ReactOS  0.4.15-dev-3326-ga91f5e8
tif_dirread.c
Go to the documentation of this file.
1 /*
2  * Copyright (c) 1988-1997 Sam Leffler
3  * Copyright (c) 1991-1997 Silicon Graphics, Inc.
4  *
5  * Permission to use, copy, modify, distribute, and sell this software and
6  * its documentation for any purpose is hereby granted without fee, provided
7  * that (i) the above copyright notices and this permission notice appear in
8  * all copies of the software and related documentation, and (ii) the names of
9  * Sam Leffler and Silicon Graphics may not be used in any advertising or
10  * publicity relating to the software without the specific, prior written
11  * permission of Sam Leffler and Silicon Graphics.
12  *
13  * THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND,
14  * EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY
15  * WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
16  *
17  * IN NO EVENT SHALL SAM LEFFLER OR SILICON GRAPHICS BE LIABLE FOR
18  * ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND,
19  * OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
20  * WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF
21  * LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
22  * OF THIS SOFTWARE.
23  */
24 
25 /*
26  * TIFF Library.
27  *
28  * Directory Read Support Routines.
29  */
30 
31 /* Suggested pending improvements:
32  * - add a field 'field_info' to the TIFFDirEntry structure, and set that with
33  * the pointer to the appropriate TIFFField structure early on in
34  * TIFFReadDirectory, so as to eliminate current possibly repetitive lookup.
35  */
36 
37 #include <precomp.h>
38 #include <float.h>
39 #include <stdlib.h>
40 
41 #define FAILED_FII ((uint32) -1)
42 
43 /*
44  * Largest 64-bit signed integer value.
45  */
46 #define TIFF_INT64_MAX ((int64)(TIFF_UINT64_MAX >> 1))
47 
48 #ifdef HAVE_IEEEFP
49 # define TIFFCvtIEEEFloatToNative(tif, n, fp)
50 # define TIFFCvtIEEEDoubleToNative(tif, n, dp)
51 #else
52 extern void TIFFCvtIEEEFloatToNative(TIFF*, uint32, float*);
53 extern void TIFFCvtIEEEDoubleToNative(TIFF*, uint32, double*);
54 #endif
55 
56 enum TIFFReadDirEntryErr {
57  TIFFReadDirEntryErrOk = 0,
58  TIFFReadDirEntryErrCount = 1,
59  TIFFReadDirEntryErrType = 2,
60  TIFFReadDirEntryErrIo = 3,
61  TIFFReadDirEntryErrRange = 4,
62  TIFFReadDirEntryErrPsdif = 5,
63  TIFFReadDirEntryErrSizesan = 6,
64  TIFFReadDirEntryErrAlloc = 7,
65 };
66 
67 static enum TIFFReadDirEntryErr TIFFReadDirEntryByte(TIFF* tif, TIFFDirEntry* direntry, uint8* value);
68 static enum TIFFReadDirEntryErr TIFFReadDirEntryShort(TIFF* tif, TIFFDirEntry* direntry, uint16* value);
69 static enum TIFFReadDirEntryErr TIFFReadDirEntryLong(TIFF* tif, TIFFDirEntry* direntry, uint32* value);
70 static enum TIFFReadDirEntryErr TIFFReadDirEntryLong8(TIFF* tif, TIFFDirEntry* direntry, uint64* value);
71 static enum TIFFReadDirEntryErr TIFFReadDirEntryFloat(TIFF* tif, TIFFDirEntry* direntry, float* value);
72 static enum TIFFReadDirEntryErr TIFFReadDirEntryDouble(TIFF* tif, TIFFDirEntry* direntry, double* value);
73 static enum TIFFReadDirEntryErr TIFFReadDirEntryIfd8(TIFF* tif, TIFFDirEntry* direntry, uint64* value);
74 
75 static enum TIFFReadDirEntryErr TIFFReadDirEntryArray(TIFF* tif, TIFFDirEntry* direntry, uint32* count, uint32 desttypesize, void** value);
76 static enum TIFFReadDirEntryErr TIFFReadDirEntryByteArray(TIFF* tif, TIFFDirEntry* direntry, uint8** value);
77 static enum TIFFReadDirEntryErr TIFFReadDirEntrySbyteArray(TIFF* tif, TIFFDirEntry* direntry, int8** value);
78 static enum TIFFReadDirEntryErr TIFFReadDirEntryShortArray(TIFF* tif, TIFFDirEntry* direntry, uint16** value);
79 static enum TIFFReadDirEntryErr TIFFReadDirEntrySshortArray(TIFF* tif, TIFFDirEntry* direntry, int16** value);
80 static enum TIFFReadDirEntryErr TIFFReadDirEntryLongArray(TIFF* tif, TIFFDirEntry* direntry, uint32** value);
81 static enum TIFFReadDirEntryErr TIFFReadDirEntrySlongArray(TIFF* tif, TIFFDirEntry* direntry, int32** value);
82 static enum TIFFReadDirEntryErr TIFFReadDirEntryLong8Array(TIFF* tif, TIFFDirEntry* direntry, uint64** value);
83 static enum TIFFReadDirEntryErr TIFFReadDirEntrySlong8Array(TIFF* tif, TIFFDirEntry* direntry, int64** value);
84 static enum TIFFReadDirEntryErr TIFFReadDirEntryFloatArray(TIFF* tif, TIFFDirEntry* direntry, float** value);
85 static enum TIFFReadDirEntryErr TIFFReadDirEntryDoubleArray(TIFF* tif, TIFFDirEntry* direntry, double** value);
86 static enum TIFFReadDirEntryErr TIFFReadDirEntryIfd8Array(TIFF* tif, TIFFDirEntry* direntry, uint64** value);
87 
88 static enum TIFFReadDirEntryErr TIFFReadDirEntryPersampleShort(TIFF* tif, TIFFDirEntry* direntry, uint16* value);
89 #if 0
90 static enum TIFFReadDirEntryErr TIFFReadDirEntryPersampleDouble(TIFF* tif, TIFFDirEntry* direntry, double* value);
91 #endif
92 
93 static void TIFFReadDirEntryCheckedByte(TIFF* tif, TIFFDirEntry* direntry, uint8* value);
94 static void TIFFReadDirEntryCheckedSbyte(TIFF* tif, TIFFDirEntry* direntry, int8* value);
95 static void TIFFReadDirEntryCheckedShort(TIFF* tif, TIFFDirEntry* direntry, uint16* value);
96 static void TIFFReadDirEntryCheckedSshort(TIFF* tif, TIFFDirEntry* direntry, int16* value);
97 static void TIFFReadDirEntryCheckedLong(TIFF* tif, TIFFDirEntry* direntry, uint32* value);
98 static void TIFFReadDirEntryCheckedSlong(TIFF* tif, TIFFDirEntry* direntry, int32* value);
99 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedLong8(TIFF* tif, TIFFDirEntry* direntry, uint64* value);
100 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedSlong8(TIFF* tif, TIFFDirEntry* direntry, int64* value);
101 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedRational(TIFF* tif, TIFFDirEntry* direntry, double* value);
102 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedSrational(TIFF* tif, TIFFDirEntry* direntry, double* value);
103 static void TIFFReadDirEntryCheckedFloat(TIFF* tif, TIFFDirEntry* direntry, float* value);
104 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedDouble(TIFF* tif, TIFFDirEntry* direntry, double* value);
105 
106 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSbyte(int8 value);
107 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteShort(uint16 value);
108 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSshort(int16 value);
109 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteLong(uint32 value);
110 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSlong(int32 value);
111 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteLong8(uint64 value);
112 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSlong8(int64 value);
113 
114 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteByte(uint8 value);
115 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteShort(uint16 value);
116 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteSshort(int16 value);
117 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteLong(uint32 value);
118 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteSlong(int32 value);
119 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteLong8(uint64 value);
120 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteSlong8(int64 value);
121 
122 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSbyte(int8 value);
123 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSshort(int16 value);
124 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortLong(uint32 value);
125 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSlong(int32 value);
126 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortLong8(uint64 value);
127 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSlong8(int64 value);
128 
129 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortShort(uint16 value);
130 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortLong(uint32 value);
131 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortSlong(int32 value);
132 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortLong8(uint64 value);
133 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortSlong8(int64 value);
134 
135 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongSbyte(int8 value);
136 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongSshort(int16 value);
137 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongSlong(int32 value);
138 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongLong8(uint64 value);
139 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongSlong8(int64 value);
140 
141 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSlongLong(uint32 value);
142 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSlongLong8(uint64 value);
143 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSlongSlong8(int64 value);
144 
145 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLong8Sbyte(int8 value);
146 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLong8Sshort(int16 value);
147 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLong8Slong(int32 value);
148 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLong8Slong8(int64 value);
149 
150 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSlong8Long8(uint64 value);
151 
152 static enum TIFFReadDirEntryErr TIFFReadDirEntryData(TIFF* tif, uint64 offset, tmsize_t size, void* dest);
153 static void TIFFReadDirEntryOutputErr(TIFF* tif, enum TIFFReadDirEntryErr err, const char* module, const char* tagname, int recover);
154 
155 static void TIFFReadDirectoryCheckOrder(TIFF* tif, TIFFDirEntry* dir, uint16 dircount);
156 static TIFFDirEntry* TIFFReadDirectoryFindEntry(TIFF* tif, TIFFDirEntry* dir, uint16 dircount, uint16 tagid);
157 static void TIFFReadDirectoryFindFieldInfo(TIFF* tif, uint16 tagid, uint32* fii);
158 
159 static int EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount);
160 static void MissingRequired(TIFF*, const char*);
161 static int TIFFCheckDirOffset(TIFF* tif, uint64 diroff);
162 static int CheckDirCount(TIFF*, TIFFDirEntry*, uint32);
163 static uint16 TIFFFetchDirectory(TIFF* tif, uint64 diroff, TIFFDirEntry** pdir, uint64* nextdiroff);
164 static int TIFFFetchNormalTag(TIFF*, TIFFDirEntry*, int recover);
165 static int TIFFFetchStripThing(TIFF* tif, TIFFDirEntry* dir, uint32 nstrips, uint64** lpp);
166 static int TIFFFetchSubjectDistance(TIFF*, TIFFDirEntry*);
167 static void ChopUpSingleUncompressedStrip(TIFF*);
168 static void TryChopUpUncompressedBigTiff(TIFF*);
169 static uint64 TIFFReadUInt64(const uint8 *value);
170 static int _TIFFGetMaxColorChannels(uint16 photometric);
171 
172 static int _TIFFFillStrilesInternal( TIFF *tif, int loadStripByteCount );
173 
174 typedef union _UInt64Aligned_t
175 {
176  double d;
177  uint64 l;
178  uint32 i[2];
179  uint16 s[4];
180  uint8 c[8];
181 } UInt64Aligned_t;
182 
183 /*
184  Unaligned safe copy of a uint64 value from an octet array.
185 */
186 static uint64 TIFFReadUInt64(const uint8 *value)
187 {
188  UInt64Aligned_t result;
189 
190  result.c[0]=value[0];
191  result.c[1]=value[1];
192  result.c[2]=value[2];
193  result.c[3]=value[3];
194  result.c[4]=value[4];
195  result.c[5]=value[5];
196  result.c[6]=value[6];
197  result.c[7]=value[7];
198 
199  return result.l;
200 }
201 
202 static enum TIFFReadDirEntryErr TIFFReadDirEntryByte(TIFF* tif, TIFFDirEntry* direntry, uint8* value)
203 {
204  enum TIFFReadDirEntryErr err;
205  if (direntry->tdir_count!=1)
206  return(TIFFReadDirEntryErrCount);
207  switch (direntry->tdir_type)
208  {
209  case TIFF_BYTE:
210  case TIFF_UNDEFINED: /* Support to read TIFF_UNDEFINED with field_readcount==1 */
211  TIFFReadDirEntryCheckedByte(tif,direntry,value);
212  return(TIFFReadDirEntryErrOk);
213  case TIFF_SBYTE:
214  {
215  int8 m;
216  TIFFReadDirEntryCheckedSbyte(tif,direntry,&m);
217  err=TIFFReadDirEntryCheckRangeByteSbyte(m);
218  if (err!=TIFFReadDirEntryErrOk)
219  return(err);
220  *value=(uint8)m;
221  return(TIFFReadDirEntryErrOk);
222  }
223  case TIFF_SHORT:
224  {
225  uint16 m;
226  TIFFReadDirEntryCheckedShort(tif,direntry,&m);
227  err=TIFFReadDirEntryCheckRangeByteShort(m);
228  if (err!=TIFFReadDirEntryErrOk)
229  return(err);
230  *value=(uint8)m;
231  return(TIFFReadDirEntryErrOk);
232  }
233  case TIFF_SSHORT:
234  {
235  int16 m;
236  TIFFReadDirEntryCheckedSshort(tif,direntry,&m);
237  err=TIFFReadDirEntryCheckRangeByteSshort(m);
238  if (err!=TIFFReadDirEntryErrOk)
239  return(err);
240  *value=(uint8)m;
241  return(TIFFReadDirEntryErrOk);
242  }
243  case TIFF_LONG:
244  {
245  uint32 m;
246  TIFFReadDirEntryCheckedLong(tif,direntry,&m);
247  err=TIFFReadDirEntryCheckRangeByteLong(m);
248  if (err!=TIFFReadDirEntryErrOk)
249  return(err);
250  *value=(uint8)m;
251  return(TIFFReadDirEntryErrOk);
252  }
253  case TIFF_SLONG:
254  {
255  int32 m;
256  TIFFReadDirEntryCheckedSlong(tif,direntry,&m);
257  err=TIFFReadDirEntryCheckRangeByteSlong(m);
258  if (err!=TIFFReadDirEntryErrOk)
259  return(err);
260  *value=(uint8)m;
261  return(TIFFReadDirEntryErrOk);
262  }
263  case TIFF_LONG8:
264  {
265  uint64 m;
266  err=TIFFReadDirEntryCheckedLong8(tif,direntry,&m);
267  if (err!=TIFFReadDirEntryErrOk)
268  return(err);
269  err=TIFFReadDirEntryCheckRangeByteLong8(m);
270  if (err!=TIFFReadDirEntryErrOk)
271  return(err);
272  *value=(uint8)m;
273  return(TIFFReadDirEntryErrOk);
274  }
275  case TIFF_SLONG8:
276  {
277  int64 m;
278  err=TIFFReadDirEntryCheckedSlong8(tif,direntry,&m);
279  if (err!=TIFFReadDirEntryErrOk)
280  return(err);
281  err=TIFFReadDirEntryCheckRangeByteSlong8(m);
282  if (err!=TIFFReadDirEntryErrOk)
283  return(err);
284  *value=(uint8)m;
285  return(TIFFReadDirEntryErrOk);
286  }
287  default:
288  return(TIFFReadDirEntryErrType);
289  }
290 }
291 
292 static enum TIFFReadDirEntryErr TIFFReadDirEntryShort(TIFF* tif, TIFFDirEntry* direntry, uint16* value)
293 {
294  enum TIFFReadDirEntryErr err;
295  if (direntry->tdir_count!=1)
296  return(TIFFReadDirEntryErrCount);
297  switch (direntry->tdir_type)
298  {
299  case TIFF_BYTE:
300  {
301  uint8 m;
302  TIFFReadDirEntryCheckedByte(tif,direntry,&m);
303  *value=(uint16)m;
304  return(TIFFReadDirEntryErrOk);
305  }
306  case TIFF_SBYTE:
307  {
308  int8 m;
309  TIFFReadDirEntryCheckedSbyte(tif,direntry,&m);
310  err=TIFFReadDirEntryCheckRangeShortSbyte(m);
311  if (err!=TIFFReadDirEntryErrOk)
312  return(err);
313  *value=(uint16)m;
314  return(TIFFReadDirEntryErrOk);
315  }
316  case TIFF_SHORT:
317  TIFFReadDirEntryCheckedShort(tif,direntry,value);
