CoCalc -- tif_dirread.c

GitHub Repository: Tetragramm/opencv
Path: blob/master/3rdparty/libtiff/tif_dirread.c
¹⁶³³⁷ views
1
/* $Id: tif_dirread.c,v 1.218 2017-09-09 21:44:42 erouault Exp $ */
2

3
/*
4
 * Copyright (c) 1988-1997 Sam Leffler
5
 * Copyright (c) 1991-1997 Silicon Graphics, Inc.
6
 *
7
 * Permission to use, copy, modify, distribute, and sell this software and
8
 * its documentation for any purpose is hereby granted without fee, provided
9
 * that (i) the above copyright notices and this permission notice appear in
10
 * all copies of the software and related documentation, and (ii) the names of
11
 * Sam Leffler and Silicon Graphics may not be used in any advertising or
12
 * publicity relating to the software without the specific, prior written
13
 * permission of Sam Leffler and Silicon Graphics.
14
 *
15
 * THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND,
16
 * EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY
17
 * WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
18
 *
19
 * IN NO EVENT SHALL SAM LEFFLER OR SILICON GRAPHICS BE LIABLE FOR
20
 * ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND,
21
 * OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
22
 * WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF
23
 * LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
24
 * OF THIS SOFTWARE.
25
 */
26

27
/*
28
 * TIFF Library.
29
 *
30
 * Directory Read Support Routines.
31
 */
32

33
/* Suggested pending improvements:
34
 * - add a field 'ignore' to the TIFFDirEntry structure, to flag status,
35
 *   eliminating current use of the IGNORE value, and therefore eliminating
36
 *   current irrational behaviour on tags with tag id code 0
37
 * - add a field 'field_info' to the TIFFDirEntry structure, and set that with
38
 *   the pointer to the appropriate TIFFField structure early on in
39
 *   TIFFReadDirectory, so as to eliminate current possibly repetitive lookup.
40
 */
41

42
#include "tiffiop.h"
43
#include <float.h>
44
#include <stdlib.h>
45

46
#define IGNORE 0          /* tag placeholder used below */
47
#define FAILED_FII    ((uint32) -1)
48

49
#ifdef HAVE_IEEEFP
50
# define TIFFCvtIEEEFloatToNative(tif, n, fp)
51
# define TIFFCvtIEEEDoubleToNative(tif, n, dp)
52
#else
53
extern void TIFFCvtIEEEFloatToNative(TIFF*, uint32, float*);
54
extern void TIFFCvtIEEEDoubleToNative(TIFF*, uint32, double*);
55
#endif
56

57
enum TIFFReadDirEntryErr {
58
	TIFFReadDirEntryErrOk = 0,
59
	TIFFReadDirEntryErrCount = 1,
60
	TIFFReadDirEntryErrType = 2,
61
	TIFFReadDirEntryErrIo = 3,
62
	TIFFReadDirEntryErrRange = 4,
63
	TIFFReadDirEntryErrPsdif = 5,
64
	TIFFReadDirEntryErrSizesan = 6,
65
	TIFFReadDirEntryErrAlloc = 7,
66
};
67

68
static enum TIFFReadDirEntryErr TIFFReadDirEntryByte(TIFF* tif, TIFFDirEntry* direntry, uint8* value);
69
static enum TIFFReadDirEntryErr TIFFReadDirEntryShort(TIFF* tif, TIFFDirEntry* direntry, uint16* value);
70
static enum TIFFReadDirEntryErr TIFFReadDirEntryLong(TIFF* tif, TIFFDirEntry* direntry, uint32* value);
71
static enum TIFFReadDirEntryErr TIFFReadDirEntryLong8(TIFF* tif, TIFFDirEntry* direntry, uint64* value);
72
static enum TIFFReadDirEntryErr TIFFReadDirEntryFloat(TIFF* tif, TIFFDirEntry* direntry, float* value);
73
static enum TIFFReadDirEntryErr TIFFReadDirEntryDouble(TIFF* tif, TIFFDirEntry* direntry, double* value);
74
static enum TIFFReadDirEntryErr TIFFReadDirEntryIfd8(TIFF* tif, TIFFDirEntry* direntry, uint64* value);
75

76
static enum TIFFReadDirEntryErr TIFFReadDirEntryArray(TIFF* tif, TIFFDirEntry* direntry, uint32* count, uint32 desttypesize, void** value);
77
static enum TIFFReadDirEntryErr TIFFReadDirEntryByteArray(TIFF* tif, TIFFDirEntry* direntry, uint8** value);
78
static enum TIFFReadDirEntryErr TIFFReadDirEntrySbyteArray(TIFF* tif, TIFFDirEntry* direntry, int8** value);
79
static enum TIFFReadDirEntryErr TIFFReadDirEntryShortArray(TIFF* tif, TIFFDirEntry* direntry, uint16** value);
80
static enum TIFFReadDirEntryErr TIFFReadDirEntrySshortArray(TIFF* tif, TIFFDirEntry* direntry, int16** value);
81
static enum TIFFReadDirEntryErr TIFFReadDirEntryLongArray(TIFF* tif, TIFFDirEntry* direntry, uint32** value);
82
static enum TIFFReadDirEntryErr TIFFReadDirEntrySlongArray(TIFF* tif, TIFFDirEntry* direntry, int32** value);
83
static enum TIFFReadDirEntryErr TIFFReadDirEntryLong8Array(TIFF* tif, TIFFDirEntry* direntry, uint64** value);
84
static enum TIFFReadDirEntryErr TIFFReadDirEntrySlong8Array(TIFF* tif, TIFFDirEntry* direntry, int64** value);
85
static enum TIFFReadDirEntryErr TIFFReadDirEntryFloatArray(TIFF* tif, TIFFDirEntry* direntry, float** value);
86
static enum TIFFReadDirEntryErr TIFFReadDirEntryDoubleArray(TIFF* tif, TIFFDirEntry* direntry, double** value);
87
static enum TIFFReadDirEntryErr TIFFReadDirEntryIfd8Array(TIFF* tif, TIFFDirEntry* direntry, uint64** value);
88

89
static enum TIFFReadDirEntryErr TIFFReadDirEntryPersampleShort(TIFF* tif, TIFFDirEntry* direntry, uint16* value);
90
#if 0
91
static enum TIFFReadDirEntryErr TIFFReadDirEntryPersampleDouble(TIFF* tif, TIFFDirEntry* direntry, double* value);
92
#endif
93

94
static void TIFFReadDirEntryCheckedByte(TIFF* tif, TIFFDirEntry* direntry, uint8* value);
95
static void TIFFReadDirEntryCheckedSbyte(TIFF* tif, TIFFDirEntry* direntry, int8* value);
96
static void TIFFReadDirEntryCheckedShort(TIFF* tif, TIFFDirEntry* direntry, uint16* value);
97
static void TIFFReadDirEntryCheckedSshort(TIFF* tif, TIFFDirEntry* direntry, int16* value);
98
static void TIFFReadDirEntryCheckedLong(TIFF* tif, TIFFDirEntry* direntry, uint32* value);
99
static void TIFFReadDirEntryCheckedSlong(TIFF* tif, TIFFDirEntry* direntry, int32* value);
100
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedLong8(TIFF* tif, TIFFDirEntry* direntry, uint64* value);
101
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedSlong8(TIFF* tif, TIFFDirEntry* direntry, int64* value);
102
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedRational(TIFF* tif, TIFFDirEntry* direntry, double* value);
103
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedSrational(TIFF* tif, TIFFDirEntry* direntry, double* value);
104
static void TIFFReadDirEntryCheckedFloat(TIFF* tif, TIFFDirEntry* direntry, float* value);
105
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedDouble(TIFF* tif, TIFFDirEntry* direntry, double* value);
106

107
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSbyte(int8 value);
108
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteShort(uint16 value);
109
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSshort(int16 value);
110
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteLong(uint32 value);
111
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSlong(int32 value);
112
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteLong8(uint64 value);
113
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSlong8(int64 value);
114

115
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteByte(uint8 value);
116
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteShort(uint16 value);
117
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteSshort(int16 value);
118
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteLong(uint32 value);
119
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteSlong(int32 value);
120
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteLong8(uint64 value);
121
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteSlong8(int64 value);
122

123
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSbyte(int8 value);
124
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSshort(int16 value);
125
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortLong(uint32 value);
126
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSlong(int32 value);
127
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortLong8(uint64 value);
128
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSlong8(int64 value);
129

130
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortShort(uint16 value);
131
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortLong(uint32 value);
132
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortSlong(int32 value);
133
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortLong8(uint64 value);
134
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortSlong8(int64 value);
135

136
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongSbyte(int8 value);
137
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongSshort(int16 value);
138
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongSlong(int32 value);
139
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongLong8(uint64 value);
140
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongSlong8(int64 value);
141

142
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSlongLong(uint32 value);
143
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSlongLong8(uint64 value);
144
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSlongSlong8(int64 value);
145

146
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLong8Sbyte(int8 value);
147
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLong8Sshort(int16 value);
148
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLong8Slong(int32 value);
149
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLong8Slong8(int64 value);
150

151
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSlong8Long8(uint64 value);
152

153
static enum TIFFReadDirEntryErr TIFFReadDirEntryData(TIFF* tif, uint64 offset, tmsize_t size, void* dest);
154
static void TIFFReadDirEntryOutputErr(TIFF* tif, enum TIFFReadDirEntryErr err, const char* module, const char* tagname, int recover);
155

156
static void TIFFReadDirectoryCheckOrder(TIFF* tif, TIFFDirEntry* dir, uint16 dircount);
157
static TIFFDirEntry* TIFFReadDirectoryFindEntry(TIFF* tif, TIFFDirEntry* dir, uint16 dircount, uint16 tagid);
158
static void TIFFReadDirectoryFindFieldInfo(TIFF* tif, uint16 tagid, uint32* fii);
159

160
static int EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount);
161
static void MissingRequired(TIFF*, const char*);
162
static int TIFFCheckDirOffset(TIFF* tif, uint64 diroff);
163
static int CheckDirCount(TIFF*, TIFFDirEntry*, uint32);
164
static uint16 TIFFFetchDirectory(TIFF* tif, uint64 diroff, TIFFDirEntry** pdir, uint64* nextdiroff);
165
static int TIFFFetchNormalTag(TIFF*, TIFFDirEntry*, int recover);
166
static int TIFFFetchStripThing(TIFF* tif, TIFFDirEntry* dir, uint32 nstrips, uint64** lpp);
167
static int TIFFFetchSubjectDistance(TIFF*, TIFFDirEntry*);
168
static void ChopUpSingleUncompressedStrip(TIFF*);
169
static uint64 TIFFReadUInt64(const uint8 *value);
170

171
static int _TIFFFillStrilesInternal( TIFF *tif, int loadStripByteCount );
172

173
typedef union _UInt64Aligned_t
174
{
175
        double d;
176
	uint64 l;
177
	uint32 i[2];
178
	uint16 s[4];
179
	uint8  c[8];
180
} UInt64Aligned_t;
181

