFReadDirEntryErrRange);
  3590. else
  3591. return (TIFFReadDirEntryErrOk);
  3592. }
  3593. static enum TIFFReadDirEntryErr
  3594. TIFFReadDirEntryCheckRangeShortSlong(int32_t value)
  3595. {
  3596. if ((value < 0) || (value > 0xFFFF))
  3597. return (TIFFReadDirEntryErrRange);
  3598. else
  3599. return (TIFFReadDirEntryErrOk);
  3600. }
  3601. static enum TIFFReadDirEntryErr
  3602. TIFFReadDirEntryCheckRangeShortLong8(uint64_t value)
  3603. {
  3604. if (value > 0xFFFF)
  3605. return (TIFFReadDirEntryErrRange);
  3606. else
  3607. return (TIFFReadDirEntryErrOk);
  3608. }
  3609. static enum TIFFReadDirEntryErr
  3610. TIFFReadDirEntryCheckRangeShortSlong8(int64_t value)
  3611. {
  3612. if ((value < 0) || (value > 0xFFFF))
  3613. return (TIFFReadDirEntryErrRange);
  3614. else
  3615. return (TIFFReadDirEntryErrOk);
  3616. }
  3617. static enum TIFFReadDirEntryErr
  3618. TIFFReadDirEntryCheckRangeSshortShort(uint16_t value)
  3619. {
  3620. if (value > 0x7FFF)
  3621. return (TIFFReadDirEntryErrRange);
  3622. else
  3623. return (TIFFReadDirEntryErrOk);
  3624. }
  3625. static enum TIFFReadDirEntryErr
  3626. TIFFReadDirEntryCheckRangeSshortLong(uint32_t value)
  3627. {
  3628. if (value > 0x7FFF)
  3629. return (TIFFReadDirEntryErrRange);
  3630. else
  3631. return (TIFFReadDirEntryErrOk);
  3632. }
  3633. static enum TIFFReadDirEntryErr
  3634. TIFFReadDirEntryCheckRangeSshortSlong(int32_t value)
  3635. {
  3636. if ((value < -0x8000) || (value > 0x7FFF))
  3637. return (TIFFReadDirEntryErrRange);
  3638. else
  3639. return (TIFFReadDirEntryErrOk);
  3640. }
  3641. static enum TIFFReadDirEntryErr
  3642. TIFFReadDirEntryCheckRangeSshortLong8(uint64_t value)
  3643. {
  3644. if (value > 0x7FFF)
  3645. return (TIFFReadDirEntryErrRange);
  3646. else
  3647. return (TIFFReadDirEntryErrOk);
  3648. }
  3649. static enum TIFFReadDirEntryErr
  3650. TIFFReadDirEntryCheckRangeSshortSlong8(int64_t value)
  3651. {
  3652. if ((value < -0x8000) || (value > 0x7FFF))
  3653. return (TIFFReadDirEntryErrRange);
  3654. else
  3655. return (TIFFReadDirEntryErrOk);
  3656. }
  3657. static enum TIFFReadDirEntryErr
  3658. TIFFReadDirEntryCheckRangeLongSbyte(int8_t value)
  3659. {
  3660. if (value < 0)
  3661. return (TIFFReadDirEntryErrRange);
  3662. else
  3663. return (TIFFReadDirEntryErrOk);
  3664. }
  3665. static enum TIFFReadDirEntryErr
  3666. TIFFReadDirEntryCheckRangeLongSshort(int16_t value)
  3667. {
  3668. if (value < 0)
  3669. return (TIFFReadDirEntryErrRange);
  3670. else
  3671. return (TIFFReadDirEntryErrOk);
  3672. }
  3673. static enum TIFFReadDirEntryErr
  3674. TIFFReadDirEntryCheckRangeLongSlong(int32_t value)
  3675. {
  3676. if (value < 0)
  3677. return (TIFFReadDirEntryErrRange);
  3678. else
  3679. return (TIFFReadDirEntryErrOk);
  3680. }
  3681. static enum TIFFReadDirEntryErr
  3682. TIFFReadDirEntryCheckRangeLongLong8(uint64_t value)
  3683. {
  3684. if (value > UINT32_MAX)
  3685. return (TIFFReadDirEntryErrRange);
  3686. else
  3687. return (TIFFReadDirEntryErrOk);
  3688. }
  3689. static enum TIFFReadDirEntryErr
  3690. TIFFReadDirEntryCheckRangeLongSlong8(int64_t value)
  3691. {
  3692. if ((value < 0) || (value > (int64_t)UINT32_MAX))
  3693. return (TIFFReadDirEntryErrRange);
  3694. else
  3695. return (TIFFReadDirEntryErrOk);
  3696. }
  3697. static enum TIFFReadDirEntryErr
  3698. TIFFReadDirEntryCheckRangeSlongLong(uint32_t value)
  3699. {
  3700. if (value > 0x7FFFFFFFUL)
  3701. return (TIFFReadDirEntryErrRange);
  3702. else
  3703. return (TIFFReadDirEntryErrOk);
  3704. }
  3705. /* Check that the 8-byte unsigned value can fit in a 4-byte unsigned range */
  3706. static enum TIFFReadDirEntryErr
  3707. TIFFReadDirEntryCheckRangeSlongLong8(uint64_t value)
  3708. {
  3709. if (value > 0x7FFFFFFF)
  3710. return (TIFFReadDirEntryErrRange);
  3711. else
  3712. return (TIFFReadDirEntryErrOk);
  3713. }
  3714. /* Check that the 8-byte signed value can fit in a 4-byte signed range */
  3715. static enum TIFFReadDirEntryErr
  3716. TIFFReadDirEntryCheckRangeSlongSlong8(int64_t value)
  3717. {
  3718. if ((value < 0 - ((int64_t)0x7FFFFFFF + 1)) || (value > 0x7FFFFFFF))
  3719. return (TIFFReadDirEntryErrRange);
  3720. else
  3721. return (TIFFReadDirEntryErrOk);
  3722. }
  3723. static enum TIFFReadDirEntryErr
  3724. TIFFReadDirEntryCheckRangeLong8Sbyte(int8_t value)
  3725. {
  3726. if (value < 0)
  3727. return (TIFFReadDirEntryErrRange);
  3728. else
  3729. return (TIFFReadDirEntryErrOk);
  3730. }
  3731. static enum TIFFReadDirEntryErr
  3732. TIFFReadDirEntryCheckRangeLong8Sshort(int16_t value)
  3733. {
  3734. if (value < 0)
  3735. return (TIFFReadDirEntryErrRange);
  3736. else
  3737. return (TIFFReadDirEntryErrOk);
  3738. }
  3739. static enum TIFFReadDirEntryErr
  3740. TIFFReadDirEntryCheckRangeLong8Slong(int32_t value)
  3741. {
  3742. if (value < 0)
  3743. return (TIFFReadDirEntryErrRange);
  3744. else
  3745. return (TIFFReadDirEntryErrOk);
  3746. }
  3747. static enum TIFFReadDirEntryErr
  3748. TIFFReadDirEntryCheckRangeLong8Slong8(int64_t value)
  3749. {
  3750. if (value < 0)
  3751. return (TIFFReadDirEntryErrRange);
  3752. else
  3753. return (TIFFReadDirEntryErrOk);
  3754. }
  3755. static enum TIFFReadDirEntryErr
  3756. TIFFReadDirEntryCheckRangeSlong8Long8(uint64_t value)
  3757. {
  3758. if (value > INT64_MAX)
  3759. return (TIFFReadDirEntryErrRange);
  3760. else
  3761. return (TIFFReadDirEntryErrOk);
  3762. }
  3763. static enum TIFFReadDirEntryErr TIFFReadDirEntryData(TIFF *tif, uint64_t offset,
  3764. tmsize_t size, void *dest)
  3765. {
  3766. assert(size > 0);
  3767. if (!isMapped(tif))
  3768. {
  3769. if (!SeekOK(tif, offset))
  3770. return (TIFFReadDirEntryErrIo);
  3771. if (!ReadOK(tif, dest, size))
  3772. return (TIFFReadDirEntryErrIo);
  3773. }
  3774. else
  3775. {
  3776. size_t ma, mb;
  3777. ma = (size_t)offset;
  3778. if ((uint64_t)ma != offset || ma > (~(size_t)0) - (size_t)size)
  3779. {
  3780. return TIFFReadDirEntryErrIo;
  3781. }
  3782. mb = ma + size;
  3783. if (mb > (uint64_t)tif->tif_size)
  3784. return (TIFFReadDirEntryErrIo);
  3785. _TIFFmemcpy(dest, tif->tif_base + ma, size);
  3786. }
  3787. return (TIFFReadDirEntryErrOk);
  3788. }
  3789. static void TIFFReadDirEntryOutputErr(TIFF *tif, enum TIFFReadDirEntryErr err,
  3790. const char *module, const char *tagname,
  3791. int recover)
  3792. {
  3793. if (!recover)
  3794. {
  3795. switch (err)
  3796. {
  3797. case TIFFReadDirEntryErrCount:
  3798. TIFFErrorExtR(tif, module, "Incorrect count for \"%s\"",
  3799. tagname);
  3800. break;
  3801. case TIFFReadDirEntryErrType:
  3802. TIFFErrorExtR(tif, module, "Incompatible type for \"%s\"",
  3803. tagname);
  3804. break;
  3805. case TIFFReadDirEntryErrIo:
  3806. TIFFErrorExtR(tif, module, "IO error during reading of \"%s\"",
  3807. tagname);
  3808. break;
  3809. case TIFFReadDirEntryErrRange:
  3810. TIFFErrorExtR(tif, module, "Incorrect value for \"%s\"",
  3811. tagname);
  3812. break;
  3813. case TIFFReadDirEntryErrPsdif:
  3814. TIFFErrorExtR(
  3815. tif, module,
  3816. "Cannot handle different values per sample for \"%s\"",
  3817. tagname);
  3818. break;
  3819. case TIFFReadDirEntryErrSizesan:
  3820. TIFFErrorExtR(tif, module,
  3821. "Sanity check on size of \"%s\" value failed",
  3822. tagname);
  3823. break;
  3824. case TIFFReadDirEntryErrAlloc:
  3825. TIFFErrorExtR(tif, module, "Out of memory reading of \"%s\"",
  3826. tagname);
  3827. break;
  3828. default:
  3829. assert(0); /* we should never get here */
  3830. break;
  3831. }
  3832. }
  3833. else
  3834. {
  3835. switch (err)
  3836. {
  3837. case TIFFReadDirEntryErrCount:
  3838. TIFFWarningExtR(tif, module,
  3839. "Incorrect count for \"%s\"; tag ignored",
  3840. tagname);
  3841. break;
  3842. case TIFFReadDirEntryErrType:
  3843. TIFFWarningExtR(tif, module,
  3844. "Incompatible type for \"%s\"; tag ignored",
  3845. tagname);
  3846. break;
  3847. case TIFFReadDirEntryErrIo:
  3848. TIFFWarningExtR(
  3849. tif, module,
  3850. "IO error during reading of \"%s\"; tag ignored", tagname);
  3851. break;
  3852. case TIFFReadDirEntryErrRange:
  3853. TIFFWarningExtR(tif, module,
  3854. "Incorrect value for \"%s\"; tag ignored",
  3855. tagname);
  3856. break;
  3857. case TIFFReadDirEntryErrPsdif:
  3858. TIFFWarningExtR(tif, module,
  3859. "Cannot handle different values per sample for "
  3860. "\"%s\"; tag ignored",
  3861. tagname);
  3862. break;
  3863. case TIFFReadDirEntryErrSizesan:
  3864. TIFFWarningExtR(
  3865. tif, module,
  3866. "Sanity check on size of \"%s\" value failed; tag ignored",
  3867. tagname);
  3868. break;
  3869. case TIFFReadDirEntryErrAlloc:
  3870. TIFFWarningExtR(tif, module,
  3871. "Out of memory reading of \"%s\"; tag ignored",
  3872. tagname);
  3873. break;
  3874. default:
  3875. assert(0); /* we should never get here */
  3876. break;
  3877. }
  3878. }
  3879. }
  3880. /*
  3881. * Return the maximum number of color channels specified for a given photometric
  3882. * type. 0 is returned if photometric type isn't supported or no default value
  3883. * is defined by the specification.
  3884. */
  3885. static int _TIFFGetMaxColorChannels(uint16_t photometric)
  3886. {
  3887. switch (photometric)
  3888. {
  3889. case PHOTOMETRIC_PALETTE:
  3890. case PHOTOMETRIC_MINISWHITE:
  3891. case PHOTOMETRIC_MINISBLACK:
  3892. return 1;
  3893. case PHOTOMETRIC_YCBCR:
  3894. case PHOTOMETRIC_RGB:
  3895. case PHOTOMETRIC_CIELAB:
  3896. case PHOTOMETRIC_LOGLUV:
  3897. case PHOTOMETRIC_ITULAB:
  3898. case PHOTOMETRIC_ICCLAB:
  3899. return 3;
  3900. case PHOTOMETRIC_SEPARATED:
  3901. case PHOTOMETRIC_MASK:
  3902. return 4;
  3903. case PHOTOMETRIC_LOGL:
  3904. case PHOTOMETRIC_CFA:
  3905. default:
  3906. return 0;
  3907. }
  3908. }
  3909. static int ByteCountLooksBad(TIFF *tif)
  3910. {
  3911. /*
  3912. * Assume we have wrong StripByteCount value (in case
  3913. * of single strip) in following cases:
  3914. * - it is equal to zero along with StripOffset;
  3915. * - it is larger than file itself (in case of uncompressed
  3916. * image);
  3917. * - it is smaller than the size of the bytes per row
  3918. * multiplied on the number of rows. The last case should
  3919. * not be checked in the case of writing new image,
  3920. * because we may do not know the exact strip size
  3921. * until the whole image will be written and directory
  3922. * dumped out.
  3923. */
  3924. uint64_t bytecount = TIFFGetStrileByteCount(tif, 0);
  3925. uint64_t offset = TIFFGetStrileOffset(tif, 0);
  3926. uint64_t filesize;
  3927. if (offset == 0)
  3928. return 0;
  3929. if (bytecount == 0)
  3930. return 1;
  3931. if (tif->tif_dir.td_compression != COMPRESSION_NONE)
  3932. return 0;
  3933. filesize = TIFFGetFileSize(tif);
  3934. if (offset <= filesize && bytecount > filesize - offset)
  3935. return 1;
  3936. if (tif->tif_mode == O_RDONLY)
  3937. {
  3938. uint64_t scanlinesize = TIFFScanlineSize64(tif);
  3939. if (tif->tif_dir.td_imagelength > 0 &&
  3940. scanlinesize > UINT64_MAX / tif->tif_dir.td_imagelength)
  3941. {
  3942. return 1;
  3943. }
  3944. if (bytecount < scanlinesize * tif->tif_dir.td_imagelength)
  3945. return 1;
  3946. }
  3947. return 0;
  3948. }
  3949. /*
  3950. * To evaluate the IFD data size when reading, save the offset and data size of
  3951. * all data that does not fit into the IFD entries themselves.
  3952. */
  3953. static bool EvaluateIFDdatasizeReading(TIFF *tif, TIFFDirEntry *dp)
  3954. {
  3955. const uint64_t data_width = TIFFDataWidth(dp->tdir_type);
  3956. if (data_width != 0 && dp->tdir_count > UINT64_MAX / data_width)
  3957. {
  3958. TIFFErrorExtR(tif, "EvaluateIFDdatasizeReading",
  3959. "Too large IFD data size");
  3960. return false;
  3961. }
  3962. const uint64_t datalength = dp->tdir_count * data_width;
  3963. if (datalength > ((tif->tif_flags & TIFF_BIGTIFF) ? 0x8U : 0x4U))
  3964. {
  3965. if (tif->tif_dir.td_dirdatasize_read > UINT64_MAX - datalength)
  3966. {
  3967. TIFFErrorExtR(tif, "EvaluateIFDdatasizeReading",
  3968. "Too large IFD data size");
  3969. return false;
  3970. }
  3971. tif->tif_dir.td_dirdatasize_read += datalength;
  3972. if (!(tif->tif_flags & TIFF_BIGTIFF))
  3973. {
  3974. /* The offset of TIFFDirEntry are not swapped when read in. That has
  3975. * to be done when used. */
  3976. uint32_t offset = dp->tdir_offset.toff_long;
  3977. if (tif->tif_flags & TIFF_SWAB)
  3978. TIFFSwabLong(&offset);
  3979. tif->tif_dir
  3980. .td_dirdatasize_offsets[tif->tif_dir.td_dirdatasize_Noffsets]
  3981. .offset = (uint64_t)offset;
  3982. }
  3983. else
  3984. {
  3985. tif->tif_dir
  3986. .td_dirdatasize_offsets[tif->tif_dir.td_dirdatasize_Noffsets]
  3987. .offset = dp->tdir_offset.toff_long8;
  3988. if (tif->tif_flags & TIFF_SWAB)
  3989. TIFFSwabLong8(
  3990. &tif->tif_dir
  3991. .td_dirdatasize_offsets[tif->tif_dir
  3992. .td_dirdatasize_Noffsets]
  3993. .offset);
  3994. }
  3995. tif->tif_dir
  3996. .td_dirdatasize_offsets[tif->tif_dir.td_dirdatasize_Noffsets]
  3997. .length = datalength;
  3998. tif->tif_dir.td_dirdatasize_Noffsets++;
  3999. }
  4000. return true;
  4001. }
  4002. /*
  4003. * Compare function for qsort() sorting TIFFEntryOffsetAndLength array entries.
  4004. */
  4005. static int cmpTIFFEntryOffsetAndLength(const void *a, const void *b)
  4006. {
  4007. const TIFFEntryOffsetAndLength *ta = (const TIFFEntryOffsetAndLength *)a;
  4008. const TIFFEntryOffsetAndLength *tb = (const TIFFEntryOffsetAndLength *)b;
  4009. /* Compare offsets */
  4010. if (ta->offset > tb->offset)
  4011. return 1;
  4012. else if (ta->offset < tb->offset)
  4013. return -1;
  4014. else
  4015. return 0;
  4016. }
  4017. /*
  4018. * Determine the IFD data size after reading an IFD from the file that can be
  4019. * overwritten and saving it in tif_dir.td_dirdatasize_read. This data size
  4020. * includes the IFD entries themselves as well as the data that does not fit
  4021. * directly into the IFD entries but is located directly after the IFD entries
  4022. * in the file.
  4023. */
  4024. static void CalcFinalIFDdatasizeReading(TIFF *tif, uint16_t dircount)
  4025. {
  4026. /* IFD data size is only needed if file-writing is enabled.
  4027. * This also avoids the seek() to EOF to determine the file size, which
  4028. * causes the stdin-streaming-friendly mode of libtiff for GDAL to fail. */
  4029. if (tif->tif_mode == O_RDONLY)
  4030. return;
  4031. /* Sort TIFFEntryOffsetAndLength array in ascending order. */
  4032. qsort(tif->tif_dir.td_dirdatasize_offsets,
  4033. tif->tif_dir.td_dirdatasize_Noffsets,
  4034. sizeof(TIFFEntryOffsetAndLength), cmpTIFFEntryOffsetAndLength);
  4035. /* Get offset of end of IFD entry space. */
  4036. uint64_t IFDendoffset;
  4037. if (!(tif->tif_flags & TIFF_BIGTIFF))
  4038. IFDendoffset = tif->tif_diroff + 2 + dircount * 12 + 4;
  4039. else
  4040. IFDendoffset = tif->tif_diroff + 8 + dircount * 20 + 8;
  4041. /* Check which offsets are right behind IFD entries. However, LibTIFF
  4042. * increments the writing address for every external data to an even offset.
  4043. * Thus gaps of 1 byte can occur. */
  4044. uint64_t size = 0;
  4045. uint64_t offset;
  4046. uint32_t i;
  4047. for (i = 0; i < tif->tif_dir.td_dirdatasize_Noffsets; i++)
  4048. {
  4049. offset = tif->tif_dir.td_dirdatasize_offsets[i].offset;
  4050. if (offset == IFDendoffset)
  4051. {
  4052. size += tif->tif_dir.td_dirdatasize_offsets[i].length;
  4053. IFDendoffset += tif->tif_dir.td_dirdatasize_offsets[i].length;
  4054. }
  4055. else if (offset == IFDendoffset + 1)
  4056. {
  4057. /* Add gap byte after previous IFD data set. */
  4058. size += tif->tif_dir.td_dirdatasize_offsets[i].length + 1;
  4059. IFDendoffset += tif->tif_dir.td_dirdatasize_offsets[i].length;
  4060. }
  4061. else
  4062. {
  4063. /* Further data is no more continuously after IFD */
  4064. break;
  4065. }
  4066. }
  4067. /* Check for gap byte of some easy cases. This should cover 90% of cases.
  4068. * Otherwise, IFD will be re-written even it might be safely overwritten. */
  4069. if (tif->tif_nextdiroff != 0)
  4070. {
  4071. if (tif->tif_nextdiroff == IFDendoffset + 1)
  4072. size++;
  4073. }
  4074. else
  4075. {
  4076. /* Check for IFD data ends at EOF. Then IFD can always be safely
  4077. * overwritten. */
  4078. offset = TIFFSeekFile(tif, 0, SEEK_END);
  4079. if (offset == IFDendoffset)
  4080. {
  4081. tif->tif_dir.td_dirdatasize_read = UINT64_MAX;
  4082. return;
  4083. }
  4084. }
  4085. /* Finally, add the size of the IFD tag entries themselves. */
  4086. if (!(tif->tif_flags & TIFF_BIGTIFF))
  4087. tif->tif_dir.td_dirdatasize_read = 2 + dircount * 12 + 4 + size;
  4088. else
  4089. tif->tif_dir.td_dirdatasize_read = 8 + dircount * 20 + 8 + size;
  4090. } /*-- CalcFinalIFDdatasizeReading() --*/
  4091. /*
  4092. * Read the next TIFF directory from a file and convert it to the internal
  4093. * format. We read directories sequentially.
  4094. */
  4095. int TIFFReadDirectory(TIFF *tif)
  4096. {
  4097. static const char module[] = "TIFFReadDirectory";
  4098. TIFFDirEntry *dir;
  4099. uint16_t dircount;
  4100. TIFFDirEntry *dp;
  4101. uint16_t di;
  4102. const TIFFField *fip;
  4103. uint32_t fii = FAILED_FII;
  4104. toff_t nextdiroff;
  4105. int bitspersample_read = FALSE;
  4106. int color_channels;
  4107. if (tif->tif_nextdiroff == 0)
  4108. {
  4109. /* In this special case, tif_diroff needs also to be set to 0.
  4110. * This is behind the last IFD, thus no checking or reading necessary.
  4111. */
  4112. tif->tif_diroff = tif->tif_nextdiroff;
  4113. return 0;
  4114. }
  4115. nextdiroff = tif->tif_nextdiroff;
  4116. /* tif_curdir++ and tif_nextdiroff should only be updated after SUCCESSFUL
  4117. * reading of the directory. Otherwise, invalid IFD offsets could corrupt
  4118. * the IFD list. */
  4119. if (!_TIFFCheckDirNumberAndOffset(tif,
  4120. tif->tif_curdir ==
  4121. TIFF_NON_EXISTENT_DIR_NUMBER
  4122. ? 0
  4123. : tif->tif_curdir + 1,
  4124. nextdiroff))
  4125. {
  4126. return 0; /* bad offset (IFD looping or more than TIFF_MAX_DIR_COUNT
  4127. IFDs) */
  4128. }
  4129. dircount = TIFFFetchDirectory(tif, nextdiroff, &dir, &tif->tif_nextdiroff);
  4130. if (!dircount)
  4131. {
  4132. TIFFErrorExtR(tif, module,
  4133. "Failed to read directory at offset %" PRIu64,
  4134. nextdiroff);
  4135. return 0;
  4136. }
  4137. /* Set global values after a valid directory has been fetched.
  4138. * tif_diroff is already set to nextdiroff in TIFFFetchDirectory() in the
  4139. * beginning. */
  4140. if (tif->tif_curdir == TIFF_NON_EXISTENT_DIR_NUMBER)
  4141. tif->tif_curdir = 0;
  4142. else
  4143. tif->tif_curdir++;
  4144. TIFFReadDirectoryCheckOrder(tif, dir, dircount);
  4145. /*
  4146. * Mark duplicates of any tag to be ignored (bugzilla 1994)
  4147. * to avoid certain pathological problems.