318  return(TIFFReadDirEntryErrOk);
319  case TIFF_SSHORT:
320  {
321  int16 m;
322  TIFFReadDirEntryCheckedSshort(tif,direntry,&m);
323  err=TIFFReadDirEntryCheckRangeShortSshort(m);
324  if (err!=TIFFReadDirEntryErrOk)
325  return(err);
326  *value=(uint16)m;
327  return(TIFFReadDirEntryErrOk);
328  }
329  case TIFF_LONG:
330  {
331  uint32 m;
332  TIFFReadDirEntryCheckedLong(tif,direntry,&m);
333  err=TIFFReadDirEntryCheckRangeShortLong(m);
334  if (err!=TIFFReadDirEntryErrOk)
335  return(err);
336  *value=(uint16)m;
337  return(TIFFReadDirEntryErrOk);
338  }
339  case TIFF_SLONG:
340  {
341  int32 m;
342  TIFFReadDirEntryCheckedSlong(tif,direntry,&m);
343  err=TIFFReadDirEntryCheckRangeShortSlong(m);
344  if (err!=TIFFReadDirEntryErrOk)
345  return(err);
346  *value=(uint16)m;
347  return(TIFFReadDirEntryErrOk);
348  }
349  case TIFF_LONG8:
350  {
351  uint64 m;
352  err=TIFFReadDirEntryCheckedLong8(tif,direntry,&m);
353  if (err!=TIFFReadDirEntryErrOk)
354  return(err);
355  err=TIFFReadDirEntryCheckRangeShortLong8(m);
356  if (err!=TIFFReadDirEntryErrOk)
357  return(err);
358  *value=(uint16)m;
359  return(TIFFReadDirEntryErrOk);
360  }
361  case TIFF_SLONG8:
362  {
363  int64 m;
364  err=TIFFReadDirEntryCheckedSlong8(tif,direntry,&m);
365  if (err!=TIFFReadDirEntryErrOk)
366  return(err);
367  err=TIFFReadDirEntryCheckRangeShortSlong8(m);
368  if (err!=TIFFReadDirEntryErrOk)
369  return(err);
370  *value=(uint16)m;
371  return(TIFFReadDirEntryErrOk);
372  }
373  default:
374  return(TIFFReadDirEntryErrType);
375  }
376 }
377 
378 static enum TIFFReadDirEntryErr TIFFReadDirEntryLong(TIFF* tif, TIFFDirEntry* direntry, uint32* value)
379 {
380  enum TIFFReadDirEntryErr err;
381  if (direntry->tdir_count!=1)
382  return(TIFFReadDirEntryErrCount);
383  switch (direntry->tdir_type)
384  {
385  case TIFF_BYTE:
386  {
387  uint8 m;
388  TIFFReadDirEntryCheckedByte(tif,direntry,&m);
389  *value=(uint32)m;
390  return(TIFFReadDirEntryErrOk);
391  }
392  case TIFF_SBYTE:
393  {
394  int8 m;
395  TIFFReadDirEntryCheckedSbyte(tif,direntry,&m);
396  err=TIFFReadDirEntryCheckRangeLongSbyte(m);
397  if (err!=TIFFReadDirEntryErrOk)
398  return(err);
399  *value=(uint32)m;
400  return(TIFFReadDirEntryErrOk);
401  }
402  case TIFF_SHORT:
403  {
404  uint16 m;
405  TIFFReadDirEntryCheckedShort(tif,direntry,&m);
406  *value=(uint32)m;
407  return(TIFFReadDirEntryErrOk);
408  }
409  case TIFF_SSHORT:
410  {
411  int16 m;
412  TIFFReadDirEntryCheckedSshort(tif,direntry,&m);
413  err=TIFFReadDirEntryCheckRangeLongSshort(m);
414  if (err!=TIFFReadDirEntryErrOk)
415  return(err);
416  *value=(uint32)m;
417  return(TIFFReadDirEntryErrOk);
418  }
419  case TIFF_LONG:
420  TIFFReadDirEntryCheckedLong(tif,direntry,value);
421  return(TIFFReadDirEntryErrOk);
422  case TIFF_SLONG:
423  {
424  int32 m;
425  TIFFReadDirEntryCheckedSlong(tif,direntry,&m);
426  err=TIFFReadDirEntryCheckRangeLongSlong(m);
427  if (err!=TIFFReadDirEntryErrOk)
428  return(err);
429  *value=(uint32)m;
430  return(TIFFReadDirEntryErrOk);
431  }
432  case TIFF_LONG8:
433  {
434  uint64 m;
435  err=TIFFReadDirEntryCheckedLong8(tif,direntry,&m);
436  if (err!=TIFFReadDirEntryErrOk)
437  return(err);
438  err=TIFFReadDirEntryCheckRangeLongLong8(m);
439  if (err!=TIFFReadDirEntryErrOk)
440  return(err);
441  *value=(uint32)m;
442  return(TIFFReadDirEntryErrOk);
443  }
444  case TIFF_SLONG8:
445  {
446  int64 m;
447  err=TIFFReadDirEntryCheckedSlong8(tif,direntry,&m);
448  if (err!=TIFFReadDirEntryErrOk)
449  return(err);
450  err=TIFFReadDirEntryCheckRangeLongSlong8(m);
451  if (err!=TIFFReadDirEntryErrOk)
452  return(err);
453  *value=(uint32)m;
454  return(TIFFReadDirEntryErrOk);
455  }
456  default:
457  return(TIFFReadDirEntryErrType);
458  }
459 }
460 
461 static enum TIFFReadDirEntryErr TIFFReadDirEntryLong8(TIFF* tif, TIFFDirEntry* direntry, uint64* value)
462 {
463  enum TIFFReadDirEntryErr err;
464  if (direntry->tdir_count!=1)
465  return(TIFFReadDirEntryErrCount);
466  switch (direntry->tdir_type)
467  {
468  case TIFF_BYTE:
469  {
470  uint8 m;
471  TIFFReadDirEntryCheckedByte(tif,direntry,&m);
472  *value=(uint64)m;
473  return(TIFFReadDirEntryErrOk);
474  }
475  case TIFF_SBYTE:
476  {
477  int8 m;
478  TIFFReadDirEntryCheckedSbyte(tif,direntry,&m);
479  err=TIFFReadDirEntryCheckRangeLong8Sbyte(m);
480  if (err!=TIFFReadDirEntryErrOk)
481  return(err);
482  *value=(uint64)m;
483  return(TIFFReadDirEntryErrOk);
484  }
485  case TIFF_SHORT:
486  {
487  uint16 m;
488  TIFFReadDirEntryCheckedShort(tif,direntry,&m);
489  *value=(uint64)m;
490  return(TIFFReadDirEntryErrOk);
491  }
492  case TIFF_SSHORT:
493  {
494  int16 m;
495  TIFFReadDirEntryCheckedSshort(tif,direntry,&m);
496  err=TIFFReadDirEntryCheckRangeLong8Sshort(m);
497  if (err!=TIFFReadDirEntryErrOk)
498  return(err);
499  *value=(uint64)m;
500  return(TIFFReadDirEntryErrOk);
501  }
502  case TIFF_LONG:
503  {
504  uint32 m;
505  TIFFReadDirEntryCheckedLong(tif,direntry,&m);
506  *value=(uint64)m;
507  return(TIFFReadDirEntryErrOk);
508  }
509  case TIFF_SLONG:
510  {
511  int32 m;
512  TIFFReadDirEntryCheckedSlong(tif,direntry,&m);
513  err=TIFFReadDirEntryCheckRangeLong8Slong(m);
514  if (err!=TIFFReadDirEntryErrOk)
515  return(err);
516  *value=(uint64)m;
517  return(TIFFReadDirEntryErrOk);
518  }
519  case TIFF_LONG8:
520  err=TIFFReadDirEntryCheckedLong8(tif,direntry,value);
521  return(err);
522  case TIFF_SLONG8:
523  {
524  int64 m;
525  err=TIFFReadDirEntryCheckedSlong8(tif,direntry,&m);
526  if (err!=TIFFReadDirEntryErrOk)
527  return(err);
528  err=TIFFReadDirEntryCheckRangeLong8Slong8(m);
529  if (err!=TIFFReadDirEntryErrOk)
530  return(err);
531  *value=(uint64)m;
532  return(TIFFReadDirEntryErrOk);
533  }
534  default:
535  return(TIFFReadDirEntryErrType);
536  }
537 }
538 
539 static enum TIFFReadDirEntryErr TIFFReadDirEntryFloat(TIFF* tif, TIFFDirEntry* direntry, float* value)
540 {
541  enum TIFFReadDirEntryErr err;
542  if (direntry->tdir_count!=1)
543  return(TIFFReadDirEntryErrCount);
544  switch (direntry->tdir_type)
545  {
546  case TIFF_BYTE:
547  {
548  uint8 m;
549  TIFFReadDirEntryCheckedByte(tif,direntry,&m);
550  *value=(float)m;
551  return(TIFFReadDirEntryErrOk);
552  }
553  case TIFF_SBYTE:
554  {
555  int8 m;
556  TIFFReadDirEntryCheckedSbyte(tif,direntry,&m);
557  *value=(float)m;
558  return(TIFFReadDirEntryErrOk);
559  }
560  case TIFF_SHORT:
561  {
562  uint16 m;
563  TIFFReadDirEntryCheckedShort(tif,direntry,&m);
564  *value=(float)m;
565  return(TIFFReadDirEntryErrOk);
566  }
567  case TIFF_SSHORT:
568  {
569  int16 m;
570  TIFFReadDirEntryCheckedSshort(tif,direntry,&m);
571  *value=(float)m;
572  return(TIFFReadDirEntryErrOk);
573  }
574  case TIFF_LONG:
575  {
576  uint32 m;
577  TIFFReadDirEntryCheckedLong(tif,direntry,&m);
578  *value=(float)m;
579  return(TIFFReadDirEntryErrOk);
580  }
581  case TIFF_SLONG:
582  {
583  int32 m;
584  TIFFReadDirEntryCheckedSlong(tif,direntry,&m);
585  *value=(float)m;
586  return(TIFFReadDirEntryErrOk);
587  }
588  case TIFF_LONG8:
589  {
590  uint64 m;
591  err=TIFFReadDirEntryCheckedLong8(tif,direntry,&m);
592  if (err!=TIFFReadDirEntryErrOk)
593  return(err);
594 #if defined(__WIN32__) && (_MSC_VER < 1500)
595  /*
596  * XXX: MSVC 6.0 does not support conversion
597  * of 64-bit integers into floating point
598  * values.
599  */
600  *value = _TIFFUInt64ToFloat(m);
601 #else
602  *value=(float)m;
603 #endif
604  return(TIFFReadDirEntryErrOk);
605  }
606  case TIFF_SLONG8:
607  {
608  int64 m;
609  err=TIFFReadDirEntryCheckedSlong8(tif,direntry,&m);
610  if (err!=TIFFReadDirEntryErrOk)
611  return(err);
612  *value=(float)m;
613  return(TIFFReadDirEntryErrOk);
614  }
615  case TIFF_RATIONAL:
616  {
617  double m;
618  err=TIFFReadDirEntryCheckedRational(tif,direntry,&m);
619  if (err!=TIFFReadDirEntryErrOk)
620  return(err);
621  *value=(float)m;
622  return(TIFFReadDirEntryErrOk);
623  }
624  case TIFF_SRATIONAL:
625  {
626  double m;
627  err=TIFFReadDirEntryCheckedSrational(tif,direntry,&m);
628  if (err!=TIFFReadDirEntryErrOk)
629  return(err);
630  *value=(float)m;
631  return(TIFFReadDirEntryErrOk);
632  }
633  case TIFF_FLOAT:
634  TIFFReadDirEntryCheckedFloat(tif,direntry,value);
635  return(TIFFReadDirEntryErrOk);
636  case TIFF_DOUBLE:
637  {
638  double m;
639  err=TIFFReadDirEntryCheckedDouble(tif,direntry,&m);
640  if (err!=TIFFReadDirEntryErrOk)
641  return(err);
642  if ((m > FLT_MAX) || (m < FLT_MIN))
643  return(TIFFReadDirEntryErrRange);
644  *value=(float)m;
645  return(TIFFReadDirEntryErrOk);
646  }
647  default:
648  return(TIFFReadDirEntryErrType);
649  }
650 }
651 
652 static enum TIFFReadDirEntryErr TIFFReadDirEntryDouble(TIFF* tif, TIFFDirEntry* direntry, double* value)
653 {
654  enum TIFFReadDirEntryErr err;
655  if (direntry->tdir_count!=1)
656  return(TIFFReadDirEntryErrCount);
657  switch (direntry->tdir_type)
658  {
659  case TIFF_BYTE:
660  {
661  uint8 m;
662  TIFFReadDirEntryCheckedByte(tif,direntry,&m);
663  *value=(double)m;
664  return(TIFFReadDirEntryErrOk);
665  }
666  case TIFF_SBYTE:
667  {
668  int8 m;
669  TIFFReadDirEntryCheckedSbyte(tif,direntry,&m);
670  *value=(double)m;
671  return(TIFFReadDirEntryErrOk);
672  }
673  case TIFF_SHORT:
674  {
675  uint16 m;
676  TIFFReadDirEntryCheckedShort(tif,direntry,&m);
677  *value=(double)m;
678  return(TIFFReadDirEntryErrOk);
679  }
680  case TIFF_SSHORT:
681  {
682  int16 m;
683  TIFFReadDirEntryCheckedSshort(tif,direntry,&m);
684  *value=(double)m;
685  return(TIFFReadDirEntryErrOk);
686  }
687  case TIFF_LONG:
688  {
689  uint32 m;
690  TIFFReadDirEntryCheckedLong(tif,direntry,&m);
691  *value=(double)m;
692  return(TIFFReadDirEntryErrOk);
693  }
694  case TIFF_SLONG:
695  {
696  int32 m;
697  TIFFReadDirEntryCheckedSlong(tif,direntry,&m);
698  *value=(double)m;
699  return(TIFFReadDirEntryErrOk);
700  }
701  case TIFF_LONG8:
702  {
703  uint64 m;
704  err=TIFFReadDirEntryCheckedLong8(tif,direntry,&m);
705  if (err!=TIFFReadDirEntryErrOk)
706  return(err);
707 #if defined(__WIN32__) && (_MSC_VER < 1500)
708  /*
709  * XXX: MSVC 6.0 does not support conversion
710  * of 64-bit integers into floating point
711  * values.
712  */
713  *value = _TIFFUInt64ToDouble(m);
714 #else
715  *value = (double)m;
716 #endif
717  return(TIFFReadDirEntryErrOk);
718  }
719  case TIFF_SLONG8:
720  {
721  int64 m;
722  err=TIFFReadDirEntryCheckedSlong8(tif,direntry,&m);
723  if (err!=TIFFReadDirEntryErrOk)
724  return(err);
725  *value=(double)m;
726  return(TIFFReadDirEntryErrOk);
727  }
728  case TIFF_RATIONAL:
729  err=TIFFReadDirEntryCheckedRational(tif,direntry,value);
730  return(err);
731  case TIFF_SRATIONAL:
732  err=TIFFReadDirEntryCheckedSrational(tif,direntry,value);
733  return(err);
734  case TIFF_FLOAT:
735  {
736  float m;
737  TIFFReadDirEntryCheckedFloat(tif,direntry,&m);
738  *value=(double)m;
739  return(TIFFReadDirEntryErrOk);
740  }
741  case TIFF_DOUBLE:
742  err=TIFFReadDirEntryCheckedDouble(tif,direntry,value);
743  return(err);
744  default:
745  return(TIFFReadDirEntryErrType);
746  }
747 }
748 
749 static enum TIFFReadDirEntryErr TIFFReadDirEntryIfd8(TIFF* tif, TIFFDirEntry* direntry, uint64* value)
750 {
751  enum TIFFReadDirEntryErr err;
752  if (direntry->tdir_count!=1)
753  return(TIFFReadDirEntryErrCount);
754  switch (direntry->tdir_type)
755  {
756  case TIFF_LONG:
757  case TIFF_IFD:
758  {
759  uint32 m;
760  TIFFReadDirEntryCheckedLong(tif,direntry,&m);
761  *value=(uint64)m;
762  return(TIFFReadDirEntryErrOk);
763  }
764  case TIFF_LONG8:
765  case TIFF_IFD8:
766  err=TIFFReadDirEntryCheckedLong8(tif,direntry,value);
767  return(err);
768  default:
769  return(TIFFReadDirEntryErrType);
770  }
771 }
772 
773 
774 #define INITIAL_THRESHOLD (1024 * 1024)
775 #define THRESHOLD_MULTIPLIER 10
776 #define MAX_THRESHOLD (THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER * INITIAL_THRESHOLD)
777 
778 static enum TIFFReadDirEntryErr TIFFReadDirEntryDataAndRealloc(
779  TIFF* tif, uint64 offset, tmsize_t size, void** pdest)
780 {
781 #if SIZEOF_SIZE_T == 8
782  tmsize_t threshold = INITIAL_THRESHOLD;
783 #endif
784  tmsize_t already_read = 0;
785 
786  assert( !isMapped(tif) );
787 
788  if (!SeekOK(tif,offset))
789  return(TIFFReadDirEntryErrIo);
790 
791  /* On 64 bit processes, read first a maximum of 1 MB, then 10 MB, etc */
792  /* so as to avoid allocating too much memory in case the file is too */
793  /* short. We could ask for the file size, but this might be */
794  /* expensive with some I/O layers (think of reading a gzipped file) */
795  /* Restrict to 64 bit processes, so as to avoid reallocs() */
796  /* on 32 bit processes where virtual memory is scarce. */
797  while( already_read < size )
798  {
799  void* new_dest;
800  tmsize_t bytes_read;
801  tmsize_t to_read = size - already_read;
802 #if SIZEOF_SIZE_T == 8
803  if( to_read >= threshold && threshold < MAX_THRESHOLD )
804  {
805  to_read = threshold;
806  threshold *= THRESHOLD_MULTIPLIER;
807  }
808 #endif
809 
810  new_dest = (uint8*) _TIFFrealloc(
811  *pdest, already_read + to_read);
812  if( new_dest == NULL )
813  {
814  TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
815  "Failed to allocate memory for %s "
816  "(%ld elements of %ld bytes each)",
817  "TIFFReadDirEntryArray",
818  (long) 1, (long) (already_read + to_read));
819  return TIFFReadDirEntryErrAlloc;
820  }
821  *pdest = new_dest;
822 
823  bytes_read = TIFFReadFile(tif,
824  (char*)*pdest + already_read, to_read);
825  already_read += bytes_read;
826  if (bytes_read != to_read) {
827  return TIFFReadDirEntryErrIo;
828  }
829  }
830  return TIFFReadDirEntryErrOk;
831 }
832 
833 static enum TIFFReadDirEntryErr TIFFReadDirEntryArrayWithLimit(
834  TIFF* tif, TIFFDirEntry* direntry, uint32* count, uint32 desttypesize,
835  void** value, uint64 maxcount)
836 {
837  int typesize;
838  uint32 datasize;
839  void* data;
840  uint64 target_count64;
841  typesize=TIFFDataWidth(direntry->tdir_type);
842 
843  target_count64 = (direntry->tdir_count > maxcount) ?
844  maxcount : direntry->tdir_count;
845 
846  if ((target_count64==0)||(typesize==0))
847  {
848  *value=0;
849  return(TIFFReadDirEntryErrOk);
850  }
851  (void) desttypesize;
852 
853  /*
854  * As a sanity check, make sure we have no more than a 2GB tag array
855  * in either the current data type or the dest data type. This also
856  * avoids problems with overflow of tmsize_t on 32bit systems.
