ReactOS  0.4.14-dev-297-g23e575c
tif_dirread.c
Go to the documentation of this file.
1 /*
2  * Copyright (c) 1988-1997 Sam Leffler
3  * Copyright (c) 1991-1997 Silicon Graphics, Inc.
4  *
5  * Permission to use, copy, modify, distribute, and sell this software and
6  * its documentation for any purpose is hereby granted without fee, provided
7  * that (i) the above copyright notices and this permission notice appear in
8  * all copies of the software and related documentation, and (ii) the names of
9  * Sam Leffler and Silicon Graphics may not be used in any advertising or
10  * publicity relating to the software without the specific, prior written
11  * permission of Sam Leffler and Silicon Graphics.
12  *
13  * THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND,
14  * EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY
15  * WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
16  *
17  * IN NO EVENT SHALL SAM LEFFLER OR SILICON GRAPHICS BE LIABLE FOR
18  * ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND,
19  * OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
20  * WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF
21  * LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
22  * OF THIS SOFTWARE.
23  */
24 
25 /*
26  * TIFF Library.
27  *
28  * Directory Read Support Routines.
29  */
30 
31 /* Suggested pending improvements:
32  * - add a field 'ignore' to the TIFFDirEntry structure, to flag status,
33  * eliminating current use of the IGNORE value, and therefore eliminating
34  * current irrational behaviour on tags with tag id code 0
35  * - add a field 'field_info' to the TIFFDirEntry structure, and set that with
36  * the pointer to the appropriate TIFFField structure early on in
37  * TIFFReadDirectory, so as to eliminate current possibly repetitive lookup.
38  */
39 
40 #include <precomp.h>
41 #include <float.h>
42 #include <stdlib.h>
43 
44 #define IGNORE 0 /* tag placeholder used below */
45 #define FAILED_FII ((uint32) -1)
46 
47 #ifdef HAVE_IEEEFP
48 # define TIFFCvtIEEEFloatToNative(tif, n, fp)
49 # define TIFFCvtIEEEDoubleToNative(tif, n, dp)
50 #else
51 extern void TIFFCvtIEEEFloatToNative(TIFF*, uint32, float*);
52 extern void TIFFCvtIEEEDoubleToNative(TIFF*, uint32, double*);
53 #endif
54 
55 enum TIFFReadDirEntryErr {
56  TIFFReadDirEntryErrOk = 0,
57  TIFFReadDirEntryErrCount = 1,
58  TIFFReadDirEntryErrType = 2,
59  TIFFReadDirEntryErrIo = 3,
60  TIFFReadDirEntryErrRange = 4,
61  TIFFReadDirEntryErrPsdif = 5,
62  TIFFReadDirEntryErrSizesan = 6,
63  TIFFReadDirEntryErrAlloc = 7,
64 };
65 
66 static enum TIFFReadDirEntryErr TIFFReadDirEntryByte(TIFF* tif, TIFFDirEntry* direntry, uint8* value);
67 static enum TIFFReadDirEntryErr TIFFReadDirEntryShort(TIFF* tif, TIFFDirEntry* direntry, uint16* value);
68 static enum TIFFReadDirEntryErr TIFFReadDirEntryLong(TIFF* tif, TIFFDirEntry* direntry, uint32* value);
69 static enum TIFFReadDirEntryErr TIFFReadDirEntryLong8(TIFF* tif, TIFFDirEntry* direntry, uint64* value);
70 static enum TIFFReadDirEntryErr TIFFReadDirEntryFloat(TIFF* tif, TIFFDirEntry* direntry, float* value);
71 static enum TIFFReadDirEntryErr TIFFReadDirEntryDouble(TIFF* tif, TIFFDirEntry* direntry, double* value);
72 static enum TIFFReadDirEntryErr TIFFReadDirEntryIfd8(TIFF* tif, TIFFDirEntry* direntry, uint64* value);
73 
74 static enum TIFFReadDirEntryErr TIFFReadDirEntryArray(TIFF* tif, TIFFDirEntry* direntry, uint32* count, uint32 desttypesize, void** value);
75 static enum TIFFReadDirEntryErr TIFFReadDirEntryByteArray(TIFF* tif, TIFFDirEntry* direntry, uint8** value);
76 static enum TIFFReadDirEntryErr TIFFReadDirEntrySbyteArray(TIFF* tif, TIFFDirEntry* direntry, int8** value);
77 static enum TIFFReadDirEntryErr TIFFReadDirEntryShortArray(TIFF* tif, TIFFDirEntry* direntry, uint16** value);
78 static enum TIFFReadDirEntryErr TIFFReadDirEntrySshortArray(TIFF* tif, TIFFDirEntry* direntry, int16** value);
79 static enum TIFFReadDirEntryErr TIFFReadDirEntryLongArray(TIFF* tif, TIFFDirEntry* direntry, uint32** value);
80 static enum TIFFReadDirEntryErr TIFFReadDirEntrySlongArray(TIFF* tif, TIFFDirEntry* direntry, int32** value);
81 static enum TIFFReadDirEntryErr TIFFReadDirEntryLong8Array(TIFF* tif, TIFFDirEntry* direntry, uint64** value);
82 static enum TIFFReadDirEntryErr TIFFReadDirEntrySlong8Array(TIFF* tif, TIFFDirEntry* direntry, int64** value);
83 static enum TIFFReadDirEntryErr TIFFReadDirEntryFloatArray(TIFF* tif, TIFFDirEntry* direntry, float** value);
84 static enum TIFFReadDirEntryErr TIFFReadDirEntryDoubleArray(TIFF* tif, TIFFDirEntry* direntry, double** value);
85 static enum TIFFReadDirEntryErr TIFFReadDirEntryIfd8Array(TIFF* tif, TIFFDirEntry* direntry, uint64** value);
86 
87 static enum TIFFReadDirEntryErr TIFFReadDirEntryPersampleShort(TIFF* tif, TIFFDirEntry* direntry, uint16* value);
88 #if 0
89 static enum TIFFReadDirEntryErr TIFFReadDirEntryPersampleDouble(TIFF* tif, TIFFDirEntry* direntry, double* value);
90 #endif
91 
92 static void TIFFReadDirEntryCheckedByte(TIFF* tif, TIFFDirEntry* direntry, uint8* value);
93 static void TIFFReadDirEntryCheckedSbyte(TIFF* tif, TIFFDirEntry* direntry, int8* value);
94 static void TIFFReadDirEntryCheckedShort(TIFF* tif, TIFFDirEntry* direntry, uint16* value);
95 static void TIFFReadDirEntryCheckedSshort(TIFF* tif, TIFFDirEntry* direntry, int16* value);
96 static void TIFFReadDirEntryCheckedLong(TIFF* tif, TIFFDirEntry* direntry, uint32* value);
97 static void TIFFReadDirEntryCheckedSlong(TIFF* tif, TIFFDirEntry* direntry, int32* value);
98 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedLong8(TIFF* tif, TIFFDirEntry* direntry, uint64* value);
99 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedSlong8(TIFF* tif, TIFFDirEntry* direntry, int64* value);
100 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedRational(TIFF* tif, TIFFDirEntry* direntry, double* value);
101 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedSrational(TIFF* tif, TIFFDirEntry* direntry, double* value);
102 static void TIFFReadDirEntryCheckedFloat(TIFF* tif, TIFFDirEntry* direntry, float* value);
103 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedDouble(TIFF* tif, TIFFDirEntry* direntry, double* value);
104 
105 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSbyte(int8 value);
106 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteShort(uint16 value);
107 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSshort(int16 value);
108 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteLong(uint32 value);
109 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSlong(int32 value);
110 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteLong8(uint64 value);
111 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSlong8(int64 value);
112 
113 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteByte(uint8 value);
114 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteShort(uint16 value);
115 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteSshort(int16 value);
116 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteLong(uint32 value);
117 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteSlong(int32 value);
118 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteLong8(uint64 value);
119 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteSlong8(int64 value);
120 
121 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSbyte(int8 value);
122 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSshort(int16 value);
123 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortLong(uint32 value);
124 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSlong(int32 value);
125 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortLong8(uint64 value);
126 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSlong8(int64 value);
127 
128 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortShort(uint16 value);
129 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortLong(uint32 value);
130 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortSlong(int32 value);
131 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortLong8(uint64 value);
132 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortSlong8(int64 value);
133 
134 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongSbyte(int8 value);
135 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongSshort(int16 value);
136 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongSlong(int32 value);
137 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongLong8(uint64 value);
138 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongSlong8(int64 value);
139 
140 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSlongLong(uint32 value);
141 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSlongLong8(uint64 value);
142 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSlongSlong8(int64 value);
143 
144 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLong8Sbyte(int8 value);
145 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLong8Sshort(int16 value);
146 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLong8Slong(int32 value);
147 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLong8Slong8(int64 value);
148 
149 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSlong8Long8(uint64 value);
150 
151 static enum TIFFReadDirEntryErr TIFFReadDirEntryData(TIFF* tif, uint64 offset, tmsize_t size, void* dest);
152 static void TIFFReadDirEntryOutputErr(TIFF* tif, enum TIFFReadDirEntryErr err, const char* module, const char* tagname, int recover);
153 
154 static void TIFFReadDirectoryCheckOrder(TIFF* tif, TIFFDirEntry* dir, uint16 dircount);
155 static TIFFDirEntry* TIFFReadDirectoryFindEntry(TIFF* tif, TIFFDirEntry* dir, uint16 dircount, uint16 tagid);
156 static void TIFFReadDirectoryFindFieldInfo(TIFF* tif, uint16 tagid, uint32* fii);
157 
158 static int EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount);
159 static void MissingRequired(TIFF*, const char*);
160 static int TIFFCheckDirOffset(TIFF* tif, uint64 diroff);
161 static int CheckDirCount(TIFF*, TIFFDirEntry*, uint32);
162 static uint16 TIFFFetchDirectory(TIFF* tif, uint64 diroff, TIFFDirEntry** pdir, uint64* nextdiroff);
163 static int TIFFFetchNormalTag(TIFF*, TIFFDirEntry*, int recover);
164 static int TIFFFetchStripThing(TIFF* tif, TIFFDirEntry* dir, uint32 nstrips, uint64** lpp);
165 static int TIFFFetchSubjectDistance(TIFF*, TIFFDirEntry*);
166 static void ChopUpSingleUncompressedStrip(TIFF*);
167 static uint64 TIFFReadUInt64(const uint8 *value);
168 static int _TIFFGetMaxColorChannels(uint16 photometric);
169 
170 static int _TIFFFillStrilesInternal( TIFF *tif, int loadStripByteCount );
171 
172 typedef union _UInt64Aligned_t
173 {
174  double d;
175  uint64 l;
176  uint32 i[2];
177  uint16 s[4];
178  uint8 c[8];
179 } UInt64Aligned_t;
180 
181 /*
182  Unaligned safe copy of a uint64 value from an octet array.
183 */
184 static uint64 TIFFReadUInt64(const uint8 *value)
185 {
186  UInt64Aligned_t result;
187 
188  result.c[0]=value[0];
189  result.c[1]=value[1];
190  result.c[2]=value[2];
191  result.c[3]=value[3];
192  result.c[4]=value[4];
193  result.c[5]=value[5];
194  result.c[6]=value[6];
195  result.c[7]=value[7];
196 
197  return result.l;
198 }
199 
200 static enum TIFFReadDirEntryErr TIFFReadDirEntryByte(TIFF* tif, TIFFDirEntry* direntry, uint8* value)
201 {
202  enum TIFFReadDirEntryErr err;
203  if (direntry->tdir_count!=1)
204  return(TIFFReadDirEntryErrCount);
205  switch (direntry->tdir_type)
206  {
207  case TIFF_BYTE:
208  TIFFReadDirEntryCheckedByte(tif,direntry,value);
209  return(TIFFReadDirEntryErrOk);
210  case TIFF_SBYTE:
211  {
212  int8 m;
213  TIFFReadDirEntryCheckedSbyte(tif,direntry,&m);
214  err=TIFFReadDirEntryCheckRangeByteSbyte(m);
215  if (err!=TIFFReadDirEntryErrOk)
216  return(err);
217  *value=(uint8)m;
218  return(TIFFReadDirEntryErrOk);
219  }
220  case TIFF_SHORT:
221  {
222  uint16 m;
223  TIFFReadDirEntryCheckedShort(tif,direntry,&m);
224  err=TIFFReadDirEntryCheckRangeByteShort(m);
225  if (err!=TIFFReadDirEntryErrOk)
226  return(err);
227  *value=(uint8)m;
228  return(TIFFReadDirEntryErrOk);
229  }
230  case TIFF_SSHORT:
231  {
232  int16 m;
233  TIFFReadDirEntryCheckedSshort(tif,direntry,&m);
234  err=TIFFReadDirEntryCheckRangeByteSshort(m);
235  if (err!=TIFFReadDirEntryErrOk)
236  return(err);
237  *value=(uint8)m;
238  return(TIFFReadDirEntryErrOk);
239  }
240  case TIFF_LONG:
241  {
242  uint32 m;
243  TIFFReadDirEntryCheckedLong(tif,direntry,&m);
244  err=TIFFReadDirEntryCheckRangeByteLong(m);
245  if (err!=TIFFReadDirEntryErrOk)
246  return(err);
247  *value=(uint8)m;
248  return(TIFFReadDirEntryErrOk);
249  }
250  case TIFF_SLONG:
251  {
252  int32 m;
253  TIFFReadDirEntryCheckedSlong(tif,direntry,&m);
254  err=TIFFReadDirEntryCheckRangeByteSlong(m);
255  if (err!=TIFFReadDirEntryErrOk)
256  return(err);
257  *value=(uint8)m;
258  return(TIFFReadDirEntryErrOk);
259  }
260  case TIFF_LONG8:
261  {
262  uint64 m;
263  err=TIFFReadDirEntryCheckedLong8(tif,direntry,&m);
264  if (err!=TIFFReadDirEntryErrOk)
265  return(err);
266  err=TIFFReadDirEntryCheckRangeByteLong8(m);
267  if (err!=TIFFReadDirEntryErrOk)
268  return(err);
269  *value=(uint8)m;
270  return(TIFFReadDirEntryErrOk);
271  }
272  case TIFF_SLONG8:
273  {
274  int64 m;
275  err=TIFFReadDirEntryCheckedSlong8(tif,direntry,&m);
276  if (err!=TIFFReadDirEntryErrOk)
277  return(err);
278  err=TIFFReadDirEntryCheckRangeByteSlong8(m);
279  if (err!=TIFFReadDirEntryErrOk)
280  return(err);
281  *value=(uint8)m;
282  return(TIFFReadDirEntryErrOk);
283  }
284  default:
285  return(TIFFReadDirEntryErrType);
286  }
287 }
288 
289 static enum TIFFReadDirEntryErr TIFFReadDirEntryShort(TIFF* tif, TIFFDirEntry* direntry, uint16* value)
290 {
291  enum TIFFReadDirEntryErr err;
292  if (direntry->tdir_count!=1)
293  return(TIFFReadDirEntryErrCount);
294  switch (direntry->tdir_type)
295  {
296  case TIFF_BYTE:
297  {
298  uint8 m;
299  TIFFReadDirEntryCheckedByte(tif,direntry,&m);
300  *value=(uint16)m;
301  return(TIFFReadDirEntryErrOk);
302  }
303  case TIFF_SBYTE:
304  {
305  int8 m;
306  TIFFReadDirEntryCheckedSbyte(tif,direntry,&m);
307  err=TIFFReadDirEntryCheckRangeShortSbyte(m);
308  if (err!=TIFFReadDirEntryErrOk)
309  return(err);
310  *value=(uint16)m;
311  return(TIFFReadDirEntryErrOk);
312  }
313  case TIFF_SHORT:
314  TIFFReadDirEntryCheckedShort(tif,direntry,value);
