?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
winex11: Don't use the vulkan driver interface for xrandr.
[wine.git] / libs / tiff / libtiff / tif_dirread.c
blob2c49dc6aa0265f8a7f9bab269006cfcb2fea971f
1 /*
2 * Copyright (c) 1988-1997 Sam Leffler
3 * Copyright (c) 1991-1997 Silicon Graphics, Inc.
4 *
5 * Permission to use, copy, modify, distribute, and sell this software and
6 * its documentation for any purpose is hereby granted without fee, provided
7 * that (i) the above copyright notices and this permission notice appear in
8 * all copies of the software and related documentation, and (ii) the names of
9 * Sam Leffler and Silicon Graphics may not be used in any advertising or
10 * publicity relating to the software without the specific, prior written
11 * permission of Sam Leffler and Silicon Graphics.
12 *
13 * THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND,
14 * EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY
15 * WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
16 *
17 * IN NO EVENT SHALL SAM LEFFLER OR SILICON GRAPHICS BE LIABLE FOR
18 * ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND,
19 * OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
20 * WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF
21 * LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
22 * OF THIS SOFTWARE.
23 */
24
25 /*
26 * TIFF Library.
27 *
28 * Directory Read Support Routines.
29 */
30
31 /* Suggested pending improvements:
32 * - add a field 'field_info' to the TIFFDirEntry structure, and set that with
33 * the pointer to the appropriate TIFFField structure early on in
34 * TIFFReadDirectory, so as to eliminate current possibly repetitive lookup.
35 */
36
37 #include "tiffconf.h"
38 #include "tiffiop.h"
39 #include <float.h>
40 #include <limits.h>
41 #include <stdlib.h>
42 #include <string.h>
43
44 #define FAILED_FII ((uint32_t)-1)
45
46 #ifdef HAVE_IEEEFP
47 #define TIFFCvtIEEEFloatToNative(tif, n, fp)
48 #define TIFFCvtIEEEDoubleToNative(tif, n, dp)
49 #else
50 extern void TIFFCvtIEEEFloatToNative(TIFF *, uint32_t, float *);
51 extern void TIFFCvtIEEEDoubleToNative(TIFF *, uint32_t, double *);
52 #endif
53
54 enum TIFFReadDirEntryErr
55 {
56 TIFFReadDirEntryErrOk = 0,
57 TIFFReadDirEntryErrCount = 1,
58 TIFFReadDirEntryErrType = 2,
59 TIFFReadDirEntryErrIo = 3,
60 TIFFReadDirEntryErrRange = 4,
61 TIFFReadDirEntryErrPsdif = 5,
62 TIFFReadDirEntryErrSizesan = 6,
63 TIFFReadDirEntryErrAlloc = 7,
64 };
65
66 static enum TIFFReadDirEntryErr
67 TIFFReadDirEntryByte(TIFF *tif, TIFFDirEntry *direntry, uint8_t *value);
68 static enum TIFFReadDirEntryErr
69 TIFFReadDirEntrySbyte(TIFF *tif, TIFFDirEntry *direntry, int8_t *value);
70 static enum TIFFReadDirEntryErr
71 TIFFReadDirEntryShort(TIFF *tif, TIFFDirEntry *direntry, uint16_t *value);
72 static enum TIFFReadDirEntryErr
73 TIFFReadDirEntrySshort(TIFF *tif, TIFFDirEntry *direntry, int16_t *value);
74 static enum TIFFReadDirEntryErr
75 TIFFReadDirEntryLong(TIFF *tif, TIFFDirEntry *direntry, uint32_t *value);
76 static enum TIFFReadDirEntryErr
77 TIFFReadDirEntrySlong(TIFF *tif, TIFFDirEntry *direntry, int32_t *value);
78 static enum TIFFReadDirEntryErr
79 TIFFReadDirEntryLong8(TIFF *tif, TIFFDirEntry *direntry, uint64_t *value);
80 static enum TIFFReadDirEntryErr
81 TIFFReadDirEntrySlong8(TIFF *tif, TIFFDirEntry *direntry, int64_t *value);
82 static enum TIFFReadDirEntryErr
83 TIFFReadDirEntryFloat(TIFF *tif, TIFFDirEntry *direntry, float *value);
84 static enum TIFFReadDirEntryErr
85 TIFFReadDirEntryDouble(TIFF *tif, TIFFDirEntry *direntry, double *value);
86 static enum TIFFReadDirEntryErr
87 TIFFReadDirEntryIfd8(TIFF *tif, TIFFDirEntry *direntry, uint64_t *value);
88
89 static enum TIFFReadDirEntryErr
90 TIFFReadDirEntryArray(TIFF *tif, TIFFDirEntry *direntry, uint32_t *count,
91 uint32_t desttypesize, void **value);
92 static enum TIFFReadDirEntryErr
93 TIFFReadDirEntryByteArray(TIFF *tif, TIFFDirEntry *direntry, uint8_t **value);
94 static enum TIFFReadDirEntryErr
95 TIFFReadDirEntrySbyteArray(TIFF *tif, TIFFDirEntry *direntry, int8_t **value);
96 static enum TIFFReadDirEntryErr
97 TIFFReadDirEntryShortArray(TIFF *tif, TIFFDirEntry *direntry, uint16_t **value);
98 static enum TIFFReadDirEntryErr
99 TIFFReadDirEntrySshortArray(TIFF *tif, TIFFDirEntry *direntry, int16_t **value);
100 static enum TIFFReadDirEntryErr
101 TIFFReadDirEntryLongArray(TIFF *tif, TIFFDirEntry *direntry, uint32_t **value);
102 static enum TIFFReadDirEntryErr
103 TIFFReadDirEntrySlongArray(TIFF *tif, TIFFDirEntry *direntry, int32_t **value);
104 static enum TIFFReadDirEntryErr
105 TIFFReadDirEntryLong8Array(TIFF *tif, TIFFDirEntry *direntry, uint64_t **value);
106 static enum TIFFReadDirEntryErr
107 TIFFReadDirEntrySlong8Array(TIFF *tif, TIFFDirEntry *direntry, int64_t **value);
108 static enum TIFFReadDirEntryErr
109 TIFFReadDirEntryFloatArray(TIFF *tif, TIFFDirEntry *direntry, float **value);
110 static enum TIFFReadDirEntryErr
111 TIFFReadDirEntryDoubleArray(TIFF *tif, TIFFDirEntry *direntry, double **value);
112 static enum TIFFReadDirEntryErr
113 TIFFReadDirEntryIfd8Array(TIFF *tif, TIFFDirEntry *direntry, uint64_t **value);
114
115 static enum TIFFReadDirEntryErr
116 TIFFReadDirEntryPersampleShort(TIFF *tif, TIFFDirEntry *direntry,
117 uint16_t *value);
118
119 static void TIFFReadDirEntryCheckedByte(TIFF *tif, TIFFDirEntry *direntry,
120 uint8_t *value);
121 static void TIFFReadDirEntryCheckedSbyte(TIFF *tif, TIFFDirEntry *direntry,
122 int8_t *value);
123 static void TIFFReadDirEntryCheckedShort(TIFF *tif, TIFFDirEntry *direntry,
124 uint16_t *value);
125 static void TIFFReadDirEntryCheckedSshort(TIFF *tif, TIFFDirEntry *direntry,
126 int16_t *value);
127 static void TIFFReadDirEntryCheckedLong(TIFF *tif, TIFFDirEntry *direntry,
128 uint32_t *value);
129 static void TIFFReadDirEntryCheckedSlong(TIFF *tif, TIFFDirEntry *direntry,
130 int32_t *value);
131 static enum TIFFReadDirEntryErr
132 TIFFReadDirEntryCheckedLong8(TIFF *tif, TIFFDirEntry *direntry,
133 uint64_t *value);
134 static enum TIFFReadDirEntryErr
135 TIFFReadDirEntryCheckedSlong8(TIFF *tif, TIFFDirEntry *direntry,
136 int64_t *value);
137 static enum TIFFReadDirEntryErr
138 TIFFReadDirEntryCheckedRational(TIFF *tif, TIFFDirEntry *direntry,
139 double *value);
140 static enum TIFFReadDirEntryErr
141 TIFFReadDirEntryCheckedSrational(TIFF *tif, TIFFDirEntry *direntry,
142 double *value);
143 static void TIFFReadDirEntryCheckedFloat(TIFF *tif, TIFFDirEntry *direntry,
144 float *value);
145 static enum TIFFReadDirEntryErr
146 TIFFReadDirEntryCheckedDouble(TIFF *tif, TIFFDirEntry *direntry, double *value);
147 #if 0
148 static enum TIFFReadDirEntryErr
149 TIFFReadDirEntryCheckedRationalDirect(TIFF *tif, TIFFDirEntry *direntry,
150 TIFFRational_t *value);
151 #endif
152 static enum TIFFReadDirEntryErr
153 TIFFReadDirEntryCheckRangeByteSbyte(int8_t value);
154 static enum TIFFReadDirEntryErr
155 TIFFReadDirEntryCheckRangeByteShort(uint16_t value);
156 static enum TIFFReadDirEntryErr
157 TIFFReadDirEntryCheckRangeByteSshort(int16_t value);
158 static enum TIFFReadDirEntryErr
159 TIFFReadDirEntryCheckRangeByteLong(uint32_t value);
160 static enum TIFFReadDirEntryErr
161 TIFFReadDirEntryCheckRangeByteSlong(int32_t value);
162 static enum TIFFReadDirEntryErr
163 TIFFReadDirEntryCheckRangeByteLong8(uint64_t value);
164 static enum TIFFReadDirEntryErr
165 TIFFReadDirEntryCheckRangeByteSlong8(int64_t value);
166
167 static enum TIFFReadDirEntryErr
168 TIFFReadDirEntryCheckRangeSbyteByte(uint8_t value);
169 static enum TIFFReadDirEntryErr
170 TIFFReadDirEntryCheckRangeSbyteShort(uint16_t value);
171 static enum TIFFReadDirEntryErr
172 TIFFReadDirEntryCheckRangeSbyteSshort(int16_t value);
173 static enum TIFFReadDirEntryErr
174 TIFFReadDirEntryCheckRangeSbyteLong(uint32_t value);
175 static enum TIFFReadDirEntryErr
176 TIFFReadDirEntryCheckRangeSbyteSlong(int32_t value);
177 static enum TIFFReadDirEntryErr
178 TIFFReadDirEntryCheckRangeSbyteLong8(uint64_t value);
179 static enum TIFFReadDirEntryErr
180 TIFFReadDirEntryCheckRangeSbyteSlong8(int64_t value);
181
182 static enum TIFFReadDirEntryErr
183 TIFFReadDirEntryCheckRangeShortSbyte(int8_t value);
184 static enum TIFFReadDirEntryErr
185 TIFFReadDirEntryCheckRangeShortSshort(int16_t value);
186 static enum TIFFReadDirEntryErr
187 TIFFReadDirEntryCheckRangeShortLong(uint32_t value);
188 static enum TIFFReadDirEntryErr
189 TIFFReadDirEntryCheckRangeShortSlong(int32_t value);
190 static enum TIFFReadDirEntryErr
191 TIFFReadDirEntryCheckRangeShortLong8(uint64_t value);
192 static enum TIFFReadDirEntryErr
193 TIFFReadDirEntryCheckRangeShortSlong8(int64_t value);
194
195 static enum TIFFReadDirEntryErr
196 TIFFReadDirEntryCheckRangeSshortShort(uint16_t value);
197 static enum TIFFReadDirEntryErr
198 TIFFReadDirEntryCheckRangeSshortLong(uint32_t value);
199 static enum TIFFReadDirEntryErr
200 TIFFReadDirEntryCheckRangeSshortSlong(int32_t value);
201 static enum TIFFReadDirEntryErr
202 TIFFReadDirEntryCheckRangeSshortLong8(uint64_t value);
203 static enum TIFFReadDirEntryErr
204 TIFFReadDirEntryCheckRangeSshortSlong8(int64_t value);
205
206 static enum TIFFReadDirEntryErr
207 TIFFReadDirEntryCheckRangeLongSbyte(int8_t value);
208 static enum TIFFReadDirEntryErr
209 TIFFReadDirEntryCheckRangeLongSshort(int16_t value);
210 static enum TIFFReadDirEntryErr
211 TIFFReadDirEntryCheckRangeLongSlong(int32_t value);
212 static enum TIFFReadDirEntryErr
213 TIFFReadDirEntryCheckRangeLongLong8(uint64_t value);
214 static enum TIFFReadDirEntryErr
215 TIFFReadDirEntryCheckRangeLongSlong8(int64_t value);
216
217 static enum TIFFReadDirEntryErr
218 TIFFReadDirEntryCheckRangeSlongLong(uint32_t value);
219 static enum TIFFReadDirEntryErr
220 TIFFReadDirEntryCheckRangeSlongLong8(uint64_t value);
221 static enum TIFFReadDirEntryErr
222 TIFFReadDirEntryCheckRangeSlongSlong8(int64_t value);
223
224 static enum TIFFReadDirEntryErr
225 TIFFReadDirEntryCheckRangeLong8Sbyte(int8_t value);
226 static enum TIFFReadDirEntryErr
227 TIFFReadDirEntryCheckRangeLong8Sshort(int16_t value);
228 static enum TIFFReadDirEntryErr
229 TIFFReadDirEntryCheckRangeLong8Slong(int32_t value);
230 static enum TIFFReadDirEntryErr
231 TIFFReadDirEntryCheckRangeLong8Slong8(int64_t value);
232
233 static enum TIFFReadDirEntryErr
234 TIFFReadDirEntryCheckRangeSlong8Long8(uint64_t value);
235
236 static enum TIFFReadDirEntryErr TIFFReadDirEntryData(TIFF *tif, uint64_t offset,
237 tmsize_t size, void *dest);
238 static void TIFFReadDirEntryOutputErr(TIFF *tif, enum TIFFReadDirEntryErr err,
239 const char *module, const char *tagname,
240 int recover);
241
242 static void TIFFReadDirectoryCheckOrder(TIFF *tif, TIFFDirEntry *dir,
243 uint16_t dircount);
244 static TIFFDirEntry *TIFFReadDirectoryFindEntry(TIFF *tif, TIFFDirEntry *dir,
245 uint16_t dircount,
246 uint16_t tagid);
247 static void TIFFReadDirectoryFindFieldInfo(TIFF *tif, uint16_t tagid,
248 uint32_t *fii);
249
250 static int EstimateStripByteCounts(TIFF *tif, TIFFDirEntry *dir,
251 uint16_t dircount);
252 static void MissingRequired(TIFF *, const char *);
253 static int CheckDirCount(TIFF *, TIFFDirEntry *, uint32_t);
254 static uint16_t TIFFFetchDirectory(TIFF *tif, uint64_t diroff,
255 TIFFDirEntry **pdir, uint64_t *nextdiroff);
256 static int TIFFFetchNormalTag(TIFF *, TIFFDirEntry *, int recover);
257 static int TIFFFetchStripThing(TIFF *tif, TIFFDirEntry *dir, uint32_t nstrips,
258 uint64_t **lpp);
259 static int TIFFFetchSubjectDistance(TIFF *, TIFFDirEntry *);
260 static void ChopUpSingleUncompressedStrip(TIFF *);
261 static void TryChopUpUncompressedBigTiff(TIFF *);
262 static uint64_t TIFFReadUInt64(const uint8_t *value);
263 static int _TIFFGetMaxColorChannels(uint16_t photometric);
264
265 static int _TIFFFillStrilesInternal(TIFF *tif, int loadStripByteCount);
266
267 typedef union _UInt64Aligned_t
268 {
269 double d;
270 uint64_t l;
271 uint32_t i[2];
272 uint16_t s[4];
273 uint8_t c[8];
274 } UInt64Aligned_t;
275
276 /*
277 Unaligned safe copy of a uint64_t value from an octet array.
278 */
279 static uint64_t TIFFReadUInt64(const uint8_t *value)
280 {
281 UInt64Aligned_t result;
282
283 result.c[0] = value[0];
284 result.c[1] = value[1];
285 result.c[2] = value[2];
286 result.c[3] = value[3];
287 result.c[4] = value[4];
288 result.c[5] = value[5];
289 result.c[6] = value[6];
290 result.c[7] = value[7];
291
292 return result.l;
293 }
294
295 static enum TIFFReadDirEntryErr
296 TIFFReadDirEntryByte(TIFF *tif, TIFFDirEntry *direntry, uint8_t *value)
297 {
298 enum TIFFReadDirEntryErr err;
299 if (direntry->tdir_count != 1)
300 return (TIFFReadDirEntryErrCount);
301 switch (direntry->tdir_type)
302 {
303 case TIFF_BYTE:
304 case TIFF_UNDEFINED: /* Support to read TIFF_UNDEFINED with
305 field_readcount==1 */
306 TIFFReadDirEntryCheckedByte(tif, direntry, value);
307 return (TIFFReadDirEntryErrOk);
308 case TIFF_SBYTE:
309 {
310 int8_t m;
311 TIFFReadDirEntryCheckedSbyte(tif, direntry, &m);
312 err = TIFFReadDirEntryCheckRangeByteSbyte(m);
313 if (err != TIFFReadDirEntryErrOk)
314 return (err);
315 *value = (uint8_t)m;
316 return (TIFFReadDirEntryErrOk);
317 }
318 case TIFF_SHORT:
319 {
320 uint16_t m;
321 TIFFReadDirEntryCheckedShort(tif, direntry, &m);
322 err = TIFFReadDirEntryCheckRangeByteShort(m);
323 if (err != TIFFReadDirEntryErrOk)
324 return (err);
325 *value = (uint8_t)m;
326 return (TIFFReadDirEntryErrOk);
327 }
328 case TIFF_SSHORT:
329 {
330 int16_t m;
331 TIFFReadDirEntryCheckedSshort(tif, direntry, &m);
332 err = TIFFReadDirEntryCheckRangeByteSshort(m);
333 if (err != TIFFReadDirEntryErrOk)
334 return (err);
335 *value = (uint8_t)m;
336 return (TIFFReadDirEntryErrOk);
337 }
338 case TIFF_LONG:
339 {
340 uint32_t m;
341 TIFFReadDirEntryCheckedLong(tif, direntry, &m);
342 err = TIFFReadDirEntryCheckRangeByteLong(m);
343 if (err != TIFFReadDirEntryErrOk)
344 return (err);
345 *value = (uint8_t)m;
346 return (TIFFReadDirEntryErrOk);
347 }
348 case TIFF_SLONG:
349 {
350 int32_t m;
351 TIFFReadDirEntryCheckedSlong(tif, direntry, &m);
352 err = TIFFReadDirEntryCheckRangeByteSlong(m);
353 if (err != TIFFReadDirEntryErrOk)
354 return (err);
355 *value = (uint8_t)m;
356 return (TIFFReadDirEntryErrOk);
357 }
358 case TIFF_LONG8:
359 {
360 uint64_t m;
361 err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m);
362 if (err != TIFFReadDirEntryErrOk)
363 return (err);
364 err = TIFFReadDirEntryCheckRangeByteLong8(m);
365 if (err != TIFFReadDirEntryErrOk)
366 return (err);
367 *value = (uint8_t)m;
368 return (TIFFReadDirEntryErrOk);
369 }
370 case TIFF_SLONG8:
371 {
372 int64_t m;
373 err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m);
374 if (err != TIFFReadDirEntryErrOk)
375 return (err);
376 err = TIFFReadDirEntryCheckRangeByteSlong8(m);
377 if (err != TIFFReadDirEntryErrOk)
378 return (err);
379 *value = (uint8_t)m;
380 return (TIFFReadDirEntryErrOk);
381 }
382 default:
383 return (TIFFReadDirEntryErrType);
384 }
385 }
386
387 static enum TIFFReadDirEntryErr
388 TIFFReadDirEntrySbyte(TIFF *tif, TIFFDirEntry *direntry, int8_t *value)
389 {
390 enum TIFFReadDirEntryErr err;
391 if (direntry->tdir_count != 1)
392 return (TIFFReadDirEntryErrCount);
393 switch (direntry->tdir_type)
394 {
395 case TIFF_BYTE:
396 case TIFF_UNDEFINED: /* Support to read TIFF_UNDEFINED with
397 field_readcount==1 */
398 {
399 uint8_t m;
400 TIFFReadDirEntryCheckedByte(tif, direntry, &m);
401 err = TIFFReadDirEntryCheckRangeSbyteByte(m);
402 if (err != TIFFReadDirEntryErrOk)
403 return (err);
404 *value = (int8_t)m;
405 return (TIFFReadDirEntryErrOk);
406 }
407 case TIFF_SBYTE:
408 {
409 TIFFReadDirEntryCheckedSbyte(tif, direntry, value);
410 return (TIFFReadDirEntryErrOk);
411 }
412 case TIFF_SHORT:
413 {
414 uint16_t m;
415 TIFFReadDirEntryCheckedShort(tif, direntry, &m);
416 err = TIFFReadDirEntryCheckRangeSbyteShort(m);
417 if (err != TIFFReadDirEntryErrOk)
418 return (err);
419 *value = (int8_t)m;
420 return (TIFFReadDirEntryErrOk);
421 }
422 case TIFF_SSHORT:
423 {
424 int16_t m;
425 TIFFReadDirEntryCheckedSshort(tif, direntry, &m);
426 err = TIFFReadDirEntryCheckRangeSbyteSshort(m);
427 if (err != TIFFReadDirEntryErrOk)
428 return (err);
429 *value = (int8_t)m;
430 return (TIFFReadDirEntryErrOk);
431 }
432 case TIFF_LONG:
433 {
434 uint32_t m;
435 TIFFReadDirEntryCheckedLong(tif, direntry, &m);
436 err = TIFFReadDirEntryCheckRangeSbyteLong(m);
437 if (err != TIFFReadDirEntryErrOk)
438 return (err);
439 *value = (int8_t)m;
440 return (TIFFReadDirEntryErrOk);
441 }
442 case TIFF_SLONG:
443 {
444 int32_t m;
445 TIFFReadDirEntryCheckedSlong(tif, direntry, &m);
446 err = TIFFReadDirEntryCheckRangeSbyteSlong(m);
447 if (err != TIFFReadDirEntryErrOk)
448 return (err);
449 *value = (int8_t)m;
450 return (TIFFReadDirEntryErrOk);
451 }
452 case TIFF_LONG8:
453 {
454 uint64_t m;
455 err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m);
456 if (err != TIFFReadDirEntryErrOk)
457 return (err);
458 err = TIFFReadDirEntryCheckRangeSbyteLong8(m);
459 if (err != TIFFReadDirEntryErrOk)
460 return (err);
461 *value = (int8_t)m;
462 return (TIFFReadDirEntryErrOk);
463 }
464 case TIFF_SLONG8:
465 {
466 int64_t m;
467 err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m);
468 if (err != TIFFReadDirEntryErrOk)
469 return (err);
470 err = TIFFReadDirEntryCheckRangeSbyteSlong8(m);
471 if (err != TIFFReadDirEntryErrOk)
472 return (err);
473 *value = (int8_t)m;
474 return (TIFFReadDirEntryErrOk);
475 }
476 default:
477 return (TIFFReadDirEntryErrType);
478 }
479 } /*-- TIFFReadDirEntrySbyte() --*/
480
481 static enum TIFFReadDirEntryErr
482 TIFFReadDirEntryShort(TIFF *tif, TIFFDirEntry *direntry, uint16_t *value)
483 {
484 enum TIFFReadDirEntryErr err;
485 if (direntry->tdir_count != 1)
486 return (TIFFReadDirEntryErrCount);
487 switch (direntry->tdir_type)
488 {
489 case TIFF_BYTE:
490 {
491 uint8_t m;
492 TIFFReadDirEntryCheckedByte(tif, direntry, &m);
493 *value = (uint16_t)m;
494 return (TIFFReadDirEntryErrOk);
495 }
496 case TIFF_SBYTE:
497 {
498 int8_t m;
499 TIFFReadDirEntryCheckedSbyte(tif, direntry, &m);
500 err = TIFFReadDirEntryCheckRangeShortSbyte(m);
501 if (err != TIFFReadDirEntryErrOk)
502 return (err);
503 *value = (uint16_t)m;
504 return (TIFFReadDirEntryErrOk);
505 }
506 case TIFF_SHORT:
507 TIFFReadDirEntryCheckedShort(tif, direntry, value);
508 return (TIFFReadDirEntryErrOk);
509 case TIFF_SSHORT:
510 {
511 int16_t m;
512 TIFFReadDirEntryCheckedSshort(tif, direntry, &m);
513 err = TIFFReadDirEntryCheckRangeShortSshort(m);
514 if (err != TIFFReadDirEntryErrOk)
515 return (err);
516 *value = (uint16_t)m;
517 return (TIFFReadDirEntryErrOk);
518 }
519 case TIFF_LONG:
520 {
521 uint32_t m;
522 TIFFReadDirEntryCheckedLong(tif, direntry, &m);
523 err = TIFFReadDirEntryCheckRangeShortLong(m);
524 if (err != TIFFReadDirEntryErrOk)
525 return (err);
526 *value = (uint16_t)m;
527 return (TIFFReadDirEntryErrOk);
528 }
529 case TIFF_SLONG:
530 {
531 int32_t m;
532 TIFFReadDirEntryCheckedSlong(tif, direntry, &m);
533 err = TIFFReadDirEntryCheckRangeShortSlong(m);
534 if (err != TIFFReadDirEntryErrOk)
535 return (err);
536 *value = (uint16_t)m;
537 return (TIFFReadDirEntryErrOk);
538 }
539 case TIFF_LONG8:
540 {
541 uint64_t m;
542 err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m);
543 if (err != TIFFReadDirEntryErrOk)
544 return (err);
545 err = TIFFReadDirEntryCheckRangeShortLong8(m);
546 if (err != TIFFReadDirEntryErrOk)
547 return (err);
548 *value = (uint16_t)m;
549 return (TIFFReadDirEntryErrOk);
550 }
551 case TIFF_SLONG8:
552 {
553 int64_t m;
554 err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m);
555 if (err != TIFFReadDirEntryErrOk)
556 return (err);
557 err = TIFFReadDirEntryCheckRangeShortSlong8(m);
558 if (err != TIFFReadDirEntryErrOk)
559 return (err);
560 *value = (uint16_t)m;
561 return (TIFFReadDirEntryErrOk);
562 }
563 default:
564 return (TIFFReadDirEntryErrType);
565 }
566 } /*-- TIFFReadDirEntryShort() --*/
567
568 static enum TIFFReadDirEntryErr
569 TIFFReadDirEntrySshort(TIFF *tif, TIFFDirEntry *direntry, int16_t *value)
570 {
571 enum TIFFReadDirEntryErr err;
572 if (direntry->tdir_count != 1)
573 return (TIFFReadDirEntryErrCount);
574 switch (direntry->tdir_type)
575 {
576 case TIFF_BYTE:
577 {
578 uint8_t m;
579 TIFFReadDirEntryCheckedByte(tif, direntry, &m);
580 *value = (int16_t)m;
581 return (TIFFReadDirEntryErrOk);
582 }
583 case TIFF_SBYTE:
584 {
585 int8_t m;
586 TIFFReadDirEntryCheckedSbyte(tif, direntry, &m);
587 *value = (int16_t)m;
588 return (TIFFReadDirEntryErrOk);
589 }
590 case TIFF_SHORT:
591 {
592 uint16_t m;
593 TIFFReadDirEntryCheckedShort(tif, direntry, &m);
594 err = TIFFReadDirEntryCheckRangeSshortShort(m);
595 if (err != TIFFReadDirEntryErrOk)
596 return (err);
597 *value = (uint16_t)m;
598 return (TIFFReadDirEntryErrOk);
599 }
600 case TIFF_SSHORT:
601 TIFFReadDirEntryCheckedSshort(tif, direntry, value);
602 return (TIFFReadDirEntryErrOk);
603 case TIFF_LONG:
604 {
605 uint32_t m;
606 TIFFReadDirEntryCheckedLong(tif, direntry, &m);
607 err = TIFFReadDirEntryCheckRangeSshortLong(m);
608 if (err != TIFFReadDirEntryErrOk)
609 return (err);
610 *value = (int16_t)m;
611 return (TIFFReadDirEntryErrOk);
612 }
613 case TIFF_SLONG:
614 {
615 int32_t m;
616 TIFFReadDirEntryCheckedSlong(tif, direntry, &m);
617 err = TIFFReadDirEntryCheckRangeSshortSlong(m);
618 if (err != TIFFReadDirEntryErrOk)
619 return (err);
620 *value = (int16_t)m;
621 return (TIFFReadDirEntryErrOk);
622 }
623 case TIFF_LONG8:
624 {
625 uint64_t m;
626 err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m);
627 if (err != TIFFReadDirEntryErrOk)
628 return (err);
629 err = TIFFReadDirEntryCheckRangeSshortLong8(m);
630 if (err != TIFFReadDirEntryErrOk)
631 return (err);
632 *value = (int16_t)m;
633 return (TIFFReadDirEntryErrOk);
634 }
635 case TIFF_SLONG8:
636 {
637 int64_t m;
638 err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m);
639 if (err != TIFFReadDirEntryErrOk)
640 return (err);
641 err = TIFFReadDirEntryCheckRangeSshortSlong8(m);
642 if (err != TIFFReadDirEntryErrOk)
643 return (err);
644 *value = (int16_t)m;
645 return (TIFFReadDirEntryErrOk);
646 }
647 default:
648 return (TIFFReadDirEntryErrType);
649 }
650 } /*-- TIFFReadDirEntrySshort() --*/
651
652 static enum TIFFReadDirEntryErr
653 TIFFReadDirEntryLong(TIFF *tif, TIFFDirEntry *direntry, uint32_t *value)
654 {
655 enum TIFFReadDirEntryErr err;
656 if (direntry->tdir_count != 1)
657 return (TIFFReadDirEntryErrCount);
658 switch (direntry->tdir_type)
659 {
660 case TIFF_BYTE:
661 {
662 uint8_t m;
663 TIFFReadDirEntryCheckedByte(tif, direntry, &m);
664 *value = (uint32_t)m;
665 return (TIFFReadDirEntryErrOk);
666 }
667 case TIFF_SBYTE:
668 {
669 int8_t m;
670 TIFFReadDirEntryCheckedSbyte(tif, direntry, &m);
671 err = TIFFReadDirEntryCheckRangeLongSbyte(m);
672 if (err != TIFFReadDirEntryErrOk)
673 return (err);
674 *value = (uint32_t)m;
675 return (TIFFReadDirEntryErrOk);
676 }
677 case TIFF_SHORT:
678 {
679 uint16_t m;
680 TIFFReadDirEntryCheckedShort(tif, direntry, &m);
681 *value = (uint32_t)m;
682 return (TIFFReadDirEntryErrOk);
683 }
684 case TIFF_SSHORT:
685 {
686 int16_t m;
687 TIFFReadDirEntryCheckedSshort(tif, direntry, &m);
688 err = TIFFReadDirEntryCheckRangeLongSshort(m);
689 if (err != TIFFReadDirEntryErrOk)
690 return (err);
691 *value = (uint32_t)m;
692 return (TIFFReadDirEntryErrOk);
693 }
694 case TIFF_LONG:
695 TIFFReadDirEntryCheckedLong(tif, direntry, value);
696 return (TIFFReadDirEntryErrOk);
697 case TIFF_SLONG:
698 {
699 int32_t m;
700 TIFFReadDirEntryCheckedSlong(tif, direntry, &m);
701 err = TIFFReadDirEntryCheckRangeLongSlong(m);
702 if (err != TIFFReadDirEntryErrOk)
703 return (err);
704 *value = (uint32_t)m;
705 return (TIFFReadDirEntryErrOk);
706 }
707 case TIFF_LONG8:
708 {
709 uint64_t m;
710 err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m);
711 if (err != TIFFReadDirEntryErrOk)
712 return (err);
713 err = TIFFReadDirEntryCheckRangeLongLong8(m);
714 if (err != TIFFReadDirEntryErrOk)
715 return (err);
716 *value = (uint32_t)m;
717 return (TIFFReadDirEntryErrOk);
718 }
719 case TIFF_SLONG8:
720 {
721 int64_t m;
722 err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m);
723 if (err != TIFFReadDirEntryErrOk)
724 return (err);
725 err = TIFFReadDirEntryCheckRangeLongSlong8(m);
726 if (err != TIFFReadDirEntryErrOk)
727 return (err);
728 *value = (uint32_t)m;
729 return (TIFFReadDirEntryErrOk);
730 }
731 default:
732 return (TIFFReadDirEntryErrType);
733 }
734 } /*-- TIFFReadDirEntryLong() --*/
735
736 static enum TIFFReadDirEntryErr
737 TIFFReadDirEntrySlong(TIFF *tif, TIFFDirEntry *direntry, int32_t *value)
738 {
739 enum TIFFReadDirEntryErr err;
740 if (direntry->tdir_count != 1)
741 return (TIFFReadDirEntryErrCount);
742 switch (direntry->tdir_type)
743 {
744 case TIFF_BYTE:
745 {
746 uint8_t m;
747 TIFFReadDirEntryCheckedByte(tif, direntry, &m);
748 *value = (int32_t)m;
749 return (TIFFReadDirEntryErrOk);
750 }
751 case TIFF_SBYTE:
752 {
753 int8_t m;
754 TIFFReadDirEntryCheckedSbyte(tif, direntry, &m);
755 *value = (int32_t)m;
756 return (TIFFReadDirEntryErrOk);
757 }
758 case TIFF_SHORT:
759 {
760 uint16_t m;
761 TIFFReadDirEntryCheckedShort(tif, direntry, &m);
762 *value = (int32_t)m;
763 return (TIFFReadDirEntryErrOk);
764 }
765 case TIFF_SSHORT:
766 {
767 int16_t m;
768 TIFFReadDirEntryCheckedSshort(tif, direntry, &m);
769 *value = (int32_t)m;
770 return (TIFFReadDirEntryErrOk);
771 }
772 case TIFF_LONG:
773 {
774 uint32_t m;
775 TIFFReadDirEntryCheckedLong(tif, direntry, &m);
776 err = TIFFReadDirEntryCheckRangeSlongLong(m);
777 if (err != TIFFReadDirEntryErrOk)
778 return (err);
779 *value = (int32_t)m;
780 return (TIFFReadDirEntryErrOk);
781 }
782 case TIFF_SLONG:
783 TIFFReadDirEntryCheckedSlong(tif, direntry, value);
784 return (TIFFReadDirEntryErrOk);
785 case TIFF_LONG8:
786 {
787 uint64_t m;
788 err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m);
789 if (err != TIFFReadDirEntryErrOk)
790 return (err);
791 err = TIFFReadDirEntryCheckRangeSlongLong8(m);
792 if (err != TIFFReadDirEntryErrOk)
793 return (err);
794 *value = (int32_t)m;
795 return (TIFFReadDirEntryErrOk);
796 }
797 case TIFF_SLONG8:
798 {
799 int64_t m;
800 err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m);
801 if (err != TIFFReadDirEntryErrOk)
802 return (err);
803 err = TIFFReadDirEntryCheckRangeSlongSlong8(m);
804 if (err != TIFFReadDirEntryErrOk)
805 return (err);
806 *value = (int32_t)m;
807 return (TIFFReadDirEntryErrOk);
808 }
809 default:
810 return (TIFFReadDirEntryErrType);
811 }
812 } /*-- TIFFReadDirEntrySlong() --*/
813
814 static enum TIFFReadDirEntryErr
815 TIFFReadDirEntryLong8(TIFF *tif, TIFFDirEntry *direntry, uint64_t *value)
816 {
817 enum TIFFReadDirEntryErr err;
818 if (direntry->tdir_count != 1)
819 return (TIFFReadDirEntryErrCount);
820 switch (direntry->tdir_type)
821 {
822 case TIFF_BYTE:
823 {
824 uint8_t m;
825 TIFFReadDirEntryCheckedByte(tif, direntry, &m);
826 *value = (uint64_t)m;
827 return (TIFFReadDirEntryErrOk);
828 }
829 case TIFF_SBYTE:
830 {
831 int8_t m;
832 TIFFReadDirEntryCheckedSbyte(tif, direntry, &m);
833 err = TIFFReadDirEntryCheckRangeLong8Sbyte(m);
834 if (err != TIFFReadDirEntryErrOk)
835 return (err);
836 *value = (uint64_t)m;
837 return (TIFFReadDirEntryErrOk);
838 }
839 case TIFF_SHORT:
840 {
841 uint16_t m;
842 TIFFReadDirEntryCheckedShort(tif, direntry, &m);
843 *value = (uint64_t)m;
844 return (TIFFReadDirEntryErrOk);
845 }
846 case TIFF_SSHORT:
847 {
848 int16_t m;
849 TIFFReadDirEntryCheckedSshort(tif, direntry, &m);
850 err = TIFFReadDirEntryCheckRangeLong8Sshort(m);
851 if (err != TIFFReadDirEntryErrOk)
852 return (err);
853 *value = (uint64_t)m;
854 return (TIFFReadDirEntryErrOk);
855 }
856 case TIFF_LONG:
857 {
858 uint32_t m;
859 TIFFReadDirEntryCheckedLong(tif, direntry, &m);
860 *value = (uint64_t)m;
861 return (TIFFReadDirEntryErrOk);
862 }
863 case TIFF_SLONG:
864 {
865 int32_t m;
866 TIFFReadDirEntryCheckedSlong(tif, direntry, &m);
867 err = TIFFReadDirEntryCheckRangeLong8Slong(m);
868 if (err != TIFFReadDirEntryErrOk)
869 return (err);
870 *value = (uint64_t)m;
871 return (TIFFReadDirEntryErrOk);
872 }
873 case TIFF_LONG8:
874 err = TIFFReadDirEntryCheckedLong8(tif, direntry, value);
875 return (err);
876 case TIFF_SLONG8:
877 {
878 int64_t m;
879 err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m);
880 if (err != TIFFReadDirEntryErrOk)
881 return (err);
882 err = TIFFReadDirEntryCheckRangeLong8Slong8(m);
883 if (err != TIFFReadDirEntryErrOk)
884 return (err);
885 *value = (uint64_t)m;
886 return (TIFFReadDirEntryErrOk);
887 }
888 default:
889 return (TIFFReadDirEntryErrType);
890 }
891 } /*-- TIFFReadDirEntryLong8() --*/
892
893 static enum TIFFReadDirEntryErr
894 TIFFReadDirEntrySlong8(TIFF *tif, TIFFDirEntry *direntry, int64_t *value)
895 {
896 enum TIFFReadDirEntryErr err;
897 if (direntry->tdir_count != 1)
898 return (TIFFReadDirEntryErrCount);
899 switch (direntry->tdir_type)
900 {
901 case TIFF_BYTE:
902 {
903 uint8_t m;
904 TIFFReadDirEntryCheckedByte(tif, direntry, &m);
905 *value = (int64_t)m;
906 return (TIFFReadDirEntryErrOk);
907 }
908 case TIFF_SBYTE:
909 {
910 int8_t m;
911 TIFFReadDirEntryCheckedSbyte(tif, direntry, &m);
912 *value = (int64_t)m;
913 return (TIFFReadDirEntryErrOk);
914 }
915 case TIFF_SHORT:
916 {
917 uint16_t m;
918 TIFFReadDirEntryCheckedShort(tif, direntry, &m);
919 *value = (int64_t)m;
920 return (TIFFReadDirEntryErrOk);
921 }
922 case TIFF_SSHORT:
923 {
924 int16_t m;
925 TIFFReadDirEntryCheckedSshort(tif, direntry, &m);
926 *value = (int64_t)m;
927 return (TIFFReadDirEntryErrOk);
928 }
929 case TIFF_LONG:
930 {
931 uint32_t m;
932 TIFFReadDirEntryCheckedLong(tif, direntry, &m);
933 *value = (int64_t)m;
934 return (TIFFReadDirEntryErrOk);
935 }
936 case TIFF_SLONG:
937 {
938 int32_t m;
939 TIFFReadDirEntryCheckedSlong(tif, direntry, &m);
940 *value = (int64_t)m;
941 return (TIFFReadDirEntryErrOk);
942 }
943 case TIFF_LONG8:
944 {
945 uint64_t m;
946 err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m);
947 if (err != TIFFReadDirEntryErrOk)
948 return (err);
949 err = TIFFReadDirEntryCheckRangeSlong8Long8(m);
950 if (err != TIFFReadDirEntryErrOk)
951 return (err);
952 *value = (int64_t)m;
953 return (TIFFReadDirEntryErrOk);
954 }
955 case TIFF_SLONG8:
956 err = TIFFReadDirEntryCheckedSlong8(tif, direntry, value);
957 return (err);
958 default:
959 return (TIFFReadDirEntryErrType);
960 }
961 } /*-- TIFFReadDirEntrySlong8() --*/
962
963 static enum TIFFReadDirEntryErr
964 TIFFReadDirEntryFloat(TIFF *tif, TIFFDirEntry *direntry, float *value)
965 {
966 enum TIFFReadDirEntryErr err;
967 if (direntry->tdir_count != 1)
968 return (TIFFReadDirEntryErrCount);
969 switch (direntry->tdir_type)
970 {
971 case TIFF_BYTE:
972 {
973 uint8_t m;
974 TIFFReadDirEntryCheckedByte(tif, direntry, &m);
975 *value = (float)m;
976 return (TIFFReadDirEntryErrOk);
977 }
978 case TIFF_SBYTE:
979 {
980 int8_t m;
981 TIFFReadDirEntryCheckedSbyte(tif, direntry, &m);
982 *value = (float)m;
983 return (TIFFReadDirEntryErrOk);
984 }
985 case TIFF_SHORT:
986 {
987 uint16_t m;
988 TIFFReadDirEntryCheckedShort(tif, direntry, &m);
989 *value = (float)m;
990 return (TIFFReadDirEntryErrOk);
991 }
992 case TIFF_SSHORT:
993 {
994 int16_t m;
995 TIFFReadDirEntryCheckedSshort(tif, direntry, &m);
996 *value = (float)m;
997 return (TIFFReadDirEntryErrOk);
998 }
999 case TIFF_LONG:
1000 {
1001 uint32_t m;
1002 TIFFReadDirEntryCheckedLong(tif, direntry, &m);
1003 *value = (float)m;
1004 return (TIFFReadDirEntryErrOk);
1005 }
1006 case TIFF_SLONG:
1007 {
1008 int32_t m;
1009 TIFFReadDirEntryCheckedSlong(tif, direntry, &m);
1010 *value = (float)m;
1011 return (TIFFReadDirEntryErrOk);
1012 }
1013 case TIFF_LONG8:
1014 {
1015 uint64_t m;
1016 err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m);
1017 if (err != TIFFReadDirEntryErrOk)
1018 return (err);
1019 #if defined(__WIN32__) && (_MSC_VER < 1500)
1020 /*
1021 * XXX: MSVC 6.0 does not support conversion
1022 * of 64-bit integers into floating point
1023 * values.