857  */
858  if ((uint64)(2147483647/typesize)<target_count64)
859  return(TIFFReadDirEntryErrSizesan);
860  if ((uint64)(2147483647/desttypesize)<target_count64)
861  return(TIFFReadDirEntryErrSizesan);
862 
863  *count=(uint32)target_count64;
864  datasize=(*count)*typesize;
865  assert((tmsize_t)datasize>0);
866 
867  if( isMapped(tif) && datasize > (uint32)tif->tif_size )
868  return TIFFReadDirEntryErrIo;
869 
870  if( !isMapped(tif) &&
871  (((tif->tif_flags&TIFF_BIGTIFF) && datasize > 8) ||
872  (!(tif->tif_flags&TIFF_BIGTIFF) && datasize > 4)) )
873  {
874  data = NULL;
875  }
876  else
877  {
878  data=_TIFFCheckMalloc(tif, *count, typesize, "ReadDirEntryArray");
879  if (data==0)
880  return(TIFFReadDirEntryErrAlloc);
881  }
882  if (!(tif->tif_flags&TIFF_BIGTIFF))
883  {
884  if (datasize<=4)
885  _TIFFmemcpy(data,&direntry->tdir_offset,datasize);
886  else
887  {
888  enum TIFFReadDirEntryErr err;
889  uint32 offset = direntry->tdir_offset.toff_long;
890  if (tif->tif_flags&TIFF_SWAB)
891  TIFFSwabLong(&offset);
892  if( isMapped(tif) )
893  err=TIFFReadDirEntryData(tif,(uint64)offset,(tmsize_t)datasize,data);
894  else
895  err=TIFFReadDirEntryDataAndRealloc(tif,(uint64)offset,(tmsize_t)datasize,&data);
896  if (err!=TIFFReadDirEntryErrOk)
897  {
898  _TIFFfree(data);
899  return(err);
900  }
901  }
902  }
903  else
904  {
905  if (datasize<=8)
906  _TIFFmemcpy(data,&direntry->tdir_offset,datasize);
907  else
908  {
909  enum TIFFReadDirEntryErr err;
910  uint64 offset = direntry->tdir_offset.toff_long8;
911  if (tif->tif_flags&TIFF_SWAB)
912  TIFFSwabLong8(&offset);
913  if( isMapped(tif) )
914  err=TIFFReadDirEntryData(tif,(uint64)offset,(tmsize_t)datasize,data);
915  else
916  err=TIFFReadDirEntryDataAndRealloc(tif,(uint64)offset,(tmsize_t)datasize,&data);
917  if (err!=TIFFReadDirEntryErrOk)
918  {
919  _TIFFfree(data);
920  return(err);
921  }
922  }
923  }
924  *value=data;
925  return(TIFFReadDirEntryErrOk);
926 }
927 
928 static enum TIFFReadDirEntryErr TIFFReadDirEntryArray(TIFF* tif, TIFFDirEntry* direntry, uint32* count, uint32 desttypesize, void** value)
929 {
930  return TIFFReadDirEntryArrayWithLimit(tif, direntry, count,
931  desttypesize, value, ~((uint64)0));
932 }
933 
934 static enum TIFFReadDirEntryErr TIFFReadDirEntryByteArray(TIFF* tif, TIFFDirEntry* direntry, uint8** value)
935 {
936  enum TIFFReadDirEntryErr err;
937  uint32 count;
938  void* origdata;
939  uint8* data;
940  switch (direntry->tdir_type)
941  {
942  case TIFF_ASCII:
943  case TIFF_UNDEFINED:
944  case TIFF_BYTE:
945  case TIFF_SBYTE:
946  case TIFF_SHORT:
947  case TIFF_SSHORT:
948  case TIFF_LONG:
949  case TIFF_SLONG:
950  case TIFF_LONG8:
951  case TIFF_SLONG8:
952  break;
953  default:
954  return(TIFFReadDirEntryErrType);
955  }
956  err=TIFFReadDirEntryArray(tif,direntry,&count,1,&origdata);
957  if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
958  {
959  *value=0;
960  return(err);
961  }
962  switch (direntry->tdir_type)
963  {
964  case TIFF_ASCII:
965  case TIFF_UNDEFINED:
966  case TIFF_BYTE:
967  *value=(uint8*)origdata;
968  return(TIFFReadDirEntryErrOk);
969  case TIFF_SBYTE:
970  {
971  int8* m;
972  uint32 n;
973  m=(int8*)origdata;
974  for (n=0; n<count; n++)
975  {
976  err=TIFFReadDirEntryCheckRangeByteSbyte(*m);
977  if (err!=TIFFReadDirEntryErrOk)
978  {
979  _TIFFfree(origdata);
980  return(err);
981  }
982  m++;
983  }
984  *value=(uint8*)origdata;
985  return(TIFFReadDirEntryErrOk);
986  }
987  }
988  data=(uint8*)_TIFFmalloc(count);
989  if (data==0)
990  {
991  _TIFFfree(origdata);
992  return(TIFFReadDirEntryErrAlloc);
993  }
994  switch (direntry->tdir_type)
995  {
996  case TIFF_SHORT:
997  {
998  uint16* ma;
999  uint8* mb;
1000  uint32 n;
1001  ma=(uint16*)origdata;
1002  mb=data;
1003  for (n=0; n<count; n++)
1004  {
1005  if (tif->tif_flags&TIFF_SWAB)
1006  TIFFSwabShort(ma);
1007  err=TIFFReadDirEntryCheckRangeByteShort(*ma);
1008  if (err!=TIFFReadDirEntryErrOk)
1009  break;
1010  *mb++=(uint8)(*ma++);
1011  }
1012  }
1013  break;
1014  case TIFF_SSHORT:
1015  {
1016  int16* ma;
1017  uint8* mb;
1018  uint32 n;
1019  ma=(int16*)origdata;
1020  mb=data;
1021  for (n=0; n<count; n++)
1022  {
1023  if (tif->tif_flags&TIFF_SWAB)
1024  TIFFSwabShort((uint16*)ma);
1025  err=TIFFReadDirEntryCheckRangeByteSshort(*ma);
1026  if (err!=TIFFReadDirEntryErrOk)
1027  break;
1028  *mb++=(uint8)(*ma++);
1029  }
1030  }
1031  break;
1032  case TIFF_LONG:
1033  {
1034  uint32* ma;
1035  uint8* mb;
1036  uint32 n;
1037  ma=(uint32*)origdata;
1038  mb=data;
1039  for (n=0; n<count; n++)
1040  {
1041  if (tif->tif_flags&TIFF_SWAB)
1042  TIFFSwabLong(ma);
1043  err=TIFFReadDirEntryCheckRangeByteLong(*ma);
1044  if (err!=TIFFReadDirEntryErrOk)
1045  break;
1046  *mb++=(uint8)(*ma++);
1047  }
1048  }
1049  break;
1050  case TIFF_SLONG:
1051  {
1052  int32* ma;
1053  uint8* mb;
1054  uint32 n;
1055  ma=(int32*)origdata;
1056  mb=data;
1057  for (n=0; n<count; n++)
1058  {
1059  if (tif->tif_flags&TIFF_SWAB)
1060  TIFFSwabLong((uint32*)ma);
1061  err=TIFFReadDirEntryCheckRangeByteSlong(*ma);
1062  if (err!=TIFFReadDirEntryErrOk)
1063  break;
1064  *mb++=(uint8)(*ma++);
1065  }
1066  }
1067  break;
1068  case TIFF_LONG8:
1069  {
1070  uint64* ma;
1071  uint8* mb;
1072  uint32 n;
1073  ma=(uint64*)origdata;
1074  mb=data;
1075  for (n=0; n<count; n++)
1076  {
1077  if (tif->tif_flags&TIFF_SWAB)
1078  TIFFSwabLong8(ma);
1079  err=TIFFReadDirEntryCheckRangeByteLong8(*ma);
1080  if (err!=TIFFReadDirEntryErrOk)
1081  break;
1082  *mb++=(uint8)(*ma++);
1083  }
1084  }
1085  break;
1086  case TIFF_SLONG8:
1087  {
1088  int64* ma;
1089  uint8* mb;
1090  uint32 n;
1091  ma=(int64*)origdata;
1092  mb=data;
1093  for (n=0; n<count; n++)
1094  {
1095  if (tif->tif_flags&TIFF_SWAB)
1096  TIFFSwabLong8((uint64*)ma);
1097  err=TIFFReadDirEntryCheckRangeByteSlong8(*ma);
1098  if (err!=TIFFReadDirEntryErrOk)
1099  break;
1100  *mb++=(uint8)(*ma++);
1101  }
1102  }
1103  break;
1104  }
1105  _TIFFfree(origdata);
1106  if (err!=TIFFReadDirEntryErrOk)
1107  {
1108  _TIFFfree(data);
1109  return(err);
1110  }
1111  *value=data;
1112  return(TIFFReadDirEntryErrOk);
1113 }
1114 
1115 static enum TIFFReadDirEntryErr TIFFReadDirEntrySbyteArray(TIFF* tif, TIFFDirEntry* direntry, int8** value)
1116 {
1117  enum TIFFReadDirEntryErr err;
1118  uint32 count;
1119  void* origdata;
1120  int8* data;
1121  switch (direntry->tdir_type)
1122  {
1123  case TIFF_UNDEFINED:
1124  case TIFF_BYTE:
1125  case TIFF_SBYTE:
1126  case TIFF_SHORT:
1127  case TIFF_SSHORT:
1128  case TIFF_LONG:
1129  case TIFF_SLONG:
1130  case TIFF_LONG8:
1131  case TIFF_SLONG8:
1132  break;
1133  default:
1134  return(TIFFReadDirEntryErrType);
1135  }
1136  err=TIFFReadDirEntryArray(tif,direntry,&count,1,&origdata);
1137  if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
1138  {
1139  *value=0;
1140  return(err);
1141  }
1142  switch (direntry->tdir_type)
1143  {
1144  case TIFF_UNDEFINED:
1145  case TIFF_BYTE:
1146  {
1147  uint8* m;
1148  uint32 n;
1149  m=(uint8*)origdata;
1150  for (n=0; n<count; n++)
1151  {
1152  err=TIFFReadDirEntryCheckRangeSbyteByte(*m);
1153  if (err!=TIFFReadDirEntryErrOk)
1154  {
1155  _TIFFfree(origdata);
1156  return(err);
1157  }
1158  m++;
1159  }
1160  *value=(int8*)origdata;
1161  return(TIFFReadDirEntryErrOk);
1162  }
1163  case TIFF_SBYTE:
1164  *value=(int8*)origdata;
1165  return(TIFFReadDirEntryErrOk);
1166  }
1167  data=(int8*)_TIFFmalloc(count);
1168  if (data==0)
1169  {
1170  _TIFFfree(origdata);
1171  return(TIFFReadDirEntryErrAlloc);
1172  }
1173  switch (direntry->tdir_type)
1174  {
1175  case TIFF_SHORT:
1176  {
1177  uint16* ma;
1178  int8* mb;
1179  uint32 n;
1180  ma=(uint16*)origdata;
1181  mb=data;
1182  for (n=0; n<count; n++)
1183  {
1184  if (tif->tif_flags&TIFF_SWAB)
1185  TIFFSwabShort(ma);
1186  err=TIFFReadDirEntryCheckRangeSbyteShort(*ma);
1187  if (err!=TIFFReadDirEntryErrOk)
1188  break;
1189  *mb++=(int8)(*ma++);
1190  }
1191  }
1192  break;
1193  case TIFF_SSHORT:
1194  {
1195  int16* ma;
1196  int8* mb;
1197  uint32 n;
1198  ma=(int16*)origdata;
1199  mb=data;
1200  for (n=0; n<count; n++)
1201  {
1202  if (tif->tif_flags&TIFF_SWAB)
1203  TIFFSwabShort((uint16*)ma);
1204  err=TIFFReadDirEntryCheckRangeSbyteSshort(*ma);
1205  if (err!=TIFFReadDirEntryErrOk)
1206  break;
1207  *mb++=(int8)(*ma++);
1208  }
1209  }
1210  break;
1211  case TIFF_LONG:
1212  {
1213  uint32* ma;
1214  int8* mb;
1215  uint32 n;
1216  ma=(uint32*)origdata;
1217  mb=data;
1218  for (n=0; n<count; n++)
1219  {
1220  if (tif->tif_flags&TIFF_SWAB)
1221  TIFFSwabLong(ma);
1222  err=TIFFReadDirEntryCheckRangeSbyteLong(*ma);
1223  if (err!=TIFFReadDirEntryErrOk)
1224  break;
1225  *mb++=(int8)(*ma++);
1226  }
1227  }
1228  break;
1229  case TIFF_SLONG:
1230  {
1231  int32* ma;
1232  int8* mb;
1233  uint32 n;
1234  ma=(int32*)origdata;
1235  mb=data;
1236  for (n=0; n<count; n++)
1237  {
1238  if (tif->tif_flags&TIFF_SWAB)
1239  TIFFSwabLong((uint32*)ma);
1240  err=TIFFReadDirEntryCheckRangeSbyteSlong(*ma);
1241  if (err!=TIFFReadDirEntryErrOk)
1242  break;
1243  *mb++=(int8)(*ma++);
1244  }
1245  }
1246  break;
1247  case TIFF_LONG8:
1248  {
1249  uint64* ma;
1250  int8* mb;
1251  uint32 n;
1252  ma=(uint64*)origdata;
1253  mb=data;
1254  for (n=0; n<count; n++)
1255  {
1256  if (tif->tif_flags&TIFF_SWAB)
1257  TIFFSwabLong8(ma);
1258  err=TIFFReadDirEntryCheckRangeSbyteLong8(*ma);
1259  if (err!=TIFFReadDirEntryErrOk)
1260  break;
1261  *mb++=(int8)(*ma++);
1262  }
1263  }
1264  break;
1265  case TIFF_SLONG8:
1266  {
1267  int64* ma;
1268  int8* mb;
1269  uint32 n;
1270  ma=(int64*)origdata;
1271  mb=data;
1272  for (n=0; n<count; n++)
1273  {
1274  if (tif->tif_flags&TIFF_SWAB)
1275  TIFFSwabLong8((uint64*)ma);
1276  err=TIFFReadDirEntryCheckRangeSbyteSlong8(*ma);
1277  if (err!=TIFFReadDirEntryErrOk)
1278  break;
1279  *mb++=(int8)(*ma++);
1280  }
1281  }
1282  break;
1283  }
1284  _TIFFfree(origdata);
1285  if (err!=TIFFReadDirEntryErrOk)
1286  {
1287  _TIFFfree(data);
1288  return(err);
1289  }
1290  *value=data;
1291  return(TIFFReadDirEntryErrOk);
1292 }
1293 
1294 static enum TIFFReadDirEntryErr TIFFReadDirEntryShortArray(TIFF* tif, TIFFDirEntry* direntry, uint16** value)
1295 {
1296  enum TIFFReadDirEntryErr err;
1297  uint32 count;
1298  void* origdata;
1299  uint16* data;
1300  switch (direntry->tdir_type)
1301  {
1302  case TIFF_BYTE:
1303  case TIFF_SBYTE:
1304  case TIFF_SHORT:
1305  case TIFF_SSHORT:
1306  case TIFF_LONG:
1307  case TIFF_SLONG:
1308  case TIFF_LONG8:
1309  case TIFF_SLONG8:
1310  break;
1311  default:
1312  return(TIFFReadDirEntryErrType);
1313  }
1314  err=TIFFReadDirEntryArray(tif,direntry,&count,2,&origdata);
1315  if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
1316  {
1317  *value=0;
1318  return(err);
1319  }
1320  switch (direntry->tdir_type)
1321  {
1322  case TIFF_SHORT:
1323  *value=(uint16*)origdata;
1324  if (tif->tif_flags&TIFF_SWAB)
1325  TIFFSwabArrayOfShort(*value,count);
1326  return(TIFFReadDirEntryErrOk);
1327  case TIFF_SSHORT:
1328  {
1329  int16* m;
1330  uint32 n;
1331  m=(int16*)origdata;
1332  for (n=0; n<count; n++)
1333  {
1334  if (tif->tif_flags&TIFF_SWAB)
1335  TIFFSwabShort((uint16*)m);
1336  err=TIFFReadDirEntryCheckRangeShortSshort(*m);
1337  if (err!=TIFFReadDirEntryErrOk)
1338  {
1339  _TIFFfree(origdata);
1340  return(err);
1341  }
1342  m++;
1343  }
1344  *value=(uint16*)origdata;
1345  return(TIFFReadDirEntryErrOk);
1346  }
1347  }
1348  data=(uint16*)_TIFFmalloc(count*2);
1349  if (data==0)
1350  {
1351  _TIFFfree(origdata);
1352  return(TIFFReadDirEntryErrAlloc);
1353  }
1354  switch (direntry->tdir_type)
1355  {
1356  case TIFF_BYTE:
1357  {
1358  uint8* ma;
1359  uint16* mb;
1360  uint32 n;
1361  ma=(uint8*)origdata;
1362  mb=data;
1363  for (n=0; n<count; n++)
1364  *mb++=(uint16)(*ma++);
1365  }
1366  break;
1367  case TIFF_SBYTE:
1368  {
1369  int8* ma;
1370  uint16* mb;
1371  uint32 n;
1372  ma=(int8*)origdata;
1373  mb=data;
1374  for (n=0; n<count; n++)
1375  {
1376  err=TIFFReadDirEntryCheckRangeShortSbyte(*ma);
1377  if (err!=TIFFReadDirEntryErrOk)
1378  break;
1379  *mb++=(uint16)(*ma++);
1380  }
1381  }
1382  break;
1383  case TIFF_LONG:
1384  {
1385  uint32* ma;
1386  uint16* mb;
1387  uint32 n;
1388  ma=(uint32*)origdata;
1389  mb=data;
1390  for (n=0; n<count; n++)
1391  {
1392  if (tif->tif_flags&TIFF_SWAB)
1393  TIFFSwabLong(ma);
1394  err=TIFFReadDirEntryCheckRangeShortLong(*ma);
1395  if (err!=TIFFReadDirEntryErrOk)
1396  break;
1397  *mb++=(uint16)(*ma++);
1398  }
1399  }
1400  break;
1401  case TIFF_SLONG:
1402  {
1403  int32* ma;
1404  uint16* mb;
1405  uint32 n;
1406  ma=(int32*)origdata;
1407  mb=data;
1408  for (n=0; n<count; n++)
1409  {
1410  if (tif->tif_flags&TIFF_SWAB)
1411  TIFFSwabLong((uint32*)ma);
1412  err=TIFFReadDirEntryCheckRangeShortSlong(*ma);
1413  if (err!=TIFFReadDirEntryErrOk)
1414  break;
1415  *mb++=(uint16)(*ma++);
1416  }
1417  }
1418  break;
1419  case TIFF_LONG8:
1420  {
1421  uint64* ma;
1422  uint16* mb;
1423  uint32 n;
1424  ma=(uint64*)origdata;
1425  mb=data;
1426  for (n=0; n<count; n++)
1427  {
1428  if (tif->tif_flags&TIFF_SWAB)
1429  TIFFSwabLong8(ma);
1430  err=TIFFReadDirEntryCheckRangeShortLong8(*ma);
1431  if (err!=TIFFReadDirEntryErrOk)
1432  break;
1433  *mb++=(uint16)(*ma++);
1434  }
1435  }
1436  break;
1437  case TIFF_SLONG8:
1438  {
1439  int64* ma;
1440  uint16* mb;
1441  uint32 n;