315  return(TIFFReadDirEntryErrOk);
316  case TIFF_SSHORT:
317  {
318  int16 m;
319  TIFFReadDirEntryCheckedSshort(tif,direntry,&m);
320  err=TIFFReadDirEntryCheckRangeShortSshort(m);
321  if (err!=TIFFReadDirEntryErrOk)
322  return(err);
323  *value=(uint16)m;
324  return(TIFFReadDirEntryErrOk);
325  }
326  case TIFF_LONG:
327  {
328  uint32 m;
329  TIFFReadDirEntryCheckedLong(tif,direntry,&m);
330  err=TIFFReadDirEntryCheckRangeShortLong(m);
331  if (err!=TIFFReadDirEntryErrOk)
332  return(err);
333  *value=(uint16)m;
334  return(TIFFReadDirEntryErrOk);
335  }
336  case TIFF_SLONG:
337  {
338  int32 m;
339  TIFFReadDirEntryCheckedSlong(tif,direntry,&m);
340  err=TIFFReadDirEntryCheckRangeShortSlong(m);
341  if (err!=TIFFReadDirEntryErrOk)
342  return(err);
343  *value=(uint16)m;
344  return(TIFFReadDirEntryErrOk);
345  }
346  case TIFF_LONG8:
347  {
348  uint64 m;
349  err=TIFFReadDirEntryCheckedLong8(tif,direntry,&m);
350  if (err!=TIFFReadDirEntryErrOk)
351  return(err);
352  err=TIFFReadDirEntryCheckRangeShortLong8(m);
353  if (err!=TIFFReadDirEntryErrOk)
354  return(err);
355  *value=(uint16)m;
356  return(TIFFReadDirEntryErrOk);
357  }
358  case TIFF_SLONG8:
359  {
360  int64 m;
361  err=TIFFReadDirEntryCheckedSlong8(tif,direntry,&m);
362  if (err!=TIFFReadDirEntryErrOk)
363  return(err);
364  err=TIFFReadDirEntryCheckRangeShortSlong8(m);
365  if (err!=TIFFReadDirEntryErrOk)
366  return(err);
367  *value=(uint16)m;
368  return(TIFFReadDirEntryErrOk);
369  }
370  default:
371  return(TIFFReadDirEntryErrType);
372  }
373 }
374 
375 static enum TIFFReadDirEntryErr TIFFReadDirEntryLong(TIFF* tif, TIFFDirEntry* direntry, uint32* value)
376 {
377  enum TIFFReadDirEntryErr err;
378  if (direntry->tdir_count!=1)
379  return(TIFFReadDirEntryErrCount);
380  switch (direntry->tdir_type)
381  {
382  case TIFF_BYTE:
383  {
384  uint8 m;
385  TIFFReadDirEntryCheckedByte(tif,direntry,&m);
386  *value=(uint32)m;
387  return(TIFFReadDirEntryErrOk);
388  }
389  case TIFF_SBYTE:
390  {
391  int8 m;
392  TIFFReadDirEntryCheckedSbyte(tif,direntry,&m);
393  err=TIFFReadDirEntryCheckRangeLongSbyte(m);
394  if (err!=TIFFReadDirEntryErrOk)
395  return(err);
396  *value=(uint32)m;
397  return(TIFFReadDirEntryErrOk);
398  }
399  case TIFF_SHORT:
400  {
401  uint16 m;
402  TIFFReadDirEntryCheckedShort(tif,direntry,&m);
403  *value=(uint32)m;
404  return(TIFFReadDirEntryErrOk);
405  }
406  case TIFF_SSHORT:
407  {
408  int16 m;
409  TIFFReadDirEntryCheckedSshort(tif,direntry,&m);
410  err=TIFFReadDirEntryCheckRangeLongSshort(m);
411  if (err!=TIFFReadDirEntryErrOk)
412  return(err);
413  *value=(uint32)m;
414  return(TIFFReadDirEntryErrOk);
415  }
416  case TIFF_LONG:
417  TIFFReadDirEntryCheckedLong(tif,direntry,value);
418  return(TIFFReadDirEntryErrOk);
419  case TIFF_SLONG:
420  {
421  int32 m;
422  TIFFReadDirEntryCheckedSlong(tif,direntry,&m);
423  err=TIFFReadDirEntryCheckRangeLongSlong(m);
424  if (err!=TIFFReadDirEntryErrOk)
425  return(err);
426  *value=(uint32)m;
427  return(TIFFReadDirEntryErrOk);
428  }
429  case TIFF_LONG8:
430  {
431  uint64 m;
432  err=TIFFReadDirEntryCheckedLong8(tif,direntry,&m);
433  if (err!=TIFFReadDirEntryErrOk)
434  return(err);
435  err=TIFFReadDirEntryCheckRangeLongLong8(m);
436  if (err!=TIFFReadDirEntryErrOk)
437  return(err);
438  *value=(uint32)m;
439  return(TIFFReadDirEntryErrOk);
440  }
441  case TIFF_SLONG8:
442  {
443  int64 m;
444  err=TIFFReadDirEntryCheckedSlong8(tif,direntry,&m);
445  if (err!=TIFFReadDirEntryErrOk)
446  return(err);
447  err=TIFFReadDirEntryCheckRangeLongSlong8(m);
448  if (err!=TIFFReadDirEntryErrOk)
449  return(err);
450  *value=(uint32)m;
451  return(TIFFReadDirEntryErrOk);
452  }
453  default:
454  return(TIFFReadDirEntryErrType);
455  }
456 }
457 
458 static enum TIFFReadDirEntryErr TIFFReadDirEntryLong8(TIFF* tif, TIFFDirEntry* direntry, uint64* value)
459 {
460  enum TIFFReadDirEntryErr err;
461  if (direntry->tdir_count!=1)
462  return(TIFFReadDirEntryErrCount);
463  switch (direntry->tdir_type)
464  {
465  case TIFF_BYTE:
466  {
467  uint8 m;
468  TIFFReadDirEntryCheckedByte(tif,direntry,&m);
469  *value=(uint64)m;
470  return(TIFFReadDirEntryErrOk);
471  }
472  case TIFF_SBYTE:
473  {
474  int8 m;
475  TIFFReadDirEntryCheckedSbyte(tif,direntry,&m);
476  err=TIFFReadDirEntryCheckRangeLong8Sbyte(m);
477  if (err!=TIFFReadDirEntryErrOk)
478  return(err);
479  *value=(uint64)m;
480  return(TIFFReadDirEntryErrOk);
481  }
482  case TIFF_SHORT:
483  {
484  uint16 m;
485  TIFFReadDirEntryCheckedShort(tif,direntry,&m);
486  *value=(uint64)m;
487  return(TIFFReadDirEntryErrOk);
488  }
489  case TIFF_SSHORT:
490  {
491  int16 m;
492  TIFFReadDirEntryCheckedSshort(tif,direntry,&m);
493  err=TIFFReadDirEntryCheckRangeLong8Sshort(m);
494  if (err!=TIFFReadDirEntryErrOk)
495  return(err);
496  *value=(uint64)m;
497  return(TIFFReadDirEntryErrOk);
498  }
499  case TIFF_LONG:
500  {
501  uint32 m;
502  TIFFReadDirEntryCheckedLong(tif,direntry,&m);
503  *value=(uint64)m;
504  return(TIFFReadDirEntryErrOk);
505  }
506  case TIFF_SLONG:
507  {
508  int32 m;
509  TIFFReadDirEntryCheckedSlong(tif,direntry,&m);
510  err=TIFFReadDirEntryCheckRangeLong8Slong(m);
511  if (err!=TIFFReadDirEntryErrOk)
512  return(err);
513  *value=(uint64)m;
514  return(TIFFReadDirEntryErrOk);
515  }
516  case TIFF_LONG8:
517  err=TIFFReadDirEntryCheckedLong8(tif,direntry,value);
518  return(err);
519  case TIFF_SLONG8:
520  {
521  int64 m;
522  err=TIFFReadDirEntryCheckedSlong8(tif,direntry,&m);
523  if (err!=TIFFReadDirEntryErrOk)
524  return(err);
525  err=TIFFReadDirEntryCheckRangeLong8Slong8(m);
526  if (err!=TIFFReadDirEntryErrOk)
527  return(err);
528  *value=(uint64)m;
529  return(TIFFReadDirEntryErrOk);
530  }
531  default:
532  return(TIFFReadDirEntryErrType);
533  }
534 }
535 
536 static enum TIFFReadDirEntryErr TIFFReadDirEntryFloat(TIFF* tif, TIFFDirEntry* direntry, float* value)
537 {
538  enum TIFFReadDirEntryErr err;
539  if (direntry->tdir_count!=1)
540  return(TIFFReadDirEntryErrCount);
541  switch (direntry->tdir_type)
542  {
543  case TIFF_BYTE:
544  {
545  uint8 m;
546  TIFFReadDirEntryCheckedByte(tif,direntry,&m);
547  *value=(float)m;
548  return(TIFFReadDirEntryErrOk);
549  }
550  case TIFF_SBYTE:
551  {
552  int8 m;
553  TIFFReadDirEntryCheckedSbyte(tif,direntry,&m);
554  *value=(float)m;
555  return(TIFFReadDirEntryErrOk);
556  }
557  case TIFF_SHORT:
558  {
559  uint16 m;
560  TIFFReadDirEntryCheckedShort(tif,direntry,&m);
561  *value=(float)m;
562  return(TIFFReadDirEntryErrOk);
563  }
564  case TIFF_SSHORT:
565  {
566  int16 m;
567  TIFFReadDirEntryCheckedSshort(tif,direntry,&m);
568  *value=(float)m;
569  return(TIFFReadDirEntryErrOk);
570  }
571  case TIFF_LONG:
572  {
573  uint32 m;
574  TIFFReadDirEntryCheckedLong(tif,direntry,&m);
575  *value=(float)m;
576  return(TIFFReadDirEntryErrOk);
577  }
578  case TIFF_SLONG:
579  {
580  int32 m;
581  TIFFReadDirEntryCheckedSlong(tif,direntry,&m);
582  *value=(float)m;
583  return(TIFFReadDirEntryErrOk);
584  }
585  case TIFF_LONG8:
586  {
587  uint64 m;
588  err=TIFFReadDirEntryCheckedLong8(tif,direntry,&m);
589  if (err!=TIFFReadDirEntryErrOk)
590  return(err);
591 #if defined(__WIN32__) && (_MSC_VER < 1500)
592  /*
593  * XXX: MSVC 6.0 does not support conversion
594  * of 64-bit integers into floating point
595  * values.
596  */
597  *value = _TIFFUInt64ToFloat(m);
598 #else
599  *value=(float)m;
600 #endif
601  return(TIFFReadDirEntryErrOk);
602  }
603  case TIFF_SLONG8:
604  {
605  int64 m;
606  err=TIFFReadDirEntryCheckedSlong8(tif,direntry,&m);
607  if (err!=TIFFReadDirEntryErrOk)
608  return(err);
609  *value=(float)m;
610  return(TIFFReadDirEntryErrOk);
611  }
612  case TIFF_RATIONAL:
613  {
614  double m;
615  err=TIFFReadDirEntryCheckedRational(tif,direntry,&m);
616  if (err!=TIFFReadDirEntryErrOk)
617  return(err);
618  *value=(float)m;
619  return(TIFFReadDirEntryErrOk);
620  }
621  case TIFF_SRATIONAL:
622  {
623  double m;
624  err=TIFFReadDirEntryCheckedSrational(tif,direntry,&m);
625  if (err!=TIFFReadDirEntryErrOk)
626  return(err);
627  *value=(float)m;
628  return(TIFFReadDirEntryErrOk);
629  }
630  case TIFF_FLOAT:
631  TIFFReadDirEntryCheckedFloat(tif,direntry,value);
632  return(TIFFReadDirEntryErrOk);
633  case TIFF_DOUBLE:
634  {
635  double m;
636  err=TIFFReadDirEntryCheckedDouble(tif,direntry,&m);
637  if (err!=TIFFReadDirEntryErrOk)
638  return(err);
639  if ((m > FLT_MAX) || (m < FLT_MIN))
640  return(TIFFReadDirEntryErrRange);
641  *value=(float)m;
642  return(TIFFReadDirEntryErrOk);
643  }
644  default:
645  return(TIFFReadDirEntryErrType);
646  }
647 }
648 
649 static enum TIFFReadDirEntryErr TIFFReadDirEntryDouble(TIFF* tif, TIFFDirEntry* direntry, double* value)
650 {
651  enum TIFFReadDirEntryErr err;
652  if (direntry->tdir_count!=1)
653  return(TIFFReadDirEntryErrCount);
654  switch (direntry->tdir_type)
655  {
656  case TIFF_BYTE:
657  {
658  uint8 m;
659  TIFFReadDirEntryCheckedByte(tif,direntry,&m);
660  *value=(double)m;
661  return(TIFFReadDirEntryErrOk);
662  }
663  case TIFF_SBYTE:
664  {
665  int8 m;
666  TIFFReadDirEntryCheckedSbyte(tif,direntry,&m);
667  *value=(double)m;
668  return(TIFFReadDirEntryErrOk);
669  }
670  case TIFF_SHORT:
671  {
672  uint16 m;
673  TIFFReadDirEntryCheckedShort(tif,direntry,&m);
674  *value=(double)m;
675  return(TIFFReadDirEntryErrOk);
676  }
677  case TIFF_SSHORT:
678  {
679  int16 m;
680  TIFFReadDirEntryCheckedSshort(tif,direntry,&m);
681  *value=(double)m;
682  return(TIFFReadDirEntryErrOk);
683  }
684  case TIFF_LONG:
685  {
686  uint32 m;
687  TIFFReadDirEntryCheckedLong(tif,direntry,&m);
688  *value=(double)m;
689  return(TIFFReadDirEntryErrOk);
690  }
691  case TIFF_SLONG:
692  {
693  int32 m;
694  TIFFReadDirEntryCheckedSlong(tif,direntry,&m);
695  *value=(double)m;
696  return(TIFFReadDirEntryErrOk);
697  }
698  case TIFF_LONG8:
699  {
700  uint64 m;
701  err=TIFFReadDirEntryCheckedLong8(tif,direntry,&m);
702  if (err!=TIFFReadDirEntryErrOk)
703  return(err);
704 #if defined(__WIN32__) && (_MSC_VER < 1500)
705  /*
706  * XXX: MSVC 6.0 does not support conversion
707  * of 64-bit integers into floating point
708  * values.
709  */
710  *value = _TIFFUInt64ToDouble(m);
711 #else
712  *value = (double)m;
713 #endif
714  return(TIFFReadDirEntryErrOk);
715  }
716  case TIFF_SLONG8:
717  {
718  int64 m;
719  err=TIFFReadDirEntryCheckedSlong8(tif,direntry,&m);
720  if (err!=TIFFReadDirEntryErrOk)
721  return(err);
722  *value=(double)m;
723  return(TIFFReadDirEntryErrOk);
724  }
725  case TIFF_RATIONAL:
726  err=TIFFReadDirEntryCheckedRational(tif,direntry,value);
727  return(err);
728  case TIFF_SRATIONAL:
729  err=TIFFReadDirEntryCheckedSrational(tif,direntry,value);
730  return(err);
731  case TIFF_FLOAT:
732  {
733  float m;
734  TIFFReadDirEntryCheckedFloat(tif,direntry,&m);
735  *value=(double)m;
736  return(TIFFReadDirEntryErrOk);
737  }
738  case TIFF_DOUBLE:
739  err=TIFFReadDirEntryCheckedDouble(tif,direntry,value);
740  return(err);
741  default:
742  return(TIFFReadDirEntryErrType);
743  }
744 }
745 
746 static enum TIFFReadDirEntryErr TIFFReadDirEntryIfd8(TIFF* tif, TIFFDirEntry* direntry, uint64* value)
747 {
748  enum TIFFReadDirEntryErr err;
749  if (direntry->tdir_count!=1)
750  return(TIFFReadDirEntryErrCount);
751  switch (direntry->tdir_type)
752  {
753  case TIFF_LONG:
754  case TIFF_IFD:
755  {
756  uint32 m;
757  TIFFReadDirEntryCheckedLong(tif,direntry,&m);
758  *value=(uint64)m;
759  return(TIFFReadDirEntryErrOk);
760  }
761  case TIFF_LONG8:
762  case TIFF_IFD8:
763  err=TIFFReadDirEntryCheckedLong8(tif,direntry,value);
764  return(err);
765  default:
766  return(TIFFReadDirEntryErrType);
767  }
768 }
769 
770 
771 #define INITIAL_THRESHOLD (1024 * 1024)
772 #define THRESHOLD_MULTIPLIER 10
773 #define MAX_THRESHOLD (THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER * INITIAL_THRESHOLD)
774 
775 static enum TIFFReadDirEntryErr TIFFReadDirEntryDataAndRealloc(
776  TIFF* tif, uint64 offset, tmsize_t size, void** pdest)
777 {
778 #if SIZEOF_SIZE_T == 8
779  tmsize_t threshold = INITIAL_THRESHOLD;
780 #endif
781  tmsize_t already_read = 0;
782 
783  assert( !isMapped(tif) );
784 
785  if (!SeekOK(tif,offset))
786  return(TIFFReadDirEntryErrIo);
787 
788  /* On 64 bit processes, read first a maximum of 1 MB, then 10 MB, etc */
789  /* so as to avoid allocating too much memory in case the file is too */
790  /* short. We could ask for the file size, but this might be */
791  /* expensive with some I/O layers (think of reading a gzipped file) */
792  /* Restrict to 64 bit processes, so as to avoid reallocs() */
793  /* on 32 bit processes where virtual memory is scarce. */
794  while( already_read < size )
795  {
796  void* new_dest;
797  tmsize_t bytes_read;
798  tmsize_t to_read = size - already_read;
799 #if SIZEOF_SIZE_T == 8
800  if( to_read >= threshold && threshold < MAX_THRESHOLD )
801  {
802  to_read = threshold;
803  threshold *= THRESHOLD_MULTIPLIER;
804  }
805 #endif
806 
807  new_dest = (uint8*) _TIFFrealloc(
808  *pdest, already_read + to_read);
809  if( new_dest == NULL )
810  {
811  TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
812  "Failed to allocate memory for %s "
813  "(%ld elements of %ld bytes each)",
814  "TIFFReadDirEntryArray",
815  (long) 1, (long) (already_read + to_read));
816  return TIFFReadDirEntryErrAlloc;
817  }
818  *pdest = new_dest;
819 
820  bytes_read = TIFFReadFile(tif,
821  (char*)*pdest + already_read, to_read);
822  already_read += bytes_read;
823  if (bytes_read != to_read) {
824  return TIFFReadDirEntryErrIo;
825  }
826  }
827  return TIFFReadDirEntryErrOk;
828 }
829 
830 static enum TIFFReadDirEntryErr TIFFReadDirEntryArrayWithLimit(
831  TIFF* tif, TIFFDirEntry* direntry, uint32* count, uint32 desttypesize,
832  void** value, uint64 maxcount)
833 {
834  int typesize;
835  uint32 datasize;
836  void* data;
837  uint64 target_count64;
838  typesize=TIFFDataWidth(direntry->tdir_type);
839 
840  target_count64 = (direntry->tdir_count > maxcount) ?
841  maxcount : direntry->tdir_count;
842 
843  if ((target_count64==0)||(typesize==0))
844  {
845  *value=0;
846  return(TIFFReadDirEntryErrOk);
847  }
848  (void) desttypesize;
849 
850  /*
851  * As a sanity check, make sure we have no more than a 2GB tag array
852  * in either the current data type or the dest data type. This also
853  * avoids problems with overflow of tmsize_t on 32bit systems.