1024 */
1025 *value = _TIFFUInt64ToFloat(m);
1026 #else
1027 *value = (float)m;
1028 #endif
1029 return (TIFFReadDirEntryErrOk);
1030 }
1031 case TIFF_SLONG8:
1032 {
1033 int64_t m;
1034 err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m);
1035 if (err != TIFFReadDirEntryErrOk)
1036 return (err);
1037 *value = (float)m;
1038 return (TIFFReadDirEntryErrOk);
1039 }
1040 case TIFF_RATIONAL:
1041 {
1042 double m;
1043 err = TIFFReadDirEntryCheckedRational(tif, direntry, &m);
1044 if (err != TIFFReadDirEntryErrOk)
1045 return (err);
1046 *value = (float)m;
1047 return (TIFFReadDirEntryErrOk);
1048 }
1049 case TIFF_SRATIONAL:
1050 {
1051 double m;
1052 err = TIFFReadDirEntryCheckedSrational(tif, direntry, &m);
1053 if (err != TIFFReadDirEntryErrOk)
1054 return (err);
1055 *value = (float)m;
1056 return (TIFFReadDirEntryErrOk);
1057 }
1058 case TIFF_FLOAT:
1059 TIFFReadDirEntryCheckedFloat(tif, direntry, value);
1060 return (TIFFReadDirEntryErrOk);
1061 case TIFF_DOUBLE:
1062 {
1063 double m;
1064 err = TIFFReadDirEntryCheckedDouble(tif, direntry, &m);
1065 if (err != TIFFReadDirEntryErrOk)
1066 return (err);
1067 if ((m > FLT_MAX) || (m < -FLT_MAX))
1068 return (TIFFReadDirEntryErrRange);
1069 *value = (float)m;
1070 return (TIFFReadDirEntryErrOk);
1071 }
1072 default:
1073 return (TIFFReadDirEntryErrType);
1074 }
1075 }
1076
1077 static enum TIFFReadDirEntryErr
1078 TIFFReadDirEntryDouble(TIFF *tif, TIFFDirEntry *direntry, double *value)
1079 {
1080 enum TIFFReadDirEntryErr err;
1081 if (direntry->tdir_count != 1)
1082 return (TIFFReadDirEntryErrCount);
1083 switch (direntry->tdir_type)
1084 {
1085 case TIFF_BYTE:
1086 {
1087 uint8_t m;
1088 TIFFReadDirEntryCheckedByte(tif, direntry, &m);
1089 *value = (double)m;
1090 return (TIFFReadDirEntryErrOk);
1091 }
1092 case TIFF_SBYTE:
1093 {
1094 int8_t m;
1095 TIFFReadDirEntryCheckedSbyte(tif, direntry, &m);
1096 *value = (double)m;
1097 return (TIFFReadDirEntryErrOk);
1098 }
1099 case TIFF_SHORT:
1100 {
1101 uint16_t m;
1102 TIFFReadDirEntryCheckedShort(tif, direntry, &m);
1103 *value = (double)m;
1104 return (TIFFReadDirEntryErrOk);
1105 }
1106 case TIFF_SSHORT:
1107 {
1108 int16_t m;
1109 TIFFReadDirEntryCheckedSshort(tif, direntry, &m);
1110 *value = (double)m;
1111 return (TIFFReadDirEntryErrOk);
1112 }
1113 case TIFF_LONG:
1114 {
1115 uint32_t m;
1116 TIFFReadDirEntryCheckedLong(tif, direntry, &m);
1117 *value = (double)m;
1118 return (TIFFReadDirEntryErrOk);
1119 }
1120 case TIFF_SLONG:
1121 {
1122 int32_t m;
1123 TIFFReadDirEntryCheckedSlong(tif, direntry, &m);
1124 *value = (double)m;
1125 return (TIFFReadDirEntryErrOk);
1126 }
1127 case TIFF_LONG8:
1128 {
1129 uint64_t m;
1130 err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m);
1131 if (err != TIFFReadDirEntryErrOk)
1132 return (err);
1133 #if defined(__WIN32__) && (_MSC_VER < 1500)
1134 /*
1135 * XXX: MSVC 6.0 does not support conversion
1136 * of 64-bit integers into floating point
1137 * values.
1138 */
1139 *value = _TIFFUInt64ToDouble(m);
1140 #else
1141 *value = (double)m;
1142 #endif
1143 return (TIFFReadDirEntryErrOk);
1144 }
1145 case TIFF_SLONG8:
1146 {
1147 int64_t m;
1148 err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m);
1149 if (err != TIFFReadDirEntryErrOk)
1150 return (err);
1151 *value = (double)m;
1152 return (TIFFReadDirEntryErrOk);
1153 }
1154 case TIFF_RATIONAL:
1155 err = TIFFReadDirEntryCheckedRational(tif, direntry, value);
1156 return (err);
1157 case TIFF_SRATIONAL:
1158 err = TIFFReadDirEntryCheckedSrational(tif, direntry, value);
1159 return (err);
1160 case TIFF_FLOAT:
1161 {
1162 float m;
1163 TIFFReadDirEntryCheckedFloat(tif, direntry, &m);
1164 *value = (double)m;
1165 return (TIFFReadDirEntryErrOk);
1166 }
1167 case TIFF_DOUBLE:
1168 err = TIFFReadDirEntryCheckedDouble(tif, direntry, value);
1169 return (err);
1170 default:
1171 return (TIFFReadDirEntryErrType);
1172 }
1173 }
1174
1175 static enum TIFFReadDirEntryErr
1176 TIFFReadDirEntryIfd8(TIFF *tif, TIFFDirEntry *direntry, uint64_t *value)
1177 {
1178 enum TIFFReadDirEntryErr err;
1179 if (direntry->tdir_count != 1)
1180 return (TIFFReadDirEntryErrCount);
1181 switch (direntry->tdir_type)
1182 {
1183 case TIFF_LONG:
1184 case TIFF_IFD:
1185 {
1186 uint32_t m;
1187 TIFFReadDirEntryCheckedLong(tif, direntry, &m);
1188 *value = (uint64_t)m;
1189 return (TIFFReadDirEntryErrOk);
1190 }
1191 case TIFF_LONG8:
1192 case TIFF_IFD8:
1193 err = TIFFReadDirEntryCheckedLong8(tif, direntry, value);
1194 return (err);
1195 default:
1196 return (TIFFReadDirEntryErrType);
1197 }
1198 }
1199
1200 #define INITIAL_THRESHOLD (1024 * 1024)
1201 #define THRESHOLD_MULTIPLIER 10
1202 #define MAX_THRESHOLD \
1203 (THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER * \
1204 INITIAL_THRESHOLD)
1205
1206 static enum TIFFReadDirEntryErr TIFFReadDirEntryDataAndRealloc(TIFF *tif,
1207 uint64_t offset,
1208 tmsize_t size,
1209 void **pdest)
1210 {
1211 #if SIZEOF_SIZE_T == 8
1212 tmsize_t threshold = INITIAL_THRESHOLD;
1213 #endif
1214 tmsize_t already_read = 0;
1215
1216 assert(!isMapped(tif));
1217
1218 if (!SeekOK(tif, offset))
1219 return (TIFFReadDirEntryErrIo);
1220
1221 /* On 64 bit processes, read first a maximum of 1 MB, then 10 MB, etc */
1222 /* so as to avoid allocating too much memory in case the file is too */
1223 /* short. We could ask for the file size, but this might be */
1224 /* expensive with some I/O layers (think of reading a gzipped file) */
1225 /* Restrict to 64 bit processes, so as to avoid reallocs() */
1226 /* on 32 bit processes where virtual memory is scarce. */
1227 while (already_read < size)
1228 {
1229 void *new_dest;
1230 tmsize_t bytes_read;
1231 tmsize_t to_read = size - already_read;
1232 #if SIZEOF_SIZE_T == 8
1233 if (to_read >= threshold && threshold < MAX_THRESHOLD)
1234 {
1235 to_read = threshold;
1236 threshold *= THRESHOLD_MULTIPLIER;
1237 }
1238 #endif
1239
1240 new_dest =
1241 (uint8_t *)_TIFFreallocExt(tif, *pdest, already_read + to_read);
1242 if (new_dest == NULL)
1243 {
1244 TIFFErrorExtR(tif, tif->tif_name,
1245 "Failed to allocate memory for %s "
1246 "(%" TIFF_SSIZE_FORMAT
1247 " elements of %" TIFF_SSIZE_FORMAT " bytes each)",
1248 "TIFFReadDirEntryArray", (tmsize_t)1,
1249 already_read + to_read);
1250 return TIFFReadDirEntryErrAlloc;
1251 }
1252 *pdest = new_dest;
1253
1254 bytes_read = TIFFReadFile(tif, (char *)*pdest + already_read, to_read);
1255 already_read += bytes_read;
1256 if (bytes_read != to_read)
1257 {
1258 return TIFFReadDirEntryErrIo;
1259 }
1260 }
1261 return TIFFReadDirEntryErrOk;
1262 }
1263
1264 /* Caution: if raising that value, make sure int32 / uint32 overflows can't
1265 * occur elsewhere */
1266 #define MAX_SIZE_TAG_DATA 2147483647U
1267
1268 static enum TIFFReadDirEntryErr
1269 TIFFReadDirEntryArrayWithLimit(TIFF *tif, TIFFDirEntry *direntry,
1270 uint32_t *count, uint32_t desttypesize,
1271 void **value, uint64_t maxcount)
1272 {
1273 int typesize;
1274 uint32_t datasize;
1275 void *data;
1276 uint64_t target_count64;
1277 int original_datasize_clamped;
1278 typesize = TIFFDataWidth(direntry->tdir_type);
1279
1280 target_count64 =
1281 (direntry->tdir_count > maxcount) ? maxcount : direntry->tdir_count;
1282
1283 if ((target_count64 == 0) || (typesize == 0))
1284 {
1285 *value = 0;
1286 return (TIFFReadDirEntryErrOk);
1287 }
1288 (void)desttypesize;
1289
1290 /* We just want to know if the original tag size is more than 4 bytes
1291 * (classic TIFF) or 8 bytes (BigTIFF)
1292 */
1293 original_datasize_clamped =
1294 ((direntry->tdir_count > 10) ? 10 : (int)direntry->tdir_count) *
1295 typesize;
1296
1297 /*
1298 * As a sanity check, make sure we have no more than a 2GB tag array
1299 * in either the current data type or the dest data type. This also
1300 * avoids problems with overflow of tmsize_t on 32bit systems.
1301 */
1302 if ((uint64_t)(MAX_SIZE_TAG_DATA / typesize) < target_count64)
1303 return (TIFFReadDirEntryErrSizesan);
1304 if ((uint64_t)(MAX_SIZE_TAG_DATA / desttypesize) < target_count64)
1305 return (TIFFReadDirEntryErrSizesan);
1306
1307 *count = (uint32_t)target_count64;
1308 datasize = (*count) * typesize;
1309 assert((tmsize_t)datasize > 0);
1310
1311 if (isMapped(tif) && datasize > (uint64_t)tif->tif_size)
1312 return TIFFReadDirEntryErrIo;
1313
1314 if (!isMapped(tif) && (((tif->tif_flags & TIFF_BIGTIFF) && datasize > 8) ||
1315 (!(tif->tif_flags & TIFF_BIGTIFF) && datasize > 4)))
1316 {
1317 data = NULL;
1318 }
1319 else
1320 {
1321 data = _TIFFCheckMalloc(tif, *count, typesize, "ReadDirEntryArray");
1322 if (data == 0)
1323 return (TIFFReadDirEntryErrAlloc);
1324 }
1325 if (!(tif->tif_flags & TIFF_BIGTIFF))
1326 {
1327 /* Only the condition on original_datasize_clamped. The second
1328 * one is implied, but Coverity Scan cannot see it. */
1329 if (original_datasize_clamped <= 4 && datasize <= 4)
1330 _TIFFmemcpy(data, &direntry->tdir_offset, datasize);
1331 else
1332 {
1333 enum TIFFReadDirEntryErr err;
1334 uint32_t offset = direntry->tdir_offset.toff_long;
1335 if (tif->tif_flags & TIFF_SWAB)
1336 TIFFSwabLong(&offset);
1337 if (isMapped(tif))
1338 err = TIFFReadDirEntryData(tif, (uint64_t)offset,
1339 (tmsize_t)datasize, data);
1340 else
1341 err = TIFFReadDirEntryDataAndRealloc(tif, (uint64_t)offset,
1342 (tmsize_t)datasize, &data);
1343 if (err != TIFFReadDirEntryErrOk)
1344 {
1345 _TIFFfreeExt(tif, data);
1346 return (err);
1347 }
1348 }
1349 }
1350 else
1351 {
1352 /* See above comment for the Classic TIFF case */
1353 if (original_datasize_clamped <= 8 && datasize <= 8)
1354 _TIFFmemcpy(data, &direntry->tdir_offset, datasize);
1355 else
1356 {
1357 enum TIFFReadDirEntryErr err;
1358 uint64_t offset = direntry->tdir_offset.toff_long8;
1359 if (tif->tif_flags & TIFF_SWAB)
1360 TIFFSwabLong8(&offset);
1361 if (isMapped(tif))
1362 err = TIFFReadDirEntryData(tif, (uint64_t)offset,
1363 (tmsize_t)datasize, data);
1364 else
1365 err = TIFFReadDirEntryDataAndRealloc(tif, (uint64_t)offset,
1366 (tmsize_t)datasize, &data);
1367 if (err != TIFFReadDirEntryErrOk)
1368 {
1369 _TIFFfreeExt(tif, data);
1370 return (err);
1371 }
1372 }
1373 }
1374 *value = data;
1375 return (TIFFReadDirEntryErrOk);
1376 }
1377
1378 static enum TIFFReadDirEntryErr
1379 TIFFReadDirEntryArray(TIFF *tif, TIFFDirEntry *direntry, uint32_t *count,
1380 uint32_t desttypesize, void **value)
1381 {
1382 return TIFFReadDirEntryArrayWithLimit(tif, direntry, count, desttypesize,
1383 value, ~((uint64_t)0));
1384 }
1385
1386 static enum TIFFReadDirEntryErr
1387 TIFFReadDirEntryByteArray(TIFF *tif, TIFFDirEntry *direntry, uint8_t **value)
1388 {
1389 enum TIFFReadDirEntryErr err;
1390 uint32_t count;
1391 void *origdata;
1392 uint8_t *data;
1393 switch (direntry->tdir_type)
1394 {
1395 case TIFF_ASCII:
1396 case TIFF_UNDEFINED:
1397 case TIFF_BYTE:
1398 case TIFF_SBYTE:
1399 case TIFF_SHORT:
1400 case TIFF_SSHORT:
1401 case TIFF_LONG:
1402 case TIFF_SLONG:
1403 case TIFF_LONG8:
1404 case TIFF_SLONG8:
1405 break;
1406 default:
1407 return (TIFFReadDirEntryErrType);
1408 }
1409 err = TIFFReadDirEntryArray(tif, direntry, &count, 1, &origdata);
1410 if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
1411 {
1412 *value = 0;
1413 return (err);
1414 }
1415 switch (direntry->tdir_type)
1416 {
1417 case TIFF_ASCII:
1418 case TIFF_UNDEFINED:
1419 case TIFF_BYTE:
1420 *value = (uint8_t *)origdata;
1421 return (TIFFReadDirEntryErrOk);
1422 case TIFF_SBYTE:
1423 {
1424 int8_t *m;
1425 uint32_t n;
1426 m = (int8_t *)origdata;
1427 for (n = 0; n < count; n++)
1428 {
1429 err = TIFFReadDirEntryCheckRangeByteSbyte(*m);
1430 if (err != TIFFReadDirEntryErrOk)
1431 {
1432 _TIFFfreeExt(tif, origdata);
1433 return (err);
1434 }
1435 m++;
1436 }
1437 *value = (uint8_t *)origdata;
1438 return (TIFFReadDirEntryErrOk);
1439 }
1440 }
1441 data = (uint8_t *)_TIFFmallocExt(tif, count);
1442 if (data == 0)
1443 {
1444 _TIFFfreeExt(tif, origdata);
1445 return (TIFFReadDirEntryErrAlloc);
1446 }
1447 switch (direntry->tdir_type)
1448 {
1449 case TIFF_SHORT:
1450 {
1451 uint16_t *ma;
1452 uint8_t *mb;
1453 uint32_t n;
1454 ma = (uint16_t *)origdata;
1455 mb = data;
1456 for (n = 0; n < count; n++)
1457 {
1458 if (tif->tif_flags & TIFF_SWAB)
1459 TIFFSwabShort(ma);
1460 err = TIFFReadDirEntryCheckRangeByteShort(*ma);
1461 if (err != TIFFReadDirEntryErrOk)
1462 break;
1463 *mb++ = (uint8_t)(*ma++);
1464 }
1465 }
1466 break;
1467 case TIFF_SSHORT:
1468 {
1469 int16_t *ma;
1470 uint8_t *mb;
1471 uint32_t n;
1472 ma = (int16_t *)origdata;
1473 mb = data;
1474 for (n = 0; n < count; n++)
1475 {
1476 if (tif->tif_flags & TIFF_SWAB)
1477 TIFFSwabShort((uint16_t *)ma);
1478 err = TIFFReadDirEntryCheckRangeByteSshort(*ma);
1479 if (err != TIFFReadDirEntryErrOk)
1480 break;
1481 *mb++ = (uint8_t)(*ma++);
1482 }
1483 }
1484 break;
1485 case TIFF_LONG:
1486 {
1487 uint32_t *ma;
1488 uint8_t *mb;
1489 uint32_t n;
1490 ma = (uint32_t *)origdata;
1491 mb = data;
1492 for (n = 0; n < count; n++)
1493 {
1494 if (tif->tif_flags & TIFF_SWAB)
1495 TIFFSwabLong(ma);
1496 err = TIFFReadDirEntryCheckRangeByteLong(*ma);
1497 if (err != TIFFReadDirEntryErrOk)
1498 break;
1499 *mb++ = (uint8_t)(*ma++);
1500 }
1501 }
1502 break;
1503 case TIFF_SLONG:
1504 {
1505 int32_t *ma;
1506 uint8_t *mb;
1507 uint32_t n;
1508 ma = (int32_t *)origdata;
1509 mb = data;
1510 for (n = 0; n < count; n++)
1511 {
1512 if (tif->tif_flags & TIFF_SWAB)
1513 TIFFSwabLong((uint32_t *)ma);
1514 err = TIFFReadDirEntryCheckRangeByteSlong(*ma);
1515 if (err != TIFFReadDirEntryErrOk)
1516 break;
1517 *mb++ = (uint8_t)(*ma++);
1518 }
1519 }
1520 break;
1521 case TIFF_LONG8:
1522 {
1523 uint64_t *ma;
1524 uint8_t *mb;
1525 uint32_t n;
1526 ma = (uint64_t *)origdata;
1527 mb = data;
1528 for (n = 0; n < count; n++)
1529 {
1530 if (tif->tif_flags & TIFF_SWAB)
1531 TIFFSwabLong8(ma);
1532 err = TIFFReadDirEntryCheckRangeByteLong8(*ma);
1533 if (err != TIFFReadDirEntryErrOk)
1534 break;
1535 *mb++ = (uint8_t)(*ma++);
1536 }
1537 }
1538 break;
1539 case TIFF_SLONG8:
1540 {
1541 int64_t *ma;
1542 uint8_t *mb;
1543 uint32_t n;
1544 ma = (int64_t *)origdata;
1545 mb = data;
1546 for (n = 0; n < count; n++)
1547 {
1548 if (tif->tif_flags & TIFF_SWAB)
1549 TIFFSwabLong8((uint64_t *)ma);
1550 err = TIFFReadDirEntryCheckRangeByteSlong8(*ma);
1551 if (err != TIFFReadDirEntryErrOk)
1552 break;
1553 *mb++ = (uint8_t)(*ma++);
1554 }
1555 }
1556 break;
1557 }
1558 _TIFFfreeExt(tif, origdata);
1559 if (err != TIFFReadDirEntryErrOk)
1560 {
1561 _TIFFfreeExt(tif, data);
1562 return (err);
1563 }
1564 *value = data;
1565 return (TIFFReadDirEntryErrOk);
1566 }
1567
1568 static enum TIFFReadDirEntryErr
1569 TIFFReadDirEntrySbyteArray(TIFF *tif, TIFFDirEntry *direntry, int8_t **value)
1570 {
1571 enum TIFFReadDirEntryErr err;
1572 uint32_t count;
1573 void *origdata;
1574 int8_t *data;
1575 switch (direntry->tdir_type)
1576 {
1577 case TIFF_UNDEFINED:
1578 case TIFF_BYTE:
1579 case TIFF_SBYTE:
1580 case TIFF_SHORT:
1581 case TIFF_SSHORT:
1582 case TIFF_LONG:
1583 case TIFF_SLONG:
1584 case TIFF_LONG8:
1585 case TIFF_SLONG8:
1586 break;
1587 default:
1588 return (TIFFReadDirEntryErrType);
1589 }
1590 err = TIFFReadDirEntryArray(tif, direntry, &count, 1, &origdata);
1591 if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
1592 {
1593 *value = 0;
1594 return (err);
1595 }
1596 switch (direntry->tdir_type)
1597 {
1598 case TIFF_UNDEFINED:
1599 case TIFF_BYTE:
1600 {
1601 uint8_t *m;
1602 uint32_t n;
1603 m = (uint8_t *)origdata;
1604 for (n = 0; n < count; n++)
1605 {
1606 err = TIFFReadDirEntryCheckRangeSbyteByte(*m);
1607 if (err != TIFFReadDirEntryErrOk)
1608 {
1609 _TIFFfreeExt(tif, origdata);
1610 return (err);
1611 }
1612 m++;
1613 }
1614 *value = (int8_t *)origdata;
1615 return (TIFFReadDirEntryErrOk);
1616 }
1617 case TIFF_SBYTE:
1618 *value = (int8_t *)origdata;
1619 return (TIFFReadDirEntryErrOk);
1620 }
1621 data = (int8_t *)_TIFFmallocExt(tif, count);
1622 if (data == 0)
1623 {
1624 _TIFFfreeExt(tif, origdata);
1625 return (TIFFReadDirEntryErrAlloc);
1626 }
1627 switch (direntry->tdir_type)
1628 {
1629 case TIFF_SHORT:
1630 {
1631 uint16_t *ma;
1632 int8_t *mb;
1633 uint32_t n;
1634 ma = (uint16_t *)origdata;
1635 mb = data;
1636 for (n = 0; n < count; n++)
1637 {
1638 if (tif->tif_flags & TIFF_SWAB)
1639 TIFFSwabShort(ma);
1640 err = TIFFReadDirEntryCheckRangeSbyteShort(*ma);
1641 if (err != TIFFReadDirEntryErrOk)
1642 break;
1643 *mb++ = (int8_t)(*ma++);
1644 }
1645 }
1646 break;
1647 case TIFF_SSHORT:
1648 {
1649 int16_t *ma;
1650 int8_t *mb;
1651 uint32_t n;
1652 ma = (int16_t *)origdata;
1653 mb = data;
1654 for (n = 0; n < count; n++)
1655 {
1656 if (tif->tif_flags & TIFF_SWAB)
1657 TIFFSwabShort((uint16_t *)ma);
1658 err = TIFFReadDirEntryCheckRangeSbyteSshort(*ma);
1659 if (err != TIFFReadDirEntryErrOk)
1660 break;
1661 *mb++ = (int8_t)(*ma++);
1662 }
1663 }
1664 break;
1665 case TIFF_LONG:
1666 {
1667 uint32_t *ma;
1668 int8_t *mb;
1669 uint32_t n;
1670 ma = (uint32_t *)origdata;
1671 mb = data;
1672 for (n = 0; n < count; n++)
1673 {
1674 if (tif->tif_flags & TIFF_SWAB)
1675 TIFFSwabLong(ma);
1676 err = TIFFReadDirEntryCheckRangeSbyteLong(*ma);
1677 if (err != TIFFReadDirEntryErrOk)
1678 break;
1679 *mb++ = (int8_t)(*ma++);
1680 }
1681 }
1682 break;
1683 case TIFF_SLONG:
1684 {
1685 int32_t *ma;
1686 int8_t *mb;
1687 uint32_t n;
1688 ma = (int32_t *)origdata;
1689 mb = data;
1690 for (n = 0; n < count; n++)
1691 {
1692 if (tif->tif_flags & TIFF_SWAB)
1693 TIFFSwabLong((uint32_t *)ma);
1694 err = TIFFReadDirEntryCheckRangeSbyteSlong(*ma);
1695 if (err != TIFFReadDirEntryErrOk)
1696 break;
1697 *mb++ = (int8_t)(*ma++);
1698 }
1699 }
1700 break;
1701 case TIFF_LONG8:
1702 {
1703 uint64_t *ma;
1704 int8_t *mb;
1705 uint32_t n;
1706 ma = (uint64_t *)origdata;
1707 mb = data;
1708 for (n = 0; n < count; n++)
1709 {
1710 if (tif->tif_flags & TIFF_SWAB)
1711 TIFFSwabLong8(ma);
1712 err = TIFFReadDirEntryCheckRangeSbyteLong8(*ma);
1713 if (err != TIFFReadDirEntryErrOk)
1714 break;
1715 *mb++ = (int8_t)(*ma++);
1716 }
1717 }
1718 break;
1719 case TIFF_SLONG8:
1720 {
1721 int64_t *ma;
1722 int8_t *mb;
1723 uint32_t n;
1724 ma = (int64_t *)origdata;
1725 mb = data;
1726 for (n = 0; n < count; n++)
1727 {
1728 if (tif->tif_flags & TIFF_SWAB)
1729 TIFFSwabLong8((uint64_t *)ma);
1730 err = TIFFReadDirEntryCheckRangeSbyteSlong8(*ma);
1731 if (err != TIFFReadDirEntryErrOk)
1732 break;
1733 *mb++ = (int8_t)(*ma++);
1734 }
1735 }
1736 break;
1737 }
1738 _TIFFfreeExt(tif, origdata);
1739 if (err != TIFFReadDirEntryErrOk)
1740 {
1741 _TIFFfreeExt(tif, data);
1742 return (err);
1743 }
1744 *value = data;
1745 return (TIFFReadDirEntryErrOk);
1746 }
1747
1748 static enum TIFFReadDirEntryErr
1749 TIFFReadDirEntryShortArray(TIFF *tif, TIFFDirEntry *direntry, uint16_t **value)
1750 {
1751 enum TIFFReadDirEntryErr err;
1752 uint32_t count;
1753 void *origdata;
1754 uint16_t *data;
1755 switch (direntry->tdir_type)
1756 {
1757 case TIFF_BYTE:
1758 case TIFF_SBYTE:
1759 case TIFF_SHORT:
1760 case TIFF_SSHORT:
1761 case TIFF_LONG:
1762 case TIFF_SLONG:
1763 case TIFF_LONG8:
1764 case TIFF_SLONG8:
1765 break;
1766 default:
1767 return (TIFFReadDirEntryErrType);
1768 }
1769 err = TIFFReadDirEntryArray(tif, direntry, &count, 2, &origdata);
1770 if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
1771 {
1772 *value = 0;
1773 return (err);
1774 }
1775 switch (direntry->tdir_type)
1776 {
1777 case TIFF_SHORT:
1778 *value = (uint16_t *)origdata;
1779 if (tif->tif_flags & TIFF_SWAB)
1780 TIFFSwabArrayOfShort(*value, count);
1781 return (TIFFReadDirEntryErrOk);
1782 case TIFF_SSHORT:
1783 {
1784 int16_t *m;
1785 uint32_t n;
1786 m = (int16_t *)origdata;
1787 for (n = 0; n < count; n++)
1788 {
1789 if (tif->tif_flags & TIFF_SWAB)
1790 TIFFSwabShort((uint16_t *)m);
1791 err = TIFFReadDirEntryCheckRangeShortSshort(*m);
1792 if (err != TIFFReadDirEntryErrOk)
1793 {
1794 _TIFFfreeExt(tif, origdata);
1795 return (err);
1796 }
1797 m++;
1798 }
1799 *value = (uint16_t *)origdata;
1800 return (TIFFReadDirEntryErrOk);
1801 }
1802 }
1803 data = (uint16_t *)_TIFFmallocExt(tif, count * 2);
1804 if (data == 0)
1805 {
1806 _TIFFfreeExt(tif, origdata);
1807 return (TIFFReadDirEntryErrAlloc);
1808 }
1809 switch (direntry->tdir_type)
1810 {
1811 case TIFF_BYTE:
1812 {
1813 uint8_t *ma;
1814 uint16_t *mb;
1815 uint32_t n;
1816 ma = (uint8_t *)origdata;
1817 mb = data;
1818 for (n = 0; n < count; n++)
1819 *mb++ = (uint16_t)(*ma++);
1820 }
1821 break;
1822 case TIFF_SBYTE:
1823 {
1824 int8_t *ma;
1825 uint16_t *mb;
1826 uint32_t n;
1827 ma = (int8_t *)origdata;
1828 mb = data;
1829 for (n = 0; n < count; n++)
1830 {
1831 err = TIFFReadDirEntryCheckRangeShortSbyte(*ma);
1832 if (err != TIFFReadDirEntryErrOk)
1833 break;
1834 *mb++ = (uint16_t)(*ma++);
1835 }
1836 }
1837 break;
1838 case TIFF_LONG:
1839 {
1840 uint32_t *ma;
1841 uint16_t *mb;
1842 uint32_t n;
1843 ma = (uint32_t *)origdata;
1844 mb = data;
1845 for (n = 0; n < count; n++)
1846 {
1847 if (tif->tif_flags & TIFF_SWAB)
1848 TIFFSwabLong(ma);
1849 err = TIFFReadDirEntryCheckRangeShortLong(*ma);
1850 if (err != TIFFReadDirEntryErrOk)
1851 break;
1852 *mb++ = (uint16_t)(*ma++);
1853 }
1854 }
1855 break;
1856 case TIFF_SLONG:
1857 {
1858 int32_t *ma;
1859 uint16_t *mb;
1860 uint32_t n;
1861 ma = (int32_t *)origdata;
1862 mb = data;
1863 for (n = 0; n < count; n++)
1864 {
1865 if (tif->tif_flags & TIFF_SWAB)
1866 TIFFSwabLong((uint32_t *)ma);
1867 err = TIFFReadDirEntryCheckRangeShortSlong(*ma);
1868 if (err != TIFFReadDirEntryErrOk)
1869 break;
1870 *mb++ = (uint16_t)(*ma++);
1871 }
1872 }
1873 break;
1874 case TIFF_LONG8:
1875 {
1876 uint64_t *ma;
1877 uint16_t *mb;
1878 uint32_t n;
1879 ma = (uint64_t *)origdata;
1880 mb = data;
1881 for (n = 0; n < count; n++)
1882 {
1883 if (tif->tif_flags & TIFF_SWAB)
1884 TIFFSwabLong8(ma);
1885 err = TIFFReadDirEntryCheckRangeShortLong8(*ma);
1886 if (err != TIFFReadDirEntryErrOk)
1887 break;
1888 *mb++ = (uint16_t)(*ma++);
1889 }
1890 }
1891 break;
1892 case TIFF_SLONG8:
1893 {
1894 int64_t *ma;
1895 uint16_t *mb;
1896 uint32_t n;
1897 ma = (int64_t *)origdata;
1898 mb = data;
1899 for (n = 0; n < count; n++)
1900 {
1901 if (tif->tif_flags & TIFF_SWAB)
1902 TIFFSwabLong8((uint64_t *)ma);
1903 err = TIFFReadDirEntryCheckRangeShortSlong8(*ma);
1904 if (err != TIFFReadDirEntryErrOk)
1905 break;
1906 *mb++ = (uint16_t)(*ma++);
1907 }
1908 }
1909 break;
1910 }
1911 _TIFFfreeExt(tif, origdata);
1912 if (err != TIFFReadDirEntryErrOk)
1913 {
1914 _TIFFfreeExt(tif, data);
1915 return (err);
1916 }
1917 *value = data;
1918 return (TIFFReadDirEntryErrOk);
1919 }
1920
1921 static enum TIFFReadDirEntryErr
1922 TIFFReadDirEntrySshortArray(TIFF *tif, TIFFDirEntry *direntry, int16_t **value)
1923 {
1924 enum TIFFReadDirEntryErr err;
1925 uint32_t count;
1926 void *origdata;
1927 int16_t *data;
1928 switch (direntry->tdir_type)
1929 {
1930 case TIFF_BYTE:
1931 case TIFF_SBYTE:
1932 case TIFF_SHORT:
1933 case TIFF_SSHORT:
1934 case TIFF_LONG:
1935 case TIFF_SLONG:
1936 case TIFF_LONG8:
1937 case TIFF_SLONG8:
1938 break;
1939 default:
1940 return (TIFFReadDirEntryErrType);
1941 }
1942 err = TIFFReadDirEntryArray(tif, direntry, &count, 2, &origdata);
1943 if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
1944 {
1945 *value = 0;
1946 return (err);
1947 }
1948 switch (direntry->tdir_type)
1949 {
1950 case TIFF_SHORT:
1951 {
1952 uint16_t *m;
1953 uint32_t n;
1954 m = (uint16_t *)origdata;
1955 for (n = 0; n < count; n++)
1956 {
1957 if (tif->tif_flags & TIFF_SWAB)
1958 TIFFSwabShort(m);
1959 err = TIFFReadDirEntryCheckRangeSshortShort(*m);
1960 if (err != TIFFReadDirEntryErrOk)
1961 {
1962 _TIFFfreeExt(tif, origdata);
1963 return (err);
1964 }
1965 m++;
1966 }
1967 *value = (int16_t *)origdata;
1968 return (TIFFReadDirEntryErrOk);
1969 }
1970 case TIFF_SSHORT:
1971 *value = (int16_t *)origdata;
1972 if (tif->tif_flags & TIFF_SWAB)
1973 TIFFSwabArrayOfShort((uint16_t *)(*value), count);
1974 return (TIFFReadDirEntryErrOk);
1975 }
1976 data = (int16_t *)_TIFFmallocExt(tif, count * 2);
1977 if (data == 0)
1978 {
1979 _TIFFfreeExt(tif, origdata);
1980 return (TIFFReadDirEntryErrAlloc);
1981 }
1982 switch (direntry->tdir_type)
1983 {
1984 case TIFF_BYTE:
1985 {
1986 uint8_t *ma;
1987 int16_t *mb;
1988 uint32_t n;
1989 ma = (uint8_t *)origdata;
1990 mb = data;
1991 for (n = 0; n < count; n++)
1992 *mb++ = (int16_t)(*ma++);
1993 }
1994 break;
1995 case TIFF_SBYTE:
1996 {
1997 int8_t *ma;
1998 int16_t *mb;
1999 uint32_t n;
2000 ma = (int8_t *)origdata;
2001 mb = data;
2002 for (n = 0; n < count; n++)
2003 *mb++ = (int16_t)(*ma++);
2004 }
2005 break;
2006 case TIFF_LONG:
2007 {
2008 uint32_t *ma;
2009 int16_t *mb;
2010 uint32_t n;
2011 ma = (uint32_t *)origdata;
2012 mb = data;
2013 for (n = 0; n < count; n++)
2014 {
2015 if (tif->tif_flags & TIFF_SWAB)
2016 TIFFSwabLong(ma);
2017 err = TIFFReadDirEntryCheckRangeSshortLong(*ma);