1442  ma=(int64*)origdata;
1443  mb=data;
1444  for (n=0; n<count; n++)
1445  {
1446  if (tif->tif_flags&TIFF_SWAB)
1447  TIFFSwabLong8((uint64*)ma);
1448  err=TIFFReadDirEntryCheckRangeShortSlong8(*ma);
1449  if (err!=TIFFReadDirEntryErrOk)
1450  break;
1451  *mb++=(uint16)(*ma++);
1452  }
1453  }
1454  break;
1455  }
1456  _TIFFfree(origdata);
1457  if (err!=TIFFReadDirEntryErrOk)
1458  {
1459  _TIFFfree(data);
1460  return(err);
1461  }
1462  *value=data;
1463  return(TIFFReadDirEntryErrOk);
1464 }
1465 
1466 static enum TIFFReadDirEntryErr TIFFReadDirEntrySshortArray(TIFF* tif, TIFFDirEntry* direntry, int16** value)
1467 {
1468  enum TIFFReadDirEntryErr err;
1469  uint32 count;
1470  void* origdata;
1471  int16* data;
1472  switch (direntry->tdir_type)
1473  {
1474  case TIFF_BYTE:
1475  case TIFF_SBYTE:
1476  case TIFF_SHORT:
1477  case TIFF_SSHORT:
1478  case TIFF_LONG:
1479  case TIFF_SLONG:
1480  case TIFF_LONG8:
1481  case TIFF_SLONG8:
1482  break;
1483  default:
1484  return(TIFFReadDirEntryErrType);
1485  }
1486  err=TIFFReadDirEntryArray(tif,direntry,&count,2,&origdata);
1487  if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
1488  {
1489  *value=0;
1490  return(err);
1491  }
1492  switch (direntry->tdir_type)
1493  {
1494  case TIFF_SHORT:
1495  {
1496  uint16* m;
1497  uint32 n;
1498  m=(uint16*)origdata;
1499  for (n=0; n<count; n++)
1500  {
1501  if (tif->tif_flags&TIFF_SWAB)
1502  TIFFSwabShort(m);
1503  err=TIFFReadDirEntryCheckRangeSshortShort(*m);
1504  if (err!=TIFFReadDirEntryErrOk)
1505  {
1506  _TIFFfree(origdata);
1507  return(err);
1508  }
1509  m++;
1510  }
1511  *value=(int16*)origdata;
1512  return(TIFFReadDirEntryErrOk);
1513  }
1514  case TIFF_SSHORT:
1515  *value=(int16*)origdata;
1516  if (tif->tif_flags&TIFF_SWAB)
1517  TIFFSwabArrayOfShort((uint16*)(*value),count);
1518  return(TIFFReadDirEntryErrOk);
1519  }
1520  data=(int16*)_TIFFmalloc(count*2);
1521  if (data==0)
1522  {
1523  _TIFFfree(origdata);
1524  return(TIFFReadDirEntryErrAlloc);
1525  }
1526  switch (direntry->tdir_type)
1527  {
1528  case TIFF_BYTE:
1529  {
1530  uint8* ma;
1531  int16* mb;
1532  uint32 n;
1533  ma=(uint8*)origdata;
1534  mb=data;
1535  for (n=0; n<count; n++)
1536  *mb++=(int16)(*ma++);
1537  }
1538  break;
1539  case TIFF_SBYTE:
1540  {
1541  int8* ma;
1542  int16* mb;
1543  uint32 n;
1544  ma=(int8*)origdata;
1545  mb=data;
1546  for (n=0; n<count; n++)
1547  *mb++=(int16)(*ma++);
1548  }
1549  break;
1550  case TIFF_LONG:
1551  {
1552  uint32* ma;
1553  int16* mb;
1554  uint32 n;
1555  ma=(uint32*)origdata;
1556  mb=data;
1557  for (n=0; n<count; n++)
1558  {
1559  if (tif->tif_flags&TIFF_SWAB)
1560  TIFFSwabLong(ma);
1561  err=TIFFReadDirEntryCheckRangeSshortLong(*ma);
1562  if (err!=TIFFReadDirEntryErrOk)
1563  break;
1564  *mb++=(int16)(*ma++);
1565  }
1566  }
1567  break;
1568  case TIFF_SLONG:
1569  {
1570  int32* ma;
1571  int16* mb;
1572  uint32 n;
1573  ma=(int32*)origdata;
1574  mb=data;
1575  for (n=0; n<count; n++)
1576  {
1577  if (tif->tif_flags&TIFF_SWAB)
1578  TIFFSwabLong((uint32*)ma);
1579  err=TIFFReadDirEntryCheckRangeSshortSlong(*ma);
1580  if (err!=TIFFReadDirEntryErrOk)
1581  break;
1582  *mb++=(int16)(*ma++);
1583  }
1584  }
1585  break;
1586  case TIFF_LONG8:
1587  {
1588  uint64* ma;
1589  int16* mb;
1590  uint32 n;
1591  ma=(uint64*)origdata;
1592  mb=data;
1593  for (n=0; n<count; n++)
1594  {
1595  if (tif->tif_flags&TIFF_SWAB)
1596  TIFFSwabLong8(ma);
1597  err=TIFFReadDirEntryCheckRangeSshortLong8(*ma);
1598  if (err!=TIFFReadDirEntryErrOk)
1599  break;
1600  *mb++=(int16)(*ma++);
1601  }
1602  }
1603  break;
1604  case TIFF_SLONG8:
1605  {
1606  int64* ma;
1607  int16* mb;
1608  uint32 n;
1609  ma=(int64*)origdata;
1610  mb=data;
1611  for (n=0; n<count; n++)
1612  {
1613  if (tif->tif_flags&TIFF_SWAB)
1614  TIFFSwabLong8((uint64*)ma);
1615  err=TIFFReadDirEntryCheckRangeSshortSlong8(*ma);
1616  if (err!=TIFFReadDirEntryErrOk)
1617  break;
1618  *mb++=(int16)(*ma++);
1619  }
1620  }
1621  break;
1622  }
1623  _TIFFfree(origdata);
1624  if (err!=TIFFReadDirEntryErrOk)
1625  {
1626  _TIFFfree(data);
1627  return(err);
1628  }
1629  *value=data;
1630  return(TIFFReadDirEntryErrOk);
1631 }
1632 
1633 static enum TIFFReadDirEntryErr TIFFReadDirEntryLongArray(TIFF* tif, TIFFDirEntry* direntry, uint32** value)
1634 {
1635  enum TIFFReadDirEntryErr err;
1636  uint32 count;
1637  void* origdata;
1638  uint32* data;
1639  switch (direntry->tdir_type)
1640  {
1641  case TIFF_BYTE:
1642  case TIFF_SBYTE:
1643  case TIFF_SHORT:
1644  case TIFF_SSHORT:
1645  case TIFF_LONG:
1646  case TIFF_SLONG:
1647  case TIFF_LONG8:
1648  case TIFF_SLONG8:
1649  break;
1650  default:
1651  return(TIFFReadDirEntryErrType);
1652  }
1653  err=TIFFReadDirEntryArray(tif,direntry,&count,4,&origdata);
1654  if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
1655  {
1656  *value=0;
1657  return(err);
1658  }
1659  switch (direntry->tdir_type)
1660  {
1661  case TIFF_LONG:
1662  *value=(uint32*)origdata;
1663  if (tif->tif_flags&TIFF_SWAB)
1664  TIFFSwabArrayOfLong(*value,count);
1665  return(TIFFReadDirEntryErrOk);
1666  case TIFF_SLONG:
1667  {
1668  int32* m;
1669  uint32 n;
1670  m=(int32*)origdata;
1671  for (n=0; n<count; n++)
1672  {
1673  if (tif->tif_flags&TIFF_SWAB)
1674  TIFFSwabLong((uint32*)m);
1675  err=TIFFReadDirEntryCheckRangeLongSlong(*m);
1676  if (err!=TIFFReadDirEntryErrOk)
1677  {
1678  _TIFFfree(origdata);
1679  return(err);
1680  }
1681  m++;
1682  }
1683  *value=(uint32*)origdata;
1684  return(TIFFReadDirEntryErrOk);
1685  }
1686  }
1687  data=(uint32*)_TIFFmalloc(count*4);
1688  if (data==0)
1689  {
1690  _TIFFfree(origdata);
1691  return(TIFFReadDirEntryErrAlloc);
1692  }
1693  switch (direntry->tdir_type)
1694  {
1695  case TIFF_BYTE:
1696  {
1697  uint8* ma;
1698  uint32* mb;
1699  uint32 n;
1700  ma=(uint8*)origdata;
1701  mb=data;
1702  for (n=0; n<count; n++)
1703  *mb++=(uint32)(*ma++);
1704  }
1705  break;
1706  case TIFF_SBYTE:
1707  {
1708  int8* ma;
1709  uint32* mb;
1710  uint32 n;
1711  ma=(int8*)origdata;
1712  mb=data;
1713  for (n=0; n<count; n++)
1714  {
1715  err=TIFFReadDirEntryCheckRangeLongSbyte(*ma);
1716  if (err!=TIFFReadDirEntryErrOk)
1717  break;
1718  *mb++=(uint32)(*ma++);
1719  }
1720  }
1721  break;
1722  case TIFF_SHORT:
1723  {
1724  uint16* ma;
1725  uint32* mb;
1726  uint32 n;
1727  ma=(uint16*)origdata;
1728  mb=data;
1729  for (n=0; n<count; n++)
1730  {
1731  if (tif->tif_flags&TIFF_SWAB)
1732  TIFFSwabShort(ma);
1733  *mb++=(uint32)(*ma++);
1734  }
1735  }
1736  break;
1737  case TIFF_SSHORT:
1738  {
1739  int16* ma;
1740  uint32* mb;
1741  uint32 n;
1742  ma=(int16*)origdata;
1743  mb=data;
1744  for (n=0; n<count; n++)
1745  {
1746  if (tif->tif_flags&TIFF_SWAB)
1747  TIFFSwabShort((uint16*)ma);
1748  err=TIFFReadDirEntryCheckRangeLongSshort(*ma);
1749  if (err!=TIFFReadDirEntryErrOk)
1750  break;
1751  *mb++=(uint32)(*ma++);
1752  }
1753  }
1754  break;
1755  case TIFF_LONG8:
1756  {
1757  uint64* ma;
1758  uint32* mb;
1759  uint32 n;
1760  ma=(uint64*)origdata;
1761  mb=data;
1762  for (n=0; n<count; n++)
1763  {
1764  if (tif->tif_flags&TIFF_SWAB)
1765  TIFFSwabLong8(ma);
1766  err=TIFFReadDirEntryCheckRangeLongLong8(*ma);
1767  if (err!=TIFFReadDirEntryErrOk)
1768  break;
1769  *mb++=(uint32)(*ma++);
1770  }
1771  }
1772  break;
1773  case TIFF_SLONG8:
1774  {
1775  int64* ma;
1776  uint32* mb;
1777  uint32 n;
1778  ma=(int64*)origdata;
1779  mb=data;
1780  for (n=0; n<count; n++)
1781  {
1782  if (tif->tif_flags&TIFF_SWAB)
1783  TIFFSwabLong8((uint64*)ma);
1784  err=TIFFReadDirEntryCheckRangeLongSlong8(*ma);
1785  if (err!=TIFFReadDirEntryErrOk)
1786  break;
1787  *mb++=(uint32)(*ma++);
1788  }
1789  }
1790  break;
1791  }
1792  _TIFFfree(origdata);
1793  if (err!=TIFFReadDirEntryErrOk)
1794  {
1795  _TIFFfree(data);
1796  return(err);
1797  }
1798  *value=data;
1799  return(TIFFReadDirEntryErrOk);
1800 }
1801 
1802 static enum TIFFReadDirEntryErr TIFFReadDirEntrySlongArray(TIFF* tif, TIFFDirEntry* direntry, int32** value)
1803 {
1804  enum TIFFReadDirEntryErr err;
1805  uint32 count;
1806  void* origdata;
1807  int32* data;
1808  switch (direntry->tdir_type)
1809  {
1810  case TIFF_BYTE:
1811  case TIFF_SBYTE:
1812  case TIFF_SHORT:
1813  case TIFF_SSHORT:
1814  case TIFF_LONG:
1815  case TIFF_SLONG:
1816  case TIFF_LONG8:
1817  case TIFF_SLONG8:
1818  break;
1819  default:
1820  return(TIFFReadDirEntryErrType);
1821  }
1822  err=TIFFReadDirEntryArray(tif,direntry,&count,4,&origdata);
1823  if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
1824  {
1825  *value=0;
1826  return(err);
1827  }
1828  switch (direntry->tdir_type)
1829  {
1830  case TIFF_LONG:
1831  {
1832  uint32* m;
1833  uint32 n;
1834  m=(uint32*)origdata;
1835  for (n=0; n<count; n++)
1836  {
1837  if (tif->tif_flags&TIFF_SWAB)
1838  TIFFSwabLong((uint32*)m);
1839  err=TIFFReadDirEntryCheckRangeSlongLong(*m);
1840  if (err!=TIFFReadDirEntryErrOk)
1841  {
1842  _TIFFfree(origdata);
1843  return(err);
1844  }
1845  m++;
1846  }
1847  *value=(int32*)origdata;
1848  return(TIFFReadDirEntryErrOk);
1849  }
1850  case TIFF_SLONG:
1851  *value=(int32*)origdata;
1852  if (tif->tif_flags&TIFF_SWAB)
1853  TIFFSwabArrayOfLong((uint32*)(*value),count);
1854  return(TIFFReadDirEntryErrOk);
1855  }
1856  data=(int32*)_TIFFmalloc(count*4);
1857  if (data==0)
1858  {
1859  _TIFFfree(origdata);
1860  return(TIFFReadDirEntryErrAlloc);
1861  }
1862  switch (direntry->tdir_type)
1863  {
1864  case TIFF_BYTE:
1865  {
1866  uint8* ma;
1867  int32* mb;
1868  uint32 n;
1869  ma=(uint8*)origdata;
1870  mb=data;
1871  for (n=0; n<count; n++)
1872  *mb++=(int32)(*ma++);
1873  }
1874  break;
1875  case TIFF_SBYTE:
1876  {
1877  int8* ma;
1878  int32* mb;
1879  uint32 n;
1880  ma=(int8*)origdata;
1881  mb=data;
1882  for (n=0; n<count; n++)
1883  *mb++=(int32)(*ma++);
1884  }
1885  break;
1886  case TIFF_SHORT:
1887  {
1888  uint16* ma;
1889  int32* mb;
1890  uint32 n;
1891  ma=(uint16*)origdata;
1892  mb=data;
1893  for (n=0; n<count; n++)
1894  {
1895  if (tif->tif_flags&TIFF_SWAB)
1896  TIFFSwabShort(ma);
1897  *mb++=(int32)(*ma++);
1898  }
1899  }
1900  break;
1901  case TIFF_SSHORT:
1902  {
1903  int16* ma;
1904  int32* mb;
1905  uint32 n;
1906  ma=(int16*)origdata;
1907  mb=data;
1908  for (n=0; n<count; n++)
1909  {
1910  if (tif->tif_flags&TIFF_SWAB)
1911  TIFFSwabShort((uint16*)ma);
1912  *mb++=(int32)(*ma++);
1913  }
1914  }
1915  break;
1916  case TIFF_LONG8:
1917  {
1918  uint64* ma;
1919  int32* mb;
1920  uint32 n;
1921  ma=(uint64*)origdata;
1922  mb=data;
1923  for (n=0; n<count; n++)
1924  {
1925  if (tif->tif_flags&TIFF_SWAB)
1926  TIFFSwabLong8(ma);
1927  err=TIFFReadDirEntryCheckRangeSlongLong8(*ma);
1928  if (err!=TIFFReadDirEntryErrOk)
1929  break;
1930  *mb++=(int32)(*ma++);
1931  }
1932  }
1933  break;
1934  case TIFF_SLONG8:
1935  {
1936  int64* ma;
1937  int32* mb;
1938  uint32 n;
1939  ma=(int64*)origdata;
1940  mb=data;
1941  for (n=0; n<count; n++)
1942  {
1943  if (tif->tif_flags&TIFF_SWAB)
1944  TIFFSwabLong8((uint64*)ma);
1945  err=TIFFReadDirEntryCheckRangeSlongSlong8(*ma);
1946  if (err!=TIFFReadDirEntryErrOk)
1947  break;
1948  *mb++=(int32)(*ma++);
1949  }
1950  }
1951  break;
1952  }
1953  _TIFFfree(origdata);
1954  if (err!=TIFFReadDirEntryErrOk)
1955  {
1956  _TIFFfree(data);
1957  return(err);
1958  }
1959  *value=data;
1960  return(TIFFReadDirEntryErrOk);
1961 }
1962 
1963 static enum TIFFReadDirEntryErr TIFFReadDirEntryLong8ArrayWithLimit(
1964  TIFF* tif, TIFFDirEntry* direntry, uint64** value, uint64 maxcount)
1965 {
1966  enum TIFFReadDirEntryErr err;
1967  uint32 count;
1968  void* origdata;
1969  uint64* data;
1970  switch (direntry->tdir_type)
1971  {
1972  case TIFF_BYTE:
1973  case TIFF_SBYTE:
1974  case TIFF_SHORT:
1975  case TIFF_SSHORT:
1976  case TIFF_LONG:
1977  case TIFF_SLONG:
1978  case TIFF_LONG8:
1979  case TIFF_SLONG8:
1980  break;
1981  default:
1982  return(TIFFReadDirEntryErrType);
1983  }
1984  err=TIFFReadDirEntryArrayWithLimit(tif,direntry,&count,8,&origdata,maxcount);
1985  if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
1986  {
1987  *value=0;
1988  return(err);
1989  }
1990  switch (direntry->tdir_type)
1991  {
1992  case TIFF_LONG8:
1993  *value=(uint64*)origdata;
1994  if (tif->tif_flags&TIFF_SWAB)
1995  TIFFSwabArrayOfLong8(*value,count);
1996  return(TIFFReadDirEntryErrOk);
1997  case TIFF_SLONG8:
1998  {
1999  int64* m;
2000  uint32 n;
2001  m=(int64*)origdata;
2002  for (n=0; n<count; n++)
2003  {
2004  if (tif->tif_flags&TIFF_SWAB)
2005  TIFFSwabLong8((uint64*)m);
2006  err=TIFFReadDirEntryCheckRangeLong8Slong8(*m);
2007  if (err!=TIFFReadDirEntryErrOk)
2008  {
2009  _TIFFfree(origdata);
2010  return(err);
2011  }
2012  m++;
2013  }
2014  *value=(uint64*)origdata;
2015  return(TIFFReadDirEntryErrOk);
2016  }
2017  }
2018  data=(uint64*)_TIFFmalloc(count*8);
2019  if (data==0)
2020  {
2021  _TIFFfree(origdata);
2022  return(TIFFReadDirEntryErrAlloc);
2023  }
2024  switch (direntry->tdir_type)
2025  {
2026  case TIFF_BYTE:
2027  {
2028  uint8* ma;
2029  uint64* mb;
2030  uint32 n;
2031  ma=(uint8*)origdata;
2032  mb=data;
2033  for (n=0; n<count; n++)
2034  *mb++=(uint64)(*ma++);
2035  }
2036  break;
2037  case TIFF_SBYTE:
2038  {
2039  int8* ma;
2040  uint64* mb;
2041  uint32 n;
2042  ma=(int8*)origdata;
2043  mb=data;
2044  for (n=0; n<count; n++)
2045  {
2046  err=TIFFReadDirEntryCheckRangeLong8Sbyte(*ma);
2047  if (err!=TIFFReadDirEntryErrOk)