182
/*
183
  Unaligned safe copy of a uint64 value from an octet array.
184
*/
185
static uint64 TIFFReadUInt64(const uint8 *value)
186
{
187
	UInt64Aligned_t result;
188

189
	result.c[0]=value[0];
190
	result.c[1]=value[1];
191
	result.c[2]=value[2];
192
	result.c[3]=value[3];
193
	result.c[4]=value[4];
194
	result.c[5]=value[5];
195
	result.c[6]=value[6];
196
	result.c[7]=value[7];
197

198
	return result.l;
199
}
200

201
static enum TIFFReadDirEntryErr TIFFReadDirEntryByte(TIFF* tif, TIFFDirEntry* direntry, uint8* value)
202
{
203
	enum TIFFReadDirEntryErr err;
204
	if (direntry->tdir_count!=1)
205
		return(TIFFReadDirEntryErrCount);
206
	switch (direntry->tdir_type)
207
	{
208
		case TIFF_BYTE:
209
			TIFFReadDirEntryCheckedByte(tif,direntry,value);
210
			return(TIFFReadDirEntryErrOk);
211
		case TIFF_SBYTE:
212
			{
213
				int8 m;
214
				TIFFReadDirEntryCheckedSbyte(tif,direntry,&m);
215
				err=TIFFReadDirEntryCheckRangeByteSbyte(m);
216
				if (err!=TIFFReadDirEntryErrOk)
217
					return(err);
218
				*value=(uint8)m;
219
				return(TIFFReadDirEntryErrOk);
220
			}
221
		case TIFF_SHORT:
222
			{
223
				uint16 m;
224
				TIFFReadDirEntryCheckedShort(tif,direntry,&m);
225
				err=TIFFReadDirEntryCheckRangeByteShort(m);
226
				if (err!=TIFFReadDirEntryErrOk)
227
					return(err);
228
				*value=(uint8)m;
229
				return(TIFFReadDirEntryErrOk);
230
			}
231
		case TIFF_SSHORT:
232
			{
233
				int16 m;
234
				TIFFReadDirEntryCheckedSshort(tif,direntry,&m);
235
				err=TIFFReadDirEntryCheckRangeByteSshort(m);
236
				if (err!=TIFFReadDirEntryErrOk)
237
					return(err);
238
				*value=(uint8)m;
239
				return(TIFFReadDirEntryErrOk);
240
			}
241
		case TIFF_LONG:
242
			{
243
				uint32 m;
244
				TIFFReadDirEntryCheckedLong(tif,direntry,&m);
245
				err=TIFFReadDirEntryCheckRangeByteLong(m);
246
				if (err!=TIFFReadDirEntryErrOk)
247
					return(err);
248
				*value=(uint8)m;
249
				return(TIFFReadDirEntryErrOk);
250
			}
251
		case TIFF_SLONG:
252
			{
253
				int32 m;
254
				TIFFReadDirEntryCheckedSlong(tif,direntry,&m);
255
				err=TIFFReadDirEntryCheckRangeByteSlong(m);
256
				if (err!=TIFFReadDirEntryErrOk)
257
					return(err);
258
				*value=(uint8)m;
259
				return(TIFFReadDirEntryErrOk);
260
			}
261
		case TIFF_LONG8:
262
			{
263
				uint64 m;
264
				err=TIFFReadDirEntryCheckedLong8(tif,direntry,&m);
265
				if (err!=TIFFReadDirEntryErrOk)
266
					return(err);
267
				err=TIFFReadDirEntryCheckRangeByteLong8(m);
268
				if (err!=TIFFReadDirEntryErrOk)
269
					return(err);
270
				*value=(uint8)m;
271
				return(TIFFReadDirEntryErrOk);
272
			}
273
		case TIFF_SLONG8:
274
			{
275
				int64 m;
276
				err=TIFFReadDirEntryCheckedSlong8(tif,direntry,&m);
277
				if (err!=TIFFReadDirEntryErrOk)
278
					return(err);
279
				err=TIFFReadDirEntryCheckRangeByteSlong8(m);
280
				if (err!=TIFFReadDirEntryErrOk)
281
					return(err);
282
				*value=(uint8)m;
283
				return(TIFFReadDirEntryErrOk);
284
			}
285
		default:
286
			return(TIFFReadDirEntryErrType);
287
	}
288
}
289

290
static enum TIFFReadDirEntryErr TIFFReadDirEntryShort(TIFF* tif, TIFFDirEntry* direntry, uint16* value)
291
{
292
	enum TIFFReadDirEntryErr err;
293
	if (direntry->tdir_count!=1)
294
		return(TIFFReadDirEntryErrCount);
295
	switch (direntry->tdir_type)
296
	{
297
		case TIFF_BYTE:
298
			{
299
				uint8 m;
300
				TIFFReadDirEntryCheckedByte(tif,direntry,&m);
301
				*value=(uint16)m;
302
				return(TIFFReadDirEntryErrOk);
303
			}
304
		case TIFF_SBYTE:
305
			{
306
				int8 m;
307
				TIFFReadDirEntryCheckedSbyte(tif,direntry,&m);
308
				err=TIFFReadDirEntryCheckRangeShortSbyte(m);
309
				if (err!=TIFFReadDirEntryErrOk)
310
					return(err);
311
				*value=(uint16)m;
312
				return(TIFFReadDirEntryErrOk);
313
			}
314
		case TIFF_SHORT:
315
			TIFFReadDirEntryCheckedShort(tif,direntry,value);
316
			return(TIFFReadDirEntryErrOk);
317
		case TIFF_SSHORT:
318
			{
319
				int16 m;
320
				TIFFReadDirEntryCheckedSshort(tif,direntry,&m);
321
				err=TIFFReadDirEntryCheckRangeShortSshort(m);
322
				if (err!=TIFFReadDirEntryErrOk)
323
					return(err);
324
				*value=(uint16)m;
325
				return(TIFFReadDirEntryErrOk);
326
			}
327
		case TIFF_LONG:
328
			{
329
				uint32 m;
330
				TIFFReadDirEntryCheckedLong(tif,direntry,&m);
331
				err=TIFFReadDirEntryCheckRangeShortLong(m);
332
				if (err!=TIFFReadDirEntryErrOk)
333
					return(err);
334
				*value=(uint16)m;
335
				return(TIFFReadDirEntryErrOk);
336
			}
337
		case TIFF_SLONG:
338
			{
339
				int32 m;
340
				TIFFReadDirEntryCheckedSlong(tif,direntry,&m);
341
				err=TIFFReadDirEntryCheckRangeShortSlong(m);
342
				if (err!=TIFFReadDirEntryErrOk)
343
					return(err);
344
				*value=(uint16)m;
345
				return(TIFFReadDirEntryErrOk);
346
			}
347
		case TIFF_LONG8:
348
			{
349
				uint64 m;
350
				err=TIFFReadDirEntryCheckedLong8(tif,direntry,&m);
351
				if (err!=TIFFReadDirEntryErrOk)
352
					return(err);
353
				err=TIFFReadDirEntryCheckRangeShortLong8(m);
354
				if (err!=TIFFReadDirEntryErrOk)
355
					return(err);
356
				*value=(uint16)m;
357
				return(TIFFReadDirEntryErrOk);
358
			}
359
		case TIFF_SLONG8:
360
			{
361
				int64 m;
362
				err=TIFFReadDirEntryCheckedSlong8(tif,direntry,&m);
363
				if (err!=TIFFReadDirEntryErrOk)
364
					return(err);
365
				err=TIFFReadDirEntryCheckRangeShortSlong8(m);
366
				if (err!=TIFFReadDirEntryErrOk)
367
					return(err);
368
				*value=(uint16)m;
369
				return(TIFFReadDirEntryErrOk);
370
			}
371
		default:
372
			return(TIFFReadDirEntryErrType);
373
	}
374
}
375

376
static enum TIFFReadDirEntryErr TIFFReadDirEntryLong(TIFF* tif, TIFFDirEntry* direntry, uint32* value)
377
{
378
	enum TIFFReadDirEntryErr err;
379
	if (direntry->tdir_count!=1)
380
		return(TIFFReadDirEntryErrCount);
381
	switch (direntry->tdir_type)
382
	{
383
		case TIFF_BYTE:
384
			{
385
				uint8 m;
386
				TIFFReadDirEntryCheckedByte(tif,direntry,&m);
387
				*value=(uint32)m;
388
				return(TIFFReadDirEntryErrOk);
389
			}
390
		case TIFF_SBYTE:
391
			{
392
				int8 m;
393
				TIFFReadDirEntryCheckedSbyte(tif,direntry,&m);
394
				err=TIFFReadDirEntryCheckRangeLongSbyte(m);
395
				if (err!=TIFFReadDirEntryErrOk)
396
					return(err);
397
				*value=(uint32)m;
398
				return(TIFFReadDirEntryErrOk);
399
			}
400
		case TIFF_SHORT:
401
			{
402
				uint16 m;
403
				TIFFReadDirEntryCheckedShort(tif,direntry,&m);
404
				*value=(uint32)m;
405
				return(TIFFReadDirEntryErrOk);
406
			}
407
		case TIFF_SSHORT:
408
			{
409
				int16 m;
410
				TIFFReadDirEntryCheckedSshort(tif,direntry,&m);
411
				err=TIFFReadDirEntryCheckRangeLongSshort(m);
412
				if (err!=TIFFReadDirEntryErrOk)
413
					return(err);
414
				*value=(uint32)m;
415
				return(TIFFReadDirEntryErrOk);
416
			}
417
		case TIFF_LONG:
418
			TIFFReadDirEntryCheckedLong(tif,direntry,value);
419
			return(TIFFReadDirEntryErrOk);
420
		case TIFF_SLONG:
421
			{
422
				int32 m;
423
				TIFFReadDirEntryCheckedSlong(tif,direntry,&m);
424
				err=TIFFReadDirEntryCheckRangeLongSlong(m);
425
				if (err!=TIFFReadDirEntryErrOk)
426
					return(err);
427
				*value=(uint32)m;
428
				return(TIFFReadDirEntryErrOk);
429
			}
430
		case TIFF_LONG8:
431
			{
432
				uint64 m;
433
				err=TIFFReadDirEntryCheckedLong8(tif,direntry,&m);
434
				if (err!=TIFFReadDirEntryErrOk)
435
					return(err);
436
				err=TIFFReadDirEntryCheckRangeLongLong8(m);
437
				if (err!=TIFFReadDirEntryErrOk)
438
					return(err);
439
				*value=(uint32)m;
440
				return(TIFFReadDirEntryErrOk);
441
			}
442
		case TIFF_SLONG8:
443
			{
444
				int64 m;
445
				err=TIFFReadDirEntryCheckedSlong8(tif,direntry,&m);
446
				if (err!=TIFFReadDirEntryErrOk)
447
					return(err);
448
				err=TIFFReadDirEntryCheckRangeLongSlong8(m);
449
				if (err!=TIFFReadDirEntryErrOk)
450
					return(err);
451
				*value=(uint32)m;
452
				return(TIFFReadDirEntryErrOk);
453
			}
454
		default:
455
			return(TIFFReadDirEntryErrType);
456
	}
457
}
458