2018 if (err != TIFFReadDirEntryErrOk)
2019 break;
2020 *mb++ = (int16_t)(*ma++);
2021 }
2022 }
2023 break;
2024 case TIFF_SLONG:
2025 {
2026 int32_t *ma;
2027 int16_t *mb;
2028 uint32_t n;
2029 ma = (int32_t *)origdata;
2030 mb = data;
2031 for (n = 0; n < count; n++)
2032 {
2033 if (tif->tif_flags & TIFF_SWAB)
2034 TIFFSwabLong((uint32_t *)ma);
2035 err = TIFFReadDirEntryCheckRangeSshortSlong(*ma);
2036 if (err != TIFFReadDirEntryErrOk)
2037 break;
2038 *mb++ = (int16_t)(*ma++);
2039 }
2040 }
2041 break;
2042 case TIFF_LONG8:
2043 {
2044 uint64_t *ma;
2045 int16_t *mb;
2046 uint32_t n;
2047 ma = (uint64_t *)origdata;
2048 mb = data;
2049 for (n = 0; n < count; n++)
2050 {
2051 if (tif->tif_flags & TIFF_SWAB)
2052 TIFFSwabLong8(ma);
2053 err = TIFFReadDirEntryCheckRangeSshortLong8(*ma);
2054 if (err != TIFFReadDirEntryErrOk)
2055 break;
2056 *mb++ = (int16_t)(*ma++);
2057 }
2058 }
2059 break;
2060 case TIFF_SLONG8:
2061 {
2062 int64_t *ma;
2063 int16_t *mb;
2064 uint32_t n;
2065 ma = (int64_t *)origdata;
2066 mb = data;
2067 for (n = 0; n < count; n++)
2068 {
2069 if (tif->tif_flags & TIFF_SWAB)
2070 TIFFSwabLong8((uint64_t *)ma);
2071 err = TIFFReadDirEntryCheckRangeSshortSlong8(*ma);
2072 if (err != TIFFReadDirEntryErrOk)
2073 break;
2074 *mb++ = (int16_t)(*ma++);
2075 }
2076 }
2077 break;
2078 }
2079 _TIFFfreeExt(tif, origdata);
2080 if (err != TIFFReadDirEntryErrOk)
2081 {
2082 _TIFFfreeExt(tif, data);
2083 return (err);
2084 }
2085 *value = data;
2086 return (TIFFReadDirEntryErrOk);
2087 }
2088
2089 static enum TIFFReadDirEntryErr
2090 TIFFReadDirEntryLongArray(TIFF *tif, TIFFDirEntry *direntry, uint32_t **value)
2091 {
2092 enum TIFFReadDirEntryErr err;
2093 uint32_t count;
2094 void *origdata;
2095 uint32_t *data;
2096 switch (direntry->tdir_type)
2097 {
2098 case TIFF_BYTE:
2099 case TIFF_SBYTE:
2100 case TIFF_SHORT:
2101 case TIFF_SSHORT:
2102 case TIFF_LONG:
2103 case TIFF_SLONG:
2104 case TIFF_LONG8:
2105 case TIFF_SLONG8:
2106 break;
2107 default:
2108 return (TIFFReadDirEntryErrType);
2109 }
2110 err = TIFFReadDirEntryArray(tif, direntry, &count, 4, &origdata);
2111 if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
2112 {
2113 *value = 0;
2114 return (err);
2115 }
2116 switch (direntry->tdir_type)
2117 {
2118 case TIFF_LONG:
2119 *value = (uint32_t *)origdata;
2120 if (tif->tif_flags & TIFF_SWAB)
2121 TIFFSwabArrayOfLong(*value, count);
2122 return (TIFFReadDirEntryErrOk);
2123 case TIFF_SLONG:
2124 {
2125 int32_t *m;
2126 uint32_t n;
2127 m = (int32_t *)origdata;
2128 for (n = 0; n < count; n++)
2129 {
2130 if (tif->tif_flags & TIFF_SWAB)
2131 TIFFSwabLong((uint32_t *)m);
2132 err = TIFFReadDirEntryCheckRangeLongSlong(*m);
2133 if (err != TIFFReadDirEntryErrOk)
2134 {
2135 _TIFFfreeExt(tif, origdata);
2136 return (err);
2137 }
2138 m++;
2139 }
2140 *value = (uint32_t *)origdata;
2141 return (TIFFReadDirEntryErrOk);
2142 }
2143 }
2144 data = (uint32_t *)_TIFFmallocExt(tif, count * 4);
2145 if (data == 0)
2146 {
2147 _TIFFfreeExt(tif, origdata);
2148 return (TIFFReadDirEntryErrAlloc);
2149 }
2150 switch (direntry->tdir_type)
2151 {
2152 case TIFF_BYTE:
2153 {
2154 uint8_t *ma;
2155 uint32_t *mb;
2156 uint32_t n;
2157 ma = (uint8_t *)origdata;
2158 mb = data;
2159 for (n = 0; n < count; n++)
2160 *mb++ = (uint32_t)(*ma++);
2161 }
2162 break;
2163 case TIFF_SBYTE:
2164 {
2165 int8_t *ma;
2166 uint32_t *mb;
2167 uint32_t n;
2168 ma = (int8_t *)origdata;
2169 mb = data;
2170 for (n = 0; n < count; n++)
2171 {
2172 err = TIFFReadDirEntryCheckRangeLongSbyte(*ma);
2173 if (err != TIFFReadDirEntryErrOk)
2174 break;
2175 *mb++ = (uint32_t)(*ma++);
2176 }
2177 }
2178 break;
2179 case TIFF_SHORT:
2180 {
2181 uint16_t *ma;
2182 uint32_t *mb;
2183 uint32_t n;
2184 ma = (uint16_t *)origdata;
2185 mb = data;
2186 for (n = 0; n < count; n++)
2187 {
2188 if (tif->tif_flags & TIFF_SWAB)
2189 TIFFSwabShort(ma);
2190 *mb++ = (uint32_t)(*ma++);
2191 }
2192 }
2193 break;
2194 case TIFF_SSHORT:
2195 {
2196 int16_t *ma;
2197 uint32_t *mb;
2198 uint32_t n;
2199 ma = (int16_t *)origdata;
2200 mb = data;
2201 for (n = 0; n < count; n++)
2202 {
2203 if (tif->tif_flags & TIFF_SWAB)
2204 TIFFSwabShort((uint16_t *)ma);
2205 err = TIFFReadDirEntryCheckRangeLongSshort(*ma);
2206 if (err != TIFFReadDirEntryErrOk)
2207 break;
2208 *mb++ = (uint32_t)(*ma++);
2209 }
2210 }
2211 break;
2212 case TIFF_LONG8:
2213 {
2214 uint64_t *ma;
2215 uint32_t *mb;
2216 uint32_t n;
2217 ma = (uint64_t *)origdata;
2218 mb = data;
2219 for (n = 0; n < count; n++)
2220 {
2221 if (tif->tif_flags & TIFF_SWAB)
2222 TIFFSwabLong8(ma);
2223 err = TIFFReadDirEntryCheckRangeLongLong8(*ma);
2224 if (err != TIFFReadDirEntryErrOk)
2225 break;
2226 *mb++ = (uint32_t)(*ma++);
2227 }
2228 }
2229 break;
2230 case TIFF_SLONG8:
2231 {
2232 int64_t *ma;
2233 uint32_t *mb;
2234 uint32_t n;
2235 ma = (int64_t *)origdata;
2236 mb = data;
2237 for (n = 0; n < count; n++)
2238 {
2239 if (tif->tif_flags & TIFF_SWAB)
2240 TIFFSwabLong8((uint64_t *)ma);
2241 err = TIFFReadDirEntryCheckRangeLongSlong8(*ma);
2242 if (err != TIFFReadDirEntryErrOk)
2243 break;
2244 *mb++ = (uint32_t)(*ma++);
2245 }
2246 }
2247 break;
2248 }
2249 _TIFFfreeExt(tif, origdata);
2250 if (err != TIFFReadDirEntryErrOk)
2251 {
2252 _TIFFfreeExt(tif, data);
2253 return (err);
2254 }
2255 *value = data;
2256 return (TIFFReadDirEntryErrOk);
2257 }
2258
2259 static enum TIFFReadDirEntryErr
2260 TIFFReadDirEntrySlongArray(TIFF *tif, TIFFDirEntry *direntry, int32_t **value)
2261 {
2262 enum TIFFReadDirEntryErr err;
2263 uint32_t count;
2264 void *origdata;
2265 int32_t *data;
2266 switch (direntry->tdir_type)
2267 {
2268 case TIFF_BYTE:
2269 case TIFF_SBYTE:
2270 case TIFF_SHORT:
2271 case TIFF_SSHORT:
2272 case TIFF_LONG:
2273 case TIFF_SLONG:
2274 case TIFF_LONG8:
2275 case TIFF_SLONG8:
2276 break;
2277 default:
2278 return (TIFFReadDirEntryErrType);
2279 }
2280 err = TIFFReadDirEntryArray(tif, direntry, &count, 4, &origdata);
2281 if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
2282 {
2283 *value = 0;
2284 return (err);
2285 }
2286 switch (direntry->tdir_type)
2287 {
2288 case TIFF_LONG:
2289 {
2290 uint32_t *m;
2291 uint32_t n;
2292 m = (uint32_t *)origdata;
2293 for (n = 0; n < count; n++)
2294 {
2295 if (tif->tif_flags & TIFF_SWAB)
2296 TIFFSwabLong((uint32_t *)m);
2297 err = TIFFReadDirEntryCheckRangeSlongLong(*m);
2298 if (err != TIFFReadDirEntryErrOk)
2299 {
2300 _TIFFfreeExt(tif, origdata);
2301 return (err);
2302 }
2303 m++;
2304 }
2305 *value = (int32_t *)origdata;
2306 return (TIFFReadDirEntryErrOk);
2307 }
2308 case TIFF_SLONG:
2309 *value = (int32_t *)origdata;
2310 if (tif->tif_flags & TIFF_SWAB)
2311 TIFFSwabArrayOfLong((uint32_t *)(*value), count);
2312 return (TIFFReadDirEntryErrOk);
2313 }
2314 data = (int32_t *)_TIFFmallocExt(tif, count * 4);
2315 if (data == 0)
2316 {
2317 _TIFFfreeExt(tif, origdata);
2318 return (TIFFReadDirEntryErrAlloc);
2319 }
2320 switch (direntry->tdir_type)
2321 {
2322 case TIFF_BYTE:
2323 {
2324 uint8_t *ma;
2325 int32_t *mb;
2326 uint32_t n;
2327 ma = (uint8_t *)origdata;
2328 mb = data;
2329 for (n = 0; n < count; n++)
2330 *mb++ = (int32_t)(*ma++);
2331 }
2332 break;
2333 case TIFF_SBYTE:
2334 {
2335 int8_t *ma;
2336 int32_t *mb;
2337 uint32_t n;
2338 ma = (int8_t *)origdata;
2339 mb = data;
2340 for (n = 0; n < count; n++)
2341 *mb++ = (int32_t)(*ma++);
2342 }
2343 break;
2344 case TIFF_SHORT:
2345 {
2346 uint16_t *ma;
2347 int32_t *mb;
2348 uint32_t n;
2349 ma = (uint16_t *)origdata;
2350 mb = data;
2351 for (n = 0; n < count; n++)
2352 {
2353 if (tif->tif_flags & TIFF_SWAB)
2354 TIFFSwabShort(ma);
2355 *mb++ = (int32_t)(*ma++);
2356 }
2357 }
2358 break;
2359 case TIFF_SSHORT:
2360 {
2361 int16_t *ma;
2362 int32_t *mb;
2363 uint32_t n;
2364 ma = (int16_t *)origdata;
2365 mb = data;
2366 for (n = 0; n < count; n++)
2367 {
2368 if (tif->tif_flags & TIFF_SWAB)
2369 TIFFSwabShort((uint16_t *)ma);
2370 *mb++ = (int32_t)(*ma++);
2371 }
2372 }
2373 break;
2374 case TIFF_LONG8:
2375 {
2376 uint64_t *ma;
2377 int32_t *mb;
2378 uint32_t n;
2379 ma = (uint64_t *)origdata;
2380 mb = data;
2381 for (n = 0; n < count; n++)
2382 {
2383 if (tif->tif_flags & TIFF_SWAB)
2384 TIFFSwabLong8(ma);
2385 err = TIFFReadDirEntryCheckRangeSlongLong8(*ma);
2386 if (err != TIFFReadDirEntryErrOk)
2387 break;
2388 *mb++ = (int32_t)(*ma++);
2389 }
2390 }
2391 break;
2392 case TIFF_SLONG8:
2393 {
2394 int64_t *ma;
2395 int32_t *mb;
2396 uint32_t n;
2397 ma = (int64_t *)origdata;
2398 mb = data;
2399 for (n = 0; n < count; n++)
2400 {
2401 if (tif->tif_flags & TIFF_SWAB)
2402 TIFFSwabLong8((uint64_t *)ma);
2403 err = TIFFReadDirEntryCheckRangeSlongSlong8(*ma);
2404 if (err != TIFFReadDirEntryErrOk)
2405 break;
2406 *mb++ = (int32_t)(*ma++);
2407 }
2408 }
2409 break;
2410 }
2411 _TIFFfreeExt(tif, origdata);
2412 if (err != TIFFReadDirEntryErrOk)
2413 {
2414 _TIFFfreeExt(tif, data);
2415 return (err);
2416 }
2417 *value = data;
2418 return (TIFFReadDirEntryErrOk);
2419 }
2420
2421 static enum TIFFReadDirEntryErr
2422 TIFFReadDirEntryLong8ArrayWithLimit(TIFF *tif, TIFFDirEntry *direntry,
2423 uint64_t **value, uint64_t maxcount)
2424 {
2425 enum TIFFReadDirEntryErr err;
2426 uint32_t count;
2427 void *origdata;
2428 uint64_t *data;
2429 switch (direntry->tdir_type)
2430 {
2431 case TIFF_BYTE:
2432 case TIFF_SBYTE:
2433 case TIFF_SHORT:
2434 case TIFF_SSHORT:
2435 case TIFF_LONG:
2436 case TIFF_SLONG:
2437 case TIFF_LONG8:
2438 case TIFF_SLONG8:
2439 break;
2440 default:
2441 return (TIFFReadDirEntryErrType);
2442 }
2443 err = TIFFReadDirEntryArrayWithLimit(tif, direntry, &count, 8, &origdata,
2444 maxcount);
2445 if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
2446 {
2447 *value = 0;
2448 return (err);
2449 }
2450 switch (direntry->tdir_type)
2451 {
2452 case TIFF_LONG8:
2453 *value = (uint64_t *)origdata;
2454 if (tif->tif_flags & TIFF_SWAB)
2455 TIFFSwabArrayOfLong8(*value, count);
2456 return (TIFFReadDirEntryErrOk);
2457 case TIFF_SLONG8:
2458 {
2459 int64_t *m;
2460 uint32_t n;
2461 m = (int64_t *)origdata;
2462 for (n = 0; n < count; n++)
2463 {
2464 if (tif->tif_flags & TIFF_SWAB)
2465 TIFFSwabLong8((uint64_t *)m);
2466 err = TIFFReadDirEntryCheckRangeLong8Slong8(*m);
2467 if (err != TIFFReadDirEntryErrOk)
2468 {
2469 _TIFFfreeExt(tif, origdata);
2470 return (err);
2471 }
2472 m++;
2473 }
2474 *value = (uint64_t *)origdata;
2475 return (TIFFReadDirEntryErrOk);
2476 }
2477 }
2478 data = (uint64_t *)_TIFFmallocExt(tif, count * 8);
2479 if (data == 0)
2480 {
2481 _TIFFfreeExt(tif, origdata);
2482 return (TIFFReadDirEntryErrAlloc);
2483 }
2484 switch (direntry->tdir_type)
2485 {
2486 case TIFF_BYTE:
2487 {
2488 uint8_t *ma;
2489 uint64_t *mb;
2490 uint32_t n;
2491 ma = (uint8_t *)origdata;
2492 mb = data;
2493 for (n = 0; n < count; n++)
2494 *mb++ = (uint64_t)(*ma++);
2495 }
2496 break;
2497 case TIFF_SBYTE:
2498 {
2499 int8_t *ma;
2500 uint64_t *mb;
2501 uint32_t n;
2502 ma = (int8_t *)origdata;
2503 mb = data;
2504 for (n = 0; n < count; n++)
2505 {
2506 err = TIFFReadDirEntryCheckRangeLong8Sbyte(*ma);
2507 if (err != TIFFReadDirEntryErrOk)
2508 break;
2509 *mb++ = (uint64_t)(*ma++);
2510 }
2511 }
2512 break;
2513 case TIFF_SHORT:
2514 {
2515 uint16_t *ma;
2516 uint64_t *mb;
2517 uint32_t n;
2518 ma = (uint16_t *)origdata;
2519 mb = data;
2520 for (n = 0; n < count; n++)
2521 {
2522 if (tif->tif_flags & TIFF_SWAB)
2523 TIFFSwabShort(ma);
2524 *mb++ = (uint64_t)(*ma++);
2525 }
2526 }
2527 break;
2528 case TIFF_SSHORT:
2529 {
2530 int16_t *ma;
2531 uint64_t *mb;
2532 uint32_t n;
2533 ma = (int16_t *)origdata;
2534 mb = data;
2535 for (n = 0; n < count; n++)
2536 {
2537 if (tif->tif_flags & TIFF_SWAB)
2538 TIFFSwabShort((uint16_t *)ma);
2539 err = TIFFReadDirEntryCheckRangeLong8Sshort(*ma);
2540 if (err != TIFFReadDirEntryErrOk)
2541 break;
2542 *mb++ = (uint64_t)(*ma++);
2543 }
2544 }
2545 break;
2546 case TIFF_LONG:
2547 {
2548 uint32_t *ma;
2549 uint64_t *mb;
2550 uint32_t n;
2551 ma = (uint32_t *)origdata;
2552 mb = data;
2553 for (n = 0; n < count; n++)
2554 {
2555 if (tif->tif_flags & TIFF_SWAB)
2556 TIFFSwabLong(ma);
2557 *mb++ = (uint64_t)(*ma++);
2558 }
2559 }
2560 break;
2561 case TIFF_SLONG:
2562 {
2563 int32_t *ma;
2564 uint64_t *mb;
2565 uint32_t n;
2566 ma = (int32_t *)origdata;
2567 mb = data;
2568 for (n = 0; n < count; n++)
2569 {
2570 if (tif->tif_flags & TIFF_SWAB)
2571 TIFFSwabLong((uint32_t *)ma);
2572 err = TIFFReadDirEntryCheckRangeLong8Slong(*ma);
2573 if (err != TIFFReadDirEntryErrOk)
2574 break;
2575 *mb++ = (uint64_t)(*ma++);
2576 }
2577 }
2578 break;
2579 }
2580 _TIFFfreeExt(tif, origdata);
2581 if (err != TIFFReadDirEntryErrOk)
2582 {
2583 _TIFFfreeExt(tif, data);
2584 return (err);
2585 }
2586 *value = data;
2587 return (TIFFReadDirEntryErrOk);
2588 }
2589
2590 static enum TIFFReadDirEntryErr
2591 TIFFReadDirEntryLong8Array(TIFF *tif, TIFFDirEntry *direntry, uint64_t **value)
2592 {
2593 return TIFFReadDirEntryLong8ArrayWithLimit(tif, direntry, value,
2594 ~((uint64_t)0));
2595 }
2596
2597 static enum TIFFReadDirEntryErr
2598 TIFFReadDirEntrySlong8Array(TIFF *tif, TIFFDirEntry *direntry, int64_t **value)
2599 {
2600 enum TIFFReadDirEntryErr err;
2601 uint32_t count;
2602 void *origdata;
2603 int64_t *data;
2604 switch (direntry->tdir_type)
2605 {
2606 case TIFF_BYTE:
2607 case TIFF_SBYTE:
2608 case TIFF_SHORT:
2609 case TIFF_SSHORT:
2610 case TIFF_LONG:
2611 case TIFF_SLONG:
2612 case TIFF_LONG8:
2613 case TIFF_SLONG8:
2614 break;
2615 default:
2616 return (TIFFReadDirEntryErrType);
2617 }
2618 err = TIFFReadDirEntryArray(tif, direntry, &count, 8, &origdata);
2619 if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
2620 {
2621 *value = 0;
2622 return (err);
2623 }
2624 switch (direntry->tdir_type)
2625 {
2626 case TIFF_LONG8:
2627 {
2628 uint64_t *m;
2629 uint32_t n;
2630 m = (uint64_t *)origdata;
2631 for (n = 0; n < count; n++)
2632 {
2633 if (tif->tif_flags & TIFF_SWAB)
2634 TIFFSwabLong8(m);
2635 err = TIFFReadDirEntryCheckRangeSlong8Long8(*m);
2636 if (err != TIFFReadDirEntryErrOk)
2637 {
2638 _TIFFfreeExt(tif, origdata);
2639 return (err);
2640 }
2641 m++;
2642 }
2643 *value = (int64_t *)origdata;
2644 return (TIFFReadDirEntryErrOk);
2645 }
2646 case TIFF_SLONG8:
2647 *value = (int64_t *)origdata;
2648 if (tif->tif_flags & TIFF_SWAB)
2649 TIFFSwabArrayOfLong8((uint64_t *)(*value), count);
2650 return (TIFFReadDirEntryErrOk);
2651 }
2652 data = (int64_t *)_TIFFmallocExt(tif, count * 8);
2653 if (data == 0)
2654 {
2655 _TIFFfreeExt(tif, origdata);
2656 return (TIFFReadDirEntryErrAlloc);
2657 }
2658 switch (direntry->tdir_type)
2659 {
2660 case TIFF_BYTE:
2661 {
2662 uint8_t *ma;
2663 int64_t *mb;
2664 uint32_t n;
2665 ma = (uint8_t *)origdata;
2666 mb = data;
2667 for (n = 0; n < count; n++)
2668 *mb++ = (int64_t)(*ma++);
2669 }
2670 break;
2671 case TIFF_SBYTE:
2672 {
2673 int8_t *ma;
2674 int64_t *mb;
2675 uint32_t n;
2676 ma = (int8_t *)origdata;
2677 mb = data;
2678 for (n = 0; n < count; n++)
2679 *mb++ = (int64_t)(*ma++);
2680 }
2681 break;
2682 case TIFF_SHORT:
2683 {
2684 uint16_t *ma;
2685 int64_t *mb;
2686 uint32_t n;
2687 ma = (uint16_t *)origdata;
2688 mb = data;
2689 for (n = 0; n < count; n++)
2690 {
2691 if (tif->tif_flags & TIFF_SWAB)
2692 TIFFSwabShort(ma);
2693 *mb++ = (int64_t)(*ma++);
2694 }
2695 }
2696 break;
2697 case TIFF_SSHORT:
2698 {
2699 int16_t *ma;
2700 int64_t *mb;
2701 uint32_t n;
2702 ma = (int16_t *)origdata;
2703 mb = data;
2704 for (n = 0; n < count; n++)
2705 {
2706 if (tif->tif_flags & TIFF_SWAB)
2707 TIFFSwabShort((uint16_t *)ma);
2708 *mb++ = (int64_t)(*ma++);
2709 }
2710 }
2711 break;
2712 case TIFF_LONG:
2713 {
2714 uint32_t *ma;
2715 int64_t *mb;
2716 uint32_t n;
2717 ma = (uint32_t *)origdata;
2718 mb = data;
2719 for (n = 0; n < count; n++)
2720 {
2721 if (tif->tif_flags & TIFF_SWAB)
2722 TIFFSwabLong(ma);
2723 *mb++ = (int64_t)(*ma++);
2724 }
2725 }
2726 break;
2727 case TIFF_SLONG:
2728 {
2729 int32_t *ma;
2730 int64_t *mb;
2731 uint32_t n;
2732 ma = (int32_t *)origdata;
2733 mb = data;
2734 for (n = 0; n < count; n++)
2735 {
2736 if (tif->tif_flags & TIFF_SWAB)
2737 TIFFSwabLong((uint32_t *)ma);
2738 *mb++ = (int64_t)(*ma++);
2739 }
2740 }
2741 break;
2742 }
2743 _TIFFfreeExt(tif, origdata);
2744 *value = data;
2745 return (TIFFReadDirEntryErrOk);
2746 }
2747
2748 static enum TIFFReadDirEntryErr
2749 TIFFReadDirEntryFloatArray(TIFF *tif, TIFFDirEntry *direntry, float **value)
2750 {
2751 enum TIFFReadDirEntryErr err;
2752 uint32_t count;
2753 void *origdata;
2754 float *data;
2755 switch (direntry->tdir_type)
2756 {
2757 case TIFF_BYTE:
2758 case TIFF_SBYTE:
2759 case TIFF_SHORT:
2760 case TIFF_SSHORT:
2761 case TIFF_LONG:
2762 case TIFF_SLONG:
2763 case TIFF_LONG8:
2764 case TIFF_SLONG8:
2765 case TIFF_RATIONAL:
2766 case TIFF_SRATIONAL:
2767 case TIFF_FLOAT:
2768 case TIFF_DOUBLE:
2769 break;
2770 default:
2771 return (TIFFReadDirEntryErrType);
2772 }
2773 err = TIFFReadDirEntryArray(tif, direntry, &count, 4, &origdata);
2774 if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
2775 {
2776 *value = 0;
2777 return (err);
2778 }
2779 switch (direntry->tdir_type)
2780 {
2781 case TIFF_FLOAT:
2782 if (tif->tif_flags & TIFF_SWAB)
2783 TIFFSwabArrayOfLong((uint32_t *)origdata, count);
2784 TIFFCvtIEEEDoubleToNative(tif, count, (float *)origdata);
2785 *value = (float *)origdata;
2786 return (TIFFReadDirEntryErrOk);
2787 }
2788 data = (float *)_TIFFmallocExt(tif, count * sizeof(float));
2789 if (data == 0)
2790 {
2791 _TIFFfreeExt(tif, origdata);
2792 return (TIFFReadDirEntryErrAlloc);
2793 }
2794 switch (direntry->tdir_type)
2795 {
2796 case TIFF_BYTE:
2797 {
2798 uint8_t *ma;
2799 float *mb;
2800 uint32_t n;
2801 ma = (uint8_t *)origdata;
2802 mb = data;
2803 for (n = 0; n < count; n++)
2804 *mb++ = (float)(*ma++);
2805 }
2806 break;
2807 case TIFF_SBYTE:
2808 {
2809 int8_t *ma;
2810 float *mb;
2811 uint32_t n;
2812 ma = (int8_t *)origdata;
2813 mb = data;
2814 for (n = 0; n < count; n++)
2815 *mb++ = (float)(*ma++);
2816 }
2817 break;
2818 case TIFF_SHORT:
2819 {
2820 uint16_t *ma;
2821 float *mb;
2822 uint32_t n;
2823 ma = (uint16_t *)origdata;
2824 mb = data;
2825 for (n = 0; n < count; n++)
2826 {
2827 if (tif->tif_flags & TIFF_SWAB)
2828 TIFFSwabShort(ma);
2829 *mb++ = (float)(*ma++);
2830 }
2831 }
2832 break;
2833 case TIFF_SSHORT:
2834 {
2835 int16_t *ma;
2836 float *mb;
2837 uint32_t n;
2838 ma = (int16_t *)origdata;
2839 mb = data;
2840 for (n = 0; n < count; n++)
2841 {
2842 if (tif->tif_flags & TIFF_SWAB)
2843 TIFFSwabShort((uint16_t *)ma);
2844 *mb++ = (float)(*ma++);
2845 }
2846 }
2847 break;
2848 case TIFF_LONG:
2849 {
2850 uint32_t *ma;
2851 float *mb;
2852 uint32_t n;
2853 ma = (uint32_t *)origdata;
2854 mb = data;
2855 for (n = 0; n < count; n++)
2856 {
2857 if (tif->tif_flags & TIFF_SWAB)
2858 TIFFSwabLong(ma);
2859 *mb++ = (float)(*ma++);
2860 }
2861 }
2862 break;
2863 case TIFF_SLONG:
2864 {
2865 int32_t *ma;
2866 float *mb;
2867 uint32_t n;
2868 ma = (int32_t *)origdata;
2869 mb = data;
2870 for (n = 0; n < count; n++)
2871 {
2872 if (tif->tif_flags & TIFF_SWAB)
2873 TIFFSwabLong((uint32_t *)ma);
2874 *mb++ = (float)(*ma++);
2875 }
2876 }
2877 break;
2878 case TIFF_LONG8:
2879 {
2880 uint64_t *ma;
2881 float *mb;
2882 uint32_t n;
2883 ma = (uint64_t *)origdata;
2884 mb = data;
2885 for (n = 0; n < count; n++)
2886 {
2887 if (tif->tif_flags & TIFF_SWAB)
2888 TIFFSwabLong8(ma);
2889 #if defined(__WIN32__) && (_MSC_VER < 1500)
2890 /*
2891 * XXX: MSVC 6.0 does not support
2892 * conversion of 64-bit integers into
2893 * floating point values.
2894 */
2895 *mb++ = _TIFFUInt64ToFloat(*ma++);
2896 #else
2897 *mb++ = (float)(*ma++);
2898 #endif
2899 }
2900 }
2901 break;
2902 case TIFF_SLONG8:
2903 {
2904 int64_t *ma;
2905 float *mb;
2906 uint32_t n;
2907 ma = (int64_t *)origdata;
2908 mb = data;
2909 for (n = 0; n < count; n++)
2910 {
2911 if (tif->tif_flags & TIFF_SWAB)
2912 TIFFSwabLong8((uint64_t *)ma);
2913 *mb++ = (float)(*ma++);
2914 }
2915 }
2916 break;
2917 case TIFF_RATIONAL:
2918 {
2919 uint32_t *ma;
2920 uint32_t maa;
2921 uint32_t mab;
2922 float *mb;
2923 uint32_t n;
2924 ma = (uint32_t *)origdata;
2925 mb = data;
2926 for (n = 0; n < count; n++)
2927 {
2928 if (tif->tif_flags & TIFF_SWAB)
2929 TIFFSwabLong(ma);
2930 maa = *ma++;
2931 if (tif->tif_flags & TIFF_SWAB)
2932 TIFFSwabLong(ma);
2933 mab = *ma++;
2934 if (mab == 0)
2935 *mb++ = 0.0;
2936 else
2937 *mb++ = (float)maa / (float)mab;
2938 }
2939 }
2940 break;
2941 case TIFF_SRATIONAL:
2942 {
2943 uint32_t *ma;
2944 int32_t maa;
2945 uint32_t mab;
2946 float *mb;
2947 uint32_t n;
2948 ma = (uint32_t *)origdata;
2949 mb = data;
2950 for (n = 0; n < count; n++)
2951 {
2952 if (tif->tif_flags & TIFF_SWAB)
2953 TIFFSwabLong(ma);
2954 maa = *(int32_t *)ma;
2955 ma++;
2956 if (tif->tif_flags & TIFF_SWAB)
2957 TIFFSwabLong(ma);
2958 mab = *ma++;
2959 if (mab == 0)
2960 *mb++ = 0.0;
2961 else
2962 *mb++ = (float)maa / (float)mab;
2963 }
2964 }
2965 break;
2966 case TIFF_DOUBLE:
2967 {
2968 double *ma;
2969 float *mb;
2970 uint32_t n;
2971 if (tif->tif_flags & TIFF_SWAB)
2972 TIFFSwabArrayOfLong8((uint64_t *)origdata, count);
2973 TIFFCvtIEEEDoubleToNative(tif, count, (double *)origdata);
2974 ma = (double *)origdata;
2975 mb = data;
2976 for (n = 0; n < count; n++)
2977 {
2978 double val = *ma++;
2979 if (val > FLT_MAX)
2980 val = FLT_MAX;
2981 else if (val < -FLT_MAX)
2982 val = -FLT_MAX;
2983 *mb++ = (float)val;
2984 }
2985 }
2986 break;
2987 }
2988 _TIFFfreeExt(tif, origdata);
2989 *value = data;
2990 return (TIFFReadDirEntryErrOk);
2991 }
2992
2993 static enum TIFFReadDirEntryErr
2994 TIFFReadDirEntryDoubleArray(TIFF *tif, TIFFDirEntry *direntry, double **value)
2995 {
2996 enum TIFFReadDirEntryErr err;
2997 uint32_t count;
2998 void *origdata;
2999 double *data;
3000 switch (direntry->tdir_type)
3001 {
3002 case TIFF_BYTE:
3003 case TIFF_SBYTE:
3004 case TIFF_SHORT:
3005 case TIFF_SSHORT:
3006 case TIFF_LONG:
3007 case TIFF_SLONG:
3008 case TIFF_LONG8:
3009 case TIFF_SLONG8:
3010 case TIFF_RATIONAL:
3011 case TIFF_SRATIONAL:
3012 case TIFF_FLOAT:
3013 case TIFF_DOUBLE:
3014 break;
3015 default:
3016 return (TIFFReadDirEntryErrType);
3017 }
3018 err = TIFFReadDirEntryArray(tif, direntry, &count, 8, &origdata);
3019 if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
3020 {
3021 *value = 0;
3022 return (err);
3023 }
3024 switch (direntry->tdir_type)
3025 {
3026 case TIFF_DOUBLE:
3027 if (tif->tif_flags & TIFF_SWAB)
3028 TIFFSwabArrayOfLong8((uint64_t *)origdata, count);
3029 TIFFCvtIEEEDoubleToNative(tif, count, (double *)origdata);
3030 *value = (double *)origdata;
3031 return (TIFFReadDirEntryErrOk);
3032 }
3033 data = (double *)_TIFFmallocExt(tif, count * sizeof(double));
3034 if (data == 0)
3035 {
3036 _TIFFfreeExt(tif, origdata);
3037 return (TIFFReadDirEntryErrAlloc);
3038 }
3039 switch (direntry->tdir_type)
3040 {
3041 case TIFF_BYTE:
3042 {
3043 uint8_t *ma;
3044 double *mb;
3045 uint32_t n;
3046 ma = (uint8_t *)origdata;
3047 mb = data;
3048 for (n = 0; n < count; n++)
3049 *mb++ = (double)(*ma++);
3050 }
3051 break;
3052 case TIFF_SBYTE:
3053 {
3054 int8_t *ma;
3055 double *mb;
3056 uint32_t n;
3057 ma = (int8_t *)origdata;
3058 mb = data;
3059 for (n = 0; n < count; n++)
3060 *mb++ = (double)(*ma++);
3061 }
3062 break;
3063 case TIFF_SHORT:
3064 {
3065 uint16_t *ma;
3066 double *mb;
3067 uint32_t n;
3068 ma = (uint16_t *)origdata;
3069 mb = data;
3070 for (n = 0; n < count; n++)
3071 {
3072 if (tif->tif_flags & TIFF_SWAB)
3073 TIFFSwabShort(ma);
3074 *mb++ = (double)(*ma++);
3075 }
3076 }
3077 break;
3078 case TIFF_SSHORT:
3079 {
3080 int16_t *ma;
3081 double *mb;
3082 uint32_t n;
3083 ma = (int16_t *)origdata;
3084 mb = data;
3085 for (n = 0; n < count; n++)
3086 {
3087 if (tif->tif_flags & TIFF_SWAB)
3088 TIFFSwabShort((uint16_t *)ma);
3089 *mb++ = (double)(*ma++);
3090 }
3091 }
3092 break;
3093 case TIFF_LONG:
3094 {
3095 uint32_t *ma;
3096 double *mb;
3097 uint32_t n;
3098 ma = (uint32_t *)origdata;
3099 mb = data;
3100 for (n = 0; n < count; n++)
3101 {
3102 if (tif->tif_flags & TIFF_SWAB)
3103 TIFFSwabLong(ma);
3104 *mb++ = (double)(*ma++);
3105 }
3106 }
3107 break;
3108 case TIFF_SLONG:
3109 {
3110 int32_t *ma;
3111 double *mb;
3112 uint32_t n;
3113 ma = (int32_t *)origdata;
3114 mb = data;
3115 for (n = 0; n < count; n++)
3116 {
3117 if (tif->tif_flags & TIFF_SWAB)
3118 TIFFSwabLong((uint32_t *)ma);
3119 *mb++ = (double)(*ma++);
3120 }
3121 }
3122 break;
3123 case TIFF_LONG8:
3124 {
3125 uint64_t *ma;
3126 double *mb;
3127 uint32_t n;
3128 ma = (uint64_t *)origdata;
3129 mb = data;
3130 for (n = 0; n < count; n++)
3131 {
3132 if (tif->tif_flags & TIFF_SWAB)
3133 TIFFSwabLong8(ma);
3134 #if defined(__WIN32__) && (_MSC_VER < 1500)
3135 /*
3136 * XXX: MSVC 6.0 does not support
3137 * conversion of 64-bit integers into
3138 * floating point values.