2048  break;
2049  *mb++=(uint64)(*ma++);
2050  }
2051  }
2052  break;
2053  case TIFF_SHORT:
2054  {
2055  uint16* ma;
2056  uint64* mb;
2057  uint32 n;
2058  ma=(uint16*)origdata;
2059  mb=data;
2060  for (n=0; n<count; n++)
2061  {
2062  if (tif->tif_flags&TIFF_SWAB)
2063  TIFFSwabShort(ma);
2064  *mb++=(uint64)(*ma++);
2065  }
2066  }
2067  break;
2068  case TIFF_SSHORT:
2069  {
2070  int16* ma;
2071  uint64* mb;
2072  uint32 n;
2073  ma=(int16*)origdata;
2074  mb=data;
2075  for (n=0; n<count; n++)
2076  {
2077  if (tif->tif_flags&TIFF_SWAB)
2078  TIFFSwabShort((uint16*)ma);
2079  err=TIFFReadDirEntryCheckRangeLong8Sshort(*ma);
2080  if (err!=TIFFReadDirEntryErrOk)
2081  break;
2082  *mb++=(uint64)(*ma++);
2083  }
2084  }
2085  break;
2086  case TIFF_LONG:
2087  {
2088  uint32* ma;
2089  uint64* mb;
2090  uint32 n;
2091  ma=(uint32*)origdata;
2092  mb=data;
2093  for (n=0; n<count; n++)
2094  {
2095  if (tif->tif_flags&TIFF_SWAB)
2096  TIFFSwabLong(ma);
2097  *mb++=(uint64)(*ma++);
2098  }
2099  }
2100  break;
2101  case TIFF_SLONG:
2102  {
2103  int32* ma;
2104  uint64* mb;
2105  uint32 n;
2106  ma=(int32*)origdata;
2107  mb=data;
2108  for (n=0; n<count; n++)
2109  {
2110  if (tif->tif_flags&TIFF_SWAB)
2111  TIFFSwabLong((uint32*)ma);
2112  err=TIFFReadDirEntryCheckRangeLong8Slong(*ma);
2113  if (err!=TIFFReadDirEntryErrOk)
2114  break;
2115  *mb++=(uint64)(*ma++);
2116  }
2117  }
2118  break;
2119  }
2120  _TIFFfree(origdata);
2121  if (err!=TIFFReadDirEntryErrOk)
2122  {
2123  _TIFFfree(data);
2124  return(err);
2125  }
2126  *value=data;
2127  return(TIFFReadDirEntryErrOk);
2128 }
2129 
2130 static enum TIFFReadDirEntryErr TIFFReadDirEntryLong8Array(TIFF* tif, TIFFDirEntry* direntry, uint64** value)
2131 {
2132  return TIFFReadDirEntryLong8ArrayWithLimit(tif, direntry, value, ~((uint64)0));
2133 }
2134 
2135 static enum TIFFReadDirEntryErr TIFFReadDirEntrySlong8Array(TIFF* tif, TIFFDirEntry* direntry, int64** value)
2136 {
2137  enum TIFFReadDirEntryErr err;
2138  uint32 count;
2139  void* origdata;
2140  int64* data;
2141  switch (direntry->tdir_type)
2142  {
2143  case TIFF_BYTE:
2144  case TIFF_SBYTE:
2145  case TIFF_SHORT:
2146  case TIFF_SSHORT:
2147  case TIFF_LONG:
2148  case TIFF_SLONG:
2149  case TIFF_LONG8:
2150  case TIFF_SLONG8:
2151  break;
2152  default:
2153  return(TIFFReadDirEntryErrType);
2154  }
2155  err=TIFFReadDirEntryArray(tif,direntry,&count,8,&origdata);
2156  if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
2157  {
2158  *value=0;
2159  return(err);
2160  }
2161  switch (direntry->tdir_type)
2162  {
2163  case TIFF_LONG8:
2164  {
2165  uint64* m;
2166  uint32 n;
2167  m=(uint64*)origdata;
2168  for (n=0; n<count; n++)
2169  {
2170  if (tif->tif_flags&TIFF_SWAB)
2171  TIFFSwabLong8(m);
2172  err=TIFFReadDirEntryCheckRangeSlong8Long8(*m);
2173  if (err!=TIFFReadDirEntryErrOk)
2174  {
2175  _TIFFfree(origdata);
2176  return(err);
2177  }
2178  m++;
2179  }
2180  *value=(int64*)origdata;
2181  return(TIFFReadDirEntryErrOk);
2182  }
2183  case TIFF_SLONG8:
2184  *value=(int64*)origdata;
2185  if (tif->tif_flags&TIFF_SWAB)
2186  TIFFSwabArrayOfLong8((uint64*)(*value),count);
2187  return(TIFFReadDirEntryErrOk);
2188  }
2189  data=(int64*)_TIFFmalloc(count*8);
2190  if (data==0)
2191  {
2192  _TIFFfree(origdata);
2193  return(TIFFReadDirEntryErrAlloc);
2194  }
2195  switch (direntry->tdir_type)
2196  {
2197  case TIFF_BYTE:
2198  {
2199  uint8* ma;
2200  int64* mb;
2201  uint32 n;
2202  ma=(uint8*)origdata;
2203  mb=data;
2204  for (n=0; n<count; n++)
2205  *mb++=(int64)(*ma++);
2206  }
2207  break;
2208  case TIFF_SBYTE:
2209  {
2210  int8* ma;
2211  int64* mb;
2212  uint32 n;
2213  ma=(int8*)origdata;
2214  mb=data;
2215  for (n=0; n<count; n++)
2216  *mb++=(int64)(*ma++);
2217  }
2218  break;
2219  case TIFF_SHORT:
2220  {
2221  uint16* ma;
2222  int64* mb;
2223  uint32 n;
2224  ma=(uint16*)origdata;
2225  mb=data;
2226  for (n=0; n<count; n++)
2227  {
2228  if (tif->tif_flags&TIFF_SWAB)
2229  TIFFSwabShort(ma);
2230  *mb++=(int64)(*ma++);
2231  }
2232  }
2233  break;
2234  case TIFF_SSHORT:
2235  {
2236  int16* ma;
2237  int64* mb;
2238  uint32 n;
2239  ma=(int16*)origdata;
2240  mb=data;
2241  for (n=0; n<count; n++)
2242  {
2243  if (tif->tif_flags&TIFF_SWAB)
2244  TIFFSwabShort((uint16*)ma);
2245  *mb++=(int64)(*ma++);
2246  }
2247  }
2248  break;
2249  case TIFF_LONG:
2250  {
2251  uint32* ma;
2252  int64* mb;
2253  uint32 n;
2254  ma=(uint32*)origdata;
2255  mb=data;
2256  for (n=0; n<count; n++)
2257  {
2258  if (tif->tif_flags&TIFF_SWAB)
2259  TIFFSwabLong(ma);
2260  *mb++=(int64)(*ma++);
2261  }
2262  }
2263  break;
2264  case TIFF_SLONG:
2265  {
2266  int32* ma;
2267  int64* mb;
2268  uint32 n;
2269  ma=(int32*)origdata;
2270  mb=data;
2271  for (n=0; n<count; n++)
2272  {
2273  if (tif->tif_flags&TIFF_SWAB)
2274  TIFFSwabLong((uint32*)ma);
2275  *mb++=(int64)(*ma++);
2276  }
2277  }
2278  break;
2279  }
2280  _TIFFfree(origdata);
2281  *value=data;
2282  return(TIFFReadDirEntryErrOk);
2283 }
2284 
2285 static enum TIFFReadDirEntryErr TIFFReadDirEntryFloatArray(TIFF* tif, TIFFDirEntry* direntry, float** value)
2286 {
2287  enum TIFFReadDirEntryErr err;
2288  uint32 count;
2289  void* origdata;
2290  float* data;
2291  switch (direntry->tdir_type)
2292  {
2293  case TIFF_BYTE:
2294  case TIFF_SBYTE:
2295  case TIFF_SHORT:
2296  case TIFF_SSHORT:
2297  case TIFF_LONG:
2298  case TIFF_SLONG:
2299  case TIFF_LONG8:
2300  case TIFF_SLONG8:
2301  case TIFF_RATIONAL:
2302  case TIFF_SRATIONAL:
2303  case TIFF_FLOAT:
2304  case TIFF_DOUBLE:
2305  break;
2306  default:
2307  return(TIFFReadDirEntryErrType);
2308  }
2309  err=TIFFReadDirEntryArray(tif,direntry,&count,4,&origdata);
2310  if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
2311  {
2312  *value=0;
2313  return(err);
2314  }
2315  switch (direntry->tdir_type)
2316  {
2317  case TIFF_FLOAT:
2318  if (tif->tif_flags&TIFF_SWAB)
2319  TIFFSwabArrayOfLong((uint32*)origdata,count);
2320  TIFFCvtIEEEDoubleToNative(tif,count,(float*)origdata);
2321  *value=(float*)origdata;
2322  return(TIFFReadDirEntryErrOk);
2323  }
2324  data=(float*)_TIFFmalloc(count*sizeof(float));
2325  if (data==0)
2326  {
2327  _TIFFfree(origdata);
2328  return(TIFFReadDirEntryErrAlloc);
2329  }
2330  switch (direntry->tdir_type)
2331  {
2332  case TIFF_BYTE:
2333  {
2334  uint8* ma;
2335  float* mb;
2336  uint32 n;
2337  ma=(uint8*)origdata;
2338  mb=data;
2339  for (n=0; n<count; n++)
2340  *mb++=(float)(*ma++);
2341  }
2342  break;
2343  case TIFF_SBYTE:
2344  {
2345  int8* ma;
2346  float* mb;
2347  uint32 n;
2348  ma=(int8*)origdata;
2349  mb=data;
2350  for (n=0; n<count; n++)
2351  *mb++=(float)(*ma++);
2352  }
2353  break;
2354  case TIFF_SHORT:
2355  {
2356  uint16* ma;
2357  float* mb;
2358  uint32 n;
2359  ma=(uint16*)origdata;
2360  mb=data;
2361  for (n=0; n<count; n++)
2362  {
2363  if (tif->tif_flags&TIFF_SWAB)
2364  TIFFSwabShort(ma);
2365  *mb++=(float)(*ma++);
2366  }
2367  }
2368  break;
2369  case TIFF_SSHORT:
2370  {
2371  int16* ma;
2372  float* mb;
2373  uint32 n;
2374  ma=(int16*)origdata;
2375  mb=data;
2376  for (n=0; n<count; n++)
2377  {
2378  if (tif->tif_flags&TIFF_SWAB)
2379  TIFFSwabShort((uint16*)ma);
2380  *mb++=(float)(*ma++);
2381  }
2382  }
2383  break;
2384  case TIFF_LONG:
2385  {
2386  uint32* ma;
2387  float* mb;
2388  uint32 n;
2389  ma=(uint32*)origdata;
2390  mb=data;
2391  for (n=0; n<count; n++)
2392  {
2393  if (tif->tif_flags&TIFF_SWAB)
2394  TIFFSwabLong(ma);
2395  *mb++=(float)(*ma++);
2396  }
2397  }
2398  break;
2399  case TIFF_SLONG:
2400  {
2401  int32* ma;
2402  float* mb;
2403  uint32 n;
2404  ma=(int32*)origdata;
2405  mb=data;
2406  for (n=0; n<count; n++)
2407  {
2408  if (tif->tif_flags&TIFF_SWAB)
2409  TIFFSwabLong((uint32*)ma);
2410  *mb++=(float)(*ma++);
2411  }
2412  }
2413  break;
2414  case TIFF_LONG8:
2415  {
2416  uint64* ma;
2417  float* mb;
2418  uint32 n;
2419  ma=(uint64*)origdata;
2420  mb=data;
2421  for (n=0; n<count; n++)
2422  {
2423  if (tif->tif_flags&TIFF_SWAB)
2424  TIFFSwabLong8(ma);
2425 #if defined(__WIN32__) && (_MSC_VER < 1500)
2426  /*
2427  * XXX: MSVC 6.0 does not support
2428  * conversion of 64-bit integers into
2429  * floating point values.
2430  */
2431  *mb++ = _TIFFUInt64ToFloat(*ma++);
2432 #else
2433  *mb++ = (float)(*ma++);
2434 #endif
2435  }
2436  }
2437  break;
2438  case TIFF_SLONG8:
2439  {
2440  int64* ma;
2441  float* mb;
2442  uint32 n;
2443  ma=(int64*)origdata;
2444  mb=data;
2445  for (n=0; n<count; n++)
2446  {
2447  if (tif->tif_flags&TIFF_SWAB)
2448  TIFFSwabLong8((uint64*)ma);
2449  *mb++=(float)(*ma++);
2450  }
2451  }
2452  break;
2453  case TIFF_RATIONAL:
2454  {
2455  uint32* ma;
2456  uint32 maa;
2457  uint32 mab;
2458  float* mb;
2459  uint32 n;
2460  ma=(uint32*)origdata;
2461  mb=data;
2462  for (n=0; n<count; n++)
2463  {
2464  if (tif->tif_flags&TIFF_SWAB)
2465  TIFFSwabLong(ma);
2466  maa=*ma++;
2467  if (tif->tif_flags&TIFF_SWAB)
2468  TIFFSwabLong(ma);
2469  mab=*ma++;
2470  if (mab==0)
2471  *mb++=0.0;
2472  else
2473  *mb++=(float)maa/(float)mab;
2474  }
2475  }
2476  break;
2477  case TIFF_SRATIONAL:
2478  {
2479  uint32* ma;
2480  int32 maa;
2481  uint32 mab;
2482  float* mb;
2483  uint32 n;
2484  ma=(uint32*)origdata;
2485  mb=data;
2486  for (n=0; n<count; n++)
2487  {
2488  if (tif->tif_flags&TIFF_SWAB)
2489  TIFFSwabLong(ma);
2490  maa=*(int32*)ma;
2491  ma++;
2492  if (tif->tif_flags&TIFF_SWAB)
2493  TIFFSwabLong(ma);
2494  mab=*ma++;
2495  if (mab==0)
2496  *mb++=0.0;
2497  else
2498  *mb++=(float)maa/(float)mab;
2499  }
2500  }
2501  break;
2502  case TIFF_DOUBLE:
2503  {
2504  double* ma;
2505  float* mb;
2506  uint32 n;
2507  if (tif->tif_flags&TIFF_SWAB)
2508  TIFFSwabArrayOfLong8((uint64*)origdata,count);
2509  TIFFCvtIEEEDoubleToNative(tif,count,(double*)origdata);
2510  ma=(double*)origdata;
2511  mb=data;
2512  for (n=0; n<count; n++)
2513  {
2514  double val = *ma++;
2515  if( val > FLT_MAX )
2516  val = FLT_MAX;
2517  else if( val < -FLT_MAX )
2518  val = -FLT_MAX;
2519  *mb++=(float)val;
2520  }
2521  }
2522  break;
2523  }
2524  _TIFFfree(origdata);
2525  *value=data;
2526  return(TIFFReadDirEntryErrOk);
2527 }
2528 
2529 static enum TIFFReadDirEntryErr
2530 TIFFReadDirEntryDoubleArray(TIFF* tif, TIFFDirEntry* direntry, double** value)
2531 {
2532  enum TIFFReadDirEntryErr err;
2533  uint32 count;
2534  void* origdata;
2535  double* data;
2536  switch (direntry->tdir_type)
2537  {
2538  case TIFF_BYTE:
2539  case TIFF_SBYTE:
2540  case TIFF_SHORT:
2541  case TIFF_SSHORT:
2542  case TIFF_LONG:
2543  case TIFF_SLONG:
2544  case TIFF_LONG8:
2545  case TIFF_SLONG8:
2546  case TIFF_RATIONAL:
2547  case TIFF_SRATIONAL:
2548  case TIFF_FLOAT:
2549  case TIFF_DOUBLE:
2550  break;
2551  default:
2552  return(TIFFReadDirEntryErrType);
2553  }
2554  err=TIFFReadDirEntryArray(tif,direntry,&count,8,&origdata);
2555  if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
2556  {
2557  *value=0;
2558  return(err);
2559  }
2560  switch (direntry->tdir_type)
2561  {
2562  case TIFF_DOUBLE:
2563  if (tif->tif_flags&TIFF_SWAB)
2564  TIFFSwabArrayOfLong8((uint64*)origdata,count);
2565  TIFFCvtIEEEDoubleToNative(tif,count,(double*)origdata);
2566  *value=(double*)origdata;
2567  return(TIFFReadDirEntryErrOk);
2568  }
2569  data=(double*)_TIFFmalloc(count*sizeof(double));
2570  if (data==0)
2571  {
2572  _TIFFfree(origdata);
2573  return(TIFFReadDirEntryErrAlloc);
2574  }
2575  switch (direntry->tdir_type)
2576  {
2577  case TIFF_BYTE:
2578  {
2579  uint8* ma;
2580  double* mb;
2581  uint32 n;
2582  ma=(uint8*)origdata;
2583  mb=data;
2584  for (n=0; n<count; n++)
2585  *mb++=(double)(*ma++);
2586  }
2587  break;
2588  case TIFF_SBYTE:
2589  {
2590  int8* ma;
2591  double* mb;
2592  uint32 n;
2593  ma=(int8*)origdata;
2594  mb=data;
2595  for (n=0; n<count; n++)
2596  *mb++=(double)(*ma++);
2597  }
2598  break;
2599  case TIFF_SHORT:
2600  {
2601  uint16* ma;
2602  double* mb;
2603  uint32 n;
2604  ma=(uint16*)origdata;
2605  mb=data;
2606  for (n=0; n<count; n++)
2607  {
2608  if (tif->tif_flags&TIFF_SWAB)
2609  TIFFSwabShort(ma);
2610  *mb++=(double)(*ma++);
2611  }
2612  }
2613  break;
2614  case TIFF_SSHORT:
2615  {
2616  int16* ma;
2617  double* mb;
2618  uint32 n;
2619  ma=(int16*)origdata;
2620  mb=data;
2621  for (n=0; n<count; n++)
2622  {
2623  if (tif->tif_flags&TIFF_SWAB)
2624  TIFFSwabShort((uint16*)ma);
2625  *mb++=(double)(*ma++);
2626  }
2627  }
2628  break;
2629  case TIFF_LONG:
2630  {
2631  uint32* ma;
2632  double* mb;
2633  uint32 n;
2634  ma=(uint32*)origdata;
2635  mb=data;
2636  for (n=0; n<count; n++)
2637  {
2638  if (tif->tif_flags&TIFF_SWAB)
2639  TIFFSwabLong(ma);
2640  *mb++=(double)(*ma++);
2641  }
2642  }
2643  break;
2644  case TIFF_SLONG:
2645  {
2646  int32* ma;
2647  double* mb;
2648  uint32 n;
2649  ma=(int32*)origdata;
2650  mb=data;
2651  for (n=0; n<count; n++)
2652  {
2653  if (tif->tif_flags&TIFF_SWAB)
2654  TIFFSwabLong((uint32*)ma);
2655  *mb++=(double)(*ma++);
2656  }
2657  }
2658  break;
2659  case TIFF_LONG8:
2660  {
2661  uint64* ma;
2662  double* mb;
2663  uint32 n;
2664  ma=(uint64*)origdata;
2665  mb=data;
2666  for (n=0; n<count; n++)
2667  {
2668  if (tif->tif_flags&TIFF_SWAB)
2669  TIFFSwabLong8(ma);
2670 #if defined(__WIN32__) && (_MSC_VER < 1500)
2671  /*
2672  * XXX: MSVC 6.0 does not support
2673  * conversion of 64-bit integers into
2674  * floating point values.