854  */
855  if ((uint64)(2147483647/typesize)<target_count64)
856  return(TIFFReadDirEntryErrSizesan);
857  if ((uint64)(2147483647/desttypesize)<target_count64)
858  return(TIFFReadDirEntryErrSizesan);
859 
860  *count=(uint32)target_count64;
861  datasize=(*count)*typesize;
862  assert((tmsize_t)datasize>0);
863 
864  if( isMapped(tif) && datasize > (uint32)tif->tif_size )
865  return TIFFReadDirEntryErrIo;
866 
867  if( !isMapped(tif) &&
868  (((tif->tif_flags&TIFF_BIGTIFF) && datasize > 8) ||
869  (!(tif->tif_flags&TIFF_BIGTIFF) && datasize > 4)) )
870  {
871  data = NULL;
872  }
873  else
874  {
875  data=_TIFFCheckMalloc(tif, *count, typesize, "ReadDirEntryArray");
876  if (data==0)
877  return(TIFFReadDirEntryErrAlloc);
878  }
879  if (!(tif->tif_flags&TIFF_BIGTIFF))
880  {
881  if (datasize<=4)
882  _TIFFmemcpy(data,&direntry->tdir_offset,datasize);
883  else
884  {
885  enum TIFFReadDirEntryErr err;
886  uint32 offset = direntry->tdir_offset.toff_long;
887  if (tif->tif_flags&TIFF_SWAB)
888  TIFFSwabLong(&offset);
889  if( isMapped(tif) )
890  err=TIFFReadDirEntryData(tif,(uint64)offset,(tmsize_t)datasize,data);
891  else
892  err=TIFFReadDirEntryDataAndRealloc(tif,(uint64)offset,(tmsize_t)datasize,&data);
893  if (err!=TIFFReadDirEntryErrOk)
894  {
895  _TIFFfree(data);
896  return(err);
897  }
898  }
899  }
900  else
901  {
902  if (datasize<=8)
903  _TIFFmemcpy(data,&direntry->tdir_offset,datasize);
904  else
905  {
906  enum TIFFReadDirEntryErr err;
907  uint64 offset = direntry->tdir_offset.toff_long8;
908  if (tif->tif_flags&TIFF_SWAB)
909  TIFFSwabLong8(&offset);
910  if( isMapped(tif) )
911  err=TIFFReadDirEntryData(tif,(uint64)offset,(tmsize_t)datasize,data);
912  else
913  err=TIFFReadDirEntryDataAndRealloc(tif,(uint64)offset,(tmsize_t)datasize,&data);
914  if (err!=TIFFReadDirEntryErrOk)
915  {
916  _TIFFfree(data);
917  return(err);
918  }
919  }
920  }
921  *value=data;
922  return(TIFFReadDirEntryErrOk);
923 }
924 
925 static enum TIFFReadDirEntryErr TIFFReadDirEntryArray(TIFF* tif, TIFFDirEntry* direntry, uint32* count, uint32 desttypesize, void** value)
926 {
927  return TIFFReadDirEntryArrayWithLimit(tif, direntry, count,
928  desttypesize, value, ~((uint64)0));
929 }
930 
931 static enum TIFFReadDirEntryErr TIFFReadDirEntryByteArray(TIFF* tif, TIFFDirEntry* direntry, uint8** value)
932 {
933  enum TIFFReadDirEntryErr err;
934  uint32 count;
935  void* origdata;
936  uint8* data;
937  switch (direntry->tdir_type)
938  {
939  case TIFF_ASCII:
940  case TIFF_UNDEFINED:
941  case TIFF_BYTE:
942  case TIFF_SBYTE:
943  case TIFF_SHORT:
944  case TIFF_SSHORT:
945  case TIFF_LONG:
946  case TIFF_SLONG:
947  case TIFF_LONG8:
948  case TIFF_SLONG8:
949  break;
950  default:
951  return(TIFFReadDirEntryErrType);
952  }
953  err=TIFFReadDirEntryArray(tif,direntry,&count,1,&origdata);
954  if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
955  {
956  *value=0;
957  return(err);
958  }
959  switch (direntry->tdir_type)
960  {
961  case TIFF_ASCII:
962  case TIFF_UNDEFINED:
963  case TIFF_BYTE:
964  *value=(uint8*)origdata;
965  return(TIFFReadDirEntryErrOk);
966  case TIFF_SBYTE:
967  {
968  int8* m;
969  uint32 n;
970  m=(int8*)origdata;
971  for (n=0; n<count; n++)
972  {
973  err=TIFFReadDirEntryCheckRangeByteSbyte(*m);
974  if (err!=TIFFReadDirEntryErrOk)
975  {
976  _TIFFfree(origdata);
977  return(err);
978  }
979  m++;
980  }
981  *value=(uint8*)origdata;
982  return(TIFFReadDirEntryErrOk);
983  }
984  }
985  data=(uint8*)_TIFFmalloc(count);
986  if (data==0)
987  {
988  _TIFFfree(origdata);
989  return(TIFFReadDirEntryErrAlloc);
990  }
991  switch (direntry->tdir_type)
992  {
993  case TIFF_SHORT:
994  {
995  uint16* ma;
996  uint8* mb;
997  uint32 n;
998  ma=(uint16*)origdata;
999  mb=data;
1000  for (n=0; n<count; n++)
1001  {
1002  if (tif->tif_flags&TIFF_SWAB)
1003  TIFFSwabShort(ma);
1004  err=TIFFReadDirEntryCheckRangeByteShort(*ma);
1005  if (err!=TIFFReadDirEntryErrOk)
1006  break;
1007  *mb++=(uint8)(*ma++);
1008  }
1009  }
1010  break;
1011  case TIFF_SSHORT:
1012  {
1013  int16* ma;
1014  uint8* mb;
1015  uint32 n;
1016  ma=(int16*)origdata;
1017  mb=data;
1018  for (n=0; n<count; n++)
1019  {
1020  if (tif->tif_flags&TIFF_SWAB)
1021  TIFFSwabShort((uint16*)ma);
1022  err=TIFFReadDirEntryCheckRangeByteSshort(*ma);
1023  if (err!=TIFFReadDirEntryErrOk)
1024  break;
1025  *mb++=(uint8)(*ma++);
1026  }
1027  }
1028  break;
1029  case TIFF_LONG:
1030  {
1031  uint32* ma;
1032  uint8* mb;
1033  uint32 n;
1034  ma=(uint32*)origdata;
1035  mb=data;
1036  for (n=0; n<count; n++)
1037  {
1038  if (tif->tif_flags&TIFF_SWAB)
1039  TIFFSwabLong(ma);
1040  err=TIFFReadDirEntryCheckRangeByteLong(*ma);
1041  if (err!=TIFFReadDirEntryErrOk)
1042  break;
1043  *mb++=(uint8)(*ma++);
1044  }
1045  }
1046  break;
1047  case TIFF_SLONG:
1048  {
1049  int32* ma;
1050  uint8* mb;
1051  uint32 n;
1052  ma=(int32*)origdata;
1053  mb=data;
1054  for (n=0; n<count; n++)
1055  {
1056  if (tif->tif_flags&TIFF_SWAB)
1057  TIFFSwabLong((uint32*)ma);
1058  err=TIFFReadDirEntryCheckRangeByteSlong(*ma);
1059  if (err!=TIFFReadDirEntryErrOk)
1060  break;
1061  *mb++=(uint8)(*ma++);
1062  }
1063  }
1064  break;
1065  case TIFF_LONG8:
1066  {
1067  uint64* ma;
1068  uint8* mb;
1069  uint32 n;
1070  ma=(uint64*)origdata;
1071  mb=data;
1072  for (n=0; n<count; n++)
1073  {
1074  if (tif->tif_flags&TIFF_SWAB)
1075  TIFFSwabLong8(ma);
1076  err=TIFFReadDirEntryCheckRangeByteLong8(*ma);
1077  if (err!=TIFFReadDirEntryErrOk)
1078  break;
1079  *mb++=(uint8)(*ma++);
1080  }
1081  }
1082  break;
1083  case TIFF_SLONG8:
1084  {
1085  int64* ma;
1086  uint8* mb;
1087  uint32 n;
1088  ma=(int64*)origdata;
1089  mb=data;
1090  for (n=0; n<count; n++)
1091  {
1092  if (tif->tif_flags&TIFF_SWAB)
1093  TIFFSwabLong8((uint64*)ma);
1094  err=TIFFReadDirEntryCheckRangeByteSlong8(*ma);
1095  if (err!=TIFFReadDirEntryErrOk)
1096  break;
1097  *mb++=(uint8)(*ma++);
1098  }
1099  }
1100  break;
1101  }
1102  _TIFFfree(origdata);
1103  if (err!=TIFFReadDirEntryErrOk)
1104  {
1105  _TIFFfree(data);
1106  return(err);
1107  }
1108  *value=data;
1109  return(TIFFReadDirEntryErrOk);
1110 }
1111 
1112 static enum TIFFReadDirEntryErr TIFFReadDirEntrySbyteArray(TIFF* tif, TIFFDirEntry* direntry, int8** value)
1113 {
1114  enum TIFFReadDirEntryErr err;
1115  uint32 count;
1116  void* origdata;
1117  int8* data;
1118  switch (direntry->tdir_type)
1119  {
1120  case TIFF_UNDEFINED:
1121  case TIFF_BYTE:
1122  case TIFF_SBYTE:
1123  case TIFF_SHORT:
1124  case TIFF_SSHORT:
1125  case TIFF_LONG:
1126  case TIFF_SLONG:
1127  case TIFF_LONG8:
1128  case TIFF_SLONG8:
1129  break;
1130  default:
1131  return(TIFFReadDirEntryErrType);
1132  }
1133  err=TIFFReadDirEntryArray(tif,direntry,&count,1,&origdata);
1134  if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
1135  {
1136  *value=0;
1137  return(err);
1138  }
1139  switch (direntry->tdir_type)
1140  {
1141  case TIFF_UNDEFINED:
1142  case TIFF_BYTE:
1143  {
1144  uint8* m;
1145  uint32 n;
1146  m=(uint8*)origdata;
1147  for (n=0; n<count; n++)
1148  {
1149  err=TIFFReadDirEntryCheckRangeSbyteByte(*m);
1150  if (err!=TIFFReadDirEntryErrOk)
1151  {
1152  _TIFFfree(origdata);
1153  return(err);
1154  }
1155  m++;
1156  }
1157  *value=(int8*)origdata;
1158  return(TIFFReadDirEntryErrOk);
1159  }
1160  case TIFF_SBYTE:
1161  *value=(int8*)origdata;
1162  return(TIFFReadDirEntryErrOk);
1163  }
1164  data=(int8*)_TIFFmalloc(count);
1165  if (data==0)
1166  {
1167  _TIFFfree(origdata);
1168  return(TIFFReadDirEntryErrAlloc);
1169  }
1170  switch (direntry->tdir_type)
1171  {
1172  case TIFF_SHORT:
1173  {
1174  uint16* ma;
1175  int8* mb;
1176  uint32 n;
1177  ma=(uint16*)origdata;
1178  mb=data;
1179  for (n=0; n<count; n++)
1180  {
1181  if (tif->tif_flags&TIFF_SWAB)
1182  TIFFSwabShort(ma);
1183  err=TIFFReadDirEntryCheckRangeSbyteShort(*ma);
1184  if (err!=TIFFReadDirEntryErrOk)
1185  break;
1186  *mb++=(int8)(*ma++);
1187  }
1188  }
1189  break;
1190  case TIFF_SSHORT:
1191  {
1192  int16* ma;
1193  int8* mb;
1194  uint32 n;
1195  ma=(int16*)origdata;
1196  mb=data;
1197  for (n=0; n<count; n++)
1198  {
1199  if (tif->tif_flags&TIFF_SWAB)
1200  TIFFSwabShort((uint16*)ma);
1201  err=TIFFReadDirEntryCheckRangeSbyteSshort(*ma);
1202  if (err!=TIFFReadDirEntryErrOk)
1203  break;
1204  *mb++=(int8)(*ma++);
1205  }
1206  }
1207  break;
1208  case TIFF_LONG:
1209  {
1210  uint32* ma;
1211  int8* mb;
1212  uint32 n;
1213  ma=(uint32*)origdata;
1214  mb=data;
1215  for (n=0; n<count; n++)
1216  {
1217  if (tif->tif_flags&TIFF_SWAB)
1218  TIFFSwabLong(ma);
1219  err=TIFFReadDirEntryCheckRangeSbyteLong(*ma);
1220  if (err!=TIFFReadDirEntryErrOk)
1221  break;
1222  *mb++=(int8)(*ma++);
1223  }
1224  }
1225  break;
1226  case TIFF_SLONG:
1227  {
1228  int32* ma;
1229  int8* mb;
1230  uint32 n;
1231  ma=(int32*)origdata;
1232  mb=data;
1233  for (n=0; n<count; n++)
1234  {
1235  if (tif->tif_flags&TIFF_SWAB)
1236  TIFFSwabLong((uint32*)ma);
1237  err=TIFFReadDirEntryCheckRangeSbyteSlong(*ma);
1238  if (err!=TIFFReadDirEntryErrOk)
1239  break;
1240  *mb++=(int8)(*ma++);
1241  }
1242  }
1243  break;
1244  case TIFF_LONG8:
1245  {
1246  uint64* ma;
1247  int8* mb;
1248  uint32 n;
1249  ma=(uint64*)origdata;
1250  mb=data;
1251  for (n=0; n<count; n++)
1252  {
1253  if (tif->tif_flags&TIFF_SWAB)
1254  TIFFSwabLong8(ma);
1255  err=TIFFReadDirEntryCheckRangeSbyteLong8(*ma);
1256  if (err!=TIFFReadDirEntryErrOk)
1257  break;
1258  *mb++=(int8)(*ma++);
1259  }
1260  }
1261  break;
1262  case TIFF_SLONG8:
1263  {
1264  int64* ma;
1265  int8* mb;
1266  uint32 n;
1267  ma=(int64*)origdata;
1268  mb=data;
1269  for (n=0; n<count; n++)
1270  {
1271  if (tif->tif_flags&TIFF_SWAB)
1272  TIFFSwabLong8((uint64*)ma);
1273  err=TIFFReadDirEntryCheckRangeSbyteSlong8(*ma);
1274  if (err!=TIFFReadDirEntryErrOk)
1275  break;
1276  *mb++=(int8)(*ma++);
1277  }
1278  }
1279  break;
1280  }
1281  _TIFFfree(origdata);
1282  if (err!=TIFFReadDirEntryErrOk)
1283  {
1284  _TIFFfree(data);
1285  return(err);
1286  }
1287  *value=data;
1288  return(TIFFReadDirEntryErrOk);
1289 }
1290 
1291 static enum TIFFReadDirEntryErr TIFFReadDirEntryShortArray(TIFF* tif, TIFFDirEntry* direntry, uint16** value)
1292 {
1293  enum TIFFReadDirEntryErr err;
1294  uint32 count;
1295  void* origdata;
1296  uint16* data;
1297  switch (direntry->tdir_type)
1298  {
1299  case TIFF_BYTE:
1300  case TIFF_SBYTE:
1301  case TIFF_SHORT:
1302  case TIFF_SSHORT:
1303  case TIFF_LONG:
1304  case TIFF_SLONG:
1305  case TIFF_LONG8:
1306  case TIFF_SLONG8:
1307  break;
1308  default:
1309  return(TIFFReadDirEntryErrType);
1310  }
1311  err=TIFFReadDirEntryArray(tif,direntry,&count,2,&origdata);
1312  if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
1313  {
1314  *value=0;
1315  return(err);
1316  }
1317  switch (direntry->tdir_type)
1318  {
1319  case TIFF_SHORT:
1320  *value=(uint16*)origdata;
1321  if (tif->tif_flags&TIFF_SWAB)
1322  TIFFSwabArrayOfShort(*value,count);
1323  return(TIFFReadDirEntryErrOk);
1324  case TIFF_SSHORT:
1325  {
1326  int16* m;
1327  uint32 n;
1328  m=(int16*)origdata;
1329  for (n=0; n<count; n++)
1330  {
1331  if (tif->tif_flags&TIFF_SWAB)
1332  TIFFSwabShort((uint16*)m);
1333  err=TIFFReadDirEntryCheckRangeShortSshort(*m);
1334  if (err!=TIFFReadDirEntryErrOk)
1335  {
1336  _TIFFfree(origdata);
1337  return(err);
1338  }
1339  m++;
1340  }
1341  *value=(uint16*)origdata;
1342  return(TIFFReadDirEntryErrOk);
1343  }
1344  }
1345  data=(uint16*)_TIFFmalloc(count*2);
1346  if (data==0)
1347  {
1348  _TIFFfree(origdata);
1349  return(TIFFReadDirEntryErrAlloc);
1350  }
1351  switch (direntry->tdir_type)
1352  {
1353  case TIFF_BYTE:
1354  {
1355  uint8* ma;
1356  uint16* mb;
1357  uint32 n;
1358  ma=(uint8*)origdata;
1359  mb=data;
1360  for (n=0; n<count; n++)
1361  *mb++=(uint16)(*ma++);
1362  }
1363  break;
1364  case TIFF_SBYTE:
1365  {
1366  int8* ma;
1367  uint16* mb;
1368  uint32 n;
1369  ma=(int8*)origdata;
1370  mb=data;
1371  for (n=0; n<count; n++)
1372  {
1373  err=TIFFReadDirEntryCheckRangeShortSbyte(*ma);
1374  if (err!=TIFFReadDirEntryErrOk)
1375  break;
1376  *mb++=(uint16)(*ma++);
1377  }
1378  }
1379  break;
1380  case TIFF_LONG:
1381  {
1382  uint32* ma;
1383  uint16* mb;
1384  uint32 n;
1385  ma=(uint32*)origdata;
1386  mb=data;
1387  for (n=0; n<count; n++)
1388  {
1389  if (tif->tif_flags&TIFF_SWAB)
1390  TIFFSwabLong(ma);
1391  err=TIFFReadDirEntryCheckRangeShortLong(*ma);
1392  if (err!=TIFFReadDirEntryErrOk)
1393  break;
1394  *mb++=(uint16)(*ma++);
1395  }
1396  }
1397  break;
1398  case TIFF_SLONG:
1399  {
1400  int32* ma;
1401  uint16* mb;
1402  uint32 n;
1403  ma=(int32*)origdata;
1404  mb=data;
1405  for (n=0; n<count; n++)
1406  {
1407  if (tif->tif_flags&TIFF_SWAB)
1408  TIFFSwabLong((uint32*)ma);
1409  err=TIFFReadDirEntryCheckRangeShortSlong(*ma);
1410  if (err!=TIFFReadDirEntryErrOk)
1411  break;
1412  *mb++=(uint16)(*ma++);
1413  }
1414  }
1415  break;
1416  case TIFF_LONG8:
1417  {
1418  uint64* ma;
1419  uint16* mb;
1420  uint32 n;
1421  ma=(uint64*)origdata;
1422  mb=data;
1423  for (n=0; n<count; n++)
1424  {
1425  if (tif->tif_flags&TIFF_SWAB)
1426  TIFFSwabLong8(ma);
1427  err=TIFFReadDirEntryCheckRangeShortLong8(*ma);
1428  if (err!=TIFFReadDirEntryErrOk)
1429  break;
1430  *mb++=(uint16)(*ma++);
1431  }
1432  }
1433  break;
1434  case TIFF_SLONG8:
1435  {
1436  int64* ma;
1437  uint16* mb;
1438  uint32 n;