459
static enum TIFFReadDirEntryErr TIFFReadDirEntryLong8(TIFF* tif, TIFFDirEntry* direntry, uint64* value)
460
{
461
	enum TIFFReadDirEntryErr err;
462
	if (direntry->tdir_count!=1)
463
		return(TIFFReadDirEntryErrCount);
464
	switch (direntry->tdir_type)
465
	{
466
		case TIFF_BYTE:
467
			{
468
				uint8 m;
469
				TIFFReadDirEntryCheckedByte(tif,direntry,&m);
470
				*value=(uint64)m;
471
				return(TIFFReadDirEntryErrOk);
472
			}
473
		case TIFF_SBYTE:
474
			{
475
				int8 m;
476
				TIFFReadDirEntryCheckedSbyte(tif,direntry,&m);
477
				err=TIFFReadDirEntryCheckRangeLong8Sbyte(m);
478
				if (err!=TIFFReadDirEntryErrOk)
479
					return(err);
480
				*value=(uint64)m;
481
				return(TIFFReadDirEntryErrOk);
482
			}
483
		case TIFF_SHORT:
484
			{
485
				uint16 m;
486
				TIFFReadDirEntryCheckedShort(tif,direntry,&m);
487
				*value=(uint64)m;
488
				return(TIFFReadDirEntryErrOk);
489
			}
490
		case TIFF_SSHORT:
491
			{
492
				int16 m;
493
				TIFFReadDirEntryCheckedSshort(tif,direntry,&m);
494
				err=TIFFReadDirEntryCheckRangeLong8Sshort(m);
495
				if (err!=TIFFReadDirEntryErrOk)
496
					return(err);
497
				*value=(uint64)m;
498
				return(TIFFReadDirEntryErrOk);
499
			}
500
		case TIFF_LONG:
501
			{
502
				uint32 m;
503
				TIFFReadDirEntryCheckedLong(tif,direntry,&m);
504
				*value=(uint64)m;
505
				return(TIFFReadDirEntryErrOk);
506
			}
507
		case TIFF_SLONG:
508
			{
509
				int32 m;
510
				TIFFReadDirEntryCheckedSlong(tif,direntry,&m);
511
				err=TIFFReadDirEntryCheckRangeLong8Slong(m);
512
				if (err!=TIFFReadDirEntryErrOk)
513
					return(err);
514
				*value=(uint64)m;
515
				return(TIFFReadDirEntryErrOk);
516
			}
517
		case TIFF_LONG8:
518
			err=TIFFReadDirEntryCheckedLong8(tif,direntry,value);
519
			return(err);
520
		case TIFF_SLONG8:
521
			{
522
				int64 m;
523
				err=TIFFReadDirEntryCheckedSlong8(tif,direntry,&m);
524
				if (err!=TIFFReadDirEntryErrOk)
525
					return(err);
526
				err=TIFFReadDirEntryCheckRangeLong8Slong8(m);
527
				if (err!=TIFFReadDirEntryErrOk)
528
					return(err);
529
				*value=(uint64)m;
530
				return(TIFFReadDirEntryErrOk);
531
			}
532
		default:
533
			return(TIFFReadDirEntryErrType);
534
	}
535
}
536

537
static enum TIFFReadDirEntryErr TIFFReadDirEntryFloat(TIFF* tif, TIFFDirEntry* direntry, float* value)
538
{
539
	enum TIFFReadDirEntryErr err;
540
	if (direntry->tdir_count!=1)
541
		return(TIFFReadDirEntryErrCount);
542
	switch (direntry->tdir_type)
543
	{
544
		case TIFF_BYTE:
545
			{
546
				uint8 m;
547
				TIFFReadDirEntryCheckedByte(tif,direntry,&m);
548
				*value=(float)m;
549
				return(TIFFReadDirEntryErrOk);
550
			}
551
		case TIFF_SBYTE:
552
			{
553
				int8 m;
554
				TIFFReadDirEntryCheckedSbyte(tif,direntry,&m);
555
				*value=(float)m;
556
				return(TIFFReadDirEntryErrOk);
557
			}
558
		case TIFF_SHORT:
559
			{
560
				uint16 m;
561
				TIFFReadDirEntryCheckedShort(tif,direntry,&m);
562
				*value=(float)m;
563
				return(TIFFReadDirEntryErrOk);
564
			}
565
		case TIFF_SSHORT:
566
			{
567
				int16 m;
568
				TIFFReadDirEntryCheckedSshort(tif,direntry,&m);
569
				*value=(float)m;
570
				return(TIFFReadDirEntryErrOk);
571
			}
572
		case TIFF_LONG:
573
			{
574
				uint32 m;
575
				TIFFReadDirEntryCheckedLong(tif,direntry,&m);
576
				*value=(float)m;
577
				return(TIFFReadDirEntryErrOk);
578
			}
579
		case TIFF_SLONG:
580
			{
581
				int32 m;
582
				TIFFReadDirEntryCheckedSlong(tif,direntry,&m);
583
				*value=(float)m;
584
				return(TIFFReadDirEntryErrOk);
585
			}
586
		case TIFF_LONG8:
587
			{
588
				uint64 m;
589
				err=TIFFReadDirEntryCheckedLong8(tif,direntry,&m);
590
				if (err!=TIFFReadDirEntryErrOk)
591
					return(err);
592
#if defined(__WIN32__) && (_MSC_VER < 1500)
593
				/*
594
				 * XXX: MSVC 6.0 does not support conversion
595
				 * of 64-bit integers into floating point
596
				 * values.
597
				 */
598
				*value = _TIFFUInt64ToFloat(m);
599
#else
600
				*value=(float)m;
601
#endif
602
				return(TIFFReadDirEntryErrOk);
603
			}
604
		case TIFF_SLONG8:
605
			{
606
				int64 m;
607
				err=TIFFReadDirEntryCheckedSlong8(tif,direntry,&m);
608
				if (err!=TIFFReadDirEntryErrOk)
609
					return(err);
610
				*value=(float)m;
611
				return(TIFFReadDirEntryErrOk);
612
			}
613
		case TIFF_RATIONAL:
614
			{
615
				double m;
616
				err=TIFFReadDirEntryCheckedRational(tif,direntry,&m);
617
				if (err!=TIFFReadDirEntryErrOk)
618
					return(err);
619
				*value=(float)m;
620
				return(TIFFReadDirEntryErrOk);
621
			}
622
		case TIFF_SRATIONAL:
623
			{
624
				double m;
625
				err=TIFFReadDirEntryCheckedSrational(tif,direntry,&m);
626
				if (err!=TIFFReadDirEntryErrOk)
627
					return(err);
628
				*value=(float)m;
629
				return(TIFFReadDirEntryErrOk);
630
			}
631
		case TIFF_FLOAT:
632
			TIFFReadDirEntryCheckedFloat(tif,direntry,value);
633
			return(TIFFReadDirEntryErrOk);
634
		case TIFF_DOUBLE:
635
			{
636
				double m;
637
				err=TIFFReadDirEntryCheckedDouble(tif,direntry,&m);
638
				if (err!=TIFFReadDirEntryErrOk)
639
					return(err);
640
				if ((m > FLT_MAX) || (m < FLT_MIN))
641
					return(TIFFReadDirEntryErrRange);
642
				*value=(float)m;
643
				return(TIFFReadDirEntryErrOk);
644
			}
645
		default:
646
			return(TIFFReadDirEntryErrType);
647
	}
648
}
649

650
static enum TIFFReadDirEntryErr TIFFReadDirEntryDouble(TIFF* tif, TIFFDirEntry* direntry, double* value)
651
{
652
	enum TIFFReadDirEntryErr err;
653
	if (direntry->tdir_count!=1)
654
		return(TIFFReadDirEntryErrCount);
655
	switch (direntry->tdir_type)
656
	{
657
		case TIFF_BYTE:
658
			{
659
				uint8 m;
660
				TIFFReadDirEntryCheckedByte(tif,direntry,&m);
661
				*value=(double)m;
662
				return(TIFFReadDirEntryErrOk);
663
			}
664
		case TIFF_SBYTE:
665
			{
666
				int8 m;
667
				TIFFReadDirEntryCheckedSbyte(tif,direntry,&m);
668
				*value=(double)m;
669
				return(TIFFReadDirEntryErrOk);
670
			}
671
		case TIFF_SHORT:
672
			{
673
				uint16 m;
674
				TIFFReadDirEntryCheckedShort(tif,direntry,&m);
675
				*value=(double)m;
676
				return(TIFFReadDirEntryErrOk);
677
			}
678
		case TIFF_SSHORT:
679
			{
680
				int16 m;
681
				TIFFReadDirEntryCheckedSshort(tif,direntry,&m);
682
				*value=(double)m;
683
				return(TIFFReadDirEntryErrOk);
684
			}
685
		case TIFF_LONG:
686
			{
687
				uint32 m;
688
				TIFFReadDirEntryCheckedLong(tif,direntry,&m);
689
				*value=(double)m;
690
				return(TIFFReadDirEntryErrOk);
691
			}
692
		case TIFF_SLONG:
693
			{
694
				int32 m;
695
				TIFFReadDirEntryCheckedSlong(tif,direntry,&m);
696
				*value=(double)m;
697
				return(TIFFReadDirEntryErrOk);
698
			}
699
		case TIFF_LONG8:
700
			{
701
				uint64 m;
702
				err=TIFFReadDirEntryCheckedLong8(tif,direntry,&m);
703
				if (err!=TIFFReadDirEntryErrOk)
704
					return(err);
705
#if defined(__WIN32__) && (_MSC_VER < 1500)
706
				/*
707
				 * XXX: MSVC 6.0 does not support conversion
708
				 * of 64-bit integers into floating point
709
				 * values.
710
				 */
711
				*value = _TIFFUInt64ToDouble(m);
712
#else
713
				*value = (double)m;
714
#endif
715
				return(TIFFReadDirEntryErrOk);
716
			}
717
		case TIFF_SLONG8:
718
			{
719
				int64 m;
720
				err=TIFFReadDirEntryCheckedSlong8(tif,direntry,&m);
721
				if (err!=TIFFReadDirEntryErrOk)
722
					return(err);
723
				*value=(double)m;
724
				return(TIFFReadDirEntryErrOk);
725
			}
726
		case TIFF_RATIONAL:
727
			err=TIFFReadDirEntryCheckedRational(tif,direntry,value);
728
			return(err);
729
		case TIFF_SRATIONAL:
730
			err=TIFFReadDirEntryCheckedSrational(tif,direntry,value);
731
			return(err);
732
		case TIFF_FLOAT:
733
			{
734
				float m;
735
				TIFFReadDirEntryCheckedFloat(tif,direntry,&m);
736
				*value=(double)m;
737
				return(TIFFReadDirEntryErrOk);
738
			}
739
		case TIFF_DOUBLE:
740
			err=TIFFReadDirEntryCheckedDouble(tif,direntry,value);
741
			return(err);
742
		default:
743
			return(TIFFReadDirEntryErrType);
744
	}
745
}
746