  4148. */
  4149. {
  4150. TIFFDirEntry *ma;
  4151. uint16_t mb;
  4152. for (ma = dir, mb = 0; mb < dircount; ma++, mb++)
  4153. {
  4154. TIFFDirEntry *na;
  4155. uint16_t nb;
  4156. for (na = ma + 1, nb = mb + 1; nb < dircount; na++, nb++)
  4157. {
  4158. if (ma->tdir_tag == na->tdir_tag)
  4159. {
  4160. na->tdir_ignore = TRUE;
  4161. }
  4162. }
  4163. }
  4164. }
  4165. tif->tif_flags &= ~TIFF_BEENWRITING; /* reset before new dir */
  4166. tif->tif_flags &= ~TIFF_BUF4WRITE; /* reset before new dir */
  4167. tif->tif_flags &= ~TIFF_CHOPPEDUPARRAYS;
  4168. /* free any old stuff and reinit */
  4169. (*tif->tif_cleanup)(tif); /* cleanup any previous compression state */
  4170. TIFFFreeDirectory(tif);
  4171. TIFFDefaultDirectory(tif);
  4172. /* After setup a fresh directory indicate that now active IFD is also
  4173. * present on file, even if its entries could not be read successfully
  4174. * below. */
  4175. tif->tif_dir.td_iswrittentofile = TRUE;
  4176. /* Allocate arrays for offset values outside IFD entry for IFD data size
  4177. * checking. Note: Counter are reset within TIFFFreeDirectory(). */
  4178. tif->tif_dir.td_dirdatasize_offsets =
  4179. (TIFFEntryOffsetAndLength *)_TIFFmallocExt(
  4180. tif, dircount * sizeof(TIFFEntryOffsetAndLength));
  4181. if (tif->tif_dir.td_dirdatasize_offsets == NULL)
  4182. {
  4183. TIFFErrorExtR(
  4184. tif, module,
  4185. "Failed to allocate memory for counting IFD data size at reading");
  4186. goto bad;
  4187. }
  4188. /*
  4189. * Electronic Arts writes gray-scale TIFF files
  4190. * without a PlanarConfiguration directory entry.
  4191. * Thus we setup a default value here, even though
  4192. * the TIFF spec says there is no default value.
  4193. * After PlanarConfiguration is preset in TIFFDefaultDirectory()
  4194. * the following setting is not needed, but does not harm either.
  4195. */
  4196. TIFFSetField(tif, TIFFTAG_PLANARCONFIG, PLANARCONFIG_CONTIG);
  4197. /*
  4198. * Setup default value and then make a pass over
  4199. * the fields to check type and tag information,
  4200. * and to extract info required to size data
  4201. * structures. A second pass is made afterwards
  4202. * to read in everything not taken in the first pass.
  4203. * But we must process the Compression tag first
  4204. * in order to merge in codec-private tag definitions (otherwise
  4205. * we may get complaints about unknown tags). However, the
  4206. * Compression tag may be dependent on the SamplesPerPixel
  4207. * tag value because older TIFF specs permitted Compression
  4208. * to be written as a SamplesPerPixel-count tag entry.
  4209. * Thus if we don't first figure out the correct SamplesPerPixel
  4210. * tag value then we may end up ignoring the Compression tag
  4211. * value because it has an incorrect count value (if the
  4212. * true value of SamplesPerPixel is not 1).
  4213. */
  4214. dp =
  4215. TIFFReadDirectoryFindEntry(tif, dir, dircount, TIFFTAG_SAMPLESPERPIXEL);
  4216. if (dp)
  4217. {
  4218. if (!TIFFFetchNormalTag(tif, dp, 0))
  4219. goto bad;
  4220. dp->tdir_ignore = TRUE;
  4221. }
  4222. dp = TIFFReadDirectoryFindEntry(tif, dir, dircount, TIFFTAG_COMPRESSION);
  4223. if (dp)
  4224. {
  4225. /*
  4226. * The 5.0 spec says the Compression tag has one value, while
  4227. * earlier specs say it has one value per sample. Because of
  4228. * this, we accept the tag if one value is supplied with either
  4229. * count.
  4230. */
  4231. uint16_t value;
  4232. enum TIFFReadDirEntryErr err;
  4233. err = TIFFReadDirEntryShort(tif, dp, &value);
  4234. if (err == TIFFReadDirEntryErrCount)
  4235. err = TIFFReadDirEntryPersampleShort(tif, dp, &value);
  4236. if (err != TIFFReadDirEntryErrOk)
  4237. {
  4238. TIFFReadDirEntryOutputErr(tif, err, module, "Compression", 0);
  4239. goto bad;
  4240. }
  4241. if (!TIFFSetField(tif, TIFFTAG_COMPRESSION, value))
  4242. goto bad;
  4243. dp->tdir_ignore = TRUE;
  4244. }
  4245. else
  4246. {
  4247. if (!TIFFSetField(tif, TIFFTAG_COMPRESSION, COMPRESSION_NONE))
  4248. goto bad;
  4249. }
  4250. /*
  4251. * First real pass over the directory.
  4252. */
  4253. for (di = 0, dp = dir; di < dircount; di++, dp++)
  4254. {
  4255. if (!dp->tdir_ignore)
  4256. {
  4257. TIFFReadDirectoryFindFieldInfo(tif, dp->tdir_tag, &fii);
  4258. if (fii == FAILED_FII)
  4259. {
  4260. TIFFWarningExtR(tif, module,
  4261. "Unknown field with tag %" PRIu16 " (0x%" PRIx16
  4262. ") encountered",
  4263. dp->tdir_tag, dp->tdir_tag);
  4264. /* the following knowingly leaks the
  4265. anonymous field structure */
  4266. const TIFFField *fld = _TIFFCreateAnonField(
  4267. tif, dp->tdir_tag, (TIFFDataType)dp->tdir_type);
  4268. if (fld == NULL || !_TIFFMergeFields(tif, fld, 1))
  4269. {
  4270. TIFFWarningExtR(
  4271. tif, module,
  4272. "Registering anonymous field with tag %" PRIu16
  4273. " (0x%" PRIx16 ") failed",
  4274. dp->tdir_tag, dp->tdir_tag);
  4275. dp->tdir_ignore = TRUE;
  4276. }
  4277. else
  4278. {
  4279. TIFFReadDirectoryFindFieldInfo(tif, dp->tdir_tag, &fii);
  4280. assert(fii != FAILED_FII);
  4281. }
  4282. }
  4283. }
  4284. if (!dp->tdir_ignore)
  4285. {
  4286. fip = tif->tif_fields[fii];
  4287. if (fip->field_bit == FIELD_IGNORE)
  4288. dp->tdir_ignore = TRUE;
  4289. else
  4290. {
  4291. switch (dp->tdir_tag)
  4292. {
  4293. case TIFFTAG_STRIPOFFSETS:
  4294. case TIFFTAG_STRIPBYTECOUNTS:
  4295. case TIFFTAG_TILEOFFSETS:
  4296. case TIFFTAG_TILEBYTECOUNTS:
  4297. TIFFSetFieldBit(tif, fip->field_bit);
  4298. break;
  4299. case TIFFTAG_IMAGEWIDTH:
  4300. case TIFFTAG_IMAGELENGTH:
  4301. case TIFFTAG_IMAGEDEPTH:
  4302. case TIFFTAG_TILELENGTH:
  4303. case TIFFTAG_TILEWIDTH:
  4304. case TIFFTAG_TILEDEPTH:
  4305. case TIFFTAG_PLANARCONFIG:
  4306. case TIFFTAG_ROWSPERSTRIP:
  4307. case TIFFTAG_EXTRASAMPLES:
  4308. if (!TIFFFetchNormalTag(tif, dp, 0))
  4309. goto bad;
  4310. dp->tdir_ignore = TRUE;
  4311. break;
  4312. default:
  4313. if (!_TIFFCheckFieldIsValidForCodec(tif, dp->tdir_tag))
  4314. dp->tdir_ignore = TRUE;
  4315. break;
  4316. }
  4317. }
  4318. }
  4319. }
  4320. /*
  4321. * XXX: OJPEG hack.
  4322. * If a) compression is OJPEG, b) planarconfig tag says it's separate,
  4323. * c) strip offsets/bytecounts tag are both present and
  4324. * d) both contain exactly one value, then we consistently find
  4325. * that the buggy implementation of the buggy compression scheme
  4326. * matches contig planarconfig best. So we 'fix-up' the tag here
  4327. */
  4328. if ((tif->tif_dir.td_compression == COMPRESSION_OJPEG) &&
  4329. (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE))
  4330. {
  4331. if (!_TIFFFillStriles(tif))
  4332. goto bad;
  4333. dp = TIFFReadDirectoryFindEntry(tif, dir, dircount,
  4334. TIFFTAG_STRIPOFFSETS);
  4335. if ((dp != 0) && (dp->tdir_count == 1))
  4336. {
  4337. dp = TIFFReadDirectoryFindEntry(tif, dir, dircount,
  4338. TIFFTAG_STRIPBYTECOUNTS);
  4339. if ((dp != 0) && (dp->tdir_count == 1))
  4340. {
  4341. tif->tif_dir.td_planarconfig = PLANARCONFIG_CONTIG;
  4342. TIFFWarningExtR(tif, module,
  4343. "Planarconfig tag value assumed incorrect, "
  4344. "assuming data is contig instead of chunky");
  4345. }
  4346. }
  4347. }
  4348. /*
  4349. * Allocate directory structure and setup defaults.
  4350. */
  4351. if (!TIFFFieldSet(tif, FIELD_IMAGEDIMENSIONS))
  4352. {
  4353. TIFFWarningExtR(tif, module, "TIFF directory is missing required ImageLength field");
  4354. }
  4355. /*
  4356. * Second pass: extract other information.
  4357. */
  4358. for (di = 0, dp = dir; di < dircount; di++, dp++)
  4359. {
  4360. if (!dp->tdir_ignore)
  4361. {
  4362. switch (dp->tdir_tag)
  4363. {
  4364. case TIFFTAG_MINSAMPLEVALUE:
  4365. case TIFFTAG_MAXSAMPLEVALUE:
  4366. case TIFFTAG_BITSPERSAMPLE:
  4367. case TIFFTAG_DATATYPE:
  4368. case TIFFTAG_SAMPLEFORMAT:
  4369. /*
  4370. * The MinSampleValue, MaxSampleValue, BitsPerSample
  4371. * DataType and SampleFormat tags are supposed to be
  4372. * written as one value/sample, but some vendors
  4373. * incorrectly write one value only -- so we accept
  4374. * that as well (yuck). Other vendors write correct
  4375. * value for NumberOfSamples, but incorrect one for
  4376. * BitsPerSample and friends, and we will read this
  4377. * too.
  4378. */
  4379. {
  4380. uint16_t value;
  4381. enum TIFFReadDirEntryErr err;
  4382. err = TIFFReadDirEntryShort(tif, dp, &value);
  4383. if (!EvaluateIFDdatasizeReading(tif, dp))
  4384. goto bad;
  4385. if (err == TIFFReadDirEntryErrCount)
  4386. err =
  4387. TIFFReadDirEntryPersampleShort(tif, dp, &value);
  4388. if (err != TIFFReadDirEntryErrOk)
  4389. {
  4390. fip = TIFFFieldWithTag(tif, dp->tdir_tag);
  4391. TIFFReadDirEntryOutputErr(
  4392. tif, err, module,
  4393. fip ? fip->field_name : "unknown tagname", 0);
  4394. goto bad;
  4395. }
  4396. if (!TIFFSetField(tif, dp->tdir_tag, value))
  4397. goto bad;
  4398. if (dp->tdir_tag == TIFFTAG_BITSPERSAMPLE)
  4399. bitspersample_read = TRUE;
  4400. }
  4401. break;
  4402. case TIFFTAG_SMINSAMPLEVALUE:
  4403. case TIFFTAG_SMAXSAMPLEVALUE:
  4404. {
  4405. double *data = NULL;
  4406. enum TIFFReadDirEntryErr err;
  4407. uint32_t saved_flags;
  4408. int m;
  4409. if (dp->tdir_count !=
  4410. (uint64_t)tif->tif_dir.td_samplesperpixel)
  4411. err = TIFFReadDirEntryErrCount;
  4412. else
  4413. err = TIFFReadDirEntryDoubleArray(tif, dp, &data);
  4414. if (!EvaluateIFDdatasizeReading(tif, dp))
  4415. goto bad;
  4416. if (err != TIFFReadDirEntryErrOk)
  4417. {
  4418. fip = TIFFFieldWithTag(tif, dp->tdir_tag);
  4419. TIFFReadDirEntryOutputErr(
  4420. tif, err, module,
  4421. fip ? fip->field_name : "unknown tagname", 0);
  4422. goto bad;
  4423. }
  4424. saved_flags = tif->tif_flags;
  4425. tif->tif_flags |= TIFF_PERSAMPLE;
  4426. m = TIFFSetField(tif, dp->tdir_tag, data);
  4427. tif->tif_flags = saved_flags;
  4428. _TIFFfreeExt(tif, data);
  4429. if (!m)
  4430. goto bad;
  4431. }
  4432. break;
  4433. case TIFFTAG_STRIPOFFSETS:
  4434. case TIFFTAG_TILEOFFSETS:
  4435. {
  4436. switch (dp->tdir_type)
  4437. {
  4438. case TIFF_SHORT:
  4439. case TIFF_LONG:
  4440. case TIFF_LONG8:
  4441. break;
  4442. default:
  4443. /* Warn except if directory typically created with
  4444. * TIFFDeferStrileArrayWriting() */
  4445. if (!(tif->tif_mode == O_RDWR &&
  4446. dp->tdir_count == 0 && dp->tdir_type == 0 &&
  4447. dp->tdir_offset.toff_long8 == 0))
  4448. {
  4449. fip = TIFFFieldWithTag(tif, dp->tdir_tag);
  4450. TIFFWarningExtR(
  4451. tif, module, "Invalid data type for tag %s",
  4452. fip ? fip->field_name : "unknown tagname");
  4453. }
  4454. break;
  4455. }
  4456. _TIFFmemcpy(&(tif->tif_dir.td_stripoffset_entry), dp,
  4457. sizeof(TIFFDirEntry));
  4458. if (!EvaluateIFDdatasizeReading(tif, dp))
  4459. goto bad;
  4460. }
  4461. break;
  4462. case TIFFTAG_STRIPBYTECOUNTS:
  4463. case TIFFTAG_TILEBYTECOUNTS:
  4464. {
  4465. switch (dp->tdir_type)
  4466. {
  4467. case TIFF_SHORT:
  4468. case TIFF_LONG:
  4469. case TIFF_LONG8:
  4470. break;
  4471. default:
  4472. /* Warn except if directory typically created with
  4473. * TIFFDeferStrileArrayWriting() */
  4474. if (!(tif->tif_mode == O_RDWR &&
  4475. dp->tdir_count == 0 && dp->tdir_type == 0 &&
  4476. dp->tdir_offset.toff_long8 == 0))
  4477. {
  4478. fip = TIFFFieldWithTag(tif, dp->tdir_tag);
  4479. TIFFWarningExtR(
  4480. tif, module, "Invalid data type for tag %s",
  4481. fip ? fip->field_name : "unknown tagname");
  4482. }
  4483. break;
  4484. }
  4485. _TIFFmemcpy(&(tif->tif_dir.td_stripbytecount_entry), dp,
  4486. sizeof(TIFFDirEntry));
  4487. if (!EvaluateIFDdatasizeReading(tif, dp))
  4488. goto bad;
  4489. }
  4490. break;
  4491. case TIFFTAG_COLORMAP:
  4492. case TIFFTAG_TRANSFERFUNCTION:
  4493. {
  4494. enum TIFFReadDirEntryErr err;
  4495. uint32_t countpersample;
  4496. uint32_t countrequired;
  4497. uint32_t incrementpersample;
  4498. uint16_t *value = NULL;
  4499. /* It would be dangerous to instantiate those tag values */
  4500. /* since if td_bitspersample has not yet been read (due to
  4501. */
  4502. /* unordered tags), it could be read afterwards with a */
  4503. /* values greater than the default one (1), which may cause
  4504. */
  4505. /* crashes in user code */
  4506. if (!bitspersample_read)
  4507. {
  4508. fip = TIFFFieldWithTag(tif, dp->tdir_tag);
  4509. TIFFWarningExtR(
  4510. tif, module,
  4511. "Ignoring %s since BitsPerSample tag not found",
  4512. fip ? fip->field_name : "unknown tagname");
  4513. continue;
  4514. }
  4515. /* ColorMap or TransferFunction for high bit */
  4516. /* depths do not make much sense and could be */
  4517. /* used as a denial of service vector */
  4518. if (tif->tif_dir.td_bitspersample > 24)
  4519. {
  4520. fip = TIFFFieldWithTag(tif, dp->tdir_tag);
  4521. TIFFWarningExtR(
  4522. tif, module,
  4523. "Ignoring %s because BitsPerSample=%" PRIu16 ">24",
  4524. fip ? fip->field_name : "unknown tagname",
  4525. tif->tif_dir.td_bitspersample);
  4526. continue;
  4527. }
  4528. countpersample = (1U << tif->tif_dir.td_bitspersample);
  4529. if ((dp->tdir_tag == TIFFTAG_TRANSFERFUNCTION) &&
  4530. (dp->tdir_count == (uint64_t)countpersample))
  4531. {
  4532. countrequired = countpersample;
  4533. incrementpersample = 0;
  4534. }
  4535. else
  4536. {
  4537. countrequired = 3 * countpersample;
  4538. incrementpersample = countpersample;
  4539. }
  4540. if (dp->tdir_count != (uint64_t)countrequired)
  4541. err = TIFFReadDirEntryErrCount;
  4542. else
  4543. err = TIFFReadDirEntryShortArray(tif, dp, &value);
  4544. if (!EvaluateIFDdatasizeReading(tif, dp))
  4545. goto bad;
  4546. if (err != TIFFReadDirEntryErrOk)
  4547. {
  4548. fip = TIFFFieldWithTag(tif, dp->tdir_tag);
  4549. TIFFReadDirEntryOutputErr(
  4550. tif, err, module,
  4551. fip ? fip->field_name : "unknown tagname", 1);
  4552. }
  4553. else
  4554. {
  4555. TIFFSetField(tif, dp->tdir_tag, value,
  4556. value + incrementpersample,
  4557. value + 2 * incrementpersample);
  4558. _TIFFfreeExt(tif, value);
  4559. }
  4560. }
  4561. break;
  4562. /* BEGIN REV 4.0 COMPATIBILITY */
  4563. case TIFFTAG_OSUBFILETYPE:
  4564. {
  4565. uint16_t valueo;
  4566. uint32_t value;
  4567. if (TIFFReadDirEntryShort(tif, dp, &valueo) ==
  4568. TIFFReadDirEntryErrOk)
  4569. {
  4570. switch (valueo)
  4571. {
  4572. case OFILETYPE_REDUCEDIMAGE:
  4573. value = FILETYPE_REDUCEDIMAGE;
  4574. break;
  4575. case OFILETYPE_PAGE:
  4576. value = FILETYPE_PAGE;
  4577. break;
  4578. default:
  4579. value = 0;
  4580. break;
  4581. }
  4582. if (value != 0)
  4583. TIFFSetField(tif, TIFFTAG_SUBFILETYPE, value);
  4584. }
  4585. }
  4586. break;
  4587. /* END REV 4.0 COMPATIBILITY */
  4588. #if 0
  4589. case TIFFTAG_EP_BATTERYLEVEL:
  4590. /* TIFFTAG_EP_BATTERYLEVEL can be RATIONAL or ASCII.
  4591. * LibTiff defines it as ASCII and converts RATIONAL to an
  4592. * ASCII string. */
  4593. switch (dp->tdir_type)
  4594. {
  4595. case TIFF_RATIONAL:
  4596. {
  4597. /* Read rational and convert to ASCII*/
  4598. enum TIFFReadDirEntryErr err;
  4599. TIFFRational_t rValue;
  4600. err = TIFFReadDirEntryCheckedRationalDirect(
  4601. tif, dp, &rValue);
  4602. if (err != TIFFReadDirEntryErrOk)
  4603. {
  4604. fip = TIFFFieldWithTag(tif, dp->tdir_tag);
  4605. TIFFReadDirEntryOutputErr(
  4606. tif, err, module,
  4607. fip ? fip->field_name : "unknown tagname",
  4608. 1);
  4609. }
  4610. else
  4611. {
  4612. char szAux[32];
  4613. snprintf(szAux, sizeof(szAux) - 1, "%d/%d",
  4614. rValue.uNum, rValue.uDenom);
  4615. TIFFSetField(tif, dp->tdir_tag, szAux);
  4616. }
  4617. }
  4618. break;
  4619. case TIFF_ASCII:
  4620. (void)TIFFFetchNormalTag(tif, dp, TRUE);
  4621. break;
  4622. default:
  4623. fip = TIFFFieldWithTag(tif, dp->tdir_tag);
  4624. TIFFWarningExtR(tif, module,
  4625. "Invalid data type for tag %s. "
  4626. "ASCII or RATIONAL expected",
  4627. fip ? fip->field_name
  4628. : "unknown tagname");
  4629. break;
  4630. }
  4631. break;
  4632. #endif
  4633. default:
  4634. (void)TIFFFetchNormalTag(tif, dp, TRUE);
  4635. break;
  4636. } /* -- switch (dp->tdir_tag) -- */
  4637. } /* -- if (!dp->tdir_ignore) */
  4638. } /* -- for-loop -- */
  4639. /* Evaluate final IFD data size. */
  4640. CalcFinalIFDdatasizeReading(tif, dircount);
  4641. /*
  4642. * OJPEG hack:
  4643. * - If a) compression is OJPEG, and b) photometric tag is missing,
  4644. * then we consistently find that photometric should be YCbCr
  4645. * - If a) compression is OJPEG, and b) photometric tag says it's RGB,
  4646. * then we consistently find that the buggy implementation of the
  4647. * buggy compression scheme matches photometric YCbCr instead.
  4648. * - If a) compression is OJPEG, and b) bitspersample tag is missing,
  4649. * then we consistently find bitspersample should be 8.
  4650. * - If a) compression is OJPEG, b) samplesperpixel tag is missing,
  4651. * and c) photometric is RGB or YCbCr, then we consistently find
  4652. * samplesperpixel should be 3
  4653. * - If a) compression is OJPEG, b) samplesperpixel tag is missing,
  4654. * and c) photometric is MINISWHITE or MINISBLACK, then we consistently
  4655. * find samplesperpixel should be 3
  4656. */
  4657. if (tif->tif_dir.td_compression == COMPRESSION_OJPEG)
  4658. {
  4659. if (!TIFFFieldSet(tif, FIELD_PHOTOMETRIC))
  4660. {
  4661. TIFFWarningExtR(
  4662. tif, module,
  4663. "Photometric tag is missing, assuming data is YCbCr");
  4664. if (!TIFFSetField(tif, TIFFTAG_PHOTOMETRIC, PHOTOMETRIC_YCBCR))
  4665. goto bad;
  4666. }
  4667. else if (tif->tif_dir.td_photometric == PHOTOMETRIC_RGB)
  4668. {
  4669. tif->tif_dir.td_photometric = PHOTOMETRIC_YCBCR;
  4670. TIFFWarningExtR(tif, module,
  4671. "Photometric tag value assumed incorrect, "
  4672. "assuming data is YCbCr instead of RGB");
  4673. }
  4674. if (!TIFFFieldSet(tif, FIELD_BITSPERSAMPLE))
  4675. {
  4676. TIFFWarningExtR(
  4677. tif, module,
  4678. "BitsPerSample tag is missing, assuming 8 bits per sample");
  4679. if (!TIFFSetField(tif, TIFFTAG_BITSPERSAMPLE, 8))
  4680. goto bad;
  4681. }
  4682. if (!TIFFFieldSet(tif, FIELD_SAMPLESPERPIXEL))
  4683. {
  4684. if (tif->tif_dir.td_photometric == PHOTOMETRIC_RGB)
  4685. {
  4686. TIFFWarningExtR(tif, module,
  4687. "SamplesPerPixel tag is missing, "
  4688. "assuming correct SamplesPerPixel value is 3");
  4689. if (!TIFFSetField(tif, TIFFTAG_SAMPLESPERPIXEL, 3))
  4690. goto bad;
  4691. }
  4692. if (tif->tif_dir.td_photometric == PHOTOMETRIC_YCBCR)
  4693. {
  4694. TIFFWarningExtR(tif, module,
  4695. "SamplesPerPixel tag is missing, "
  4696. "applying correct SamplesPerPixel value of 3");
  4697. if (!TIFFSetField(tif, TIFFTAG_SAMPLESPERPIXEL, 3))
  4698. goto bad;
  4699. }
  4700. else if ((tif->tif_dir.td_photometric == PHOTOMETRIC_MINISWHITE) ||
  4701. (tif->tif_dir.td_photometric == PHOTOMETRIC_MINISBLACK))
  4702. {
  4703. /*
  4704. * SamplesPerPixel tag is missing, but is not required
  4705. * by spec. Assume correct SamplesPerPixel value of 1.