3139 */
3140 *mb++ = _TIFFUInt64ToDouble(*ma++);
3141 #else
3142 *mb++ = (double)(*ma++);
3143 #endif
3144 }
3145 }
3146 break;
3147 case TIFF_SLONG8:
3148 {
3149 int64_t *ma;
3150 double *mb;
3151 uint32_t n;
3152 ma = (int64_t *)origdata;
3153 mb = data;
3154 for (n = 0; n < count; n++)
3155 {
3156 if (tif->tif_flags & TIFF_SWAB)
3157 TIFFSwabLong8((uint64_t *)ma);
3158 *mb++ = (double)(*ma++);
3159 }
3160 }
3161 break;
3162 case TIFF_RATIONAL:
3163 {
3164 uint32_t *ma;
3165 uint32_t maa;
3166 uint32_t mab;
3167 double *mb;
3168 uint32_t n;
3169 ma = (uint32_t *)origdata;
3170 mb = data;
3171 for (n = 0; n < count; n++)
3172 {
3173 if (tif->tif_flags & TIFF_SWAB)
3174 TIFFSwabLong(ma);
3175 maa = *ma++;
3176 if (tif->tif_flags & TIFF_SWAB)
3177 TIFFSwabLong(ma);
3178 mab = *ma++;
3179 if (mab == 0)
3180 *mb++ = 0.0;
3181 else
3182 *mb++ = (double)maa / (double)mab;
3183 }
3184 }
3185 break;
3186 case TIFF_SRATIONAL:
3187 {
3188 uint32_t *ma;
3189 int32_t maa;
3190 uint32_t mab;
3191 double *mb;
3192 uint32_t n;
3193 ma = (uint32_t *)origdata;
3194 mb = data;
3195 for (n = 0; n < count; n++)
3196 {
3197 if (tif->tif_flags & TIFF_SWAB)
3198 TIFFSwabLong(ma);
3199 maa = *(int32_t *)ma;
3200 ma++;
3201 if (tif->tif_flags & TIFF_SWAB)
3202 TIFFSwabLong(ma);
3203 mab = *ma++;
3204 if (mab == 0)
3205 *mb++ = 0.0;
3206 else
3207 *mb++ = (double)maa / (double)mab;
3208 }
3209 }
3210 break;
3211 case TIFF_FLOAT:
3212 {
3213 float *ma;
3214 double *mb;
3215 uint32_t n;
3216 if (tif->tif_flags & TIFF_SWAB)
3217 TIFFSwabArrayOfLong((uint32_t *)origdata, count);
3218 TIFFCvtIEEEFloatToNative(tif, count, (float *)origdata);
3219 ma = (float *)origdata;
3220 mb = data;
3221 for (n = 0; n < count; n++)
3222 *mb++ = (double)(*ma++);
3223 }
3224 break;
3225 }
3226 _TIFFfreeExt(tif, origdata);
3227 *value = data;
3228 return (TIFFReadDirEntryErrOk);
3229 }
3230
3231 static enum TIFFReadDirEntryErr
3232 TIFFReadDirEntryIfd8Array(TIFF *tif, TIFFDirEntry *direntry, uint64_t **value)
3233 {
3234 enum TIFFReadDirEntryErr err;
3235 uint32_t count;
3236 void *origdata;
3237 uint64_t *data;
3238 switch (direntry->tdir_type)
3239 {
3240 case TIFF_LONG:
3241 case TIFF_LONG8:
3242 case TIFF_IFD:
3243 case TIFF_IFD8:
3244 break;
3245 default:
3246 return (TIFFReadDirEntryErrType);
3247 }
3248 err = TIFFReadDirEntryArray(tif, direntry, &count, 8, &origdata);
3249 if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
3250 {
3251 *value = 0;
3252 return (err);
3253 }
3254 switch (direntry->tdir_type)
3255 {
3256 case TIFF_LONG8:
3257 case TIFF_IFD8:
3258 *value = (uint64_t *)origdata;
3259 if (tif->tif_flags & TIFF_SWAB)
3260 TIFFSwabArrayOfLong8(*value, count);
3261 return (TIFFReadDirEntryErrOk);
3262 }
3263 data = (uint64_t *)_TIFFmallocExt(tif, count * 8);
3264 if (data == 0)
3265 {
3266 _TIFFfreeExt(tif, origdata);
3267 return (TIFFReadDirEntryErrAlloc);
3268 }
3269 switch (direntry->tdir_type)
3270 {
3271 case TIFF_LONG:
3272 case TIFF_IFD:
3273 {
3274 uint32_t *ma;
3275 uint64_t *mb;
3276 uint32_t n;
3277 ma = (uint32_t *)origdata;
3278 mb = data;
3279 for (n = 0; n < count; n++)
3280 {
3281 if (tif->tif_flags & TIFF_SWAB)
3282 TIFFSwabLong(ma);
3283 *mb++ = (uint64_t)(*ma++);
3284 }
3285 }
3286 break;
3287 }
3288 _TIFFfreeExt(tif, origdata);
3289 *value = data;
3290 return (TIFFReadDirEntryErrOk);
3291 }
3292
3293 static enum TIFFReadDirEntryErr
3294 TIFFReadDirEntryPersampleShort(TIFF *tif, TIFFDirEntry *direntry,
3295 uint16_t *value)
3296 {
3297 enum TIFFReadDirEntryErr err;
3298 uint16_t *m;
3299 uint16_t *na;
3300 uint16_t nb;
3301 if (direntry->tdir_count < (uint64_t)tif->tif_dir.td_samplesperpixel)
3302 return (TIFFReadDirEntryErrCount);
3303 err = TIFFReadDirEntryShortArray(tif, direntry, &m);
3304 if (err != TIFFReadDirEntryErrOk || m == NULL)
3305 return (err);
3306 na = m;
3307 nb = tif->tif_dir.td_samplesperpixel;
3308 *value = *na++;
3309 nb--;
3310 while (nb > 0)
3311 {
3312 if (*na++ != *value)
3313 {
3314 err = TIFFReadDirEntryErrPsdif;
3315 break;
3316 }
3317 nb--;
3318 }
3319 _TIFFfreeExt(tif, m);
3320 return (err);
3321 }
3322
3323 static void TIFFReadDirEntryCheckedByte(TIFF *tif, TIFFDirEntry *direntry,
3324 uint8_t *value)
3325 {
3326 (void)tif;
3327 *value = *(uint8_t *)(&direntry->tdir_offset);
3328 }
3329
3330 static void TIFFReadDirEntryCheckedSbyte(TIFF *tif, TIFFDirEntry *direntry,
3331 int8_t *value)
3332 {
3333 (void)tif;
3334 *value = *(int8_t *)(&direntry->tdir_offset);
3335 }
3336
3337 static void TIFFReadDirEntryCheckedShort(TIFF *tif, TIFFDirEntry *direntry,
3338 uint16_t *value)
3339 {
3340 *value = direntry->tdir_offset.toff_short;
3341 /* *value=*(uint16_t*)(&direntry->tdir_offset); */
3342 if (tif->tif_flags & TIFF_SWAB)
3343 TIFFSwabShort(value);
3344 }
3345
3346 static void TIFFReadDirEntryCheckedSshort(TIFF *tif, TIFFDirEntry *direntry,
3347 int16_t *value)
3348 {
3349 *value = *(int16_t *)(&direntry->tdir_offset);
3350 if (tif->tif_flags & TIFF_SWAB)
3351 TIFFSwabShort((uint16_t *)value);
3352 }
3353
3354 static void TIFFReadDirEntryCheckedLong(TIFF *tif, TIFFDirEntry *direntry,
3355 uint32_t *value)
3356 {
3357 *value = *(uint32_t *)(&direntry->tdir_offset);
3358 if (tif->tif_flags & TIFF_SWAB)
3359 TIFFSwabLong(value);
3360 }
3361
3362 static void TIFFReadDirEntryCheckedSlong(TIFF *tif, TIFFDirEntry *direntry,
3363 int32_t *value)
3364 {
3365 *value = *(int32_t *)(&direntry->tdir_offset);
3366 if (tif->tif_flags & TIFF_SWAB)
3367 TIFFSwabLong((uint32_t *)value);
3368 }
3369
3370 static enum TIFFReadDirEntryErr
3371 TIFFReadDirEntryCheckedLong8(TIFF *tif, TIFFDirEntry *direntry, uint64_t *value)
3372 {
3373 if (!(tif->tif_flags & TIFF_BIGTIFF))
3374 {
3375 enum TIFFReadDirEntryErr err;
3376 uint32_t offset = direntry->tdir_offset.toff_long;
3377 if (tif->tif_flags & TIFF_SWAB)
3378 TIFFSwabLong(&offset);
3379 err = TIFFReadDirEntryData(tif, offset, 8, value);
3380 if (err != TIFFReadDirEntryErrOk)
3381 return (err);
3382 }
3383 else
3384 *value = direntry->tdir_offset.toff_long8;
3385 if (tif->tif_flags & TIFF_SWAB)
3386 TIFFSwabLong8(value);
3387 return (TIFFReadDirEntryErrOk);
3388 }
3389
3390 static enum TIFFReadDirEntryErr
3391 TIFFReadDirEntryCheckedSlong8(TIFF *tif, TIFFDirEntry *direntry, int64_t *value)
3392 {
3393 if (!(tif->tif_flags & TIFF_BIGTIFF))
3394 {
3395 enum TIFFReadDirEntryErr err;
3396 uint32_t offset = direntry->tdir_offset.toff_long;
3397 if (tif->tif_flags & TIFF_SWAB)
3398 TIFFSwabLong(&offset);
3399 err = TIFFReadDirEntryData(tif, offset, 8, value);
3400 if (err != TIFFReadDirEntryErrOk)
3401 return (err);
3402 }
3403 else
3404 *value = *(int64_t *)(&direntry->tdir_offset);
3405 if (tif->tif_flags & TIFF_SWAB)
3406 TIFFSwabLong8((uint64_t *)value);
3407 return (TIFFReadDirEntryErrOk);
3408 }
3409
3410 static enum TIFFReadDirEntryErr
3411 TIFFReadDirEntryCheckedRational(TIFF *tif, TIFFDirEntry *direntry,
3412 double *value)
3413 {
3414 UInt64Aligned_t m;
3415
3416 assert(sizeof(double) == 8);
3417 assert(sizeof(uint64_t) == 8);
3418 assert(sizeof(uint32_t) == 4);
3419 if (!(tif->tif_flags & TIFF_BIGTIFF))
3420 {
3421 enum TIFFReadDirEntryErr err;
3422 uint32_t offset = direntry->tdir_offset.toff_long;
3423 if (tif->tif_flags & TIFF_SWAB)
3424 TIFFSwabLong(&offset);
3425 err = TIFFReadDirEntryData(tif, offset, 8, m.i);
3426 if (err != TIFFReadDirEntryErrOk)
3427 return (err);
3428 }
3429 else
3430 m.l = direntry->tdir_offset.toff_long8;
3431 if (tif->tif_flags & TIFF_SWAB)
3432 TIFFSwabArrayOfLong(m.i, 2);
3433 /* Not completely sure what we should do when m.i[1]==0, but some */
3434 /* sanitizers do not like division by 0.0: */
3435 /* http://bugzilla.maptools.org/show_bug.cgi?id=2644 */
3436 if (m.i[0] == 0 || m.i[1] == 0)
3437 *value = 0.0;
3438 else
3439 *value = (double)m.i[0] / (double)m.i[1];
3440 return (TIFFReadDirEntryErrOk);
3441 }
3442
3443 static enum TIFFReadDirEntryErr
3444 TIFFReadDirEntryCheckedSrational(TIFF *tif, TIFFDirEntry *direntry,
3445 double *value)
3446 {
3447 UInt64Aligned_t m;
3448 assert(sizeof(double) == 8);
3449 assert(sizeof(uint64_t) == 8);
3450 assert(sizeof(int32_t) == 4);
3451 assert(sizeof(uint32_t) == 4);
3452 if (!(tif->tif_flags & TIFF_BIGTIFF))
3453 {
3454 enum TIFFReadDirEntryErr err;
3455 uint32_t offset = direntry->tdir_offset.toff_long;
3456 if (tif->tif_flags & TIFF_SWAB)
3457 TIFFSwabLong(&offset);
3458 err = TIFFReadDirEntryData(tif, offset, 8, m.i);
3459 if (err != TIFFReadDirEntryErrOk)
3460 return (err);
3461 }
3462 else
3463 m.l = direntry->tdir_offset.toff_long8;
3464 if (tif->tif_flags & TIFF_SWAB)
3465 TIFFSwabArrayOfLong(m.i, 2);
3466 /* Not completely sure what we should do when m.i[1]==0, but some */
3467 /* sanitizers do not like division by 0.0: */
3468 /* http://bugzilla.maptools.org/show_bug.cgi?id=2644 */
3469 if ((int32_t)m.i[0] == 0 || m.i[1] == 0)
3470 *value = 0.0;
3471 else
3472 *value = (double)((int32_t)m.i[0]) / (double)m.i[1];
3473 return (TIFFReadDirEntryErrOk);
3474 }
3475
3476 #if 0
3477 static enum TIFFReadDirEntryErr
3478 TIFFReadDirEntryCheckedRationalDirect(TIFF *tif, TIFFDirEntry *direntry,
3479 TIFFRational_t *value)
3480 { /*--: SetGetRATIONAL_directly:_CustomTag: Read rational (and signed rationals)
3481 directly --*/
3482 UInt64Aligned_t m;
3483
3484 assert(sizeof(double) == 8);
3485 assert(sizeof(uint64_t) == 8);
3486 assert(sizeof(uint32_t) == 4);
3487
3488 if (direntry->tdir_count != 1)
3489 return (TIFFReadDirEntryErrCount);
3490
3491 if (direntry->tdir_type != TIFF_RATIONAL &&
3492 direntry->tdir_type != TIFF_SRATIONAL)
3493 return (TIFFReadDirEntryErrType);
3494
3495 if (!(tif->tif_flags & TIFF_BIGTIFF))
3496 {
3497 enum TIFFReadDirEntryErr err;
3498 uint32_t offset = direntry->tdir_offset.toff_long;
3499 if (tif->tif_flags & TIFF_SWAB)
3500 TIFFSwabLong(&offset);
3501 err = TIFFReadDirEntryData(tif, offset, 8, m.i);
3502 if (err != TIFFReadDirEntryErrOk)
3503 return (err);
3504 }
3505 else
3506 {
3507 m.l = direntry->tdir_offset.toff_long8;
3508 }
3509
3510 if (tif->tif_flags & TIFF_SWAB)
3511 TIFFSwabArrayOfLong(m.i, 2);
3512
3513 value->uNum = m.i[0];
3514 value->uDenom = m.i[1];
3515 return (TIFFReadDirEntryErrOk);
3516 } /*-- TIFFReadDirEntryCheckedRationalDirect() --*/
3517 #endif
3518
3519 static void TIFFReadDirEntryCheckedFloat(TIFF *tif, TIFFDirEntry *direntry,
3520 float *value)
3521 {
3522 union
3523 {
3524 float f;
3525 uint32_t i;
3526 } float_union;
3527 assert(sizeof(float) == 4);
3528 assert(sizeof(uint32_t) == 4);
3529 assert(sizeof(float_union) == 4);
3530 float_union.i = *(uint32_t *)(&direntry->tdir_offset);
3531 *value = float_union.f;
3532 if (tif->tif_flags & TIFF_SWAB)
3533 TIFFSwabLong((uint32_t *)value);
3534 }
3535
3536 static enum TIFFReadDirEntryErr
3537 TIFFReadDirEntryCheckedDouble(TIFF *tif, TIFFDirEntry *direntry, double *value)
3538 {
3539 assert(sizeof(double) == 8);
3540 assert(sizeof(uint64_t) == 8);
3541 assert(sizeof(UInt64Aligned_t) == 8);
3542 if (!(tif->tif_flags & TIFF_BIGTIFF))
3543 {
3544 enum TIFFReadDirEntryErr err;
3545 uint32_t offset = direntry->tdir_offset.toff_long;
3546 if (tif->tif_flags & TIFF_SWAB)
3547 TIFFSwabLong(&offset);
3548 err = TIFFReadDirEntryData(tif, offset, 8, value);
3549 if (err != TIFFReadDirEntryErrOk)
3550 return (err);
3551 }
3552 else
3553 {
3554 UInt64Aligned_t uint64_union;
3555 uint64_union.l = direntry->tdir_offset.toff_long8;
3556 *value = uint64_union.d;
3557 }
3558 if (tif->tif_flags & TIFF_SWAB)
3559 TIFFSwabLong8((uint64_t *)value);
3560 return (TIFFReadDirEntryErrOk);
3561 }
3562
3563 static enum TIFFReadDirEntryErr
3564 TIFFReadDirEntryCheckRangeByteSbyte(int8_t value)
3565 {
3566 if (value < 0)
3567 return (TIFFReadDirEntryErrRange);
3568 else
3569 return (TIFFReadDirEntryErrOk);
3570 }
3571
3572 static enum TIFFReadDirEntryErr
3573 TIFFReadDirEntryCheckRangeByteShort(uint16_t value)
3574 {
3575 if (value > 0xFF)
3576 return (TIFFReadDirEntryErrRange);
3577 else
3578 return (TIFFReadDirEntryErrOk);
3579 }
3580
3581 static enum TIFFReadDirEntryErr
3582 TIFFReadDirEntryCheckRangeByteSshort(int16_t value)
3583 {
3584 if ((value < 0) || (value > 0xFF))
3585 return (TIFFReadDirEntryErrRange);
3586 else
3587 return (TIFFReadDirEntryErrOk);
3588 }
3589
3590 static enum TIFFReadDirEntryErr
3591 TIFFReadDirEntryCheckRangeByteLong(uint32_t value)
3592 {
3593 if (value > 0xFF)
3594 return (TIFFReadDirEntryErrRange);
3595 else
3596 return (TIFFReadDirEntryErrOk);
3597 }
3598
3599 static enum TIFFReadDirEntryErr
3600 TIFFReadDirEntryCheckRangeByteSlong(int32_t value)
3601 {
3602 if ((value < 0) || (value > 0xFF))
3603 return (TIFFReadDirEntryErrRange);
3604 else
3605 return (TIFFReadDirEntryErrOk);
3606 }
3607
3608 static enum TIFFReadDirEntryErr
3609 TIFFReadDirEntryCheckRangeByteLong8(uint64_t value)
3610 {
3611 if (value > 0xFF)
3612 return (TIFFReadDirEntryErrRange);
3613 else
3614 return (TIFFReadDirEntryErrOk);
3615 }
3616
3617 static enum TIFFReadDirEntryErr
3618 TIFFReadDirEntryCheckRangeByteSlong8(int64_t value)
3619 {
3620 if ((value < 0) || (value > 0xFF))
3621 return (TIFFReadDirEntryErrRange);
3622 else
3623 return (TIFFReadDirEntryErrOk);
3624 }
3625
3626 static enum TIFFReadDirEntryErr
3627 TIFFReadDirEntryCheckRangeSbyteByte(uint8_t value)
3628 {
3629 if (value > 0x7F)
3630 return (TIFFReadDirEntryErrRange);
3631 else
3632 return (TIFFReadDirEntryErrOk);
3633 }
3634
3635 static enum TIFFReadDirEntryErr
3636 TIFFReadDirEntryCheckRangeSbyteShort(uint16_t value)
3637 {
3638 if (value > 0x7F)
3639 return (TIFFReadDirEntryErrRange);
3640 else
3641 return (TIFFReadDirEntryErrOk);
3642 }
3643
3644 static enum TIFFReadDirEntryErr
3645 TIFFReadDirEntryCheckRangeSbyteSshort(int16_t value)
3646 {
3647 if ((value < -0x80) || (value > 0x7F))
3648 return (TIFFReadDirEntryErrRange);
3649 else
3650 return (TIFFReadDirEntryErrOk);
3651 }
3652
3653 static enum TIFFReadDirEntryErr
3654 TIFFReadDirEntryCheckRangeSbyteLong(uint32_t value)
3655 {
3656 if (value > 0x7F)
3657 return (TIFFReadDirEntryErrRange);
3658 else
3659 return (TIFFReadDirEntryErrOk);
3660 }
3661
3662 static enum TIFFReadDirEntryErr
3663 TIFFReadDirEntryCheckRangeSbyteSlong(int32_t value)
3664 {
3665 if ((value < -0x80) || (value > 0x7F))
3666 return (TIFFReadDirEntryErrRange);
3667 else
3668 return (TIFFReadDirEntryErrOk);
3669 }
3670
3671 static enum TIFFReadDirEntryErr
3672 TIFFReadDirEntryCheckRangeSbyteLong8(uint64_t value)
3673 {
3674 if (value > 0x7F)
3675 return (TIFFReadDirEntryErrRange);
3676 else
3677 return (TIFFReadDirEntryErrOk);
3678 }
3679
3680 static enum TIFFReadDirEntryErr
3681 TIFFReadDirEntryCheckRangeSbyteSlong8(int64_t value)
3682 {
3683 if ((value < -0x80) || (value > 0x7F))
3684 return (TIFFReadDirEntryErrRange);
3685 else
3686 return (TIFFReadDirEntryErrOk);
3687 }
3688
3689 static enum TIFFReadDirEntryErr
3690 TIFFReadDirEntryCheckRangeShortSbyte(int8_t value)
3691 {
3692 if (value < 0)
3693 return (TIFFReadDirEntryErrRange);
3694 else
3695 return (TIFFReadDirEntryErrOk);
3696 }
3697
3698 static enum TIFFReadDirEntryErr
3699 TIFFReadDirEntryCheckRangeShortSshort(int16_t value)
3700 {
3701 if (value < 0)
3702 return (TIFFReadDirEntryErrRange);
3703 else
3704 return (TIFFReadDirEntryErrOk);
3705 }
3706
3707 static enum TIFFReadDirEntryErr
3708 TIFFReadDirEntryCheckRangeShortLong(uint32_t value)
3709 {
3710 if (value > 0xFFFF)
3711 return (TIFFReadDirEntryErrRange);
3712 else
3713 return (TIFFReadDirEntryErrOk);
3714 }
3715
3716 static enum TIFFReadDirEntryErr
3717 TIFFReadDirEntryCheckRangeShortSlong(int32_t value)
3718 {
3719 if ((value < 0) || (value > 0xFFFF))
3720 return (TIFFReadDirEntryErrRange);
3721 else
3722 return (TIFFReadDirEntryErrOk);
3723 }
3724
3725 static enum TIFFReadDirEntryErr
3726 TIFFReadDirEntryCheckRangeShortLong8(uint64_t value)
3727 {
3728 if (value > 0xFFFF)
3729 return (TIFFReadDirEntryErrRange);
3730 else
3731 return (TIFFReadDirEntryErrOk);
3732 }
3733
3734 static enum TIFFReadDirEntryErr
3735 TIFFReadDirEntryCheckRangeShortSlong8(int64_t value)
3736 {
3737 if ((value < 0) || (value > 0xFFFF))
3738 return (TIFFReadDirEntryErrRange);
3739 else
3740 return (TIFFReadDirEntryErrOk);
3741 }
3742
3743 static enum TIFFReadDirEntryErr
3744 TIFFReadDirEntryCheckRangeSshortShort(uint16_t value)
3745 {
3746 if (value > 0x7FFF)
3747 return (TIFFReadDirEntryErrRange);
3748 else
3749 return (TIFFReadDirEntryErrOk);
3750 }
3751
3752 static enum TIFFReadDirEntryErr
3753 TIFFReadDirEntryCheckRangeSshortLong(uint32_t value)
3754 {
3755 if (value > 0x7FFF)
3756 return (TIFFReadDirEntryErrRange);
3757 else
3758 return (TIFFReadDirEntryErrOk);
3759 }
3760
3761 static enum TIFFReadDirEntryErr
3762 TIFFReadDirEntryCheckRangeSshortSlong(int32_t value)
3763 {
3764 if ((value < -0x8000) || (value > 0x7FFF))
3765 return (TIFFReadDirEntryErrRange);
3766 else
3767 return (TIFFReadDirEntryErrOk);
3768 }
3769
3770 static enum TIFFReadDirEntryErr
3771 TIFFReadDirEntryCheckRangeSshortLong8(uint64_t value)
3772 {
3773 if (value > 0x7FFF)
3774 return (TIFFReadDirEntryErrRange);
3775 else
3776 return (TIFFReadDirEntryErrOk);
3777 }
3778
3779 static enum TIFFReadDirEntryErr
3780 TIFFReadDirEntryCheckRangeSshortSlong8(int64_t value)
3781 {
3782 if ((value < -0x8000) || (value > 0x7FFF))
3783 return (TIFFReadDirEntryErrRange);
3784 else
3785 return (TIFFReadDirEntryErrOk);
3786 }
3787
3788 static enum TIFFReadDirEntryErr
3789 TIFFReadDirEntryCheckRangeLongSbyte(int8_t value)
3790 {
3791 if (value < 0)
3792 return (TIFFReadDirEntryErrRange);
3793 else
3794 return (TIFFReadDirEntryErrOk);
3795 }
3796
3797 static enum TIFFReadDirEntryErr
3798 TIFFReadDirEntryCheckRangeLongSshort(int16_t value)
3799 {
3800 if (value < 0)
3801 return (TIFFReadDirEntryErrRange);
3802 else
3803 return (TIFFReadDirEntryErrOk);
3804 }
3805
3806 static enum TIFFReadDirEntryErr
3807 TIFFReadDirEntryCheckRangeLongSlong(int32_t value)
3808 {
3809 if (value < 0)
3810 return (TIFFReadDirEntryErrRange);
3811 else
3812 return (TIFFReadDirEntryErrOk);
3813 }
3814
3815 static enum TIFFReadDirEntryErr
3816 TIFFReadDirEntryCheckRangeLongLong8(uint64_t value)
3817 {
3818 if (value > UINT32_MAX)
3819 return (TIFFReadDirEntryErrRange);
3820 else
3821 return (TIFFReadDirEntryErrOk);
3822 }
3823
3824 static enum TIFFReadDirEntryErr
3825 TIFFReadDirEntryCheckRangeLongSlong8(int64_t value)
3826 {
3827 if ((value < 0) || (value > (int64_t)UINT32_MAX))
3828 return (TIFFReadDirEntryErrRange);
3829 else
3830 return (TIFFReadDirEntryErrOk);
3831 }
3832
3833 static enum TIFFReadDirEntryErr
3834 TIFFReadDirEntryCheckRangeSlongLong(uint32_t value)
3835 {
3836 if (value > 0x7FFFFFFFUL)
3837 return (TIFFReadDirEntryErrRange);
3838 else
3839 return (TIFFReadDirEntryErrOk);
3840 }
3841
3842 /* Check that the 8-byte unsigned value can fit in a 4-byte unsigned range */
3843 static enum TIFFReadDirEntryErr
3844 TIFFReadDirEntryCheckRangeSlongLong8(uint64_t value)
3845 {
3846 if (value > 0x7FFFFFFF)
3847 return (TIFFReadDirEntryErrRange);
3848 else
3849 return (TIFFReadDirEntryErrOk);
3850 }
3851
3852 /* Check that the 8-byte signed value can fit in a 4-byte signed range */
3853 static enum TIFFReadDirEntryErr
3854 TIFFReadDirEntryCheckRangeSlongSlong8(int64_t value)
3855 {
3856 if ((value < 0 - ((int64_t)0x7FFFFFFF + 1)) || (value > 0x7FFFFFFF))
3857 return (TIFFReadDirEntryErrRange);
3858 else
3859 return (TIFFReadDirEntryErrOk);
3860 }
3861
3862 static enum TIFFReadDirEntryErr
3863 TIFFReadDirEntryCheckRangeLong8Sbyte(int8_t value)
3864 {
3865 if (value < 0)
3866 return (TIFFReadDirEntryErrRange);
3867 else
3868 return (TIFFReadDirEntryErrOk);
3869 }
3870
3871 static enum TIFFReadDirEntryErr
3872 TIFFReadDirEntryCheckRangeLong8Sshort(int16_t value)
3873 {
3874 if (value < 0)
3875 return (TIFFReadDirEntryErrRange);
3876 else
3877 return (TIFFReadDirEntryErrOk);
3878 }
3879
3880 static enum TIFFReadDirEntryErr
3881 TIFFReadDirEntryCheckRangeLong8Slong(int32_t value)
3882 {
3883 if (value < 0)
3884 return (TIFFReadDirEntryErrRange);
3885 else
3886 return (TIFFReadDirEntryErrOk);
3887 }
3888
3889 static enum TIFFReadDirEntryErr
3890 TIFFReadDirEntryCheckRangeLong8Slong8(int64_t value)
3891 {
3892 if (value < 0)
3893 return (TIFFReadDirEntryErrRange);
3894 else
3895 return (TIFFReadDirEntryErrOk);
3896 }
3897
3898 static enum TIFFReadDirEntryErr
3899 TIFFReadDirEntryCheckRangeSlong8Long8(uint64_t value)
3900 {
3901 if (value > INT64_MAX)
3902 return (TIFFReadDirEntryErrRange);
3903 else
3904 return (TIFFReadDirEntryErrOk);
3905 }
3906
3907 static enum TIFFReadDirEntryErr TIFFReadDirEntryData(TIFF *tif, uint64_t offset,
3908 tmsize_t size, void *dest)
3909 {
3910 assert(size > 0);
3911 if (!isMapped(tif))
3912 {
3913 if (!SeekOK(tif, offset))
3914 return (TIFFReadDirEntryErrIo);
3915 if (!ReadOK(tif, dest, size))
3916 return (TIFFReadDirEntryErrIo);
3917 }
3918 else
3919 {
3920 size_t ma, mb;
3921 ma = (size_t)offset;
3922 if ((uint64_t)ma != offset || ma > (~(size_t)0) - (size_t)size)
3923 {
3924 return TIFFReadDirEntryErrIo;
3925 }
3926 mb = ma + size;
3927 if (mb > (uint64_t)tif->tif_size)
3928 return (TIFFReadDirEntryErrIo);
3929 _TIFFmemcpy(dest, tif->tif_base + ma, size);
3930 }
3931 return (TIFFReadDirEntryErrOk);
3932 }
3933
3934 static void TIFFReadDirEntryOutputErr(TIFF *tif, enum TIFFReadDirEntryErr err,
3935 const char *module, const char *tagname,
3936 int recover)
3937 {
3938 if (!recover)
3939 {
3940 switch (err)
3941 {
3942 case TIFFReadDirEntryErrCount:
3943 TIFFErrorExtR(tif, module, "Incorrect count for \"%s\"",
3944 tagname);
3945 break;
3946 case TIFFReadDirEntryErrType:
3947 TIFFErrorExtR(tif, module, "Incompatible type for \"%s\"",
3948 tagname);
3949 break;
3950 case TIFFReadDirEntryErrIo:
3951 TIFFErrorExtR(tif, module, "IO error during reading of \"%s\"",
3952 tagname);
3953 break;
3954 case TIFFReadDirEntryErrRange:
3955 TIFFErrorExtR(tif, module, "Incorrect value for \"%s\"",
3956 tagname);
3957 break;
3958 case TIFFReadDirEntryErrPsdif:
3959 TIFFErrorExtR(
3960 tif, module,
3961 "Cannot handle different values per sample for \"%s\"",
3962 tagname);
3963 break;
3964 case TIFFReadDirEntryErrSizesan:
3965 TIFFErrorExtR(tif, module,
3966 "Sanity check on size of \"%s\" value failed",
3967 tagname);
3968 break;
3969 case TIFFReadDirEntryErrAlloc:
3970 TIFFErrorExtR(tif, module, "Out of memory reading of \"%s\"",
3971 tagname);
3972 break;
3973 default:
3974 assert(0); /* we should never get here */
3975 break;
3976 }
3977 }
3978 else
3979 {
3980 switch (err)
3981 {
3982 case TIFFReadDirEntryErrCount:
3983 TIFFWarningExtR(tif, module,
3984 "Incorrect count for \"%s\"; tag ignored",
3985 tagname);
3986 break;
3987 case TIFFReadDirEntryErrType:
3988 TIFFWarningExtR(tif, module,
3989 "Incompatible type for \"%s\"; tag ignored",
3990 tagname);
3991 break;
3992 case TIFFReadDirEntryErrIo:
3993 TIFFWarningExtR(
3994 tif, module,
3995 "IO error during reading of \"%s\"; tag ignored", tagname);
3996 break;
3997 case TIFFReadDirEntryErrRange:
3998 TIFFWarningExtR(tif, module,
3999 "Incorrect value for \"%s\"; tag ignored",
4000 tagname);
4001 break;
4002 case TIFFReadDirEntryErrPsdif:
4003 TIFFWarningExtR(tif, module,
4004 "Cannot handle different values per sample for "
4005 "\"%s\"; tag ignored",
4006 tagname);
4007 break;
4008 case TIFFReadDirEntryErrSizesan:
4009 TIFFWarningExtR(
4010 tif, module,
4011 "Sanity check on size of \"%s\" value failed; tag ignored",
4012 tagname);
4013 break;
4014 case TIFFReadDirEntryErrAlloc:
4015 TIFFWarningExtR(tif, module,
4016 "Out of memory reading of \"%s\"; tag ignored",
4017 tagname);
4018 break;
4019 default:
4020 assert(0); /* we should never get here */
4021 break;
4022 }
4023 }
4024 }
4025
4026 /*
4027 * Return the maximum number of color channels specified for a given photometric
4028 * type. 0 is returned if photometric type isn't supported or no default value
4029 * is defined by the specification.
4030 */
4031 static int _TIFFGetMaxColorChannels(uint16_t photometric)
4032 {
4033 switch (photometric)
4034 {
4035 case PHOTOMETRIC_PALETTE:
4036 case PHOTOMETRIC_MINISWHITE:
4037 case PHOTOMETRIC_MINISBLACK:
4038 return 1;
4039 case PHOTOMETRIC_YCBCR:
4040 case PHOTOMETRIC_RGB:
4041 case PHOTOMETRIC_CIELAB:
4042 case PHOTOMETRIC_LOGLUV:
4043 case PHOTOMETRIC_ITULAB:
4044 case PHOTOMETRIC_ICCLAB:
4045 return 3;
4046 case PHOTOMETRIC_SEPARATED:
4047 case PHOTOMETRIC_MASK:
4048 return 4;
4049 case PHOTOMETRIC_LOGL:
4050 case PHOTOMETRIC_CFA:
4051 default:
4052 return 0;
4053 }
4054 }
4055
4056 static int ByteCountLooksBad(TIFF *tif)
4057 {
4058 /*
4059 * Assume we have wrong StripByteCount value (in case
4060 * of single strip) in following cases:
4061 * - it is equal to zero along with StripOffset;
4062 * - it is larger than file itself (in case of uncompressed
4063 * image);
4064 * - it is smaller than the size of the bytes per row
4065 * multiplied on the number of rows. The last case should
4066 * not be checked in the case of writing new image,
4067 * because we may do not know the exact strip size
4068 * until the whole image will be written and directory
4069 * dumped out.