747
static enum TIFFReadDirEntryErr TIFFReadDirEntryIfd8(TIFF* tif, TIFFDirEntry* direntry, uint64* value)
748
{
749
	enum TIFFReadDirEntryErr err;
750
	if (direntry->tdir_count!=1)
751
		return(TIFFReadDirEntryErrCount);
752
	switch (direntry->tdir_type)
753
	{
754
		case TIFF_LONG:
755
		case TIFF_IFD:
756
			{
757
				uint32 m;
758
				TIFFReadDirEntryCheckedLong(tif,direntry,&m);
759
				*value=(uint64)m;
760
				return(TIFFReadDirEntryErrOk);
761
			}
762
		case TIFF_LONG8:
763
		case TIFF_IFD8:
764
			err=TIFFReadDirEntryCheckedLong8(tif,direntry,value);
765
			return(err);
766
		default:
767
			return(TIFFReadDirEntryErrType);
768
	}
769
}
770

771

772
#define INITIAL_THRESHOLD (1024 * 1024)
773
#define THRESHOLD_MULTIPLIER 10
774
#define MAX_THRESHOLD (THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER * INITIAL_THRESHOLD)
775

776
static enum TIFFReadDirEntryErr TIFFReadDirEntryDataAndRealloc(
777
                    TIFF* tif, uint64 offset, tmsize_t size, void** pdest)
778
{
779
#if SIZEOF_VOIDP == 8 || SIZEOF_SIZE_T == 8
780
        tmsize_t threshold = INITIAL_THRESHOLD;
781
#endif
782
        tmsize_t already_read = 0;
783

784
        assert( !isMapped(tif) );
785

786
        if (!SeekOK(tif,offset))
787
                return(TIFFReadDirEntryErrIo);
788

789
        /* On 64 bit processes, read first a maximum of 1 MB, then 10 MB, etc */
790
        /* so as to avoid allocating too much memory in case the file is too */
791
        /* short. We could ask for the file size, but this might be */
792
        /* expensive with some I/O layers (think of reading a gzipped file) */
793
        /* Restrict to 64 bit processes, so as to avoid reallocs() */
794
        /* on 32 bit processes where virtual memory is scarce.  */
795
        while( already_read < size )
796
        {
797
            void* new_dest;
798
            tmsize_t bytes_read;
799
            tmsize_t to_read = size - already_read;
800
#if SIZEOF_VOIDP == 8 || SIZEOF_SIZE_T == 8
801
            if( to_read >= threshold && threshold < MAX_THRESHOLD )
802
            {
803
                to_read = threshold;
804
                threshold *= THRESHOLD_MULTIPLIER;
805
            }
806
#endif
807

808
            new_dest = (uint8*) _TIFFrealloc(
809
                            *pdest, already_read + to_read);
810
            if( new_dest == NULL )
811
            {
812
                TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
813
                            "Failed to allocate memory for %s "
814
                            "(%ld elements of %ld bytes each)",
815
                            "TIFFReadDirEntryArray",
816
                             (long) 1, (long) (already_read + to_read));
817
                return TIFFReadDirEntryErrAlloc;
818
            }
819
            *pdest = new_dest;
820

821
            bytes_read = TIFFReadFile(tif,
822
                (char*)*pdest + already_read, to_read);
823
            already_read += bytes_read;
824
            if (bytes_read != to_read) {
825
                return TIFFReadDirEntryErrIo;
826
            }
827
        }
828
        return TIFFReadDirEntryErrOk;
829
}
830

831
static enum TIFFReadDirEntryErr TIFFReadDirEntryArrayWithLimit(
832
    TIFF* tif, TIFFDirEntry* direntry, uint32* count, uint32 desttypesize,
833
    void** value, uint64 maxcount)
834
{
835
	int typesize;
836
	uint32 datasize;
837
	void* data;
838
        uint64 target_count64;
839
	typesize=TIFFDataWidth(direntry->tdir_type);
840

841
        target_count64 = (direntry->tdir_count > maxcount) ?
842
                maxcount : direntry->tdir_count;
843

844
	if ((target_count64==0)||(typesize==0))
845
	{
846
		*value=0;
847
		return(TIFFReadDirEntryErrOk);
848
	}
849
        (void) desttypesize;
850

851
        /* 
852
         * As a sanity check, make sure we have no more than a 2GB tag array 
853
         * in either the current data type or the dest data type.  This also
854
         * avoids problems with overflow of tmsize_t on 32bit systems.
855
         */
856
	if ((uint64)(2147483647/typesize)<target_count64)
857
		return(TIFFReadDirEntryErrSizesan);
858
	if ((uint64)(2147483647/desttypesize)<target_count64)
859
		return(TIFFReadDirEntryErrSizesan);
860

861
	*count=(uint32)target_count64;
862
	datasize=(*count)*typesize;
863
	assert((tmsize_t)datasize>0);
864

865
	if( isMapped(tif) && datasize > (uint32)tif->tif_size )
866
		return TIFFReadDirEntryErrIo;
867

868
	if( !isMapped(tif) &&
869
		(((tif->tif_flags&TIFF_BIGTIFF) && datasize > 8) ||
870
		(!(tif->tif_flags&TIFF_BIGTIFF) && datasize > 4)) )
871
	{
872
		data = NULL;
873
	}
874
	else
875
	{
876
		data=_TIFFCheckMalloc(tif, *count, typesize, "ReadDirEntryArray");
877
		if (data==0)
878
			return(TIFFReadDirEntryErrAlloc);
879
	}
880
	if (!(tif->tif_flags&TIFF_BIGTIFF))
881
	{
882
		if (datasize<=4)
883
			_TIFFmemcpy(data,&direntry->tdir_offset,datasize);
884
		else
885
		{
886
			enum TIFFReadDirEntryErr err;
887
			uint32 offset = direntry->tdir_offset.toff_long;
888
			if (tif->tif_flags&TIFF_SWAB)
889
				TIFFSwabLong(&offset);
890
			if( isMapped(tif) )
891
				err=TIFFReadDirEntryData(tif,(uint64)offset,(tmsize_t)datasize,data);
892
			else
893
				err=TIFFReadDirEntryDataAndRealloc(tif,(uint64)offset,(tmsize_t)datasize,&data);
894
			if (err!=TIFFReadDirEntryErrOk)
895
			{
896
				_TIFFfree(data);
897
				return(err);
898
			}
899
		}
900
	}
901
	else
902
	{
903
		if (datasize<=8)
904
			_TIFFmemcpy(data,&direntry->tdir_offset,datasize);
905
		else
906
		{
907
			enum TIFFReadDirEntryErr err;
908
			uint64 offset = direntry->tdir_offset.toff_long8;
909
			if (tif->tif_flags&TIFF_SWAB)
910
				TIFFSwabLong8(&offset);
911
			if( isMapped(tif) )
912
				err=TIFFReadDirEntryData(tif,(uint64)offset,(tmsize_t)datasize,data);
913
			else
914
				err=TIFFReadDirEntryDataAndRealloc(tif,(uint64)offset,(tmsize_t)datasize,&data);
915
			if (err!=TIFFReadDirEntryErrOk)
916
			{
917
				_TIFFfree(data);
918
				return(err);
919
			}
920
		}
921
	}
922
	*value=data;
923
	return(TIFFReadDirEntryErrOk);
924
}
925

926
static enum TIFFReadDirEntryErr TIFFReadDirEntryArray(TIFF* tif, TIFFDirEntry* direntry, uint32* count, uint32 desttypesize, void** value)
927
{
928
    return TIFFReadDirEntryArrayWithLimit(tif, direntry, count,
929
                                          desttypesize, value, ~((uint64)0));
930
}
931

932
static enum TIFFReadDirEntryErr TIFFReadDirEntryByteArray(TIFF* tif, TIFFDirEntry* direntry, uint8** value)
933
{
934
	enum TIFFReadDirEntryErr err;
935
	uint32 count;
936
	void* origdata;
937
	uint8* data;
938
	switch (direntry->tdir_type)
939
	{
940
		case TIFF_ASCII:
941
		case TIFF_UNDEFINED:
942
		case TIFF_BYTE:
943
		case TIFF_SBYTE:
944
		case TIFF_SHORT:
945
		case TIFF_SSHORT:
946
		case TIFF_LONG:
947
		case TIFF_SLONG:
948
		case TIFF_LONG8:
949
		case TIFF_SLONG8:
950
			break;
951
		default:
952
			return(TIFFReadDirEntryErrType);
953
	}
954
	err=TIFFReadDirEntryArray(tif,direntry,&count,1,&origdata);
955
	if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
956
	{
957
		*value=0;
958
		return(err);
959
	}
960
	switch (direntry->tdir_type)
961
	{
962
		case TIFF_ASCII:
963
		case TIFF_UNDEFINED:
964
		case TIFF_BYTE:
965
			*value=(uint8*)origdata;
966
			return(TIFFReadDirEntryErrOk);
967
		case TIFF_SBYTE:
968
			{
969
				int8* m;
970
				uint32 n;
971
				m=(int8*)origdata;
972
				for (n=0; n<count; n++)
973
				{
974
					err=TIFFReadDirEntryCheckRangeByteSbyte(*m);
975
					if (err!=TIFFReadDirEntryErrOk)
976
					{
977
						_TIFFfree(origdata);
978
						return(err);
979
					}
980
					m++;
981
				}
982
				*value=(uint8*)origdata;
983
				return(TIFFReadDirEntryErrOk);
984
			}
985
	}
986
	data=(uint8*)_TIFFmalloc(count);
987
	if (data==0)
988
	{
989
		_TIFFfree(origdata);
990
		return(TIFFReadDirEntryErrAlloc);
991
	}
992
	switch (direntry->tdir_type)
993
	{
994
		case TIFF_SHORT:
995
			{
996
				uint16* ma;
997
				uint8* mb;
998
				uint32 n;
999
				ma=(uint16*)origdata;
1000
				mb=data;
1001
				for (n=0; n<count; n++)
1002
				{
1003
					if (tif->tif_flags&TIFF_SWAB)
1004
						TIFFSwabShort(ma);
1005
					err=TIFFReadDirEntryCheckRangeByteShort(*ma);
1006
					if (err!=TIFFReadDirEntryErrOk)
1007
						break;
1008
					*mb++=(uint8)(*ma++);
1009
				}
1010
			}
1011
			break;
1012
		case TIFF_SSHORT:
1013
			{
1014
				int16* ma;
1015
				uint8* mb;
1016
				uint32 n;
1017
				ma=(int16*)origdata;
1018
				mb=data;
1019
				for (n=0; n<count; n++)
1020
				{
1021
					if (tif->tif_flags&TIFF_SWAB)
1022
						TIFFSwabShort((uint16*)ma);
1023
					err=TIFFReadDirEntryCheckRangeByteSshort(*ma);
1024
					if (err!=TIFFReadDirEntryErrOk)
1025
						break;
1026
					*mb++=(uint8)(*ma++);
1027
				}
1028
			}
1029
			break;
1030
		case TIFF_LONG:
1031
			{
1032
				uint32* ma;
1033
				uint8* mb;
1034
				uint32 n;
1035
				ma=(uint32*)origdata;
1036
				mb=data;
1037
				for (n=0; n<count; n++)
1038
				{
1039
					if (tif->tif_flags&TIFF_SWAB)
1040
						TIFFSwabLong(ma);
1041
					err=TIFFReadDirEntryCheckRangeByteLong(*ma);
1042
					if (err!=TIFFReadDirEntryErrOk)
1043
						break;
1044
					*mb++=(uint8)(*ma++);
1045
				}
1046
			}
1047
			break;
1048
		case TIFF_SLONG:
1049
			{
1050
				int32* ma;
1051
				uint8* mb;
1052
				uint32 n;
1053
				ma=(int32*)origdata;
1054
				mb=data;
1055
				for (n=0; n<count; n++)
1056
				{
1057
					if (tif->tif_flags&TIFF_SWAB)
1058
						TIFFSwabLong((uint32*)ma);
1059
					err=TIFFReadDirEntryCheckRangeByteSlong(*ma);
1060
					if (err!=TIFFReadDirEntryErrOk)
1061
						break;
1062
					*mb++=(uint8)(*ma++);
1063
				}
1064
			}
1065
			break;
1066
		case TIFF_LONG8:
1067
			{
1068
				uint64* ma;
1069
				uint8* mb;
1070
				uint32 n;
1071
				ma=(uint64*)origdata;
1072
				mb=data;
1073
				for (n=0; n<count; n++)
1074
				{
1075
					if (tif->tif_flags&TIFF_SWAB)
1076
						TIFFSwabLong8(ma);
1077
					err=TIFFReadDirEntryCheckRangeByteLong8(*ma);
1078
					if (err!=TIFFReadDirEntryErrOk)
1079
						break;
1080
					*mb++=(uint8)(*ma++);
1081
				}
1082
			}
1083
			break;
1084
		case TIFF_SLONG8:
1085
			{
1086
				int64* ma;
1087
				uint8* mb;
1088
				uint32 n;
1089
				ma=(int64*)origdata;
1090
				mb=data;
1091
				for (n=0; n<count; n++)
1092
				{
1093
					if (tif->tif_flags&TIFF_SWAB)
1094
						TIFFSwabLong8((uint64*)ma);
1095
					err=TIFFReadDirEntryCheckRangeByteSlong8(*ma);
1096
					if (err!=TIFFReadDirEntryErrOk)
1097
						break;
1098
					*mb++=(uint8)(*ma++);
1099
				}
1100
			}
1101
			break;
1102
	}
1103
	_TIFFfree(origdata);
1104
	if (err!=TIFFReadDirEntryErrOk)
1105
	{
1106
		_TIFFfree(data);
1107
		return(err);
1108
	}
1109
	*value=data;
1110
	return(TIFFReadDirEntryErrOk);
1111
}
1112