  4706. */
  4707. if (!TIFFSetField(tif, TIFFTAG_SAMPLESPERPIXEL, 1))
  4708. goto bad;
  4709. }
  4710. }
  4711. }
  4712. /*
  4713. * Setup appropriate structures (by strip or by tile)
  4714. * We do that only after the above OJPEG hack which alters SamplesPerPixel
  4715. * and thus influences the number of strips in the separate planarconfig.
  4716. */
  4717. if (!TIFFFieldSet(tif, FIELD_TILEDIMENSIONS))
  4718. {
  4719. tif->tif_dir.td_nstrips = TIFFNumberOfStrips(tif);
  4720. tif->tif_dir.td_tilewidth = tif->tif_dir.td_imagewidth;
  4721. tif->tif_dir.td_tilelength = tif->tif_dir.td_rowsperstrip;
  4722. tif->tif_dir.td_tiledepth = tif->tif_dir.td_imagedepth;
  4723. tif->tif_flags &= ~TIFF_ISTILED;
  4724. }
  4725. else
  4726. {
  4727. tif->tif_dir.td_nstrips = TIFFNumberOfTiles(tif);
  4728. tif->tif_flags |= TIFF_ISTILED;
  4729. }
  4730. if (!tif->tif_dir.td_nstrips)
  4731. {
  4732. TIFFErrorExtR(tif, module, "Cannot handle zero number of %s",
  4733. isTiled(tif) ? "tiles" : "strips");
  4734. goto bad;
  4735. }
  4736. tif->tif_dir.td_stripsperimage = tif->tif_dir.td_nstrips;
  4737. if (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE)
  4738. tif->tif_dir.td_stripsperimage /= tif->tif_dir.td_samplesperpixel;
  4739. if (!TIFFFieldSet(tif, FIELD_STRIPOFFSETS))
  4740. {
  4741. #ifdef OJPEG_SUPPORT
  4742. if ((tif->tif_dir.td_compression == COMPRESSION_OJPEG) &&
  4743. (isTiled(tif) == 0) && (tif->tif_dir.td_nstrips == 1))
  4744. {
  4745. /*
  4746. * XXX: OJPEG hack.
  4747. * If a) compression is OJPEG, b) it's not a tiled TIFF,
  4748. * and c) the number of strips is 1,
  4749. * then we tolerate the absence of stripoffsets tag,
  4750. * because, presumably, all required data is in the
  4751. * JpegInterchangeFormat stream.
  4752. */
  4753. TIFFSetFieldBit(tif, FIELD_STRIPOFFSETS);
  4754. }
  4755. else
  4756. #endif
  4757. {
  4758. MissingRequired(tif, isTiled(tif) ? "TileOffsets" : "StripOffsets");
  4759. goto bad;
  4760. }
  4761. }
  4762. if (tif->tif_mode == O_RDWR &&
  4763. tif->tif_dir.td_stripoffset_entry.tdir_tag != 0 &&
  4764. tif->tif_dir.td_stripoffset_entry.tdir_count == 0 &&
  4765. tif->tif_dir.td_stripoffset_entry.tdir_type == 0 &&
  4766. tif->tif_dir.td_stripoffset_entry.tdir_offset.toff_long8 == 0 &&
  4767. tif->tif_dir.td_stripbytecount_entry.tdir_tag != 0 &&
  4768. tif->tif_dir.td_stripbytecount_entry.tdir_count == 0 &&
  4769. tif->tif_dir.td_stripbytecount_entry.tdir_type == 0 &&
  4770. tif->tif_dir.td_stripbytecount_entry.tdir_offset.toff_long8 == 0)
  4771. {
  4772. /* Directory typically created with TIFFDeferStrileArrayWriting() */
  4773. TIFFSetupStrips(tif);
  4774. }
  4775. else if (!(tif->tif_flags & TIFF_DEFERSTRILELOAD))
  4776. {
  4777. if (tif->tif_dir.td_stripoffset_entry.tdir_tag != 0)
  4778. {
  4779. if (!TIFFFetchStripThing(tif, &(tif->tif_dir.td_stripoffset_entry),
  4780. tif->tif_dir.td_nstrips,
  4781. &tif->tif_dir.td_stripoffset_p))
  4782. {
  4783. goto bad;
  4784. }
  4785. }
  4786. if (tif->tif_dir.td_stripbytecount_entry.tdir_tag != 0)
  4787. {
  4788. if (!TIFFFetchStripThing(
  4789. tif, &(tif->tif_dir.td_stripbytecount_entry),
  4790. tif->tif_dir.td_nstrips, &tif->tif_dir.td_stripbytecount_p))
  4791. {
  4792. goto bad;
  4793. }
  4794. }
  4795. }
  4796. /*
  4797. * Make sure all non-color channels are extrasamples.
  4798. * If it's not the case, define them as such.
  4799. */
  4800. color_channels = _TIFFGetMaxColorChannels(tif->tif_dir.td_photometric);
  4801. if (color_channels &&
  4802. tif->tif_dir.td_samplesperpixel - tif->tif_dir.td_extrasamples >
  4803. color_channels)
  4804. {
  4805. uint16_t old_extrasamples;
  4806. uint16_t *new_sampleinfo;
  4807. TIFFWarningExtR(
  4808. tif, module,
  4809. "Sum of Photometric type-related "
  4810. "color channels and ExtraSamples doesn't match SamplesPerPixel. "
  4811. "Defining non-color channels as ExtraSamples.");
  4812. old_extrasamples = tif->tif_dir.td_extrasamples;
  4813. tif->tif_dir.td_extrasamples =
  4814. (uint16_t)(tif->tif_dir.td_samplesperpixel - color_channels);
  4815. // sampleinfo should contain information relative to these new extra
  4816. // samples
  4817. new_sampleinfo = (uint16_t *)_TIFFcallocExt(
  4818. tif, tif->tif_dir.td_extrasamples, sizeof(uint16_t));
  4819. if (!new_sampleinfo)
  4820. {
  4821. TIFFErrorExtR(tif, module,
  4822. "Failed to allocate memory for "
  4823. "temporary new sampleinfo array "
  4824. "(%" PRIu16 " 16 bit elements)",
  4825. tif->tif_dir.td_extrasamples);
  4826. goto bad;
  4827. }
  4828. if (old_extrasamples > 0)
  4829. memcpy(new_sampleinfo, tif->tif_dir.td_sampleinfo,
  4830. old_extrasamples * sizeof(uint16_t));
  4831. _TIFFsetShortArrayExt(tif, &tif->tif_dir.td_sampleinfo, new_sampleinfo,
  4832. tif->tif_dir.td_extrasamples);
  4833. _TIFFfreeExt(tif, new_sampleinfo);
  4834. }
  4835. /*
  4836. * Verify Palette image has a Colormap.
  4837. */
  4838. if (tif->tif_dir.td_photometric == PHOTOMETRIC_PALETTE &&
  4839. !TIFFFieldSet(tif, FIELD_COLORMAP))
  4840. {
  4841. if (tif->tif_dir.td_bitspersample >= 8 &&
  4842. tif->tif_dir.td_samplesperpixel == 3)
  4843. tif->tif_dir.td_photometric = PHOTOMETRIC_RGB;
  4844. else if (tif->tif_dir.td_bitspersample >= 8)
  4845. tif->tif_dir.td_photometric = PHOTOMETRIC_MINISBLACK;
  4846. else
  4847. {
  4848. MissingRequired(tif, "Colormap");
  4849. goto bad;
  4850. }
  4851. }
  4852. /*
  4853. * OJPEG hack:
  4854. * We do no further messing with strip/tile offsets/bytecounts in OJPEG
  4855. * TIFFs
  4856. */
  4857. if (tif->tif_dir.td_compression != COMPRESSION_OJPEG)
  4858. {
  4859. /*
  4860. * Attempt to deal with a missing StripByteCounts tag.
  4861. */
  4862. if (!TIFFFieldSet(tif, FIELD_STRIPBYTECOUNTS))
  4863. {
  4864. /*
  4865. * Some manufacturers violate the spec by not giving
  4866. * the size of the strips. In this case, assume there
  4867. * is one uncompressed strip of data.
  4868. */
  4869. if ((tif->tif_dir.td_planarconfig == PLANARCONFIG_CONTIG &&
  4870. tif->tif_dir.td_nstrips > 1) ||
  4871. (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE &&
  4872. tif->tif_dir.td_nstrips !=
  4873. (uint32_t)tif->tif_dir.td_samplesperpixel))
  4874. {
  4875. MissingRequired(tif, "StripByteCounts");
  4876. goto bad;
  4877. }
  4878. TIFFWarningExtR(
  4879. tif, module,
  4880. "TIFF directory is missing required "
  4881. "\"StripByteCounts\" field, calculating from imagelength");
  4882. if (EstimateStripByteCounts(tif, dir, dircount) < 0)
  4883. goto bad;
  4884. }
  4885. else if (tif->tif_dir.td_nstrips == 1 &&
  4886. !(tif->tif_flags & TIFF_ISTILED) && ByteCountLooksBad(tif))
  4887. {
  4888. /*
  4889. * XXX: Plexus (and others) sometimes give a value of
  4890. * zero for a tag when they don't know what the
  4891. * correct value is! Try and handle the simple case
  4892. * of estimating the size of a one strip image.
  4893. */
  4894. TIFFWarningExtR(tif, module,
  4895. "Bogus \"StripByteCounts\" field, ignoring and "
  4896. "calculating from imagelength");
  4897. if (EstimateStripByteCounts(tif, dir, dircount) < 0)
  4898. goto bad;
  4899. }
  4900. else if (!(tif->tif_flags & TIFF_DEFERSTRILELOAD) &&
  4901. tif->tif_dir.td_planarconfig == PLANARCONFIG_CONTIG &&
  4902. tif->tif_dir.td_nstrips > 2 &&
  4903. tif->tif_dir.td_compression == COMPRESSION_NONE &&
  4904. TIFFGetStrileByteCount(tif, 0) !=
  4905. TIFFGetStrileByteCount(tif, 1) &&
  4906. TIFFGetStrileByteCount(tif, 0) != 0 &&
  4907. TIFFGetStrileByteCount(tif, 1) != 0)
  4908. {
  4909. /*
  4910. * XXX: Some vendors fill StripByteCount array with
  4911. * absolutely wrong values (it can be equal to
  4912. * StripOffset array, for example). Catch this case
  4913. * here.
  4914. *
  4915. * We avoid this check if deferring strile loading
  4916. * as it would always force us to load the strip/tile
  4917. * information.
  4918. */
  4919. TIFFWarningExtR(tif, module,
  4920. "Wrong \"StripByteCounts\" field, ignoring and "
  4921. "calculating from imagelength");
  4922. if (EstimateStripByteCounts(tif, dir, dircount) < 0)
  4923. goto bad;
  4924. }
  4925. }
  4926. if (dir)
  4927. {
  4928. _TIFFfreeExt(tif, dir);
  4929. dir = NULL;
  4930. }
  4931. if (!TIFFFieldSet(tif, FIELD_MAXSAMPLEVALUE))
  4932. {
  4933. if (tif->tif_dir.td_bitspersample >= 16)
  4934. tif->tif_dir.td_maxsamplevalue = 0xFFFF;
  4935. else
  4936. tif->tif_dir.td_maxsamplevalue =
  4937. (uint16_t)((1L << tif->tif_dir.td_bitspersample) - 1);
  4938. }
  4939. #ifdef STRIPBYTECOUNTSORTED_UNUSED
  4940. /*
  4941. * XXX: We can optimize checking for the strip bounds using the sorted
  4942. * bytecounts array. See also comments for TIFFAppendToStrip()
  4943. * function in tif_write.c.
  4944. */
  4945. if (!(tif->tif_flags & TIFF_DEFERSTRILELOAD) && tif->tif_dir.td_nstrips > 1)
  4946. {
  4947. uint32_t strip;
  4948. tif->tif_dir.td_stripbytecountsorted = 1;
  4949. for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++)
  4950. {
  4951. if (TIFFGetStrileOffset(tif, strip - 1) >
  4952. TIFFGetStrileOffset(tif, strip))
  4953. {
  4954. tif->tif_dir.td_stripbytecountsorted = 0;
  4955. break;
  4956. }
  4957. }
  4958. }
  4959. #endif
  4960. /*
  4961. * An opportunity for compression mode dependent tag fixup
  4962. */
  4963. (*tif->tif_fixuptags)(tif);
  4964. /*
  4965. * Some manufacturers make life difficult by writing
  4966. * large amounts of uncompressed data as a single strip.
  4967. * This is contrary to the recommendations of the spec.
  4968. * The following makes an attempt at breaking such images
  4969. * into strips closer to the recommended 8k bytes. A
  4970. * side effect, however, is that the RowsPerStrip tag
  4971. * value may be changed.
  4972. */
  4973. if ((tif->tif_dir.td_planarconfig == PLANARCONFIG_CONTIG) &&
  4974. (tif->tif_dir.td_nstrips == 1) &&
  4975. (tif->tif_dir.td_compression == COMPRESSION_NONE) &&
  4976. ((tif->tif_flags & (TIFF_STRIPCHOP | TIFF_ISTILED)) == TIFF_STRIPCHOP))
  4977. {
  4978. ChopUpSingleUncompressedStrip(tif);
  4979. }
  4980. /* There are also uncompressed striped files with strips larger than */
  4981. /* 2 GB, which make them unfriendly with a lot of code. If possible, */
  4982. /* try to expose smaller "virtual" strips. */
  4983. if (tif->tif_dir.td_planarconfig == PLANARCONFIG_CONTIG &&
  4984. tif->tif_dir.td_compression == COMPRESSION_NONE &&
  4985. (tif->tif_flags & (TIFF_STRIPCHOP | TIFF_ISTILED)) == TIFF_STRIPCHOP &&
  4986. TIFFStripSize64(tif) > 0x7FFFFFFFUL)
  4987. {
  4988. TryChopUpUncompressedBigTiff(tif);
  4989. }
  4990. /*
  4991. * Clear the dirty directory flag.
  4992. */
  4993. tif->tif_flags &= ~TIFF_DIRTYDIRECT;
  4994. tif->tif_flags &= ~TIFF_DIRTYSTRIP;
  4995. /*
  4996. * Reinitialize i/o since we are starting on a new directory.
  4997. */
  4998. tif->tif_row = (uint32_t)-1;
  4999. tif->tif_curstrip = (uint32_t)-1;
  5000. tif->tif_col = (uint32_t)-1;
  5001. tif->tif_curtile = (uint32_t)-1;
  5002. tif->tif_tilesize = (tmsize_t)-1;
  5003. tif->tif_scanlinesize = TIFFScanlineSize(tif);
  5004. if (!tif->tif_scanlinesize)
  5005. {
  5006. TIFFWarningExtR(tif, module, "Cannot handle zero scanline size");
  5007. }
  5008. if (isTiled(tif))
  5009. {
  5010. tif->tif_tilesize = TIFFTileSize(tif);
  5011. if (!tif->tif_tilesize)
  5012. {
  5013. TIFFWarningExtR(tif, module, "Cannot handle zero tile size");
  5014. }
  5015. }
  5016. else
  5017. {
  5018. if (!TIFFStripSize(tif))
  5019. {
  5020. TIFFWarningExt(tif, module, "Cannot handle zero strip size");
  5021. }
  5022. }
  5023. return (1);
  5024. bad:
  5025. if (dir)
  5026. _TIFFfreeExt(tif, dir);
  5027. return (0);
  5028. } /*-- TIFFReadDirectory() --*/
  5029. static void TIFFReadDirectoryCheckOrder(TIFF *tif, TIFFDirEntry *dir,
  5030. uint16_t dircount)
  5031. {
  5032. static const char module[] = "TIFFReadDirectoryCheckOrder";
  5033. uint32_t m;
  5034. uint16_t n;
  5035. TIFFDirEntry *o;
  5036. m = 0;
  5037. for (n = 0, o = dir; n < dircount; n++, o++)
  5038. {
  5039. if (o->tdir_tag < m)
  5040. {
  5041. TIFFWarningExtR(tif, module,
  5042. "Invalid TIFF directory; tags are not sorted in "
  5043. "ascending order");
  5044. break;
  5045. }
  5046. m = o->tdir_tag + 1;
  5047. }
  5048. }
  5049. static TIFFDirEntry *TIFFReadDirectoryFindEntry(TIFF *tif, TIFFDirEntry *dir,
  5050. uint16_t dircount,
  5051. uint16_t tagid)
  5052. {
  5053. TIFFDirEntry *m;
  5054. uint16_t n;
  5055. (void)tif;
  5056. for (m = dir, n = 0; n < dircount; m++, n++)
  5057. {
  5058. if (m->tdir_tag == tagid)
  5059. return (m);
  5060. }
  5061. return (0);
  5062. }
  5063. static void TIFFReadDirectoryFindFieldInfo(TIFF *tif, uint16_t tagid,
  5064. uint32_t *fii)
  5065. {
  5066. int32_t ma, mb, mc;
  5067. ma = -1;
  5068. mc = (int32_t)tif->tif_nfields;
  5069. while (1)
  5070. {
  5071. if (ma + 1 == mc)
  5072. {
  5073. *fii = FAILED_FII;
  5074. return;
  5075. }
  5076. mb = (ma + mc) / 2;
  5077. if (tif->tif_fields[mb]->field_tag == (uint32_t)tagid)
  5078. break;
  5079. if (tif->tif_fields[mb]->field_tag < (uint32_t)tagid)
  5080. ma = mb;
  5081. else
  5082. mc = mb;
  5083. }
  5084. while (1)
  5085. {
  5086. if (mb == 0)
  5087. break;
  5088. if (tif->tif_fields[mb - 1]->field_tag != (uint32_t)tagid)
  5089. break;
  5090. mb--;
  5091. }
  5092. *fii = mb;
  5093. }
  5094. /*
  5095. * Read custom directory from the arbitrary offset.
  5096. * The code is very similar to TIFFReadDirectory().
  5097. */
  5098. int TIFFReadCustomDirectory(TIFF *tif, toff_t diroff,
  5099. const TIFFFieldArray *infoarray)
  5100. {
  5101. static const char module[] = "TIFFReadCustomDirectory";
  5102. TIFFDirEntry *dir;
  5103. uint16_t dircount;
  5104. TIFFDirEntry *dp;
  5105. uint16_t di;
  5106. const TIFFField *fip;
  5107. uint32_t fii;
  5108. dircount = TIFFFetchDirectory(tif, diroff, &dir, NULL);
  5109. if (!dircount)
  5110. {
  5111. TIFFWarningExtR(tif, module,
  5112. "Failed to read custom directory at offset %" PRIu64,
  5113. diroff);
  5114. return 0;
  5115. }
  5116. TIFFReadDirectoryCheckOrder(tif, dir, dircount);
  5117. /*
  5118. * Mark duplicates of any tag to be ignored (bugzilla 1994)
  5119. * to avoid certain pathological problems.
  5120. */
  5121. {
  5122. TIFFDirEntry *ma;
  5123. uint16_t mb;
  5124. for (ma = dir, mb = 0; mb < dircount; ma++, mb++)
  5125. {
  5126. TIFFDirEntry *na;
  5127. uint16_t nb;
  5128. for (na = ma + 1, nb = mb + 1; nb < dircount; na++, nb++)
  5129. {
  5130. if (ma->tdir_tag == na->tdir_tag)
  5131. {
  5132. na->tdir_ignore = TRUE;
  5133. }
  5134. }
  5135. }
  5136. }
  5137. /* Free any old stuff and reinit. */
  5138. (*tif->tif_cleanup)(tif); /* cleanup any previous compression state */
  5139. TIFFFreeDirectory(tif);
  5140. /* Even if custom directories do not need the default settings of a standard
  5141. * IFD, the pointer to the TIFFSetField() and TIFFGetField() (i.e.
  5142. * tif->tif_tagmethods.vsetfield and tif->tif_tagmethods.vgetfield) need to
  5143. * be initialized, which is done in TIFFDefaultDirectory().
  5144. * After that, the field array for the custom tags needs to be setup again.
  5145. */
  5146. TIFFDefaultDirectory(tif);
  5147. _TIFFSetupFields(tif, infoarray);
  5148. /* Allocate arrays for offset values outside IFD entry for IFD data size
  5149. * checking. Note: Counter are reset within TIFFFreeDirectory(). */
  5150. tif->tif_dir.td_dirdatasize_offsets =
  5151. (TIFFEntryOffsetAndLength *)_TIFFmallocExt(
  5152. tif, dircount * sizeof(TIFFEntryOffsetAndLength));
  5153. if (tif->tif_dir.td_dirdatasize_offsets == NULL)
  5154. {
  5155. TIFFErrorExtR(
  5156. tif, module,
  5157. "Failed to allocate memory for counting IFD data size at reading");
  5158. if (dir)
  5159. _TIFFfreeExt(tif, dir);
  5160. return 0;
  5161. }
  5162. for (di = 0, dp = dir; di < dircount; di++, dp++)
  5163. {
  5164. TIFFReadDirectoryFindFieldInfo(tif, dp->tdir_tag, &fii);
  5165. if (fii == FAILED_FII)
  5166. {
  5167. TIFFWarningExtR(tif, module,
  5168. "Unknown field with tag %" PRIu16 " (0x%" PRIx16
  5169. ") encountered",
  5170. dp->tdir_tag, dp->tdir_tag);
  5171. const TIFFField *fld = _TIFFCreateAnonField(
  5172. tif, dp->tdir_tag, (TIFFDataType)dp->tdir_type);
  5173. if (fld == NULL || !_TIFFMergeFields(tif, fld, 1))
  5174. {
  5175. TIFFWarningExtR(tif, module,
  5176. "Registering anonymous field with tag %" PRIu16
  5177. " (0x%" PRIx16 ") failed",
  5178. dp->tdir_tag, dp->tdir_tag);
  5179. dp->tdir_ignore = TRUE;
  5180. }
  5181. else
  5182. {
  5183. TIFFReadDirectoryFindFieldInfo(tif, dp->tdir_tag, &fii);
  5184. assert(fii != FAILED_FII);
  5185. }
  5186. }
  5187. if (!dp->tdir_ignore)
  5188. {
  5189. fip = tif->tif_fields[fii];
  5190. if (fip->field_bit == FIELD_IGNORE)
  5191. dp->tdir_ignore = TRUE;
  5192. else
  5193. {
  5194. /* check data type */
  5195. while ((fip->field_type != TIFF_ANY) &&
  5196. (fip->field_type != dp->tdir_type))
  5197. {
  5198. fii++;
  5199. if ((fii == tif->tif_nfields) ||
  5200. (tif->tif_fields[fii]->field_tag !=
  5201. (uint32_t)dp->tdir_tag))
  5202. {
  5203. fii = 0xFFFF;
  5204. break;
  5205. }
  5206. fip = tif->tif_fields[fii];
  5207. }
  5208. if (fii == 0xFFFF)
  5209. {
  5210. TIFFWarningExtR(tif, module,
  5211. "Wrong data type %" PRIu16
  5212. " for \"%s\"; tag ignored",
  5213. dp->tdir_type, fip->field_name);
  5214. dp->tdir_ignore = TRUE;
  5215. }
  5216. else
  5217. {
  5218. /* check count if known in advance */
  5219. if ((fip->field_readcount != TIFF_VARIABLE) &&
  5220. (fip->field_readcount != TIFF_VARIABLE2))
  5221. {
  5222. uint32_t expected;
  5223. if (fip->field_readcount == TIFF_SPP)
  5224. expected =
  5225. (uint32_t)tif->tif_dir.td_samplesperpixel;
  5226. else
  5227. expected = (uint32_t)fip->field_readcount;
  5228. if (!CheckDirCount(tif, dp, expected))
  5229. dp->tdir_ignore = TRUE;
  5230. }
  5231. }
  5232. }
  5233. if (!dp->tdir_ignore)
  5234. {
  5235. switch (dp->tdir_tag)
  5236. {
  5237. case EXIFTAG_SUBJECTDISTANCE:
  5238. if (!TIFFFieldIsAnonymous(fip))
  5239. {
  5240. /* should only be called on a Exif directory */
  5241. /* when exifFields[] is active */
  5242. (void)TIFFFetchSubjectDistance(tif, dp);
  5243. }
  5244. else
  5245. {
  5246. (void)TIFFFetchNormalTag(tif, dp, TRUE);
  5247. }
  5248. break;
  5249. default:
  5250. (void)TIFFFetchNormalTag(tif, dp, TRUE);
  5251. break;
  5252. }
  5253. } /*-- if (!dp->tdir_ignore) */
  5254. }
  5255. }
  5256. /* Evaluate final IFD data size. */
  5257. CalcFinalIFDdatasizeReading(tif, dircount);
  5258. /* To be able to return from SubIFD or custom-IFD to main-IFD */
  5259. tif->tif_setdirectory_force_absolute = TRUE;
  5260. if (dir)
  5261. _TIFFfreeExt(tif, dir);
  5262. return 1;
  5263. }
  5264. /*
  5265. * EXIF is important special case of custom IFD, so we have a special
  5266. * function to read it.