4070 */
4071 uint64_t bytecount = TIFFGetStrileByteCount(tif, 0);
4072 uint64_t offset = TIFFGetStrileOffset(tif, 0);
4073 uint64_t filesize;
4074
4075 if (offset == 0)
4076 return 0;
4077 if (bytecount == 0)
4078 return 1;
4079 if (tif->tif_dir.td_compression != COMPRESSION_NONE)
4080 return 0;
4081 filesize = TIFFGetFileSize(tif);
4082 if (offset <= filesize && bytecount > filesize - offset)
4083 return 1;
4084 if (tif->tif_mode == O_RDONLY)
4085 {
4086 uint64_t scanlinesize = TIFFScanlineSize64(tif);
4087 if (tif->tif_dir.td_imagelength > 0 &&
4088 scanlinesize > UINT64_MAX / tif->tif_dir.td_imagelength)
4089 {
4090 return 1;
4091 }
4092 if (bytecount < scanlinesize * tif->tif_dir.td_imagelength)
4093 return 1;
4094 }
4095 return 0;
4096 }
4097
4098 /*
4099 * Read the next TIFF directory from a file and convert it to the internal
4100 * format. We read directories sequentially.
4101 */
4102 int TIFFReadDirectory(TIFF *tif)
4103 {
4104 static const char module[] = "TIFFReadDirectory";
4105 TIFFDirEntry *dir;
4106 uint16_t dircount;
4107 TIFFDirEntry *dp;
4108 uint16_t di;
4109 const TIFFField *fip;
4110 uint32_t fii = FAILED_FII;
4111 toff_t nextdiroff;
4112 int bitspersample_read = FALSE;
4113 int color_channels;
4114
4115 if (tif->tif_nextdiroff == 0)
4116 {
4117 /* In this special case, tif_diroff needs also to be set to 0.
4118 * This is behind the last IFD, thus no checking or reading necessary.
4119 */
4120 tif->tif_diroff = tif->tif_nextdiroff;
4121 return 0;
4122 }
4123
4124 nextdiroff = tif->tif_nextdiroff;
4125 /* tif_curdir++ and tif_nextdiroff should only be updated after SUCCESSFUL
4126 * reading of the directory. Otherwise, invalid IFD offsets could corrupt
4127 * the IFD list. */
4128 if (!_TIFFCheckDirNumberAndOffset(tif,
4129 tif->tif_curdir ==
4130 TIFF_NON_EXISTENT_DIR_NUMBER
4131 ? 0
4132 : tif->tif_curdir + 1,
4133 nextdiroff))
4134 {
4135 return 0; /* bad offset (IFD looping or more than TIFF_MAX_DIR_COUNT
4136 IFDs) */
4137 }
4138 dircount = TIFFFetchDirectory(tif, nextdiroff, &dir, &tif->tif_nextdiroff);
4139 if (!dircount)
4140 {
4141 TIFFErrorExtR(tif, module,
4142 "Failed to read directory at offset %" PRIu64,
4143 nextdiroff);
4144 return 0;
4145 }
4146 /* Set global values after a valid directory has been fetched.
4147 * tif_diroff is already set to nextdiroff in TIFFFetchDirectory() in the
4148 * beginning. */
4149 if (tif->tif_curdir == TIFF_NON_EXISTENT_DIR_NUMBER)
4150 tif->tif_curdir = 0;
4151 else
4152 tif->tif_curdir++;
4153 (*tif->tif_cleanup)(tif); /* cleanup any previous compression state */
4154
4155 TIFFReadDirectoryCheckOrder(tif, dir, dircount);
4156
4157 /*
4158 * Mark duplicates of any tag to be ignored (bugzilla 1994)
4159 * to avoid certain pathological problems.
4160 */
4161 {
4162 TIFFDirEntry *ma;
4163 uint16_t mb;
4164 for (ma = dir, mb = 0; mb < dircount; ma++, mb++)
4165 {
4166 TIFFDirEntry *na;
4167 uint16_t nb;
4168 for (na = ma + 1, nb = mb + 1; nb < dircount; na++, nb++)
4169 {
4170 if (ma->tdir_tag == na->tdir_tag)
4171 {
4172 na->tdir_ignore = TRUE;
4173 }
4174 }
4175 }
4176 }
4177
4178 tif->tif_flags &= ~TIFF_BEENWRITING; /* reset before new dir */
4179 tif->tif_flags &= ~TIFF_BUF4WRITE; /* reset before new dir */
4180 tif->tif_flags &= ~TIFF_CHOPPEDUPARRAYS;
4181
4182 /* free any old stuff and reinit */
4183 TIFFFreeDirectory(tif);
4184 TIFFDefaultDirectory(tif);
4185 /*
4186 * Electronic Arts writes gray-scale TIFF files
4187 * without a PlanarConfiguration directory entry.
4188 * Thus we setup a default value here, even though
4189 * the TIFF spec says there is no default value.
4190 * After PlanarConfiguration is preset in TIFFDefaultDirectory()
4191 * the following setting is not needed, but does not harm either.
4192 */
4193 TIFFSetField(tif, TIFFTAG_PLANARCONFIG, PLANARCONFIG_CONTIG);
4194 /*
4195 * Setup default value and then make a pass over
4196 * the fields to check type and tag information,
4197 * and to extract info required to size data
4198 * structures. A second pass is made afterwards
4199 * to read in everything not taken in the first pass.
4200 * But we must process the Compression tag first
4201 * in order to merge in codec-private tag definitions (otherwise
4202 * we may get complaints about unknown tags). However, the
4203 * Compression tag may be dependent on the SamplesPerPixel
4204 * tag value because older TIFF specs permitted Compression
4205 * to be written as a SamplesPerPixel-count tag entry.
4206 * Thus if we don't first figure out the correct SamplesPerPixel
4207 * tag value then we may end up ignoring the Compression tag
4208 * value because it has an incorrect count value (if the
4209 * true value of SamplesPerPixel is not 1).
4210 */
4211 dp =
4212 TIFFReadDirectoryFindEntry(tif, dir, dircount, TIFFTAG_SAMPLESPERPIXEL);
4213 if (dp)
4214 {
4215 if (!TIFFFetchNormalTag(tif, dp, 0))
4216 goto bad;
4217 dp->tdir_ignore = TRUE;
4218 }
4219 dp = TIFFReadDirectoryFindEntry(tif, dir, dircount, TIFFTAG_COMPRESSION);
4220 if (dp)
4221 {
4222 /*
4223 * The 5.0 spec says the Compression tag has one value, while
4224 * earlier specs say it has one value per sample. Because of
4225 * this, we accept the tag if one value is supplied with either
4226 * count.
4227 */
4228 uint16_t value;
4229 enum TIFFReadDirEntryErr err;
4230 err = TIFFReadDirEntryShort(tif, dp, &value);
4231 if (err == TIFFReadDirEntryErrCount)
4232 err = TIFFReadDirEntryPersampleShort(tif, dp, &value);
4233 if (err != TIFFReadDirEntryErrOk)
4234 {
4235 TIFFReadDirEntryOutputErr(tif, err, module, "Compression", 0);
4236 goto bad;
4237 }
4238 if (!TIFFSetField(tif, TIFFTAG_COMPRESSION, value))
4239 goto bad;
4240 dp->tdir_ignore = TRUE;
4241 }
4242 else
4243 {
4244 if (!TIFFSetField(tif, TIFFTAG_COMPRESSION, COMPRESSION_NONE))
4245 goto bad;
4246 }
4247 /*
4248 * First real pass over the directory.
4249 */
4250 for (di = 0, dp = dir; di < dircount; di++, dp++)
4251 {
4252 if (!dp->tdir_ignore)
4253 {
4254 TIFFReadDirectoryFindFieldInfo(tif, dp->tdir_tag, &fii);
4255 if (fii == FAILED_FII)
4256 {
4257 TIFFWarningExtR(tif, module,
4258 "Unknown field with tag %" PRIu16 " (0x%" PRIx16
4259 ") encountered",
4260 dp->tdir_tag, dp->tdir_tag);
4261 /* the following knowingly leaks the
4262 anonymous field structure */
4263 if (!_TIFFMergeFields(
4264 tif,
4265 _TIFFCreateAnonField(tif, dp->tdir_tag,
4266 (TIFFDataType)dp->tdir_type),
4267 1))
4268 {
4269 TIFFWarningExtR(
4270 tif, module,
4271 "Registering anonymous field with tag %" PRIu16
4272 " (0x%" PRIx16 ") failed",
4273 dp->tdir_tag, dp->tdir_tag);
4274 dp->tdir_ignore = TRUE;
4275 }
4276 else
4277 {
4278 TIFFReadDirectoryFindFieldInfo(tif, dp->tdir_tag, &fii);
4279 assert(fii != FAILED_FII);
4280 }
4281 }
4282 }
4283 if (!dp->tdir_ignore)
4284 {
4285 fip = tif->tif_fields[fii];
4286 if (fip->field_bit == FIELD_IGNORE)
4287 dp->tdir_ignore = TRUE;
4288 else
4289 {
4290 switch (dp->tdir_tag)
4291 {
4292 case TIFFTAG_STRIPOFFSETS:
4293 case TIFFTAG_STRIPBYTECOUNTS:
4294 case TIFFTAG_TILEOFFSETS:
4295 case TIFFTAG_TILEBYTECOUNTS:
4296 TIFFSetFieldBit(tif, fip->field_bit);
4297 break;
4298 case TIFFTAG_IMAGEWIDTH:
4299 case TIFFTAG_IMAGELENGTH:
4300 case TIFFTAG_IMAGEDEPTH:
4301 case TIFFTAG_TILELENGTH:
4302 case TIFFTAG_TILEWIDTH:
4303 case TIFFTAG_TILEDEPTH:
4304 case TIFFTAG_PLANARCONFIG:
4305 case TIFFTAG_ROWSPERSTRIP:
4306 case TIFFTAG_EXTRASAMPLES:
4307 if (!TIFFFetchNormalTag(tif, dp, 0))
4308 goto bad;
4309 dp->tdir_ignore = TRUE;
4310 break;
4311 default:
4312 if (!_TIFFCheckFieldIsValidForCodec(tif, dp->tdir_tag))
4313 dp->tdir_ignore = TRUE;
4314 break;
4315 }
4316 }
4317 }
4318 }
4319 /*
4320 * XXX: OJPEG hack.
4321 * If a) compression is OJPEG, b) planarconfig tag says it's separate,
4322 * c) strip offsets/bytecounts tag are both present and
4323 * d) both contain exactly one value, then we consistently find
4324 * that the buggy implementation of the buggy compression scheme
4325 * matches contig planarconfig best. So we 'fix-up' the tag here
4326 */
4327 if ((tif->tif_dir.td_compression == COMPRESSION_OJPEG) &&
4328 (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE))
4329 {
4330 if (!_TIFFFillStriles(tif))
4331 goto bad;
4332 dp = TIFFReadDirectoryFindEntry(tif, dir, dircount,
4333 TIFFTAG_STRIPOFFSETS);
4334 if ((dp != 0) && (dp->tdir_count == 1))
4335 {
4336 dp = TIFFReadDirectoryFindEntry(tif, dir, dircount,
4337 TIFFTAG_STRIPBYTECOUNTS);
4338 if ((dp != 0) && (dp->tdir_count == 1))
4339 {
4340 tif->tif_dir.td_planarconfig = PLANARCONFIG_CONTIG;
4341 TIFFWarningExtR(tif, module,
4342 "Planarconfig tag value assumed incorrect, "
4343 "assuming data is contig instead of chunky");
4344 }
4345 }
4346 }
4347 /*
4348 * Allocate directory structure and setup defaults.
4349 */
4350 if (!TIFFFieldSet(tif, FIELD_IMAGEDIMENSIONS))
4351 {
4352 MissingRequired(tif, "ImageLength");
4353 goto bad;
4354 }
4355
4356 /*
4357 * Second pass: extract other information.
4358 */
4359 for (di = 0, dp = dir; di < dircount; di++, dp++)
4360 {
4361 if (!dp->tdir_ignore)
4362 {
4363 switch (dp->tdir_tag)
4364 {
4365 case TIFFTAG_MINSAMPLEVALUE:
4366 case TIFFTAG_MAXSAMPLEVALUE:
4367 case TIFFTAG_BITSPERSAMPLE:
4368 case TIFFTAG_DATATYPE:
4369 case TIFFTAG_SAMPLEFORMAT:
4370 /*
4371 * The MinSampleValue, MaxSampleValue, BitsPerSample
4372 * DataType and SampleFormat tags are supposed to be
4373 * written as one value/sample, but some vendors
4374 * incorrectly write one value only -- so we accept
4375 * that as well (yuck). Other vendors write correct
4376 * value for NumberOfSamples, but incorrect one for
4377 * BitsPerSample and friends, and we will read this
4378 * too.
4379 */
4380 {
4381 uint16_t value;
4382 enum TIFFReadDirEntryErr err;
4383 err = TIFFReadDirEntryShort(tif, dp, &value);
4384 if (err == TIFFReadDirEntryErrCount)
4385 err =
4386 TIFFReadDirEntryPersampleShort(tif, dp, &value);
4387 if (err != TIFFReadDirEntryErrOk)
4388 {
4389 fip = TIFFFieldWithTag(tif, dp->tdir_tag);
4390 TIFFReadDirEntryOutputErr(
4391 tif, err, module,
4392 fip ? fip->field_name : "unknown tagname", 0);
4393 goto bad;
4394 }
4395 if (!TIFFSetField(tif, dp->tdir_tag, value))
4396 goto bad;
4397 if (dp->tdir_tag == TIFFTAG_BITSPERSAMPLE)
4398 bitspersample_read = TRUE;
4399 }
4400 break;
4401 case TIFFTAG_SMINSAMPLEVALUE:
4402 case TIFFTAG_SMAXSAMPLEVALUE:
4403 {
4404
4405 double *data = NULL;
4406 enum TIFFReadDirEntryErr err;
4407 uint32_t saved_flags;
4408 int m;
4409 if (dp->tdir_count !=
4410 (uint64_t)tif->tif_dir.td_samplesperpixel)
4411 err = TIFFReadDirEntryErrCount;
4412 else
4413 err = TIFFReadDirEntryDoubleArray(tif, dp, &data);
4414 if (err != TIFFReadDirEntryErrOk)
4415 {
4416 fip = TIFFFieldWithTag(tif, dp->tdir_tag);
4417 TIFFReadDirEntryOutputErr(
4418 tif, err, module,
4419 fip ? fip->field_name : "unknown tagname", 0);
4420 goto bad;
4421 }
4422 saved_flags = tif->tif_flags;
4423 tif->tif_flags |= TIFF_PERSAMPLE;
4424 m = TIFFSetField(tif, dp->tdir_tag, data);
4425 tif->tif_flags = saved_flags;
4426 _TIFFfreeExt(tif, data);
4427 if (!m)
4428 goto bad;
4429 }
4430 break;
4431 case TIFFTAG_STRIPOFFSETS:
4432 case TIFFTAG_TILEOFFSETS:
4433 switch (dp->tdir_type)
4434 {
4435 case TIFF_SHORT:
4436 case TIFF_LONG:
4437 case TIFF_LONG8:
4438 break;
4439 default:
4440 /* Warn except if directory typically created with
4441 * TIFFDeferStrileArrayWriting() */
4442 if (!(tif->tif_mode == O_RDWR &&
4443 dp->tdir_count == 0 && dp->tdir_type == 0 &&
4444 dp->tdir_offset.toff_long8 == 0))
4445 {
4446 fip = TIFFFieldWithTag(tif, dp->tdir_tag);
4447 TIFFWarningExtR(
4448 tif, module, "Invalid data type for tag %s",
4449 fip ? fip->field_name : "unknown tagname");
4450 }
4451 break;
4452 }
4453 _TIFFmemcpy(&(tif->tif_dir.td_stripoffset_entry), dp,
4454 sizeof(TIFFDirEntry));
4455 break;
4456 case TIFFTAG_STRIPBYTECOUNTS:
4457 case TIFFTAG_TILEBYTECOUNTS:
4458 switch (dp->tdir_type)
4459 {
4460 case TIFF_SHORT:
4461 case TIFF_LONG:
4462 case TIFF_LONG8:
4463 break;
4464 default:
4465 /* Warn except if directory typically created with
4466 * TIFFDeferStrileArrayWriting() */
4467 if (!(tif->tif_mode == O_RDWR &&
4468 dp->tdir_count == 0 && dp->tdir_type == 0 &&
4469 dp->tdir_offset.toff_long8 == 0))
4470 {
4471 fip = TIFFFieldWithTag(tif, dp->tdir_tag);
4472 TIFFWarningExtR(
4473 tif, module, "Invalid data type for tag %s",
4474 fip ? fip->field_name : "unknown tagname");
4475 }
4476 break;
4477 }
4478 _TIFFmemcpy(&(tif->tif_dir.td_stripbytecount_entry), dp,
4479 sizeof(TIFFDirEntry));
4480 break;
4481 case TIFFTAG_COLORMAP:
4482 case TIFFTAG_TRANSFERFUNCTION:
4483 {
4484 enum TIFFReadDirEntryErr err;
4485 uint32_t countpersample;
4486 uint32_t countrequired;
4487 uint32_t incrementpersample;
4488 uint16_t *value = NULL;
4489 /* It would be dangerous to instantiate those tag values */
4490 /* since if td_bitspersample has not yet been read (due to
4491 */
4492 /* unordered tags), it could be read afterwards with a */
4493 /* values greater than the default one (1), which may cause
4494 */
4495 /* crashes in user code */
4496 if (!bitspersample_read)
4497 {
4498 fip = TIFFFieldWithTag(tif, dp->tdir_tag);
4499 TIFFWarningExtR(
4500 tif, module,
4501 "Ignoring %s since BitsPerSample tag not found",
4502 fip ? fip->field_name : "unknown tagname");
4503 continue;
4504 }
4505 /* ColorMap or TransferFunction for high bit */
4506 /* depths do not make much sense and could be */
4507 /* used as a denial of service vector */
4508 if (tif->tif_dir.td_bitspersample > 24)
4509 {
4510 fip = TIFFFieldWithTag(tif, dp->tdir_tag);
4511 TIFFWarningExtR(
4512 tif, module,
4513 "Ignoring %s because BitsPerSample=%" PRIu16 ">24",
4514 fip ? fip->field_name : "unknown tagname",
4515 tif->tif_dir.td_bitspersample);
4516 continue;
4517 }
4518 countpersample = (1U << tif->tif_dir.td_bitspersample);
4519 if ((dp->tdir_tag == TIFFTAG_TRANSFERFUNCTION) &&
4520 (dp->tdir_count == (uint64_t)countpersample))
4521 {
4522 countrequired = countpersample;
4523 incrementpersample = 0;
4524 }
4525 else
4526 {
4527 countrequired = 3 * countpersample;
4528 incrementpersample = countpersample;
4529 }
4530 if (dp->tdir_count != (uint64_t)countrequired)
4531 err = TIFFReadDirEntryErrCount;
4532 else
4533 err = TIFFReadDirEntryShortArray(tif, dp, &value);
4534 if (err != TIFFReadDirEntryErrOk)
4535 {
4536 fip = TIFFFieldWithTag(tif, dp->tdir_tag);
4537 TIFFReadDirEntryOutputErr(
4538 tif, err, module,
4539 fip ? fip->field_name : "unknown tagname", 1);
4540 }
4541 else
4542 {
4543 TIFFSetField(tif, dp->tdir_tag, value,
4544 value + incrementpersample,
4545 value + 2 * incrementpersample);
4546 _TIFFfreeExt(tif, value);
4547 }
4548 }
4549 break;
4550 /* BEGIN REV 4.0 COMPATIBILITY */
4551 case TIFFTAG_OSUBFILETYPE:
4552 {
4553 uint16_t valueo;
4554 uint32_t value;
4555 if (TIFFReadDirEntryShort(tif, dp, &valueo) ==
4556 TIFFReadDirEntryErrOk)
4557 {
4558 switch (valueo)
4559 {
4560 case OFILETYPE_REDUCEDIMAGE:
4561 value = FILETYPE_REDUCEDIMAGE;
4562 break;
4563 case OFILETYPE_PAGE:
4564 value = FILETYPE_PAGE;
4565 break;
4566 default:
4567 value = 0;
4568 break;
4569 }
4570 if (value != 0)
4571 TIFFSetField(tif, TIFFTAG_SUBFILETYPE, value);
4572 }
4573 }
4574 break;
4575 /* END REV 4.0 COMPATIBILITY */
4576 #if 0
4577 case TIFFTAG_EP_BATTERYLEVEL:
4578 /* TIFFTAG_EP_BATTERYLEVEL can be RATIONAL or ASCII.
4579 * LibTiff defines it as ASCII and converts RATIONAL to an
4580 * ASCII string. */
4581 switch (dp->tdir_type)
4582 {
4583 case TIFF_RATIONAL:
4584 {
4585 /* Read rational and convert to ASCII*/
4586 enum TIFFReadDirEntryErr err;
4587 TIFFRational_t rValue;
4588 err = TIFFReadDirEntryCheckedRationalDirect(
4589 tif, dp, &rValue);
4590 if (err != TIFFReadDirEntryErrOk)
4591 {
4592 fip = TIFFFieldWithTag(tif, dp->tdir_tag);
4593 TIFFReadDirEntryOutputErr(
4594 tif, err, module,
4595 fip ? fip->field_name : "unknown tagname",
4596 1);
4597 }
4598 else
4599 {
4600 char szAux[32];
4601 snprintf(szAux, sizeof(szAux) - 1, "%d/%d",
4602 rValue.uNum, rValue.uDenom);
4603 TIFFSetField(tif, dp->tdir_tag, szAux);
4604 }
4605 }
4606 break;
4607 case TIFF_ASCII:
4608 (void)TIFFFetchNormalTag(tif, dp, TRUE);
4609 break;
4610 default:
4611 fip = TIFFFieldWithTag(tif, dp->tdir_tag);
4612 TIFFWarningExtR(tif, module,
4613 "Invalid data type for tag %s. "
4614 "ASCII or RATIONAL expected",
4615 fip ? fip->field_name
4616 : "unknown tagname");
4617 break;
4618 }
4619 break;
4620 #endif
4621 default:
4622 (void)TIFFFetchNormalTag(tif, dp, TRUE);
4623 break;
4624 }
4625 } /* -- if (!dp->tdir_ignore) */
4626 } /* -- for-loop -- */
4627
4628 /*
4629 * OJPEG hack:
4630 * - If a) compression is OJPEG, and b) photometric tag is missing,
4631 * then we consistently find that photometric should be YCbCr
4632 * - If a) compression is OJPEG, and b) photometric tag says it's RGB,
4633 * then we consistently find that the buggy implementation of the
4634 * buggy compression scheme matches photometric YCbCr instead.
4635 * - If a) compression is OJPEG, and b) bitspersample tag is missing,
4636 * then we consistently find bitspersample should be 8.
4637 * - If a) compression is OJPEG, b) samplesperpixel tag is missing,
4638 * and c) photometric is RGB or YCbCr, then we consistently find
4639 * samplesperpixel should be 3
4640 * - If a) compression is OJPEG, b) samplesperpixel tag is missing,
4641 * and c) photometric is MINISWHITE or MINISBLACK, then we consistently
4642 * find samplesperpixel should be 3
4643 */
4644 if (tif->tif_dir.td_compression == COMPRESSION_OJPEG)
4645 {
4646 if (!TIFFFieldSet(tif, FIELD_PHOTOMETRIC))
4647 {
4648 TIFFWarningExtR(
4649 tif, module,
4650 "Photometric tag is missing, assuming data is YCbCr");
4651 if (!TIFFSetField(tif, TIFFTAG_PHOTOMETRIC, PHOTOMETRIC_YCBCR))
4652 goto bad;
4653 }
4654 else if (tif->tif_dir.td_photometric == PHOTOMETRIC_RGB)
4655 {
4656 tif->tif_dir.td_photometric = PHOTOMETRIC_YCBCR;
4657 TIFFWarningExtR(tif, module,
4658 "Photometric tag value assumed incorrect, "
4659 "assuming data is YCbCr instead of RGB");
4660 }
4661 if (!TIFFFieldSet(tif, FIELD_BITSPERSAMPLE))
4662 {
4663 TIFFWarningExtR(
4664 tif, module,
4665 "BitsPerSample tag is missing, assuming 8 bits per sample");
4666 if (!TIFFSetField(tif, TIFFTAG_BITSPERSAMPLE, 8))
4667 goto bad;
4668 }
4669 if (!TIFFFieldSet(tif, FIELD_SAMPLESPERPIXEL))
4670 {
4671 if (tif->tif_dir.td_photometric == PHOTOMETRIC_RGB)
4672 {
4673 TIFFWarningExtR(tif, module,
4674 "SamplesPerPixel tag is missing, "
4675 "assuming correct SamplesPerPixel value is 3");
4676 if (!TIFFSetField(tif, TIFFTAG_SAMPLESPERPIXEL, 3))
4677 goto bad;
4678 }
4679 if (tif->tif_dir.td_photometric == PHOTOMETRIC_YCBCR)
4680 {
4681 TIFFWarningExtR(tif, module,
4682 "SamplesPerPixel tag is missing, "
4683 "applying correct SamplesPerPixel value of 3");
4684 if (!TIFFSetField(tif, TIFFTAG_SAMPLESPERPIXEL, 3))
4685 goto bad;
4686 }
4687 else if ((tif->tif_dir.td_photometric == PHOTOMETRIC_MINISWHITE) ||
4688 (tif->tif_dir.td_photometric == PHOTOMETRIC_MINISBLACK))
4689 {
4690 /*
4691 * SamplesPerPixel tag is missing, but is not required
4692 * by spec. Assume correct SamplesPerPixel value of 1.
4693 */
4694 if (!TIFFSetField(tif, TIFFTAG_SAMPLESPERPIXEL, 1))
4695 goto bad;
4696 }
4697 }
4698 }
4699
4700 /*
4701 * Setup appropriate structures (by strip or by tile)
4702 * We do that only after the above OJPEG hack which alters SamplesPerPixel
4703 * and thus influences the number of strips in the separate planarconfig.
4704 */
4705 if (!TIFFFieldSet(tif, FIELD_TILEDIMENSIONS))
4706 {
4707 tif->tif_dir.td_nstrips = TIFFNumberOfStrips(tif);
4708 tif->tif_dir.td_tilewidth = tif->tif_dir.td_imagewidth;
4709 tif->tif_dir.td_tilelength = tif->tif_dir.td_rowsperstrip;
4710 tif->tif_dir.td_tiledepth = tif->tif_dir.td_imagedepth;
4711 tif->tif_flags &= ~TIFF_ISTILED;
4712 }
4713 else
4714 {
4715 tif->tif_dir.td_nstrips = TIFFNumberOfTiles(tif);
4716 tif->tif_flags |= TIFF_ISTILED;
4717 }
4718 if (!tif->tif_dir.td_nstrips)
4719 {
4720 TIFFErrorExtR(tif, module, "Cannot handle zero number of %s",
4721 isTiled(tif) ? "tiles" : "strips");
4722 goto bad;
4723 }
4724 tif->tif_dir.td_stripsperimage = tif->tif_dir.td_nstrips;
4725 if (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE)
4726 tif->tif_dir.td_stripsperimage /= tif->tif_dir.td_samplesperpixel;
4727 if (!TIFFFieldSet(tif, FIELD_STRIPOFFSETS))
4728 {
4729 #ifdef OJPEG_SUPPORT
4730 if ((tif->tif_dir.td_compression == COMPRESSION_OJPEG) &&
4731 (isTiled(tif) == 0) && (tif->tif_dir.td_nstrips == 1))
4732 {
4733 /*
4734 * XXX: OJPEG hack.
4735 * If a) compression is OJPEG, b) it's not a tiled TIFF,
4736 * and c) the number of strips is 1,
4737 * then we tolerate the absence of stripoffsets tag,
4738 * because, presumably, all required data is in the
4739 * JpegInterchangeFormat stream.
4740 */
4741 TIFFSetFieldBit(tif, FIELD_STRIPOFFSETS);
4742 }
4743 else
4744 #endif
4745 {
4746 MissingRequired(tif, isTiled(tif) ? "TileOffsets" : "StripOffsets");
4747 goto bad;
4748 }
4749 }
4750
4751 if (tif->tif_mode == O_RDWR &&
4752 tif->tif_dir.td_stripoffset_entry.tdir_tag != 0 &&
4753 tif->tif_dir.td_stripoffset_entry.tdir_count == 0 &&
4754 tif->tif_dir.td_stripoffset_entry.tdir_type == 0 &&
4755 tif->tif_dir.td_stripoffset_entry.tdir_offset.toff_long8 == 0 &&
4756 tif->tif_dir.td_stripbytecount_entry.tdir_tag != 0 &&
4757 tif->tif_dir.td_stripbytecount_entry.tdir_count == 0 &&
4758 tif->tif_dir.td_stripbytecount_entry.tdir_type == 0 &&
4759 tif->tif_dir.td_stripbytecount_entry.tdir_offset.toff_long8 == 0)
4760 {
4761 /* Directory typically created with TIFFDeferStrileArrayWriting() */
4762 TIFFSetupStrips(tif);
4763 }
4764 else if (!(tif->tif_flags & TIFF_DEFERSTRILELOAD))
4765 {
4766 if (tif->tif_dir.td_stripoffset_entry.tdir_tag != 0)
4767 {
4768 if (!TIFFFetchStripThing(tif, &(tif->tif_dir.td_stripoffset_entry),
4769 tif->tif_dir.td_nstrips,
4770 &tif->tif_dir.td_stripoffset_p))
4771 {
4772 goto bad;
4773 }
4774 }
4775 if (tif->tif_dir.td_stripbytecount_entry.tdir_tag != 0)
4776 {
4777 if (!TIFFFetchStripThing(
4778 tif, &(tif->tif_dir.td_stripbytecount_entry),
4779 tif->tif_dir.td_nstrips, &tif->tif_dir.td_stripbytecount_p))
4780 {
4781 goto bad;
4782 }
4783 }
4784 }
4785
4786 /*
4787 * Make sure all non-color channels are extrasamples.
4788 * If it's not the case, define them as such.
4789 */
4790 color_channels = _TIFFGetMaxColorChannels(tif->tif_dir.td_photometric);
4791 if (color_channels &&
4792 tif->tif_dir.td_samplesperpixel - tif->tif_dir.td_extrasamples >
4793 color_channels)
4794 {
4795 uint16_t old_extrasamples;
4796 uint16_t *new_sampleinfo;
4797
4798 TIFFWarningExtR(
4799 tif, module,
4800 "Sum of Photometric type-related "
4801 "color channels and ExtraSamples doesn't match SamplesPerPixel. "
4802 "Defining non-color channels as ExtraSamples.");
4803
4804 old_extrasamples = tif->tif_dir.td_extrasamples;
4805 tif->tif_dir.td_extrasamples =
4806 (uint16_t)(tif->tif_dir.td_samplesperpixel - color_channels);
4807
4808 // sampleinfo should contain information relative to these new extra
4809 // samples
4810 new_sampleinfo = (uint16_t *)_TIFFcallocExt(
4811 tif, tif->tif_dir.td_extrasamples, sizeof(uint16_t));
4812 if (!new_sampleinfo)
4813 {
4814 TIFFErrorExtR(tif, module,
4815 "Failed to allocate memory for "
4816 "temporary new sampleinfo array "
4817 "(%" PRIu16 " 16 bit elements)",
4818 tif->tif_dir.td_extrasamples);
4819 goto bad;
4820 }
4821
4822 if (old_extrasamples > 0)
4823 memcpy(new_sampleinfo, tif->tif_dir.td_sampleinfo,
4824 old_extrasamples * sizeof(uint16_t));
4825 _TIFFsetShortArrayExt(tif, &tif->tif_dir.td_sampleinfo, new_sampleinfo,
4826 tif->tif_dir.td_extrasamples);
4827 _TIFFfreeExt(tif, new_sampleinfo);
4828 }
4829
4830 /*
4831 * Verify Palette image has a Colormap.
4832 */
4833 if (tif->tif_dir.td_photometric == PHOTOMETRIC_PALETTE &&
4834 !TIFFFieldSet(tif, FIELD_COLORMAP))
4835 {
4836 if (tif->tif_dir.td_bitspersample >= 8 &&
4837 tif->tif_dir.td_samplesperpixel == 3)
4838 tif->tif_dir.td_photometric = PHOTOMETRIC_RGB;
4839 else if (tif->tif_dir.td_bitspersample >= 8)
4840 tif->tif_dir.td_photometric = PHOTOMETRIC_MINISBLACK;
4841 else
4842 {
4843 MissingRequired(tif, "Colormap");
4844 goto bad;
4845 }
4846 }
4847 /*
4848 * OJPEG hack:
4849 * We do no further messing with strip/tile offsets/bytecounts in OJPEG
4850 * TIFFs
4851 */
4852 if (tif->tif_dir.td_compression != COMPRESSION_OJPEG)
4853 {
4854 /*
4855 * Attempt to deal with a missing StripByteCounts tag.
4856 */
4857 if (!TIFFFieldSet(tif, FIELD_STRIPBYTECOUNTS))
4858 {
4859 /*
4860 * Some manufacturers violate the spec by not giving
4861 * the size of the strips. In this case, assume there
4862 * is one uncompressed strip of data.
4863 */
4864 if ((tif->tif_dir.td_planarconfig == PLANARCONFIG_CONTIG &&
4865 tif->tif_dir.td_nstrips > 1) ||
4866 (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE &&
4867 tif->tif_dir.td_nstrips !=
4868 (uint32_t)tif->tif_dir.td_samplesperpixel))
4869 {
4870 MissingRequired(tif, "StripByteCounts");
4871 goto bad;
4872 }
4873 TIFFWarningExtR(
4874 tif, module,
4875 "TIFF directory is missing required "
4876 "\"StripByteCounts\" field, calculating from imagelength");
4877 if (EstimateStripByteCounts(tif, dir, dircount) < 0)
4878 goto bad;
4879 }
4880 else if (tif->tif_dir.td_nstrips == 1 &&
4881 !(tif->tif_flags & TIFF_ISTILED) && ByteCountLooksBad(tif))
4882 {
4883 /*
4884 * XXX: Plexus (and others) sometimes give a value of
4885 * zero for a tag when they don't know what the
4886 * correct value is! Try and handle the simple case
4887 * of estimating the size of a one strip image.
4888 */
4889 TIFFWarningExtR(tif, module,
4890 "Bogus \"StripByteCounts\" field, ignoring and "
4891 "calculating from imagelength");
4892 if (EstimateStripByteCounts(tif, dir, dircount) < 0)
4893 goto bad;
4894 }
4895 else if (!(tif->tif_flags & TIFF_DEFERSTRILELOAD) &&
4896 tif->tif_dir.td_planarconfig == PLANARCONFIG_CONTIG &&
4897 tif->tif_dir.td_nstrips > 2 &&
4898 tif->tif_dir.td_compression == COMPRESSION_NONE &&
4899 TIFFGetStrileByteCount(tif, 0) !=
4900 TIFFGetStrileByteCount(tif, 1) &&
4901 TIFFGetStrileByteCount(tif, 0) != 0 &&
4902 TIFFGetStrileByteCount(tif, 1) != 0)
4903 {
4904 /*
4905 * XXX: Some vendors fill StripByteCount array with
4906 * absolutely wrong values (it can be equal to
4907 * StripOffset array, for example). Catch this case
4908 * here.
4909 *
4910 * We avoid this check if deferring strile loading
4911 * as it would always force us to load the strip/tile
4912 * information.
4913 */
4914 TIFFWarningExtR(tif, module,
4915 "Wrong \"StripByteCounts\" field, ignoring and "
4916 "calculating from imagelength");
4917 if (EstimateStripByteCounts(tif, dir, dircount) < 0)
4918 goto bad;
4919 }
4920 }
4921 if (dir)
4922 {
4923 _TIFFfreeExt(tif, dir);
4924 dir = NULL;
4925 }
4926 if (!TIFFFieldSet(tif, FIELD_MAXSAMPLEVALUE))
4927 {
4928 if (tif->tif_dir.td_bitspersample >= 16)
4929 tif->tif_dir.td_maxsamplevalue = 0xFFFF;
4930 else
4931 tif->tif_dir.td_maxsamplevalue =
4932 (uint16_t)((1L << tif->tif_dir.td_bitspersample) - 1);
4933 }
4934
4935 #ifdef STRIPBYTECOUNTSORTED_UNUSED
4936 /*
4937 * XXX: We can optimize checking for the strip bounds using the sorted
4938 * bytecounts array. See also comments for TIFFAppendToStrip()
4939 * function in tif_write.c.