1439  ma=(int64*)origdata;
1440  mb=data;
1441  for (n=0; n<count; n++)
1442  {
1443  if (tif->tif_flags&TIFF_SWAB)
1444  TIFFSwabLong8((uint64*)ma);
1445  err=TIFFReadDirEntryCheckRangeShortSlong8(*ma);
1446  if (err!=TIFFReadDirEntryErrOk)
1447  break;
1448  *mb++=(uint16)(*ma++);
1449  }
1450  }
1451  break;
1452  }
1453  _TIFFfree(origdata);
1454  if (err!=TIFFReadDirEntryErrOk)
1455  {
1456  _TIFFfree(data);
1457  return(err);
1458  }
1459  *value=data;
1460  return(TIFFReadDirEntryErrOk);
1461 }
1462 
1463 static enum TIFFReadDirEntryErr TIFFReadDirEntrySshortArray(TIFF* tif, TIFFDirEntry* direntry, int16** value)
1464 {
1465  enum TIFFReadDirEntryErr err;
1466  uint32 count;
1467  void* origdata;
1468  int16* data;
1469  switch (direntry->tdir_type)
1470  {
1471  case TIFF_BYTE:
1472  case TIFF_SBYTE:
1473  case TIFF_SHORT:
1474  case TIFF_SSHORT:
1475  case TIFF_LONG:
1476  case TIFF_SLONG:
1477  case TIFF_LONG8:
1478  case TIFF_SLONG8:
1479  break;
1480  default:
1481  return(TIFFReadDirEntryErrType);
1482  }
1483  err=TIFFReadDirEntryArray(tif,direntry,&count,2,&origdata);
1484  if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
1485  {
1486  *value=0;
1487  return(err);
1488  }
1489  switch (direntry->tdir_type)
1490  {
1491  case TIFF_SHORT:
1492  {
1493  uint16* m;
1494  uint32 n;
1495  m=(uint16*)origdata;
1496  for (n=0; n<count; n++)
1497  {
1498  if (tif->tif_flags&TIFF_SWAB)
1499  TIFFSwabShort(m);
1500  err=TIFFReadDirEntryCheckRangeSshortShort(*m);
1501  if (err!=TIFFReadDirEntryErrOk)
1502  {
1503  _TIFFfree(origdata);
1504  return(err);
1505  }
1506  m++;
1507  }
1508  *value=(int16*)origdata;
1509  return(TIFFReadDirEntryErrOk);
1510  }
1511  case TIFF_SSHORT:
1512  *value=(int16*)origdata;
1513  if (tif->tif_flags&TIFF_SWAB)
1514  TIFFSwabArrayOfShort((uint16*)(*value),count);
1515  return(TIFFReadDirEntryErrOk);
1516  }
1517  data=(int16*)_TIFFmalloc(count*2);
1518  if (data==0)
1519  {
1520  _TIFFfree(origdata);
1521  return(TIFFReadDirEntryErrAlloc);
1522  }
1523  switch (direntry->tdir_type)
1524  {
1525  case TIFF_BYTE:
1526  {
1527  uint8* ma;
1528  int16* mb;
1529  uint32 n;
1530  ma=(uint8*)origdata;
1531  mb=data;
1532  for (n=0; n<count; n++)
1533  *mb++=(int16)(*ma++);
1534  }
1535  break;
1536  case TIFF_SBYTE:
1537  {
1538  int8* ma;
1539  int16* mb;
1540  uint32 n;
1541  ma=(int8*)origdata;
1542  mb=data;
1543  for (n=0; n<count; n++)
1544  *mb++=(int16)(*ma++);
1545  }
1546  break;
1547  case TIFF_LONG:
1548  {
1549  uint32* ma;
1550  int16* mb;
1551  uint32 n;
1552  ma=(uint32*)origdata;
1553  mb=data;
1554  for (n=0; n<count; n++)
1555  {
1556  if (tif->tif_flags&TIFF_SWAB)
1557  TIFFSwabLong(ma);
1558  err=TIFFReadDirEntryCheckRangeSshortLong(*ma);
1559  if (err!=TIFFReadDirEntryErrOk)
1560  break;
1561  *mb++=(int16)(*ma++);
1562  }
1563  }
1564  break;
1565  case TIFF_SLONG:
1566  {
1567  int32* ma;
1568  int16* mb;
1569  uint32 n;
1570  ma=(int32*)origdata;
1571  mb=data;
1572  for (n=0; n<count; n++)
1573  {
1574  if (tif->tif_flags&TIFF_SWAB)
1575  TIFFSwabLong((uint32*)ma);
1576  err=TIFFReadDirEntryCheckRangeSshortSlong(*ma);
1577  if (err!=TIFFReadDirEntryErrOk)
1578  break;
1579  *mb++=(int16)(*ma++);
1580  }
1581  }
1582  break;
1583  case TIFF_LONG8:
1584  {
1585  uint64* ma;
1586  int16* mb;
1587  uint32 n;
1588  ma=(uint64*)origdata;
1589  mb=data;
1590  for (n=0; n<count; n++)
1591  {
1592  if (tif->tif_flags&TIFF_SWAB)
1593  TIFFSwabLong8(ma);
1594  err=TIFFReadDirEntryCheckRangeSshortLong8(*ma);
1595  if (err!=TIFFReadDirEntryErrOk)
1596  break;
1597  *mb++=(int16)(*ma++);
1598  }
1599  }
1600  break;
1601  case TIFF_SLONG8:
1602  {
1603  int64* ma;
1604  int16* mb;
1605  uint32 n;
1606  ma=(int64*)origdata;
1607  mb=data;
1608  for (n=0; n<count; n++)
1609  {
1610  if (tif->tif_flags&TIFF_SWAB)
1611  TIFFSwabLong8((uint64*)ma);
1612  err=TIFFReadDirEntryCheckRangeSshortSlong8(*ma);
1613  if (err!=TIFFReadDirEntryErrOk)
1614  break;
1615  *mb++=(int16)(*ma++);
1616  }
1617  }
1618  break;
1619  }
1620  _TIFFfree(origdata);
1621  if (err!=TIFFReadDirEntryErrOk)
1622  {
1623  _TIFFfree(data);
1624  return(err);
1625  }
1626  *value=data;
1627  return(TIFFReadDirEntryErrOk);
1628 }
1629 
1630 static enum TIFFReadDirEntryErr TIFFReadDirEntryLongArray(TIFF* tif, TIFFDirEntry* direntry, uint32** value)
1631 {
1632  enum TIFFReadDirEntryErr err;
1633  uint32 count;
1634  void* origdata;
1635  uint32* data;
1636  switch (direntry->tdir_type)
1637  {
1638  case TIFF_BYTE:
1639  case TIFF_SBYTE:
1640  case TIFF_SHORT:
1641  case TIFF_SSHORT:
1642  case TIFF_LONG:
1643  case TIFF_SLONG:
1644  case TIFF_LONG8:
1645  case TIFF_SLONG8:
1646  break;
1647  default:
1648  return(TIFFReadDirEntryErrType);
1649  }
1650  err=TIFFReadDirEntryArray(tif,direntry,&count,4,&origdata);
1651  if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
1652  {
1653  *value=0;
1654  return(err);
1655  }
1656  switch (direntry->tdir_type)
1657  {
1658  case TIFF_LONG:
1659  *value=(uint32*)origdata;
1660  if (tif->tif_flags&TIFF_SWAB)
1661  TIFFSwabArrayOfLong(*value,count);
1662  return(TIFFReadDirEntryErrOk);
1663  case TIFF_SLONG:
1664  {
1665  int32* m;
1666  uint32 n;
1667  m=(int32*)origdata;
1668  for (n=0; n<count; n++)
1669  {
1670  if (tif->tif_flags&TIFF_SWAB)
1671  TIFFSwabLong((uint32*)m);
1672  err=TIFFReadDirEntryCheckRangeLongSlong(*m);
1673  if (err!=TIFFReadDirEntryErrOk)
1674  {
1675  _TIFFfree(origdata);
1676  return(err);
1677  }
1678  m++;
1679  }
1680  *value=(uint32*)origdata;
1681  return(TIFFReadDirEntryErrOk);
1682  }
1683  }
1684  data=(uint32*)_TIFFmalloc(count*4);
1685  if (data==0)
1686  {
1687  _TIFFfree(origdata);
1688  return(TIFFReadDirEntryErrAlloc);
1689  }
1690  switch (direntry->tdir_type)
1691  {
1692  case TIFF_BYTE:
1693  {
1694  uint8* ma;
1695  uint32* mb;
1696  uint32 n;
1697  ma=(uint8*)origdata;
1698  mb=data;
1699  for (n=0; n<count; n++)
1700  *mb++=(uint32)(*ma++);
1701  }
1702  break;
1703  case TIFF_SBYTE:
1704  {
1705  int8* ma;
1706  uint32* mb;
1707  uint32 n;
1708  ma=(int8*)origdata;
1709  mb=data;
1710  for (n=0; n<count; n++)
1711  {
1712  err=TIFFReadDirEntryCheckRangeLongSbyte(*ma);
1713  if (err!=TIFFReadDirEntryErrOk)
1714  break;
1715  *mb++=(uint32)(*ma++);
1716  }
1717  }
1718  break;
1719  case TIFF_SHORT:
1720  {
1721  uint16* ma;
1722  uint32* mb;
1723  uint32 n;
1724  ma=(uint16*)origdata;
1725  mb=data;
1726  for (n=0; n<count; n++)
1727  {
1728  if (tif->tif_flags&TIFF_SWAB)
1729  TIFFSwabShort(ma);
1730  *mb++=(uint32)(*ma++);
1731  }
1732  }
1733  break;
1734  case TIFF_SSHORT:
1735  {
1736  int16* ma;
1737  uint32* mb;
1738  uint32 n;
1739  ma=(int16*)origdata;
1740  mb=data;
1741  for (n=0; n<count; n++)
1742  {
1743  if (tif->tif_flags&TIFF_SWAB)
1744  TIFFSwabShort((uint16*)ma);
1745  err=TIFFReadDirEntryCheckRangeLongSshort(*ma);
1746  if (err!=TIFFReadDirEntryErrOk)
1747  break;
1748  *mb++=(uint32)(*ma++);
1749  }
1750  }
1751  break;
1752  case TIFF_LONG8:
1753  {
1754  uint64* ma;
1755  uint32* mb;
1756  uint32 n;
1757  ma=(uint64*)origdata;
1758  mb=data;
1759  for (n=0; n<count; n++)
1760  {
1761  if (tif->tif_flags&TIFF_SWAB)
1762  TIFFSwabLong8(ma);
1763  err=TIFFReadDirEntryCheckRangeLongLong8(*ma);
1764  if (err!=TIFFReadDirEntryErrOk)
1765  break;
1766  *mb++=(uint32)(*ma++);
1767  }
1768  }
1769  break;
1770  case TIFF_SLONG8:
1771  {
1772  int64* ma;
1773  uint32* mb;
1774  uint32 n;
1775  ma=(int64*)origdata;
1776  mb=data;
1777  for (n=0; n<count; n++)
1778  {
1779  if (tif->tif_flags&TIFF_SWAB)
1780  TIFFSwabLong8((uint64*)ma);
1781  err=TIFFReadDirEntryCheckRangeLongSlong8(*ma);
1782  if (err!=TIFFReadDirEntryErrOk)
1783  break;
1784  *mb++=(uint32)(*ma++);
1785  }
1786  }
1787  break;
1788  }
1789  _TIFFfree(origdata);
1790  if (err!=TIFFReadDirEntryErrOk)
1791  {
1792  _TIFFfree(data);
1793  return(err);
1794  }
1795  *value=data;
1796  return(TIFFReadDirEntryErrOk);
1797 }
1798 
1799 static enum TIFFReadDirEntryErr TIFFReadDirEntrySlongArray(TIFF* tif, TIFFDirEntry* direntry, int32** value)
1800 {
1801  enum TIFFReadDirEntryErr err;
1802  uint32 count;
1803  void* origdata;
1804  int32* data;
1805  switch (direntry->tdir_type)
1806  {
1807  case TIFF_BYTE:
1808  case TIFF_SBYTE:
1809  case TIFF_SHORT:
1810  case TIFF_SSHORT:
1811  case TIFF_LONG:
1812  case TIFF_SLONG:
1813  case TIFF_LONG8:
1814  case TIFF_SLONG8:
1815  break;
1816  default:
1817  return(TIFFReadDirEntryErrType);
1818  }
1819  err=TIFFReadDirEntryArray(tif,direntry,&count,4,&origdata);
1820  if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
1821  {
1822  *value=0;
1823  return(err);
1824  }
1825  switch (direntry->tdir_type)
1826  {
1827  case TIFF_LONG:
1828  {
1829  uint32* m;
1830  uint32 n;
1831  m=(uint32*)origdata;
1832  for (n=0; n<count; n++)
1833  {
1834  if (tif->tif_flags&TIFF_SWAB)
1835  TIFFSwabLong((uint32*)m);
1836  err=TIFFReadDirEntryCheckRangeSlongLong(*m);
1837  if (err!=TIFFReadDirEntryErrOk)
1838  {
1839  _TIFFfree(origdata);
1840  return(err);
1841  }
1842  m++;
1843  }
1844  *value=(int32*)origdata;
1845  return(TIFFReadDirEntryErrOk);
1846  }
1847  case TIFF_SLONG:
1848  *value=(int32*)origdata;
1849  if (tif->tif_flags&TIFF_SWAB)
1850  TIFFSwabArrayOfLong((uint32*)(*value),count);
1851  return(TIFFReadDirEntryErrOk);
1852  }
1853  data=(int32*)_TIFFmalloc(count*4);
1854  if (data==0)
1855  {
1856  _TIFFfree(origdata);
1857  return(TIFFReadDirEntryErrAlloc);
1858  }
1859  switch (direntry->tdir_type)
1860  {
1861  case TIFF_BYTE:
1862  {
1863  uint8* ma;
1864  int32* mb;
1865  uint32 n;
1866  ma=(uint8*)origdata;
1867  mb=data;
1868  for (n=0; n<count; n++)
1869  *mb++=(int32)(*ma++);
1870  }
1871  break;
1872  case TIFF_SBYTE:
1873  {
1874  int8* ma;
1875  int32* mb;
1876  uint32 n;
1877  ma=(int8*)origdata;
1878  mb=data;
1879  for (n=0; n<count; n++)
1880  *mb++=(int32)(*ma++);
1881  }
1882  break;
1883  case TIFF_SHORT:
1884  {
1885  uint16* ma;
1886  int32* mb;
1887  uint32 n;
1888  ma=(uint16*)origdata;
1889  mb=data;
1890  for (n=0; n<count; n++)
1891  {
1892  if (tif->tif_flags&TIFF_SWAB)
1893  TIFFSwabShort(ma);
1894  *mb++=(int32)(*ma++);
1895  }
1896  }
1897  break;
1898  case TIFF_SSHORT:
1899  {
1900  int16* ma;
1901  int32* mb;
1902  uint32 n;
1903  ma=(int16*)origdata;
1904  mb=data;
1905  for (n=0; n<count; n++)
1906  {
1907  if (tif->tif_flags&TIFF_SWAB)
1908  TIFFSwabShort((uint16*)ma);
1909  *mb++=(int32)(*ma++);
1910  }
1911  }
1912  break;
1913  case TIFF_LONG8:
1914  {
1915  uint64* ma;
1916  int32* mb;
1917  uint32 n;
1918  ma=(uint64*)origdata;
1919  mb=data;
1920  for (n=0; n<count; n++)
1921  {
1922  if (tif->tif_flags&TIFF_SWAB)
1923  TIFFSwabLong8(ma);
1924  err=TIFFReadDirEntryCheckRangeSlongLong8(*ma);
1925  if (err!=TIFFReadDirEntryErrOk)
1926  break;
1927  *mb++=(int32)(*ma++);
1928  }
1929  }
1930  break;
1931  case TIFF_SLONG8:
1932  {
1933  int64* ma;
1934  int32* mb;
1935  uint32 n;
1936  ma=(int64*)origdata;
1937  mb=data;
1938  for (n=0; n<count; n++)
1939  {
1940  if (tif->tif_flags&TIFF_SWAB)
1941  TIFFSwabLong8((uint64*)ma);
1942  err=TIFFReadDirEntryCheckRangeSlongSlong8(*ma);
1943  if (err!=TIFFReadDirEntryErrOk)
1944  break;
1945  *mb++=(int32)(*ma++);
1946  }
1947  }
1948  break;
1949  }
1950  _TIFFfree(origdata);
1951  if (err!=TIFFReadDirEntryErrOk)
1952  {
1953  _TIFFfree(data);
1954  return(err);
1955  }
1956  *value=data;
1957  return(TIFFReadDirEntryErrOk);
1958 }
1959 
1960 static enum TIFFReadDirEntryErr TIFFReadDirEntryLong8ArrayWithLimit(
1961  TIFF* tif, TIFFDirEntry* direntry, uint64** value, uint64 maxcount)
1962 {
1963  enum TIFFReadDirEntryErr err;
1964  uint32 count;
1965  void* origdata;
1966  uint64* data;
1967  switch (direntry->tdir_type)
1968  {
1969  case TIFF_BYTE:
1970  case TIFF_SBYTE:
1971  case TIFF_SHORT:
1972  case TIFF_SSHORT:
1973  case TIFF_LONG:
1974  case TIFF_SLONG:
1975  case TIFF_LONG8:
1976  case TIFF_SLONG8:
1977  break;
1978  default:
1979  return(TIFFReadDirEntryErrType);
1980  }
1981  err=TIFFReadDirEntryArrayWithLimit(tif,direntry,&count,8,&origdata,maxcount);
1982  if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
1983  {
1984  *value=0;
1985  return(err);
1986  }
1987  switch (direntry->tdir_type)
1988  {
1989  case TIFF_LONG8:
1990  *value=(uint64*)origdata;
1991  if (tif->tif_flags&TIFF_SWAB)
1992  TIFFSwabArrayOfLong8(*value,count);
1993  return(TIFFReadDirEntryErrOk);
1994  case TIFF_SLONG8:
1995  {
1996  int64* m;
1997  uint32 n;
1998  m=(int64*)origdata;
1999  for (n=0; n<count; n++)
2000  {
2001  if (tif->tif_flags&TIFF_SWAB)
2002  TIFFSwabLong8((uint64*)m);
2003  err=TIFFReadDirEntryCheckRangeLong8Slong8(*m);
2004  if (err!=TIFFReadDirEntryErrOk)
2005  {
2006  _TIFFfree(origdata);
2007  return(err);
2008  }
2009  m++;
2010  }
2011  *value=(uint64*)origdata;
2012  return(TIFFReadDirEntryErrOk);
2013  }
2014  }
2015  data=(uint64*)_TIFFmalloc(count*8);
2016  if (data==0)
2017  {
2018  _TIFFfree(origdata);
2019  return(TIFFReadDirEntryErrAlloc);
2020  }
2021  switch (direntry->tdir_type)
2022  {
2023  case TIFF_BYTE:
2024  {
2025  uint8* ma;
2026  uint64* mb;
2027  uint32 n;
2028  ma=(uint8*)origdata;
2029  mb=data;
2030  for (n=0; n<count; n++)
2031  *mb++=(uint64)(*ma++);
2032  }
2033  break;
2034  case TIFF_SBYTE:
2035  {
2036  int8* ma;
2037  uint64* mb;
2038  uint32 n;
2039  ma=(int8*)origdata;
2040  mb=data;
2041  for (n=0; n<count; n++)
2042  {
2043  err=TIFFReadDirEntryCheckRangeLong8Sbyte(*ma);
2044  if (err!=TIFFReadDirEntryErrOk)