1113
static enum TIFFReadDirEntryErr TIFFReadDirEntrySbyteArray(TIFF* tif, TIFFDirEntry* direntry, int8** value)
1114
{
1115
	enum TIFFReadDirEntryErr err;
1116
	uint32 count;
1117
	void* origdata;
1118
	int8* data;
1119
	switch (direntry->tdir_type)
1120
	{
1121
		case TIFF_UNDEFINED:
1122
		case TIFF_BYTE:
1123
		case TIFF_SBYTE:
1124
		case TIFF_SHORT:
1125
		case TIFF_SSHORT:
1126
		case TIFF_LONG:
1127
		case TIFF_SLONG:
1128
		case TIFF_LONG8:
1129
		case TIFF_SLONG8:
1130
			break;
1131
		default:
1132
			return(TIFFReadDirEntryErrType);
1133
	}
1134
	err=TIFFReadDirEntryArray(tif,direntry,&count,1,&origdata);
1135
	if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
1136
	{
1137
		*value=0;
1138
		return(err);
1139
	}
1140
	switch (direntry->tdir_type)
1141
	{
1142
		case TIFF_UNDEFINED:
1143
		case TIFF_BYTE:
1144
			{
1145
				uint8* m;
1146
				uint32 n;
1147
				m=(uint8*)origdata;
1148
				for (n=0; n<count; n++)
1149
				{
1150
					err=TIFFReadDirEntryCheckRangeSbyteByte(*m);
1151
					if (err!=TIFFReadDirEntryErrOk)
1152
					{
1153
						_TIFFfree(origdata);
1154
						return(err);
1155
					}
1156
					m++;
1157
				}
1158
				*value=(int8*)origdata;
1159
				return(TIFFReadDirEntryErrOk);
1160
			}
1161
		case TIFF_SBYTE:
1162
			*value=(int8*)origdata;
1163
			return(TIFFReadDirEntryErrOk);
1164
	}
1165
	data=(int8*)_TIFFmalloc(count);
1166
	if (data==0)
1167
	{
1168
		_TIFFfree(origdata);
1169
		return(TIFFReadDirEntryErrAlloc);
1170
	}
1171
	switch (direntry->tdir_type)
1172
	{
1173
		case TIFF_SHORT:
1174
			{
1175
				uint16* ma;
1176
				int8* mb;
1177
				uint32 n;
1178
				ma=(uint16*)origdata;
1179
				mb=data;
1180
				for (n=0; n<count; n++)
1181
				{
1182
					if (tif->tif_flags&TIFF_SWAB)
1183
						TIFFSwabShort(ma);
1184
					err=TIFFReadDirEntryCheckRangeSbyteShort(*ma);
1185
					if (err!=TIFFReadDirEntryErrOk)
1186
						break;
1187
					*mb++=(int8)(*ma++);
1188
				}
1189
			}
1190
			break;
1191
		case TIFF_SSHORT:
1192
			{
1193
				int16* ma;
1194
				int8* mb;
1195
				uint32 n;
1196
				ma=(int16*)origdata;
1197
				mb=data;
1198
				for (n=0; n<count; n++)
1199
				{
1200
					if (tif->tif_flags&TIFF_SWAB)
1201
						TIFFSwabShort((uint16*)ma);
1202
					err=TIFFReadDirEntryCheckRangeSbyteSshort(*ma);
1203
					if (err!=TIFFReadDirEntryErrOk)
1204
						break;
1205
					*mb++=(int8)(*ma++);
1206
				}
1207
			}
1208
			break;
1209
		case TIFF_LONG:
1210
			{
1211
				uint32* ma;
1212
				int8* mb;
1213
				uint32 n;
1214
				ma=(uint32*)origdata;
1215
				mb=data;
1216
				for (n=0; n<count; n++)
1217
				{
1218
					if (tif->tif_flags&TIFF_SWAB)
1219
						TIFFSwabLong(ma);
1220
					err=TIFFReadDirEntryCheckRangeSbyteLong(*ma);
1221
					if (err!=TIFFReadDirEntryErrOk)
1222
						break;
1223
					*mb++=(int8)(*ma++);
1224
				}
1225
			}
1226
			break;
1227
		case TIFF_SLONG:
1228
			{
1229
				int32* ma;
1230
				int8* mb;
1231
				uint32 n;
1232
				ma=(int32*)origdata;
1233
				mb=data;
1234
				for (n=0; n<count; n++)
1235
				{
1236
					if (tif->tif_flags&TIFF_SWAB)
1237
						TIFFSwabLong((uint32*)ma);
1238
					err=TIFFReadDirEntryCheckRangeSbyteSlong(*ma);
1239
					if (err!=TIFFReadDirEntryErrOk)
1240
						break;
1241
					*mb++=(int8)(*ma++);
1242
				}
1243
			}
1244
			break;
1245
		case TIFF_LONG8:
1246
			{
1247
				uint64* ma;
1248
				int8* mb;
1249
				uint32 n;
1250
				ma=(uint64*)origdata;
1251
				mb=data;
1252
				for (n=0; n<count; n++)
1253
				{
1254
					if (tif->tif_flags&TIFF_SWAB)
1255
						TIFFSwabLong8(ma);
1256
					err=TIFFReadDirEntryCheckRangeSbyteLong8(*ma);
1257
					if (err!=TIFFReadDirEntryErrOk)
1258
						break;
1259
					*mb++=(int8)(*ma++);
1260
				}
1261
			}
1262
			break;
1263
		case TIFF_SLONG8:
1264
			{
1265
				int64* ma;
1266
				int8* mb;
1267
				uint32 n;
1268
				ma=(int64*)origdata;
1269
				mb=data;
1270
				for (n=0; n<count; n++)
1271
				{
1272
					if (tif->tif_flags&TIFF_SWAB)
1273
						TIFFSwabLong8((uint64*)ma);
1274
					err=TIFFReadDirEntryCheckRangeSbyteSlong8(*ma);
1275
					if (err!=TIFFReadDirEntryErrOk)
1276
						break;
1277
					*mb++=(int8)(*ma++);
1278
				}
1279
			}
1280
			break;
1281
	}
1282
	_TIFFfree(origdata);
1283
	if (err!=TIFFReadDirEntryErrOk)
1284
	{
1285
		_TIFFfree(data);
1286
		return(err);
1287
	}
1288
	*value=data;
1289
	return(TIFFReadDirEntryErrOk);
1290
}
1291