  5267. */
  5268. int TIFFReadEXIFDirectory(TIFF *tif, toff_t diroff)
  5269. {
  5270. return TIFFReadCustomDirectory(tif, diroff, _TIFFGetExifFields());
  5271. }
  5272. /*
  5273. *--: EXIF-GPS custom directory reading as another special case of custom IFD.
  5274. */
  5275. int TIFFReadGPSDirectory(TIFF *tif, toff_t diroff)
  5276. {
  5277. return TIFFReadCustomDirectory(tif, diroff, _TIFFGetGpsFields());
  5278. }
  5279. static int EstimateStripByteCounts(TIFF *tif, TIFFDirEntry *dir,
  5280. uint16_t dircount)
  5281. {
  5282. static const char module[] = "EstimateStripByteCounts";
  5283. TIFFDirEntry *dp;
  5284. TIFFDirectory *td = &tif->tif_dir;
  5285. uint32_t strip;
  5286. /* Do not try to load stripbytecount as we will compute it */
  5287. if (!_TIFFFillStrilesInternal(tif, 0))
  5288. return -1;
  5289. const uint64_t allocsize = (uint64_t)td->td_nstrips * sizeof(uint64_t);
  5290. uint64_t filesize = 0;
  5291. if (allocsize > 100 * 1024 * 1024)
  5292. {
  5293. /* Before allocating a huge amount of memory for corrupted files, check
  5294. * if size of requested memory is not greater than file size. */
  5295. filesize = TIFFGetFileSize(tif);
  5296. if (allocsize > filesize)
  5297. {
  5298. TIFFWarningExtR(
  5299. tif, module,
  5300. "Requested memory size for StripByteCounts of %" PRIu64
  5301. " is greater than filesize %" PRIu64 ". Memory not allocated",
  5302. allocsize, filesize);
  5303. return -1;
  5304. }
  5305. }
  5306. if (td->td_stripbytecount_p)
  5307. _TIFFfreeExt(tif, td->td_stripbytecount_p);
  5308. td->td_stripbytecount_p = (uint64_t *)_TIFFCheckMalloc(
  5309. tif, td->td_nstrips, sizeof(uint64_t), "for \"StripByteCounts\" array");
  5310. if (td->td_stripbytecount_p == NULL)
  5311. return -1;
  5312. if (td->td_compression != COMPRESSION_NONE)
  5313. {
  5314. uint64_t space;
  5315. uint16_t n;
  5316. if (!(tif->tif_flags & TIFF_BIGTIFF))
  5317. space = sizeof(TIFFHeaderClassic) + 2 + dircount * 12 + 4;
  5318. else
  5319. space = sizeof(TIFFHeaderBig) + 8 + dircount * 20 + 8;
  5320. /* calculate amount of space used by indirect values */
  5321. for (dp = dir, n = dircount; n > 0; n--, dp++)
  5322. {
  5323. uint32_t typewidth;
  5324. uint64_t datasize;
  5325. typewidth = TIFFDataWidth((TIFFDataType)dp->tdir_type);
  5326. if (typewidth == 0)
  5327. {
  5328. TIFFErrorExtR(
  5329. tif, module,
  5330. "Cannot determine size of unknown tag type %" PRIu16,
  5331. dp->tdir_type);
  5332. return -1;
  5333. }
  5334. if (dp->tdir_count > UINT64_MAX / typewidth)
  5335. return -1;
  5336. datasize = (uint64_t)typewidth * dp->tdir_count;
  5337. if (!(tif->tif_flags & TIFF_BIGTIFF))
  5338. {
  5339. if (datasize <= 4)
  5340. datasize = 0;
  5341. }
  5342. else
  5343. {
  5344. if (datasize <= 8)
  5345. datasize = 0;
  5346. }
  5347. if (space > UINT64_MAX - datasize)
  5348. return -1;
  5349. space += datasize;
  5350. }
  5351. if (filesize == 0)
  5352. filesize = TIFFGetFileSize(tif);
  5353. if (filesize < space)
  5354. /* we should perhaps return in error ? */
  5355. space = filesize;
  5356. else
  5357. space = filesize - space;
  5358. if (td->td_planarconfig == PLANARCONFIG_SEPARATE)
  5359. space /= td->td_samplesperpixel;
  5360. for (strip = 0; strip < td->td_nstrips; strip++)
  5361. td->td_stripbytecount_p[strip] = space;
  5362. /*
  5363. * This gross hack handles the case were the offset to
  5364. * the last strip is past the place where we think the strip
  5365. * should begin. Since a strip of data must be contiguous,
  5366. * it's safe to assume that we've overestimated the amount
  5367. * of data in the strip and trim this number back accordingly.
  5368. */
  5369. strip--;
  5370. if (td->td_stripoffset_p[strip] >
  5371. UINT64_MAX - td->td_stripbytecount_p[strip])
  5372. return -1;
  5373. if (td->td_stripoffset_p[strip] + td->td_stripbytecount_p[strip] >
  5374. filesize)
  5375. {
  5376. if (td->td_stripoffset_p[strip] >= filesize)
  5377. {
  5378. /* Not sure what we should in that case... */
  5379. td->td_stripbytecount_p[strip] = 0;
  5380. }
  5381. else
  5382. {
  5383. td->td_stripbytecount_p[strip] =
  5384. filesize - td->td_stripoffset_p[strip];
  5385. }
  5386. }
  5387. }
  5388. else if (isTiled(tif))
  5389. {
  5390. uint64_t bytespertile = TIFFTileSize64(tif);
  5391. for (strip = 0; strip < td->td_nstrips; strip++)
  5392. td->td_stripbytecount_p[strip] = bytespertile;
  5393. }
  5394. else
  5395. {
  5396. uint64_t rowbytes = TIFFScanlineSize64(tif);
  5397. uint32_t rowsperstrip = td->td_imagelength / td->td_stripsperimage;
  5398. for (strip = 0; strip < td->td_nstrips; strip++)
  5399. {
  5400. if (rowbytes > 0 && rowsperstrip > UINT64_MAX / rowbytes)
  5401. return -1;
  5402. td->td_stripbytecount_p[strip] = rowbytes * rowsperstrip;
  5403. }
  5404. }
  5405. TIFFSetFieldBit(tif, FIELD_STRIPBYTECOUNTS);
  5406. if (!TIFFFieldSet(tif, FIELD_ROWSPERSTRIP))
  5407. td->td_rowsperstrip = td->td_imagelength;
  5408. return 1;
  5409. }
  5410. static void MissingRequired(TIFF *tif, const char *tagname)
  5411. {
  5412. static const char module[] = "MissingRequired";
  5413. TIFFWarningExtR(tif, module,
  5414. "TIFF directory is missing required \"%s\" field", tagname);
  5415. }
  5416. static unsigned long hashFuncOffsetToNumber(const void *elt)
  5417. {
  5418. const TIFFOffsetAndDirNumber *offsetAndDirNumber =
  5419. (const TIFFOffsetAndDirNumber *)elt;
  5420. const uint32_t hash = (uint32_t)(offsetAndDirNumber->offset >> 32) ^
  5421. ((uint32_t)offsetAndDirNumber->offset & 0xFFFFFFFFU);
  5422. return hash;
  5423. }
  5424. static bool equalFuncOffsetToNumber(const void *elt1, const void *elt2)
  5425. {
  5426. const TIFFOffsetAndDirNumber *offsetAndDirNumber1 =
  5427. (const TIFFOffsetAndDirNumber *)elt1;
  5428. const TIFFOffsetAndDirNumber *offsetAndDirNumber2 =
  5429. (const TIFFOffsetAndDirNumber *)elt2;
  5430. return offsetAndDirNumber1->offset == offsetAndDirNumber2->offset;
  5431. }
  5432. static unsigned long hashFuncNumberToOffset(const void *elt)
  5433. {
  5434. const TIFFOffsetAndDirNumber *offsetAndDirNumber =
  5435. (const TIFFOffsetAndDirNumber *)elt;
  5436. return offsetAndDirNumber->dirNumber;
  5437. }
  5438. static bool equalFuncNumberToOffset(const void *elt1, const void *elt2)
  5439. {
  5440. const TIFFOffsetAndDirNumber *offsetAndDirNumber1 =
  5441. (const TIFFOffsetAndDirNumber *)elt1;
  5442. const TIFFOffsetAndDirNumber *offsetAndDirNumber2 =
  5443. (const TIFFOffsetAndDirNumber *)elt2;
  5444. return offsetAndDirNumber1->dirNumber == offsetAndDirNumber2->dirNumber;
  5445. }
  5446. /*
  5447. * Check the directory number and offset against the list of already seen
  5448. * directory numbers and offsets. This is a trick to prevent IFD looping.
  5449. * The one can create TIFF file with looped directory pointers. We will
  5450. * maintain a list of already seen directories and check every IFD offset
  5451. * and its IFD number against that list. However, the offset of an IFD number
  5452. * can change - e.g. when writing updates to file.
  5453. * Returns 1 if all is ok; 0 if last directory or IFD loop is encountered,
  5454. * or an error has occurred.
  5455. */
  5456. int _TIFFCheckDirNumberAndOffset(TIFF *tif, tdir_t dirn, uint64_t diroff)
  5457. {
  5458. if (diroff == 0) /* no more directories */
  5459. return 0;
  5460. if (tif->tif_map_dir_offset_to_number == NULL)
  5461. {
  5462. tif->tif_map_dir_offset_to_number = TIFFHashSetNew(
  5463. hashFuncOffsetToNumber, equalFuncOffsetToNumber, free);
  5464. if (tif->tif_map_dir_offset_to_number == NULL)
  5465. {
  5466. TIFFErrorExtR(tif, "_TIFFCheckDirNumberAndOffset",
  5467. "Not enough memory");
  5468. return 1;
  5469. }
  5470. }
  5471. if (tif->tif_map_dir_number_to_offset == NULL)
  5472. {
  5473. /* No free callback for this map, as it shares the same items as
  5474. * tif->tif_map_dir_offset_to_number. */
  5475. tif->tif_map_dir_number_to_offset = TIFFHashSetNew(
  5476. hashFuncNumberToOffset, equalFuncNumberToOffset, NULL);
  5477. if (tif->tif_map_dir_number_to_offset == NULL)
  5478. {
  5479. TIFFErrorExtR(tif, "_TIFFCheckDirNumberAndOffset",
  5480. "Not enough memory");
  5481. return 1;
  5482. }
  5483. }
  5484. /* Check if offset is already in the list:
  5485. * - yes: check, if offset is at the same IFD number - if not, it is an IFD
  5486. * loop
  5487. * - no: add to list or update offset at that IFD number
  5488. */
  5489. TIFFOffsetAndDirNumber entry;
  5490. entry.offset = diroff;
  5491. entry.dirNumber = dirn;
  5492. TIFFOffsetAndDirNumber *foundEntry =
  5493. (TIFFOffsetAndDirNumber *)TIFFHashSetLookup(
  5494. tif->tif_map_dir_offset_to_number, &entry);
  5495. if (foundEntry)
  5496. {
  5497. if (foundEntry->dirNumber == dirn)
  5498. {
  5499. return 1;
  5500. }
  5501. else
  5502. {
  5503. TIFFWarningExtR(tif, "_TIFFCheckDirNumberAndOffset",
  5504. "TIFF directory %d has IFD looping to directory %u "
  5505. "at offset 0x%" PRIx64 " (%" PRIu64 ")",
  5506. (int)dirn - 1, foundEntry->dirNumber, diroff,
  5507. diroff);
  5508. return 0;
  5509. }
  5510. }
  5511. /* Check if offset of an IFD has been changed and update offset of that IFD
  5512. * number. */
  5513. foundEntry = (TIFFOffsetAndDirNumber *)TIFFHashSetLookup(
  5514. tif->tif_map_dir_number_to_offset, &entry);
  5515. if (foundEntry)
  5516. {
  5517. if (foundEntry->offset != diroff)
  5518. {
  5519. TIFFOffsetAndDirNumber entryOld;
  5520. entryOld.offset = foundEntry->offset;
  5521. entryOld.dirNumber = dirn;
  5522. /* We must remove first from tif_map_dir_number_to_offset as the */
  5523. /* entry is owned (and thus freed) by */
  5524. /* tif_map_dir_offset_to_number */
  5525. TIFFOffsetAndDirNumber *foundEntryOld =
  5526. (TIFFOffsetAndDirNumber *)TIFFHashSetLookup(
  5527. tif->tif_map_dir_number_to_offset, &entryOld);
  5528. if (foundEntryOld)
  5529. {
  5530. TIFFHashSetRemove(tif->tif_map_dir_number_to_offset,
  5531. foundEntryOld);
  5532. }
  5533. foundEntryOld = (TIFFOffsetAndDirNumber *)TIFFHashSetLookup(
  5534. tif->tif_map_dir_offset_to_number, &entryOld);
  5535. if (foundEntryOld)
  5536. {
  5537. TIFFHashSetRemove(tif->tif_map_dir_offset_to_number,
  5538. foundEntryOld);
  5539. }
  5540. TIFFOffsetAndDirNumber *entryPtr = (TIFFOffsetAndDirNumber *)malloc(
  5541. sizeof(TIFFOffsetAndDirNumber));
  5542. if (entryPtr == NULL)
  5543. {
  5544. return 0;
  5545. }
  5546. /* Add IFD offset and dirn to IFD directory list */
  5547. *entryPtr = entry;
  5548. if (!TIFFHashSetInsert(tif->tif_map_dir_offset_to_number, entryPtr))
  5549. {
  5550. TIFFErrorExtR(
  5551. tif, "_TIFFCheckDirNumberAndOffset",
  5552. "Insertion in tif_map_dir_offset_to_number failed");
  5553. return 0;
  5554. }
  5555. if (!TIFFHashSetInsert(tif->tif_map_dir_number_to_offset, entryPtr))
  5556. {
  5557. TIFFErrorExtR(
  5558. tif, "_TIFFCheckDirNumberAndOffset",
  5559. "Insertion in tif_map_dir_number_to_offset failed");
  5560. return 0;
  5561. }
  5562. }
  5563. return 1;
  5564. }
  5565. /* Arbitrary (hopefully big enough) limit */
  5566. if (TIFFHashSetSize(tif->tif_map_dir_offset_to_number) >=
  5567. TIFF_MAX_DIR_COUNT)
  5568. {
  5569. TIFFErrorExtR(tif, "_TIFFCheckDirNumberAndOffset",
  5570. "Cannot handle more than %u TIFF directories",
  5571. TIFF_MAX_DIR_COUNT);
  5572. return 0;
  5573. }
  5574. TIFFOffsetAndDirNumber *entryPtr =
  5575. (TIFFOffsetAndDirNumber *)malloc(sizeof(TIFFOffsetAndDirNumber));
  5576. if (entryPtr == NULL)
  5577. {
  5578. TIFFErrorExtR(tif, "_TIFFCheckDirNumberAndOffset",
  5579. "malloc(sizeof(TIFFOffsetAndDirNumber)) failed");
  5580. return 0;
  5581. }
  5582. /* Add IFD offset and dirn to IFD directory list */
  5583. *entryPtr = entry;
  5584. if (!TIFFHashSetInsert(tif->tif_map_dir_offset_to_number, entryPtr))
  5585. {
  5586. TIFFErrorExtR(tif, "_TIFFCheckDirNumberAndOffset",
  5587. "Insertion in tif_map_dir_offset_to_number failed");
  5588. return 0;
  5589. }
  5590. if (!TIFFHashSetInsert(tif->tif_map_dir_number_to_offset, entryPtr))
  5591. {
  5592. TIFFErrorExtR(tif, "_TIFFCheckDirNumberAndOffset",
  5593. "Insertion in tif_map_dir_number_to_offset failed");
  5594. return 0;
  5595. }
  5596. return 1;
  5597. } /* --- _TIFFCheckDirNumberAndOffset() ---*/
  5598. /*
  5599. * Retrieve the matching IFD directory number of a given IFD offset
  5600. * from the list of directories already seen.
  5601. * Returns 1 if the offset was in the list and the directory number
  5602. * can be returned.
  5603. * Otherwise returns 0 or if an error occurred.
  5604. */
  5605. int _TIFFGetDirNumberFromOffset(TIFF *tif, uint64_t diroff, tdir_t *dirn)
  5606. {
  5607. if (diroff == 0) /* no more directories */
  5608. return 0;
  5609. /* Check if offset is already in the list and return matching directory
  5610. * number. Otherwise update IFD list using TIFFNumberOfDirectories() and
  5611. * search again in IFD list.
  5612. */
  5613. if (tif->tif_map_dir_offset_to_number == NULL)
  5614. return 0;
  5615. TIFFOffsetAndDirNumber entry;
  5616. entry.offset = diroff;
  5617. entry.dirNumber = 0; /* not used */
  5618. TIFFOffsetAndDirNumber *foundEntry =
  5619. (TIFFOffsetAndDirNumber *)TIFFHashSetLookup(
  5620. tif->tif_map_dir_offset_to_number, &entry);
  5621. if (foundEntry)
  5622. {
  5623. *dirn = foundEntry->dirNumber;
  5624. return 1;
  5625. }
  5626. /* This updates the directory list for all main-IFDs in the file. */
  5627. TIFFNumberOfDirectories(tif);
  5628. foundEntry = (TIFFOffsetAndDirNumber *)TIFFHashSetLookup(
  5629. tif->tif_map_dir_offset_to_number, &entry);
  5630. if (foundEntry)
  5631. {
  5632. *dirn = foundEntry->dirNumber;
  5633. return 1;
  5634. }
  5635. return 0;
  5636. } /*--- _TIFFGetDirNumberFromOffset() ---*/
  5637. /*
  5638. * Retrieve the matching IFD directory offset of a given IFD number
  5639. * from the list of directories already seen.
  5640. * Returns 1 if the offset was in the list of already seen IFDs and the
  5641. * directory offset can be returned. The directory list is not updated.
  5642. * Otherwise returns 0 or if an error occurred.
  5643. */
  5644. int _TIFFGetOffsetFromDirNumber(TIFF *tif, tdir_t dirn, uint64_t *diroff)
  5645. {
  5646. if (tif->tif_map_dir_number_to_offset == NULL)
  5647. return 0;
  5648. TIFFOffsetAndDirNumber entry;
  5649. entry.offset = 0; /* not used */
  5650. entry.dirNumber = dirn;
  5651. TIFFOffsetAndDirNumber *foundEntry =
  5652. (TIFFOffsetAndDirNumber *)TIFFHashSetLookup(
  5653. tif->tif_map_dir_number_to_offset, &entry);
  5654. if (foundEntry)
  5655. {
  5656. *diroff = foundEntry->offset;
  5657. return 1;
  5658. }
  5659. return 0;
  5660. } /*--- _TIFFGetOffsetFromDirNumber() ---*/
  5661. /*
  5662. * Remove an entry from the directory list of already seen directories
  5663. * by directory offset.
  5664. * If an entry is to be removed from the list, it is also okay if the entry
  5665. * is not in the list or the list does not exist.
  5666. */
  5667. int _TIFFRemoveEntryFromDirectoryListByOffset(TIFF *tif, uint64_t diroff)
  5668. {
  5669. if (tif->tif_map_dir_offset_to_number == NULL)
  5670. return 1;
  5671. TIFFOffsetAndDirNumber entryOld;
  5672. entryOld.offset = diroff;
  5673. entryOld.dirNumber = 0;
  5674. /* We must remove first from tif_map_dir_number_to_offset as the
  5675. * entry is owned (and thus freed) by tif_map_dir_offset_to_number.
  5676. * However, we need firstly to find the directory number from offset. */
  5677. TIFFOffsetAndDirNumber *foundEntryOldOff =
  5678. (TIFFOffsetAndDirNumber *)TIFFHashSetLookup(
  5679. tif->tif_map_dir_offset_to_number, &entryOld);
  5680. if (foundEntryOldOff)
  5681. {
  5682. entryOld.dirNumber = foundEntryOldOff->dirNumber;
  5683. if (tif->tif_map_dir_number_to_offset != NULL)
  5684. {
  5685. TIFFOffsetAndDirNumber *foundEntryOldDir =
  5686. (TIFFOffsetAndDirNumber *)TIFFHashSetLookup(
  5687. tif->tif_map_dir_number_to_offset, &entryOld);
  5688. if (foundEntryOldDir)
  5689. {
  5690. TIFFHashSetRemove(tif->tif_map_dir_number_to_offset,
  5691. foundEntryOldDir);
  5692. TIFFHashSetRemove(tif->tif_map_dir_offset_to_number,
  5693. foundEntryOldOff);
  5694. return 1;
  5695. }
  5696. }
  5697. else
  5698. {
  5699. TIFFErrorExtR(tif, "_TIFFRemoveEntryFromDirectoryListByOffset",
  5700. "Unexpectedly tif_map_dir_number_to_offset is "
  5701. "missing but tif_map_dir_offset_to_number exists.");
  5702. return 0;
  5703. }
  5704. }
  5705. return 1;
  5706. } /*--- _TIFFRemoveEntryFromDirectoryListByOffset() ---*/
  5707. /*
  5708. * Check the count field of a directory entry against a known value. The
  5709. * caller is expected to skip/ignore the tag if there is a mismatch.
  5710. */
  5711. static int CheckDirCount(TIFF *tif, TIFFDirEntry *dir, uint32_t count)
  5712. {
  5713. if ((uint64_t)count > dir->tdir_count)
  5714. {
  5715. const TIFFField *fip = TIFFFieldWithTag(tif, dir->tdir_tag);
  5716. TIFFWarningExtR(tif, tif->tif_name,
  5717. "incorrect count for field \"%s\" (%" PRIu64
  5718. ", expecting %" PRIu32 "); tag ignored",
  5719. fip ? fip->field_name : "unknown tagname",
  5720. dir->tdir_count, count);
  5721. return (0);
  5722. }
  5723. else if ((uint64_t)count < dir->tdir_count)
  5724. {
  5725. const TIFFField *fip = TIFFFieldWithTag(tif, dir->tdir_tag);
  5726. TIFFWarningExtR(tif, tif->tif_name,
  5727. "incorrect count for field \"%s\" (%" PRIu64
  5728. ", expecting %" PRIu32 "); tag trimmed",
  5729. fip ? fip->field_name : "unknown tagname",
  5730. dir->tdir_count, count);
  5731. dir->tdir_count = count;
  5732. return (1);
  5733. }
  5734. return (1);
  5735. }
  5736. /*
  5737. * Read IFD structure from the specified offset. If the pointer to
  5738. * nextdiroff variable has been specified, read it too. Function returns a
  5739. * number of fields in the directory or 0 if failed.