2045  break;
2046  *mb++=(uint64)(*ma++);
2047  }
2048  }
2049  break;
2050  case TIFF_SHORT:
2051  {
2052  uint16* ma;
2053  uint64* mb;
2054  uint32 n;
2055  ma=(uint16*)origdata;
2056  mb=data;
2057  for (n=0; n<count; n++)
2058  {
2059  if (tif->tif_flags&TIFF_SWAB)
2060  TIFFSwabShort(ma);
2061  *mb++=(uint64)(*ma++);
2062  }
2063  }
2064  break;
2065  case TIFF_SSHORT:
2066  {
2067  int16* ma;
2068  uint64* mb;
2069  uint32 n;
2070  ma=(int16*)origdata;
2071  mb=data;
2072  for (n=0; n<count; n++)
2073  {
2074  if (tif->tif_flags&TIFF_SWAB)
2075  TIFFSwabShort((uint16*)ma);
2076  err=TIFFReadDirEntryCheckRangeLong8Sshort(*ma);
2077  if (err!=TIFFReadDirEntryErrOk)
2078  break;
2079  *mb++=(uint64)(*ma++);
2080  }
2081  }
2082  break;
2083  case TIFF_LONG:
2084  {
2085  uint32* ma;
2086  uint64* mb;
2087  uint32 n;
2088  ma=(uint32*)origdata;
2089  mb=data;
2090  for (n=0; n<count; n++)
2091  {
2092  if (tif->tif_flags&TIFF_SWAB)
2093  TIFFSwabLong(ma);
2094  *mb++=(uint64)(*ma++);
2095  }
2096  }
2097  break;
2098  case TIFF_SLONG:
2099  {
2100  int32* ma;
2101  uint64* mb;
2102  uint32 n;
2103  ma=(int32*)origdata;
2104  mb=data;
2105  for (n=0; n<count; n++)
2106  {
2107  if (tif->tif_flags&TIFF_SWAB)
2108  TIFFSwabLong((uint32*)ma);
2109  err=TIFFReadDirEntryCheckRangeLong8Slong(*ma);
2110  if (err!=TIFFReadDirEntryErrOk)
2111  break;
2112  *mb++=(uint64)(*ma++);
2113  }
2114  }
2115  break;
2116  }
2117  _TIFFfree(origdata);
2118  if (err!=TIFFReadDirEntryErrOk)
2119  {
2120  _TIFFfree(data);
2121  return(err);
2122  }
2123  *value=data;
2124  return(TIFFReadDirEntryErrOk);
2125 }
2126 
2127 static enum TIFFReadDirEntryErr TIFFReadDirEntryLong8Array(TIFF* tif, TIFFDirEntry* direntry, uint64** value)
2128 {
2129  return TIFFReadDirEntryLong8ArrayWithLimit(tif, direntry, value, ~((uint64)0));
2130 }
2131 
2132 static enum TIFFReadDirEntryErr TIFFReadDirEntrySlong8Array(TIFF* tif, TIFFDirEntry* direntry, int64** value)
2133 {
2134  enum TIFFReadDirEntryErr err;
2135  uint32 count;
2136  void* origdata;
2137  int64* data;
2138  switch (direntry->tdir_type)
2139  {
2140  case TIFF_BYTE:
2141  case TIFF_SBYTE:
2142  case TIFF_SHORT:
2143  case TIFF_SSHORT:
2144  case TIFF_LONG:
2145  case TIFF_SLONG:
2146  case TIFF_LONG8:
2147  case TIFF_SLONG8:
2148  break;
2149  default:
2150  return(TIFFReadDirEntryErrType);
2151  }
2152  err=TIFFReadDirEntryArray(tif,direntry,&count,8,&origdata);
2153  if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
2154  {
2155  *value=0;
2156  return(err);
2157  }
2158  switch (direntry->tdir_type)
2159  {
2160  case TIFF_LONG8:
2161  {
2162  uint64* m;
2163  uint32 n;
2164  m=(uint64*)origdata;
2165  for (n=0; n<count; n++)
2166  {
2167  if (tif->tif_flags&TIFF_SWAB)
2168  TIFFSwabLong8(m);
2169  err=TIFFReadDirEntryCheckRangeSlong8Long8(*m);
2170  if (err!=TIFFReadDirEntryErrOk)
2171  {
2172  _TIFFfree(origdata);
2173  return(err);
2174  }
2175  m++;
2176  }
2177  *value=(int64*)origdata;
2178  return(TIFFReadDirEntryErrOk);
2179  }
2180  case TIFF_SLONG8:
2181  *value=(int64*)origdata;
2182  if (tif->tif_flags&TIFF_SWAB)
2183  TIFFSwabArrayOfLong8((uint64*)(*value),count);
2184  return(TIFFReadDirEntryErrOk);
2185  }
2186  data=(int64*)_TIFFmalloc(count*8);
2187  if (data==0)
2188  {
2189  _TIFFfree(origdata);
2190  return(TIFFReadDirEntryErrAlloc);
2191  }
2192  switch (direntry->tdir_type)
2193  {
2194  case TIFF_BYTE:
2195  {
2196  uint8* ma;
2197  int64* mb;
2198  uint32 n;
2199  ma=(uint8*)origdata;
2200  mb=data;
2201  for (n=0; n<count; n++)
2202  *mb++=(int64)(*ma++);
2203  }
2204  break;
2205  case TIFF_SBYTE:
2206  {
2207  int8* ma;
2208  int64* mb;
2209  uint32 n;
2210  ma=(int8*)origdata;
2211  mb=data;
2212  for (n=0; n<count; n++)
2213  *mb++=(int64)(*ma++);
2214  }
2215  break;
2216  case TIFF_SHORT:
2217  {
2218  uint16* ma;
2219  int64* mb;
2220  uint32 n;
2221  ma=(uint16*)origdata;
2222  mb=data;
2223  for (n=0; n<count; n++)
2224  {
2225  if (tif->tif_flags&TIFF_SWAB)
2226  TIFFSwabShort(ma);
2227  *mb++=(int64)(*ma++);
2228  }
2229  }
2230  break;
2231  case TIFF_SSHORT:
2232  {
2233  int16* ma;
2234  int64* mb;
2235  uint32 n;
2236  ma=(int16*)origdata;
2237  mb=data;
2238  for (n=0; n<count; n++)
2239  {
2240  if (tif->tif_flags&TIFF_SWAB)
2241  TIFFSwabShort((uint16*)ma);
2242  *mb++=(int64)(*ma++);
2243  }
2244  }
2245  break;
2246  case TIFF_LONG:
2247  {
2248  uint32* ma;
2249  int64* mb;
2250  uint32 n;
2251  ma=(uint32*)origdata;
2252  mb=data;
2253  for (n=0; n<count; n++)
2254  {
2255  if (tif->tif_flags&TIFF_SWAB)
2256  TIFFSwabLong(ma);
2257  *mb++=(int64)(*ma++);
2258  }
2259  }
2260  break;
2261  case TIFF_SLONG:
2262  {
2263  int32* ma;
2264  int64* mb;
2265  uint32 n;
2266  ma=(int32*)origdata;
2267  mb=data;
2268  for (n=0; n<count; n++)
2269  {
2270  if (tif->tif_flags&TIFF_SWAB)
2271  TIFFSwabLong((uint32*)ma);
2272  *mb++=(int64)(*ma++);
2273  }
2274  }
2275  break;
2276  }
2277  _TIFFfree(origdata);
2278  *value=data;
2279  return(TIFFReadDirEntryErrOk);
2280 }
2281 
2282 static enum TIFFReadDirEntryErr TIFFReadDirEntryFloatArray(TIFF* tif, TIFFDirEntry* direntry, float** value)
2283 {
2284  enum TIFFReadDirEntryErr err;
2285  uint32 count;
2286  void* origdata;
2287  float* data;
2288  switch (direntry->tdir_type)
2289  {
2290  case TIFF_BYTE:
2291  case TIFF_SBYTE:
2292  case TIFF_SHORT:
2293  case TIFF_SSHORT:
2294  case TIFF_LONG:
2295  case TIFF_SLONG:
2296  case TIFF_LONG8:
2297  case TIFF_SLONG8:
2298  case TIFF_RATIONAL:
2299  case TIFF_SRATIONAL:
2300  case TIFF_FLOAT:
2301  case TIFF_DOUBLE:
2302  break;
2303  default:
2304  return(TIFFReadDirEntryErrType);
2305  }
2306  err=TIFFReadDirEntryArray(tif,direntry,&count,4,&origdata);
2307  if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
2308  {
2309  *value=0;
2310  return(err);
2311  }
2312  switch (direntry->tdir_type)
2313  {
2314  case TIFF_FLOAT:
2315  if (tif->tif_flags&TIFF_SWAB)
2316  TIFFSwabArrayOfLong((uint32*)origdata,count);
2317  TIFFCvtIEEEDoubleToNative(tif,count,(float*)origdata);
2318  *value=(float*)origdata;
2319  return(TIFFReadDirEntryErrOk);
2320  }
2321  data=(float*)_TIFFmalloc(count*sizeof(float));
2322  if (data==0)
2323  {
2324  _TIFFfree(origdata);
2325  return(TIFFReadDirEntryErrAlloc);
2326  }
2327  switch (direntry->tdir_type)
2328  {
2329  case TIFF_BYTE:
2330  {
2331  uint8* ma;
2332  float* mb;
2333  uint32 n;
2334  ma=(uint8*)origdata;
2335  mb=data;
2336  for (n=0; n<count; n++)
2337  *mb++=(float)(*ma++);
2338  }
2339  break;
2340  case TIFF_SBYTE:
2341  {
2342  int8* ma;
2343  float* mb;
2344  uint32 n;
2345  ma=(int8*)origdata;
2346  mb=data;
2347  for (n=0; n<count; n++)
2348  *mb++=(float)(*ma++);
2349  }
2350  break;
2351  case TIFF_SHORT:
2352  {
2353  uint16* ma;
2354  float* mb;
2355  uint32 n;
2356  ma=(uint16*)origdata;
2357  mb=data;
2358  for (n=0; n<count; n++)
2359  {
2360  if (tif->tif_flags&TIFF_SWAB)
2361  TIFFSwabShort(ma);
2362  *mb++=(float)(*ma++);
2363  }
2364  }
2365  break;
2366  case TIFF_SSHORT:
2367  {
2368  int16* ma;
2369  float* mb;
2370  uint32 n;
2371  ma=(int16*)origdata;
2372  mb=data;
2373  for (n=0; n<count; n++)
2374  {
2375  if (tif->tif_flags&TIFF_SWAB)
2376  TIFFSwabShort((uint16*)ma);
2377  *mb++=(float)(*ma++);
2378  }
2379  }
2380  break;
2381  case TIFF_LONG:
2382  {
2383  uint32* ma;
2384  float* mb;
2385  uint32 n;
2386  ma=(uint32*)origdata;
2387  mb=data;
2388  for (n=0; n<count; n++)
2389  {
2390  if (tif->tif_flags&TIFF_SWAB)
2391  TIFFSwabLong(ma);
2392  *mb++=(float)(*ma++);
2393  }
2394  }
2395  break;
2396  case TIFF_SLONG:
2397  {
2398  int32* ma;
2399  float* mb;
2400  uint32 n;
2401  ma=(int32*)origdata;
2402  mb=data;
2403  for (n=0; n<count; n++)
2404  {
2405  if (tif->tif_flags&TIFF_SWAB)
2406  TIFFSwabLong((uint32*)ma);
2407  *mb++=(float)(*ma++);
2408  }
2409  }
2410  break;
2411  case TIFF_LONG8:
2412  {
2413  uint64* ma;
2414  float* mb;
2415  uint32 n;
2416  ma=(uint64*)origdata;
2417  mb=data;
2418  for (n=0; n<count; n++)
2419  {
2420  if (tif->tif_flags&TIFF_SWAB)
2421  TIFFSwabLong8(ma);
2422 #if defined(__WIN32__) && (_MSC_VER < 1500)
2423  /*
2424  * XXX: MSVC 6.0 does not support
2425  * conversion of 64-bit integers into
2426  * floating point values.
2427  */
2428  *mb++ = _TIFFUInt64ToFloat(*ma++);
2429 #else
2430  *mb++ = (float)(*ma++);
2431 #endif
2432  }
2433  }
2434  break;
2435  case TIFF_SLONG8:
2436  {
2437  int64* ma;
2438  float* mb;
2439  uint32 n;
2440  ma=(int64*)origdata;
2441  mb=data;
2442  for (n=0; n<count; n++)
2443  {
2444  if (tif->tif_flags&TIFF_SWAB)
2445  TIFFSwabLong8((uint64*)ma);
2446  *mb++=(float)(*ma++);
2447  }
2448  }
2449  break;
2450  case TIFF_RATIONAL:
2451  {
2452  uint32* ma;
2453  uint32 maa;
2454  uint32 mab;
2455  float* mb;
2456  uint32 n;
2457  ma=(uint32*)origdata;
2458  mb=data;
2459  for (n=0; n<count; n++)
2460  {
2461  if (tif->tif_flags&TIFF_SWAB)
2462  TIFFSwabLong(ma);
2463  maa=*ma++;
2464  if (tif->tif_flags&TIFF_SWAB)
2465  TIFFSwabLong(ma);
2466  mab=*ma++;
2467  if (mab==0)
2468  *mb++=0.0;
2469  else
2470  *mb++=(float)maa/(float)mab;
2471  }
2472  }
2473  break;
2474  case TIFF_SRATIONAL:
2475  {
2476  uint32* ma;
2477  int32 maa;
2478  uint32 mab;
2479  float* mb;
2480  uint32 n;
2481  ma=(uint32*)origdata;
2482  mb=data;
2483  for (n=0; n<count; n++)
2484  {
2485  if (tif->tif_flags&TIFF_SWAB)
2486  TIFFSwabLong(ma);
2487  maa=*(int32*)ma;
2488  ma++;
2489  if (tif->tif_flags&TIFF_SWAB)
2490  TIFFSwabLong(ma);
2491  mab=*ma++;
2492  if (mab==0)
2493  *mb++=0.0;
2494  else
2495  *mb++=(float)maa/(float)mab;
2496  }
2497  }
2498  break;
2499  case TIFF_DOUBLE:
2500  {
2501  double* ma;
2502  float* mb;
2503  uint32 n;
2504  if (tif->tif_flags&TIFF_SWAB)
2505  TIFFSwabArrayOfLong8((uint64*)origdata,count);
2506  TIFFCvtIEEEDoubleToNative(tif,count,(double*)origdata);
2507  ma=(double*)origdata;
2508  mb=data;
2509  for (n=0; n<count; n++)
2510  {
2511  double val = *ma++;
2512  if( val > FLT_MAX )
2513  val = FLT_MAX;
2514  else if( val < -FLT_MAX )
2515  val = -FLT_MAX;
2516  *mb++=(float)val;
2517  }
2518  }
2519  break;
2520  }
2521  _TIFFfree(origdata);
2522  *value=data;
2523  return(TIFFReadDirEntryErrOk);
2524 }
2525 
2526 static enum TIFFReadDirEntryErr
2527 TIFFReadDirEntryDoubleArray(TIFF* tif, TIFFDirEntry* direntry, double** value)
2528 {
2529  enum TIFFReadDirEntryErr err;
2530  uint32 count;
2531  void* origdata;
2532  double* data;
2533  switch (direntry->tdir_type)
2534  {
2535  case TIFF_BYTE:
2536  case TIFF_SBYTE:
2537  case TIFF_SHORT:
2538  case TIFF_SSHORT:
2539  case TIFF_LONG:
2540  case TIFF_SLONG:
2541  case TIFF_LONG8:
2542  case TIFF_SLONG8:
2543  case TIFF_RATIONAL:
2544  case TIFF_SRATIONAL:
2545  case TIFF_FLOAT:
2546  case TIFF_DOUBLE:
2547  break;
2548  default:
2549  return(TIFFReadDirEntryErrType);
2550  }
2551  err=TIFFReadDirEntryArray(tif,direntry,&count,8,&origdata);
2552  if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
2553  {
2554  *value=0;
2555  return(err);
2556  }
2557  switch (direntry->tdir_type)
2558  {
2559  case TIFF_DOUBLE:
2560  if (tif->tif_flags&TIFF_SWAB)
2561  TIFFSwabArrayOfLong8((uint64*)origdata,count);
2562  TIFFCvtIEEEDoubleToNative(tif,count,(double*)origdata);
2563  *value=(double*)origdata;
2564  return(TIFFReadDirEntryErrOk);
2565  }
2566  data=(double*)_TIFFmalloc(count*sizeof(double));
2567  if (data==0)
2568  {
2569  _TIFFfree(origdata);
2570  return(TIFFReadDirEntryErrAlloc);
2571  }
2572  switch (direntry->tdir_type)
2573  {
2574  case TIFF_BYTE:
2575  {
2576  uint8* ma;
2577  double* mb;
2578  uint32 n;
2579  ma=(uint8*)origdata;
2580  mb=data;
2581  for (n=0; n<count; n++)
2582  *mb++=(double)(*ma++);
2583  }
2584  break;
2585  case TIFF_SBYTE:
2586  {
2587  int8* ma;
2588  double* mb;
2589  uint32 n;
2590  ma=(int8*)origdata;
2591  mb=data;
2592  for (n=0; n<count; n++)
2593  *mb++=(double)(*ma++);
2594  }
2595  break;
2596  case TIFF_SHORT:
2597  {
2598  uint16* ma;
2599  double* mb;
2600  uint32 n;
2601  ma=(uint16*)origdata;
2602  mb=data;
2603  for (n=0; n<count; n++)
2604  {
2605  if (tif->tif_flags&TIFF_SWAB)
2606  TIFFSwabShort(ma);
2607  *mb++=(double)(*ma++);
2608  }
2609  }
2610  break;
2611  case TIFF_SSHORT:
2612  {
2613  int16* ma;
2614  double* mb;
2615  uint32 n;
2616  ma=(int16*)origdata;
2617  mb=data;
2618  for (n=0; n<count; n++)
2619  {
2620  if (tif->tif_flags&TIFF_SWAB)
2621  TIFFSwabShort((uint16*)ma);
2622  *mb++=(double)(*ma++);
2623  }
2624  }
2625  break;
2626  case TIFF_LONG:
2627  {
2628  uint32* ma;
2629  double* mb;
2630  uint32 n;
2631  ma=(uint32*)origdata;
2632  mb=data;
2633  for (n=0; n<count; n++)
2634  {
2635  if (tif->tif_flags&TIFF_SWAB)
2636  TIFFSwabLong(ma);
2637  *mb++=(double)(*ma++);
2638  }
2639  }
2640  break;
2641  case TIFF_SLONG:
2642  {
2643  int32* ma;
2644  double* mb;
2645  uint32 n;
2646  ma=(int32*)origdata;
2647  mb=data;
2648  for (n=0; n<count; n++)
2649  {
2650  if (tif->tif_flags&TIFF_SWAB)
2651  TIFFSwabLong((uint32*)ma);
2652  *mb++=(double)(*ma++);
2653  }
2654  }
2655  break;
2656  case TIFF_LONG8:
2657  {
2658  uint64* ma;
2659  double* mb;
2660  uint32 n;
2661  ma=(uint64*)origdata;
2662  mb=data;
2663  for (n=0; n<count; n++)
2664  {
2665  if (tif->tif_flags&TIFF_SWAB)
2666  TIFFSwabLong8(ma);
2667 #if defined(__WIN32__) && (_MSC_VER < 1500)
2668  /*
2669  * XXX: MSVC 6.0 does not support
2670  * conversion of 64-bit integers into
2671  * floating point values.