1292
static enum TIFFReadDirEntryErr TIFFReadDirEntryShortArray(TIFF* tif, TIFFDirEntry* direntry, uint16** value)
1293
{
1294
	enum TIFFReadDirEntryErr err;
1295
	uint32 count;
1296
	void* origdata;
1297
	uint16* data;
1298
	switch (direntry->tdir_type)
1299
	{
1300
		case TIFF_BYTE:
1301
		case TIFF_SBYTE:
1302
		case TIFF_SHORT:
1303
		case TIFF_SSHORT:
1304
		case TIFF_LONG:
1305
		case TIFF_SLONG:
1306
		case TIFF_LONG8:
1307
		case TIFF_SLONG8:
1308
			break;
1309
		default:
1310
			return(TIFFReadDirEntryErrType);
1311
	}
1312
	err=TIFFReadDirEntryArray(tif,direntry,&count,2,&origdata);
1313
	if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
1314
	{
1315
		*value=0;
1316
		return(err);
1317
	}
1318
	switch (direntry->tdir_type)
1319
	{
1320
		case TIFF_SHORT:
1321
			*value=(uint16*)origdata;
1322
			if (tif->tif_flags&TIFF_SWAB)
1323
				TIFFSwabArrayOfShort(*value,count);  
1324
			return(TIFFReadDirEntryErrOk);
1325
		case TIFF_SSHORT:
1326
			{
1327
				int16* m;
1328
				uint32 n;
1329
				m=(int16*)origdata;
1330
				for (n=0; n<count; n++)
1331
				{
1332
					if (tif->tif_flags&TIFF_SWAB)
1333
						TIFFSwabShort((uint16*)m);
1334
					err=TIFFReadDirEntryCheckRangeShortSshort(*m);
1335
					if (err!=TIFFReadDirEntryErrOk)
1336
					{
1337
						_TIFFfree(origdata);
1338
						return(err);
1339
					}
1340
					m++;
1341
				}
1342
				*value=(uint16*)origdata;
1343
				return(TIFFReadDirEntryErrOk);
1344
			}
1345
	}
1346
	data=(uint16*)_TIFFmalloc(count*2);
1347
	if (data==0)
1348
	{
1349
		_TIFFfree(origdata);
1350
		return(TIFFReadDirEntryErrAlloc);
1351
	}
1352
	switch (direntry->tdir_type)
1353
	{
1354
		case TIFF_BYTE:
1355
			{
1356
				uint8* ma;
1357
				uint16* mb;
1358
				uint32 n;
1359
				ma=(uint8*)origdata;
1360
				mb=data;
1361
				for (n=0; n<count; n++)
1362
					*mb++=(uint16)(*ma++);
1363
			}
1364
			break;
1365
		case TIFF_SBYTE:
1366
			{
1367
				int8* ma;
1368
				uint16* mb;
1369
				uint32 n;
1370
				ma=(int8*)origdata;
1371
				mb=data;
1372
				for (n=0; n<count; n++)
1373
				{
1374
					err=TIFFReadDirEntryCheckRangeShortSbyte(*ma);
1375
					if (err!=TIFFReadDirEntryErrOk)
1376
						break;
1377
					*mb++=(uint16)(*ma++);
1378
				}
1379
			}
1380
			break;
1381
		case TIFF_LONG:
1382
			{
1383
				uint32* ma;
1384
				uint16* mb;
1385
				uint32 n;
1386
				ma=(uint32*)origdata;
1387
				mb=data;
1388
				for (n=0; n<count; n++)
1389
				{
1390
					if (tif->tif_flags&TIFF_SWAB)
1391
						TIFFSwabLong(ma);
1392
					err=TIFFReadDirEntryCheckRangeShortLong(*ma);
1393
					if (err!=TIFFReadDirEntryErrOk)
1394
						break;
1395
					*mb++=(uint16)(*ma++);
1396
				}
1397
			}
1398
			break;
1399
		case TIFF_SLONG:
1400
			{
1401
				int32* ma;
1402
				uint16* mb;
1403
				uint32 n;
1404
				ma=(int32*)origdata;
1405
				mb=data;
1406
				for (n=0; n<count; n++)
1407
				{
1408
					if (tif->tif_flags&TIFF_SWAB)
1409
						TIFFSwabLong((uint32*)ma);
1410
					err=TIFFReadDirEntryCheckRangeShortSlong(*ma);
1411
					if (err!=TIFFReadDirEntryErrOk)
1412
						break;
1413
					*mb++=(uint16)(*ma++);
1414
				}
1415
			}
1416
			break;
1417
		case TIFF_LONG8:
1418
			{
1419
				uint64* ma;
1420
				uint16* mb;
1421
				uint32 n;
1422
				ma=(uint64*)origdata;
1423
				mb=data;
1424
				for (n=0; n<count; n++)
1425
				{
1426
					if (tif->tif_flags&TIFF_SWAB)
1427
						TIFFSwabLong8(ma);
1428
					err=TIFFReadDirEntryCheckRangeShortLong8(*ma);
1429
					if (err!=TIFFReadDirEntryErrOk)
1430
						break;
1431
					*mb++=(uint16)(*ma++);
1432
				}
1433
			}
1434
			break;
1435
		case TIFF_SLONG8:
1436
			{
1437
				int64* ma;
1438
				uint16* mb;
1439
				uint32 n;
1440
				ma=(int64*)origdata;
1441
				mb=data;
1442
				for (n=0; n<count; n++)
1443
				{
1444
					if (tif->tif_flags&TIFF_SWAB)
1445
						TIFFSwabLong8((uint64*)ma);
1446
					err=TIFFReadDirEntryCheckRangeShortSlong8(*ma);
1447
					if (err!=TIFFReadDirEntryErrOk)
1448
						break;
1449
					*mb++=(uint16)(*ma++);
1450
				}
1451
			}
1452
			break;
1453
	}
1454
	_TIFFfree(origdata);
1455
	if (err!=TIFFReadDirEntryErrOk)
1456
	{
1457
		_TIFFfree(data);
1458
		return(err);
1459
	}
1460
	*value=data;
1461
	return(TIFFReadDirEntryErrOk);
1462
}
1463

1464
static enum TIFFReadDirEntryErr TIFFReadDirEntrySshortArray(TIFF* tif, TIFFDirEntry* direntry, int16** value)
1465
{
1466
	enum TIFFReadDirEntryErr err;
1467
	uint32 count;
1468
	void* origdata;
1469
	int16* data;
1470
	switch (direntry->tdir_type)
1471
	{
1472
		case TIFF_BYTE:
1473
		case TIFF_SBYTE:
1474
		case TIFF_SHORT:
1475
		case TIFF_SSHORT:
1476
		case TIFF_LONG:
1477
		case TIFF_SLONG:
1478
		case TIFF_LONG8:
1479
		case TIFF_SLONG8:
1480
			break;
1481
		default:
1482
			return(TIFFReadDirEntryErrType);
1483
	}
1484
	err=TIFFReadDirEntryArray(tif,direntry,&count,2,&origdata);
1485
	if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
1486
	{
1487
		*value=0;
1488
		return(err);
1489
	}
1490
	switch (direntry->tdir_type)
1491
	{
1492
		case TIFF_SHORT:
1493
			{
1494
				uint16* m;
1495
				uint32 n;
1496
				m=(uint16*)origdata;
1497
				for (n=0; n<count; n++)
1498
				{
1499
					if (tif->tif_flags&TIFF_SWAB)
1500
						TIFFSwabShort(m);
1501
					err=TIFFReadDirEntryCheckRangeSshortShort(*m);
1502
					if (err!=TIFFReadDirEntryErrOk)
1503
					{
1504
						_TIFFfree(origdata);
1505
						return(err);
1506
					}
1507
					m++;
1508
				}
1509
				*value=(int16*)origdata;
1510
				return(TIFFReadDirEntryErrOk);
1511
			}
1512
		case TIFF_SSHORT:
1513
			*value=(int16*)origdata;
1514
			if (tif->tif_flags&TIFF_SWAB)
1515
				TIFFSwabArrayOfShort((uint16*)(*value),count);
1516
			return(TIFFReadDirEntryErrOk);
1517
	}
1518
	data=(int16*)_TIFFmalloc(count*2);
1519
	if (data==0)
1520
	{
1521
		_TIFFfree(origdata);
1522
		return(TIFFReadDirEntryErrAlloc);
1523
	}
1524
	switch (direntry->tdir_type)
1525
	{
1526
		case TIFF_BYTE:
1527
			{
1528
				uint8* ma;
1529
				int16* mb;
1530
				uint32 n;
1531
				ma=(uint8*)origdata;
1532
				mb=data;
1533
				for (n=0; n<count; n++)
1534
					*mb++=(int16)(*ma++);
1535
			}
1536
			break;
1537
		case TIFF_SBYTE:
1538
			{
1539
				int8* ma;
1540
				int16* mb;
1541
				uint32 n;
1542
				ma=(int8*)origdata;
1543
				mb=data;
1544
				for (n=0; n<count; n++)
1545
					*mb++=(int16)(*ma++);
1546
			}
1547
			break;
1548
		case TIFF_LONG:
1549
			{
1550
				uint32* ma;
1551
				int16* mb;
1552
				uint32 n;
1553
				ma=(uint32*)origdata;
1554
				mb=data;
1555
				for (n=0; n<count; n++)
1556
				{
1557
					if (tif->tif_flags&TIFF_SWAB)
1558
						TIFFSwabLong(ma);
1559
					err=TIFFReadDirEntryCheckRangeSshortLong(*ma);
1560
					if (err!=TIFFReadDirEntryErrOk)
1561
						break;
1562
					*mb++=(int16)(*ma++);
1563
				}
1564
			}
1565
			break;
1566
		case TIFF_SLONG:
1567
			{
1568
				int32* ma;
1569
				int16* mb;
1570
				uint32 n;
1571
				ma=(int32*)origdata;
1572
				mb=data;
1573
				for (n=0; n<count; n++)
1574
				{
1575
					if (tif->tif_flags&TIFF_SWAB)
1576
						TIFFSwabLong((uint32*)ma);
1577
					err=TIFFReadDirEntryCheckRangeSshortSlong(*ma);
1578
					if (err!=TIFFReadDirEntryErrOk)
1579
						break;
1580
					*mb++=(int16)(*ma++);
1581
				}
1582
			}
1583
			break;
1584
		case TIFF_LONG8:
1585
			{
1586
				uint64* ma;
1587
				int16* mb;
1588
				uint32 n;
1589
				ma=(uint64*)origdata;
1590
				mb=data;
1591
				for (n=0; n<count; n++)
1592
				{
1593
					if (tif->tif_flags&TIFF_SWAB)
1594
						TIFFSwabLong8(ma);
1595
					err=TIFFReadDirEntryCheckRangeSshortLong8(*ma);
1596
					if (err!=TIFFReadDirEntryErrOk)
1597
						break;
1598
					*mb++=(int16)(*ma++);
1599
				}
1600
			}
1601
			break;
1602
		case TIFF_SLONG8:
1603
			{
1604
				int64* ma;
1605
				int16* mb;
1606
				uint32 n;
1607
				ma=(int64*)origdata;
1608
				mb=data;
1609
				for (n=0; n<count; n++)
1610
				{
1611
					if (tif->tif_flags&TIFF_SWAB)
1612
						TIFFSwabLong8((uint64*)ma);
1613
					err=TIFFReadDirEntryCheckRangeSshortSlong8(*ma);
1614
					if (err!=TIFFReadDirEntryErrOk)
1615
						break;
1616
					*mb++=(int16)(*ma++);
1617
				}
1618
			}
1619
			break;
1620
	}
1621
	_TIFFfree(origdata);
1622
	if (err!=TIFFReadDirEntryErrOk)
1623
	{
1624
		_TIFFfree(data);
1625
		return(err);
1626
	}
1627
	*value=data;
1628
	return(TIFFReadDirEntryErrOk);
1629
}
1630