  5740. */
  5741. static uint16_t TIFFFetchDirectory(TIFF *tif, uint64_t diroff,
  5742. TIFFDirEntry **pdir, uint64_t *nextdiroff)
  5743. {
  5744. static const char module[] = "TIFFFetchDirectory";
  5745. void *origdir;
  5746. uint16_t dircount16;
  5747. uint32_t dirsize;
  5748. TIFFDirEntry *dir;
  5749. uint8_t *ma;
  5750. TIFFDirEntry *mb;
  5751. uint16_t n;
  5752. assert(pdir);
  5753. tif->tif_diroff = diroff;
  5754. if (nextdiroff)
  5755. *nextdiroff = 0;
  5756. if (!isMapped(tif))
  5757. {
  5758. if (!SeekOK(tif, tif->tif_diroff))
  5759. {
  5760. TIFFErrorExtR(tif, module,
  5761. "%s: Seek error accessing TIFF directory",
  5762. tif->tif_name);
  5763. return 0;
  5764. }
  5765. if (!(tif->tif_flags & TIFF_BIGTIFF))
  5766. {
  5767. if (!ReadOK(tif, &dircount16, sizeof(uint16_t)))
  5768. {
  5769. TIFFErrorExtR(tif, module,
  5770. "%s: Can not read TIFF directory count",
  5771. tif->tif_name);
  5772. return 0;
  5773. }
  5774. if (tif->tif_flags & TIFF_SWAB)
  5775. TIFFSwabShort(&dircount16);
  5776. if (dircount16 > 4096)
  5777. {
  5778. TIFFErrorExtR(tif, module,
  5779. "Sanity check on directory count failed, this is "
  5780. "probably not a valid IFD offset");
  5781. return 0;
  5782. }
  5783. dirsize = 12;
  5784. }
  5785. else
  5786. {
  5787. uint64_t dircount64;
  5788. if (!ReadOK(tif, &dircount64, sizeof(uint64_t)))
  5789. {
  5790. TIFFErrorExtR(tif, module,
  5791. "%s: Can not read TIFF directory count",
  5792. tif->tif_name);
  5793. return 0;
  5794. }
  5795. if (tif->tif_flags & TIFF_SWAB)
  5796. TIFFSwabLong8(&dircount64);
  5797. if (dircount64 > 4096)
  5798. {
  5799. TIFFErrorExtR(tif, module,
  5800. "Sanity check on directory count failed, this is "
  5801. "probably not a valid IFD offset");
  5802. return 0;
  5803. }
  5804. dircount16 = (uint16_t)dircount64;
  5805. dirsize = 20;
  5806. }
  5807. origdir = _TIFFCheckMalloc(tif, dircount16, dirsize,
  5808. "to read TIFF directory");
  5809. if (origdir == NULL)
  5810. return 0;
  5811. if (!ReadOK(tif, origdir, (tmsize_t)(dircount16 * dirsize)))
  5812. {
  5813. TIFFErrorExtR(tif, module, "%.100s: Can not read TIFF directory",
  5814. tif->tif_name);
  5815. _TIFFfreeExt(tif, origdir);
  5816. return 0;
  5817. }
  5818. /*
  5819. * Read offset to next directory for sequential scans if
  5820. * needed.
  5821. */
  5822. if (nextdiroff)
  5823. {
  5824. if (!(tif->tif_flags & TIFF_BIGTIFF))
  5825. {
  5826. uint32_t nextdiroff32;
  5827. if (!ReadOK(tif, &nextdiroff32, sizeof(uint32_t)))
  5828. nextdiroff32 = 0;
  5829. if (tif->tif_flags & TIFF_SWAB)
  5830. TIFFSwabLong(&nextdiroff32);
  5831. *nextdiroff = nextdiroff32;
  5832. }
  5833. else
  5834. {
  5835. if (!ReadOK(tif, nextdiroff, sizeof(uint64_t)))
  5836. *nextdiroff = 0;
  5837. if (tif->tif_flags & TIFF_SWAB)
  5838. TIFFSwabLong8(nextdiroff);
  5839. }
  5840. }
  5841. }
  5842. else
  5843. {
  5844. tmsize_t m;
  5845. tmsize_t off;
  5846. if (tif->tif_diroff > (uint64_t)INT64_MAX)
  5847. {
  5848. TIFFErrorExtR(tif, module, "Can not read TIFF directory count");
  5849. return (0);
  5850. }
  5851. off = (tmsize_t)tif->tif_diroff;
  5852. /*
  5853. * Check for integer overflow when validating the dir_off,
  5854. * otherwise a very high offset may cause an OOB read and
  5855. * crash the client. Make two comparisons instead of
  5856. *
  5857. * off + sizeof(uint16_t) > tif->tif_size
  5858. *
  5859. * to avoid overflow.
  5860. */
  5861. if (!(tif->tif_flags & TIFF_BIGTIFF))
  5862. {
  5863. m = off + sizeof(uint16_t);
  5864. if ((m < off) || (m < (tmsize_t)sizeof(uint16_t)) ||
  5865. (m > tif->tif_size))
  5866. {
  5867. TIFFErrorExtR(tif, module, "Can not read TIFF directory count");
  5868. return 0;
  5869. }
  5870. else
  5871. {
  5872. _TIFFmemcpy(&dircount16, tif->tif_base + off, sizeof(uint16_t));
  5873. }
  5874. off += sizeof(uint16_t);
  5875. if (tif->tif_flags & TIFF_SWAB)
  5876. TIFFSwabShort(&dircount16);
  5877. if (dircount16 > 4096)
  5878. {
  5879. TIFFErrorExtR(tif, module,
  5880. "Sanity check on directory count failed, this is "
  5881. "probably not a valid IFD offset");
  5882. return 0;
  5883. }
  5884. dirsize = 12;
  5885. }
  5886. else
  5887. {
  5888. uint64_t dircount64;
  5889. m = off + sizeof(uint64_t);
  5890. if ((m < off) || (m < (tmsize_t)sizeof(uint64_t)) ||
  5891. (m > tif->tif_size))
  5892. {
  5893. TIFFErrorExtR(tif, module, "Can not read TIFF directory count");
  5894. return 0;
  5895. }
  5896. else
  5897. {
  5898. _TIFFmemcpy(&dircount64, tif->tif_base + off, sizeof(uint64_t));
  5899. }
  5900. off += sizeof(uint64_t);
  5901. if (tif->tif_flags & TIFF_SWAB)
  5902. TIFFSwabLong8(&dircount64);
  5903. if (dircount64 > 4096)
  5904. {
  5905. TIFFErrorExtR(tif, module,
  5906. "Sanity check on directory count failed, this is "
  5907. "probably not a valid IFD offset");
  5908. return 0;
  5909. }
  5910. dircount16 = (uint16_t)dircount64;
  5911. dirsize = 20;
  5912. }
  5913. if (dircount16 == 0)
  5914. {
  5915. TIFFWarningExtR(tif, module,
  5916. "Sanity check on directory count failed, zero tag "
  5917. "directories not supported");
  5918. return 0;
  5919. }
  5920. /* Before allocating a huge amount of memory for corrupted files, check
  5921. * if size of requested memory is not greater than file size. */
  5922. uint64_t filesize = TIFFGetFileSize(tif);
  5923. uint64_t allocsize = (uint64_t)dircount16 * dirsize;
  5924. if (allocsize > filesize)
  5925. {
  5926. TIFFWarningExtR(
  5927. tif, module,
  5928. "Requested memory size for TIFF directory of %" PRIu64
  5929. " is greater than filesize %" PRIu64
  5930. ". Memory not allocated, TIFF directory not read",
  5931. allocsize, filesize);
  5932. return 0;
  5933. }
  5934. origdir = _TIFFCheckMalloc(tif, dircount16, dirsize,
  5935. "to read TIFF directory");
  5936. if (origdir == NULL)
  5937. return 0;
  5938. m = off + dircount16 * dirsize;
  5939. if ((m < off) || (m < (tmsize_t)(dircount16 * dirsize)) ||
  5940. (m > tif->tif_size))
  5941. {
  5942. TIFFErrorExtR(tif, module, "Can not read TIFF directory");
  5943. _TIFFfreeExt(tif, origdir);
  5944. return 0;
  5945. }
  5946. else
  5947. {
  5948. _TIFFmemcpy(origdir, tif->tif_base + off, dircount16 * dirsize);
  5949. }
  5950. if (nextdiroff)
  5951. {
  5952. off += dircount16 * dirsize;
  5953. if (!(tif->tif_flags & TIFF_BIGTIFF))
  5954. {
  5955. uint32_t nextdiroff32;
  5956. m = off + sizeof(uint32_t);
  5957. if ((m < off) || (m < (tmsize_t)sizeof(uint32_t)) ||
  5958. (m > tif->tif_size))
  5959. nextdiroff32 = 0;
  5960. else
  5961. _TIFFmemcpy(&nextdiroff32, tif->tif_base + off,
  5962. sizeof(uint32_t));
  5963. if (tif->tif_flags & TIFF_SWAB)
  5964. TIFFSwabLong(&nextdiroff32);
  5965. *nextdiroff = nextdiroff32;
  5966. }
  5967. else
  5968. {
  5969. m = off + sizeof(uint64_t);
  5970. if ((m < off) || (m < (tmsize_t)sizeof(uint64_t)) ||
  5971. (m > tif->tif_size))
  5972. *nextdiroff = 0;
  5973. else
  5974. _TIFFmemcpy(nextdiroff, tif->tif_base + off,
  5975. sizeof(uint64_t));
  5976. if (tif->tif_flags & TIFF_SWAB)
  5977. TIFFSwabLong8(nextdiroff);
  5978. }
  5979. }
  5980. }
  5981. /* No check against filesize needed here because "dir" should have same size
  5982. * than "origdir" checked above. */
  5983. dir = (TIFFDirEntry *)_TIFFCheckMalloc(
  5984. tif, dircount16, sizeof(TIFFDirEntry), "to read TIFF directory");
  5985. if (dir == 0)
  5986. {
  5987. _TIFFfreeExt(tif, origdir);
  5988. return 0;
  5989. }
  5990. ma = (uint8_t *)origdir;
  5991. mb = dir;
  5992. for (n = 0; n < dircount16; n++)
  5993. {
  5994. mb->tdir_ignore = FALSE;
  5995. if (tif->tif_flags & TIFF_SWAB)
  5996. TIFFSwabShort((uint16_t *)ma);
  5997. mb->tdir_tag = *(uint16_t *)ma;
  5998. ma += sizeof(uint16_t);
  5999. if (tif->tif_flags & TIFF_SWAB)
  6000. TIFFSwabShort((uint16_t *)ma);
  6001. mb->tdir_type = *(uint16_t *)ma;
  6002. ma += sizeof(uint16_t);
  6003. if (!(tif->tif_flags & TIFF_BIGTIFF))
  6004. {
  6005. if (tif->tif_flags & TIFF_SWAB)
  6006. TIFFSwabLong((uint32_t *)ma);
  6007. mb->tdir_count = (uint64_t)(*(uint32_t *)ma);
  6008. ma += sizeof(uint32_t);
  6009. mb->tdir_offset.toff_long8 = 0;
  6010. *(uint32_t *)(&mb->tdir_offset) = *(uint32_t *)ma;
  6011. ma += sizeof(uint32_t);
  6012. }
  6013. else
  6014. {
  6015. if (tif->tif_flags & TIFF_SWAB)
  6016. TIFFSwabLong8((uint64_t *)ma);
  6017. mb->tdir_count = TIFFReadUInt64(ma);
  6018. ma += sizeof(uint64_t);
  6019. mb->tdir_offset.toff_long8 = TIFFReadUInt64(ma);
  6020. ma += sizeof(uint64_t);
  6021. }
  6022. mb++;
  6023. }
  6024. _TIFFfreeExt(tif, origdir);
  6025. *pdir = dir;
  6026. return dircount16;
  6027. }
  6028. /*
  6029. * Fetch a tag that is not handled by special case code.
  6030. */
  6031. static int TIFFFetchNormalTag(TIFF *tif, TIFFDirEntry *dp, int recover)
  6032. {
  6033. static const char module[] = "TIFFFetchNormalTag";
  6034. enum TIFFReadDirEntryErr err;
  6035. uint32_t fii;
  6036. const TIFFField *fip = NULL;
  6037. TIFFReadDirectoryFindFieldInfo(tif, dp->tdir_tag, &fii);
  6038. if (fii == FAILED_FII)
  6039. {
  6040. TIFFErrorExtR(tif, "TIFFFetchNormalTag",
  6041. "No definition found for tag %" PRIu16, dp->tdir_tag);
  6042. return 0;
  6043. }
  6044. fip = tif->tif_fields[fii];
  6045. assert(fip != NULL); /* should not happen */
  6046. assert(fip->set_field_type !=
  6047. TIFF_SETGET_OTHER); /* if so, we shouldn't arrive here but deal with
  6048. this in specialized code */
  6049. assert(fip->set_field_type !=
  6050. TIFF_SETGET_INT); /* if so, we shouldn't arrive here as this is only
  6051. the case for pseudo-tags */
  6052. err = TIFFReadDirEntryErrOk;
  6053. switch (fip->set_field_type)
  6054. {
  6055. case TIFF_SETGET_UNDEFINED:
  6056. TIFFErrorExtR(
  6057. tif, "TIFFFetchNormalTag",
  6058. "Defined set_field_type of custom tag %u (%s) is "
  6059. "TIFF_SETGET_UNDEFINED and thus tag is not read from file",
  6060. fip->field_tag, fip->field_name);
  6061. break;
  6062. case TIFF_SETGET_ASCII:
  6063. {
  6064. uint8_t *data;
  6065. assert(fip->field_passcount == 0);
  6066. err = TIFFReadDirEntryByteArray(tif, dp, &data);
  6067. if (err == TIFFReadDirEntryErrOk)
  6068. {
  6069. size_t mb = 0;
  6070. int n;
  6071. if (data != NULL)
  6072. {
  6073. if (dp->tdir_count > 0 && data[dp->tdir_count - 1] == 0)
  6074. {
  6075. /* optimization: if data is known to be 0 terminated, we
  6076. * can use strlen() */
  6077. mb = strlen((const char *)data);
  6078. }
  6079. else
  6080. {
  6081. /* general case. equivalent to non-portable */
  6082. /* mb = strnlen((const char*)data,
  6083. * (uint32_t)dp->tdir_count); */
  6084. uint8_t *ma = data;
  6085. while (mb < (uint32_t)dp->tdir_count)
  6086. {
  6087. if (*ma == 0)
  6088. break;
  6089. ma++;
  6090. mb++;
  6091. }
  6092. }
  6093. }
  6094. if (!EvaluateIFDdatasizeReading(tif, dp))
  6095. {
  6096. if (data != NULL)
  6097. _TIFFfreeExt(tif, data);
  6098. return (0);
  6099. }
  6100. if (mb + 1 < (uint32_t)dp->tdir_count)
  6101. TIFFWarningExtR(
  6102. tif, module,
  6103. "ASCII value for tag \"%s\" contains null byte in "
  6104. "value; value incorrectly truncated during reading due "
  6105. "to implementation limitations",
  6106. fip->field_name);
  6107. else if (mb + 1 > (uint32_t)dp->tdir_count)
  6108. {
  6109. TIFFWarningExtR(tif, module,
  6110. "ASCII value for tag \"%s\" does not end "
  6111. "in null byte. Forcing it to be null",
  6112. fip->field_name);
  6113. /* TIFFReadDirEntryArrayWithLimit() ensures this can't be
  6114. * larger than MAX_SIZE_TAG_DATA */
  6115. assert((uint32_t)dp->tdir_count + 1 == dp->tdir_count + 1);
  6116. uint8_t *o =
  6117. _TIFFmallocExt(tif, (uint32_t)dp->tdir_count + 1);
  6118. if (o == NULL)
  6119. {
  6120. if (data != NULL)
  6121. _TIFFfreeExt(tif, data);
  6122. return (0);
  6123. }
  6124. if (dp->tdir_count > 0)
  6125. {
  6126. _TIFFmemcpy(o, data, (uint32_t)dp->tdir_count);
  6127. }
  6128. o[(uint32_t)dp->tdir_count] = 0;
  6129. if (data != 0)
  6130. _TIFFfreeExt(tif, data);
  6131. data = o;
  6132. }
  6133. n = TIFFSetField(tif, dp->tdir_tag, data);
  6134. if (data != 0)
  6135. _TIFFfreeExt(tif, data);
  6136. if (!n)
  6137. return (0);
  6138. }
  6139. }
  6140. break;
  6141. case TIFF_SETGET_UINT8:
  6142. {
  6143. uint8_t data = 0;
  6144. assert(fip->field_readcount == 1);
  6145. assert(fip->field_passcount == 0);
  6146. err = TIFFReadDirEntryByte(tif, dp, &data);
  6147. if (err == TIFFReadDirEntryErrOk)
  6148. {
  6149. if (!TIFFSetField(tif, dp->tdir_tag, data))
  6150. return (0);
  6151. }
  6152. }
  6153. break;
  6154. case TIFF_SETGET_SINT8:
  6155. {
  6156. int8_t data = 0;
  6157. assert(fip->field_readcount == 1);
  6158. assert(fip->field_passcount == 0);
  6159. err = TIFFReadDirEntrySbyte(tif, dp, &data);
  6160. if (err == TIFFReadDirEntryErrOk)
  6161. {
  6162. if (!TIFFSetField(tif, dp->tdir_tag, data))
  6163. return (0);
  6164. }
  6165. }
  6166. break;
  6167. case TIFF_SETGET_UINT16:
  6168. {
  6169. uint16_t data;
  6170. assert(fip->field_readcount == 1);
  6171. assert(fip->field_passcount == 0);
  6172. err = TIFFReadDirEntryShort(tif, dp, &data);
  6173. if (err == TIFFReadDirEntryErrOk)
  6174. {
  6175. if (!TIFFSetField(tif, dp->tdir_tag, data))
  6176. return (0);
  6177. }
  6178. }
  6179. break;
  6180. case TIFF_SETGET_SINT16:
  6181. {
  6182. int16_t data;
  6183. assert(fip->field_readcount == 1);
  6184. assert(fip->field_passcount == 0);
  6185. err = TIFFReadDirEntrySshort(tif, dp, &data);
  6186. if (err == TIFFReadDirEntryErrOk)
  6187. {
  6188. if (!TIFFSetField(tif, dp->tdir_tag, data))
  6189. return (0);
  6190. }
  6191. }
  6192. break;
  6193. case TIFF_SETGET_UINT32:
  6194. {
  6195. uint32_t data;
  6196. assert(fip->field_readcount == 1);
  6197. assert(fip->field_passcount == 0);
  6198. err = TIFFReadDirEntryLong(tif, dp, &data);
  6199. if (err == TIFFReadDirEntryErrOk)
  6200. {
  6201. if (!TIFFSetField(tif, dp->tdir_tag, data))
  6202. return (0);
  6203. }
  6204. }
  6205. break;
  6206. case TIFF_SETGET_SINT32:
  6207. {
  6208. int32_t data;
  6209. assert(fip->field_readcount == 1);
  6210. assert(fip->field_passcount == 0);
  6211. err = TIFFReadDirEntrySlong(tif, dp, &data);
  6212. if (err == TIFFReadDirEntryErrOk)
  6213. {
  6214. if (!TIFFSetField(tif, dp->tdir_tag, data))
  6215. return (0);
  6216. }
  6217. }
  6218. break;
  6219. case TIFF_SETGET_UINT64:
  6220. {
  6221. uint64_t data;
  6222. assert(fip->field_readcount == 1);
  6223. assert(fip->field_passcount == 0);
  6224. err = TIFFReadDirEntryLong8(tif, dp, &data);
  6225. if (err == TIFFReadDirEntryErrOk)
  6226. {
  6227. if (!EvaluateIFDdatasizeReading(tif, dp))
  6228. return 0;
  6229. if (!TIFFSetField(tif, dp->tdir_tag, data))
  6230. return (0);
  6231. }
  6232. }
  6233. break;
  6234. case TIFF_SETGET_SINT64:
  6235. {
  6236. int64_t data;
  6237. assert(fip->field_readcount == 1);
  6238. assert(fip->field_passcount == 0);
  6239. err = TIFFReadDirEntrySlong8(tif, dp, &data);
  6240. if (err == TIFFReadDirEntryErrOk)
  6241. {
  6242. if (!EvaluateIFDdatasizeReading(tif, dp))
  6243. return 0;
  6244. if (!TIFFSetField(tif, dp->tdir_tag, data))
  6245. return (0);
  6246. }
  6247. }
  6248. break;
  6249. case TIFF_SETGET_FLOAT:
  6250. {
  6251. float data;
  6252. assert(fip->field_readcount == 1);
  6253. assert(fip->field_passcount == 0);
  6254. err = TIFFReadDirEntryFloat(tif, dp, &data);
  6255. if (err == TIFFReadDirEntryErrOk)
  6256. {
  6257. if (!EvaluateIFDdatasizeReading(tif, dp))
  6258. return 0;
  6259. if (!TIFFSetField(tif, dp->tdir_tag, data))
  6260. return (0);
  6261. }
  6262. }
  6263. break;
  6264. case TIFF_SETGET_DOUBLE:
  6265. {
  6266. double data;
  6267. assert(fip->field_readcount == 1);
  6268. assert(fip->field_passcount == 0);
  6269. err = TIFFReadDirEntryDouble(tif, dp, &data);
  6270. if (err == TIFFReadDirEntryErrOk)
  6271. {
  6272. if (!EvaluateIFDdatasizeReading(tif, dp))
  6273. return 0;
  6274. if (!TIFFSetField(tif, dp->tdir_tag, data))
  6275. return (0);
  6276. }
  6277. }
  6278. break;
  6279. case TIFF_SETGET_IFD8:
  6280. {
  6281. uint64_t data;
  6282. assert(fip->field_readcount == 1);
  6283. assert(fip->field_passcount == 0);
  6284. err = TIFFReadDirEntryIfd8(tif, dp, &data);
  6285. if (err == TIFFReadDirEntryErrOk)
  6286. {
  6287. if (!EvaluateIFDdatasizeReading(tif, dp))
  6288. return 0;
  6289. if (!TIFFSetField(tif, dp->tdir_tag, data))
  6290. return (0);
  6291. }
  6292. }
  6293. break;
  6294. case TIFF_SETGET_UINT16_PAIR:
  6295. {
  6296. uint16_t *data;
  6297. assert(fip->field_readcount == 2);
  6298. assert(fip->field_passcount == 0);
  6299. if (dp->tdir_count != 2)
  6300. {
  6301. TIFFWarningExtR(tif, module,
  6302. "incorrect count for field \"%s\", expected 2, "
  6303. "got %" PRIu64,
  6304. fip->field_name, dp->tdir_count);
  6305. return (0);
  6306. }
  6307. err = TIFFReadDirEntryShortArray(tif, dp, &data);
  6308. if (err == TIFFReadDirEntryErrOk)
  6309. {
  6310. int m;
  6311. assert(data); /* avoid CLang static Analyzer false positive */
  6312. m = TIFFSetField(tif, dp->tdir_tag, data[0], data[1]);
  6313. _TIFFfreeExt(tif, data);
  6314. if (!m)
  6315. return (0);
  6316. }
  6317. }
  6318. break;
  6319. case TIFF_SETGET_C0_UINT8:
  6320. {
  6321. uint8_t *data;
  6322. assert(fip->field_readcount >= 1);
  6323. assert(fip->field_passcount == 0);
  6324. if (dp->tdir_count != (uint64_t)fip->field_readcount)
  6325. {
  6326. TIFFWarningExtR(tif, module,
  6327. "incorrect count for field \"%s\", expected "
  6328. "%d, got %" PRIu64,
  6329. fip->field_name, (int)fip->field_readcount,
  6330. dp->tdir_count);
  6331. return (0);
  6332. }
  6333. else
  6334. {
  6335. err = TIFFReadDirEntryByteArray(tif, dp, &data);
  6336. if (err == TIFFReadDirEntryErrOk)
  6337. {
  6338. if (!EvaluateIFDdatasizeReading(tif, dp))
  6339. {
  6340. if (data != 0)
  6341. _TIFFfreeExt(tif, data);
  6342. return 0;
  6343. }
  6344. int m;
  6345. m = TIFFSetField(tif, dp->tdir_tag, data);
  6346. if (data != 0)
  6347. _TIFFfreeExt(tif, data);
  6348. if (!m)
  6349. return (0);
  6350. }
  6351. }
  6352. }
  6353. break;