2672  */
2673  *mb++ = _TIFFUInt64ToDouble(*ma++);
2674 #else
2675  *mb++ = (double)(*ma++);
2676 #endif
2677  }
2678  }
2679  break;
2680  case TIFF_SLONG8:
2681  {
2682  int64* ma;
2683  double* mb;
2684  uint32 n;
2685  ma=(int64*)origdata;
2686  mb=data;
2687  for (n=0; n<count; n++)
2688  {
2689  if (tif->tif_flags&TIFF_SWAB)
2690  TIFFSwabLong8((uint64*)ma);
2691  *mb++=(double)(*ma++);
2692  }
2693  }
2694  break;
2695  case TIFF_RATIONAL:
2696  {
2697  uint32* ma;
2698  uint32 maa;
2699  uint32 mab;
2700  double* mb;
2701  uint32 n;
2702  ma=(uint32*)origdata;
2703  mb=data;
2704  for (n=0; n<count; n++)
2705  {
2706  if (tif->tif_flags&TIFF_SWAB)
2707  TIFFSwabLong(ma);
2708  maa=*ma++;
2709  if (tif->tif_flags&TIFF_SWAB)
2710  TIFFSwabLong(ma);
2711  mab=*ma++;
2712  if (mab==0)
2713  *mb++=0.0;
2714  else
2715  *mb++=(double)maa/(double)mab;
2716  }
2717  }
2718  break;
2719  case TIFF_SRATIONAL:
2720  {
2721  uint32* ma;
2722  int32 maa;
2723  uint32 mab;
2724  double* mb;
2725  uint32 n;
2726  ma=(uint32*)origdata;
2727  mb=data;
2728  for (n=0; n<count; n++)
2729  {
2730  if (tif->tif_flags&TIFF_SWAB)
2731  TIFFSwabLong(ma);
2732  maa=*(int32*)ma;
2733  ma++;
2734  if (tif->tif_flags&TIFF_SWAB)
2735  TIFFSwabLong(ma);
2736  mab=*ma++;
2737  if (mab==0)
2738  *mb++=0.0;
2739  else
2740  *mb++=(double)maa/(double)mab;
2741  }
2742  }
2743  break;
2744  case TIFF_FLOAT:
2745  {
2746  float* ma;
2747  double* mb;
2748  uint32 n;
2749  if (tif->tif_flags&TIFF_SWAB)
2750  TIFFSwabArrayOfLong((uint32*)origdata,count);
2751  TIFFCvtIEEEFloatToNative(tif,count,(float*)origdata);
2752  ma=(float*)origdata;
2753  mb=data;
2754  for (n=0; n<count; n++)
2755  *mb++=(double)(*ma++);
2756  }
2757  break;
2758  }
2759  _TIFFfree(origdata);
2760  *value=data;
2761  return(TIFFReadDirEntryErrOk);
2762 }
2763 
2764 static enum TIFFReadDirEntryErr TIFFReadDirEntryIfd8Array(TIFF* tif, TIFFDirEntry* direntry, uint64** value)
2765 {
2766  enum TIFFReadDirEntryErr err;
2767  uint32 count;
2768  void* origdata;
2769  uint64* data;
2770  switch (direntry->tdir_type)
2771  {
2772  case TIFF_LONG:
2773  case TIFF_LONG8:
2774  case TIFF_IFD:
2775  case TIFF_IFD8:
2776  break;
2777  default:
2778  return(TIFFReadDirEntryErrType);
2779  }
2780  err=TIFFReadDirEntryArray(tif,direntry,&count,8,&origdata);
2781  if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
2782  {
2783  *value=0;
2784  return(err);
2785  }
2786  switch (direntry->tdir_type)
2787  {
2788  case TIFF_LONG8:
2789  case TIFF_IFD8:
2790  *value=(uint64*)origdata;
2791  if (tif->tif_flags&TIFF_SWAB)
2792  TIFFSwabArrayOfLong8(*value,count);
2793  return(TIFFReadDirEntryErrOk);
2794  }
2795  data=(uint64*)_TIFFmalloc(count*8);
2796  if (data==0)
2797  {
2798  _TIFFfree(origdata);
2799  return(TIFFReadDirEntryErrAlloc);
2800  }
2801  switch (direntry->tdir_type)
2802  {
2803  case TIFF_LONG:
2804  case TIFF_IFD:
2805  {
2806  uint32* ma;
2807  uint64* mb;
2808  uint32 n;
2809  ma=(uint32*)origdata;
2810  mb=data;
2811  for (n=0; n<count; n++)
2812  {
2813  if (tif->tif_flags&TIFF_SWAB)
2814  TIFFSwabLong(ma);
2815  *mb++=(uint64)(*ma++);
2816  }
2817  }
2818  break;
2819  }
2820  _TIFFfree(origdata);
2821  *value=data;
2822  return(TIFFReadDirEntryErrOk);
2823 }
2824 
2825 static enum TIFFReadDirEntryErr TIFFReadDirEntryPersampleShort(TIFF* tif, TIFFDirEntry* direntry, uint16* value)
2826 {
2827  enum TIFFReadDirEntryErr err;
2828  uint16* m;
2829  uint16* na;
2830  uint16 nb;
2831  if (direntry->tdir_count<(uint64)tif->tif_dir.td_samplesperpixel)
2832  return(TIFFReadDirEntryErrCount);
2833  err=TIFFReadDirEntryShortArray(tif,direntry,&m);
2834  if (err!=TIFFReadDirEntryErrOk || m == NULL)
2835  return(err);
2836  na=m;
2837  nb=tif->tif_dir.td_samplesperpixel;
2838  *value=*na++;
2839  nb--;
2840  while (nb>0)
2841  {
2842  if (*na++!=*value)
2843  {
2844  err=TIFFReadDirEntryErrPsdif;
2845  break;
2846  }
2847  nb--;
2848  }
2849  _TIFFfree(m);
2850  return(err);
2851 }
2852 
2853 #if 0
2854 static enum TIFFReadDirEntryErr TIFFReadDirEntryPersampleDouble(TIFF* tif, TIFFDirEntry* direntry, double* value)
2855 {
2856  enum TIFFReadDirEntryErr err;
2857  double* m;
2858  double* na;
2859  uint16 nb;
2860  if (direntry->tdir_count<(uint64)tif->tif_dir.td_samplesperpixel)
2861  return(TIFFReadDirEntryErrCount);
2862  err=TIFFReadDirEntryDoubleArray(tif,direntry,&m);
2863  if (err!=TIFFReadDirEntryErrOk)
2864  return(err);
2865  na=m;
2866  nb=tif->tif_dir.td_samplesperpixel;
2867  *value=*na++;
2868  nb--;
2869  while (nb>0)
2870  {
2871  if (*na++!=*value)
2872  {
2873  err=TIFFReadDirEntryErrPsdif;
2874  break;
2875  }
2876  nb--;
2877  }
2878  _TIFFfree(m);
2879  return(err);
2880 }
2881 #endif
2882 
2883 static void TIFFReadDirEntryCheckedByte(TIFF* tif, TIFFDirEntry* direntry, uint8* value)
2884 {
2885  (void) tif;
2886  *value=*(uint8*)(&direntry->tdir_offset);
2887 }
2888 
2889 static void TIFFReadDirEntryCheckedSbyte(TIFF* tif, TIFFDirEntry* direntry, int8* value)
2890 {
2891  (void) tif;
2892  *value=*(int8*)(&direntry->tdir_offset);
2893 }
2894 
2895 static void TIFFReadDirEntryCheckedShort(TIFF* tif, TIFFDirEntry* direntry, uint16* value)
2896 {
2897  *value = direntry->tdir_offset.toff_short;
2898  /* *value=*(uint16*)(&direntry->tdir_offset); */
2899  if (tif->tif_flags&TIFF_SWAB)
2900  TIFFSwabShort(value);
2901 }
2902 
2903 static void TIFFReadDirEntryCheckedSshort(TIFF* tif, TIFFDirEntry* direntry, int16* value)
2904 {
2905  *value=*(int16*)(&direntry->tdir_offset);
2906  if (tif->tif_flags&TIFF_SWAB)
2907  TIFFSwabShort((uint16*)value);
2908 }
2909 
2910 static void TIFFReadDirEntryCheckedLong(TIFF* tif, TIFFDirEntry* direntry, uint32* value)
2911 {
2912  *value=*(uint32*)(&direntry->tdir_offset);
2913  if (tif->tif_flags&TIFF_SWAB)
2914  TIFFSwabLong(value);
2915 }
2916 
2917 static void TIFFReadDirEntryCheckedSlong(TIFF* tif, TIFFDirEntry* direntry, int32* value)
2918 {
2919  *value=*(int32*)(&direntry->tdir_offset);
2920  if (tif->tif_flags&TIFF_SWAB)
2921  TIFFSwabLong((uint32*)value);
2922 }
2923 
2924 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedLong8(TIFF* tif, TIFFDirEntry* direntry, uint64* value)
2925 {
2926  if (!(tif->tif_flags&TIFF_BIGTIFF))
2927  {
2928  enum TIFFReadDirEntryErr err;
2929  uint32 offset = direntry->tdir_offset.toff_long;
2930  if (tif->tif_flags&TIFF_SWAB)
2931  TIFFSwabLong(&offset);
2932  err=TIFFReadDirEntryData(tif,offset,8,value);
2933  if (err!=TIFFReadDirEntryErrOk)
2934  return(err);
2935  }
2936  else
2937  *value = direntry->tdir_offset.toff_long8;
2938  if (tif->tif_flags&TIFF_SWAB)
2939  TIFFSwabLong8(value);
2940  return(TIFFReadDirEntryErrOk);
2941 }
2942 
2943 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedSlong8(TIFF* tif, TIFFDirEntry* direntry, int64* value)
2944 {
2945  if (!(tif->tif_flags&TIFF_BIGTIFF))
2946  {
2947  enum TIFFReadDirEntryErr err;
2948  uint32 offset = direntry->tdir_offset.toff_long;
2949  if (tif->tif_flags&TIFF_SWAB)
2950  TIFFSwabLong(&offset);
2951  err=TIFFReadDirEntryData(tif,offset,8,value);
2952  if (err!=TIFFReadDirEntryErrOk)
2953  return(err);
2954  }
2955  else
2956  *value=*(int64*)(&direntry->tdir_offset);
2957  if (tif->tif_flags&TIFF_SWAB)
2958  TIFFSwabLong8((uint64*)value);
2959  return(TIFFReadDirEntryErrOk);
2960 }
2961 
2962 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedRational(TIFF* tif, TIFFDirEntry* direntry, double* value)
2963 {
2964  UInt64Aligned_t m;
2965 
2966  assert(sizeof(double)==8);
2967  assert(sizeof(uint64)==8);
2968  assert(sizeof(uint32)==4);
2969  if (!(tif->tif_flags&TIFF_BIGTIFF))
2970  {
2971  enum TIFFReadDirEntryErr err;
2972  uint32 offset = direntry->tdir_offset.toff_long;
2973  if (tif->tif_flags&TIFF_SWAB)
2974  TIFFSwabLong(&offset);
2975  err=TIFFReadDirEntryData(tif,offset,8,m.i);
2976  if (err!=TIFFReadDirEntryErrOk)
2977  return(err);
2978  }
2979  else
2980  m.l = direntry->tdir_offset.toff_long8;
2981  if (tif->tif_flags&TIFF_SWAB)
2982  TIFFSwabArrayOfLong(m.i,2);
2983  /* Not completely sure what we should do when m.i[1]==0, but some */
2984  /* sanitizers do not like division by 0.0: */
2985  /* http://bugzilla.maptools.org/show_bug.cgi?id=2644 */
2986  if (m.i[0]==0 || m.i[1]==0)
2987  *value=0.0;
2988  else
2989  *value=(double)m.i[0]/(double)m.i[1];
2990  return(TIFFReadDirEntryErrOk);
2991 }
2992 
2993 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedSrational(TIFF* tif, TIFFDirEntry* direntry, double* value)
2994 {
2995  UInt64Aligned_t m;
2996  assert(sizeof(double)==8);
2997  assert(sizeof(uint64)==8);
2998  assert(sizeof(int32)==4);
2999  assert(sizeof(uint32)==4);
3000  if (!(tif->tif_flags&TIFF_BIGTIFF))
3001  {
3002  enum TIFFReadDirEntryErr err;
3003  uint32 offset = direntry->tdir_offset.toff_long;
3004  if (tif->tif_flags&TIFF_SWAB)
3005  TIFFSwabLong(&offset);
3006  err=TIFFReadDirEntryData(tif,offset,8,m.i);
3007  if (err!=TIFFReadDirEntryErrOk)
3008  return(err);
3009  }
3010  else
3011  m.l=direntry->tdir_offset.toff_long8;
3012  if (tif->tif_flags&TIFF_SWAB)
3013  TIFFSwabArrayOfLong(m.i,2);
3014  /* Not completely sure what we should do when m.i[1]==0, but some */
3015  /* sanitizers do not like division by 0.0: */
3016  /* http://bugzilla.maptools.org/show_bug.cgi?id=2644 */
3017  if ((int32)m.i[0]==0 || m.i[1]==0)
3018  *value=0.0;
3019  else
3020  *value=(double)((int32)m.i[0])/(double)m.i[1];
3021  return(TIFFReadDirEntryErrOk);
3022 }
3023 
3024 static void TIFFReadDirEntryCheckedFloat(TIFF* tif, TIFFDirEntry* direntry, float* value)
3025 {
3026  union
3027  {
3028  float f;
3029  uint32 i;
3030  } float_union;
3031  assert(sizeof(float)==4);
3032  assert(sizeof(uint32)==4);
3033  assert(sizeof(float_union)==4);
3034  float_union.i=*(uint32*)(&direntry->tdir_offset);
3035  *value=float_union.f;
3036  if (tif->tif_flags&TIFF_SWAB)
3037  TIFFSwabLong((uint32*)value);
3038 }
3039 
3040 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedDouble(TIFF* tif, TIFFDirEntry* direntry, double* value)
3041 {
3042  assert(sizeof(double)==8);
3043  assert(sizeof(uint64)==8);
3044  assert(sizeof(UInt64Aligned_t)==8);
3045  if (!(tif->tif_flags&TIFF_BIGTIFF))
3046  {
3047  enum TIFFReadDirEntryErr err;
3048  uint32 offset = direntry->tdir_offset.toff_long;
3049  if (tif->tif_flags&TIFF_SWAB)
3050  TIFFSwabLong(&offset);
3051  err=TIFFReadDirEntryData(tif,offset,8,value);
3052  if (err!=TIFFReadDirEntryErrOk)
3053  return(err);
3054  }
3055  else
3056  {
3057  UInt64Aligned_t uint64_union;
3058  uint64_union.l=direntry->tdir_offset.toff_long8;
3059  *value=uint64_union.d;
3060  }
3061  if (tif->tif_flags&TIFF_SWAB)
3062  TIFFSwabLong8((uint64*)value);
3063  return(TIFFReadDirEntryErrOk);
3064 }
3065 
3066 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSbyte(int8 value)
3067 {
3068  if (value<0)
3069  return(TIFFReadDirEntryErrRange);
3070  else
3071  return(TIFFReadDirEntryErrOk);
3072 }
3073 
3074 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteShort(uint16 value)
3075 {
3076  if (value>0xFF)
3077  return(TIFFReadDirEntryErrRange);
3078  else
3079  return(TIFFReadDirEntryErrOk);
3080 }
3081 
3082 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSshort(int16 value)
3083 {
3084  if ((value<0)||(value>0xFF))
3085  return(TIFFReadDirEntryErrRange);
3086  else
3087  return(TIFFReadDirEntryErrOk);
3088 }
3089 
3090 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteLong(uint32 value)
3091 {
3092  if (value>0xFF)
3093  return(TIFFReadDirEntryErrRange);
3094  else
3095  return(TIFFReadDirEntryErrOk);
3096 }
3097 
3098 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSlong(int32 value)
3099 {
3100  if ((value<0)||(value>0xFF))
3101  return(TIFFReadDirEntryErrRange);
3102  else
3103  return(TIFFReadDirEntryErrOk);
3104 }
3105 
3106 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteLong8(uint64 value)
3107 {
3108  if (value>0xFF)
3109  return(TIFFReadDirEntryErrRange);
3110  else
3111  return(TIFFReadDirEntryErrOk);
3112 }
3113 
3114 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSlong8(int64 value)
3115 {
3116  if ((value<0)||(value>0xFF))
3117  return(TIFFReadDirEntryErrRange);
3118  else
3119  return(TIFFReadDirEntryErrOk);
3120 }
3121 
3122 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteByte(uint8 value)
3123 {
3124  if (value>0x7F)
3125  return(TIFFReadDirEntryErrRange);
3126  else
3127  return(TIFFReadDirEntryErrOk);
3128 }
3129 
3130 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteShort(uint16 value)
3131 {
3132  if (value>0x7F)
3133  return(TIFFReadDirEntryErrRange);
3134  else
3135  return(TIFFReadDirEntryErrOk);
3136 }
3137 
3138 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteSshort(int16 value)
3139 {
3140  if ((value<-0x80)||(value>0x7F))
3141  return(TIFFReadDirEntryErrRange);
3142  else
3143  return(TIFFReadDirEntryErrOk);
3144 }
3145 
3146 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteLong(uint32 value)
3147 {
3148  if (value>0x7F)
3149  return(TIFFReadDirEntryErrRange);
3150  else
3151  return(TIFFReadDirEntryErrOk);
3152 }
3153 
3154 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteSlong(int32 value)
3155 {
3156  if ((value<-0x80)||(value>0x7F))
3157  return(TIFFReadDirEntryErrRange);
3158  else
3159  return(TIFFReadDirEntryErrOk);
3160 }
3161 
3162 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteLong8(uint64 value)
3163 {
3164  if (value>0x7F)
3165  return(TIFFReadDirEntryErrRange);
3166  else
3167  return(TIFFReadDirEntryErrOk);
3168 }
3169 
3170 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteSlong8(int64 value)
3171 {
3172  if ((value<-0x80)||(value>0x7F))
3173  return(TIFFReadDirEntryErrRange);
3174  else
3175  return(TIFFReadDirEntryErrOk);
3176 }
3177 
3178 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSbyte(int8 value)
3179 {
3180  if (value<0)
3181  return(TIFFReadDirEntryErrRange);
3182  else
3183  return(TIFFReadDirEntryErrOk);
3184 }
3185 
3186 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSshort(int16 value)
3187 {
3188  if (value<0)
3189  return(TIFFReadDirEntryErrRange);
3190  else
3191  return(TIFFReadDirEntryErrOk);
3192 }
3193 
3194 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortLong(uint32 value)
3195 {
3196  if (value>0xFFFF)
3197  return(TIFFReadDirEntryErrRange);
3198  else
3199  return(TIFFReadDirEntryErrOk);
3200 }
3201 
3202 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSlong(int32 value)
3203 {
3204  if ((value<0)||(value>0xFFFF))
3205  return(TIFFReadDirEntryErrRange);
3206  else
3207  return(TIFFReadDirEntryErrOk);
3208 }
3209 
3210 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortLong8(uint64 value)
3211 {
3212  if (value>0xFFFF)
3213  return(TIFFReadDirEntryErrRange);
3214  else
3215  return(TIFFReadDirEntryErrOk);
3216 }
3217 
3218 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSlong8(int64 value)
3219 {
3220  if ((value<0)||(value>0xFFFF))
3221  return(TIFFReadDirEntryErrRange);
3222  else
3223  return(TIFFReadDirEntryErrOk);
3224 }
3225 
3226 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortShort(uint16 value)
3227 {
3228  if (value>0x7FFF)
3229  return(TIFFReadDirEntryErrRange);
3230  else
3231  return(TIFFReadDirEntryErrOk);
3232 }
3233 
3234 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortLong(uint32 value)
3235 {
3236  if (value>0x7FFF)
3237  return(TIFFReadDirEntryErrRange);
3238  else
3239  return(TIFFReadDirEntryErrOk);
3240 }
3241 
3242 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortSlong(int32 value)
3243 {
3244  if ((value<-0x8000)||(value>0x7FFF))
3245  return(TIFFReadDirEntryErrRange);
3246  else
3247  return(TIFFReadDirEntryErrOk);
3248 }
3249 
3250 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortLong8(uint64 value)
3251 {
3252  if (value>0x7FFF)
3253  return(TIFFReadDirEntryErrRange);
3254  else
3255  return(TIFFReadDirEntryErrOk);
3256 }
3257 
3258 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortSlong8(int64 value)
3259 {
3260  if ((value<-0x8000)||(value>0x7FFF))
3261  return(TIFFReadDirEntryErrRange);
3262  else
3263  return(TIFFReadDirEntryErrOk);
3264 }
3265 
3266 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongSbyte(int8 value)
3267 {
3268  if (value<0)
3269  return(TIFFReadDirEntryErrRange);
3270  else
3271  return(TIFFReadDirEntryErrOk);
3272 }
3273 
3274 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongSshort(int16 value)
3275 {
3276  if (value<0)
3277  return(TIFFReadDirEntryErrRange);
3278  else
3279  return(TIFFReadDirEntryErrOk);
3280 }
3281 
3282 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongSlong(int32 value)
3283 {
3284  if (value<0)
3285  return(TIFFReadDirEntryErrRange);
3286  else
3287  return(TIFFReadDirEntryErrOk);
3288 }
3289 
3290 /*
3291  * Largest 32-bit unsigned integer value.
3292  */
3293 #define TIFF_UINT32_MAX 0xFFFFFFFFU
3294 
3295 static enum TIFFReadDirEntryErr
3296 TIFFReadDirEntryCheckRangeLongLong8(uint64 value)
3297 {
3298  if (value > TIFF_UINT32_MAX)
3299  return(TIFFReadDirEntryErrRange);
3300  else
3301  return(TIFFReadDirEntryErrOk);
3302 }
3303 
3304 static enum TIFFReadDirEntryErr
3305 TIFFReadDirEntryCheckRangeLongSlong8(int64 value)
3306 {
3307  if ((value < 0) || (value > (int64) TIFF_UINT32_MAX))
3308  return(TIFFReadDirEntryErrRange);
3309  else
3310  return(TIFFReadDirEntryErrOk);
3311 }
3312 
3313 #undef TIFF_UINT32_MAX
3314 
3315 static enum TIFFReadDirEntryErr
3316 TIFFReadDirEntryCheckRangeSlongLong(uint32 value)
3317 {
3318  if (value > 0x7FFFFFFFUL)
3319  return(TIFFReadDirEntryErrRange);
3320  else
3321  return(TIFFReadDirEntryErrOk);
3322 }
3323 
3324 /* Check that the 8-byte unsigned value can fit in a 4-byte unsigned range */
3325 static enum TIFFReadDirEntryErr
3326 TIFFReadDirEntryCheckRangeSlongLong8(uint64 value)
3327 {
3328  if (value > 0x7FFFFFFF)
3329  return(TIFFReadDirEntryErrRange);
3330  else
3331  return(TIFFReadDirEntryErrOk);
3332 }
3333 
3334 /* Check that the 8-byte signed value can fit in a 4-byte signed range */
3335 static enum TIFFReadDirEntryErr
3336 TIFFReadDirEntryCheckRangeSlongSlong8(int64 value)
3337 {
3338  if ((value < 0-((int64) 0x7FFFFFFF+1)) || (value > 0x7FFFFFFF))
3339  return(TIFFReadDirEntryErrRange);
3340  else
3341  return(TIFFReadDirEntryErrOk);
3342 }
3343 
3344 static enum TIFFReadDirEntryErr
3345 TIFFReadDirEntryCheckRangeLong8Sbyte(int8 value)
3346 {
3347  if (value < 0)
3348  return(TIFFReadDirEntryErrRange);
3349  else
3350  return(TIFFReadDirEntryErrOk);
3351 }
3352 
3353 static enum TIFFReadDirEntryErr
3354 TIFFReadDirEntryCheckRangeLong8Sshort(int16 value)
3355 {
3356  if (value < 0)
3357  return(TIFFReadDirEntryErrRange);
3358  else
3359  return(TIFFReadDirEntryErrOk);
3360 }
3361 
3362 static enum TIFFReadDirEntryErr
3363 TIFFReadDirEntryCheckRangeLong8Slong(int32 value)
3364 {
3365  if (value < 0)
3366  return(TIFFReadDirEntryErrRange);
3367  else
3368  return(TIFFReadDirEntryErrOk);
3369 }
3370 
3371 static enum TIFFReadDirEntryErr
3372 TIFFReadDirEntryCheckRangeLong8Slong8(int64 value)
3373 {
3374  if (value < 0)
3375  return(TIFFReadDirEntryErrRange);
3376  else
3377  return(TIFFReadDirEntryErrOk);
3378 }
3379 
3380 /*
3381  * Largest 64-bit signed integer value.