2675  */
2676  *mb++ = _TIFFUInt64ToDouble(*ma++);
2677 #else
2678  *mb++ = (double)(*ma++);
2679 #endif
2680  }
2681  }
2682  break;
2683  case TIFF_SLONG8:
2684  {
2685  int64* ma;
2686  double* mb;
2687  uint32 n;
2688  ma=(int64*)origdata;
2689  mb=data;
2690  for (n=0; n<count; n++)
2691  {
2692  if (tif->tif_flags&TIFF_SWAB)
2693  TIFFSwabLong8((uint64*)ma);
2694  *mb++=(double)(*ma++);
2695  }
2696  }
2697  break;
2698  case TIFF_RATIONAL:
2699  {
2700  uint32* ma;
2701  uint32 maa;
2702  uint32 mab;
2703  double* mb;
2704  uint32 n;
2705  ma=(uint32*)origdata;
2706  mb=data;
2707  for (n=0; n<count; n++)
2708  {
2709  if (tif->tif_flags&TIFF_SWAB)
2710  TIFFSwabLong(ma);
2711  maa=*ma++;
2712  if (tif->tif_flags&TIFF_SWAB)
2713  TIFFSwabLong(ma);
2714  mab=*ma++;
2715  if (mab==0)
2716  *mb++=0.0;
2717  else
2718  *mb++=(double)maa/(double)mab;
2719  }
2720  }
2721  break;
2722  case TIFF_SRATIONAL:
2723  {
2724  uint32* ma;
2725  int32 maa;
2726  uint32 mab;
2727  double* mb;
2728  uint32 n;
2729  ma=(uint32*)origdata;
2730  mb=data;
2731  for (n=0; n<count; n++)
2732  {
2733  if (tif->tif_flags&TIFF_SWAB)
2734  TIFFSwabLong(ma);
2735  maa=*(int32*)ma;
2736  ma++;
2737  if (tif->tif_flags&TIFF_SWAB)
2738  TIFFSwabLong(ma);
2739  mab=*ma++;
2740  if (mab==0)
2741  *mb++=0.0;
2742  else
2743  *mb++=(double)maa/(double)mab;
2744  }
2745  }
2746  break;
2747  case TIFF_FLOAT:
2748  {
2749  float* ma;
2750  double* mb;
2751  uint32 n;
2752  if (tif->tif_flags&TIFF_SWAB)
2753  TIFFSwabArrayOfLong((uint32*)origdata,count);
2754  TIFFCvtIEEEFloatToNative(tif,count,(float*)origdata);
2755  ma=(float*)origdata;
2756  mb=data;
2757  for (n=0; n<count; n++)
2758  *mb++=(double)(*ma++);
2759  }
2760  break;
2761  }
2762  _TIFFfree(origdata);
2763  *value=data;
2764  return(TIFFReadDirEntryErrOk);
2765 }
2766 
2767 static enum TIFFReadDirEntryErr TIFFReadDirEntryIfd8Array(TIFF* tif, TIFFDirEntry* direntry, uint64** value)
2768 {
2769  enum TIFFReadDirEntryErr err;
2770  uint32 count;
2771  void* origdata;
2772  uint64* data;
2773  switch (direntry->tdir_type)
2774  {
2775  case TIFF_LONG:
2776  case TIFF_LONG8:
2777  case TIFF_IFD:
2778  case TIFF_IFD8:
2779  break;
2780  default:
2781  return(TIFFReadDirEntryErrType);
2782  }
2783  err=TIFFReadDirEntryArray(tif,direntry,&count,8,&origdata);
2784  if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
2785  {
2786  *value=0;
2787  return(err);
2788  }
2789  switch (direntry->tdir_type)
2790  {
2791  case TIFF_LONG8:
2792  case TIFF_IFD8:
2793  *value=(uint64*)origdata;
2794  if (tif->tif_flags&TIFF_SWAB)
2795  TIFFSwabArrayOfLong8(*value,count);
2796  return(TIFFReadDirEntryErrOk);
2797  }
2798  data=(uint64*)_TIFFmalloc(count*8);
2799  if (data==0)
2800  {
2801  _TIFFfree(origdata);
2802  return(TIFFReadDirEntryErrAlloc);
2803  }
2804  switch (direntry->tdir_type)
2805  {
2806  case TIFF_LONG:
2807  case TIFF_IFD:
2808  {
2809  uint32* ma;
2810  uint64* mb;
2811  uint32 n;
2812  ma=(uint32*)origdata;
2813  mb=data;
2814  for (n=0; n<count; n++)
2815  {
2816  if (tif->tif_flags&TIFF_SWAB)
2817  TIFFSwabLong(ma);
2818  *mb++=(uint64)(*ma++);
2819  }
2820  }
2821  break;
2822  }
2823  _TIFFfree(origdata);
2824  *value=data;
2825  return(TIFFReadDirEntryErrOk);
2826 }
2827 
2828 static enum TIFFReadDirEntryErr TIFFReadDirEntryPersampleShort(TIFF* tif, TIFFDirEntry* direntry, uint16* value)
2829 {
2830  enum TIFFReadDirEntryErr err;
2831  uint16* m;
2832  uint16* na;
2833  uint16 nb;
2834  if (direntry->tdir_count<(uint64)tif->tif_dir.td_samplesperpixel)
2835  return(TIFFReadDirEntryErrCount);
2836  err=TIFFReadDirEntryShortArray(tif,direntry,&m);
2837  if (err!=TIFFReadDirEntryErrOk || m == NULL)
2838  return(err);
2839  na=m;
2840  nb=tif->tif_dir.td_samplesperpixel;
2841  *value=*na++;
2842  nb--;
2843  while (nb>0)
2844  {
2845  if (*na++!=*value)
2846  {
2847  err=TIFFReadDirEntryErrPsdif;
2848  break;
2849  }
2850  nb--;
2851  }
2852  _TIFFfree(m);
2853  return(err);
2854 }
2855 
2856 #if 0
2857 static enum TIFFReadDirEntryErr TIFFReadDirEntryPersampleDouble(TIFF* tif, TIFFDirEntry* direntry, double* value)
2858 {
2859  enum TIFFReadDirEntryErr err;
2860  double* m;
2861  double* na;
2862  uint16 nb;
2863  if (direntry->tdir_count<(uint64)tif->tif_dir.td_samplesperpixel)
2864  return(TIFFReadDirEntryErrCount);
2865  err=TIFFReadDirEntryDoubleArray(tif,direntry,&m);
2866  if (err!=TIFFReadDirEntryErrOk)
2867  return(err);
2868  na=m;
2869  nb=tif->tif_dir.td_samplesperpixel;
2870  *value=*na++;
2871  nb--;
2872  while (nb>0)
2873  {
2874  if (*na++!=*value)
2875  {
2876  err=TIFFReadDirEntryErrPsdif;
2877  break;
2878  }
2879  nb--;
2880  }
2881  _TIFFfree(m);
2882  return(err);
2883 }
2884 #endif
2885 
2886 static void TIFFReadDirEntryCheckedByte(TIFF* tif, TIFFDirEntry* direntry, uint8* value)
2887 {
2888  (void) tif;
2889  *value=*(uint8*)(&direntry->tdir_offset);
2890 }
2891 
2892 static void TIFFReadDirEntryCheckedSbyte(TIFF* tif, TIFFDirEntry* direntry, int8* value)
2893 {
2894  (void) tif;
2895  *value=*(int8*)(&direntry->tdir_offset);
2896 }
2897 
2898 static void TIFFReadDirEntryCheckedShort(TIFF* tif, TIFFDirEntry* direntry, uint16* value)
2899 {
2900  *value = direntry->tdir_offset.toff_short;
2901  /* *value=*(uint16*)(&direntry->tdir_offset); */
2902  if (tif->tif_flags&TIFF_SWAB)
2903  TIFFSwabShort(value);
2904 }
2905 
2906 static void TIFFReadDirEntryCheckedSshort(TIFF* tif, TIFFDirEntry* direntry, int16* value)
2907 {
2908  *value=*(int16*)(&direntry->tdir_offset);
2909  if (tif->tif_flags&TIFF_SWAB)
2910  TIFFSwabShort((uint16*)value);
2911 }
2912 
2913 static void TIFFReadDirEntryCheckedLong(TIFF* tif, TIFFDirEntry* direntry, uint32* value)
2914 {
2915  *value=*(uint32*)(&direntry->tdir_offset);
2916  if (tif->tif_flags&TIFF_SWAB)
2917  TIFFSwabLong(value);
2918 }
2919 
2920 static void TIFFReadDirEntryCheckedSlong(TIFF* tif, TIFFDirEntry* direntry, int32* value)
2921 {
2922  *value=*(int32*)(&direntry->tdir_offset);
2923  if (tif->tif_flags&TIFF_SWAB)
2924  TIFFSwabLong((uint32*)value);
2925 }
2926 
2927 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedLong8(TIFF* tif, TIFFDirEntry* direntry, uint64* value)
2928 {
2929  if (!(tif->tif_flags&TIFF_BIGTIFF))
2930  {
2931  enum TIFFReadDirEntryErr err;
2932  uint32 offset = direntry->tdir_offset.toff_long;
2933  if (tif->tif_flags&TIFF_SWAB)
2934  TIFFSwabLong(&offset);
2935  err=TIFFReadDirEntryData(tif,offset,8,value);
2936  if (err!=TIFFReadDirEntryErrOk)
2937  return(err);
2938  }
2939  else
2940  *value = direntry->tdir_offset.toff_long8;
2941  if (tif->tif_flags&TIFF_SWAB)
2942  TIFFSwabLong8(value);
2943  return(TIFFReadDirEntryErrOk);
2944 }
2945 
2946 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedSlong8(TIFF* tif, TIFFDirEntry* direntry, int64* value)
2947 {
2948  if (!(tif->tif_flags&TIFF_BIGTIFF))
2949  {
2950  enum TIFFReadDirEntryErr err;
2951  uint32 offset = direntry->tdir_offset.toff_long;
2952  if (tif->tif_flags&TIFF_SWAB)
2953  TIFFSwabLong(&offset);
2954  err=TIFFReadDirEntryData(tif,offset,8,value);
2955  if (err!=TIFFReadDirEntryErrOk)
2956  return(err);
2957  }
2958  else
2959  *value=*(int64*)(&direntry->tdir_offset);
2960  if (tif->tif_flags&TIFF_SWAB)
2961  TIFFSwabLong8((uint64*)value);
2962  return(TIFFReadDirEntryErrOk);
2963 }
2964 
2965 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedRational(TIFF* tif, TIFFDirEntry* direntry, double* value)
2966 {
2967  UInt64Aligned_t m;
2968 
2969  assert(sizeof(double)==8);
2970  assert(sizeof(uint64)==8);
2971  assert(sizeof(uint32)==4);
2972  if (!(tif->tif_flags&TIFF_BIGTIFF))
2973  {
2974  enum TIFFReadDirEntryErr err;
2975  uint32 offset = direntry->tdir_offset.toff_long;
2976  if (tif->tif_flags&TIFF_SWAB)
2977  TIFFSwabLong(&offset);
2978  err=TIFFReadDirEntryData(tif,offset,8,m.i);
2979  if (err!=TIFFReadDirEntryErrOk)
2980  return(err);
2981  }
2982  else
2983  m.l = direntry->tdir_offset.toff_long8;
2984  if (tif->tif_flags&TIFF_SWAB)
2985  TIFFSwabArrayOfLong(m.i,2);
2986  /* Not completely sure what we should do when m.i[1]==0, but some */
2987  /* sanitizers do not like division by 0.0: */
2988  /* http://bugzilla.maptools.org/show_bug.cgi?id=2644 */
2989  if (m.i[0]==0 || m.i[1]==0)
2990  *value=0.0;
2991  else
2992  *value=(double)m.i[0]/(double)m.i[1];
2993  return(TIFFReadDirEntryErrOk);
2994 }
2995 
2996 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedSrational(TIFF* tif, TIFFDirEntry* direntry, double* value)
2997 {
2998  UInt64Aligned_t m;
2999  assert(sizeof(double)==8);
3000  assert(sizeof(uint64)==8);
3001  assert(sizeof(int32)==4);
3002  assert(sizeof(uint32)==4);
3003  if (!(tif->tif_flags&TIFF_BIGTIFF))
3004  {
3005  enum TIFFReadDirEntryErr err;
3006  uint32 offset = direntry->tdir_offset.toff_long;
3007  if (tif->tif_flags&TIFF_SWAB)
3008  TIFFSwabLong(&offset);
3009  err=TIFFReadDirEntryData(tif,offset,8,m.i);
3010  if (err!=TIFFReadDirEntryErrOk)
3011  return(err);
3012  }
3013  else
3014  m.l=direntry->tdir_offset.toff_long8;
3015  if (tif->tif_flags&TIFF_SWAB)
3016  TIFFSwabArrayOfLong(m.i,2);
3017  /* Not completely sure what we should do when m.i[1]==0, but some */
3018  /* sanitizers do not like division by 0.0: */
3019  /* http://bugzilla.maptools.org/show_bug.cgi?id=2644 */
3020  if ((int32)m.i[0]==0 || m.i[1]==0)
3021  *value=0.0;
3022  else
3023  *value=(double)((int32)m.i[0])/(double)m.i[1];
3024  return(TIFFReadDirEntryErrOk);
3025 }
3026 
3027 static void TIFFReadDirEntryCheckedFloat(TIFF* tif, TIFFDirEntry* direntry, float* value)
3028 {
3029  union
3030  {
3031  float f;
3032  uint32 i;
3033  } float_union;
3034  assert(sizeof(float)==4);
3035  assert(sizeof(uint32)==4);
3036  assert(sizeof(float_union)==4);
3037  float_union.i=*(uint32*)(&direntry->tdir_offset);
3038  *value=float_union.f;
3039  if (tif->tif_flags&TIFF_SWAB)
3040  TIFFSwabLong((uint32*)value);
3041 }
3042 
3043 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedDouble(TIFF* tif, TIFFDirEntry* direntry, double* value)
3044 {
3045  assert(sizeof(double)==8);
3046  assert(sizeof(uint64)==8);
3047  assert(sizeof(UInt64Aligned_t)==8);
3048  if (!(tif->tif_flags&TIFF_BIGTIFF))
3049  {
3050  enum TIFFReadDirEntryErr err;
3051  uint32 offset = direntry->tdir_offset.toff_long;
3052  if (tif->tif_flags&TIFF_SWAB)
3053  TIFFSwabLong(&offset);
3054  err=TIFFReadDirEntryData(tif,offset,8,value);
3055  if (err!=TIFFReadDirEntryErrOk)
3056  return(err);
3057  }
3058  else
3059  {
3060  UInt64Aligned_t uint64_union;
3061  uint64_union.l=direntry->tdir_offset.toff_long8;
3062  *value=uint64_union.d;
3063  }
3064  if (tif->tif_flags&TIFF_SWAB)
3065  TIFFSwabLong8((uint64*)value);
3066  return(TIFFReadDirEntryErrOk);
3067 }
3068 
3069 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSbyte(int8 value)
3070 {
3071  if (value<0)
3072  return(TIFFReadDirEntryErrRange);
3073  else
3074  return(TIFFReadDirEntryErrOk);
3075 }
3076 
3077 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteShort(uint16 value)
3078 {
3079  if (value>0xFF)
3080  return(TIFFReadDirEntryErrRange);
3081  else
3082  return(TIFFReadDirEntryErrOk);
3083 }
3084 
3085 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSshort(int16 value)
3086 {
3087  if ((value<0)||(value>0xFF))
3088  return(TIFFReadDirEntryErrRange);
3089  else
3090  return(TIFFReadDirEntryErrOk);
3091 }
3092 
3093 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteLong(uint32 value)
3094 {
3095  if (value>0xFF)
3096  return(TIFFReadDirEntryErrRange);
3097  else
3098  return(TIFFReadDirEntryErrOk);
3099 }
3100 
3101 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSlong(int32 value)
3102 {
3103  if ((value<0)||(value>0xFF))
3104  return(TIFFReadDirEntryErrRange);
3105  else
3106  return(TIFFReadDirEntryErrOk);
3107 }
3108 
3109 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteLong8(uint64 value)
3110 {
3111  if (value>0xFF)
3112  return(TIFFReadDirEntryErrRange);
3113  else
3114  return(TIFFReadDirEntryErrOk);
3115 }
3116 
3117 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSlong8(int64 value)
3118 {
3119  if ((value<0)||(value>0xFF))
3120  return(TIFFReadDirEntryErrRange);
3121  else
3122  return(TIFFReadDirEntryErrOk);
3123 }
3124 
3125 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteByte(uint8 value)
3126 {
3127  if (value>0x7F)
3128  return(TIFFReadDirEntryErrRange);
3129  else
3130  return(TIFFReadDirEntryErrOk);
3131 }
3132 
3133 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteShort(uint16 value)
3134 {
3135  if (value>0x7F)
3136  return(TIFFReadDirEntryErrRange);
3137  else
3138  return(TIFFReadDirEntryErrOk);
3139 }
3140 
3141 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteSshort(int16 value)
3142 {
3143  if ((value<-0x80)||(value>0x7F))
3144  return(TIFFReadDirEntryErrRange);
3145  else
3146  return(TIFFReadDirEntryErrOk);
3147 }
3148 
3149 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteLong(uint32 value)
3150 {
3151  if (value>0x7F)
3152  return(TIFFReadDirEntryErrRange);
3153  else
3154  return(TIFFReadDirEntryErrOk);
3155 }
3156 
3157 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteSlong(int32 value)
3158 {
3159  if ((value<-0x80)||(value>0x7F))
3160  return(TIFFReadDirEntryErrRange);
3161  else
3162  return(TIFFReadDirEntryErrOk);
3163 }
3164 
3165 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteLong8(uint64 value)
3166 {
3167  if (value>0x7F)
3168  return(TIFFReadDirEntryErrRange);
3169  else
3170  return(TIFFReadDirEntryErrOk);
3171 }
3172 
3173 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteSlong8(int64 value)
3174 {
3175  if ((value<-0x80)||(value>0x7F))
3176  return(TIFFReadDirEntryErrRange);
3177  else
3178  return(TIFFReadDirEntryErrOk);
3179 }
3180 
3181 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSbyte(int8 value)
3182 {
3183  if (value<0)
3184  return(TIFFReadDirEntryErrRange);
3185  else
3186  return(TIFFReadDirEntryErrOk);
3187 }
3188 
3189 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSshort(int16 value)
3190 {
3191  if (value<0)
3192  return(TIFFReadDirEntryErrRange);
3193  else
3194  return(TIFFReadDirEntryErrOk);
3195 }
3196 
3197 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortLong(uint32 value)
3198 {
3199  if (value>0xFFFF)
3200  return(TIFFReadDirEntryErrRange);
3201  else
3202  return(TIFFReadDirEntryErrOk);
3203 }
3204 
3205 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSlong(int32 value)
3206 {
3207  if ((value<0)||(value>0xFFFF))
3208  return(TIFFReadDirEntryErrRange);
3209  else
3210  return(TIFFReadDirEntryErrOk);
3211 }
3212 
3213 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortLong8(uint64 value)
3214 {
3215  if (value>0xFFFF)
3216  return(TIFFReadDirEntryErrRange);
3217  else
3218  return(TIFFReadDirEntryErrOk);
3219 }
3220 
3221 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSlong8(int64 value)
3222 {
3223  if ((value<0)||(value>0xFFFF))
3224  return(TIFFReadDirEntryErrRange);
3225  else
3226  return(TIFFReadDirEntryErrOk);
3227 }
3228 
3229 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortShort(uint16 value)
3230 {
3231  if (value>0x7FFF)
3232  return(TIFFReadDirEntryErrRange);
3233  else
3234  return(TIFFReadDirEntryErrOk);
3235 }
3236 
3237 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortLong(uint32 value)
3238 {
3239  if (value>0x7FFF)
3240  return(TIFFReadDirEntryErrRange);
3241  else
3242  return(TIFFReadDirEntryErrOk);
3243 }
3244 
3245 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortSlong(int32 value)
3246 {
3247  if ((value<-0x8000)||(value>0x7FFF))
3248  return(TIFFReadDirEntryErrRange);
3249  else
3250  return(TIFFReadDirEntryErrOk);
3251 }
3252 
3253 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortLong8(uint64 value)
3254 {
3255  if (value>0x7FFF)
3256  return(TIFFReadDirEntryErrRange);
3257  else
3258  return(TIFFReadDirEntryErrOk);
3259 }
3260 
3261 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortSlong8(int64 value)
3262 {
3263  if ((value<-0x8000)||(value>0x7FFF))
3264  return(TIFFReadDirEntryErrRange);
3265  else
3266  return(TIFFReadDirEntryErrOk);
3267 }
3268 
3269 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongSbyte(int8 value)
3270 {
3271  if (value<0)
3272  return(TIFFReadDirEntryErrRange);
3273  else
3274  return(TIFFReadDirEntryErrOk);
3275 }
3276 
3277 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongSshort(int16 value)
3278 {
3279  if (value<0)
3280  return(TIFFReadDirEntryErrRange);
3281  else
3282  return(TIFFReadDirEntryErrOk);
3283 }
3284 
3285 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongSlong(int32 value)
3286 {
3287  if (value<0)
3288  return(TIFFReadDirEntryErrRange);
3289  else
3290  return(TIFFReadDirEntryErrOk);
3291 }
3292 
3293 static enum TIFFReadDirEntryErr
3294 TIFFReadDirEntryCheckRangeLongLong8(uint64 value)
3295 {
3296  if (value > TIFF_UINT32_MAX)
3297  return(TIFFReadDirEntryErrRange);
3298  else
3299  return(TIFFReadDirEntryErrOk);
3300 }
3301 
3302 static enum TIFFReadDirEntryErr
3303 TIFFReadDirEntryCheckRangeLongSlong8(int64 value)
3304 {
3305  if ((value < 0) || (value > (int64) TIFF_UINT32_MAX))
3306  return(TIFFReadDirEntryErrRange);
3307  else
3308  return(TIFFReadDirEntryErrOk);
3309 }
3310 
3311 static enum TIFFReadDirEntryErr
3312 TIFFReadDirEntryCheckRangeSlongLong(uint32 value)
3313 {
3314  if (value > 0x7FFFFFFFUL)
3315  return(TIFFReadDirEntryErrRange);
3316  else
3317  return(TIFFReadDirEntryErrOk);
3318 }
3319 
3320 /* Check that the 8-byte unsigned value can fit in a 4-byte unsigned range */
3321 static enum TIFFReadDirEntryErr
3322 TIFFReadDirEntryCheckRangeSlongLong8(uint64 value)
3323 {
3324  if (value > 0x7FFFFFFF)
3325  return(TIFFReadDirEntryErrRange);
3326  else
3327  return(TIFFReadDirEntryErrOk);
3328 }
3329 
3330 /* Check that the 8-byte signed value can fit in a 4-byte signed range */
3331 static enum TIFFReadDirEntryErr
3332 TIFFReadDirEntryCheckRangeSlongSlong8(int64 value)
3333 {
3334  if ((value < 0-((int64) 0x7FFFFFFF+1)) || (value > 0x7FFFFFFF))
3335  return(TIFFReadDirEntryErrRange);
3336  else
3337  return(TIFFReadDirEntryErrOk);
3338 }
3339 
3340 static enum TIFFReadDirEntryErr
3341 TIFFReadDirEntryCheckRangeLong8Sbyte(int8 value)
3342 {
3343  if (value < 0)
3344  return(TIFFReadDirEntryErrRange);
3345  else
3346  return(TIFFReadDirEntryErrOk);
3347 }
3348 
3349 static enum TIFFReadDirEntryErr
3350 TIFFReadDirEntryCheckRangeLong8Sshort(int16 value)
3351 {
3352  if (value < 0)
3353  return(TIFFReadDirEntryErrRange);
3354  else
3355  return(TIFFReadDirEntryErrOk);
3356 }
3357 
3358 static enum TIFFReadDirEntryErr
3359 TIFFReadDirEntryCheckRangeLong8Slong(int32 value)
3360 {
3361  if (value < 0)
3362  return(TIFFReadDirEntryErrRange);
3363  else
3364  return(TIFFReadDirEntryErrOk);
3365 }
3366 
3367 static enum TIFFReadDirEntryErr
3368 TIFFReadDirEntryCheckRangeLong8Slong8(int64 value)
3369 {
3370  if (value < 0)
3371  return(TIFFReadDirEntryErrRange);
3372  else
3373  return(TIFFReadDirEntryErrOk);
3374 }
3375 
3376 static enum TIFFReadDirEntryErr
3377 TIFFReadDirEntryCheckRangeSlong8Long8(uint64 value)
3378 {
3379  if (value > TIFF_INT64_MAX)
3380  return(TIFFReadDirEntryErrRange);
3381  else
3382  return(TIFFReadDirEntryErrOk);
3383 }
3384 
3385 static enum TIFFReadDirEntryErr
3386 TIFFReadDirEntryData(TIFF* tif, uint64 offset, tmsize_t size, void* dest)
3387 {
3388  assert(size>0);
3389  if (!isMapped(tif)) {
3390  if (!SeekOK(tif,offset))
3391  return(TIFFReadDirEntryErrIo);
3392  if (!ReadOK(tif,dest,size))
3393  return(TIFFReadDirEntryErrIo);
3394  } else {
3395  size_t ma,mb;
3396  ma=(size_t)offset;
3397  if( (uint64)ma!=offset ||
3398  ma > (~(size_t)0) - (size_t)size )
3399  {
3400  return TIFFReadDirEntryErrIo;
3401  }
3402  mb=ma+size;
3403  if (mb > (size_t)tif->tif_size)
3404  return(TIFFReadDirEntryErrIo);
3405  _TIFFmemcpy(dest,tif->tif_base+ma,size);
3406  }
3407  return(TIFFReadDirEntryErrOk);
3408 }
3409 
3410 static void TIFFReadDirEntryOutputErr(TIFF* tif, enum TIFFReadDirEntryErr err, const char* module, const char* tagname, int recover)
3411 {
3412  if (!recover) {
3413  switch (err) {
3414  case TIFFReadDirEntryErrCount:
3415  TIFFErrorExt(tif->tif_clientdata, module,
3416  "Incorrect count for \"%s\"",
3417  tagname);
3418  break;
3419  case TIFFReadDirEntryErrType:
3420  TIFFErrorExt(tif->tif_clientdata, module,
3421  "Incompatible type for \"%s\"",
3422  tagname);
3423  break;
3424  case TIFFReadDirEntryErrIo:
3425  TIFFErrorExt(tif->tif_clientdata, module,
3426  "IO error during reading of \"%s\"",
3427  tagname);
3428  break;
3429  case TIFFReadDirEntryErrRange:
3430  TIFFErrorExt(tif->tif_clientdata, module,
3431  "Incorrect value for \"%s\"",
3432  tagname);
3433  break;
3434  case TIFFReadDirEntryErrPsdif:
3435  TIFFErrorExt(tif->tif_clientdata, module,
3436  "Cannot handle different values per sample for \"%s\"",
3437  tagname);
3438  break;
3439  case TIFFReadDirEntryErrSizesan:
3440  TIFFErrorExt(tif->tif_clientdata, module,
3441  "Sanity check on size of \"%s\" value failed",
3442  tagname);
3443  break;
3444  case TIFFReadDirEntryErrAlloc:
3445  TIFFErrorExt(tif->tif_clientdata, module,
3446  "Out of memory reading of \"%s\"",
3447  tagname);
3448  break;
3449  default:
3450  assert(0); /* we should never get here */
3451  break;
3452  }
3453  } else {
3454  switch (err) {
3455  case TIFFReadDirEntryErrCount:
3456  TIFFWarningExt(tif->tif_clientdata, module,
3457  "Incorrect count for \"%s\"; tag ignored",
3458  tagname);
3459  break;
3460  case TIFFReadDirEntryErrType:
3461  TIFFWarningExt(tif->tif_clientdata, module,
3462  "Incompatible type for \"%s\"; tag ignored",
3463  tagname);
3464  break;
3465  case TIFFReadDirEntryErrIo:
3466  TIFFWarningExt(tif->tif_clientdata, module,
3467  "IO error during reading of \"%s\"; tag ignored",
3468  tagname);
3469  break;
3470  case TIFFReadDirEntryErrRange:
3471  TIFFWarningExt(tif->tif_clientdata, module,
3472  "Incorrect value for \"%s\"; tag ignored",
3473  tagname);
3474  break;
3475  case TIFFReadDirEntryErrPsdif:
3476  TIFFWarningExt(tif->tif_clientdata, module,
3477  "Cannot handle different values per sample for \"%s\"; tag ignored",
3478  tagname);
3479  break;
3480  case TIFFReadDirEntryErrSizesan:
3481  TIFFWarningExt(tif->tif_clientdata, module,
3482  "Sanity check on size of \"%s\" value failed; tag ignored",
3483  tagname);
3484  break;
3485  case TIFFReadDirEntryErrAlloc:
3486  TIFFWarningExt(tif->tif_clientdata, module,
3487  "Out of memory reading of \"%s\"; tag ignored",
3488  tagname);
3489  break;
3490  default:
3491  assert(0); /* we should never get here */
3492  break;
3493  }
3494  }
3495 }
3496 
3497 /*
3498  * Return the maximum number of color channels specified for a given photometric
3499  * type. 0 is returned if photometric type isn't supported or no default value
3500  * is defined by the specification.