4940 */
4941 if (!(tif->tif_flags & TIFF_DEFERSTRILELOAD) && tif->tif_dir.td_nstrips > 1)
4942 {
4943 uint32_t strip;
4944
4945 tif->tif_dir.td_stripbytecountsorted = 1;
4946 for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++)
4947 {
4948 if (TIFFGetStrileOffset(tif, strip - 1) >
4949 TIFFGetStrileOffset(tif, strip))
4950 {
4951 tif->tif_dir.td_stripbytecountsorted = 0;
4952 break;
4953 }
4954 }
4955 }
4956 #endif
4957
4958 /*
4959 * An opportunity for compression mode dependent tag fixup
4960 */
4961 (*tif->tif_fixuptags)(tif);
4962
4963 /*
4964 * Some manufacturers make life difficult by writing
4965 * large amounts of uncompressed data as a single strip.
4966 * This is contrary to the recommendations of the spec.
4967 * The following makes an attempt at breaking such images
4968 * into strips closer to the recommended 8k bytes. A
4969 * side effect, however, is that the RowsPerStrip tag
4970 * value may be changed.
4971 */
4972 if ((tif->tif_dir.td_planarconfig == PLANARCONFIG_CONTIG) &&
4973 (tif->tif_dir.td_nstrips == 1) &&
4974 (tif->tif_dir.td_compression == COMPRESSION_NONE) &&
4975 ((tif->tif_flags & (TIFF_STRIPCHOP | TIFF_ISTILED)) == TIFF_STRIPCHOP))
4976 {
4977 ChopUpSingleUncompressedStrip(tif);
4978 }
4979
4980 /* There are also uncompressed striped files with strips larger than */
4981 /* 2 GB, which make them unfriendly with a lot of code. If possible, */
4982 /* try to expose smaller "virtual" strips. */
4983 if (tif->tif_dir.td_planarconfig == PLANARCONFIG_CONTIG &&
4984 tif->tif_dir.td_compression == COMPRESSION_NONE &&
4985 (tif->tif_flags & (TIFF_STRIPCHOP | TIFF_ISTILED)) == TIFF_STRIPCHOP &&
4986 TIFFStripSize64(tif) > 0x7FFFFFFFUL)
4987 {
4988 TryChopUpUncompressedBigTiff(tif);
4989 }
4990
4991 /*
4992 * Clear the dirty directory flag.
4993 */
4994 tif->tif_flags &= ~TIFF_DIRTYDIRECT;
4995 tif->tif_flags &= ~TIFF_DIRTYSTRIP;
4996
4997 /*
4998 * Reinitialize i/o since we are starting on a new directory.
4999 */
5000 tif->tif_row = (uint32_t)-1;
5001 tif->tif_curstrip = (uint32_t)-1;
5002 tif->tif_col = (uint32_t)-1;
5003 tif->tif_curtile = (uint32_t)-1;
5004 tif->tif_tilesize = (tmsize_t)-1;
5005
5006 tif->tif_scanlinesize = TIFFScanlineSize(tif);
5007 if (!tif->tif_scanlinesize)
5008 {
5009 TIFFErrorExtR(tif, module, "Cannot handle zero scanline size");
5010 return (0);
5011 }
5012
5013 if (isTiled(tif))
5014 {
5015 tif->tif_tilesize = TIFFTileSize(tif);
5016 if (!tif->tif_tilesize)
5017 {
5018 TIFFErrorExtR(tif, module, "Cannot handle zero tile size");
5019 return (0);
5020 }
5021 }
5022 else
5023 {
5024 if (!TIFFStripSize(tif))
5025 {
5026 TIFFErrorExtR(tif, module, "Cannot handle zero strip size");
5027 return (0);
5028 }
5029 }
5030 return (1);
5031 bad:
5032 if (dir)
5033 _TIFFfreeExt(tif, dir);
5034 return (0);
5035 }
5036
5037 static void TIFFReadDirectoryCheckOrder(TIFF *tif, TIFFDirEntry *dir,
5038 uint16_t dircount)
5039 {
5040 static const char module[] = "TIFFReadDirectoryCheckOrder";
5041 uint32_t m;
5042 uint16_t n;
5043 TIFFDirEntry *o;
5044 m = 0;
5045 for (n = 0, o = dir; n < dircount; n++, o++)
5046 {
5047 if (o->tdir_tag < m)
5048 {
5049 TIFFWarningExtR(tif, module,
5050 "Invalid TIFF directory; tags are not sorted in "
5051 "ascending order");
5052 break;
5053 }
5054 m = o->tdir_tag + 1;
5055 }
5056 }
5057
5058 static TIFFDirEntry *TIFFReadDirectoryFindEntry(TIFF *tif, TIFFDirEntry *dir,
5059 uint16_t dircount,
5060 uint16_t tagid)
5061 {
5062 TIFFDirEntry *m;
5063 uint16_t n;
5064 (void)tif;
5065 for (m = dir, n = 0; n < dircount; m++, n++)
5066 {
5067 if (m->tdir_tag == tagid)
5068 return (m);
5069 }
5070 return (0);
5071 }
5072
5073 static void TIFFReadDirectoryFindFieldInfo(TIFF *tif, uint16_t tagid,
5074 uint32_t *fii)
5075 {
5076 int32_t ma, mb, mc;
5077 ma = -1;
5078 mc = (int32_t)tif->tif_nfields;
5079 while (1)
5080 {
5081 if (ma + 1 == mc)
5082 {
5083 *fii = FAILED_FII;
5084 return;
5085 }
5086 mb = (ma + mc) / 2;
5087 if (tif->tif_fields[mb]->field_tag == (uint32_t)tagid)
5088 break;
5089 if (tif->tif_fields[mb]->field_tag < (uint32_t)tagid)
5090 ma = mb;
5091 else
5092 mc = mb;
5093 }
5094 while (1)
5095 {
5096 if (mb == 0)
5097 break;
5098 if (tif->tif_fields[mb - 1]->field_tag != (uint32_t)tagid)
5099 break;
5100 mb--;
5101 }
5102 *fii = mb;
5103 }
5104
5105 /*
5106 * Read custom directory from the arbitrary offset.
5107 * The code is very similar to TIFFReadDirectory().
5108 */
5109 int TIFFReadCustomDirectory(TIFF *tif, toff_t diroff,
5110 const TIFFFieldArray *infoarray)
5111 {
5112 static const char module[] = "TIFFReadCustomDirectory";
5113 TIFFDirEntry *dir;
5114 uint16_t dircount;
5115 TIFFDirEntry *dp;
5116 uint16_t di;
5117 const TIFFField *fip;
5118 uint32_t fii;
5119 (*tif->tif_cleanup)(tif); /* cleanup any previous compression state */
5120 _TIFFSetupFields(tif, infoarray);
5121 dircount = TIFFFetchDirectory(tif, diroff, &dir, NULL);
5122 if (!dircount)
5123 {
5124 TIFFErrorExtR(tif, module,
5125 "Failed to read custom directory at offset %" PRIu64,
5126 diroff);
5127 return 0;
5128 }
5129 TIFFFreeDirectory(tif);
5130 _TIFFmemset(&tif->tif_dir, 0, sizeof(TIFFDirectory));
5131 TIFFReadDirectoryCheckOrder(tif, dir, dircount);
5132 for (di = 0, dp = dir; di < dircount; di++, dp++)
5133 {
5134 TIFFReadDirectoryFindFieldInfo(tif, dp->tdir_tag, &fii);
5135 if (fii == FAILED_FII)
5136 {
5137 TIFFWarningExtR(tif, module,
5138 "Unknown field with tag %" PRIu16 " (0x%" PRIx16
5139 ") encountered",
5140 dp->tdir_tag, dp->tdir_tag);
5141 if (!_TIFFMergeFields(
5142 tif,
5143 _TIFFCreateAnonField(tif, dp->tdir_tag,
5144 (TIFFDataType)dp->tdir_type),
5145 1))
5146 {
5147 TIFFWarningExtR(tif, module,
5148 "Registering anonymous field with tag %" PRIu16
5149 " (0x%" PRIx16 ") failed",
5150 dp->tdir_tag, dp->tdir_tag);
5151 dp->tdir_ignore = TRUE;
5152 }
5153 else
5154 {
5155 TIFFReadDirectoryFindFieldInfo(tif, dp->tdir_tag, &fii);
5156 assert(fii != FAILED_FII);
5157 }
5158 }
5159 if (!dp->tdir_ignore)
5160 {
5161 fip = tif->tif_fields[fii];
5162 if (fip->field_bit == FIELD_IGNORE)
5163 dp->tdir_ignore = TRUE;
5164 else
5165 {
5166 /* check data type */
5167 while ((fip->field_type != TIFF_ANY) &&
5168 (fip->field_type != dp->tdir_type))
5169 {
5170 fii++;
5171 if ((fii == tif->tif_nfields) ||
5172 (tif->tif_fields[fii]->field_tag !=
5173 (uint32_t)dp->tdir_tag))
5174 {
5175 fii = 0xFFFF;
5176 break;
5177 }
5178 fip = tif->tif_fields[fii];
5179 }
5180 if (fii == 0xFFFF)
5181 {
5182 TIFFWarningExtR(tif, module,
5183 "Wrong data type %" PRIu16
5184 " for \"%s\"; tag ignored",
5185 dp->tdir_type, fip->field_name);
5186 dp->tdir_ignore = TRUE;
5187 }
5188 else
5189 {
5190 /* check count if known in advance */
5191 if ((fip->field_readcount != TIFF_VARIABLE) &&
5192 (fip->field_readcount != TIFF_VARIABLE2))
5193 {
5194 uint32_t expected;
5195 if (fip->field_readcount == TIFF_SPP)
5196 expected =
5197 (uint32_t)tif->tif_dir.td_samplesperpixel;
5198 else
5199 expected = (uint32_t)fip->field_readcount;
5200 if (!CheckDirCount(tif, dp, expected))
5201 dp->tdir_ignore = TRUE;
5202 }
5203 }
5204 }
5205 if (!dp->tdir_ignore)
5206 {
5207 switch (dp->tdir_tag)
5208 {
5209 case EXIFTAG_SUBJECTDISTANCE:
5210 if (!TIFFFieldIsAnonymous(fip))
5211 {
5212 /* should only be called on a Exif directory */
5213 /* when exifFields[] is active */
5214 (void)TIFFFetchSubjectDistance(tif, dp);
5215 }
5216 else
5217 {
5218 (void)TIFFFetchNormalTag(tif, dp, TRUE);
5219 }
5220 break;
5221 default:
5222 (void)TIFFFetchNormalTag(tif, dp, TRUE);
5223 break;
5224 }
5225 } /*-- if (!dp->tdir_ignore) */
5226 }
5227 }
5228 /* To be able to return from SubIFD or custom-IFD to main-IFD */
5229 tif->tif_setdirectory_force_absolute = TRUE;
5230 if (dir)
5231 _TIFFfreeExt(tif, dir);
5232 return 1;
5233 }
5234
5235 /*
5236 * EXIF is important special case of custom IFD, so we have a special
5237 * function to read it.
5238 */
5239 int TIFFReadEXIFDirectory(TIFF *tif, toff_t diroff)
5240 {
5241 const TIFFFieldArray *exifFieldArray;
5242 exifFieldArray = _TIFFGetExifFields();
5243 return TIFFReadCustomDirectory(tif, diroff, exifFieldArray);
5244 }
5245
5246 /*
5247 *--: EXIF-GPS custom directory reading as another special case of custom IFD.
5248 */
5249 int TIFFReadGPSDirectory(TIFF *tif, toff_t diroff)
5250 {
5251 const TIFFFieldArray *gpsFieldArray;
5252 gpsFieldArray = _TIFFGetGpsFields();
5253 return TIFFReadCustomDirectory(tif, diroff, gpsFieldArray);
5254 }
5255
5256 static int EstimateStripByteCounts(TIFF *tif, TIFFDirEntry *dir,
5257 uint16_t dircount)
5258 {
5259 static const char module[] = "EstimateStripByteCounts";
5260
5261 TIFFDirEntry *dp;
5262 TIFFDirectory *td = &tif->tif_dir;
5263 uint32_t strip;
5264
5265 /* Do not try to load stripbytecount as we will compute it */
5266 if (!_TIFFFillStrilesInternal(tif, 0))
5267 return -1;
5268
5269 if (td->td_stripbytecount_p)
5270 _TIFFfreeExt(tif, td->td_stripbytecount_p);
5271 td->td_stripbytecount_p = (uint64_t *)_TIFFCheckMalloc(
5272 tif, td->td_nstrips, sizeof(uint64_t), "for \"StripByteCounts\" array");
5273 if (td->td_stripbytecount_p == NULL)
5274 return -1;
5275
5276 if (td->td_compression != COMPRESSION_NONE)
5277 {
5278 uint64_t space;
5279 uint64_t filesize;
5280 uint16_t n;
5281 filesize = TIFFGetFileSize(tif);
5282 if (!(tif->tif_flags & TIFF_BIGTIFF))
5283 space = sizeof(TIFFHeaderClassic) + 2 + dircount * 12 + 4;
5284 else
5285 space = sizeof(TIFFHeaderBig) + 8 + dircount * 20 + 8;
5286 /* calculate amount of space used by indirect values */
5287 for (dp = dir, n = dircount; n > 0; n--, dp++)
5288 {
5289 uint32_t typewidth;
5290 uint64_t datasize;
5291 typewidth = TIFFDataWidth((TIFFDataType)dp->tdir_type);
5292 if (typewidth == 0)
5293 {
5294 TIFFErrorExtR(
5295 tif, module,
5296 "Cannot determine size of unknown tag type %" PRIu16,
5297 dp->tdir_type);
5298 return -1;
5299 }
5300 if (dp->tdir_count > UINT64_MAX / typewidth)
5301 return -1;
5302 datasize = (uint64_t)typewidth * dp->tdir_count;
5303 if (!(tif->tif_flags & TIFF_BIGTIFF))
5304 {
5305 if (datasize <= 4)
5306 datasize = 0;
5307 }
5308 else
5309 {
5310 if (datasize <= 8)
5311 datasize = 0;
5312 }
5313 if (space > UINT64_MAX - datasize)
5314 return -1;
5315 space += datasize;
5316 }
5317 if (filesize < space)
5318 /* we should perhaps return in error ? */
5319 space = filesize;
5320 else
5321 space = filesize - space;
5322 if (td->td_planarconfig == PLANARCONFIG_SEPARATE)
5323 space /= td->td_samplesperpixel;
5324 for (strip = 0; strip < td->td_nstrips; strip++)
5325 td->td_stripbytecount_p[strip] = space;
5326 /*
5327 * This gross hack handles the case were the offset to
5328 * the last strip is past the place where we think the strip
5329 * should begin. Since a strip of data must be contiguous,
5330 * it's safe to assume that we've overestimated the amount
5331 * of data in the strip and trim this number back accordingly.
5332 */
5333 strip--;
5334 if (td->td_stripoffset_p[strip] >
5335 UINT64_MAX - td->td_stripbytecount_p[strip])
5336 return -1;
5337 if (td->td_stripoffset_p[strip] + td->td_stripbytecount_p[strip] >
5338 filesize)
5339 {
5340 if (td->td_stripoffset_p[strip] >= filesize)
5341 {
5342 /* Not sure what we should in that case... */
5343 td->td_stripbytecount_p[strip] = 0;
5344 }
5345 else
5346 {
5347 td->td_stripbytecount_p[strip] =
5348 filesize - td->td_stripoffset_p[strip];
5349 }
5350 }
5351 }
5352 else if (isTiled(tif))
5353 {
5354 uint64_t bytespertile = TIFFTileSize64(tif);
5355
5356 for (strip = 0; strip < td->td_nstrips; strip++)
5357 td->td_stripbytecount_p[strip] = bytespertile;
5358 }
5359 else
5360 {
5361 uint64_t rowbytes = TIFFScanlineSize64(tif);
5362 uint32_t rowsperstrip = td->td_imagelength / td->td_stripsperimage;
5363 for (strip = 0; strip < td->td_nstrips; strip++)
5364 {
5365 if (rowbytes > 0 && rowsperstrip > UINT64_MAX / rowbytes)
5366 return -1;
5367 td->td_stripbytecount_p[strip] = rowbytes * rowsperstrip;
5368 }
5369 }
5370 TIFFSetFieldBit(tif, FIELD_STRIPBYTECOUNTS);
5371 if (!TIFFFieldSet(tif, FIELD_ROWSPERSTRIP))
5372 td->td_rowsperstrip = td->td_imagelength;
5373 return 1;
5374 }
5375
5376 static void MissingRequired(TIFF *tif, const char *tagname)
5377 {
5378 static const char module[] = "MissingRequired";
5379
5380 TIFFErrorExtR(tif, module,
5381 "TIFF directory is missing required \"%s\" field", tagname);
5382 }
5383
5384 static unsigned long hashFuncOffsetToNumber(const void *elt)
5385 {
5386 const TIFFOffsetAndDirNumber *offsetAndDirNumber =
5387 (const TIFFOffsetAndDirNumber *)elt;
5388 const uint32_t hash = (uint32_t)(offsetAndDirNumber->offset >> 32) ^
5389 ((uint32_t)offsetAndDirNumber->offset & 0xFFFFFFFFU);
5390 return hash;
5391 }
5392
5393 static bool equalFuncOffsetToNumber(const void *elt1, const void *elt2)
5394 {
5395 const TIFFOffsetAndDirNumber *offsetAndDirNumber1 =
5396 (const TIFFOffsetAndDirNumber *)elt1;
5397 const TIFFOffsetAndDirNumber *offsetAndDirNumber2 =
5398 (const TIFFOffsetAndDirNumber *)elt2;
5399 return offsetAndDirNumber1->offset == offsetAndDirNumber2->offset;
5400 }
5401
5402 static unsigned long hashFuncNumberToOffset(const void *elt)
5403 {
5404 const TIFFOffsetAndDirNumber *offsetAndDirNumber =
5405 (const TIFFOffsetAndDirNumber *)elt;
5406 return offsetAndDirNumber->dirNumber;
5407 }
5408
5409 static bool equalFuncNumberToOffset(const void *elt1, const void *elt2)
5410 {
5411 const TIFFOffsetAndDirNumber *offsetAndDirNumber1 =
5412 (const TIFFOffsetAndDirNumber *)elt1;
5413 const TIFFOffsetAndDirNumber *offsetAndDirNumber2 =
5414 (const TIFFOffsetAndDirNumber *)elt2;
5415 return offsetAndDirNumber1->dirNumber == offsetAndDirNumber2->dirNumber;
5416 }
5417
5418 /*
5419 * Check the directory number and offset against the list of already seen
5420 * directory numbers and offsets. This is a trick to prevent IFD looping.
5421 * The one can create TIFF file with looped directory pointers. We will
5422 * maintain a list of already seen directories and check every IFD offset
5423 * and its IFD number against that list. However, the offset of an IFD number
5424 * can change - e.g. when writing updates to file.
5425 * Returns 1 if all is ok; 0 if last directory or IFD loop is encountered,
5426 * or an error has occurred.
5427 */
5428 int _TIFFCheckDirNumberAndOffset(TIFF *tif, tdir_t dirn, uint64_t diroff)
5429 {
5430 if (diroff == 0) /* no more directories */
5431 return 0;
5432
5433 if (tif->tif_map_dir_offset_to_number == NULL)
5434 {
5435 tif->tif_map_dir_offset_to_number = TIFFHashSetNew(
5436 hashFuncOffsetToNumber, equalFuncOffsetToNumber, free);
5437 if (tif->tif_map_dir_offset_to_number == NULL)
5438 {
5439 TIFFErrorExtR(tif, "_TIFFCheckDirNumberAndOffset",
5440 "Not enough memory");
5441 return 1;
5442 }
5443 }
5444
5445 if (tif->tif_map_dir_number_to_offset == NULL)
5446 {
5447 /* No free callback for this map, as it shares the same items as
5448 * tif->tif_map_dir_offset_to_number. */
5449 tif->tif_map_dir_number_to_offset = TIFFHashSetNew(
5450 hashFuncNumberToOffset, equalFuncNumberToOffset, NULL);
5451 if (tif->tif_map_dir_number_to_offset == NULL)
5452 {
5453 TIFFErrorExtR(tif, "_TIFFCheckDirNumberAndOffset",
5454 "Not enough memory");
5455 return 1;
5456 }
5457 }
5458
5459 /* Check if offset is already in the list:
5460 * - yes: check, if offset is at the same IFD number - if not, it is an IFD
5461 * loop
5462 * - no: add to list or update offset at that IFD number
5463 */
5464 TIFFOffsetAndDirNumber entry;
5465 entry.offset = diroff;
5466 entry.dirNumber = dirn;
5467
5468 TIFFOffsetAndDirNumber *foundEntry =
5469 (TIFFOffsetAndDirNumber *)TIFFHashSetLookup(
5470 tif->tif_map_dir_offset_to_number, &entry);
5471 if (foundEntry)
5472 {
5473 if (foundEntry->dirNumber == dirn)
5474 {
5475 return 1;
5476 }
5477 else
5478 {
5479 TIFFWarningExtR(tif, "_TIFFCheckDirNumberAndOffset",
5480 "TIFF directory %d has IFD looping to directory %u "
5481 "at offset 0x%" PRIx64 " (%" PRIu64 ")",
5482 (int)dirn - 1, foundEntry->dirNumber, diroff,
5483 diroff);
5484 return 0;
5485 }
5486 }
5487
5488 /* Check if offset of an IFD has been changed and update offset of that IFD
5489 * number. */
5490 foundEntry = (TIFFOffsetAndDirNumber *)TIFFHashSetLookup(
5491 tif->tif_map_dir_number_to_offset, &entry);
5492 if (foundEntry)
5493 {
5494 if (foundEntry->offset != diroff)
5495 {
5496 TIFFOffsetAndDirNumber entryOld;
5497 entryOld.offset = foundEntry->offset;
5498 entryOld.dirNumber = dirn;
5499 /* We must remove first from tif_map_dir_number_to_offset as the */
5500 /* entry is owned (and thus freed) by */
5501 /* tif_map_dir_offset_to_number */
5502 TIFFOffsetAndDirNumber *foundEntryOld =
5503 (TIFFOffsetAndDirNumber *)TIFFHashSetLookup(
5504 tif->tif_map_dir_number_to_offset, &entryOld);
5505 if (foundEntryOld)
5506 {
5507 TIFFHashSetRemove(tif->tif_map_dir_number_to_offset,
5508 foundEntryOld);
5509 }
5510 foundEntryOld = (TIFFOffsetAndDirNumber *)TIFFHashSetLookup(
5511 tif->tif_map_dir_offset_to_number, &entryOld);
5512 if (foundEntryOld)
5513 {
5514 TIFFHashSetRemove(tif->tif_map_dir_offset_to_number,
5515 foundEntryOld);
5516 }
5517
5518 TIFFOffsetAndDirNumber *entryPtr = (TIFFOffsetAndDirNumber *)malloc(
5519 sizeof(TIFFOffsetAndDirNumber));
5520 if (entryPtr == NULL)
5521 {
5522 return 0;
5523 }
5524
5525 /* Add IFD offset and dirn to IFD directory list */
5526 *entryPtr = entry;
5527
5528 if (!TIFFHashSetInsert(tif->tif_map_dir_offset_to_number, entryPtr))
5529 {
5530 TIFFErrorExtR(
5531 tif, "_TIFFCheckDirNumberAndOffset",
5532 "Insertion in tif_map_dir_offset_to_number failed");
5533 return 0;
5534 }
5535 if (!TIFFHashSetInsert(tif->tif_map_dir_number_to_offset, entryPtr))
5536 {
5537 TIFFErrorExtR(
5538 tif, "_TIFFCheckDirNumberAndOffset",
5539 "Insertion in tif_map_dir_number_to_offset failed");
5540 return 0;
5541 }
5542 }
5543 return 1;
5544 }
5545
5546 /* Arbitrary (hopefully big enough) limit */
5547 if (TIFFHashSetSize(tif->tif_map_dir_offset_to_number) >=
5548 TIFF_MAX_DIR_COUNT)
5549 {
5550 TIFFErrorExtR(tif, "_TIFFCheckDirNumberAndOffset",
5551 "Cannot handle more than %u TIFF directories",
5552 TIFF_MAX_DIR_COUNT);
5553 return 0;
5554 }
5555
5556 TIFFOffsetAndDirNumber *entryPtr =
5557 (TIFFOffsetAndDirNumber *)malloc(sizeof(TIFFOffsetAndDirNumber));
5558 if (entryPtr == NULL)
5559 {
5560 TIFFErrorExtR(tif, "_TIFFCheckDirNumberAndOffset",
5561 "malloc(sizeof(TIFFOffsetAndDirNumber)) failed");
5562 return 0;
5563 }
5564
5565 /* Add IFD offset and dirn to IFD directory list */
5566 *entryPtr = entry;
5567
5568 if (!TIFFHashSetInsert(tif->tif_map_dir_offset_to_number, entryPtr))
5569 {
5570 TIFFErrorExtR(tif, "_TIFFCheckDirNumberAndOffset",
5571 "Insertion in tif_map_dir_offset_to_number failed");
5572 return 0;
5573 }
5574 if (!TIFFHashSetInsert(tif->tif_map_dir_number_to_offset, entryPtr))
5575 {
5576 TIFFErrorExtR(tif, "_TIFFCheckDirNumberAndOffset",
5577 "Insertion in tif_map_dir_number_to_offset failed");
5578 return 0;
5579 }
5580
5581 return 1;
5582 } /* --- _TIFFCheckDirNumberAndOffset() ---*/
5583
5584 /*
5585 * Retrieve the matching IFD directory number of a given IFD offset
5586 * from the list of directories already seen.
5587 * Returns 1 if the offset was in the list and the directory number
5588 * can be returned.
5589 * Otherwise returns 0 or if an error occurred.
5590 */
5591 int _TIFFGetDirNumberFromOffset(TIFF *tif, uint64_t diroff, tdir_t *dirn)
5592 {
5593 if (diroff == 0) /* no more directories */
5594 return 0;
5595
5596 /* Check if offset is already in the list and return matching directory
5597 * number. Otherwise update IFD list using TIFFNumberOfDirectories() and
5598 * search again in IFD list.
5599 */
5600 if (tif->tif_map_dir_offset_to_number == NULL)
5601 return 0;
5602 TIFFOffsetAndDirNumber entry;
5603 entry.offset = diroff;
5604 entry.dirNumber = 0; /* not used */
5605
5606 TIFFOffsetAndDirNumber *foundEntry =
5607 (TIFFOffsetAndDirNumber *)TIFFHashSetLookup(
5608 tif->tif_map_dir_offset_to_number, &entry);
5609 if (foundEntry)
5610 {
5611 *dirn = foundEntry->dirNumber;
5612 return 1;
5613 }
5614
5615 /* This updates the directory list for all main-IFDs in the file. */
5616 TIFFNumberOfDirectories(tif);
5617
5618 foundEntry = (TIFFOffsetAndDirNumber *)TIFFHashSetLookup(
5619 tif->tif_map_dir_offset_to_number, &entry);
5620 if (foundEntry)
5621 {
5622 *dirn = foundEntry->dirNumber;
5623 return 1;
5624 }
5625
5626 return 0;
5627 } /*--- _TIFFGetDirNumberFromOffset() ---*/
5628
5629 /*
5630 * Retrieve the matching IFD directory offset of a given IFD number
5631 * from the list of directories already seen.
5632 * Returns 1 if the offset was in the list of already seen IFDs and the
5633 * directory offset can be returned. The directory list is not updated.
5634 * Otherwise returns 0 or if an error occurred.
5635 */
5636 int _TIFFGetOffsetFromDirNumber(TIFF *tif, tdir_t dirn, uint64_t *diroff)
5637 {
5638
5639 if (tif->tif_map_dir_number_to_offset == NULL)
5640 return 0;
5641 TIFFOffsetAndDirNumber entry;
5642 entry.offset = 0; /* not used */
5643 entry.dirNumber = dirn;
5644
5645 TIFFOffsetAndDirNumber *foundEntry =
5646 (TIFFOffsetAndDirNumber *)TIFFHashSetLookup(
5647 tif->tif_map_dir_number_to_offset, &entry);
5648 if (foundEntry)
5649 {
5650 *diroff = foundEntry->offset;
5651 return 1;
5652 }
5653
5654 return 0;
5655 } /*--- _TIFFGetOffsetFromDirNumber() ---*/
5656
5657 /*
5658 * Remove an entry from the directory list of already seen directories
5659 * by directory offset.
5660 * If an entry is to be removed from the list, it is also okay if the entry
5661 * is not in the list or the list does not exist.
5662 */
5663 int _TIFFRemoveEntryFromDirectoryListByOffset(TIFF *tif, uint64_t diroff)
5664 {
5665 if (tif->tif_map_dir_offset_to_number == NULL)
5666 return 1;
5667
5668 TIFFOffsetAndDirNumber entryOld;
5669 entryOld.offset = diroff;
5670 entryOld.dirNumber = 0;
5671 /* We must remove first from tif_map_dir_number_to_offset as the
5672 * entry is owned (and thus freed) by tif_map_dir_offset_to_number.
5673 * However, we need firstly to find the directory number from offset. */
5674
5675 TIFFOffsetAndDirNumber *foundEntryOldOff =
5676 (TIFFOffsetAndDirNumber *)TIFFHashSetLookup(
5677 tif->tif_map_dir_offset_to_number, &entryOld);
5678 if (foundEntryOldOff)
5679 {
5680 entryOld.dirNumber = foundEntryOldOff->dirNumber;
5681 if (tif->tif_map_dir_number_to_offset != NULL)
5682 {
5683 TIFFOffsetAndDirNumber *foundEntryOldDir =
5684 (TIFFOffsetAndDirNumber *)TIFFHashSetLookup(
5685 tif->tif_map_dir_number_to_offset, &entryOld);
5686 if (foundEntryOldDir)
5687 {
5688 TIFFHashSetRemove(tif->tif_map_dir_number_to_offset,
5689 foundEntryOldDir);
5690 TIFFHashSetRemove(tif->tif_map_dir_offset_to_number,
5691 foundEntryOldOff);
5692 return 1;
5693 }
5694 }
5695 else
5696 {
5697 TIFFErrorExtR(tif, "_TIFFRemoveEntryFromDirectoryListByOffset",
5698 "Unexpectedly tif_map_dir_number_to_offset is "
5699 "missing but tif_map_dir_offset_to_number exists.");
5700 return 0;
5701 }
5702 }
5703 return 1;
5704 } /*--- _TIFFRemoveEntryFromDirectoryListByOffset() ---*/
5705
5706 /*
5707 * Check the count field of a directory entry against a known value. The
5708 * caller is expected to skip/ignore the tag if there is a mismatch.
5709 */
5710 static int CheckDirCount(TIFF *tif, TIFFDirEntry *dir, uint32_t count)
5711 {
5712 if ((uint64_t)count > dir->tdir_count)
5713 {
5714 const TIFFField *fip = TIFFFieldWithTag(tif, dir->tdir_tag);
5715 TIFFWarningExtR(tif, tif->tif_name,
5716 "incorrect count for field \"%s\" (%" PRIu64
5717 ", expecting %" PRIu32 "); tag ignored",
5718 fip ? fip->field_name : "unknown tagname",
5719 dir->tdir_count, count);
5720 return (0);
5721 }
5722 else if ((uint64_t)count < dir->tdir_count)
5723 {
5724 const TIFFField *fip = TIFFFieldWithTag(tif, dir->tdir_tag);
5725 TIFFWarningExtR(tif, tif->tif_name,
5726 "incorrect count for field \"%s\" (%" PRIu64
5727 ", expecting %" PRIu32 "); tag trimmed",
5728 fip ? fip->field_name : "unknown tagname",
5729 dir->tdir_count, count);
5730 dir->tdir_count = count;
5731 return (1);
5732 }
5733 return (1);
5734 }
5735
5736 /*
5737 * Read IFD structure from the specified offset. If the pointer to
5738 * nextdiroff variable has been specified, read it too. Function returns a
5739 * number of fields in the directory or 0 if failed.
5740 */
5741 static uint16_t TIFFFetchDirectory(TIFF *tif, uint64_t diroff,
5742 TIFFDirEntry **pdir, uint64_t *nextdiroff)
5743 {
5744 static const char module[] = "TIFFFetchDirectory";
5745
5746 void *origdir;
5747 uint16_t dircount16;
5748 uint32_t dirsize;
5749 TIFFDirEntry *dir;
5750 uint8_t *ma;
5751 TIFFDirEntry *mb;
5752 uint16_t n;
5753
5754 assert(pdir);
5755
5756 tif->tif_diroff = diroff;
5757 if (nextdiroff)
5758 *nextdiroff = 0;
5759 if (!isMapped(tif))
5760 {
5761 if (!SeekOK(tif, tif->tif_diroff))
5762 {
5763 TIFFErrorExtR(tif, module,
5764 "%s: Seek error accessing TIFF directory",
5765 tif->tif_name);
5766 return 0;
5767 }
5768 if (!(tif->tif_flags & TIFF_BIGTIFF))
5769 {
5770 if (!ReadOK(tif, &dircount16, sizeof(uint16_t)))
5771 {
5772 TIFFErrorExtR(tif, module,
5773 "%s: Can not read TIFF directory count",
5774 tif->tif_name);
5775 return 0;
5776 }
5777 if (tif->tif_flags & TIFF_SWAB)
5778 TIFFSwabShort(&dircount16);
5779 if (dircount16 > 4096)
5780 {
5781 TIFFErrorExtR(tif, module,
5782 "Sanity check on directory count failed, this is "
5783 "probably not a valid IFD offset");
5784 return 0;
5785 }
5786 dirsize = 12;
5787 }
5788 else
5789 {
5790 uint64_t dircount64;
5791 if (!ReadOK(tif, &dircount64, sizeof(uint64_t)))
5792 {
5793 TIFFErrorExtR(tif, module,
5794 "%s: Can not read TIFF directory count",
5795 tif->tif_name);
5796 return 0;
5797 }
5798 if (tif->tif_flags & TIFF_SWAB)
5799 TIFFSwabLong8(&dircount64);
5800 if (dircount64 > 4096)
5801 {
5802 TIFFErrorExtR(tif, module,
5803 "Sanity check on directory count failed, this is "
5804 "probably not a valid IFD offset");
5805 return 0;
5806 }
5807 dircount16 = (uint16_t)dircount64;
5808 dirsize = 20;
5809 }
5810 origdir = _TIFFCheckMalloc(tif, dircount16, dirsize,
5811 "to read TIFF directory");
5812 if (origdir == NULL)
5813 return 0;
5814 if (!ReadOK(tif, origdir, (tmsize_t)(dircount16 * dirsize)))
5815 {
5816 TIFFErrorExtR(tif, module, "%.100s: Can not read TIFF directory",
5817 tif->tif_name);
5818 _TIFFfreeExt(tif, origdir);
5819 return 0;
5820 }
5821 /*
5822 * Read offset to next directory for sequential scans if
5823 * needed.
5824 */
5825 if (nextdiroff)
5826 {
5827 if (!(tif->tif_flags & TIFF_BIGTIFF))
5828 {
5829 uint32_t nextdiroff32;
5830 if (!ReadOK(tif, &nextdiroff32, sizeof(uint32_t)))
5831 nextdiroff32 = 0;
5832 if (tif->tif_flags & TIFF_SWAB)
5833 TIFFSwabLong(&nextdiroff32);
5834 *nextdiroff = nextdiroff32;
5835 }
5836 else
5837 {
5838 if (!ReadOK(tif, nextdiroff, sizeof(uint64_t)))
5839 *nextdiroff = 0;
5840 if (tif->tif_flags & TIFF_SWAB)
5841 TIFFSwabLong8(nextdiroff);
5842 }
5843 }
5844 }
5845 else
5846 {
5847 tmsize_t m;
5848 tmsize_t off;
5849 if (tif->tif_diroff > (uint64_t)INT64_MAX)
5850 {
5851 TIFFErrorExtR(tif, module, "Can not read TIFF directory count");
5852 return (0);
5853 }
5854 off = (tmsize_t)tif->tif_diroff;
5855
5856 /*
5857 * Check for integer overflow when validating the dir_off,
5858 * otherwise a very high offset may cause an OOB read and
5859 * crash the client. Make two comparisons instead of
5860 *
5861 * off + sizeof(uint16_t) > tif->tif_size
5862 *
5863 * to avoid overflow.