3382  */
3383 #define TIFF_INT64_MAX ((int64)(((uint64) ~0) >> 1))
3384 
3385 static enum TIFFReadDirEntryErr
3386 TIFFReadDirEntryCheckRangeSlong8Long8(uint64 value)
3387 {
3388  if (value > TIFF_INT64_MAX)
3389  return(TIFFReadDirEntryErrRange);
3390  else
3391  return(TIFFReadDirEntryErrOk);
3392 }
3393 
3394 #undef TIFF_INT64_MAX
3395 
3396 static enum TIFFReadDirEntryErr
3397 TIFFReadDirEntryData(TIFF* tif, uint64 offset, tmsize_t size, void* dest)
3398 {
3399  assert(size>0);
3400  if (!isMapped(tif)) {
3401  if (!SeekOK(tif,offset))
3402  return(TIFFReadDirEntryErrIo);
3403  if (!ReadOK(tif,dest,size))
3404  return(TIFFReadDirEntryErrIo);
3405  } else {
3406  size_t ma,mb;
3407  ma=(size_t)offset;
3408  mb=ma+size;
3409  if (((uint64)ma!=offset)
3410  || (mb < ma)
3411  || (mb - ma != (size_t) size)
3412  || (mb < (size_t)size)
3413  || (mb > (size_t)tif->tif_size)
3414  )
3415  return(TIFFReadDirEntryErrIo);
3416  _TIFFmemcpy(dest,tif->tif_base+ma,size);
3417  }
3418  return(TIFFReadDirEntryErrOk);
3419 }
3420 
3421 static void TIFFReadDirEntryOutputErr(TIFF* tif, enum TIFFReadDirEntryErr err, const char* module, const char* tagname, int recover)
3422 {
3423  if (!recover) {
3424  switch (err) {
3425  case TIFFReadDirEntryErrCount:
3426  TIFFErrorExt(tif->tif_clientdata, module,
3427  "Incorrect count for \"%s\"",
3428  tagname);
3429  break;
3430  case TIFFReadDirEntryErrType:
3431  TIFFErrorExt(tif->tif_clientdata, module,
3432  "Incompatible type for \"%s\"",
3433  tagname);
3434  break;
3435  case TIFFReadDirEntryErrIo:
3436  TIFFErrorExt(tif->tif_clientdata, module,
3437  "IO error during reading of \"%s\"",
3438  tagname);
3439  break;
3440  case TIFFReadDirEntryErrRange:
3441  TIFFErrorExt(tif->tif_clientdata, module,
3442  "Incorrect value for \"%s\"",
3443  tagname);
3444  break;
3445  case TIFFReadDirEntryErrPsdif:
3446  TIFFErrorExt(tif->tif_clientdata, module,
3447  "Cannot handle different values per sample for \"%s\"",
3448  tagname);
3449  break;
3450  case TIFFReadDirEntryErrSizesan:
3451  TIFFErrorExt(tif->tif_clientdata, module,
3452  "Sanity check on size of \"%s\" value failed",
3453  tagname);
3454  break;
3455  case TIFFReadDirEntryErrAlloc:
3456  TIFFErrorExt(tif->tif_clientdata, module,
3457  "Out of memory reading of \"%s\"",
3458  tagname);
3459  break;
3460  default:
3461  assert(0); /* we should never get here */
3462  break;
3463  }
3464  } else {
3465  switch (err) {
3466  case TIFFReadDirEntryErrCount:
3467  TIFFWarningExt(tif->tif_clientdata, module,
3468  "Incorrect count for \"%s\"; tag ignored",
3469  tagname);
3470  break;
3471  case TIFFReadDirEntryErrType:
3472  TIFFWarningExt(tif->tif_clientdata, module,
3473  "Incompatible type for \"%s\"; tag ignored",
3474  tagname);
3475  break;
3476  case TIFFReadDirEntryErrIo:
3477  TIFFWarningExt(tif->tif_clientdata, module,
3478  "IO error during reading of \"%s\"; tag ignored",
3479  tagname);
3480  break;
3481  case TIFFReadDirEntryErrRange:
3482  TIFFWarningExt(tif->tif_clientdata, module,
3483  "Incorrect value for \"%s\"; tag ignored",
3484  tagname);
3485  break;
3486  case TIFFReadDirEntryErrPsdif:
3487  TIFFWarningExt(tif->tif_clientdata, module,
3488  "Cannot handle different values per sample for \"%s\"; tag ignored",
3489  tagname);
3490  break;
3491  case TIFFReadDirEntryErrSizesan:
3492  TIFFWarningExt(tif->tif_clientdata, module,
3493  "Sanity check on size of \"%s\" value failed; tag ignored",
3494  tagname);
3495  break;
3496  case TIFFReadDirEntryErrAlloc:
3497  TIFFWarningExt(tif->tif_clientdata, module,
3498  "Out of memory reading of \"%s\"; tag ignored",
3499  tagname);
3500  break;
3501  default:
3502  assert(0); /* we should never get here */
3503  break;
3504  }
3505  }
3506 }
3507 
3508 /*
3509  * Return the maximum number of color channels specified for a given photometric
3510  * type. 0 is returned if photometric type isn't supported or no default value
3511  * is defined by the specification.
3512  */
3513 static int _TIFFGetMaxColorChannels( uint16 photometric )
3514 {
3515  switch (photometric) {
3516  case PHOTOMETRIC_PALETTE:
3517  case PHOTOMETRIC_MINISWHITE:
3518  case PHOTOMETRIC_MINISBLACK:
3519  return 1;
3520  case PHOTOMETRIC_YCBCR:
3521  case PHOTOMETRIC_RGB:
3522  case PHOTOMETRIC_CIELAB:
3523  case PHOTOMETRIC_LOGLUV:
3524  case PHOTOMETRIC_ITULAB:
3525  case PHOTOMETRIC_ICCLAB:
3526  return 3;
3527  case PHOTOMETRIC_SEPARATED:
3528  case PHOTOMETRIC_MASK:
3529  return 4;
3530  case PHOTOMETRIC_LOGL:
3531  case PHOTOMETRIC_CFA:
3532  default:
3533  return 0;
3534  }
3535 }
3536 
3537 /*
3538  * Read the next TIFF directory from a file and convert it to the internal
3539  * format. We read directories sequentially.
3540  */
3541 int
3542 TIFFReadDirectory(TIFF* tif)
3543 {
3544  static const char module[] = "TIFFReadDirectory";
3545  TIFFDirEntry* dir;
3546  uint16 dircount;
3547  TIFFDirEntry* dp;
3548  uint16 di;
3549  const TIFFField* fip;
3550  uint32 fii=FAILED_FII;
3551  toff_t nextdiroff;
3552  int bitspersample_read = FALSE;
3553  int color_channels;
3554 
3555  tif->tif_diroff=tif->tif_nextdiroff;
3556  if (!TIFFCheckDirOffset(tif,tif->tif_nextdiroff))
3557  return 0; /* last offset or bad offset (IFD looping) */
3558  (*tif->tif_cleanup)(tif); /* cleanup any previous compression state */
3559  tif->tif_curdir++;
3560  nextdiroff = tif->tif_nextdiroff;
3561  dircount=TIFFFetchDirectory(tif,nextdiroff,&dir,&tif->tif_nextdiroff);
3562  if (!dircount)
3563  {
3564  TIFFErrorExt(tif->tif_clientdata,module,
3565  "Failed to read directory at offset " TIFF_UINT64_FORMAT,nextdiroff);
3566  return 0;
3567  }
3568  TIFFReadDirectoryCheckOrder(tif,dir,dircount);
3569 
3570  /*
3571  * Mark duplicates of any tag to be ignored (bugzilla 1994)
3572  * to avoid certain pathological problems.
3573  */
3574  {
3575  TIFFDirEntry* ma;
3576  uint16 mb;
3577  for (ma=dir, mb=0; mb<dircount; ma++, mb++)
3578  {
3579  TIFFDirEntry* na;
3580  uint16 nb;
3581  for (na=ma+1, nb=mb+1; nb<dircount; na++, nb++)
3582  {
3583  if (ma->tdir_tag==na->tdir_tag)
3584  na->tdir_tag=IGNORE;
3585  }
3586  }
3587  }
3588 
3589  tif->tif_flags &= ~TIFF_BEENWRITING; /* reset before new dir */
3590  tif->tif_flags &= ~TIFF_BUF4WRITE; /* reset before new dir */
3591  /* free any old stuff and reinit */
3592  TIFFFreeDirectory(tif);
3593  TIFFDefaultDirectory(tif);
3594  /*
3595  * Electronic Arts writes gray-scale TIFF files
3596  * without a PlanarConfiguration directory entry.
3597  * Thus we setup a default value here, even though
3598  * the TIFF spec says there is no default value.
3599  */
3600  TIFFSetField(tif,TIFFTAG_PLANARCONFIG,PLANARCONFIG_CONTIG);
3601  /*
3602  * Setup default value and then make a pass over
3603  * the fields to check type and tag information,
3604  * and to extract info required to size data
3605  * structures. A second pass is made afterwards
3606  * to read in everything not taken in the first pass.
3607  * But we must process the Compression tag first
3608  * in order to merge in codec-private tag definitions (otherwise
3609  * we may get complaints about unknown tags). However, the
3610  * Compression tag may be dependent on the SamplesPerPixel
3611  * tag value because older TIFF specs permitted Compression
3612  * to be written as a SamplesPerPixel-count tag entry.
3613  * Thus if we don't first figure out the correct SamplesPerPixel
3614  * tag value then we may end up ignoring the Compression tag
3615  * value because it has an incorrect count value (if the
3616  * true value of SamplesPerPixel is not 1).
3617  */
3618  dp=TIFFReadDirectoryFindEntry(tif,dir,dircount,TIFFTAG_SAMPLESPERPIXEL);
3619  if (dp)
3620  {
3621  if (!TIFFFetchNormalTag(tif,dp,0))
3622  goto bad;
3623  dp->tdir_tag=IGNORE;
3624  }
3625  dp=TIFFReadDirectoryFindEntry(tif,dir,dircount,TIFFTAG_COMPRESSION);
3626  if (dp)
3627  {
3628  /*
3629  * The 5.0 spec says the Compression tag has one value, while
3630  * earlier specs say it has one value per sample. Because of
3631  * this, we accept the tag if one value is supplied with either
3632  * count.
3633  */
3634  uint16 value;
3635  enum TIFFReadDirEntryErr err;
3636  err=TIFFReadDirEntryShort(tif,dp,&value);
3637  if (err==TIFFReadDirEntryErrCount)
3638  err=TIFFReadDirEntryPersampleShort(tif,dp,&value);
3639  if (err!=TIFFReadDirEntryErrOk)
3640  {
3641  TIFFReadDirEntryOutputErr(tif,err,module,"Compression",0);
3642  goto bad;
3643  }
3644  if (!TIFFSetField(tif,TIFFTAG_COMPRESSION,value))
3645  goto bad;
3646  dp->tdir_tag=IGNORE;
3647  }
3648  else
3649  {
3650  if (!TIFFSetField(tif,TIFFTAG_COMPRESSION,COMPRESSION_NONE))
3651  goto bad;
3652  }
3653  /*
3654  * First real pass over the directory.
3655  */
3656  for (di=0, dp=dir; di<dircount; di++, dp++)
3657  {
3658  if (dp->tdir_tag!=IGNORE)
3659  {
3660  TIFFReadDirectoryFindFieldInfo(tif,dp->tdir_tag,&fii);
3661  if (fii == FAILED_FII)
3662  {
3663  TIFFWarningExt(tif->tif_clientdata, module,
3664  "Unknown field with tag %d (0x%x) encountered",
3665  dp->tdir_tag,dp->tdir_tag);
3666  /* the following knowingly leaks the
3667  anonymous field structure */
3668  if (!_TIFFMergeFields(tif,
3669  _TIFFCreateAnonField(tif,
3670  dp->tdir_tag,
3671  (TIFFDataType) dp->tdir_type),
3672  1)) {
3673  TIFFWarningExt(tif->tif_clientdata,
3674  module,
3675  "Registering anonymous field with tag %d (0x%x) failed",
3676  dp->tdir_tag,
3677  dp->tdir_tag);
3678  dp->tdir_tag=IGNORE;
3679  } else {
3680  TIFFReadDirectoryFindFieldInfo(tif,dp->tdir_tag,&fii);
3681  assert(fii != FAILED_FII);
3682  }
3683  }
3684  }
3685  if (dp->tdir_tag!=IGNORE)
3686  {
3687  fip=tif->tif_fields[fii];
3688  if (fip->field_bit==FIELD_IGNORE)
3689  dp->tdir_tag=IGNORE;
3690  else
3691  {
3692  switch (dp->tdir_tag)
3693  {
3694  case TIFFTAG_STRIPOFFSETS:
3695  case TIFFTAG_STRIPBYTECOUNTS:
3696  case TIFFTAG_TILEOFFSETS:
3697  case TIFFTAG_TILEBYTECOUNTS:
3698  TIFFSetFieldBit(tif,fip->field_bit);
3699  break;
3700  case TIFFTAG_IMAGEWIDTH:
3701  case TIFFTAG_IMAGELENGTH:
3702  case TIFFTAG_IMAGEDEPTH:
3703  case TIFFTAG_TILELENGTH:
3704  case TIFFTAG_TILEWIDTH:
3705  case TIFFTAG_TILEDEPTH:
3706  case TIFFTAG_PLANARCONFIG:
3707  case TIFFTAG_ROWSPERSTRIP:
3708  case TIFFTAG_EXTRASAMPLES:
3709  if (!TIFFFetchNormalTag(tif,dp,0))
3710  goto bad;
3711  dp->tdir_tag=IGNORE;
3712  break;
3713  default:
3714  if( !_TIFFCheckFieldIsValidForCodec(tif, dp->tdir_tag) )
3715  dp->tdir_tag=IGNORE;
3716  break;
3717  }
3718  }
3719  }
3720  }
3721  /*
3722  * XXX: OJPEG hack.
3723  * If a) compression is OJPEG, b) planarconfig tag says it's separate,
3724  * c) strip offsets/bytecounts tag are both present and
3725  * d) both contain exactly one value, then we consistently find
3726  * that the buggy implementation of the buggy compression scheme
3727  * matches contig planarconfig best. So we 'fix-up' the tag here
3728  */
3729  if ((tif->tif_dir.td_compression==COMPRESSION_OJPEG)&&
3730  (tif->tif_dir.td_planarconfig==PLANARCONFIG_SEPARATE))
3731  {
3732  if (!_TIFFFillStriles(tif))
3733  goto bad;
3734  dp=TIFFReadDirectoryFindEntry(tif,dir,dircount,TIFFTAG_STRIPOFFSETS);
3735  if ((dp!=0)&&(dp->tdir_count==1))
3736  {
3737  dp=TIFFReadDirectoryFindEntry(tif,dir,dircount,
3738  TIFFTAG_STRIPBYTECOUNTS);
3739  if ((dp!=0)&&(dp->tdir_count==1))
3740  {
3741  tif->tif_dir.td_planarconfig=PLANARCONFIG_CONTIG;
3742  TIFFWarningExt(tif->tif_clientdata,module,
3743  "Planarconfig tag value assumed incorrect, "
3744  "assuming data is contig instead of chunky");
3745  }
3746  }
3747  }
3748  /*
3749  * Allocate directory structure and setup defaults.
3750  */
3751  if (!TIFFFieldSet(tif,FIELD_IMAGEDIMENSIONS))
3752  {
3753  MissingRequired(tif,"ImageLength");
3754  goto bad;
3755  }
3756  /*
3757  * Setup appropriate structures (by strip or by tile)
3758  */
3759  if (!TIFFFieldSet(tif, FIELD_TILEDIMENSIONS)) {
3760  tif->tif_dir.td_nstrips = TIFFNumberOfStrips(tif);
3761  tif->tif_dir.td_tilewidth = tif->tif_dir.td_imagewidth;
3762  tif->tif_dir.td_tilelength = tif->tif_dir.td_rowsperstrip;
3763  tif->tif_dir.td_tiledepth = tif->tif_dir.td_imagedepth;
3764  tif->tif_flags &= ~TIFF_ISTILED;
3765  } else {
3766  tif->tif_dir.td_nstrips = TIFFNumberOfTiles(tif);
3767  tif->tif_flags |= TIFF_ISTILED;
3768  }
3769  if (!tif->tif_dir.td_nstrips) {
3770  TIFFErrorExt(tif->tif_clientdata, module,
3771  "Cannot handle zero number of %s",
3772  isTiled(tif) ? "tiles" : "strips");
3773  goto bad;
3774  }
3775  tif->tif_dir.td_stripsperimage = tif->tif_dir.td_nstrips;
3776  if (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE)
3777  tif->tif_dir.td_stripsperimage /= tif->tif_dir.td_samplesperpixel;
3778  if (!TIFFFieldSet(tif, FIELD_STRIPOFFSETS)) {
3779 #ifdef OJPEG_SUPPORT
3780  if ((tif->tif_dir.td_compression==COMPRESSION_OJPEG) &&
3781  (isTiled(tif)==0) &&
3782  (tif->tif_dir.td_nstrips==1)) {
3783  /*
3784  * XXX: OJPEG hack.
3785  * If a) compression is OJPEG, b) it's not a tiled TIFF,
3786  * and c) the number of strips is 1,
3787  * then we tolerate the absence of stripoffsets tag,
3788  * because, presumably, all required data is in the
3789  * JpegInterchangeFormat stream.
3790  */
3791  TIFFSetFieldBit(tif, FIELD_STRIPOFFSETS);
3792  } else
3793 #endif
3794  {
3795  MissingRequired(tif,
3796  isTiled(tif) ? "TileOffsets" : "StripOffsets");
3797  goto bad;
3798  }
3799  }
3800  /*
3801  * Second pass: extract other information.
3802  */
3803  for (di=0, dp=dir; di<dircount; di++, dp++)
3804  {
3805  switch (dp->tdir_tag)
3806  {
3807  case IGNORE:
3808  break;
3809  case TIFFTAG_MINSAMPLEVALUE:
3810  case TIFFTAG_MAXSAMPLEVALUE:
3811  case TIFFTAG_BITSPERSAMPLE:
3812  case TIFFTAG_DATATYPE:
3813  case TIFFTAG_SAMPLEFORMAT:
3814  /*
3815  * The MinSampleValue, MaxSampleValue, BitsPerSample
3816  * DataType and SampleFormat tags are supposed to be
3817  * written as one value/sample, but some vendors
3818  * incorrectly write one value only -- so we accept
3819  * that as well (yuck). Other vendors write correct
3820  * value for NumberOfSamples, but incorrect one for
3821  * BitsPerSample and friends, and we will read this
3822  * too.