1631
static enum TIFFReadDirEntryErr TIFFReadDirEntryLongArray(TIFF* tif, TIFFDirEntry* direntry, uint32** value)
1632
{
1633
	enum TIFFReadDirEntryErr err;
1634
	uint32 count;
1635
	void* origdata;
1636
	uint32* data;
1637
	switch (direntry->tdir_type)
1638
	{
1639
		case TIFF_BYTE:
1640
		case TIFF_SBYTE:
1641
		case TIFF_SHORT:
1642
		case TIFF_SSHORT:
1643
		case TIFF_LONG:
1644
		case TIFF_SLONG:
1645
		case TIFF_LONG8:
1646
		case TIFF_SLONG8:
1647
			break;
1648
		default:
1649
			return(TIFFReadDirEntryErrType);
1650
	}
1651
	err=TIFFReadDirEntryArray(tif,direntry,&count,4,&origdata);
1652
	if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
1653
	{
1654
		*value=0;
1655
		return(err);
1656
	}
1657
	switch (direntry->tdir_type)
1658
	{
1659
		case TIFF_LONG:
1660
			*value=(uint32*)origdata;
1661
			if (tif->tif_flags&TIFF_SWAB)
1662
				TIFFSwabArrayOfLong(*value,count);
1663
			return(TIFFReadDirEntryErrOk);
1664
		case TIFF_SLONG:
1665
			{
1666
				int32* m;
1667
				uint32 n;
1668
				m=(int32*)origdata;
1669
				for (n=0; n<count; n++)
1670
				{
1671
					if (tif->tif_flags&TIFF_SWAB)
1672
						TIFFSwabLong((uint32*)m);
1673
					err=TIFFReadDirEntryCheckRangeLongSlong(*m);
1674
					if (err!=TIFFReadDirEntryErrOk)
1675
					{
1676
						_TIFFfree(origdata);
1677
						return(err);
1678
					}
1679
					m++;
1680
				}
1681
				*value=(uint32*)origdata;
1682
				return(TIFFReadDirEntryErrOk);
1683
			}
1684
	}
1685
	data=(uint32*)_TIFFmalloc(count*4);
1686
	if (data==0)
1687
	{
1688
		_TIFFfree(origdata);
1689
		return(TIFFReadDirEntryErrAlloc);
1690
	}
1691
	switch (direntry->tdir_type)
1692
	{
1693
		case TIFF_BYTE:
1694
			{
1695
				uint8* ma;
1696
				uint32* mb;
1697
				uint32 n;
1698
				ma=(uint8*)origdata;
1699
				mb=data;
1700
				for (n=0; n<count; n++)
1701
					*mb++=(uint32)(*ma++);
1702
			}
1703
			break;
1704
		case TIFF_SBYTE:
1705
			{
1706
				int8* ma;
1707
				uint32* mb;
1708
				uint32 n;
1709
				ma=(int8*)origdata;
1710
				mb=data;
1711
				for (n=0; n<count; n++)
1712
				{
1713
					err=TIFFReadDirEntryCheckRangeLongSbyte(*ma);
1714
					if (err!=TIFFReadDirEntryErrOk)
1715
						break;
1716
					*mb++=(uint32)(*ma++);
1717
				}
1718
			}
1719
			break;
1720
		case TIFF_SHORT:
1721
			{
1722
				uint16* ma;
1723
				uint32* mb;
1724
				uint32 n;
1725
				ma=(uint16*)origdata;
1726
				mb=data;
1727
				for (n=0; n<count; n++)
1728
				{
1729
					if (tif->tif_flags&TIFF_SWAB)
1730
						TIFFSwabShort(ma);
1731
					*mb++=(uint32)(*ma++);
1732
				}
1733
			}
1734
			break;
1735
		case TIFF_SSHORT:
1736
			{
1737
				int16* ma;
1738
				uint32* mb;
1739
				uint32 n;
1740
				ma=(int16*)origdata;
1741
				mb=data;
1742
				for (n=0; n<count; n++)
1743
				{
1744
					if (tif->tif_flags&TIFF_SWAB)
1745
						TIFFSwabShort((uint16*)ma);
1746
					err=TIFFReadDirEntryCheckRangeLongSshort(*ma);
1747
					if (err!=TIFFReadDirEntryErrOk)
1748
						break;
1749
					*mb++=(uint32)(*ma++);
1750
				}
1751
			}
1752
			break;
1753
		case TIFF_LONG8:
1754
			{
1755
				uint64* ma;
1756
				uint32* mb;
1757
				uint32 n;
1758
				ma=(uint64*)origdata;
1759
				mb=data;
1760
				for (n=0; n<count; n++)
1761
				{
1762
					if (tif->tif_flags&TIFF_SWAB)
1763
						TIFFSwabLong8(ma);
1764
					err=TIFFReadDirEntryCheckRangeLongLong8(*ma);
1765
					if (err!=TIFFReadDirEntryErrOk)
1766
						break;
1767
					*mb++=(uint32)(*ma++);
1768
				}
1769
			}
1770
			break;
1771
		case TIFF_SLONG8:
1772
			{
1773
				int64* ma;
1774
				uint32* mb;
1775
				uint32 n;
1776
				ma=(int64*)origdata;
1777
				mb=data;
1778
				for (n=0; n<count; n++)
1779
				{
1780
					if (tif->tif_flags&TIFF_SWAB)
1781
						TIFFSwabLong8((uint64*)ma);
1782
					err=TIFFReadDirEntryCheckRangeLongSlong8(*ma);
1783
					if (err!=TIFFReadDirEntryErrOk)
1784
						break;
1785
					*mb++=(uint32)(*ma++);
1786
				}
1787
			}
1788
			break;
1789
	}
1790
	_TIFFfree(origdata);
1791
	if (err!=TIFFReadDirEntryErrOk)
1792
	{
1793
		_TIFFfree(data);
1794
		return(err);
1795
	}
1796
	*value=data;
1797
	return(TIFFReadDirEntryErrOk);
1798
}
1799

1800
static enum TIFFReadDirEntryErr TIFFReadDirEntrySlongArray(TIFF* tif, TIFFDirEntry* direntry, int32** value)
1801
{
1802
	enum TIFFReadDirEntryErr err;
1803
	uint32 count;
1804
	void* origdata;
1805
	int32* data;
1806
	switch (direntry->tdir_type)
1807
	{
1808
		case TIFF_BYTE:
1809
		case TIFF_SBYTE:
1810
		case TIFF_SHORT:
1811
		case TIFF_SSHORT:
1812
		case TIFF_LONG:
1813
		case TIFF_SLONG:
1814
		case TIFF_LONG8:
1815
		case TIFF_SLONG8:
1816
			break;
1817
		default:
1818
			return(TIFFReadDirEntryErrType);
1819
	}
1820
	err=TIFFReadDirEntryArray(tif,direntry,&count,4,&origdata);
1821
	if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
1822
	{
1823
		*value=0;
1824
		return(err);
1825
	}
1826
	switch (direntry->tdir_type)
1827
	{
1828
		case TIFF_LONG:
1829
			{
1830
				uint32* m;
1831
				uint32 n;
1832
				m=(uint32*)origdata;
1833
				for (n=0; n<count; n++)
1834
				{
1835
					if (tif->tif_flags&TIFF_SWAB)
1836
						TIFFSwabLong((uint32*)m);
1837
					err=TIFFReadDirEntryCheckRangeSlongLong(*m);
1838
					if (err!=TIFFReadDirEntryErrOk)
1839
					{
1840
						_TIFFfree(origdata);
1841
						return(err);
1842
					}
1843
					m++;
1844
				}
1845
				*value=(int32*)origdata;
1846
				return(TIFFReadDirEntryErrOk);
1847
			}
1848
		case TIFF_SLONG:
1849
			*value=(int32*)origdata;
1850
			if (tif->tif_flags&TIFF_SWAB)
1851
				TIFFSwabArrayOfLong((uint32*)(*value),count);
1852
			return(TIFFReadDirEntryErrOk);
1853
	}
1854
	data=(int32*)_TIFFmalloc(count*4);
1855
	if (data==0)
1856
	{
1857
		_TIFFfree(origdata);
1858
		return(TIFFReadDirEntryErrAlloc);
1859
	}
1860
	switch (direntry->tdir_type)
1861
	{
1862
		case TIFF_BYTE:
1863
			{
1864
				uint8* ma;
1865
				int32* mb;
1866
				uint32 n;
1867
				ma=(uint8*)origdata;
1868
				mb=data;
1869
				for (n=0; n<count; n++)
1870
					*mb++=(int32)(*ma++);
1871
			}
1872
			break;
1873
		case TIFF_SBYTE:
1874
			{
1875
				int8* ma;
1876
				int32* mb;
1877
				uint32 n;
1878
				ma=(int8*)origdata;
1879
				mb=data;
1880
				for (n=0; n<count; n++)
1881
					*mb++=(int32)(*ma++);
1882
			}
1883
			break;
1884
		case TIFF_SHORT:
1885
			{
1886
				uint16* ma;
1887
				int32* mb;
1888
				uint32 n;
1889
				ma=(uint16*)origdata;
1890
				mb=data;
1891
				for (n=0; n<count; n++)
1892
				{
1893
					if (tif->tif_flags&TIFF_SWAB)
1894
						TIFFSwabShort(ma);
1895
					*mb++=(int32)(*ma++);
1896
				}
1897
			}
1898
			break;
1899
		case TIFF_SSHORT:
1900
			{
1901
				int16* ma;
1902
				int32* mb;
1903
				uint32 n;
1904
				ma=(int16*)origdata;
1905
				mb=data;
1906
				for (n=0; n<count; n++)
1907
				{
1908
					if (tif->tif_flags&TIFF_SWAB)
1909
						TIFFSwabShort((uint16*)ma);
1910
					*mb++=(int32)(*ma++);
1911
				}
1912
			}
1913
			break;
1914
		case TIFF_LONG8:
1915
			{
1916
				uint64* ma;
1917
				int32* mb;
1918
				uint32 n;
1919
				ma=(uint64*)origdata;
1920
				mb=data;
1921
				for (n=0; n<count; n++)
1922
				{
1923
					if (tif->tif_flags&TIFF_SWAB)
1924
						TIFFSwabLong8(ma);
1925
					err=TIFFReadDirEntryCheckRangeSlongLong8(*ma);
1926
					if (err!=TIFFReadDirEntryErrOk)
1927
						break;
1928
					*mb++=(int32)(*ma++);
1929
				}
1930
			}
1931
			break;
1932
		case TIFF_SLONG8:
1933
			{
1934
				int64* ma;
1935
				int32* mb;
1936
				uint32 n;
1937
				ma=(int64*)origdata;
1938
				mb=data;
1939
				for (n=0; n<count; n++)
1940
				{
1941
					if (tif->tif_flags&TIFF_SWAB)
1942
						TIFFSwabLong8((uint64*)ma);
1943
					err=TIFFReadDirEntryCheckRangeSlongSlong8(*ma);
1944
					if (err!=TIFFReadDirEntryErrOk)
1945
						break;
1946
					*mb++=(int32)(*ma++);
1947
				}
1948
			}
1949
			break;
1950
	}
1951
	_TIFFfree(origdata);
1952
	if (err!=TIFFReadDirEntryErrOk)
1953
	{
1954
		_TIFFfree(data);
1955
		return(err);
1956
	}
1957
	*value=data;
1958
	return(TIFFReadDirEntryErrOk);
1959
}
1960