3501  */
3502 static int _TIFFGetMaxColorChannels( uint16 photometric )
3503 {
3504  switch (photometric) {
3505  case PHOTOMETRIC_PALETTE:
3506  case PHOTOMETRIC_MINISWHITE:
3507  case PHOTOMETRIC_MINISBLACK:
3508  return 1;
3509  case PHOTOMETRIC_YCBCR:
3510  case PHOTOMETRIC_RGB:
3511  case PHOTOMETRIC_CIELAB:
3512  case PHOTOMETRIC_LOGLUV:
3513  case PHOTOMETRIC_ITULAB:
3514  case PHOTOMETRIC_ICCLAB:
3515  return 3;
3516  case PHOTOMETRIC_SEPARATED:
3517  case PHOTOMETRIC_MASK:
3518  return 4;
3519  case PHOTOMETRIC_LOGL:
3520  case PHOTOMETRIC_CFA:
3521  default:
3522  return 0;
3523  }
3524 }
3525 
3526 static int ByteCountLooksBad(TIFF* tif)
3527 {
3528  /*
3529  * Assume we have wrong StripByteCount value (in case
3530  * of single strip) in following cases:
3531  * - it is equal to zero along with StripOffset;
3532  * - it is larger than file itself (in case of uncompressed
3533  * image);
3534  * - it is smaller than the size of the bytes per row
3535  * multiplied on the number of rows. The last case should
3536  * not be checked in the case of writing new image,
3537  * because we may do not know the exact strip size
3538  * until the whole image will be written and directory
3539  * dumped out.
3540  */
3541  uint64 bytecount = TIFFGetStrileByteCount(tif, 0);
3542  uint64 offset = TIFFGetStrileOffset(tif, 0);
3543  uint64 filesize;
3544 
3545  if( offset == 0 )
3546  return 0;
3547  if (bytecount == 0)
3548  return 1;
3549  if ( tif->tif_dir.td_compression != COMPRESSION_NONE )
3550  return 0;
3551  filesize = TIFFGetFileSize(tif);
3552  if( offset <= filesize && bytecount > filesize - offset )
3553  return 1;
3554  if( tif->tif_mode == O_RDONLY )
3555  {
3556  uint64 scanlinesize = TIFFScanlineSize64(tif);
3557  if( tif->tif_dir.td_imagelength > 0 &&
3558  scanlinesize > TIFF_UINT64_MAX / tif->tif_dir.td_imagelength )
3559  {
3560  return 1;
3561  }
3562  if( bytecount < scanlinesize * tif->tif_dir.td_imagelength)
3563  return 1;
3564  }
3565  return 0;
3566 }
3567 
3568 
3569 /*
3570  * Read the next TIFF directory from a file and convert it to the internal
3571  * format. We read directories sequentially.
3572  */
3573 int
3574 TIFFReadDirectory(TIFF* tif)
3575 {
3576  static const char module[] = "TIFFReadDirectory";
3577  TIFFDirEntry* dir;
3578  uint16 dircount;
3579  TIFFDirEntry* dp;
3580  uint16 di;
3581  const TIFFField* fip;
3582  uint32 fii=FAILED_FII;
3583  toff_t nextdiroff;
3584  int bitspersample_read = FALSE;
3585  int color_channels;
3586 
3587  tif->tif_diroff=tif->tif_nextdiroff;
3588  if (!TIFFCheckDirOffset(tif,tif->tif_nextdiroff))
3589  return 0; /* last offset or bad offset (IFD looping) */
3590  (*tif->tif_cleanup)(tif); /* cleanup any previous compression state */
3591  tif->tif_curdir++;
3592  nextdiroff = tif->tif_nextdiroff;
3593  dircount=TIFFFetchDirectory(tif,nextdiroff,&dir,&tif->tif_nextdiroff);
3594  if (!dircount)
3595  {
3596  TIFFErrorExt(tif->tif_clientdata,module,
3597  "Failed to read directory at offset " TIFF_UINT64_FORMAT,nextdiroff);
3598  return 0;
3599  }
3600  TIFFReadDirectoryCheckOrder(tif,dir,dircount);
3601 
3602  /*
3603  * Mark duplicates of any tag to be ignored (bugzilla 1994)
3604  * to avoid certain pathological problems.
3605  */
3606  {
3607  TIFFDirEntry* ma;
3608  uint16 mb;
3609  for (ma=dir, mb=0; mb<dircount; ma++, mb++)
3610  {
3611  TIFFDirEntry* na;
3612  uint16 nb;
3613  for (na=ma+1, nb=mb+1; nb<dircount; na++, nb++)
3614  {
3615  if (ma->tdir_tag == na->tdir_tag) {
3616  na->tdir_ignore = TRUE;
3617  }
3618  }
3619  }
3620  }
3621 
3622  tif->tif_flags &= ~TIFF_BEENWRITING; /* reset before new dir */
3623  tif->tif_flags &= ~TIFF_BUF4WRITE; /* reset before new dir */
3624  tif->tif_flags &= ~TIFF_CHOPPEDUPARRAYS;
3625 
3626  /* free any old stuff and reinit */
3627  TIFFFreeDirectory(tif);
3628  TIFFDefaultDirectory(tif);
3629  /*
3630  * Electronic Arts writes gray-scale TIFF files
3631  * without a PlanarConfiguration directory entry.
3632  * Thus we setup a default value here, even though
3633  * the TIFF spec says there is no default value.
3634  */
3635  TIFFSetField(tif,TIFFTAG_PLANARCONFIG,PLANARCONFIG_CONTIG);
3636  /*
3637  * Setup default value and then make a pass over
3638  * the fields to check type and tag information,
3639  * and to extract info required to size data
3640  * structures. A second pass is made afterwards
3641  * to read in everything not taken in the first pass.
3642  * But we must process the Compression tag first
3643  * in order to merge in codec-private tag definitions (otherwise
3644  * we may get complaints about unknown tags). However, the
3645  * Compression tag may be dependent on the SamplesPerPixel
3646  * tag value because older TIFF specs permitted Compression
3647  * to be written as a SamplesPerPixel-count tag entry.
3648  * Thus if we don't first figure out the correct SamplesPerPixel
3649  * tag value then we may end up ignoring the Compression tag
3650  * value because it has an incorrect count value (if the
3651  * true value of SamplesPerPixel is not 1).
3652  */
3653  dp=TIFFReadDirectoryFindEntry(tif,dir,dircount,TIFFTAG_SAMPLESPERPIXEL);
3654  if (dp)
3655  {
3656  if (!TIFFFetchNormalTag(tif,dp,0))
3657  goto bad;
3658  dp->tdir_ignore = TRUE;
3659  }
3660  dp=TIFFReadDirectoryFindEntry(tif,dir,dircount,TIFFTAG_COMPRESSION);
3661  if (dp)
3662  {
3663  /*
3664  * The 5.0 spec says the Compression tag has one value, while
3665  * earlier specs say it has one value per sample. Because of
3666  * this, we accept the tag if one value is supplied with either
3667  * count.
3668  */
3669  uint16 value;
3670  enum TIFFReadDirEntryErr err;
3671  err=TIFFReadDirEntryShort(tif,dp,&value);
3672  if (err==TIFFReadDirEntryErrCount)
3673  err=TIFFReadDirEntryPersampleShort(tif,dp,&value);
3674  if (err!=TIFFReadDirEntryErrOk)
3675  {
3676  TIFFReadDirEntryOutputErr(tif,err,module,"Compression",0);
3677  goto bad;
3678  }
3679  if (!TIFFSetField(tif,TIFFTAG_COMPRESSION,value))
3680  goto bad;
3681  dp->tdir_ignore = TRUE;
3682  }
3683  else
3684  {
3685  if (!TIFFSetField(tif,TIFFTAG_COMPRESSION,COMPRESSION_NONE))
3686  goto bad;
3687  }
3688  /*
3689  * First real pass over the directory.
3690  */
3691  for (di=0, dp=dir; di<dircount; di++, dp++)
3692  {
3693  if (!dp->tdir_ignore)
3694  {
3695  TIFFReadDirectoryFindFieldInfo(tif,dp->tdir_tag,&fii);
3696  if (fii == FAILED_FII)
3697  {
3698  TIFFWarningExt(tif->tif_clientdata, module,
3699  "Unknown field with tag %d (0x%x) encountered",
3700  dp->tdir_tag,dp->tdir_tag);
3701  /* the following knowingly leaks the
3702  anonymous field structure */
3703  if (!_TIFFMergeFields(tif,
3704  _TIFFCreateAnonField(tif,
3705  dp->tdir_tag,
3706  (TIFFDataType) dp->tdir_type),
3707  1)) {
3708  TIFFWarningExt(tif->tif_clientdata,
3709  module,
3710  "Registering anonymous field with tag %d (0x%x) failed",
3711  dp->tdir_tag,
3712  dp->tdir_tag);
3713  dp->tdir_ignore = TRUE;
3714  } else {
3715  TIFFReadDirectoryFindFieldInfo(tif,dp->tdir_tag,&fii);
3716  assert(fii != FAILED_FII);
3717  }
3718  }
3719  }
3720  if (!dp->tdir_ignore)
3721  {
3722  fip=tif->tif_fields[fii];
3723  if (fip->field_bit==FIELD_IGNORE)
3724  dp->tdir_ignore = TRUE;
3725  else
3726  {
3727  switch (dp->tdir_tag)
3728  {
3729  case TIFFTAG_STRIPOFFSETS:
3730  case TIFFTAG_STRIPBYTECOUNTS:
3731  case TIFFTAG_TILEOFFSETS:
3732  case TIFFTAG_TILEBYTECOUNTS:
3733  TIFFSetFieldBit(tif,fip->field_bit);
3734  break;
3735  case TIFFTAG_IMAGEWIDTH:
3736  case TIFFTAG_IMAGELENGTH:
3737  case TIFFTAG_IMAGEDEPTH:
3738  case TIFFTAG_TILELENGTH:
3739  case TIFFTAG_TILEWIDTH:
3740  case TIFFTAG_TILEDEPTH:
3741  case TIFFTAG_PLANARCONFIG:
3742  case TIFFTAG_ROWSPERSTRIP:
3743  case TIFFTAG_EXTRASAMPLES:
3744  if (!TIFFFetchNormalTag(tif,dp,0))
3745  goto bad;
3746  dp->tdir_ignore = TRUE;
3747  break;
3748  default:
3749  if( !_TIFFCheckFieldIsValidForCodec(tif, dp->tdir_tag) )
3750  dp->tdir_ignore = TRUE;
3751  break;
3752  }
3753  }
3754  }
3755  }
3756  /*
3757  * XXX: OJPEG hack.
3758  * If a) compression is OJPEG, b) planarconfig tag says it's separate,
3759  * c) strip offsets/bytecounts tag are both present and
3760  * d) both contain exactly one value, then we consistently find
3761  * that the buggy implementation of the buggy compression scheme
3762  * matches contig planarconfig best. So we 'fix-up' the tag here
3763  */
3764  if ((tif->tif_dir.td_compression==COMPRESSION_OJPEG)&&
3765  (tif->tif_dir.td_planarconfig==PLANARCONFIG_SEPARATE))
3766  {
3767  if (!_TIFFFillStriles(tif))
3768  goto bad;
3769  dp=TIFFReadDirectoryFindEntry(tif,dir,dircount,TIFFTAG_STRIPOFFSETS);
3770  if ((dp!=0)&&(dp->tdir_count==1))
3771  {
3772  dp=TIFFReadDirectoryFindEntry(tif,dir,dircount,
3773  TIFFTAG_STRIPBYTECOUNTS);
3774  if ((dp!=0)&&(dp->tdir_count==1))
3775  {
3776  tif->tif_dir.td_planarconfig=PLANARCONFIG_CONTIG;
3777  TIFFWarningExt(tif->tif_clientdata,module,
3778  "Planarconfig tag value assumed incorrect, "
3779  "assuming data is contig instead of chunky");
3780  }
3781  }
3782  }
3783  /*
3784  * Allocate directory structure and setup defaults.
3785  */
3786  if (!TIFFFieldSet(tif,FIELD_IMAGEDIMENSIONS))
3787  {
3788  MissingRequired(tif,"ImageLength");
3789  goto bad;
3790  }
3791  /*
3792  * Setup appropriate structures (by strip or by tile)
3793  */
3794  if (!TIFFFieldSet(tif, FIELD_TILEDIMENSIONS)) {
3795  tif->tif_dir.td_nstrips = TIFFNumberOfStrips(tif);
3796  tif->tif_dir.td_tilewidth = tif->tif_dir.td_imagewidth;
3797  tif->tif_dir.td_tilelength = tif->tif_dir.td_rowsperstrip;
3798  tif->tif_dir.td_tiledepth = tif->tif_dir.td_imagedepth;
3799  tif->tif_flags &= ~TIFF_ISTILED;
3800  } else {
3801  tif->tif_dir.td_nstrips = TIFFNumberOfTiles(tif);
3802  tif->tif_flags |= TIFF_ISTILED;
3803  }
3804  if (!tif->tif_dir.td_nstrips) {
3805  TIFFErrorExt(tif->tif_clientdata, module,
3806  "Cannot handle zero number of %s",
3807  isTiled(tif) ? "tiles" : "strips");
3808  goto bad;
3809  }
3810  tif->tif_dir.td_stripsperimage = tif->tif_dir.td_nstrips;
3811  if (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE)
3812  tif->tif_dir.td_stripsperimage /= tif->tif_dir.td_samplesperpixel;
3813  if (!TIFFFieldSet(tif, FIELD_STRIPOFFSETS)) {
3814 #ifdef OJPEG_SUPPORT
3815  if ((tif->tif_dir.td_compression==COMPRESSION_OJPEG) &&
3816  (isTiled(tif)==0) &&
3817  (tif->tif_dir.td_nstrips==1)) {
3818  /*
3819  * XXX: OJPEG hack.