3823  */
3824  {
3825  uint16 value;
3826  enum TIFFReadDirEntryErr err;
3827  err=TIFFReadDirEntryShort(tif,dp,&value);
3828  if (err==TIFFReadDirEntryErrCount)
3829  err=TIFFReadDirEntryPersampleShort(tif,dp,&value);
3830  if (err!=TIFFReadDirEntryErrOk)
3831  {
3832  fip = TIFFFieldWithTag(tif,dp->tdir_tag);
3833  TIFFReadDirEntryOutputErr(tif,err,module,fip ? fip->field_name : "unknown tagname",0);
3834  goto bad;
3835  }
3836  if (!TIFFSetField(tif,dp->tdir_tag,value))
3837  goto bad;
3838  if( dp->tdir_tag == TIFFTAG_BITSPERSAMPLE )
3839  bitspersample_read = TRUE;
3840  }
3841  break;
3842  case TIFFTAG_SMINSAMPLEVALUE:
3843  case TIFFTAG_SMAXSAMPLEVALUE:
3844  {
3845 
3846  double *data = NULL;
3847  enum TIFFReadDirEntryErr err;
3848  uint32 saved_flags;
3849  int m;
3850  if (dp->tdir_count != (uint64)tif->tif_dir.td_samplesperpixel)
3851  err = TIFFReadDirEntryErrCount;
3852  else
3853  err = TIFFReadDirEntryDoubleArray(tif, dp, &data);
3854  if (err!=TIFFReadDirEntryErrOk)
3855  {
3856  fip = TIFFFieldWithTag(tif,dp->tdir_tag);
3857  TIFFReadDirEntryOutputErr(tif,err,module,fip ? fip->field_name : "unknown tagname",0);
3858  goto bad;
3859  }
3860  saved_flags = tif->tif_flags;
3861  tif->tif_flags |= TIFF_PERSAMPLE;
3862  m = TIFFSetField(tif,dp->tdir_tag,data);
3863  tif->tif_flags = saved_flags;
3864  _TIFFfree(data);
3865  if (!m)
3866  goto bad;
3867  }
3868  break;
3869  case TIFFTAG_STRIPOFFSETS:
3870  case TIFFTAG_TILEOFFSETS:
3871 #if defined(DEFER_STRILE_LOAD)
3872  _TIFFmemcpy( &(tif->tif_dir.td_stripoffset_entry),
3873  dp, sizeof(TIFFDirEntry) );
3874 #else
3875  if( tif->tif_dir.td_stripoffset != NULL )
3876  {
3877  TIFFErrorExt(tif->tif_clientdata, module,
3878  "tif->tif_dir.td_stripoffset is "
3879  "already allocated. Likely duplicated "
3880  "StripOffsets/TileOffsets tag");
3881  goto bad;
3882  }
3883  if (!TIFFFetchStripThing(tif,dp,tif->tif_dir.td_nstrips,&tif->tif_dir.td_stripoffset))
3884  goto bad;
3885 #endif
3886  break;
3887  case TIFFTAG_STRIPBYTECOUNTS:
3888  case TIFFTAG_TILEBYTECOUNTS:
3889 #if defined(DEFER_STRILE_LOAD)
3890  _TIFFmemcpy( &(tif->tif_dir.td_stripbytecount_entry),
3891  dp, sizeof(TIFFDirEntry) );
3892 #else
3893  if( tif->tif_dir.td_stripbytecount != NULL )
3894  {
3895  TIFFErrorExt(tif->tif_clientdata, module,
3896  "tif->tif_dir.td_stripbytecount is "
3897  "already allocated. Likely duplicated "
3898  "StripByteCounts/TileByteCounts tag");
3899  goto bad;
3900  }
3901  if (!TIFFFetchStripThing(tif,dp,tif->tif_dir.td_nstrips,&tif->tif_dir.td_stripbytecount))
3902  goto bad;
3903 #endif
3904  break;
3905  case TIFFTAG_COLORMAP:
3906  case TIFFTAG_TRANSFERFUNCTION:
3907  {
3908  enum TIFFReadDirEntryErr err;
3909  uint32 countpersample;
3910  uint32 countrequired;
3911  uint32 incrementpersample;
3912  uint16* value=NULL;
3913  /* It would be dangerous to instantiate those tag values */
3914  /* since if td_bitspersample has not yet been read (due to */
3915  /* unordered tags), it could be read afterwards with a */
3916  /* values greater than the default one (1), which may cause */
3917  /* crashes in user code */
3918  if( !bitspersample_read )
3919  {
3920  fip = TIFFFieldWithTag(tif,dp->tdir_tag);
3921  TIFFWarningExt(tif->tif_clientdata,module,
3922  "Ignoring %s since BitsPerSample tag not found",
3923  fip ? fip->field_name : "unknown tagname");
3924  continue;
3925  }
3926  /* ColorMap or TransferFunction for high bit */
3927  /* depths do not make much sense and could be */
3928  /* used as a denial of service vector */
3929  if (tif->tif_dir.td_bitspersample > 24)
3930  {
3931  fip = TIFFFieldWithTag(tif,dp->tdir_tag);
3932  TIFFWarningExt(tif->tif_clientdata,module,
3933  "Ignoring %s because BitsPerSample=%d>24",
3934  fip ? fip->field_name : "unknown tagname",
3935  tif->tif_dir.td_bitspersample);
3936  continue;
3937  }
3938  countpersample=(1U<<tif->tif_dir.td_bitspersample);
3939  if ((dp->tdir_tag==TIFFTAG_TRANSFERFUNCTION)&&(dp->tdir_count==(uint64)countpersample))
3940  {
3941  countrequired=countpersample;
3942  incrementpersample=0;
3943  }
3944  else
3945  {
3946  countrequired=3*countpersample;
3947  incrementpersample=countpersample;
3948  }
3949  if (dp->tdir_count!=(uint64)countrequired)
3950  err=TIFFReadDirEntryErrCount;
3951  else
3952  err=TIFFReadDirEntryShortArray(tif,dp,&value);
3953  if (err!=TIFFReadDirEntryErrOk)
3954  {
3955  fip = TIFFFieldWithTag(tif,dp->tdir_tag);
3956  TIFFReadDirEntryOutputErr(tif,err,module,fip ? fip->field_name : "unknown tagname",1);
3957  }
3958  else
3959  {
3960  TIFFSetField(tif,dp->tdir_tag,value,value+incrementpersample,value+2*incrementpersample);
3961  _TIFFfree(value);
3962  }
3963  }
3964  break;
3965 /* BEGIN REV 4.0 COMPATIBILITY */
3966  case TIFFTAG_OSUBFILETYPE:
3967  {
3968  uint16 valueo;
3969  uint32 value;
3970  if (TIFFReadDirEntryShort(tif,dp,&valueo)==TIFFReadDirEntryErrOk)
3971  {
3972  switch (valueo)
3973  {
3974  case OFILETYPE_REDUCEDIMAGE: value=FILETYPE_REDUCEDIMAGE; break;
3975  case OFILETYPE_PAGE: value=FILETYPE_PAGE; break;
3976  default: value=0; break;
3977  }
3978  if (value!=0)
3979  TIFFSetField(tif,TIFFTAG_SUBFILETYPE,value);
3980  }
3981  }
3982  break;
3983 /* END REV 4.0 COMPATIBILITY */
3984  default:
3985  (void) TIFFFetchNormalTag(tif, dp, TRUE);
3986  break;
3987  }
3988  }
3989  /*
3990  * OJPEG hack:
3991  * - If a) compression is OJPEG, and b) photometric tag is missing,
3992  * then we consistently find that photometric should be YCbCr
3993  * - If a) compression is OJPEG, and b) photometric tag says it's RGB,
3994  * then we consistently find that the buggy implementation of the
3995  * buggy compression scheme matches photometric YCbCr instead.
3996  * - If a) compression is OJPEG, and b) bitspersample tag is missing,
3997  * then we consistently find bitspersample should be 8.
3998  * - If a) compression is OJPEG, b) samplesperpixel tag is missing,
3999  * and c) photometric is RGB or YCbCr, then we consistently find
4000  * samplesperpixel should be 3
4001  * - If a) compression is OJPEG, b) samplesperpixel tag is missing,
4002  * and c) photometric is MINISWHITE or MINISBLACK, then we consistently
4003  * find samplesperpixel should be 3
4004  */
4005  if (tif->tif_dir.td_compression==COMPRESSION_OJPEG)
4006  {
4007  if (!TIFFFieldSet(tif,FIELD_PHOTOMETRIC))
4008  {
4009  TIFFWarningExt(tif->tif_clientdata, module,
4010  "Photometric tag is missing, assuming data is YCbCr");
4011  if (!TIFFSetField(tif,TIFFTAG_PHOTOMETRIC,PHOTOMETRIC_YCBCR))
4012  goto bad;
4013  }
4014  else if (tif->tif_dir.td_photometric==PHOTOMETRIC_RGB)
4015  {
4016  tif->tif_dir.td_photometric=PHOTOMETRIC_YCBCR;
4017  TIFFWarningExt(tif->tif_clientdata, module,
4018  "Photometric tag value assumed incorrect, "
4019  "assuming data is YCbCr instead of RGB");
4020  }
4021  if (!TIFFFieldSet(tif,FIELD_BITSPERSAMPLE))
4022  {
4023  TIFFWarningExt(tif->tif_clientdata,module,
4024  "BitsPerSample tag is missing, assuming 8 bits per sample");
4025  if (!TIFFSetField(tif,TIFFTAG_BITSPERSAMPLE,8))
4026  goto bad;
4027  }
4028  if (!TIFFFieldSet(tif,FIELD_SAMPLESPERPIXEL))
4029  {
4030  if (tif->tif_dir.td_photometric==PHOTOMETRIC_RGB)
4031  {
4032  TIFFWarningExt(tif->tif_clientdata,module,
4033  "SamplesPerPixel tag is missing, "
4034  "assuming correct SamplesPerPixel value is 3");
4035  if (!TIFFSetField(tif,TIFFTAG_SAMPLESPERPIXEL,3))
4036  goto bad;
4037  }
4038  if (tif->tif_dir.td_photometric==PHOTOMETRIC_YCBCR)
4039  {
4040  TIFFWarningExt(tif->tif_clientdata,module,
4041  "SamplesPerPixel tag is missing, "
4042  "applying correct SamplesPerPixel value of 3");
4043  if (!TIFFSetField(tif,TIFFTAG_SAMPLESPERPIXEL,3))
4044  goto bad;
4045  }
4046  else if ((tif->tif_dir.td_photometric==PHOTOMETRIC_MINISWHITE)
4047  || (tif->tif_dir.td_photometric==PHOTOMETRIC_MINISBLACK))
4048  {
4049  /*
4050  * SamplesPerPixel tag is missing, but is not required
4051  * by spec. Assume correct SamplesPerPixel value of 1.
4052  */
4053  if (!TIFFSetField(tif,TIFFTAG_SAMPLESPERPIXEL,1))
4054  goto bad;
4055  }
4056  }
4057  }
4058 
4059  /*
4060  * Make sure all non-color channels are extrasamples.
4061  * If it's not the case, define them as such.
4062  */
4063  color_channels = _TIFFGetMaxColorChannels(tif->tif_dir.td_photometric);
4064  if (color_channels && tif->tif_dir.td_samplesperpixel - tif->tif_dir.td_extrasamples > color_channels) {
4065  uint16 old_extrasamples;
4066  uint16 *new_sampleinfo;
4067 
4068  TIFFWarningExt(tif->tif_clientdata,module, "Sum of Photometric type-related "
4069  "color channels and ExtraSamples doesn't match SamplesPerPixel. "
4070  "Defining non-color channels as ExtraSamples.");
4071 
4072  old_extrasamples = tif->tif_dir.td_extrasamples;
4073  tif->tif_dir.td_extrasamples = (uint16) (tif->tif_dir.td_samplesperpixel - color_channels);
4074 
4075  // sampleinfo should contain information relative to these new extra samples
4076  new_sampleinfo = (uint16*) _TIFFcalloc(tif->tif_dir.td_extrasamples, sizeof(uint16));
4077  if (!new_sampleinfo) {
4078  TIFFErrorExt(tif->tif_clientdata, module, "Failed to allocate memory for "
4079  "temporary new sampleinfo array (%d 16 bit elements)",
4080  tif->tif_dir.td_extrasamples);
4081  goto bad;
4082  }
4083 
4084  memcpy(new_sampleinfo, tif->tif_dir.td_sampleinfo, old_extrasamples * sizeof(uint16));
4085  _TIFFsetShortArray(&tif->tif_dir.td_sampleinfo, new_sampleinfo, tif->tif_dir.td_extrasamples);
4086  _TIFFfree(new_sampleinfo);
4087  }
4088 
4089  /*
4090  * Verify Palette image has a Colormap.
4091  */
4092  if (tif->tif_dir.td_photometric == PHOTOMETRIC_PALETTE &&
4093  !TIFFFieldSet(tif, FIELD_COLORMAP)) {
4094  if ( tif->tif_dir.td_bitspersample>=8 && tif->tif_dir.td_samplesperpixel==3)
4095  tif->tif_dir.td_photometric = PHOTOMETRIC_RGB;
4096  else if (tif->tif_dir.td_bitspersample>=8)
4097  tif->tif_dir.td_photometric = PHOTOMETRIC_MINISBLACK;
4098  else {
4099  MissingRequired(tif, "Colormap");
4100  goto bad;
4101  }
4102  }
4103  /*
4104  * OJPEG hack:
4105  * We do no further messing with strip/tile offsets/bytecounts in OJPEG
4106  * TIFFs
4107  */
4108  if (tif->tif_dir.td_compression!=COMPRESSION_OJPEG)
4109  {
4110  /*
4111  * Attempt to deal with a missing StripByteCounts tag.
4112  */
4113  if (!TIFFFieldSet(tif, FIELD_STRIPBYTECOUNTS)) {
4114  /*
4115  * Some manufacturers violate the spec by not giving
4116  * the size of the strips. In this case, assume there
4117  * is one uncompressed strip of data.
4118  */
4119  if ((tif->tif_dir.td_planarconfig == PLANARCONFIG_CONTIG &&
4120  tif->tif_dir.td_nstrips > 1) ||
4121  (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE &&
4122  tif->tif_dir.td_nstrips != (uint32)tif->tif_dir.td_samplesperpixel)) {
4123  MissingRequired(tif, "StripByteCounts");
4124  goto bad;
4125  }
4126  TIFFWarningExt(tif->tif_clientdata, module,
4127  "TIFF directory is missing required "
4128  "\"StripByteCounts\" field, calculating from imagelength");
4129  if (EstimateStripByteCounts(tif, dir, dircount) < 0)
4130  goto bad;
4131  /*
4132  * Assume we have wrong StripByteCount value (in case
4133  * of single strip) in following cases:
4134  * - it is equal to zero along with StripOffset;
4135  * - it is larger than file itself (in case of uncompressed
4136  * image);
4137  * - it is smaller than the size of the bytes per row
4138  * multiplied on the number of rows. The last case should
4139  * not be checked in the case of writing new image,
4140  * because we may do not know the exact strip size
4141  * until the whole image will be written and directory
4142  * dumped out.
4143  */
4144  #define BYTECOUNTLOOKSBAD \
4145  ( (tif->tif_dir.td_stripbytecount[0] == 0 && tif->tif_dir.td_stripoffset[0] != 0) || \
4146  (tif->tif_dir.td_compression == COMPRESSION_NONE && \
4147  (tif->tif_dir.td_stripoffset[0] <= TIFFGetFileSize(tif) && \
4148  tif->tif_dir.td_stripbytecount[0] > TIFFGetFileSize(tif) - tif->tif_dir.td_stripoffset[0])) || \
4149  (tif->tif_mode == O_RDONLY && \
4150  tif->tif_dir.td_compression == COMPRESSION_NONE && \
4151  tif->tif_dir.td_stripbytecount[0] < TIFFScanlineSize64(tif) * tif->tif_dir.td_imagelength) )
4152 
4153  } else if (tif->tif_dir.td_nstrips == 1
4154  && !(tif->tif_flags&TIFF_ISTILED)
4155  && _TIFFFillStriles(tif)
4156  && tif->tif_dir.td_stripoffset[0] != 0
4157  && BYTECOUNTLOOKSBAD) {
4158  /*
4159  * XXX: Plexus (and others) sometimes give a value of
4160  * zero for a tag when they don't know what the
4161  * correct value is! Try and handle the simple case
4162  * of estimating the size of a one strip image.
4163  */
4164  TIFFWarningExt(tif->tif_clientdata, module,
4165  "Bogus \"StripByteCounts\" field, ignoring and calculating from imagelength");
4166  if(EstimateStripByteCounts(tif, dir, dircount) < 0)
4167  goto bad;
4168 
4169 #if !defined(DEFER_STRILE_LOAD)
4170  } else if (tif->tif_dir.td_planarconfig == PLANARCONFIG_CONTIG
4171  && tif->tif_dir.td_nstrips > 2
4172  && tif->tif_dir.td_compression == COMPRESSION_NONE
4173  && tif->tif_dir.td_stripbytecount[0] != tif->tif_dir.td_stripbytecount[1]
4174  && tif->tif_dir.td_stripbytecount[0] != 0
4175  && tif->tif_dir.td_stripbytecount[1] != 0 ) {
4176  /*
4177  * XXX: Some vendors fill StripByteCount array with
4178  * absolutely wrong values (it can be equal to
4179  * StripOffset array, for example). Catch this case
4180  * here.
4181  *
4182  * We avoid this check if deferring strile loading
4183  * as it would always force us to load the strip/tile
4184  * information.
4185  */
4186  TIFFWarningExt(tif->tif_clientdata, module,
4187  "Wrong \"StripByteCounts\" field, ignoring and calculating from imagelength");
4188  if (EstimateStripByteCounts(tif, dir, dircount) < 0)
4189  goto bad;
4190 #endif /* !defined(DEFER_STRILE_LOAD) */
4191  }
4192  }
4193  if (dir)
4194  {
4195  _TIFFfree(dir);
4196  dir=NULL;
4197  }
4198  if (!TIFFFieldSet(tif, FIELD_MAXSAMPLEVALUE))
4199  {
4200  if (tif->tif_dir.td_bitspersample>=16)
4201  tif->tif_dir.td_maxsamplevalue=0xFFFF;
4202  else
4203  tif->tif_dir.td_maxsamplevalue = (uint16)((1L<<tif->tif_dir.td_bitspersample)-1);
4204  }
4205  /*
4206  * XXX: We can optimize checking for the strip bounds using the sorted
4207  * bytecounts array. See also comments for TIFFAppendToStrip()
4208  * function in tif_write.c.
4209  */
4210 #if !defined(DEFER_STRILE_LOAD)
4211  if (tif->tif_dir.td_nstrips > 1) {
4212  uint32 strip;
4213 
4214  tif->tif_dir.td_stripbytecountsorted = 1;
4215  for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++) {
4216  if (tif->tif_dir.td_stripoffset[strip - 1] >
4217  tif->tif_dir.td_stripoffset[strip]) {
4218  tif->tif_dir.td_stripbytecountsorted = 0;
4219  break;
4220  }
4221  }
4222  }
4223 #endif /* !defined(DEFER_STRILE_LOAD) */
4224 
4225  /*
4226  * An opportunity for compression mode dependent tag fixup
4227  */
4228  (*tif->tif_fixuptags)(tif);
4229 
4230  /*
4231  * Some manufacturers make life difficult by writing
4232  * large amounts of uncompressed data as a single strip.
4233  * This is contrary to the recommendations of the spec.
4234  * The following makes an attempt at breaking such images
4235  * into strips closer to the recommended 8k bytes. A
4236  * side effect, however, is that the RowsPerStrip tag
4237  * value may be changed.
4238  */
4239  if ((tif->tif_dir.td_planarconfig==PLANARCONFIG_CONTIG)&&
4240  (tif->tif_dir.td_nstrips==1)&&
4241  (tif->tif_dir.td_compression==COMPRESSION_NONE)&&
4242  ((tif->tif_flags&(TIFF_STRIPCHOP|TIFF_ISTILED))==TIFF_STRIPCHOP))
4243  {
4244  if ( !_TIFFFillStriles(tif) || !tif->tif_dir.td_stripbytecount )
4245  return 0;
4246  ChopUpSingleUncompressedStrip(tif);
4247  }
4248 
4249  /*
4250  * Clear the dirty directory flag.
4251  */
4252  tif->tif_flags &= ~TIFF_DIRTYDIRECT;
4253  tif->tif_flags &= ~TIFF_DIRTYSTRIP;
4254 
4255  /*
4256  * Reinitialize i/o since we are starting on a new directory.
4257  */
4258  tif->tif_row = (uint32) -1;
4259  tif->tif_curstrip = (uint32) -1;
4260  tif->tif_col = (uint32) -1;
4261  tif->tif_curtile = (uint32) -1;
4262  tif->tif_tilesize = (tmsize_t) -1;
4263