  6354. case TIFF_SETGET_C0_SINT8:
  6355. {
  6356. int8_t *data;
  6357. assert(fip->field_readcount >= 1);
  6358. assert(fip->field_passcount == 0);
  6359. if (dp->tdir_count != (uint64_t)fip->field_readcount)
  6360. {
  6361. TIFFWarningExtR(tif, module,
  6362. "incorrect count for field \"%s\", expected "
  6363. "%d, got %" PRIu64,
  6364. fip->field_name, (int)fip->field_readcount,
  6365. dp->tdir_count);
  6366. return (0);
  6367. }
  6368. else
  6369. {
  6370. err = TIFFReadDirEntrySbyteArray(tif, dp, &data);
  6371. if (err == TIFFReadDirEntryErrOk)
  6372. {
  6373. if (!EvaluateIFDdatasizeReading(tif, dp))
  6374. {
  6375. if (data != 0)
  6376. _TIFFfreeExt(tif, data);
  6377. return 0;
  6378. }
  6379. int m;
  6380. m = TIFFSetField(tif, dp->tdir_tag, data);
  6381. if (data != 0)
  6382. _TIFFfreeExt(tif, data);
  6383. if (!m)
  6384. return (0);
  6385. }
  6386. }
  6387. }
  6388. break;
  6389. case TIFF_SETGET_C0_UINT16:
  6390. {
  6391. uint16_t *data;
  6392. assert(fip->field_readcount >= 1);
  6393. assert(fip->field_passcount == 0);
  6394. if (dp->tdir_count != (uint64_t)fip->field_readcount)
  6395. {
  6396. TIFFWarningExtR(tif, module,
  6397. "incorrect count for field \"%s\", expected "
  6398. "%d, got %" PRIu64,
  6399. fip->field_name, (int)fip->field_readcount,
  6400. dp->tdir_count);
  6401. return (0);
  6402. }
  6403. else
  6404. {
  6405. err = TIFFReadDirEntryShortArray(tif, dp, &data);
  6406. if (err == TIFFReadDirEntryErrOk)
  6407. {
  6408. if (!EvaluateIFDdatasizeReading(tif, dp))
  6409. {
  6410. if (data != 0)
  6411. _TIFFfreeExt(tif, data);
  6412. return 0;
  6413. }
  6414. int m;
  6415. m = TIFFSetField(tif, dp->tdir_tag, data);
  6416. if (data != 0)
  6417. _TIFFfreeExt(tif, data);
  6418. if (!m)
  6419. return (0);
  6420. }
  6421. }
  6422. }
  6423. break;
  6424. case TIFF_SETGET_C0_SINT16:
  6425. {
  6426. int16_t *data;
  6427. assert(fip->field_readcount >= 1);
  6428. assert(fip->field_passcount == 0);
  6429. if (dp->tdir_count != (uint64_t)fip->field_readcount)
  6430. {
  6431. TIFFWarningExtR(tif, module,
  6432. "incorrect count for field \"%s\", expected "
  6433. "%d, got %" PRIu64,
  6434. fip->field_name, (int)fip->field_readcount,
  6435. dp->tdir_count);
  6436. return (0);
  6437. }
  6438. else
  6439. {
  6440. err = TIFFReadDirEntrySshortArray(tif, dp, &data);
  6441. if (err == TIFFReadDirEntryErrOk)
  6442. {
  6443. if (!EvaluateIFDdatasizeReading(tif, dp))
  6444. {
  6445. if (data != 0)
  6446. _TIFFfreeExt(tif, data);
  6447. return 0;
  6448. }
  6449. int m;
  6450. m = TIFFSetField(tif, dp->tdir_tag, data);
  6451. if (data != 0)
  6452. _TIFFfreeExt(tif, data);
  6453. if (!m)
  6454. return (0);
  6455. }
  6456. }
  6457. }
  6458. break;
  6459. case TIFF_SETGET_C0_UINT32:
  6460. {
  6461. uint32_t *data;
  6462. assert(fip->field_readcount >= 1);
  6463. assert(fip->field_passcount == 0);
  6464. if (dp->tdir_count != (uint64_t)fip->field_readcount)
  6465. {
  6466. TIFFWarningExtR(tif, module,
  6467. "incorrect count for field \"%s\", expected "
  6468. "%d, got %" PRIu64,
  6469. fip->field_name, (int)fip->field_readcount,
  6470. dp->tdir_count);
  6471. return (0);
  6472. }
  6473. else
  6474. {
  6475. err = TIFFReadDirEntryLongArray(tif, dp, &data);
  6476. if (err == TIFFReadDirEntryErrOk)
  6477. {
  6478. if (!EvaluateIFDdatasizeReading(tif, dp))
  6479. {
  6480. if (data != 0)
  6481. _TIFFfreeExt(tif, data);
  6482. return 0;
  6483. }
  6484. int m;
  6485. m = TIFFSetField(tif, dp->tdir_tag, data);
  6486. if (data != 0)
  6487. _TIFFfreeExt(tif, data);
  6488. if (!m)
  6489. return (0);
  6490. }
  6491. }
  6492. }
  6493. break;
  6494. case TIFF_SETGET_C0_SINT32:
  6495. {
  6496. int32_t *data;
  6497. assert(fip->field_readcount >= 1);
  6498. assert(fip->field_passcount == 0);
  6499. if (dp->tdir_count != (uint64_t)fip->field_readcount)
  6500. {
  6501. TIFFWarningExtR(tif, module,
  6502. "incorrect count for field \"%s\", expected "
  6503. "%d, got %" PRIu64,
  6504. fip->field_name, (int)fip->field_readcount,
  6505. dp->tdir_count);
  6506. return (0);
  6507. }
  6508. else
  6509. {
  6510. err = TIFFReadDirEntrySlongArray(tif, dp, &data);
  6511. if (err == TIFFReadDirEntryErrOk)
  6512. {
  6513. if (!EvaluateIFDdatasizeReading(tif, dp))
  6514. {
  6515. if (data != 0)
  6516. _TIFFfreeExt(tif, data);
  6517. return 0;
  6518. }
  6519. int m;
  6520. m = TIFFSetField(tif, dp->tdir_tag, data);
  6521. if (data != 0)
  6522. _TIFFfreeExt(tif, data);
  6523. if (!m)
  6524. return (0);
  6525. }
  6526. }
  6527. }
  6528. break;
  6529. case TIFF_SETGET_C0_UINT64:
  6530. {
  6531. uint64_t *data;
  6532. assert(fip->field_readcount >= 1);
  6533. assert(fip->field_passcount == 0);
  6534. if (dp->tdir_count != (uint64_t)fip->field_readcount)
  6535. {
  6536. TIFFWarningExtR(tif, module,
  6537. "incorrect count for field \"%s\", expected "
  6538. "%d, got %" PRIu64,
  6539. fip->field_name, (int)fip->field_readcount,
  6540. dp->tdir_count);
  6541. return (0);
  6542. }
  6543. else
  6544. {
  6545. err = TIFFReadDirEntryLong8Array(tif, dp, &data);
  6546. if (err == TIFFReadDirEntryErrOk)
  6547. {
  6548. if (!EvaluateIFDdatasizeReading(tif, dp))
  6549. {
  6550. if (data != 0)
  6551. _TIFFfreeExt(tif, data);
  6552. return 0;
  6553. }
  6554. int m;
  6555. m = TIFFSetField(tif, dp->tdir_tag, data);
  6556. if (data != 0)
  6557. _TIFFfreeExt(tif, data);
  6558. if (!m)
  6559. return (0);
  6560. }
  6561. }
  6562. }
  6563. break;
  6564. case TIFF_SETGET_C0_SINT64:
  6565. {
  6566. int64_t *data;
  6567. assert(fip->field_readcount >= 1);
  6568. assert(fip->field_passcount == 0);
  6569. if (dp->tdir_count != (uint64_t)fip->field_readcount)
  6570. {
  6571. TIFFWarningExtR(tif, module,
  6572. "incorrect count for field \"%s\", expected "
  6573. "%d, got %" PRIu64,
  6574. fip->field_name, (int)fip->field_readcount,
  6575. dp->tdir_count);
  6576. return (0);
  6577. }
  6578. else
  6579. {
  6580. err = TIFFReadDirEntrySlong8Array(tif, dp, &data);
  6581. if (err == TIFFReadDirEntryErrOk)
  6582. {
  6583. if (!EvaluateIFDdatasizeReading(tif, dp))
  6584. {
  6585. if (data != 0)
  6586. _TIFFfreeExt(tif, data);
  6587. return 0;
  6588. }
  6589. int m;
  6590. m = TIFFSetField(tif, dp->tdir_tag, data);
  6591. if (data != 0)
  6592. _TIFFfreeExt(tif, data);
  6593. if (!m)
  6594. return (0);
  6595. }
  6596. }
  6597. }
  6598. break;
  6599. case TIFF_SETGET_C0_FLOAT:
  6600. {
  6601. float *data;
  6602. assert(fip->field_readcount >= 1);
  6603. assert(fip->field_passcount == 0);
  6604. if (dp->tdir_count != (uint64_t)fip->field_readcount)
  6605. {
  6606. TIFFWarningExtR(tif, module,
  6607. "incorrect count for field \"%s\", expected "
  6608. "%d, got %" PRIu64,
  6609. fip->field_name, (int)fip->field_readcount,
  6610. dp->tdir_count);
  6611. return (0);
  6612. }
  6613. else
  6614. {
  6615. err = TIFFReadDirEntryFloatArray(tif, dp, &data);
  6616. if (err == TIFFReadDirEntryErrOk)
  6617. {
  6618. if (!EvaluateIFDdatasizeReading(tif, dp))
  6619. {
  6620. if (data != 0)
  6621. _TIFFfreeExt(tif, data);
  6622. return 0;
  6623. }
  6624. int m;
  6625. m = TIFFSetField(tif, dp->tdir_tag, data);
  6626. if (data != 0)
  6627. _TIFFfreeExt(tif, data);
  6628. if (!m)
  6629. return (0);
  6630. }
  6631. }
  6632. }
  6633. break;
  6634. /*--: Rational2Double: Extend for Double Arrays and Rational-Arrays read
  6635. * into Double-Arrays. */
  6636. case TIFF_SETGET_C0_DOUBLE:
  6637. {
  6638. double *data;
  6639. assert(fip->field_readcount >= 1);
  6640. assert(fip->field_passcount == 0);
  6641. if (dp->tdir_count != (uint64_t)fip->field_readcount)
  6642. {
  6643. TIFFWarningExtR(tif, module,
  6644. "incorrect count for field \"%s\", expected "
  6645. "%d, got %" PRIu64,
  6646. fip->field_name, (int)fip->field_readcount,
  6647. dp->tdir_count);
  6648. return (0);
  6649. }
  6650. else
  6651. {
  6652. err = TIFFReadDirEntryDoubleArray(tif, dp, &data);
  6653. if (err == TIFFReadDirEntryErrOk)
  6654. {
  6655. if (!EvaluateIFDdatasizeReading(tif, dp))
  6656. {
  6657. if (data != 0)
  6658. _TIFFfreeExt(tif, data);
  6659. return 0;
  6660. }
  6661. int m;
  6662. m = TIFFSetField(tif, dp->tdir_tag, data);
  6663. if (data != 0)
  6664. _TIFFfreeExt(tif, data);
  6665. if (!m)
  6666. return (0);
  6667. }
  6668. }
  6669. }
  6670. break;
  6671. case TIFF_SETGET_C16_ASCII:
  6672. {
  6673. uint8_t *data;
  6674. assert(fip->field_readcount == TIFF_VARIABLE);
  6675. assert(fip->field_passcount == 1);
  6676. if (dp->tdir_count > 0xFFFF)
  6677. err = TIFFReadDirEntryErrCount;
  6678. else
  6679. {
  6680. err = TIFFReadDirEntryByteArray(tif, dp, &data);
  6681. if (err == TIFFReadDirEntryErrOk)
  6682. {
  6683. if (!EvaluateIFDdatasizeReading(tif, dp))
  6684. {
  6685. if (data != 0)
  6686. _TIFFfreeExt(tif, data);
  6687. return 0;
  6688. }
  6689. int m;
  6690. if (data != 0 && dp->tdir_count > 0 &&
  6691. data[dp->tdir_count - 1] != '\0')
  6692. {
  6693. TIFFWarningExtR(tif, module,
  6694. "ASCII value for ASCII array tag "
  6695. "\"%s\" does not end in null "
  6696. "byte. Forcing it to be null",
  6697. fip->field_name);
  6698. /* Enlarge buffer and add terminating null. */
  6699. uint8_t *o =
  6700. _TIFFmallocExt(tif, (uint32_t)dp->tdir_count + 1);
  6701. if (o == NULL)
  6702. {
  6703. if (data != NULL)
  6704. _TIFFfreeExt(tif, data);
  6705. return (0);
  6706. }
  6707. if (dp->tdir_count > 0)
  6708. {
  6709. _TIFFmemcpy(o, data, (uint32_t)dp->tdir_count);
  6710. }
  6711. o[(uint32_t)dp->tdir_count] = 0;
  6712. dp->tdir_count++; /* Increment for added null. */
  6713. if (data != 0)
  6714. _TIFFfreeExt(tif, data);
  6715. data = o;
  6716. }
  6717. m = TIFFSetField(tif, dp->tdir_tag,
  6718. (uint16_t)(dp->tdir_count), data);
  6719. if (data != 0)
  6720. _TIFFfreeExt(tif, data);
  6721. if (!m)
  6722. return (0);
  6723. }
  6724. }
  6725. }
  6726. break;
  6727. case TIFF_SETGET_C16_UINT8:
  6728. {
  6729. uint8_t *data;
  6730. assert(fip->field_readcount == TIFF_VARIABLE);
  6731. assert(fip->field_passcount == 1);
  6732. if (dp->tdir_count > 0xFFFF)
  6733. err = TIFFReadDirEntryErrCount;
  6734. else
  6735. {
  6736. err = TIFFReadDirEntryByteArray(tif, dp, &data);
  6737. if (err == TIFFReadDirEntryErrOk)
  6738. {
  6739. if (!EvaluateIFDdatasizeReading(tif, dp))
  6740. {
  6741. if (data != 0)
  6742. _TIFFfreeExt(tif, data);
  6743. return 0;
  6744. }
  6745. int m;
  6746. m = TIFFSetField(tif, dp->tdir_tag,
  6747. (uint16_t)(dp->tdir_count), data);
  6748. if (data != 0)
  6749. _TIFFfreeExt(tif, data);
  6750. if (!m)
  6751. return (0);
  6752. }
  6753. }
  6754. }
  6755. break;
  6756. case TIFF_SETGET_C16_SINT8:
  6757. {
  6758. int8_t *data;
  6759. assert(fip->field_readcount == TIFF_VARIABLE);
  6760. assert(fip->field_passcount == 1);
  6761. if (dp->tdir_count > 0xFFFF)
  6762. err = TIFFReadDirEntryErrCount;
  6763. else
  6764. {
  6765. err = TIFFReadDirEntrySbyteArray(tif, dp, &data);
  6766. if (err == TIFFReadDirEntryErrOk)
  6767. {
  6768. if (!EvaluateIFDdatasizeReading(tif, dp))
  6769. {
  6770. if (data != 0)
  6771. _TIFFfreeExt(tif, data);
  6772. return 0;
  6773. }
  6774. int m;
  6775. m = TIFFSetField(tif, dp->tdir_tag,
  6776. (uint16_t)(dp->tdir_count), data);
  6777. if (data != 0)
  6778. _TIFFfreeExt(tif, data);
  6779. if (!m)
  6780. return (0);
  6781. }
  6782. }
  6783. }
  6784. break;
  6785. case TIFF_SETGET_C16_UINT16:
  6786. {
  6787. uint16_t *data;
  6788. assert(fip->field_readcount == TIFF_VARIABLE);
  6789. assert(fip->field_passcount == 1);
  6790. if (dp->tdir_count > 0xFFFF)
  6791. err = TIFFReadDirEntryErrCount;
  6792. else
  6793. {
  6794. err = TIFFReadDirEntryShortArray(tif, dp, &data);
  6795. if (err == TIFFReadDirEntryErrOk)
  6796. {
  6797. if (!EvaluateIFDdatasizeReading(tif, dp))
  6798. {
  6799. if (data != 0)
  6800. _TIFFfreeExt(tif, data);
  6801. return 0;
  6802. }
  6803. int m;
  6804. m = TIFFSetField(tif, dp->tdir_tag,
  6805. (uint16_t)(dp->tdir_count), data);
  6806. if (data != 0)
  6807. _TIFFfreeExt(tif, data);
  6808. if (!m)
  6809. return (0);
  6810. }
  6811. }
  6812. }
  6813. break;
  6814. case TIFF_SETGET_C16_SINT16:
  6815. {
  6816. int16_t *data;
  6817. assert(fip->field_readcount == TIFF_VARIABLE);
  6818. assert(fip->field_passcount == 1);
  6819. if (dp->tdir_count > 0xFFFF)
  6820. err = TIFFReadDirEntryErrCount;
  6821. else
  6822. {
  6823. err = TIFFReadDirEntrySshortArray(tif, dp, &data);
  6824. if (err == TIFFReadDirEntryErrOk)
  6825. {
  6826. if (!EvaluateIFDdatasizeReading(tif, dp))
  6827. {
  6828. if (data != 0)
  6829. _TIFFfreeExt(tif, data);
  6830. return 0;
  6831. }
  6832. int m;
  6833. m = TIFFSetField(tif, dp->tdir_tag,
  6834. (uint16_t)(dp->tdir_count), data);
  6835. if (data != 0)
  6836. _TIFFfreeExt(tif, data);
  6837. if (!m)
  6838. return (0);
  6839. }
  6840. }
  6841. }
  6842. break;
  6843. case TIFF_SETGET_C16_UINT32:
  6844. {
  6845. uint32_t *data;
  6846. assert(fip->field_readcount == TIFF_VARIABLE);
  6847. assert(fip->field_passcount == 1);
  6848. if (dp->tdir_count > 0xFFFF)
  6849. err = TIFFReadDirEntryErrCount;
  6850. else
  6851. {
  6852. err = TIFFReadDirEntryLongArray(tif, dp, &data);
  6853. if (err == TIFFReadDirEntryErrOk)
  6854. {
  6855. if (!EvaluateIFDdatasizeReading(tif, dp))
  6856. {
  6857. if (data != 0)
  6858. _TIFFfreeExt(tif, data);
  6859. return 0;
  6860. }
  6861. int m;
  6862. m = TIFFSetField(tif, dp->tdir_tag,
  6863. (uint16_t)(dp->tdir_count), data);
  6864. if (data != 0)
  6865. _TIFFfreeExt(tif, data);
  6866. if (!m)
  6867. return (0);
  6868. }
  6869. }
  6870. }
  6871. break;
  6872. case TIFF_SETGET_C16_SINT32:
  6873. {
  6874. int32_t *data;
  6875. assert(fip->field_readcount == TIFF_VARIABLE);
  6876. assert(fip->field_passcount == 1);
  6877. if (dp->tdir_count > 0xFFFF)
  6878. err = TIFFReadDirEntryErrCount;
  6879. else
  6880. {
  6881. err = TIFFReadDirEntrySlongArray(tif, dp, &data);
  6882. if (err == TIFFReadDirEntryErrOk)
  6883. {
  6884. if (!EvaluateIFDdatasizeReading(tif, dp))
  6885. {
  6886. if (data != 0)
  6887. _TIFFfreeExt(tif, data);
  6888. return 0;
  6889. }
  6890. int m;
  6891. m = TIFFSetField(tif, dp->tdir_tag,
  6892. (uint16_t)(dp->tdir_count), data);
  6893. if (data != 0)
  6894. _TIFFfreeExt(tif, data);
  6895. if (!m)
  6896. return (0);
  6897. }
  6898. }
  6899. }
  6900. break;
  6901. case TIFF_SETGET_C16_UINT64:
  6902. {
  6903. uint64_t *data;
  6904. assert(fip->field_readcount == TIFF_VARIABLE);
  6905. assert(fip->field_passcount == 1);
  6906. if (dp->tdir_count > 0xFFFF)
  6907. err = TIFFReadDirEntryErrCount;
  6908. else
  6909. {
  6910. err = TIFFReadDirEntryLong8Array(tif, dp, &data);
  6911. if (err == TIFFReadDirEntryErrOk)
  6912. {
  6913. if (!EvaluateIFDdatasizeReading(tif, dp))
  6914. {
  6915. if (data != 0)
  6916. _TIFFfreeExt(tif, data);
  6917. return 0;
  6918. }
  6919. int m;
  6920. m = TIFFSetField(tif, dp->tdir_tag,
  6921. (uint16_t)(dp->tdir_count), data);
  6922. if (data != 0)
  6923. _TIFFfreeExt(tif, data);
  6924. if (!m)
  6925. return (0);
  6926. }
  6927. }
  6928. }
  6929. break;
  6930. case TIFF_SETGET_C16_SINT64:
  6931. {
  6932. int64_t *data;
  6933. assert(fip->field_readcount == TIFF_VARIABLE);
  6934. assert(fip->field_passcount == 1);
  6935. if (dp->tdir_count > 0xFFFF)
  6936. err = TIFFReadDirEntryErrCount;
  6937. else
  6938. {
  6939. err = TIFFReadDirEntrySlong8Array(tif, dp, &data);
  6940. if (err == TIFFReadDirEntryErrOk)
  6941. {
  6942. if (!EvaluateIFDdatasizeReading(tif, dp))
  6943. {
  6944. if (data != 0)
  6945. _TIFFfreeExt(tif, data);
  6946. return 0;
  6947. }
  6948. int m;
  6949. m = TIFFSetField(tif, dp->tdir_tag,
  6950. (uint16_t)(dp->tdir_count), data);
  6951. if (data != 0)
  6952. _TIFFfreeExt(tif, data);
  6953. if (!m)
  6954. return (0);
  6955. }
  6956. }
  6957. }
  6958. break;
  6959. case TIFF_SETGET_C16_FLOAT:
  6960. {
  6961. float *data;
  6962. assert(fip->field_readcount == TIFF_VARIABLE);
  6963. assert(fip->field_passcount == 1);
  6964. if (dp->tdir_count > 0xFFFF)
  6965. err = TIFFReadDirEntryErrCount;
  6966. else
  6967. {
  6968. err = TIFFReadDirEntryFloatArray(tif, dp, &data);
  6969. if (err == TIFFReadDirEntryErrOk)
  6970. {
  6971. if (!EvaluateIFDdatasizeReading(tif, dp))
  6972. {
  6973. if (data != 0)
  6974. _TIFFfreeExt(tif, data);
  6975. return 0;
  6976. }
  6977. int m;
  6978. m = TIFFSetField(tif, dp->tdir_tag,
  6979. (uint16_t)(dp->tdir_count), data);
  6980. if (data != 0)
  6981. _TIFFfreeExt(tif, data);
  6982. if (!m)
  6983. return (0);
  6984. }
  6985. }
  6986. }
  6987. break;
  6988. case TIFF_SETGET_C16_DOUBLE:
  6989. {
  6990. double *data;
  6991. assert(fip->field_readcount == TIFF_VARIABLE);
  6992. assert(fip->field_passcount == 1);
  6993. if (dp->tdir_count > 0xFFFF)
  6994. err = TIFFReadDirEntryErrCount;
  6995. else
  6996. {
  6997. err = TIFFReadDirEntryDoubleArray(tif, dp, &data);
  6998. if (err == TIFFReadDirEntryErrOk)
  6999. {
  7000. if (!EvaluateIFDdatasizeReading(tif, dp))
  7001. {
  7002. if (data != 0)
  7003. _TIFFfreeExt(tif, data);
  7004. return 0;
  7005. }
  7006. int m;
  7007. m = TIFFSetField(tif, dp->tdir_tag,
  7008. (uint16_t)(dp->tdir_count), data);
  7009. if (data != 0)
  7010. _TIFFfreeExt(tif, data);
  7011. if (!m)
  7012. return (0);
  7013. }
  7014. }
  7015. }
  7016. break;
  7017. case TIFF_SETGET_C16_IFD8:
  7018. {
  7019. uint64_t *data;
  7020. assert(fip->field_readcount == TIFF_VARIABLE);
  7021. assert(fip->field_passcount == 1);
  7022. if (dp->tdir_count > 0xFFFF)
  7023. err = TIFFReadDirEntryErrCount;
  7024. else
  7025. {
  7026. err = TIFFReadDirEntryIfd8Array(tif, dp, &data);
  7027. if (err == TIFFReadDirEntryErrOk)
  7028. {
  7029. if (!EvaluateIFDdatasizeReading(tif, dp))
  7030. {
  7031. if (data != 0)
  7032. _TIFFfreeExt(tif, data);
  7033. return 0;
  7034. }
  7035. int m;
  7036. m = TIFFSetField(tif, dp->tdir_tag,
  7037. (uint16_t)(dp->tdir_count), data);
  7038. if (data != 0)
  7039. _TIFFfreeExt(tif, data);
  7040. if (!m)
  7041. return (0);
  7042. }
  7043. }