5864 */
5865 if (!(tif->tif_flags & TIFF_BIGTIFF))
5866 {
5867 m = off + sizeof(uint16_t);
5868 if ((m < off) || (m < (tmsize_t)sizeof(uint16_t)) ||
5869 (m > tif->tif_size))
5870 {
5871 TIFFErrorExtR(tif, module, "Can not read TIFF directory count");
5872 return 0;
5873 }
5874 else
5875 {
5876 _TIFFmemcpy(&dircount16, tif->tif_base + off, sizeof(uint16_t));
5877 }
5878 off += sizeof(uint16_t);
5879 if (tif->tif_flags & TIFF_SWAB)
5880 TIFFSwabShort(&dircount16);
5881 if (dircount16 > 4096)
5882 {
5883 TIFFErrorExtR(tif, module,
5884 "Sanity check on directory count failed, this is "
5885 "probably not a valid IFD offset");
5886 return 0;
5887 }
5888 dirsize = 12;
5889 }
5890 else
5891 {
5892 uint64_t dircount64;
5893 m = off + sizeof(uint64_t);
5894 if ((m < off) || (m < (tmsize_t)sizeof(uint64_t)) ||
5895 (m > tif->tif_size))
5896 {
5897 TIFFErrorExtR(tif, module, "Can not read TIFF directory count");
5898 return 0;
5899 }
5900 else
5901 {
5902 _TIFFmemcpy(&dircount64, tif->tif_base + off, sizeof(uint64_t));
5903 }
5904 off += sizeof(uint64_t);
5905 if (tif->tif_flags & TIFF_SWAB)
5906 TIFFSwabLong8(&dircount64);
5907 if (dircount64 > 4096)
5908 {
5909 TIFFErrorExtR(tif, module,
5910 "Sanity check on directory count failed, this is "
5911 "probably not a valid IFD offset");
5912 return 0;
5913 }
5914 dircount16 = (uint16_t)dircount64;
5915 dirsize = 20;
5916 }
5917 if (dircount16 == 0)
5918 {
5919 TIFFErrorExtR(tif, module,
5920 "Sanity check on directory count failed, zero tag "
5921 "directories not supported");
5922 return 0;
5923 }
5924 origdir = _TIFFCheckMalloc(tif, dircount16, dirsize,
5925 "to read TIFF directory");
5926 if (origdir == NULL)
5927 return 0;
5928 m = off + dircount16 * dirsize;
5929 if ((m < off) || (m < (tmsize_t)(dircount16 * dirsize)) ||
5930 (m > tif->tif_size))
5931 {
5932 TIFFErrorExtR(tif, module, "Can not read TIFF directory");
5933 _TIFFfreeExt(tif, origdir);
5934 return 0;
5935 }
5936 else
5937 {
5938 _TIFFmemcpy(origdir, tif->tif_base + off, dircount16 * dirsize);
5939 }
5940 if (nextdiroff)
5941 {
5942 off += dircount16 * dirsize;
5943 if (!(tif->tif_flags & TIFF_BIGTIFF))
5944 {
5945 uint32_t nextdiroff32;
5946 m = off + sizeof(uint32_t);
5947 if ((m < off) || (m < (tmsize_t)sizeof(uint32_t)) ||
5948 (m > tif->tif_size))
5949 nextdiroff32 = 0;
5950 else
5951 _TIFFmemcpy(&nextdiroff32, tif->tif_base + off,
5952 sizeof(uint32_t));
5953 if (tif->tif_flags & TIFF_SWAB)
5954 TIFFSwabLong(&nextdiroff32);
5955 *nextdiroff = nextdiroff32;
5956 }
5957 else
5958 {
5959 m = off + sizeof(uint64_t);
5960 if ((m < off) || (m < (tmsize_t)sizeof(uint64_t)) ||
5961 (m > tif->tif_size))
5962 *nextdiroff = 0;
5963 else
5964 _TIFFmemcpy(nextdiroff, tif->tif_base + off,
5965 sizeof(uint64_t));
5966 if (tif->tif_flags & TIFF_SWAB)
5967 TIFFSwabLong8(nextdiroff);
5968 }
5969 }
5970 }
5971 dir = (TIFFDirEntry *)_TIFFCheckMalloc(
5972 tif, dircount16, sizeof(TIFFDirEntry), "to read TIFF directory");
5973 if (dir == 0)
5974 {
5975 _TIFFfreeExt(tif, origdir);
5976 return 0;
5977 }
5978 ma = (uint8_t *)origdir;
5979 mb = dir;
5980 for (n = 0; n < dircount16; n++)
5981 {
5982 mb->tdir_ignore = FALSE;
5983 if (tif->tif_flags & TIFF_SWAB)
5984 TIFFSwabShort((uint16_t *)ma);
5985 mb->tdir_tag = *(uint16_t *)ma;
5986 ma += sizeof(uint16_t);
5987 if (tif->tif_flags & TIFF_SWAB)
5988 TIFFSwabShort((uint16_t *)ma);
5989 mb->tdir_type = *(uint16_t *)ma;
5990 ma += sizeof(uint16_t);
5991 if (!(tif->tif_flags & TIFF_BIGTIFF))
5992 {
5993 if (tif->tif_flags & TIFF_SWAB)
5994 TIFFSwabLong((uint32_t *)ma);
5995 mb->tdir_count = (uint64_t)(*(uint32_t *)ma);
5996 ma += sizeof(uint32_t);
5997 mb->tdir_offset.toff_long8 = 0;
5998 *(uint32_t *)(&mb->tdir_offset) = *(uint32_t *)ma;
5999 ma += sizeof(uint32_t);
6000 }
6001 else
6002 {
6003 if (tif->tif_flags & TIFF_SWAB)
6004 TIFFSwabLong8((uint64_t *)ma);
6005 mb->tdir_count = TIFFReadUInt64(ma);
6006 ma += sizeof(uint64_t);
6007 mb->tdir_offset.toff_long8 = TIFFReadUInt64(ma);
6008 ma += sizeof(uint64_t);
6009 }
6010 mb++;
6011 }
6012 _TIFFfreeExt(tif, origdir);
6013 *pdir = dir;
6014 return dircount16;
6015 }
6016
6017 /*
6018 * Fetch a tag that is not handled by special case code.
6019 */
6020 static int TIFFFetchNormalTag(TIFF *tif, TIFFDirEntry *dp, int recover)
6021 {
6022 static const char module[] = "TIFFFetchNormalTag";
6023 enum TIFFReadDirEntryErr err;
6024 uint32_t fii;
6025 const TIFFField *fip = NULL;
6026 TIFFReadDirectoryFindFieldInfo(tif, dp->tdir_tag, &fii);
6027 if (fii == FAILED_FII)
6028 {
6029 TIFFErrorExtR(tif, "TIFFFetchNormalTag",
6030 "No definition found for tag %" PRIu16, dp->tdir_tag);
6031 return 0;
6032 }
6033 fip = tif->tif_fields[fii];
6034 assert(fip != NULL); /* should not happen */
6035 assert(fip->set_field_type !=
6036 TIFF_SETGET_OTHER); /* if so, we shouldn't arrive here but deal with
6037 this in specialized code */
6038 assert(fip->set_field_type !=
6039 TIFF_SETGET_INT); /* if so, we shouldn't arrive here as this is only
6040 the case for pseudo-tags */
6041 err = TIFFReadDirEntryErrOk;
6042 switch (fip->set_field_type)
6043 {
6044 case TIFF_SETGET_UNDEFINED:
6045 TIFFErrorExtR(
6046 tif, "TIFFFetchNormalTag",
6047 "Defined set_field_type of custom tag %u (%s) is "
6048 "TIFF_SETGET_UNDEFINED and thus tag is not read from file",
6049 fip->field_tag, fip->field_name);
6050 break;
6051 case TIFF_SETGET_ASCII:
6052 {
6053 uint8_t *data;
6054 assert(fip->field_passcount == 0);
6055 err = TIFFReadDirEntryByteArray(tif, dp, &data);
6056 if (err == TIFFReadDirEntryErrOk)
6057 {
6058 size_t mb = 0;
6059 int n;
6060 if (data != NULL)
6061 {
6062 if (dp->tdir_count > 0 && data[dp->tdir_count - 1] == 0)
6063 {
6064 /* optimization: if data is known to be 0 terminated, we
6065 * can use strlen() */
6066 mb = strlen((const char *)data);
6067 }
6068 else
6069 {
6070 /* general case. equivalent to non-portable */
6071 /* mb = strnlen((const char*)data,
6072 * (uint32_t)dp->tdir_count); */
6073 uint8_t *ma = data;
6074 while (mb < (uint32_t)dp->tdir_count)
6075 {
6076 if (*ma == 0)
6077 break;
6078 ma++;
6079 mb++;
6080 }
6081 }
6082 }
6083 if (mb + 1 < (uint32_t)dp->tdir_count)
6084 TIFFWarningExtR(
6085 tif, module,
6086 "ASCII value for tag \"%s\" contains null byte in "
6087 "value; value incorrectly truncated during reading due "
6088 "to implementation limitations",
6089 fip->field_name);
6090 else if (mb + 1 > (uint32_t)dp->tdir_count)
6091 {
6092 uint8_t *o;
6093 TIFFWarningExtR(
6094 tif, module,
6095 "ASCII value for tag \"%s\" does not end in null byte",
6096 fip->field_name);
6097 /* TIFFReadDirEntryArrayWithLimit() ensures this can't be
6098 * larger than MAX_SIZE_TAG_DATA */
6099 assert((uint32_t)dp->tdir_count + 1 == dp->tdir_count + 1);
6100 o = _TIFFmallocExt(tif, (uint32_t)dp->tdir_count + 1);
6101 if (o == NULL)
6102 {
6103 if (data != NULL)
6104 _TIFFfreeExt(tif, data);
6105 return (0);
6106 }
6107 if (dp->tdir_count > 0)
6108 {
6109 _TIFFmemcpy(o, data, (uint32_t)dp->tdir_count);
6110 }
6111 o[(uint32_t)dp->tdir_count] = 0;
6112 if (data != 0)
6113 _TIFFfreeExt(tif, data);
6114 data = o;
6115 }
6116 n = TIFFSetField(tif, dp->tdir_tag, data);
6117 if (data != 0)
6118 _TIFFfreeExt(tif, data);
6119 if (!n)
6120 return (0);
6121 }
6122 }
6123 break;
6124 case TIFF_SETGET_UINT8:
6125 {
6126 uint8_t data = 0;
6127 assert(fip->field_readcount == 1);
6128 assert(fip->field_passcount == 0);
6129 err = TIFFReadDirEntryByte(tif, dp, &data);
6130 if (err == TIFFReadDirEntryErrOk)
6131 {
6132 if (!TIFFSetField(tif, dp->tdir_tag, data))
6133 return (0);
6134 }
6135 }
6136 break;
6137 case TIFF_SETGET_SINT8:
6138 {
6139 int8_t data = 0;
6140 assert(fip->field_readcount == 1);
6141 assert(fip->field_passcount == 0);
6142 err = TIFFReadDirEntrySbyte(tif, dp, &data);
6143 if (err == TIFFReadDirEntryErrOk)
6144 {
6145 if (!TIFFSetField(tif, dp->tdir_tag, data))
6146 return (0);
6147 }
6148 }
6149 break;
6150 case TIFF_SETGET_UINT16:
6151 {
6152 uint16_t data;
6153 assert(fip->field_readcount == 1);
6154 assert(fip->field_passcount == 0);
6155 err = TIFFReadDirEntryShort(tif, dp, &data);
6156 if (err == TIFFReadDirEntryErrOk)
6157 {
6158 if (!TIFFSetField(tif, dp->tdir_tag, data))
6159 return (0);
6160 }
6161 }
6162 break;
6163 case TIFF_SETGET_SINT16:
6164 {
6165 int16_t data;
6166 assert(fip->field_readcount == 1);
6167 assert(fip->field_passcount == 0);
6168 err = TIFFReadDirEntrySshort(tif, dp, &data);
6169 if (err == TIFFReadDirEntryErrOk)
6170 {
6171 if (!TIFFSetField(tif, dp->tdir_tag, data))
6172 return (0);
6173 }
6174 }
6175 break;
6176 case TIFF_SETGET_UINT32:
6177 {
6178 uint32_t data;
6179 assert(fip->field_readcount == 1);
6180 assert(fip->field_passcount == 0);
6181 err = TIFFReadDirEntryLong(tif, dp, &data);
6182 if (err == TIFFReadDirEntryErrOk)
6183 {
6184 if (!TIFFSetField(tif, dp->tdir_tag, data))
6185 return (0);
6186 }
6187 }
6188 break;
6189 case TIFF_SETGET_SINT32:
6190 {
6191 int32_t data;
6192 assert(fip->field_readcount == 1);
6193 assert(fip->field_passcount == 0);
6194 err = TIFFReadDirEntrySlong(tif, dp, &data);
6195 if (err == TIFFReadDirEntryErrOk)
6196 {
6197 if (!TIFFSetField(tif, dp->tdir_tag, data))
6198 return (0);
6199 }
6200 }
6201 break;
6202 case TIFF_SETGET_UINT64:
6203 {
6204 uint64_t data;
6205 assert(fip->field_readcount == 1);
6206 assert(fip->field_passcount == 0);
6207 err = TIFFReadDirEntryLong8(tif, dp, &data);
6208 if (err == TIFFReadDirEntryErrOk)
6209 {
6210 if (!TIFFSetField(tif, dp->tdir_tag, data))
6211 return (0);
6212 }
6213 }
6214 break;
6215 case TIFF_SETGET_SINT64:
6216 {
6217 int64_t data;
6218 assert(fip->field_readcount == 1);
6219 assert(fip->field_passcount == 0);
6220 err = TIFFReadDirEntrySlong8(tif, dp, &data);
6221 if (err == TIFFReadDirEntryErrOk)
6222 {
6223 if (!TIFFSetField(tif, dp->tdir_tag, data))
6224 return (0);
6225 }
6226 }
6227 break;
6228 case TIFF_SETGET_FLOAT:
6229 {
6230 float data;
6231 assert(fip->field_readcount == 1);
6232 assert(fip->field_passcount == 0);
6233 err = TIFFReadDirEntryFloat(tif, dp, &data);
6234 if (err == TIFFReadDirEntryErrOk)
6235 {
6236 if (!TIFFSetField(tif, dp->tdir_tag, data))
6237 return (0);
6238 }
6239 }
6240 break;
6241 case TIFF_SETGET_DOUBLE:
6242 {
6243 double data;
6244 assert(fip->field_readcount == 1);
6245 assert(fip->field_passcount == 0);
6246 err = TIFFReadDirEntryDouble(tif, dp, &data);
6247 if (err == TIFFReadDirEntryErrOk)
6248 {
6249 if (!TIFFSetField(tif, dp->tdir_tag, data))
6250 return (0);
6251 }
6252 }
6253 break;
6254 case TIFF_SETGET_IFD8:
6255 {
6256 uint64_t data;
6257 assert(fip->field_readcount == 1);
6258 assert(fip->field_passcount == 0);
6259 err = TIFFReadDirEntryIfd8(tif, dp, &data);
6260 if (err == TIFFReadDirEntryErrOk)
6261 {
6262 if (!TIFFSetField(tif, dp->tdir_tag, data))
6263 return (0);
6264 }
6265 }
6266 break;
6267 case TIFF_SETGET_UINT16_PAIR:
6268 {
6269 uint16_t *data;
6270 assert(fip->field_readcount == 2);
6271 assert(fip->field_passcount == 0);
6272 if (dp->tdir_count != 2)
6273 {
6274 TIFFWarningExtR(tif, module,
6275 "incorrect count for field \"%s\", expected 2, "
6276 "got %" PRIu64,
6277 fip->field_name, dp->tdir_count);
6278 return (0);
6279 }
6280 err = TIFFReadDirEntryShortArray(tif, dp, &data);
6281 if (err == TIFFReadDirEntryErrOk)
6282 {
6283 int m;
6284 assert(data); /* avoid CLang static Analyzer false positive */
6285 m = TIFFSetField(tif, dp->tdir_tag, data[0], data[1]);
6286 _TIFFfreeExt(tif, data);
6287 if (!m)
6288 return (0);
6289 }
6290 }
6291 break;
6292 case TIFF_SETGET_C0_UINT8:
6293 {
6294 uint8_t *data;
6295 assert(fip->field_readcount >= 1);
6296 assert(fip->field_passcount == 0);
6297 if (dp->tdir_count != (uint64_t)fip->field_readcount)
6298 {
6299 TIFFWarningExtR(tif, module,
6300 "incorrect count for field \"%s\", expected "
6301 "%d, got %" PRIu64,
6302 fip->field_name, (int)fip->field_readcount,
6303 dp->tdir_count);
6304 return (0);
6305 }
6306 else
6307 {
6308 err = TIFFReadDirEntryByteArray(tif, dp, &data);
6309 if (err == TIFFReadDirEntryErrOk)
6310 {
6311 int m;
6312 m = TIFFSetField(tif, dp->tdir_tag, data);
6313 if (data != 0)
6314 _TIFFfreeExt(tif, data);
6315 if (!m)
6316 return (0);
6317 }
6318 }
6319 }
6320 break;
6321 case TIFF_SETGET_C0_SINT8:
6322 {
6323 int8_t *data;
6324 assert(fip->field_readcount >= 1);
6325 assert(fip->field_passcount == 0);
6326 if (dp->tdir_count != (uint64_t)fip->field_readcount)
6327 {
6328 TIFFWarningExtR(tif, module,
6329 "incorrect count for field \"%s\", expected "
6330 "%d, got %" PRIu64,
6331 fip->field_name, (int)fip->field_readcount,
6332 dp->tdir_count);
6333 return (0);
6334 }
6335 else
6336 {
6337 err = TIFFReadDirEntrySbyteArray(tif, dp, &data);
6338 if (err == TIFFReadDirEntryErrOk)
6339 {
6340 int m;
6341 m = TIFFSetField(tif, dp->tdir_tag, data);
6342 if (data != 0)
6343 _TIFFfreeExt(tif, data);
6344 if (!m)
6345 return (0);
6346 }
6347 }
6348 }
6349 break;
6350 case TIFF_SETGET_C0_UINT16:
6351 {
6352 uint16_t *data;
6353 assert(fip->field_readcount >= 1);
6354 assert(fip->field_passcount == 0);
6355 if (dp->tdir_count != (uint64_t)fip->field_readcount)
6356 {
6357 TIFFWarningExtR(tif, module,
6358 "incorrect count for field \"%s\", expected "
6359 "%d, got %" PRIu64,
6360 fip->field_name, (int)fip->field_readcount,
6361 dp->tdir_count);
6362 return (0);
6363 }
6364 else
6365 {
6366 err = TIFFReadDirEntryShortArray(tif, dp, &data);
6367 if (err == TIFFReadDirEntryErrOk)
6368 {
6369 int m;
6370 m = TIFFSetField(tif, dp->tdir_tag, data);
6371 if (data != 0)
6372 _TIFFfreeExt(tif, data);
6373 if (!m)
6374 return (0);
6375 }
6376 }
6377 }
6378 break;
6379 case TIFF_SETGET_C0_SINT16:
6380 {
6381 int16_t *data;
6382 assert(fip->field_readcount >= 1);
6383 assert(fip->field_passcount == 0);
6384 if (dp->tdir_count != (uint64_t)fip->field_readcount)
6385 {
6386 TIFFWarningExtR(tif, module,
6387 "incorrect count for field \"%s\", expected "
6388 "%d, got %" PRIu64,
6389 fip->field_name, (int)fip->field_readcount,
6390 dp->tdir_count);
6391 return (0);
6392 }
6393 else
6394 {
6395 err = TIFFReadDirEntrySshortArray(tif, dp, &data);
6396 if (err == TIFFReadDirEntryErrOk)
6397 {
6398 int m;
6399 m = TIFFSetField(tif, dp->tdir_tag, data);
6400 if (data != 0)
6401 _TIFFfreeExt(tif, data);
6402 if (!m)
6403 return (0);
6404 }
6405 }
6406 }
6407 break;
6408 case TIFF_SETGET_C0_UINT32:
6409 {
6410 uint32_t *data;
6411 assert(fip->field_readcount >= 1);
6412 assert(fip->field_passcount == 0);
6413 if (dp->tdir_count != (uint64_t)fip->field_readcount)
6414 {
6415 TIFFWarningExtR(tif, module,
6416 "incorrect count for field \"%s\", expected "
6417 "%d, got %" PRIu64,
6418 fip->field_name, (int)fip->field_readcount,
6419 dp->tdir_count);
6420 return (0);
6421 }
6422 else
6423 {
6424 err = TIFFReadDirEntryLongArray(tif, dp, &data);
6425 if (err == TIFFReadDirEntryErrOk)
6426 {
6427 int m;
6428 m = TIFFSetField(tif, dp->tdir_tag, data);
6429 if (data != 0)
6430 _TIFFfreeExt(tif, data);
6431 if (!m)
6432 return (0);
6433 }
6434 }
6435 }
6436 break;
6437 case TIFF_SETGET_C0_SINT32:
6438 {
6439 int32_t *data;
6440 assert(fip->field_readcount >= 1);
6441 assert(fip->field_passcount == 0);
6442 if (dp->tdir_count != (uint64_t)fip->field_readcount)
6443 {
6444 TIFFWarningExtR(tif, module,
6445 "incorrect count for field \"%s\", expected "
6446 "%d, got %" PRIu64,
6447 fip->field_name, (int)fip->field_readcount,
6448 dp->tdir_count);
6449 return (0);
6450 }
6451 else
6452 {
6453 err = TIFFReadDirEntrySlongArray(tif, dp, &data);
6454 if (err == TIFFReadDirEntryErrOk)
6455 {
6456 int m;
6457 m = TIFFSetField(tif, dp->tdir_tag, data);
6458 if (data != 0)
6459 _TIFFfreeExt(tif, data);
6460 if (!m)
6461 return (0);
6462 }
6463 }
6464 }
6465 break;
6466 case TIFF_SETGET_C0_UINT64:
6467 {
6468 uint64_t *data;
6469 assert(fip->field_readcount >= 1);
6470 assert(fip->field_passcount == 0);
6471 if (dp->tdir_count != (uint64_t)fip->field_readcount)
6472 {
6473 TIFFWarningExtR(tif, module,
6474 "incorrect count for field \"%s\", expected "
6475 "%d, got %" PRIu64,
6476 fip->field_name, (int)fip->field_readcount,
6477 dp->tdir_count);
6478 return (0);
6479 }
6480 else
6481 {
6482 err = TIFFReadDirEntryLong8Array(tif, dp, &data);
6483 if (err == TIFFReadDirEntryErrOk)
6484 {
6485 int m;
6486 m = TIFFSetField(tif, dp->tdir_tag, data);
6487 if (data != 0)
6488 _TIFFfreeExt(tif, data);
6489 if (!m)
6490 return (0);
6491 }
6492 }
6493 }
6494 break;
6495 case TIFF_SETGET_C0_SINT64:
6496 {
6497 int64_t *data;
6498 assert(fip->field_readcount >= 1);
6499 assert(fip->field_passcount == 0);
6500 if (dp->tdir_count != (uint64_t)fip->field_readcount)
6501 {
6502 TIFFWarningExtR(tif, module,
6503 "incorrect count for field \"%s\", expected "
6504 "%d, got %" PRIu64,
6505 fip->field_name, (int)fip->field_readcount,
6506 dp->tdir_count);
6507 return (0);
6508 }
6509 else
6510 {
6511 err = TIFFReadDirEntrySlong8Array(tif, dp, &data);
6512 if (err == TIFFReadDirEntryErrOk)
6513 {
6514 int m;
6515 m = TIFFSetField(tif, dp->tdir_tag, data);
6516 if (data != 0)
6517 _TIFFfreeExt(tif, data);
6518 if (!m)
6519 return (0);
6520 }
6521 }
6522 }
6523 break;
6524 case TIFF_SETGET_C0_FLOAT:
6525 {
6526 float *data;
6527 assert(fip->field_readcount >= 1);
6528 assert(fip->field_passcount == 0);
6529 if (dp->tdir_count != (uint64_t)fip->field_readcount)
6530 {
6531 TIFFWarningExtR(tif, module,
6532 "incorrect count for field \"%s\", expected "
6533 "%d, got %" PRIu64,
6534 fip->field_name, (int)fip->field_readcount,
6535 dp->tdir_count);
6536 return (0);
6537 }
6538 else
6539 {
6540 err = TIFFReadDirEntryFloatArray(tif, dp, &data);
6541 if (err == TIFFReadDirEntryErrOk)
6542 {
6543 int m;
6544 m = TIFFSetField(tif, dp->tdir_tag, data);
6545 if (data != 0)
6546 _TIFFfreeExt(tif, data);
6547 if (!m)
6548 return (0);
6549 }
6550 }
6551 }
6552 break;
6553 /*--: Rational2Double: Extend for Double Arrays and Rational-Arrays read
6554 * into Double-Arrays. */
6555 case TIFF_SETGET_C0_DOUBLE:
6556 {
6557 double *data;
6558 assert(fip->field_readcount >= 1);
6559 assert(fip->field_passcount == 0);
6560 if (dp->tdir_count != (uint64_t)fip->field_readcount)
6561 {
6562 TIFFWarningExtR(tif, module,
6563 "incorrect count for field \"%s\", expected "
6564 "%d, got %" PRIu64,
6565 fip->field_name, (int)fip->field_readcount,
6566 dp->tdir_count);
6567 return (0);
6568 }
6569 else
6570 {
6571 err = TIFFReadDirEntryDoubleArray(tif, dp, &data);
6572 if (err == TIFFReadDirEntryErrOk)
6573 {
6574 int m;
6575 m = TIFFSetField(tif, dp->tdir_tag, data);
6576 if (data != 0)
6577 _TIFFfreeExt(tif, data);
6578 if (!m)
6579 return (0);
6580 }
6581 }
6582 }
6583 break;
6584 case TIFF_SETGET_C16_ASCII:
6585 {
6586 uint8_t *data;
6587 assert(fip->field_readcount == TIFF_VARIABLE);
6588 assert(fip->field_passcount == 1);
6589 if (dp->tdir_count > 0xFFFF)
6590 err = TIFFReadDirEntryErrCount;
6591 else
6592 {
6593 err = TIFFReadDirEntryByteArray(tif, dp, &data);
6594 if (err == TIFFReadDirEntryErrOk)
6595 {
6596 int m;
6597 if (data != 0 && dp->tdir_count > 0 &&
6598 data[dp->tdir_count - 1] != '\0')
6599 {
6600 TIFFWarningExtR(
6601 tif, module,
6602 "ASCII value for tag \"%s\" does not end in null "
6603 "byte. Forcing it to be null",
6604 fip->field_name);
6605 data[dp->tdir_count - 1] = '\0';
6606 }
6607 m = TIFFSetField(tif, dp->tdir_tag,
6608 (uint16_t)(dp->tdir_count), data);
6609 if (data != 0)
6610 _TIFFfreeExt(tif, data);
6611 if (!m)
6612 return (0);
6613 }
6614 }
6615 }
6616 break;
6617 case TIFF_SETGET_C16_UINT8:
6618 {
6619 uint8_t *data;
6620 assert(fip->field_readcount == TIFF_VARIABLE);
6621 assert(fip->field_passcount == 1);
6622 if (dp->tdir_count > 0xFFFF)
6623 err = TIFFReadDirEntryErrCount;
6624 else
6625 {
6626 err = TIFFReadDirEntryByteArray(tif, dp, &data);
6627 if (err == TIFFReadDirEntryErrOk)
6628 {
6629 int m;
6630 m = TIFFSetField(tif, dp->tdir_tag,
6631 (uint16_t)(dp->tdir_count), data);
6632 if (data != 0)
6633 _TIFFfreeExt(tif, data);
6634 if (!m)
6635 return (0);
6636 }
6637 }
6638 }
6639 break;
6640 case TIFF_SETGET_C16_SINT8:
6641 {
6642 int8_t *data;
6643 assert(fip->field_readcount == TIFF_VARIABLE);
6644 assert(fip->field_passcount == 1);
6645 if (dp->tdir_count > 0xFFFF)
6646 err = TIFFReadDirEntryErrCount;
6647 else
6648 {
6649 err = TIFFReadDirEntrySbyteArray(tif, dp, &data);
6650 if (err == TIFFReadDirEntryErrOk)
6651 {
6652 int m;
6653 m = TIFFSetField(tif, dp->tdir_tag,
6654 (uint16_t)(dp->tdir_count), data);
6655 if (data != 0)
6656 _TIFFfreeExt(tif, data);
6657 if (!m)
6658 return (0);
6659 }
6660 }
6661 }
6662 break;
6663 case TIFF_SETGET_C16_UINT16:
6664 {
6665 uint16_t *data;
6666 assert(fip->field_readcount == TIFF_VARIABLE);
6667 assert(fip->field_passcount == 1);
6668 if (dp->tdir_count > 0xFFFF)
6669 err = TIFFReadDirEntryErrCount;
6670 else
6671 {
6672 err = TIFFReadDirEntryShortArray(tif, dp, &data);
6673 if (err == TIFFReadDirEntryErrOk)
6674 {
6675 int m;
6676 m = TIFFSetField(tif, dp->tdir_tag,
6677 (uint16_t)(dp->tdir_count), data);
6678 if (data != 0)
6679 _TIFFfreeExt(tif, data);
6680 if (!m)
6681 return (0);
6682 }
6683 }
6684 }
6685 break;
6686 case TIFF_SETGET_C16_SINT16:
6687 {
6688 int16_t *data;
6689 assert(fip->field_readcount == TIFF_VARIABLE);
6690 assert(fip->field_passcount == 1);
6691 if (dp->tdir_count > 0xFFFF)
6692 err = TIFFReadDirEntryErrCount;
6693 else
6694 {
6695 err = TIFFReadDirEntrySshortArray(tif, dp, &data);
6696 if (err == TIFFReadDirEntryErrOk)
6697 {
6698 int m;
6699 m = TIFFSetField(tif, dp->tdir_tag,
6700 (uint16_t)(dp->tdir_count), data);
6701 if (data != 0)
6702 _TIFFfreeExt(tif, data);
6703 if (!m)
6704 return (0);
6705 }
6706 }
6707 }
6708 break;
6709 case TIFF_SETGET_C16_UINT32:
6710 {
6711 uint32_t *data;
6712 assert(fip->field_readcount == TIFF_VARIABLE);
6713 assert(fip->field_passcount == 1);
6714 if (dp->tdir_count > 0xFFFF)
6715 err = TIFFReadDirEntryErrCount;
6716 else
6717 {
6718 err = TIFFReadDirEntryLongArray(tif, dp, &data);
6719 if (err == TIFFReadDirEntryErrOk)
6720 {
6721 int m;
6722 m = TIFFSetField(tif, dp->tdir_tag,
6723 (uint16_t)(dp->tdir_count), data);
6724 if (data != 0)
6725 _TIFFfreeExt(tif, data);
6726 if (!m)
6727 return (0);
6728 }
6729 }
6730 }
6731 break;
6732 case TIFF_SETGET_C16_SINT32:
6733 {
6734 int32_t *data;
6735 assert(fip->field_readcount == TIFF_VARIABLE);
6736 assert(fip->field_passcount == 1);
6737 if (dp->tdir_count > 0xFFFF)
6738 err = TIFFReadDirEntryErrCount;
6739 else
6740 {
6741 err = TIFFReadDirEntrySlongArray(tif, dp, &data);
6742 if (err == TIFFReadDirEntryErrOk)
6743 {
6744 int m;
6745 m = TIFFSetField(tif, dp->tdir_tag,
6746 (uint16_t)(dp->tdir_count), data);
6747 if (data != 0)
6748 _TIFFfreeExt(tif, data);
6749 if (!m)
6750 return (0);
6751 }
6752 }
6753 }
6754 break;
6755 case TIFF_SETGET_C16_UINT64:
6756 {
6757 uint64_t *data;
6758 assert(fip->field_readcount == TIFF_VARIABLE);
6759 assert(fip->field_passcount == 1);
6760 if (dp->tdir_count > 0xFFFF)
6761 err = TIFFReadDirEntryErrCount;
6762 else
6763 {
6764 err = TIFFReadDirEntryLong8Array(tif, dp, &data);
6765 if (err == TIFFReadDirEntryErrOk)
6766 {
6767 int m;
6768 m = TIFFSetField(tif, dp->tdir_tag,
6769 (uint16_t)(dp->tdir_count), data);
6770 if (data != 0)
6771 _TIFFfreeExt(tif, data);
6772 if (!m)
6773 return (0);
6774 }
6775 }
6776 }
6777 break;
6778 case TIFF_SETGET_C16_SINT64:
6779 {
6780 int64_t *data;
6781 assert(fip->field_readcount == TIFF_VARIABLE);
6782 assert(fip->field_passcount == 1);
6783 if (dp->tdir_count > 0xFFFF)
6784 err = TIFFReadDirEntryErrCount;
6785 else
6786 {
6787 err = TIFFReadDirEntrySlong8Array(tif, dp, &data);
6788 if (err == TIFFReadDirEntryErrOk)
6789 {
6790 int m;
6791 m = TIFFSetField(tif, dp->tdir_tag,
6792 (uint16_t)(dp->tdir_count), data);
6793 if (data != 0)
6794 _TIFFfreeExt(tif, data);
6795 if (!m)
6796 return (0);
6797 }
6798 }
6799 }
6800 break;
6801 case TIFF_SETGET_C16_FLOAT:
6802 {
6803 float *data;
6804 assert(fip->field_readcount == TIFF_VARIABLE);
6805 assert(fip->field_passcount == 1);
6806 if (dp->tdir_count > 0xFFFF)
6807 err = TIFFReadDirEntryErrCount;
6808 else
6809 {
6810 err = TIFFReadDirEntryFloatArray(tif, dp, &data);
6811 if (err == TIFFReadDirEntryErrOk)
6812 {
6813 int m;
6814 m = TIFFSetField(tif, dp->tdir_tag,
6815 (uint16_t)(dp->tdir_count), data);
6816 if (data != 0)
6817 _TIFFfreeExt(tif, data);
6818 if (!m)
6819 return (0);
6820 }
6821 }
6822 }
6823 break;
6824 case TIFF_SETGET_C16_DOUBLE:
6825 {
6826 double *data;
6827 assert(fip->field_readcount == TIFF_VARIABLE);
6828 assert(fip->field_passcount == 1);
6829 if (dp->tdir_count > 0xFFFF)
6830 err = TIFFReadDirEntryErrCount;
6831 else
6832 {
6833 err = TIFFReadDirEntryDoubleArray(tif, dp, &data);
6834 if (err == TIFFReadDirEntryErrOk)
6835 {
6836 int m;
6837 m = TIFFSetField(tif, dp->tdir_tag,
6838 (uint16_t)(dp->tdir_count), data);
6839 if (data != 0)
6840 _TIFFfreeExt(tif, data);
6841 if (!m)
6842 return (0);
6843 }
6844 }
6845 }
6846 break;
6847 case TIFF_SETGET_C16_IFD8:
6848 {
6849 uint64_t *data;
6850 assert(fip->field_readcount == TIFF_VARIABLE);
6851 assert(fip->field_passcount == 1);
6852 if (dp->tdir_count > 0xFFFF)
6853 err = TIFFReadDirEntryErrCount;
6854 else
6855 {
6856 err = TIFFReadDirEntryIfd8Array(tif, dp, &data);
6857 if (err == TIFFReadDirEntryErrOk)
6858 {
6859 int m;
6860 m = TIFFSetField(tif, dp->tdir_tag,
6861 (uint16_t)(dp->tdir_count), data);
6862 if (data != 0)
6863 _TIFFfreeExt(tif, data);
6864 if (!m)
6865 return (0);
6866 }
6867 }
6868 }
6869 break;
6870 case TIFF_SETGET_C32_ASCII:
6871 {
6872 uint8_t *data;
6873 assert(fip->field_readcount == TIFF_VARIABLE2);
6874 assert(fip->field_passcount == 1);
6875 err = TIFFReadDirEntryByteArray(tif, dp, &data);
6876 if (err == TIFFReadDirEntryErrOk)
6877 {
6878 int m;
6879 if (data != 0 && dp->tdir_count > 0 &&
6880 data[dp->tdir_count - 1] != '\0')
6881 {
6882 TIFFWarningExtR(tif, module,
6883 "ASCII value for tag \"%s\" does not end "
6884 "in null byte. Forcing it to be null",
6885 fip->field_name);
6886 data[dp->tdir_count - 1] = '\0';
6887 }
6888 m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
6889 data);
6890 if (data != 0)
6891 _TIFFfreeExt(tif, data);
6892 if (!m)
6893 return (0);
6894 }
6895 }
6896 break;
6897 case TIFF_SETGET_C32_UINT8:
6898 {
6899 uint8_t *data;
6900 uint32_t count = 0;
6901 assert(fip->field_readcount == TIFF_VARIABLE2);
6902 assert(fip->field_passcount == 1);
6903 if (fip->field_tag == TIFFTAG_RICHTIFFIPTC &&
6904 dp->tdir_type == TIFF_LONG)
6905 {
6906 /* Adobe's software (wrongly) writes RichTIFFIPTC tag with
6907 * data type LONG instead of UNDEFINED. Work around this
6908 * frequently found issue */
6909 void *origdata;
6910 err = TIFFReadDirEntryArray(tif, dp, &count, 4, &origdata);
6911 if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
6912 {
6913 data = NULL;
6914 }
6915 else
6916 {
6917 if (tif->tif_flags & TIFF_SWAB)
6918 TIFFSwabArrayOfLong((uint32_t *)origdata, count);
6919 data = (uint8_t *)origdata;
6920 count = (uint32_t)(count * 4);
6921 }
6922 }
6923 else
6924 {
6925 err = TIFFReadDirEntryByteArray(tif, dp, &data);
6926 count = (uint32_t)(dp->tdir_count);
6927 }
6928 if (err == TIFFReadDirEntryErrOk)
6929 {
6930 int m;
6931 m = TIFFSetField(tif, dp->tdir_tag, count, data);
6932 if (data != 0)
6933 _TIFFfreeExt(tif, data);
6934 if (!m)
6935 return (0);
6936 }
6937 }
6938 break;
6939 case TIFF_SETGET_C32_SINT8:
6940 {
6941 int8_t *data = NULL;
6942 assert(fip->field_readcount == TIFF_VARIABLE2);
6943 assert(fip->field_passcount == 1);
6944 err = TIFFReadDirEntrySbyteArray(tif, dp, &data);
6945 if (err == TIFFReadDirEntryErrOk)
6946 {
6947 int m;
6948 m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
6949 data);
6950 if (data != 0)
6951 _TIFFfreeExt(tif, data);
6952 if (!m)
6953 return (0);
6954 }
6955 }
6956 break;
6957 case TIFF_SETGET_C32_UINT16:
6958 {
6959 uint16_t *data;
6960 assert(fip->field_readcount == TIFF_VARIABLE2);
6961 assert(fip->field_passcount == 1);
6962 err = TIFFReadDirEntryShortArray(tif, dp, &data);
6963 if (err == TIFFReadDirEntryErrOk)
6964 {
6965 int m;
6966 m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
6967 data);
6968 if (data != 0)
6969 _TIFFfreeExt(tif, data);
6970 if (!m)
6971 return (0);
6972 }
6973 }
6974 break;
6975 case TIFF_SETGET_C32_SINT16:
6976 {
6977 int16_t *data = NULL;
6978 assert(fip->field_readcount == TIFF_VARIABLE2);
6979 assert(fip->field_passcount == 1);
6980 err = TIFFReadDirEntrySshortArray(tif, dp, &data);
6981 if (err == TIFFReadDirEntryErrOk)
6982 {
6983 int m;
6984 m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
6985 data);
6986 if (data != 0)
6987 _TIFFfreeExt(tif, data);
6988 if (!m)
6989 return (0);
6990 }
6991 }
6992 break;
6993 case TIFF_SETGET_C32_UINT32:
6994 {
6995 uint32_t *data;
6996 assert(fip->field_readcount == TIFF_VARIABLE2);
6997 assert(fip->field_passcount == 1);
6998 err = TIFFReadDirEntryLongArray(tif, dp, &data);
6999 if (err == TIFFReadDirEntryErrOk)
7000 {
7001 int m;
7002 m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
7003 data);
7004 if (data != 0)
7005 _TIFFfreeExt(tif, data);
7006 if (!m)
7007 return (0);
7008 }
7009 }
7010 break;
7011 case TIFF_SETGET_C32_SINT32:
7012 {
7013 int32_t *data = NULL;
7014 assert(fip->field_readcount == TIFF_VARIABLE2);
7015 assert(fip->field_passcount == 1);
7016 err = TIFFReadDirEntrySlongArray(tif, dp, &data);
7017 if (err == TIFFReadDirEntryErrOk)
7018 {
7019 int m;
7020 m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
7021 data);
7022 if (data != 0)
7023 _TIFFfreeExt(tif, data);
7024 if (!m)
7025 return (0);
7026 }
7027 }
7028 break;
7029 case TIFF_SETGET_C32_UINT64:
7030 {
7031 uint64_t *data;
7032 assert(fip->field_readcount == TIFF_VARIABLE2);
7033 assert(fip->field_passcount == 1);
7034 err = TIFFReadDirEntryLong8Array(tif, dp, &data);
7035 if (err == TIFFReadDirEntryErrOk)
7036 {
7037 int m;
7038 m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
7039 data);
7040 if (data != 0)
7041 _TIFFfreeExt(tif, data);
7042 if (!m)
7043 return (0);
7044 }
7045 }
7046 break;
7047 case TIFF_SETGET_C32_SINT64:
7048 {
7049 int64_t *data = NULL;
7050 assert(fip->field_readcount == TIFF_VARIABLE2);
7051 assert(fip->field_passcount == 1);
7052 err = TIFFReadDirEntrySlong8Array(tif, dp, &data);
7053 if (err == TIFFReadDirEntryErrOk)
7054 {
7055 int m;
7056 m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
7057 data);
7058 if (data != 0)
7059 _TIFFfreeExt(tif, data);
7060 if (!m)
7061 return (0);
7062 }
7063 }
7064 break;
7065 case TIFF_SETGET_C32_FLOAT:
7066 {
7067 float *data;
7068 assert(fip->field_readcount == TIFF_VARIABLE2);
7069 assert(fip->field_passcount == 1);
7070 err = TIFFReadDirEntryFloatArray(tif, dp, &data);
7071 if (err == TIFFReadDirEntryErrOk)
7072 {
7073 int m;
7074 m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
7075 data);
7076 if (data != 0)
7077 _TIFFfreeExt(tif, data);
7078 if (!m)
7079 return (0);
7080 }
7081 }
7082 break;
7083 case TIFF_SETGET_C32_DOUBLE:
7084 {
7085 double *data;
7086 assert(fip->field_readcount == TIFF_VARIABLE2);
7087 assert(fip->field_passcount == 1);
7088 err = TIFFReadDirEntryDoubleArray(tif, dp, &data);
7089 if (err == TIFFReadDirEntryErrOk)
7090 {
7091 int m;
7092 m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
7093 data);
7094 if (data != 0)
7095 _TIFFfreeExt(tif, data);
7096 if (!m)
7097 return (0);
7098 }
7099 }
7100 break;
7101 case TIFF_SETGET_C32_IFD8:
7102 {
7103 uint64_t *data;
7104 assert(fip->field_readcount == TIFF_VARIABLE2);
7105 assert(fip->field_passcount == 1);
7106 err = TIFFReadDirEntryIfd8Array(tif, dp, &data);
7107 if (err == TIFFReadDirEntryErrOk)
7108 {
7109 int m;
7110 m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
7111 data);
7112 if (data != 0)
7113 _TIFFfreeExt(tif, data);
7114 if (!m)
7115 return (0);
7116 }
7117 }
7118 break;
7119 default:
7120 assert(0); /* we should never get here */
7121 break;
7122 }
7123 if (err != TIFFReadDirEntryErrOk)
7124 {
7125 TIFFReadDirEntryOutputErr(tif, err, module, fip->field_name, recover);
7126 return (0);
7127 }
7128 return (1);
7129 }
7130
7131 /*
7132 * Fetch a set of offsets or lengths.