3820  * If a) compression is OJPEG, b) it's not a tiled TIFF,
3821  * and c) the number of strips is 1,
3822  * then we tolerate the absence of stripoffsets tag,
3823  * because, presumably, all required data is in the
3824  * JpegInterchangeFormat stream.
3825  */
3826  TIFFSetFieldBit(tif, FIELD_STRIPOFFSETS);
3827  } else
3828 #endif
3829  {
3830  MissingRequired(tif,
3831  isTiled(tif) ? "TileOffsets" : "StripOffsets");
3832  goto bad;
3833  }
3834  }
3835  /*
3836  * Second pass: extract other information.
3837  */
3838  for (di=0, dp=dir; di<dircount; di++, dp++)
3839  {
3840  if (!dp->tdir_ignore) {
3841  switch (dp->tdir_tag)
3842  {
3843  case TIFFTAG_MINSAMPLEVALUE:
3844  case TIFFTAG_MAXSAMPLEVALUE:
3845  case TIFFTAG_BITSPERSAMPLE:
3846  case TIFFTAG_DATATYPE:
3847  case TIFFTAG_SAMPLEFORMAT:
3848  /*
3849  * The MinSampleValue, MaxSampleValue, BitsPerSample
3850  * DataType and SampleFormat tags are supposed to be
3851  * written as one value/sample, but some vendors
3852  * incorrectly write one value only -- so we accept
3853  * that as well (yuck). Other vendors write correct
3854  * value for NumberOfSamples, but incorrect one for
3855  * BitsPerSample and friends, and we will read this
3856  * too.
3857  */
3858  {
3859  uint16 value;
3860  enum TIFFReadDirEntryErr err;
3861  err=TIFFReadDirEntryShort(tif,dp,&value);
3862  if (err==TIFFReadDirEntryErrCount)
3863  err=TIFFReadDirEntryPersampleShort(tif,dp,&value);
3864  if (err!=TIFFReadDirEntryErrOk)
3865  {
3866  fip = TIFFFieldWithTag(tif,dp->tdir_tag);
3867  TIFFReadDirEntryOutputErr(tif,err,module,fip ? fip->field_name : "unknown tagname",0);
3868  goto bad;
3869  }
3870  if (!TIFFSetField(tif,dp->tdir_tag,value))
3871  goto bad;
3872  if( dp->tdir_tag == TIFFTAG_BITSPERSAMPLE )
3873  bitspersample_read = TRUE;
3874  }
3875  break;
3876  case TIFFTAG_SMINSAMPLEVALUE:
3877  case TIFFTAG_SMAXSAMPLEVALUE:
3878  {
3879 
3880  double *data = NULL;
3881  enum TIFFReadDirEntryErr err;
3882  uint32 saved_flags;
3883  int m;
3884  if (dp->tdir_count != (uint64)tif->tif_dir.td_samplesperpixel)
3885  err = TIFFReadDirEntryErrCount;
3886  else
3887  err = TIFFReadDirEntryDoubleArray(tif, dp, &data);
3888  if (err!=TIFFReadDirEntryErrOk)
3889  {
3890  fip = TIFFFieldWithTag(tif,dp->tdir_tag);
3891  TIFFReadDirEntryOutputErr(tif,err,module,fip ? fip->field_name : "unknown tagname",0);
3892  goto bad;
3893  }
3894  saved_flags = tif->tif_flags;
3895  tif->tif_flags |= TIFF_PERSAMPLE;
3896  m = TIFFSetField(tif,dp->tdir_tag,data);
3897  tif->tif_flags = saved_flags;
3898  _TIFFfree(data);
3899  if (!m)
3900  goto bad;
3901  }
3902  break;
3903  case TIFFTAG_STRIPOFFSETS:
3904  case TIFFTAG_TILEOFFSETS:
3905  _TIFFmemcpy( &(tif->tif_dir.td_stripoffset_entry),
3906  dp, sizeof(TIFFDirEntry) );
3907  break;
3908  case TIFFTAG_STRIPBYTECOUNTS:
3909  case TIFFTAG_TILEBYTECOUNTS:
3910  _TIFFmemcpy( &(tif->tif_dir.td_stripbytecount_entry),
3911  dp, sizeof(TIFFDirEntry) );
3912  break;
3913  case TIFFTAG_COLORMAP:
3914  case TIFFTAG_TRANSFERFUNCTION:
3915  {
3916  enum TIFFReadDirEntryErr err;
3917  uint32 countpersample;
3918  uint32 countrequired;
3919  uint32 incrementpersample;
3920  uint16* value=NULL;
3921  /* It would be dangerous to instantiate those tag values */
3922  /* since if td_bitspersample has not yet been read (due to */
3923  /* unordered tags), it could be read afterwards with a */
3924  /* values greater than the default one (1), which may cause */
3925  /* crashes in user code */
3926  if( !bitspersample_read )
3927  {
3928  fip = TIFFFieldWithTag(tif,dp->tdir_tag);
3929  TIFFWarningExt(tif->tif_clientdata,module,
3930  "Ignoring %s since BitsPerSample tag not found",
3931  fip ? fip->field_name : "unknown tagname");
3932  continue;
3933  }
3934  /* ColorMap or TransferFunction for high bit */
3935  /* depths do not make much sense and could be */
3936  /* used as a denial of service vector */
3937  if (tif->tif_dir.td_bitspersample > 24)
3938  {
3939  fip = TIFFFieldWithTag(tif,dp->tdir_tag);
3940  TIFFWarningExt(tif->tif_clientdata,module,
3941  "Ignoring %s because BitsPerSample=%d>24",
3942  fip ? fip->field_name : "unknown tagname",
3943  tif->tif_dir.td_bitspersample);
3944  continue;
3945  }
3946  countpersample=(1U<<tif->tif_dir.td_bitspersample);
3947  if ((dp->tdir_tag==TIFFTAG_TRANSFERFUNCTION)&&(dp->tdir_count==(uint64)countpersample))
3948  {
3949  countrequired=countpersample;
3950  incrementpersample=0;
3951  }
3952  else
3953  {
3954  countrequired=3*countpersample;
3955  incrementpersample=countpersample;
3956  }
3957  if (dp->tdir_count!=(uint64)countrequired)
3958  err=TIFFReadDirEntryErrCount;
3959  else
3960  err=TIFFReadDirEntryShortArray(tif,dp,&value);
3961  if (err!=TIFFReadDirEntryErrOk)
3962  {
3963  fip = TIFFFieldWithTag(tif,dp->tdir_tag);
3964  TIFFReadDirEntryOutputErr(tif,err,module,fip ? fip->field_name : "unknown tagname",1);
3965  }
3966  else
3967  {
3968  TIFFSetField(tif,dp->tdir_tag,value,value+incrementpersample,value+2*incrementpersample);
3969  _TIFFfree(value);
3970  }
3971  }
3972  break;
3973 /* BEGIN REV 4.0 COMPATIBILITY */
3974  case TIFFTAG_OSUBFILETYPE:
3975  {
3976  uint16 valueo;
3977  uint32 value;
3978  if (TIFFReadDirEntryShort(tif,dp,&valueo)==TIFFReadDirEntryErrOk)
3979  {
3980  switch (valueo)
3981  {
3982  case OFILETYPE_REDUCEDIMAGE: value=FILETYPE_REDUCEDIMAGE; break;
3983  case OFILETYPE_PAGE: value=FILETYPE_PAGE; break;
3984  default: value=0; break;
3985  }
3986  if (value!=0)
3987  TIFFSetField(tif,TIFFTAG_SUBFILETYPE,value);
3988  }
3989  }
3990  break;
3991 /* END REV 4.0 COMPATIBILITY */
3992  default:
3993  (void) TIFFFetchNormalTag(tif, dp, TRUE);
3994  break;
3995  }
3996  } /* -- if (!dp->tdir_ignore) */
3997  } /* -- for-loop -- */
3998 
3999  if( tif->tif_mode == O_RDWR &&
4000  tif->tif_dir.td_stripoffset_entry.tdir_tag != 0 &&
4001  tif->tif_dir.td_stripoffset_entry.tdir_count == 0 &&
4002  tif->tif_dir.td_stripoffset_entry.tdir_type == 0 &&
4003  tif->tif_dir.td_stripoffset_entry.tdir_offset.toff_long8 == 0 &&
4004  tif->tif_dir.td_stripbytecount_entry.tdir_tag != 0 &&
4005  tif->tif_dir.td_stripbytecount_entry.tdir_count == 0 &&
4006  tif->tif_dir.td_stripbytecount_entry.tdir_type == 0 &&
4007  tif->tif_dir.td_stripbytecount_entry.tdir_offset.toff_long8 == 0 )
4008  {
4009  /* Directory typically created with TIFFDeferStrileArrayWriting() */
4010  TIFFSetupStrips(tif);
4011  }
4012  else if( !(tif->tif_flags&TIFF_DEFERSTRILELOAD) )
4013  {
4014  if( tif->tif_dir.td_stripoffset_entry.tdir_tag != 0 )
4015  {
4016  if (!TIFFFetchStripThing(tif,&(tif->tif_dir.td_stripoffset_entry),
4017  tif->tif_dir.td_nstrips,
4018  &tif->tif_dir.td_stripoffset_p))
4019  {
4020  goto bad;
4021  }
4022  }
4023  if( tif->tif_dir.td_stripbytecount_entry.tdir_tag != 0 )
4024  {
4025  if (!TIFFFetchStripThing(tif,&(tif->tif_dir.td_stripbytecount_entry),
4026  tif->tif_dir.td_nstrips,
4027  &tif->tif_dir.td_stripbytecount_p))
4028  {
4029  goto bad;
4030  }
4031  }
4032  }
4033 
4034  /*
4035  * OJPEG hack:
4036  * - If a) compression is OJPEG, and b) photometric tag is missing,
4037  * then we consistently find that photometric should be YCbCr
4038  * - If a) compression is OJPEG, and b) photometric tag says it's RGB,
4039  * then we consistently find that the buggy implementation of the
4040  * buggy compression scheme matches photometric YCbCr instead.
4041  * - If a) compression is OJPEG, and b) bitspersample tag is missing,
4042  * then we consistently find bitspersample should be 8.
4043  * - If a) compression is OJPEG, b) samplesperpixel tag is missing,
4044  * and c) photometric is RGB or YCbCr, then we consistently find
4045  * samplesperpixel should be 3
4046  * - If a) compression is OJPEG, b) samplesperpixel tag is missing,
4047  * and c) photometric is MINISWHITE or MINISBLACK, then we consistently
4048  * find samplesperpixel should be 3
4049  */
4050  if (tif->tif_dir.td_compression==COMPRESSION_OJPEG)
4051  {
4052  if (!TIFFFieldSet(tif,FIELD_PHOTOMETRIC))
4053  {
4054  TIFFWarningExt(tif->tif_clientdata, module,
4055  "Photometric tag is missing, assuming data is YCbCr");
4056  if (!TIFFSetField(tif,TIFFTAG_PHOTOMETRIC,PHOTOMETRIC_YCBCR))
4057  goto bad;
4058  }
4059  else if (tif->tif_dir.td_photometric==PHOTOMETRIC_RGB)
4060  {
4061  tif->tif_dir.td_photometric=PHOTOMETRIC_YCBCR;
4062  TIFFWarningExt(tif->tif_clientdata, module,
4063  "Photometric tag value assumed incorrect, "
4064  "assuming data is YCbCr instead of RGB");
4065  }
4066  if (!TIFFFieldSet(tif,FIELD_BITSPERSAMPLE))
4067  {
4068  TIFFWarningExt(tif->tif_clientdata,module,
4069  "BitsPerSample tag is missing, assuming 8 bits per sample");
4070  if (!TIFFSetField(tif,TIFFTAG_BITSPERSAMPLE,8))
4071  goto bad;
4072  }
4073  if (!TIFFFieldSet(tif,FIELD_SAMPLESPERPIXEL))
4074  {
4075  if (tif->tif_dir.td_photometric==PHOTOMETRIC_RGB)
4076  {
4077  TIFFWarningExt(tif->tif_clientdata,module,
4078  "SamplesPerPixel tag is missing, "
4079  "assuming correct SamplesPerPixel value is 3");
4080  if (!TIFFSetField(tif,TIFFTAG_SAMPLESPERPIXEL,3))
4081  goto bad;
4082  }
4083  if (tif->tif_dir.td_photometric==PHOTOMETRIC_YCBCR)
4084  {
4085  TIFFWarningExt(tif->tif_clientdata,module,
4086  "SamplesPerPixel tag is missing, "
4087  "applying correct SamplesPerPixel value of 3");
4088  if (!TIFFSetField(tif,TIFFTAG_SAMPLESPERPIXEL,3))
4089  goto bad;
4090  }
4091  else if ((tif->tif_dir.td_photometric==PHOTOMETRIC_MINISWHITE)
4092  || (tif->tif_dir.td_photometric==PHOTOMETRIC_MINISBLACK))
4093  {
4094  /*
4095  * SamplesPerPixel tag is missing, but is not required
4096  * by spec. Assume correct SamplesPerPixel value of 1.
4097  */
4098  if (!TIFFSetField(tif,TIFFTAG_SAMPLESPERPIXEL,1))
4099  goto bad;
4100  }
4101  }
4102  }
4103 
4104  /*
4105  * Make sure all non-color channels are extrasamples.
4106  * If it's not the case, define them as such.
4107  */
4108  color_channels = _TIFFGetMaxColorChannels(tif->tif_dir.td_photometric);
4109  if (color_channels && tif->tif_dir.td_samplesperpixel - tif->tif_dir.td_extrasamples > color_channels) {
4110  uint16 old_extrasamples;
4111  uint16 *new_sampleinfo;
4112 
4113  TIFFWarningExt(tif->tif_clientdata,module, "Sum of Photometric type-related "
4114  "color channels and ExtraSamples doesn't match SamplesPerPixel. "
4115  "Defining non-color channels as ExtraSamples.");
4116 
4117  old_extrasamples = tif->tif_dir.td_extrasamples;
4118  tif->tif_dir.td_extrasamples = (uint16) (tif->tif_dir.td_samplesperpixel - color_channels);
4119 
4120  // sampleinfo should contain information relative to these new extra samples
4121  new_sampleinfo = (uint16*) _TIFFcalloc(tif->tif_dir.td_extrasamples, sizeof(uint16));
4122  if (!new_sampleinfo) {
4123  TIFFErrorExt(tif->tif_clientdata, module, "Failed to allocate memory for "
4124  "temporary new sampleinfo array (%d 16 bit elements)",
4125  tif->tif_dir.td_extrasamples);
4126  goto bad;
4127  }
4128 
4129  memcpy(new_sampleinfo, tif->tif_dir.td_sampleinfo, old_extrasamples * sizeof(uint16));
4130  _TIFFsetShortArray(&tif->tif_dir.td_sampleinfo, new_sampleinfo, tif->tif_dir.td_extrasamples);
4131  _TIFFfree(new_sampleinfo);
4132  }
4133 
4134  /*
4135  * Verify Palette image has a Colormap.
4136  */
4137  if (tif->tif_dir.td_photometric == PHOTOMETRIC_PALETTE &&
4138  !TIFFFieldSet(tif, FIELD_COLORMAP)) {
4139  if ( tif->tif_dir.td_bitspersample>=8 && tif->tif_dir.td_samplesperpixel==3)
4140  tif->tif_dir.td_photometric = PHOTOMETRIC_RGB;
4141  else if (tif->tif_dir.td_bitspersample>=8)
4142  tif->tif_dir.td_photometric = PHOTOMETRIC_MINISBLACK;
4143  else {
4144  MissingRequired(tif, "Colormap");
4145  goto bad;
4146  }
4147  }
4148  /*
4149  * OJPEG hack:
4150  * We do no further messing with strip/tile offsets/bytecounts in OJPEG
4151  * TIFFs
4152  */
4153  if (tif->tif_dir.td_compression!=COMPRESSION_OJPEG)
4154  {
4155  /*
4156  * Attempt to deal with a missing StripByteCounts tag.
4157  */
4158  if (!TIFFFieldSet(tif, FIELD_STRIPBYTECOUNTS)) {
4159  /*
4160  * Some manufacturers violate the spec by not giving
4161  * the size of the strips. In this case, assume there
4162  * is one uncompressed strip of data.
4163  */
4164  if ((tif->tif_dir.td_planarconfig == PLANARCONFIG_CONTIG &&
4165  tif->tif_dir.td_nstrips > 1) ||
4166  (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE &&
4167  tif->tif_dir.td_nstrips != (uint32)tif->tif_dir.td_samplesperpixel)) {
4168  MissingRequired(tif, "StripByteCounts");
4169  goto bad;
4170  }
4171  TIFFWarningExt(tif->tif_clientdata, module,
4172  "TIFF directory is missing required "
4173  "\"StripByteCounts\" field, calculating from imagelength");
4174  if (EstimateStripByteCounts(tif, dir, dircount) < 0)
4175  goto bad;
4176 
4177  } else if (tif->tif_dir.td_nstrips == 1
4178  && !(tif->tif_flags&TIFF_ISTILED)
4179  && ByteCountLooksBad(tif)) {
4180  /*
4181  * XXX: Plexus (and others) sometimes give a value of
4182  * zero for a tag when they don't know what the
4183  * correct value is! Try and handle the simple case
4184  * of estimating the size of a one strip image.
4185  */
4186  TIFFWarningExt(tif->tif_clientdata, module,
4187  "Bogus \"StripByteCounts\" field, ignoring and calculating from imagelength");
4188  if(EstimateStripByteCounts(tif, dir, dircount) < 0)
4189  goto bad;
4190 
4191  } else if (!(tif->tif_flags&TIFF_DEFERSTRILELOAD)
4192  && tif->tif_dir.td_planarconfig == PLANARCONFIG_CONTIG
4193  && tif->tif_dir.td_nstrips > 2
4194  && tif->tif_dir.td_compression == COMPRESSION_NONE
4195  && TIFFGetStrileByteCount(tif, 0) != TIFFGetStrileByteCount(tif, 1)
4196  && TIFFGetStrileByteCount(tif, 0) != 0
4197  && TIFFGetStrileByteCount(tif, 1) != 0 ) {
4198  /*
4199  * XXX: Some vendors fill StripByteCount array with
4200  * absolutely wrong values (it can be equal to
4201  * StripOffset array, for example). Catch this case
4202  * here.
4203  *
4204  * We avoid this check if deferring strile loading
4205  * as it would always force us to load the strip/tile
4206  * information.
4207  */
4208  TIFFWarningExt(tif->tif_clientdata, module,
4209  "Wrong \"StripByteCounts\" field, ignoring and calculating from imagelength");
4210  if (EstimateStripByteCounts(tif, dir, dircount) < 0)
4211  goto bad;
4212  }
4213  }
4214  if (dir)
4215  {
4216  _TIFFfree(dir);
4217  dir=NULL;
4218  }
4219  if (!TIFFFieldSet(tif, FIELD_MAXSAMPLEVALUE))
4220  {
4221  if (tif->tif_dir.td_bitspersample>=16)
4222  tif->tif_dir.td_maxsamplevalue=0xFFFF;
4223  else
4224  tif->tif_dir.td_maxsamplevalue = (uint16)((1L<<tif->tif_dir.td_bitspersample)-1);
4225  }
4226 
4227 #ifdef STRIPBYTECOUNTSORTED_UNUSED
4228  /*
4229  * XXX: We can optimize checking for the strip bounds using the sorted
4230  * bytecounts array. See also comments for TIFFAppendToStrip()
4231  * function in tif_write.c.
4232  */
4233  if (!(tif->tif_flags&TIFF_DEFERSTRILELOAD) && tif->tif_dir.td_nstrips > 1) {
4234  uint32 strip;
4235 
4236  tif->tif_dir.td_stripbytecountsorted = 1;
4237  for (strip = 1; strip < tif->