  7044. }
  7045. break;
  7046. case TIFF_SETGET_C32_ASCII:
  7047. {
  7048. uint8_t *data;
  7049. assert(fip->field_readcount == TIFF_VARIABLE2);
  7050. assert(fip->field_passcount == 1);
  7051. err = TIFFReadDirEntryByteArray(tif, dp, &data);
  7052. if (err == TIFFReadDirEntryErrOk)
  7053. {
  7054. if (!EvaluateIFDdatasizeReading(tif, dp))
  7055. {
  7056. if (data != 0)
  7057. _TIFFfreeExt(tif, data);
  7058. return 0;
  7059. }
  7060. int m;
  7061. if (data != 0 && dp->tdir_count > 0 &&
  7062. data[dp->tdir_count - 1] != '\0')
  7063. {
  7064. TIFFWarningExtR(
  7065. tif, module,
  7066. "ASCII value for ASCII array tag \"%s\" does not end "
  7067. "in null byte. Forcing it to be null",
  7068. fip->field_name);
  7069. /* Enlarge buffer and add terminating null. */
  7070. uint8_t *o =
  7071. _TIFFmallocExt(tif, (uint32_t)dp->tdir_count + 1);
  7072. if (o == NULL)
  7073. {
  7074. if (data != NULL)
  7075. _TIFFfreeExt(tif, data);
  7076. return (0);
  7077. }
  7078. if (dp->tdir_count > 0)
  7079. {
  7080. _TIFFmemcpy(o, data, (uint32_t)dp->tdir_count);
  7081. }
  7082. o[(uint32_t)dp->tdir_count] = 0;
  7083. dp->tdir_count++; /* Increment for added null. */
  7084. if (data != 0)
  7085. _TIFFfreeExt(tif, data);
  7086. data = o;
  7087. }
  7088. m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
  7089. data);
  7090. if (data != 0)
  7091. _TIFFfreeExt(tif, data);
  7092. if (!m)
  7093. return (0);
  7094. }
  7095. }
  7096. break;
  7097. case TIFF_SETGET_C32_UINT8:
  7098. {
  7099. uint8_t *data;
  7100. uint32_t count = 0;
  7101. assert(fip->field_readcount == TIFF_VARIABLE2);
  7102. assert(fip->field_passcount == 1);
  7103. if (fip->field_tag == TIFFTAG_RICHTIFFIPTC &&
  7104. dp->tdir_type == TIFF_LONG)
  7105. {
  7106. /* Adobe's software (wrongly) writes RichTIFFIPTC tag with
  7107. * data type LONG instead of UNDEFINED. Work around this
  7108. * frequently found issue */
  7109. void *origdata;
  7110. err = TIFFReadDirEntryArray(tif, dp, &count, 4, &origdata);
  7111. if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
  7112. {
  7113. data = NULL;
  7114. }
  7115. else
  7116. {
  7117. if (tif->tif_flags & TIFF_SWAB)
  7118. TIFFSwabArrayOfLong((uint32_t *)origdata, count);
  7119. data = (uint8_t *)origdata;
  7120. count = (uint32_t)(count * 4);
  7121. }
  7122. }
  7123. else
  7124. {
  7125. err = TIFFReadDirEntryByteArray(tif, dp, &data);
  7126. count = (uint32_t)(dp->tdir_count);
  7127. }
  7128. if (err == TIFFReadDirEntryErrOk)
  7129. {
  7130. if (!EvaluateIFDdatasizeReading(tif, dp))
  7131. {
  7132. if (data != 0)
  7133. _TIFFfreeExt(tif, data);
  7134. return 0;
  7135. }
  7136. int m;
  7137. m = TIFFSetField(tif, dp->tdir_tag, count, data);
  7138. if (data != 0)
  7139. _TIFFfreeExt(tif, data);
  7140. if (!m)
  7141. return (0);
  7142. }
  7143. }
  7144. break;
  7145. case TIFF_SETGET_C32_SINT8:
  7146. {
  7147. int8_t *data = NULL;
  7148. assert(fip->field_readcount == TIFF_VARIABLE2);
  7149. assert(fip->field_passcount == 1);
  7150. err = TIFFReadDirEntrySbyteArray(tif, dp, &data);
  7151. if (err == TIFFReadDirEntryErrOk)
  7152. {
  7153. if (!EvaluateIFDdatasizeReading(tif, dp))
  7154. {
  7155. if (data != 0)
  7156. _TIFFfreeExt(tif, data);
  7157. return 0;
  7158. }
  7159. int m;
  7160. m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
  7161. data);
  7162. if (data != 0)
  7163. _TIFFfreeExt(tif, data);
  7164. if (!m)
  7165. return (0);
  7166. }
  7167. }
  7168. break;
  7169. case TIFF_SETGET_C32_UINT16:
  7170. {
  7171. uint16_t *data;
  7172. assert(fip->field_readcount == TIFF_VARIABLE2);
  7173. assert(fip->field_passcount == 1);
  7174. err = TIFFReadDirEntryShortArray(tif, dp, &data);
  7175. if (err == TIFFReadDirEntryErrOk)
  7176. {
  7177. if (!EvaluateIFDdatasizeReading(tif, dp))
  7178. {
  7179. if (data != 0)
  7180. _TIFFfreeExt(tif, data);
  7181. return 0;
  7182. }
  7183. int m;
  7184. m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
  7185. data);
  7186. if (data != 0)
  7187. _TIFFfreeExt(tif, data);
  7188. if (!m)
  7189. return (0);
  7190. }
  7191. }
  7192. break;
  7193. case TIFF_SETGET_C32_SINT16:
  7194. {
  7195. int16_t *data = NULL;
  7196. assert(fip->field_readcount == TIFF_VARIABLE2);
  7197. assert(fip->field_passcount == 1);
  7198. err = TIFFReadDirEntrySshortArray(tif, dp, &data);
  7199. if (err == TIFFReadDirEntryErrOk)
  7200. {
  7201. if (!EvaluateIFDdatasizeReading(tif, dp))
  7202. {
  7203. if (data != 0)
  7204. _TIFFfreeExt(tif, data);
  7205. return 0;
  7206. }
  7207. int m;
  7208. m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
  7209. data);
  7210. if (data != 0)
  7211. _TIFFfreeExt(tif, data);
  7212. if (!m)
  7213. return (0);
  7214. }
  7215. }
  7216. break;
  7217. case TIFF_SETGET_C32_UINT32:
  7218. {
  7219. uint32_t *data;
  7220. assert(fip->field_readcount == TIFF_VARIABLE2);
  7221. assert(fip->field_passcount == 1);
  7222. err = TIFFReadDirEntryLongArray(tif, dp, &data);
  7223. if (err == TIFFReadDirEntryErrOk)
  7224. {
  7225. if (!EvaluateIFDdatasizeReading(tif, dp))
  7226. {
  7227. if (data != 0)
  7228. _TIFFfreeExt(tif, data);
  7229. return 0;
  7230. }
  7231. int m;
  7232. m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
  7233. data);
  7234. if (data != 0)
  7235. _TIFFfreeExt(tif, data);
  7236. if (!m)
  7237. return (0);
  7238. }
  7239. }
  7240. break;
  7241. case TIFF_SETGET_C32_SINT32:
  7242. {
  7243. int32_t *data = NULL;
  7244. assert(fip->field_readcount == TIFF_VARIABLE2);
  7245. assert(fip->field_passcount == 1);
  7246. err = TIFFReadDirEntrySlongArray(tif, dp, &data);
  7247. if (err == TIFFReadDirEntryErrOk)
  7248. {
  7249. if (!EvaluateIFDdatasizeReading(tif, dp))
  7250. {
  7251. if (data != 0)
  7252. _TIFFfreeExt(tif, data);
  7253. return 0;
  7254. }
  7255. int m;
  7256. m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
  7257. data);
  7258. if (data != 0)
  7259. _TIFFfreeExt(tif, data);
  7260. if (!m)
  7261. return (0);
  7262. }
  7263. }
  7264. break;
  7265. case TIFF_SETGET_C32_UINT64:
  7266. {
  7267. uint64_t *data;
  7268. assert(fip->field_readcount == TIFF_VARIABLE2);
  7269. assert(fip->field_passcount == 1);
  7270. err = TIFFReadDirEntryLong8Array(tif, dp, &data);
  7271. if (err == TIFFReadDirEntryErrOk)
  7272. {
  7273. if (!EvaluateIFDdatasizeReading(tif, dp))
  7274. {
  7275. if (data != 0)
  7276. _TIFFfreeExt(tif, data);
  7277. return 0;
  7278. }
  7279. int m;
  7280. m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
  7281. data);
  7282. if (data != 0)
  7283. _TIFFfreeExt(tif, data);
  7284. if (!m)
  7285. return (0);
  7286. }
  7287. }
  7288. break;
  7289. case TIFF_SETGET_C32_SINT64:
  7290. {
  7291. int64_t *data = NULL;
  7292. assert(fip->field_readcount == TIFF_VARIABLE2);
  7293. assert(fip->field_passcount == 1);
  7294. err = TIFFReadDirEntrySlong8Array(tif, dp, &data);
  7295. if (err == TIFFReadDirEntryErrOk)
  7296. {
  7297. if (!EvaluateIFDdatasizeReading(tif, dp))
  7298. {
  7299. if (data != 0)
  7300. _TIFFfreeExt(tif, data);
  7301. return 0;
  7302. }
  7303. int m;
  7304. m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
  7305. data);
  7306. if (data != 0)
  7307. _TIFFfreeExt(tif, data);
  7308. if (!m)
  7309. return (0);
  7310. }
  7311. }
  7312. break;
  7313. case TIFF_SETGET_C32_FLOAT:
  7314. {
  7315. float *data;
  7316. assert(fip->field_readcount == TIFF_VARIABLE2);
  7317. assert(fip->field_passcount == 1);
  7318. err = TIFFReadDirEntryFloatArray(tif, dp, &data);
  7319. if (err == TIFFReadDirEntryErrOk)
  7320. {
  7321. if (!EvaluateIFDdatasizeReading(tif, dp))
  7322. {
  7323. if (data != 0)
  7324. _TIFFfreeExt(tif, data);
  7325. return 0;
  7326. }
  7327. int m;
  7328. m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
  7329. data);
  7330. if (data != 0)
  7331. _TIFFfreeExt(tif, data);
  7332. if (!m)
  7333. return (0);
  7334. }
  7335. }
  7336. break;
  7337. case TIFF_SETGET_C32_DOUBLE:
  7338. {
  7339. double *data;
  7340. assert(fip->field_readcount == TIFF_VARIABLE2);
  7341. assert(fip->field_passcount == 1);
  7342. err = TIFFReadDirEntryDoubleArray(tif, dp, &data);
  7343. if (err == TIFFReadDirEntryErrOk)
  7344. {
  7345. if (!EvaluateIFDdatasizeReading(tif, dp))
  7346. {
  7347. if (data != 0)
  7348. _TIFFfreeExt(tif, data);
  7349. return 0;
  7350. }
  7351. int m;
  7352. m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
  7353. data);
  7354. if (data != 0)
  7355. _TIFFfreeExt(tif, data);
  7356. if (!m)
  7357. return (0);
  7358. }
  7359. }
  7360. break;
  7361. case TIFF_SETGET_C32_IFD8:
  7362. {
  7363. uint64_t *data;
  7364. assert(fip->field_readcount == TIFF_VARIABLE2);
  7365. assert(fip->field_passcount == 1);
  7366. err = TIFFReadDirEntryIfd8Array(tif, dp, &data);
  7367. if (err == TIFFReadDirEntryErrOk)
  7368. {
  7369. if (!EvaluateIFDdatasizeReading(tif, dp))
  7370. {
  7371. if (data != 0)
  7372. _TIFFfreeExt(tif, data);
  7373. return 0;
  7374. }
  7375. int m;
  7376. m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
  7377. data);
  7378. if (data != 0)
  7379. _TIFFfreeExt(tif, data);
  7380. if (!m)
  7381. return (0);
  7382. }
  7383. }
  7384. break;
  7385. default:
  7386. assert(0); /* we should never get here */
  7387. break;
  7388. }
  7389. if (err != TIFFReadDirEntryErrOk)
  7390. {
  7391. TIFFReadDirEntryOutputErr(tif, err, module, fip->field_name, recover);
  7392. return (0);
  7393. }
  7394. return (1);
  7395. }
  7396. /*
  7397. * Fetch a set of offsets or lengths.
  7398. * While this routine says "strips", in fact it's also used for tiles.
  7399. */
  7400. static int TIFFFetchStripThing(TIFF *tif, TIFFDirEntry *dir, uint32_t nstrips,
  7401. uint64_t **lpp)
  7402. {
  7403. static const char module[] = "TIFFFetchStripThing";
  7404. enum TIFFReadDirEntryErr err;
  7405. uint64_t *data;
  7406. err = TIFFReadDirEntryLong8ArrayWithLimit(tif, dir, &data, nstrips);
  7407. if (err != TIFFReadDirEntryErrOk)
  7408. {
  7409. const TIFFField *fip = TIFFFieldWithTag(tif, dir->tdir_tag);
  7410. TIFFReadDirEntryOutputErr(tif, err, module,
  7411. fip ? fip->field_name : "unknown tagname", 0);
  7412. return (0);
  7413. }
  7414. if (dir->tdir_count < (uint64_t)nstrips)
  7415. {
  7416. uint64_t *resizeddata;
  7417. const TIFFField *fip = TIFFFieldWithTag(tif, dir->tdir_tag);
  7418. const char *pszMax = getenv("LIBTIFF_STRILE_ARRAY_MAX_RESIZE_COUNT");
  7419. uint32_t max_nstrips = 1000000;
  7420. if (pszMax)
  7421. max_nstrips = (uint32_t)atoi(pszMax);
  7422. TIFFReadDirEntryOutputErr(tif, TIFFReadDirEntryErrCount, module,
  7423. fip ? fip->field_name : "unknown tagname",
  7424. (nstrips <= max_nstrips));
  7425. if (nstrips > max_nstrips)
  7426. {
  7427. _TIFFfreeExt(tif, data);
  7428. return (0);
  7429. }
  7430. const uint64_t allocsize = (uint64_t)nstrips * sizeof(uint64_t);
  7431. if (allocsize > 100 * 1024 * 1024)
  7432. {
  7433. /* Before allocating a huge amount of memory for corrupted files,
  7434. * check if size of requested memory is not greater than file size.
  7435. */
  7436. const uint64_t filesize = TIFFGetFileSize(tif);
  7437. if (allocsize > filesize)
  7438. {
  7439. TIFFWarningExtR(
  7440. tif, module,
  7441. "Requested memory size for StripArray of %" PRIu64
  7442. " is greater than filesize %" PRIu64
  7443. ". Memory not allocated",
  7444. allocsize, filesize);
  7445. _TIFFfreeExt(tif, data);
  7446. return (0);
  7447. }
  7448. }
  7449. resizeddata = (uint64_t *)_TIFFCheckMalloc(
  7450. tif, nstrips, sizeof(uint64_t), "for strip array");
  7451. if (resizeddata == 0)
  7452. {
  7453. _TIFFfreeExt(tif, data);
  7454. return (0);
  7455. }
  7456. if (dir->tdir_count)
  7457. _TIFFmemcpy(resizeddata, data,
  7458. (uint32_t)dir->tdir_count * sizeof(uint64_t));
  7459. _TIFFmemset(resizeddata + (uint32_t)dir->tdir_count, 0,
  7460. (nstrips - (uint32_t)dir->tdir_count) * sizeof(uint64_t));
  7461. _TIFFfreeExt(tif, data);
  7462. data = resizeddata;
  7463. }
  7464. *lpp = data;
  7465. return (1);
  7466. }
  7467. /*
  7468. * Fetch and set the SubjectDistance EXIF tag.
  7469. */
  7470. static int TIFFFetchSubjectDistance(TIFF *tif, TIFFDirEntry *dir)
  7471. {
  7472. static const char module[] = "TIFFFetchSubjectDistance";
  7473. enum TIFFReadDirEntryErr err;
  7474. UInt64Aligned_t m;
  7475. m.l = 0;
  7476. assert(sizeof(double) == 8);
  7477. assert(sizeof(uint64_t) == 8);
  7478. assert(sizeof(uint32_t) == 4);
  7479. if (dir->tdir_count != 1)
  7480. err = TIFFReadDirEntryErrCount;
  7481. else if (dir->tdir_type != TIFF_RATIONAL)
  7482. err = TIFFReadDirEntryErrType;
  7483. else
  7484. {
  7485. if (!(tif->tif_flags & TIFF_BIGTIFF))
  7486. {
  7487. uint32_t offset;
  7488. offset = *(uint32_t *)(&dir->tdir_offset);
  7489. if (tif->tif_flags & TIFF_SWAB)
  7490. TIFFSwabLong(&offset);
  7491. err = TIFFReadDirEntryData(tif, offset, 8, m.i);
  7492. }
  7493. else
  7494. {
  7495. m.l = dir->tdir_offset.toff_long8;
  7496. err = TIFFReadDirEntryErrOk;
  7497. }
  7498. }
  7499. if (err == TIFFReadDirEntryErrOk)
  7500. {
  7501. double n;
  7502. if (tif->tif_flags & TIFF_SWAB)
  7503. TIFFSwabArrayOfLong(m.i, 2);
  7504. if (m.i[0] == 0)
  7505. n = 0.0;
  7506. else if (m.i[0] == 0xFFFFFFFF || m.i[1] == 0)
  7507. /*
  7508. * XXX: Numerator 0xFFFFFFFF means that we have infinite
  7509. * distance. Indicate that with a negative floating point
  7510. * SubjectDistance value.
  7511. */
  7512. n = -1.0;
  7513. else
  7514. n = (double)m.i[0] / (double)m.i[1];
  7515. return (TIFFSetField(tif, dir->tdir_tag, n));
  7516. }
  7517. else
  7518. {
  7519. TIFFReadDirEntryOutputErr(tif, err, module, "SubjectDistance", TRUE);
  7520. return (0);
  7521. }
  7522. }
  7523. static void allocChoppedUpStripArrays(TIFF *tif, uint32_t nstrips,
  7524. uint64_t stripbytes,
  7525. uint32_t rowsperstrip)
  7526. {
  7527. TIFFDirectory *td = &tif->tif_dir;
  7528. uint64_t bytecount;
  7529. uint64_t offset;
  7530. uint64_t last_offset;
  7531. uint64_t last_bytecount;
  7532. uint32_t i;
  7533. uint64_t *newcounts;
  7534. uint64_t *newoffsets;
  7535. offset = TIFFGetStrileOffset(tif, 0);
  7536. last_offset = TIFFGetStrileOffset(tif, td->td_nstrips - 1);
  7537. last_bytecount = TIFFGetStrileByteCount(tif, td->td_nstrips - 1);
  7538. if (last_offset > UINT64_MAX - last_bytecount ||
  7539. last_offset + last_bytecount < offset)
  7540. {
  7541. return;
  7542. }
  7543. bytecount = last_offset + last_bytecount - offset;
  7544. /* Before allocating a huge amount of memory for corrupted files, check if
  7545. * size of StripByteCount and StripOffset tags is not greater than
  7546. * file size.
  7547. */
  7548. const uint64_t allocsize = (uint64_t)nstrips * sizeof(uint64_t) * 2;
  7549. if (allocsize > 100 * 1024 * 1024)
  7550. {
  7551. const uint64_t filesize = TIFFGetFileSize(tif);
  7552. if (allocsize > filesize)
  7553. {
  7554. TIFFWarningExtR(tif, "allocChoppedUpStripArrays",
  7555. "Requested memory size for StripByteCount and "
  7556. "StripOffsets %" PRIu64
  7557. " is greater than filesize %" PRIu64
  7558. ". Memory not allocated",
  7559. allocsize, filesize);
  7560. return;
  7561. }
  7562. }
  7563. newcounts =
  7564. (uint64_t *)_TIFFCheckMalloc(tif, nstrips, sizeof(uint64_t),
  7565. "for chopped \"StripByteCounts\" array");
  7566. newoffsets = (uint64_t *)_TIFFCheckMalloc(
  7567. tif, nstrips, sizeof(uint64_t), "for chopped \"StripOffsets\" array");
  7568. if (newcounts == NULL || newoffsets == NULL)
  7569. {
  7570. /*
  7571. * Unable to allocate new strip information, give up and use
  7572. * the original one strip information.
  7573. */
  7574. if (newcounts != NULL)
  7575. _TIFFfreeExt(tif, newcounts);
  7576. if (newoffsets != NULL)
  7577. _TIFFfreeExt(tif, newoffsets);
  7578. return;
  7579. }
  7580. /*
  7581. * Fill the strip information arrays with new bytecounts and offsets
  7582. * that reflect the broken-up format.
  7583. */
  7584. for (i = 0; i < nstrips; i++)
  7585. {
  7586. if (stripbytes > bytecount)
  7587. stripbytes = bytecount;
  7588. newcounts[i] = stripbytes;
  7589. newoffsets[i] = stripbytes ? offset : 0;
  7590. offset += stripbytes;
  7591. bytecount -= stripbytes;
  7592. }
  7593. /*
  7594. * Replace old single strip info with multi-strip info.
  7595. */
  7596. td->td_stripsperimage = td->td_nstrips = nstrips;
  7597. TIFFSetField(tif, TIFFTAG_ROWSPERSTRIP, rowsperstrip);
  7598. _TIFFfreeExt(tif, td->td_stripbytecount_p);
  7599. _TIFFfreeExt(tif, td->td_stripoffset_p);
  7600. td->td_stripbytecount_p = newcounts;
  7601. td->td_stripoffset_p = newoffsets;
  7602. #ifdef STRIPBYTECOUNTSORTED_UNUSED
  7603. td->td_stripbytecountsorted = 1;
  7604. #endif
  7605. tif->tif_flags |= TIFF_CHOPPEDUPARRAYS;
  7606. }
  7607. /*
  7608. * Replace a single strip (tile) of uncompressed data by multiple strips
  7609. * (tiles), each approximately STRIP_SIZE_DEFAULT bytes. This is useful for
  7610. * dealing with large images or for dealing with machines with a limited
  7611. * amount memory.
  7612. */
  7613. static void ChopUpSingleUncompressedStrip(TIFF *tif)
  7614. {
  7615. register TIFFDirectory *td = &tif->tif_dir;
  7616. uint64_t bytecount;
  7617. uint64_t offset;
  7618. uint32_t rowblock;
  7619. uint64_t rowblockbytes;
  7620. uint64_t stripbytes;
  7621. uint32_t nstrips;
  7622. uint32_t rowsperstrip;
  7623. bytecount = TIFFGetStrileByteCount(tif, 0);
  7624. /* On a newly created file, just re-opened to be filled, we */
  7625. /* don't want strip chop to trigger as it is going to cause issues */
  7626. /* later ( StripOffsets and StripByteCounts improperly filled) . */
  7627. if (bytecount == 0 && tif->tif_mode != O_RDONLY)
  7628. return;
  7629. offset = TIFFGetStrileByteCount(tif, 0);
  7630. assert(td->td_planarconfig == PLANARCONFIG_CONTIG);
  7631. if ((td->td_photometric == PHOTOMETRIC_YCBCR) && (!isUpSampled(tif)))
  7632. rowblock = td->td_ycbcrsubsampling[1];
  7633. else
  7634. rowblock = 1;
  7635. rowblockbytes = TIFFVTileSize64(tif, rowblock);
  7636. /*
  7637. * Make the rows hold at least one scanline, but fill specified amount
  7638. * of data if possible.