7133 * While this routine says "strips", in fact it's also used for tiles.
7134 */
7135 static int TIFFFetchStripThing(TIFF *tif, TIFFDirEntry *dir, uint32_t nstrips,
7136 uint64_t **lpp)
7137 {
7138 static const char module[] = "TIFFFetchStripThing";
7139 enum TIFFReadDirEntryErr err;
7140 uint64_t *data;
7141 err = TIFFReadDirEntryLong8ArrayWithLimit(tif, dir, &data, nstrips);
7142 if (err != TIFFReadDirEntryErrOk)
7143 {
7144 const TIFFField *fip = TIFFFieldWithTag(tif, dir->tdir_tag);
7145 TIFFReadDirEntryOutputErr(tif, err, module,
7146 fip ? fip->field_name : "unknown tagname", 0);
7147 return (0);
7148 }
7149 if (dir->tdir_count < (uint64_t)nstrips)
7150 {
7151 uint64_t *resizeddata;
7152 const TIFFField *fip = TIFFFieldWithTag(tif, dir->tdir_tag);
7153 const char *pszMax = getenv("LIBTIFF_STRILE_ARRAY_MAX_RESIZE_COUNT");
7154 uint32_t max_nstrips = 1000000;
7155 if (pszMax)
7156 max_nstrips = (uint32_t)atoi(pszMax);
7157 TIFFReadDirEntryOutputErr(tif, TIFFReadDirEntryErrCount, module,
7158 fip ? fip->field_name : "unknown tagname",
7159 (nstrips <= max_nstrips));
7160
7161 if (nstrips > max_nstrips)
7162 {
7163 _TIFFfreeExt(tif, data);
7164 return (0);
7165 }
7166
7167 resizeddata = (uint64_t *)_TIFFCheckMalloc(
7168 tif, nstrips, sizeof(uint64_t), "for strip array");
7169 if (resizeddata == 0)
7170 {
7171 _TIFFfreeExt(tif, data);
7172 return (0);
7173 }
7174 if (dir->tdir_count)
7175 _TIFFmemcpy(resizeddata, data,
7176 (uint32_t)dir->tdir_count * sizeof(uint64_t));
7177 _TIFFmemset(resizeddata + (uint32_t)dir->tdir_count, 0,
7178 (nstrips - (uint32_t)dir->tdir_count) * sizeof(uint64_t));
7179 _TIFFfreeExt(tif, data);
7180 data = resizeddata;
7181 }
7182 *lpp = data;
7183 return (1);
7184 }
7185
7186 /*
7187 * Fetch and set the SubjectDistance EXIF tag.
7188 */
7189 static int TIFFFetchSubjectDistance(TIFF *tif, TIFFDirEntry *dir)
7190 {
7191 static const char module[] = "TIFFFetchSubjectDistance";
7192 enum TIFFReadDirEntryErr err;
7193 UInt64Aligned_t m;
7194 m.l = 0;
7195 assert(sizeof(double) == 8);
7196 assert(sizeof(uint64_t) == 8);
7197 assert(sizeof(uint32_t) == 4);
7198 if (dir->tdir_count != 1)
7199 err = TIFFReadDirEntryErrCount;
7200 else if (dir->tdir_type != TIFF_RATIONAL)
7201 err = TIFFReadDirEntryErrType;
7202 else
7203 {
7204 if (!(tif->tif_flags & TIFF_BIGTIFF))
7205 {
7206 uint32_t offset;
7207 offset = *(uint32_t *)(&dir->tdir_offset);
7208 if (tif->tif_flags & TIFF_SWAB)
7209 TIFFSwabLong(&offset);
7210 err = TIFFReadDirEntryData(tif, offset, 8, m.i);
7211 }
7212 else
7213 {
7214 m.l = dir->tdir_offset.toff_long8;
7215 err = TIFFReadDirEntryErrOk;
7216 }
7217 }
7218 if (err == TIFFReadDirEntryErrOk)
7219 {
7220 double n;
7221 if (tif->tif_flags & TIFF_SWAB)
7222 TIFFSwabArrayOfLong(m.i, 2);
7223 if (m.i[0] == 0)
7224 n = 0.0;
7225 else if (m.i[0] == 0xFFFFFFFF || m.i[1] == 0)
7226 /*
7227 * XXX: Numerator 0xFFFFFFFF means that we have infinite
7228 * distance. Indicate that with a negative floating point
7229 * SubjectDistance value.
7230 */
7231 n = -1.0;
7232 else
7233 n = (double)m.i[0] / (double)m.i[1];
7234 return (TIFFSetField(tif, dir->tdir_tag, n));
7235 }
7236 else
7237 {
7238 TIFFReadDirEntryOutputErr(tif, err, module, "SubjectDistance", TRUE);
7239 return (0);
7240 }
7241 }
7242
7243 static void allocChoppedUpStripArrays(TIFF *tif, uint32_t nstrips,
7244 uint64_t stripbytes,
7245 uint32_t rowsperstrip)
7246 {
7247 TIFFDirectory *td = &tif->tif_dir;
7248 uint64_t bytecount;
7249 uint64_t offset;
7250 uint64_t last_offset;
7251 uint64_t last_bytecount;
7252 uint32_t i;
7253 uint64_t *newcounts;
7254 uint64_t *newoffsets;
7255
7256 offset = TIFFGetStrileOffset(tif, 0);
7257 last_offset = TIFFGetStrileOffset(tif, td->td_nstrips - 1);
7258 last_bytecount = TIFFGetStrileByteCount(tif, td->td_nstrips - 1);
7259 if (last_offset > UINT64_MAX - last_bytecount ||
7260 last_offset + last_bytecount < offset)
7261 {
7262 return;
7263 }
7264 bytecount = last_offset + last_bytecount - offset;
7265
7266 newcounts =
7267 (uint64_t *)_TIFFCheckMalloc(tif, nstrips, sizeof(uint64_t),
7268 "for chopped \"StripByteCounts\" array");
7269 newoffsets = (uint64_t *)_TIFFCheckMalloc(
7270 tif, nstrips, sizeof(uint64_t), "for chopped \"StripOffsets\" array");
7271 if (newcounts == NULL || newoffsets == NULL)
7272 {
7273 /*
7274 * Unable to allocate new strip information, give up and use
7275 * the original one strip information.
7276 */
7277 if (newcounts != NULL)
7278 _TIFFfreeExt(tif, newcounts);
7279 if (newoffsets != NULL)
7280 _TIFFfreeExt(tif, newoffsets);
7281 return;
7282 }
7283
7284 /*
7285 * Fill the strip information arrays with new bytecounts and offsets
7286 * that reflect the broken-up format.
7287 */
7288 for (i = 0; i < nstrips; i++)
7289 {
7290 if (stripbytes > bytecount)
7291 stripbytes = bytecount;
7292 newcounts[i] = stripbytes;
7293 newoffsets[i] = stripbytes ? offset : 0;
7294 offset += stripbytes;
7295 bytecount -= stripbytes;
7296 }
7297
7298 /*
7299 * Replace old single strip info with multi-strip info.
7300 */
7301 td->td_stripsperimage = td->td_nstrips = nstrips;
7302 TIFFSetField(tif, TIFFTAG_ROWSPERSTRIP, rowsperstrip);
7303
7304 _TIFFfreeExt(tif, td->td_stripbytecount_p);
7305 _TIFFfreeExt(tif, td->td_stripoffset_p);
7306 td->td_stripbytecount_p = newcounts;
7307 td->td_stripoffset_p = newoffsets;
7308 #ifdef STRIPBYTECOUNTSORTED_UNUSED
7309 td->td_stripbytecountsorted = 1;
7310 #endif
7311 tif->tif_flags |= TIFF_CHOPPEDUPARRAYS;
7312 }
7313
7314 /*
7315 * Replace a single strip (tile) of uncompressed data by multiple strips
7316 * (tiles), each approximately STRIP_SIZE_DEFAULT bytes. This is useful for
7317 * dealing with large images or for dealing with machines with a limited
7318 * amount memory.
7319 */
7320 static void ChopUpSingleUncompressedStrip(TIFF *tif)
7321 {
7322 register TIFFDirectory *td = &tif->tif_dir;
7323 uint64_t bytecount;
7324 uint64_t offset;
7325 uint32_t rowblock;
7326 uint64_t rowblockbytes;
7327 uint64_t stripbytes;
7328 uint32_t nstrips;
7329 uint32_t rowsperstrip;
7330
7331 bytecount = TIFFGetStrileByteCount(tif, 0);
7332 /* On a newly created file, just re-opened to be filled, we */
7333 /* don't want strip chop to trigger as it is going to cause issues */
7334 /* later ( StripOffsets and StripByteCounts improperly filled) . */
7335 if (bytecount == 0 && tif->tif_mode != O_RDONLY)
7336 return;
7337 offset = TIFFGetStrileByteCount(tif, 0);
7338 assert(td->td_planarconfig == PLANARCONFIG_CONTIG);
7339 if ((td->td_photometric == PHOTOMETRIC_YCBCR) && (!isUpSampled(tif)))
7340 rowblock = td->td_ycbcrsubsampling[1];
7341 else
7342 rowblock = 1;
7343 rowblockbytes = TIFFVTileSize64(tif, rowblock);
7344 /*
7345 * Make the rows hold at least one scanline, but fill specified amount
7346 * of data if possible.
7347 */
7348 if (rowblockbytes > STRIP_SIZE_DEFAULT)
7349 {
7350 stripbytes = rowblockbytes;
7351 rowsperstrip = rowblock;
7352 }
7353 else if (rowblockbytes > 0)
7354 {
7355 uint32_t rowblocksperstrip;
7356 rowblocksperstrip = (uint32_t)(STRIP_SIZE_DEFAULT / rowblockbytes);
7357 rowsperstrip = rowblocksperstrip * rowblock;
7358 stripbytes = rowblocksperstrip * rowblockbytes;
7359 }
7360 else
7361 return;
7362
7363 /*
7364 * never increase the number of rows per strip
7365 */
7366 if (rowsperstrip >= td->td_rowsperstrip)
7367 return;
7368 nstrips = TIFFhowmany_32(td->td_imagelength, rowsperstrip);
7369 if (nstrips == 0)
7370 return;
7371
7372 /* If we are going to allocate a lot of memory, make sure that the */
7373 /* file is as big as needed */
7374 if (tif->tif_mode == O_RDONLY && nstrips > 1000000 &&
7375 (offset >= TIFFGetFileSize(tif) ||
7376 stripbytes > (TIFFGetFileSize(tif) - offset) / (nstrips - 1)))
7377 {
7378 return;
7379 }
7380
7381 allocChoppedUpStripArrays(tif, nstrips, stripbytes, rowsperstrip);
7382 }
7383
7384 /*
7385 * Replace a file with contiguous strips > 2 GB of uncompressed data by
7386 * multiple smaller strips. This is useful for
7387 * dealing with large images or for dealing with machines with a limited
7388 * amount memory.
7389 */
7390 static void TryChopUpUncompressedBigTiff(TIFF *tif)
7391 {
7392 TIFFDirectory *td = &tif->tif_dir;
7393 uint32_t rowblock;
7394 uint64_t rowblockbytes;
7395 uint32_t i;
7396 uint64_t stripsize;
7397 uint32_t rowblocksperstrip;
7398 uint32_t rowsperstrip;
7399 uint64_t stripbytes;
7400 uint32_t nstrips;
7401
7402 stripsize = TIFFStripSize64(tif);
7403
7404 assert(tif->tif_dir.td_planarconfig == PLANARCONFIG_CONTIG);
7405 assert(tif->tif_dir.td_compression == COMPRESSION_NONE);
7406 assert((tif->tif_flags & (TIFF_STRIPCHOP | TIFF_ISTILED)) ==
7407 TIFF_STRIPCHOP);
7408 assert(stripsize > 0x7FFFFFFFUL);
7409
7410 /* On a newly created file, just re-opened to be filled, we */
7411 /* don't want strip chop to trigger as it is going to cause issues */
7412 /* later ( StripOffsets and StripByteCounts improperly filled) . */
7413 if (TIFFGetStrileByteCount(tif, 0) == 0 && tif->tif_mode != O_RDONLY)
7414 return;
7415
7416 if ((td->td_photometric == PHOTOMETRIC_YCBCR) && (!isUpSampled(tif)))
7417 rowblock = td->td_ycbcrsubsampling[1];
7418 else
7419 rowblock = 1;
7420 rowblockbytes = TIFFVStripSize64(tif, rowblock);
7421 if (rowblockbytes == 0 || rowblockbytes > 0x7FFFFFFFUL)
7422 {
7423 /* In case of file with gigantic width */
7424 return;
7425 }
7426
7427 /* Check that the strips are contiguous and of the expected size */
7428 for (i = 0; i < td->td_nstrips; i++)
7429 {
7430 if (i == td->td_nstrips - 1)
7431 {
7432 if (TIFFGetStrileByteCount(tif, i) <
7433 TIFFVStripSize64(tif,
7434 td->td_imagelength - i * td->td_rowsperstrip))
7435 {
7436 return;
7437 }
7438 }
7439 else
7440 {
7441 if (TIFFGetStrileByteCount(tif, i) != stripsize)
7442 {
7443 return;
7444 }
7445 if (i > 0 && TIFFGetStrileOffset(tif, i) !=
7446 TIFFGetStrileOffset(tif, i - 1) +
7447 TIFFGetStrileByteCount(tif, i - 1))
7448 {
7449 return;
7450 }
7451 }
7452 }
7453
7454 /* Aim for 512 MB strips (that will still be manageable by 32 bit builds */
7455 rowblocksperstrip = (uint32_t)(512 * 1024 * 1024 / rowblockbytes);
7456 if (rowblocksperstrip == 0)
7457 rowblocksperstrip = 1;
7458 rowsperstrip = rowblocksperstrip * rowblock;
7459 stripbytes = rowblocksperstrip * rowblockbytes;
7460 assert(stripbytes <= 0x7FFFFFFFUL);
7461
7462 nstrips = TIFFhowmany_32(td->td_imagelength, rowsperstrip);
7463 if (nstrips == 0)
7464 return;
7465
7466 /* If we are going to allocate a lot of memory, make sure that the */
7467 /* file is as big as needed */
7468 if (tif->tif_mode == O_RDONLY && nstrips > 1000000)
7469 {
7470 uint64_t last_offset = TIFFGetStrileOffset(tif, td->td_nstrips - 1);
7471 uint64_t filesize = TIFFGetFileSize(tif);
7472 uint64_t last_bytecount =
7473 TIFFGetStrileByteCount(tif, td->td_nstrips - 1);
7474 if (last_offset > filesize || last_bytecount > filesize - last_offset)
7475 {
7476 return;
7477 }
7478 }
7479
7480 allocChoppedUpStripArrays(tif, nstrips, stripbytes, rowsperstrip);
7481 }
7482
7483 TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
7484 static uint64_t _TIFFUnsanitizedAddUInt64AndInt(uint64_t a, int b)
7485 {
7486 return a + b;
7487 }
7488
7489 /* Read the value of [Strip|Tile]Offset or [Strip|Tile]ByteCount around
7490 * strip/tile of number strile. Also fetch the neighbouring values using a
7491 * 4096 byte page size.
7492 */
7493 static int _TIFFPartialReadStripArray(TIFF *tif, TIFFDirEntry *dirent,
7494 int strile, uint64_t *panVals)
7495 {
7496 static const char module[] = "_TIFFPartialReadStripArray";
7497 #define IO_CACHE_PAGE_SIZE 4096
7498
7499 size_t sizeofval;
7500 const int bSwab = (tif->tif_flags & TIFF_SWAB) != 0;
7501 int sizeofvalint;
7502 uint64_t nBaseOffset;
7503 uint64_t nOffset;
7504 uint64_t nOffsetStartPage;
7505 uint64_t nOffsetEndPage;
7506 tmsize_t nToRead;
7507 tmsize_t nRead;
7508 uint64_t nLastStripOffset;
7509 int iStartBefore;
7510 int i;
7511 const uint32_t arraySize = tif->tif_dir.td_stripoffsetbyteallocsize;
7512 unsigned char buffer[2 * IO_CACHE_PAGE_SIZE];
7513
7514 assert(dirent->tdir_count > 4);
7515
7516 if (dirent->tdir_type == TIFF_SHORT)
7517 {
7518 sizeofval = sizeof(uint16_t);
7519 }
7520 else if (dirent->tdir_type == TIFF_LONG)
7521 {
7522 sizeofval = sizeof(uint32_t);
7523 }
7524 else if (dirent->tdir_type == TIFF_LONG8)
7525 {
7526 sizeofval = sizeof(uint64_t);
7527 }
7528 else if (dirent->tdir_type == TIFF_SLONG8)
7529 {
7530 /* Non conformant but used by some images as in */
7531 /* https://github.com/OSGeo/gdal/issues/2165 */
7532 sizeofval = sizeof(int64_t);
7533 }
7534 else
7535 {
7536 TIFFErrorExtR(tif, module,
7537 "Invalid type for [Strip|Tile][Offset/ByteCount] tag");
7538 panVals[strile] = 0;
7539 return 0;
7540 }
7541 sizeofvalint = (int)(sizeofval);
7542
7543 if (tif->tif_flags & TIFF_BIGTIFF)
7544 {
7545 uint64_t offset = dirent->tdir_offset.toff_long8;
7546 if (bSwab)
7547 TIFFSwabLong8(&offset);
7548 nBaseOffset = offset;
7549 }
7550 else
7551 {
7552 uint32_t offset = dirent->tdir_offset.toff_long;
7553 if (bSwab)
7554 TIFFSwabLong(&offset);
7555 nBaseOffset = offset;
7556 }
7557 /* To avoid later unsigned integer overflows */
7558 if (nBaseOffset > (uint64_t)INT64_MAX)
7559 {
7560 TIFFErrorExtR(tif, module, "Cannot read offset/size for strile %d",
7561 strile);
7562 panVals[strile] = 0;
7563 return 0;
7564 }
7565 nOffset = nBaseOffset + sizeofval * strile;
7566 nOffsetStartPage = (nOffset / IO_CACHE_PAGE_SIZE) * IO_CACHE_PAGE_SIZE;
7567 nOffsetEndPage = nOffsetStartPage + IO_CACHE_PAGE_SIZE;
7568
7569 if (nOffset + sizeofval > nOffsetEndPage)
7570 nOffsetEndPage += IO_CACHE_PAGE_SIZE;
7571 #undef IO_CACHE_PAGE_SIZE
7572
7573 nLastStripOffset = nBaseOffset + arraySize * sizeofval;
7574 if (nLastStripOffset < nOffsetEndPage)
7575 nOffsetEndPage = nLastStripOffset;
7576 if (nOffsetStartPage >= nOffsetEndPage)
7577 {
7578 TIFFErrorExtR(tif, module, "Cannot read offset/size for strile %d",
7579 strile);
7580 panVals[strile] = 0;
7581 return 0;
7582 }
7583 if (!SeekOK(tif, nOffsetStartPage))
7584 {
7585 panVals[strile] = 0;
7586 return 0;
7587 }
7588
7589 nToRead = (tmsize_t)(nOffsetEndPage - nOffsetStartPage);
7590 nRead = TIFFReadFile(tif, buffer, nToRead);
7591 if (nRead < nToRead)
7592 {
7593 TIFFErrorExtR(tif, module,
7594 "Cannot read offset/size for strile around ~%d", strile);
7595 return 0;
7596 }
7597 iStartBefore = -(int)((nOffset - nOffsetStartPage) / sizeofval);
7598 if (strile + iStartBefore < 0)
7599 iStartBefore = -strile;
7600 for (i = iStartBefore;
7601 (uint32_t)(strile + i) < arraySize &&
7602 _TIFFUnsanitizedAddUInt64AndInt(nOffset, (i + 1) * sizeofvalint) <=
7603 nOffsetEndPage;
7604 ++i)
7605 {
7606 if (dirent->tdir_type == TIFF_SHORT)
7607 {
7608 uint16_t val;
7609 memcpy(&val,
7610 buffer + (nOffset - nOffsetStartPage) + i * sizeofvalint,
7611 sizeof(val));
7612 if (bSwab)
7613 TIFFSwabShort(&val);
7614 panVals[strile + i] = val;
7615 }
7616 else if (dirent->tdir_type == TIFF_LONG)
7617 {
7618 uint32_t val;
7619 memcpy(&val,
7620 buffer + (nOffset - nOffsetStartPage) + i * sizeofvalint,
7621 sizeof(val));
7622 if (bSwab)
7623 TIFFSwabLong(&val);
7624 panVals[strile + i] = val;
7625 }
7626 else if (dirent->tdir_type == TIFF_LONG8)
7627 {
7628 uint64_t val;
7629 memcpy(&val,
7630 buffer + (nOffset - nOffsetStartPage) + i * sizeofvalint,
7631 sizeof(val));
7632 if (bSwab)
7633 TIFFSwabLong8(&val);
7634 panVals[strile + i] = val;
7635 }
7636 else /* if( dirent->tdir_type == TIFF_SLONG8 ) */
7637 {
7638 /* Non conformant data type */
7639 int64_t val;
7640 memcpy(&val,
7641 buffer + (nOffset - nOffsetStartPage) + i * sizeofvalint,
7642 sizeof(val));
7643 if (bSwab)
7644 TIFFSwabLong8((uint64_t *)&val);
7645 panVals[strile + i] = (uint64_t)val;
7646 }
7647 }
7648 return 1;
7649 }
7650
7651 static int _TIFFFetchStrileValue(TIFF *tif, uint32_t strile,
7652 TIFFDirEntry *dirent, uint64_t **parray)
7653 {
7654 static const char module[] = "_TIFFFetchStrileValue";
7655 TIFFDirectory *td = &tif->tif_dir;
7656 if (strile >= dirent->tdir_count)
7657 {
7658 return 0;
7659 }
7660 if (strile >= td->td_stripoffsetbyteallocsize)
7661 {
7662 uint32_t nStripArrayAllocBefore = td->td_stripoffsetbyteallocsize;
7663 uint32_t nStripArrayAllocNew;
7664 uint64_t nArraySize64;
7665 size_t nArraySize;
7666 uint64_t *offsetArray;
7667 uint64_t *bytecountArray;
7668
7669 if (strile > 1000000)
7670 {
7671 uint64_t filesize = TIFFGetFileSize(tif);
7672 /* Avoid excessive memory allocation attempt */
7673 /* For such a big blockid we need at least a TIFF_LONG per strile */
7674 /* for the offset array. */
7675 if (strile > filesize / sizeof(uint32_t))
7676 {
7677 TIFFErrorExtR(tif, module, "File too short");
7678 return 0;
7679 }
7680 }
7681
7682 if (td->td_stripoffsetbyteallocsize == 0 &&
7683 td->td_nstrips < 1024 * 1024)
7684 {
7685 nStripArrayAllocNew = td->td_nstrips;
7686 }
7687 else
7688 {
7689 #define TIFF_MAX(a, b) (((a) > (b)) ? (a) : (b))
7690 #define TIFF_MIN(a, b) (((a) < (b)) ? (a) : (b))
7691 nStripArrayAllocNew = TIFF_MAX(strile + 1, 1024U * 512U);
7692 if (nStripArrayAllocNew < 0xFFFFFFFFU / 2)
7693 nStripArrayAllocNew *= 2;
7694 nStripArrayAllocNew = TIFF_MIN(nStripArrayAllocNew, td->td_nstrips);
7695 }
7696 assert(strile < nStripArrayAllocNew);
7697 nArraySize64 = (uint64_t)sizeof(uint64_t) * nStripArrayAllocNew;
7698 nArraySize = (size_t)(nArraySize64);
7699 #if SIZEOF_SIZE_T == 4
7700 if (nArraySize != nArraySize64)
7701 {
7702 TIFFErrorExtR(tif, module,
7703 "Cannot allocate strip offset and bytecount arrays");
7704 return 0;
7705 }
7706 #endif
7707 offsetArray = (uint64_t *)(_TIFFreallocExt(tif, td->td_stripoffset_p,
7708 nArraySize));
7709 bytecountArray = (uint64_t *)(_TIFFreallocExt(
7710 tif, td->td_stripbytecount_p, nArraySize));
7711 if (offsetArray)
7712 td->td_stripoffset_p = offsetArray;
7713 if (bytecountArray)
7714 td->td_stripbytecount_p = bytecountArray;
7715 if (offsetArray && bytecountArray)
7716 {
7717 td->td_stripoffsetbyteallocsize = nStripArrayAllocNew;
7718 /* Initialize new entries to ~0 / -1 */
7719 /* coverity[overrun-buffer-arg] */
7720 memset(td->td_stripoffset_p + nStripArrayAllocBefore, 0xFF,
7721 (td->td_stripoffsetbyteallocsize - nStripArrayAllocBefore) *
7722 sizeof(uint64_t));
7723 /* coverity[overrun-buffer-arg] */
7724 memset(td->td_stripbytecount_p + nStripArrayAllocBefore, 0xFF,
7725 (td->td_stripoffsetbyteallocsize - nStripArrayAllocBefore) *
7726 sizeof(uint64_t));
7727 }
7728 else
7729 {
7730 TIFFErrorExtR(tif, module,
7731 "Cannot allocate strip offset and bytecount arrays");
7732 _TIFFfreeExt(tif, td->td_stripoffset_p);
7733 td->td_stripoffset_p = NULL;
7734 _TIFFfreeExt(tif, td->td_stripbytecount_p);
7735 td->td_stripbytecount_p = NULL;
7736 td->td_stripoffsetbyteallocsize = 0;
7737 }
7738 }
7739 if (*parray == NULL || strile >= td->td_stripoffsetbyteallocsize)
7740 return 0;
7741
7742 if (~((*parray)[strile]) == 0)
7743 {
7744 if (!_TIFFPartialReadStripArray(tif, dirent, strile, *parray))
7745 {
7746 (*parray)[strile] = 0;
7747 return 0;
7748 }
7749 }
7750
7751 return 1;
7752 }
7753
7754 static uint64_t _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32_t strile,
7755 TIFFDirEntry *dirent,
7756 uint64_t **parray,
7757 int *pbErr)
7758 {
7759 TIFFDirectory *td = &tif->tif_dir;
7760 if (pbErr)
7761 *pbErr = 0;
7762 if ((tif->tif_flags & TIFF_DEFERSTRILELOAD) &&
7763 !(tif->tif_flags & TIFF_CHOPPEDUPARRAYS))
7764 {
7765 if (!(tif->tif_flags & TIFF_LAZYSTRILELOAD) ||
7766 /* If the values may fit in the toff_long/toff_long8 member */
7767 /* then use _TIFFFillStriles to simplify _TIFFFetchStrileValue */
7768 dirent->tdir_count <= 4)
7769 {
7770 if (!_TIFFFillStriles(tif))
7771 {
7772 if (pbErr)
7773 *pbErr = 1;
7774 /* Do not return, as we want this function to always */
7775 /* return the same value if called several times with */
7776 /* the same arguments */
7777 }
7778 }
7779 else
7780 {
7781 if (!_TIFFFetchStrileValue(tif, strile, dirent, parray))
7782 {
7783 if (pbErr)
7784 *pbErr = 1;
7785 return 0;
7786 }
7787 }
7788 }
7789 if (*parray == NULL || strile >= td->td_nstrips)
7790 {
7791 if (pbErr)
7792 *pbErr = 1;
7793 return 0;
7794 }
7795 return (*parray)[strile];
7796 }
7797
7798 /* Return the value of the TileOffsets/StripOffsets array for the specified
7799 * tile/strile */
7800 uint64_t TIFFGetStrileOffset(TIFF *tif, uint32_t strile)
7801 {
7802 return TIFFGetStrileOffsetWithErr(tif, strile, NULL);
7803 }
7804
7805 /* Return the value of the TileOffsets/StripOffsets array for the specified
7806 * tile/strile */
7807 uint64_t TIFFGetStrileOffsetWithErr(TIFF *tif, uint32_t strile, int *pbErr)
7808 {
7809 TIFFDirectory *td = &tif->tif_dir;
7810 return _TIFFGetStrileOffsetOrByteCountValue(tif, strile,
7811 &(td->td_stripoffset_entry),
7812 &(td->td_stripoffset_p), pbErr);
7813 }
7814
7815 /* Return the value of the TileByteCounts/StripByteCounts array for the
7816 * specified tile/strile */
7817 uint64_t TIFFGetStrileByteCount(TIFF *tif, uint32_t strile)
7818 {
7819 return TIFFGetStrileByteCountWithErr(tif, strile, NULL);
7820 }
7821
7822 /* Return the value of the TileByteCounts/StripByteCounts array for the
7823 * specified tile/strile */
7824 uint64_t TIFFGetStrileByteCountWithErr(TIFF *tif, uint32_t strile, int *pbErr)
7825 {
7826 TIFFDirectory *td = &tif->tif_dir;
7827 return _TIFFGetStrileOffsetOrByteCountValue(
7828 tif, strile, &(td->td_stripbytecount_entry), &(td->td_stripbytecount_p),
7829 pbErr);
7830 }
7831
7832 int _TIFFFillStriles(TIFF *tif) { return _TIFFFillStrilesInternal(tif, 1); }
7833
7834 static int _TIFFFillStrilesInternal(TIFF *tif, int loadStripByteCount)
7835 {
7836 register TIFFDirectory *td = &tif->tif_dir;
7837 int return_value = 1;
7838
7839 /* Do not do anything if TIFF_DEFERSTRILELOAD is not set */
7840 if (!(tif->tif_flags & TIFF_DEFERSTRILELOAD) ||
7841 (tif->tif_flags & TIFF_CHOPPEDUPARRAYS) != 0)
7842 return 1;
7843
7844 if (tif->tif_flags & TIFF_LAZYSTRILELOAD)
7845 {
7846 /* In case of lazy loading, reload completely the arrays */
7847 _TIFFfreeExt(tif, td->td_stripoffset_p);
7848 _TIFFfreeExt(tif, td->td_stripbytecount_p);
7849 td->td_stripoffset_p = NULL;
7850 td->td_stripbytecount_p = NULL;
7851 td->td_stripoffsetbyteallocsize = 0;
7852 tif->tif_flags &= ~TIFF_LAZYSTRILELOAD;
7853 }
7854
7855 /* If stripoffset array is already loaded, exit with success */
7856 if (td->td_stripoffset_p != NULL)
7857 return 1;
7858
7859 /* If tdir_count was canceled, then we already got there, but in error */
7860 if (td->td_stripoffset_entry.tdir_count == 0)
7861 return 0;
7862
7863 if (!TIFFFetchStripThing(tif, &(td->td_stripoffset_entry), td->td_nstrips,
7864 &td->td_stripoffset_p))
7865 {
7866 return_value = 0;
7867 }
7868
7869 if (loadStripByteCount &&
7870 !TIFFFetchStripThing(tif, &(td->td_stripbytecount_entry),
7871 td->td_nstrips, &td->td_stripbytecount_p))
7872 {
7873 return_value = 0;
7874 }
7875
7876 _TIFFmemset(&(td->td_stripoffset_entry), 0, sizeof(TIFFDirEntry));
7877 _TIFFmemset(&(td->td_stripbytecount_entry), 0, sizeof(TIFFDirEntry));
7878
7879 #ifdef STRIPBYTECOUNTSORTED_UNUSED
7880 if (tif->tif_dir.td_nstrips > 1 && return_value == 1)
7881 {
7882 uint32_t strip;
7883
7884 tif->tif_dir.td_stripbytecountsorted = 1;
7885 for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++)
7886 {
7887 if (tif->tif_dir.td_stripoffset_p[strip - 1] >
7888 tif->tif_dir.td_stripoffset_p[strip])
7889 {
7890 tif->tif_dir.td_stripbytecountsorted = 0;
7891 break;
7892 }
7893 }
7894 }
7895 #endif
7896
7897 return return_value;
7898 }
Windows API implementation