  7639. */
  7640. if (rowblockbytes > STRIP_SIZE_DEFAULT)
  7641. {
  7642. stripbytes = rowblockbytes;
  7643. rowsperstrip = rowblock;
  7644. }
  7645. else if (rowblockbytes > 0)
  7646. {
  7647. uint32_t rowblocksperstrip;
  7648. rowblocksperstrip = (uint32_t)(STRIP_SIZE_DEFAULT / rowblockbytes);
  7649. rowsperstrip = rowblocksperstrip * rowblock;
  7650. stripbytes = rowblocksperstrip * rowblockbytes;
  7651. }
  7652. else
  7653. return;
  7654. /*
  7655. * never increase the number of rows per strip
  7656. */
  7657. if (rowsperstrip >= td->td_rowsperstrip || rowsperstrip == 0)
  7658. return;
  7659. nstrips = TIFFhowmany_32(td->td_imagelength, rowsperstrip);
  7660. if (nstrips == 0)
  7661. return;
  7662. /* If we are going to allocate a lot of memory, make sure that the */
  7663. /* file is as big as needed */
  7664. if (tif->tif_mode == O_RDONLY && nstrips > 1000000 &&
  7665. (offset >= TIFFGetFileSize(tif) ||
  7666. stripbytes > (TIFFGetFileSize(tif) - offset) / (nstrips - 1)))
  7667. {
  7668. return;
  7669. }
  7670. allocChoppedUpStripArrays(tif, nstrips, stripbytes, rowsperstrip);
  7671. }
  7672. /*
  7673. * Replace a file with contiguous strips > 2 GB of uncompressed data by
  7674. * multiple smaller strips. This is useful for
  7675. * dealing with large images or for dealing with machines with a limited
  7676. * amount memory.
  7677. */
  7678. static void TryChopUpUncompressedBigTiff(TIFF *tif)
  7679. {
  7680. TIFFDirectory *td = &tif->tif_dir;
  7681. uint32_t rowblock;
  7682. uint64_t rowblockbytes;
  7683. uint32_t i;
  7684. uint64_t stripsize;
  7685. uint32_t rowblocksperstrip;
  7686. uint32_t rowsperstrip;
  7687. uint64_t stripbytes;
  7688. uint32_t nstrips;
  7689. stripsize = TIFFStripSize64(tif);
  7690. assert(tif->tif_dir.td_planarconfig == PLANARCONFIG_CONTIG);
  7691. assert(tif->tif_dir.td_compression == COMPRESSION_NONE);
  7692. assert((tif->tif_flags & (TIFF_STRIPCHOP | TIFF_ISTILED)) ==
  7693. TIFF_STRIPCHOP);
  7694. assert(stripsize > 0x7FFFFFFFUL);
  7695. /* On a newly created file, just re-opened to be filled, we */
  7696. /* don't want strip chop to trigger as it is going to cause issues */
  7697. /* later ( StripOffsets and StripByteCounts improperly filled) . */
  7698. if (TIFFGetStrileByteCount(tif, 0) == 0 && tif->tif_mode != O_RDONLY)
  7699. return;
  7700. if ((td->td_photometric == PHOTOMETRIC_YCBCR) && (!isUpSampled(tif)))
  7701. rowblock = td->td_ycbcrsubsampling[1];
  7702. else
  7703. rowblock = 1;
  7704. rowblockbytes = TIFFVStripSize64(tif, rowblock);
  7705. if (rowblockbytes == 0 || rowblockbytes > 0x7FFFFFFFUL)
  7706. {
  7707. /* In case of file with gigantic width */
  7708. return;
  7709. }
  7710. /* Check that the strips are contiguous and of the expected size */
  7711. for (i = 0; i < td->td_nstrips; i++)
  7712. {
  7713. if (i == td->td_nstrips - 1)
  7714. {
  7715. if (TIFFGetStrileByteCount(tif, i) <
  7716. TIFFVStripSize64(tif,
  7717. td->td_imagelength - i * td->td_rowsperstrip))
  7718. {
  7719. return;
  7720. }
  7721. }
  7722. else
  7723. {
  7724. if (TIFFGetStrileByteCount(tif, i) != stripsize)
  7725. {
  7726. return;
  7727. }
  7728. if (i > 0 && TIFFGetStrileOffset(tif, i) !=
  7729. TIFFGetStrileOffset(tif, i - 1) +
  7730. TIFFGetStrileByteCount(tif, i - 1))
  7731. {
  7732. return;
  7733. }
  7734. }
  7735. }
  7736. /* Aim for 512 MB strips (that will still be manageable by 32 bit builds */
  7737. rowblocksperstrip = (uint32_t)(512 * 1024 * 1024 / rowblockbytes);
  7738. if (rowblocksperstrip == 0)
  7739. rowblocksperstrip = 1;
  7740. rowsperstrip = rowblocksperstrip * rowblock;
  7741. stripbytes = rowblocksperstrip * rowblockbytes;
  7742. assert(stripbytes <= 0x7FFFFFFFUL);
  7743. if (rowsperstrip == 0)
  7744. return;
  7745. nstrips = TIFFhowmany_32(td->td_imagelength, rowsperstrip);
  7746. if (nstrips == 0)
  7747. return;
  7748. /* If we are going to allocate a lot of memory, make sure that the */
  7749. /* file is as big as needed */
  7750. if (tif->tif_mode == O_RDONLY && nstrips > 1000000)
  7751. {
  7752. uint64_t last_offset = TIFFGetStrileOffset(tif, td->td_nstrips - 1);
  7753. uint64_t filesize = TIFFGetFileSize(tif);
  7754. uint64_t last_bytecount =
  7755. TIFFGetStrileByteCount(tif, td->td_nstrips - 1);
  7756. if (last_offset > filesize || last_bytecount > filesize - last_offset)
  7757. {
  7758. return;
  7759. }
  7760. }
  7761. allocChoppedUpStripArrays(tif, nstrips, stripbytes, rowsperstrip);
  7762. }
  7763. TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
  7764. static uint64_t _TIFFUnsanitizedAddUInt64AndInt(uint64_t a, int b)
  7765. {
  7766. return a + b;
  7767. }
  7768. /* Read the value of [Strip|Tile]Offset or [Strip|Tile]ByteCount around
  7769. * strip/tile of number strile. Also fetch the neighbouring values using a
  7770. * 4096 byte page size.
  7771. */
  7772. static int _TIFFPartialReadStripArray(TIFF *tif, TIFFDirEntry *dirent,
  7773. int strile, uint64_t *panVals)
  7774. {
  7775. static const char module[] = "_TIFFPartialReadStripArray";
  7776. #define IO_CACHE_PAGE_SIZE 4096
  7777. size_t sizeofval;
  7778. const int bSwab = (tif->tif_flags & TIFF_SWAB) != 0;
  7779. int sizeofvalint;
  7780. uint64_t nBaseOffset;
  7781. uint64_t nOffset;
  7782. uint64_t nOffsetStartPage;
  7783. uint64_t nOffsetEndPage;
  7784. tmsize_t nToRead;
  7785. tmsize_t nRead;
  7786. uint64_t nLastStripOffset;
  7787. int iStartBefore;
  7788. int i;
  7789. const uint32_t arraySize = tif->tif_dir.td_stripoffsetbyteallocsize;
  7790. unsigned char buffer[2 * IO_CACHE_PAGE_SIZE];
  7791. assert(dirent->tdir_count > 4);
  7792. if (dirent->tdir_type == TIFF_SHORT)
  7793. {
  7794. sizeofval = sizeof(uint16_t);
  7795. }
  7796. else if (dirent->tdir_type == TIFF_LONG)
  7797. {
  7798. sizeofval = sizeof(uint32_t);
  7799. }
  7800. else if (dirent->tdir_type == TIFF_LONG8)
  7801. {
  7802. sizeofval = sizeof(uint64_t);
  7803. }
  7804. else if (dirent->tdir_type == TIFF_SLONG8)
  7805. {
  7806. /* Non conformant but used by some images as in */
  7807. /* https://github.com/OSGeo/gdal/issues/2165 */
  7808. sizeofval = sizeof(int64_t);
  7809. }
  7810. else
  7811. {
  7812. TIFFErrorExtR(tif, module,
  7813. "Invalid type for [Strip|Tile][Offset/ByteCount] tag");
  7814. panVals[strile] = 0;
  7815. return 0;
  7816. }
  7817. sizeofvalint = (int)(sizeofval);
  7818. if (tif->tif_flags & TIFF_BIGTIFF)
  7819. {
  7820. uint64_t offset = dirent->tdir_offset.toff_long8;
  7821. if (bSwab)
  7822. TIFFSwabLong8(&offset);
  7823. nBaseOffset = offset;
  7824. }
  7825. else
  7826. {
  7827. uint32_t offset = dirent->tdir_offset.toff_long;
  7828. if (bSwab)
  7829. TIFFSwabLong(&offset);
  7830. nBaseOffset = offset;
  7831. }
  7832. /* To avoid later unsigned integer overflows */
  7833. if (nBaseOffset > (uint64_t)INT64_MAX)
  7834. {
  7835. TIFFErrorExtR(tif, module, "Cannot read offset/size for strile %d",
  7836. strile);
  7837. panVals[strile] = 0;
  7838. return 0;
  7839. }
  7840. nOffset = nBaseOffset + sizeofval * strile;
  7841. nOffsetStartPage = (nOffset / IO_CACHE_PAGE_SIZE) * IO_CACHE_PAGE_SIZE;
  7842. nOffsetEndPage = nOffsetStartPage + IO_CACHE_PAGE_SIZE;
  7843. if (nOffset + sizeofval > nOffsetEndPage)
  7844. nOffsetEndPage += IO_CACHE_PAGE_SIZE;
  7845. #undef IO_CACHE_PAGE_SIZE
  7846. nLastStripOffset = nBaseOffset + arraySize * sizeofval;
  7847. if (nLastStripOffset < nOffsetEndPage)
  7848. nOffsetEndPage = nLastStripOffset;
  7849. if (nOffsetStartPage >= nOffsetEndPage)
  7850. {
  7851. TIFFErrorExtR(tif, module, "Cannot read offset/size for strile %d",
  7852. strile);
  7853. panVals[strile] = 0;
  7854. return 0;
  7855. }
  7856. if (!SeekOK(tif, nOffsetStartPage))
  7857. {
  7858. panVals[strile] = 0;
  7859. return 0;
  7860. }
  7861. nToRead = (tmsize_t)(nOffsetEndPage - nOffsetStartPage);
  7862. nRead = TIFFReadFile(tif, buffer, nToRead);
  7863. if (nRead < nToRead)
  7864. {
  7865. TIFFErrorExtR(tif, module,
  7866. "Cannot read offset/size for strile around ~%d", strile);
  7867. return 0;
  7868. }
  7869. iStartBefore = -(int)((nOffset - nOffsetStartPage) / sizeofval);
  7870. if (strile + iStartBefore < 0)
  7871. iStartBefore = -strile;
  7872. for (i = iStartBefore;
  7873. (uint32_t)(strile + i) < arraySize &&
  7874. _TIFFUnsanitizedAddUInt64AndInt(nOffset, (i + 1) * sizeofvalint) <=
  7875. nOffsetEndPage;
  7876. ++i)
  7877. {
  7878. if (dirent->tdir_type == TIFF_SHORT)
  7879. {
  7880. uint16_t val;
  7881. memcpy(&val,
  7882. buffer + (nOffset - nOffsetStartPage) + i * sizeofvalint,
  7883. sizeof(val));
  7884. if (bSwab)
  7885. TIFFSwabShort(&val);
  7886. panVals[strile + i] = val;
  7887. }
  7888. else if (dirent->tdir_type == TIFF_LONG)
  7889. {
  7890. uint32_t val;
  7891. memcpy(&val,
  7892. buffer + (nOffset - nOffsetStartPage) + i * sizeofvalint,
  7893. sizeof(val));
  7894. if (bSwab)
  7895. TIFFSwabLong(&val);
  7896. panVals[strile + i] = val;
  7897. }
  7898. else if (dirent->tdir_type == TIFF_LONG8)
  7899. {
  7900. uint64_t val;
  7901. memcpy(&val,
  7902. buffer + (nOffset - nOffsetStartPage) + i * sizeofvalint,
  7903. sizeof(val));
  7904. if (bSwab)
  7905. TIFFSwabLong8(&val);
  7906. panVals[strile + i] = val;
  7907. }
  7908. else /* if( dirent->tdir_type == TIFF_SLONG8 ) */
  7909. {
  7910. /* Non conformant data type */
  7911. int64_t val;
  7912. memcpy(&val,
  7913. buffer + (nOffset - nOffsetStartPage) + i * sizeofvalint,
  7914. sizeof(val));
  7915. if (bSwab)
  7916. TIFFSwabLong8((uint64_t *)&val);
  7917. panVals[strile + i] = (uint64_t)val;
  7918. }
  7919. }
  7920. return 1;
  7921. }
  7922. static int _TIFFFetchStrileValue(TIFF *tif, uint32_t strile,
  7923. TIFFDirEntry *dirent, uint64_t **parray)
  7924. {
  7925. static const char module[] = "_TIFFFetchStrileValue";
  7926. TIFFDirectory *td = &tif->tif_dir;
  7927. if (strile >= dirent->tdir_count)
  7928. {
  7929. return 0;
  7930. }
  7931. if (strile >= td->td_stripoffsetbyteallocsize)
  7932. {
  7933. uint32_t nStripArrayAllocBefore = td->td_stripoffsetbyteallocsize;
  7934. uint32_t nStripArrayAllocNew;
  7935. uint64_t nArraySize64;
  7936. size_t nArraySize;
  7937. uint64_t *offsetArray;
  7938. uint64_t *bytecountArray;
  7939. if (strile > 1000000)
  7940. {
  7941. uint64_t filesize = TIFFGetFileSize(tif);
  7942. /* Avoid excessive memory allocation attempt */
  7943. /* For such a big blockid we need at least a TIFF_LONG per strile */
  7944. /* for the offset array. */
  7945. if (strile > filesize / sizeof(uint32_t))
  7946. {
  7947. TIFFErrorExtR(tif, module, "File too short");
  7948. return 0;
  7949. }
  7950. }
  7951. if (td->td_stripoffsetbyteallocsize == 0 &&
  7952. td->td_nstrips < 1024 * 1024)
  7953. {
  7954. nStripArrayAllocNew = td->td_nstrips;
  7955. }
  7956. else
  7957. {
  7958. #define TIFF_MAX(a, b) (((a) > (b)) ? (a) : (b))
  7959. #define TIFF_MIN(a, b) (((a) < (b)) ? (a) : (b))
  7960. nStripArrayAllocNew = TIFF_MAX(strile + 1, 1024U * 512U);
  7961. if (nStripArrayAllocNew < 0xFFFFFFFFU / 2)
  7962. nStripArrayAllocNew *= 2;
  7963. nStripArrayAllocNew = TIFF_MIN(nStripArrayAllocNew, td->td_nstrips);
  7964. }
  7965. assert(strile < nStripArrayAllocNew);
  7966. nArraySize64 = (uint64_t)sizeof(uint64_t) * nStripArrayAllocNew;
  7967. nArraySize = (size_t)(nArraySize64);
  7968. #if SIZEOF_SIZE_T == 4
  7969. if (nArraySize != nArraySize64)
  7970. {
  7971. TIFFErrorExtR(tif, module,
  7972. "Cannot allocate strip offset and bytecount arrays");
  7973. return 0;
  7974. }
  7975. #endif
  7976. offsetArray = (uint64_t *)(_TIFFreallocExt(tif, td->td_stripoffset_p,
  7977. nArraySize));
  7978. bytecountArray = (uint64_t *)(_TIFFreallocExt(
  7979. tif, td->td_stripbytecount_p, nArraySize));
  7980. if (offsetArray)
  7981. td->td_stripoffset_p = offsetArray;
  7982. if (bytecountArray)
  7983. td->td_stripbytecount_p = bytecountArray;
  7984. if (offsetArray && bytecountArray)
  7985. {
  7986. td->td_stripoffsetbyteallocsize = nStripArrayAllocNew;
  7987. /* Initialize new entries to ~0 / -1 */
  7988. /* coverity[overrun-buffer-arg] */
  7989. memset(td->td_stripoffset_p + nStripArrayAllocBefore, 0xFF,
  7990. (td->td_stripoffsetbyteallocsize - nStripArrayAllocBefore) *
  7991. sizeof(uint64_t));
  7992. /* coverity[overrun-buffer-arg] */
  7993. memset(td->td_stripbytecount_p + nStripArrayAllocBefore, 0xFF,
  7994. (td->td_stripoffsetbyteallocsize - nStripArrayAllocBefore) *
  7995. sizeof(uint64_t));
  7996. }
  7997. else
  7998. {
  7999. TIFFErrorExtR(tif, module,
  8000. "Cannot allocate strip offset and bytecount arrays");
  8001. _TIFFfreeExt(tif, td->td_stripoffset_p);
  8002. td->td_stripoffset_p = NULL;
  8003. _TIFFfreeExt(tif, td->td_stripbytecount_p);
  8004. td->td_stripbytecount_p = NULL;
  8005. td->td_stripoffsetbyteallocsize = 0;
  8006. }
  8007. }
  8008. if (*parray == NULL || strile >= td->td_stripoffsetbyteallocsize)
  8009. return 0;
  8010. if (~((*parray)[strile]) == 0)
  8011. {
  8012. if (!_TIFFPartialReadStripArray(tif, dirent, strile, *parray))
  8013. {
  8014. (*parray)[strile] = 0;
  8015. return 0;
  8016. }
  8017. }
  8018. return 1;
  8019. }
  8020. static uint64_t _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32_t strile,
  8021. TIFFDirEntry *dirent,
  8022. uint64_t **parray,
  8023. int *pbErr)
  8024. {
  8025. TIFFDirectory *td = &tif->tif_dir;
  8026. if (pbErr)
  8027. *pbErr = 0;
  8028. if ((tif->tif_flags & TIFF_DEFERSTRILELOAD) &&
  8029. !(tif->tif_flags & TIFF_CHOPPEDUPARRAYS))
  8030. {
  8031. if (!(tif->tif_flags & TIFF_LAZYSTRILELOAD) ||
  8032. /* If the values may fit in the toff_long/toff_long8 member */
  8033. /* then use _TIFFFillStriles to simplify _TIFFFetchStrileValue */
  8034. dirent->tdir_count <= 4)
  8035. {
  8036. if (!_TIFFFillStriles(tif))
  8037. {
  8038. if (pbErr)
  8039. *pbErr = 1;
  8040. /* Do not return, as we want this function to always */
  8041. /* return the same value if called several times with */
  8042. /* the same arguments */
  8043. }
  8044. }
  8045. else
  8046. {
  8047. if (!_TIFFFetchStrileValue(tif, strile, dirent, parray))
  8048. {
  8049. if (pbErr)
  8050. *pbErr = 1;
  8051. return 0;
  8052. }
  8053. }
  8054. }
  8055. if (*parray == NULL || strile >= td->td_nstrips)
  8056. {
  8057. if (pbErr)
  8058. *pbErr = 1;
  8059. return 0;
  8060. }
  8061. return (*parray)[strile];
  8062. }
  8063. /* Return the value of the TileOffsets/StripOffsets array for the specified
  8064. * tile/strile */
  8065. uint64_t TIFFGetStrileOffset(TIFF *tif, uint32_t strile)
  8066. {
  8067. return TIFFGetStrileOffsetWithErr(tif, strile, NULL);
  8068. }
  8069. /* Return the value of the TileOffsets/StripOffsets array for the specified
  8070. * tile/strile */
  8071. uint64_t TIFFGetStrileOffsetWithErr(TIFF *tif, uint32_t strile, int *pbErr)
  8072. {
  8073. TIFFDirectory *td = &tif->tif_dir;
  8074. return _TIFFGetStrileOffsetOrByteCountValue(tif, strile,
  8075. &(td->td_stripoffset_entry),
  8076. &(td->td_stripoffset_p), pbErr);
  8077. }
  8078. /* Return the value of the TileByteCounts/StripByteCounts array for the
  8079. * specified tile/strile */
  8080. uint64_t TIFFGetStrileByteCount(TIFF *tif, uint32_t strile)
  8081. {
  8082. return TIFFGetStrileByteCountWithErr(tif, strile, NULL);
  8083. }
  8084. /* Return the value of the TileByteCounts/StripByteCounts array for the
  8085. * specified tile/strile */
  8086. uint64_t TIFFGetStrileByteCountWithErr(TIFF *tif, uint32_t strile, int *pbErr)
  8087. {
  8088. TIFFDirectory *td = &tif->tif_dir;
  8089. return _TIFFGetStrileOffsetOrByteCountValue(
  8090. tif, strile, &(td->td_stripbytecount_entry), &(td->td_stripbytecount_p),
  8091. pbErr);
  8092. }
  8093. int _TIFFFillStriles(TIFF *tif) { return _TIFFFillStrilesInternal(tif, 1); }
  8094. static int _TIFFFillStrilesInternal(TIFF *tif, int loadStripByteCount)
  8095. {
  8096. register TIFFDirectory *td = &tif->tif_dir;
  8097. int return_value = 1;
  8098. /* Do not do anything if TIFF_DEFERSTRILELOAD is not set */
  8099. if (!(tif->tif_flags & TIFF_DEFERSTRILELOAD) ||
  8100. (tif->tif_flags & TIFF_CHOPPEDUPARRAYS) != 0)
  8101. return 1;
  8102. if (tif->tif_flags & TIFF_LAZYSTRILELOAD)
  8103. {
  8104. /* In case of lazy loading, reload completely the arrays */
  8105. _TIFFfreeExt(tif, td->td_stripoffset_p);
  8106. _TIFFfreeExt(tif, td->td_stripbytecount_p);
  8107. td->td_stripoffset_p = NULL;
  8108. td->td_stripbytecount_p = NULL;
  8109. td->td_stripoffsetbyteallocsize = 0;
  8110. tif->tif_flags &= ~TIFF_LAZYSTRILELOAD;
  8111. }
  8112. /* If stripoffset array is already loaded, exit with success */
  8113. if (td->td_stripoffset_p != NULL)
  8114. return 1;
  8115. /* If tdir_count was canceled, then we already got there, but in error */
  8116. if (td->td_stripoffset_entry.tdir_count == 0)
  8117. return 0;
  8118. if (!TIFFFetchStripThing(tif, &(td->td_stripoffset_entry), td->td_nstrips,
  8119. &td->td_stripoffset_p))
  8120. {
  8121. return_value = 0;
  8122. }
  8123. if (loadStripByteCount &&
  8124. !TIFFFetchStripThing(tif, &(td->td_stripbytecount_entry),
  8125. td->td_nstrips, &td->td_stripbytecount_p))
  8126. {
  8127. return_value = 0;
  8128. }
  8129. _TIFFmemset(&(td->td_stripoffset_entry), 0, sizeof(TIFFDirEntry));
  8130. _TIFFmemset(&(td->td_stripbytecount_entry), 0, sizeof(TIFFDirEntry));
  8131. #ifdef STRIPBYTECOUNTSORTED_UNUSED
  8132. if (tif->tif_dir.td_nstrips > 1 && return_value == 1)
  8133. {
  8134. uint32_t strip;
  8135. tif->tif_dir.td_stripbytecountsorted = 1;
  8136. for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++)
  8137. {
  8138. if (tif->tif_dir.td_stripoffset_p[strip - 1] >
  8139. tif->tif_dir.td_stripoffset_p[strip])
  8140. {
  8141. tif->tif_dir.td_stripbytecountsorted = 0;
  8142. break;
  8143. }
  8144. }
  8145. }
  8146. #endif
  8147. return return_value;
  8148. }