1961
static enum TIFFReadDirEntryErr TIFFReadDirEntryLong8ArrayWithLimit(
1962
        TIFF* tif, TIFFDirEntry* direntry, uint64** value, uint64 maxcount)
1963
{
1964
	enum TIFFReadDirEntryErr err;
1965
	uint32 count;
1966
	void* origdata;
1967
	uint64* data;
1968
	switch (direntry->tdir_type)
1969
	{
1970
		case TIFF_BYTE:
1971
		case TIFF_SBYTE:
1972
		case TIFF_SHORT:
1973
		case TIFF_SSHORT:
1974
		case TIFF_LONG:
1975
		case TIFF_SLONG:
1976
		case TIFF_LONG8:
1977
		case TIFF_SLONG8:
1978
			break;
1979
		default:
1980
			return(TIFFReadDirEntryErrType);
1981
	}
1982
	err=TIFFReadDirEntryArrayWithLimit(tif,direntry,&count,8,&origdata,maxcount);
1983
	if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
1984
	{
1985
		*value=0;
1986
		return(err);
1987
	}
1988
	switch (direntry->tdir_type)
1989
	{
1990
		case TIFF_LONG8:
1991
			*value=(uint64*)origdata;
1992
			if (tif->tif_flags&TIFF_SWAB)
1993
				TIFFSwabArrayOfLong8(*value,count);
1994
			return(TIFFReadDirEntryErrOk);
1995
		case TIFF_SLONG8:
1996
			{
1997
				int64* m;
1998
				uint32 n;
1999
				m=(int64*)origdata;
2000
				for (n=0; n<count; n++)
2001
				{
2002
					if (tif->tif_flags&TIFF_SWAB)
2003
						TIFFSwabLong8((uint64*)m);
2004
					err=TIFFReadDirEntryCheckRangeLong8Slong8(*m);
2005
					if (err!=TIFFReadDirEntryErrOk)
2006
					{
2007
						_TIFFfree(origdata);
2008
						return(err);
2009
					}
2010
					m++;
2011
				}
2012
				*value=(uint64*)origdata;
2013
				return(TIFFReadDirEntryErrOk);
2014
			}
2015
	}
2016
	data=(uint64*)_TIFFmalloc(count*8);
2017
	if (data==0)
2018
	{
2019
		_TIFFfree(origdata);
2020
		return(TIFFReadDirEntryErrAlloc);
2021
	}
2022
	switch (direntry->tdir_type)
2023
	{
2024
		case TIFF_BYTE:
2025
			{
2026
				uint8* ma;
2027
				uint64* mb;
2028
				uint32 n;
2029
				ma=(uint8*)origdata;
2030
				mb=data;
2031
				for (n=0; n<count; n++)
2032
					*mb++=(uint64)(*ma++);
2033
			}
2034
			break;
2035
		case TIFF_SBYTE:
2036
			{
2037
				int8* ma;
2038
				uint64* mb;
2039
				uint32 n;
2040
				ma=(int8*)origdata;
2041
				mb=data;
2042
				for (n=0; n<count; n++)
2043
				{
2044
					err=TIFFReadDirEntryCheckRangeLong8Sbyte(*ma);
2045
					if (err!=TIFFReadDirEntryErrOk)
2046
						break;
2047
					*mb++=(uint64)(*ma++);
2048
				}
2049
			}
2050
			break;
2051
		case TIFF_SHORT:
2052
			{
2053
				uint16* ma;
2054
				uint64* mb;
2055
				uint32 n;
2056
				ma=(uint16*)origdata;
2057
				mb=data;
2058
				for (n=0; n<count; n++)
2059
				{
2060
					if (tif->tif_flags&TIFF_SWAB)
2061
						TIFFSwabShort(ma);
2062
					*mb++=(uint64)(*ma++);
2063
				}
2064
			}
2065
			break;
2066
		case TIFF_SSHORT:
2067
			{
2068
				int16* ma;
2069
				uint64* mb;
2070
				uint32 n;
2071
				ma=(int16*)origdata;
2072
				mb=data;
2073
				for (n=0; n<count; n++)
2074
				{
2075
					if (tif->tif_flags&TIFF_SWAB)
2076
						TIFFSwabShort((uint16*)ma);
2077
					err=TIFFReadDirEntryCheckRangeLong8Sshort(*ma);
2078
					if (err!=TIFFReadDirEntryErrOk)
2079
						break;
2080
					*mb++=(uint64)(*ma++);
2081
				}
2082
			}
2083
			break;
2084
		case TIFF_LONG:
2085
			{
2086
				uint32* ma;
2087
				uint64* mb;
2088
				uint32 n;
2089
				ma=(uint32*)origdata;
2090
				mb=data;
2091
				for (n=0; n<count; n++)
2092
				{
2093
					if (tif->tif_flags&TIFF_SWAB)
2094
						TIFFSwabLong(ma);
2095
					*mb++=(uint64)(*ma++);
2096
				}
2097
			}
2098
			break;
2099
		case TIFF_SLONG:
2100
			{
2101
				int32* ma;
2102
				uint64* mb;
2103
				uint32 n;
2104
				ma=(int32*)origdata;
2105
				mb=data;
2106
				for (n=0; n<count; n++)
2107
				{
2108
					if (tif->tif_flags&TIFF_SWAB)
2109
						TIFFSwabLong((uint32*)ma);
2110
					err=TIFFReadDirEntryCheckRangeLong8Slong(*ma);
2111
					if (err!=TIFFReadDirEntryErrOk)
2112
						break;
2113
					*mb++=(uint64)(*ma++);
2114
				}
2115
			}
2116
			break;
2117
	}
2118
	_TIFFfree(origdata);
2119
	if (err!=TIFFReadDirEntryErrOk)
2120
	{
2121
		_TIFFfree(data);
2122
		return(err);
2123
	}
2124
	*value=data;
2125
	return(TIFFReadDirEntryErrOk);
2126
}
2127

2128
static enum TIFFReadDirEntryErr TIFFReadDirEntryLong8Array(TIFF* tif, TIFFDirEntry* direntry, uint64** value)
2129
{
2130
    return TIFFReadDirEntryLong8ArrayWithLimit(tif, direntry, value, ~((uint64)0));
2131
}
2132

2133
static enum TIFFReadDirEntryErr TIFFReadDirEntrySlong8Array(TIFF* tif, TIFFDirEntry* direntry, int64** value)
2134
{
2135
	enum TIFFReadDirEntryErr err;
2136
	uint32 count;
2137
	void* origdata;
2138
	int64* data;
2139
	switch (direntry->tdir_type)
2140
	{
2141
		case TIFF_BYTE:
2142
		case TIFF_SBYTE:
2143
		case TIFF_SHORT:
2144
		case TIFF_SSHORT:
2145
		case TIFF_LONG:
2146
		case TIFF_SLONG:
2147
		case TIFF_LONG8:
2148
		case TIFF_SLONG8:
2149
			break;
2150
		default:
2151
			return(TIFFReadDirEntryErrType);
2152
	}
2153
	err=TIFFReadDirEntryArray(tif,direntry,&count,8,&origdata);
2154
	if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
2155
	{
2156
		*value=0;
2157
		return(err);
2158
	}
2159
	switch (direntry->tdir_type)
2160
	{
2161
		case TIFF_LONG8:
2162
			{
2163
				uint64* m;
2164
				uint32 n;
2165
				m=(uint64*)origdata;
2166
				for (n=0; n<count; n++)
2167
				{
2168
					if (tif->tif_flags&TIFF_SWAB)
2169
						TIFFSwabLong8(m);
2170
					err=TIFFReadDirEntryCheckRangeSlong8Long8(*m);
2171
					if (err!=TIFFReadDirEntryErrOk)
2172
					{
2173
						_TIFFfree(origdata);
2174
						return(err);
2175
					}
2176
					m++;
2177
				}
2178
				*value=(int64*)origdata;
2179
				return(TIFFReadDirEntryErrOk);
2180
			}
2181
		case TIFF_SLONG8:
2182
			*value=(int64*)origdata;
2183
			if (tif->tif_flags&TIFF_SWAB)
2184
				TIFFSwabArrayOfLong8((uint64*)(*value),count);
2185
			return(TIFFReadDirEntryErrOk);
2186
	}
2187
	data=(int64*)_TIFFmalloc(count*8);
2188
	if (data==0)
2189
	{
2190
		_TIFFfree(origdata);
2191
		return(TIFFReadDirEntryErrAlloc);
2192
	}
2193
	switch (direntry->tdir_type)
2194
	{
2195
		case TIFF_BYTE:
2196
			{
2197
				uint8* ma;
2198
				int64* mb;
2199
				uint32 n;
2200
				ma=(uint8*)origdata;
2201
				mb=data;
2202
				for (n=0; n<count; n++)
2203
					*mb++=(int64)(*ma++);
2204
			}
2205
			break;
2206
		case TIFF_SBYTE:
2207
			{
2208
				int8* ma;
2209
				int64* mb;
2210
				uint32 n;
2211
				ma=(int8*)origdata;
2212
				mb=data;
2213
				for (n=0; n<count; n++)
2214
					*mb++=(int64)(*ma++);
2215
			}
2216
			break;
2217
		case TIFF_SHORT:
2218
			{
2219
				uint16* ma;
2220
				int64* mb;
2221
				uint32 n;
2222
				ma=(uint16*)origdata;
2223
				mb=data;
2224
				for (n=0; n<count; n++)
2225
				{
2226
					if (tif->tif_flags&TIFF_SWAB)
2227
						TIFFSwabShort(ma);
2228
					*mb++=(int64)(*ma++);
2229
				}
2230
			}
2231
			break;
2232
		case TIFF_SSHORT:
2233
			{
2234
				int16* ma;
2235
				int64* mb;
2236
				uint32 n;
2237
				ma=(int16*)origdata;
2238
				mb=data;
2239
				for (n=0; n<count; n++)
2240
				{
2241
					if (tif->tif_flags&TIFF_SWAB)
2242
						TIFFSwabShort((uint16*)ma);
2243
					*mb++=(int64)(*ma++);
2244
				}
2245
			}
2246
			break;
2247
		case TIFF_LONG:
2248
			{
2249
				uint32* ma;
2250
				int64* mb;
2251
				uint32 n;
2252
				ma=(uint32*)origdata;
2253
				mb=data;
2254
				for (n=0; n<count; n++)
2255
				{
2256
					if (tif->tif_flags&TIFF_SWAB)
2257
						TIFFSwabLong(ma);
2258
					*mb++=(int64)(*ma++);
2259
				}
2260
			}
2261
			break;
2262
		case TIFF_SLONG:
2263
			{
2264
				int32* ma;
2265
				int64* mb;
2266
				uint32 n;
2267
				ma=(int32*)origdata;
2268
				mb=data;
2269
				for (n=0; n<count; n++)
2270
				{
2271
					if (tif->tif_flags&TIFF_SWAB)
2272
						TIFFSwabLong((uint32*)ma);
2273
					*mb++=(int64)(*ma++);
2274
				}
2275
			}
2276
			break;
2277
	}
2278
	_TIFFfree(origdata);
2279
	*value=data;
2280
	return(TIFFReadDirEntryErrOk);
2281
}
2282

2283
static enum TIFFReadDirEntryErr TIFFReadDirEntryFloatArray(TIFF* tif, TIFFDirEntry* direntry, float** value)
2284
{
2285
	enum TIFFReadDirEntryErr err;
2286
	uint32 count;
2287
	void* origdata;
2288
	float* data;
2289
	switch (direntry->tdir_type)
2290
	{
2291
		case TIFF_BYTE:
2292
		case TIFF_SBYTE:
2293
		case TIFF_SHORT:
2294
		case TIFF_SSHORT:
2295
		case TIFF_LONG:
2296
		case TIFF_SLONG:
2297
		case TIFF_LONG8:
2298
		case TIFF_SLONG8:
2299
		case TIFF_RATIONAL:
2300
		case TIFF_SRATIONAL:
2301
		case TIFF_FLOAT:
2302
		case TIFF_DOUBLE:
2303
			break;
2304
		default:
2305
			return(TIFFReadDirEntryErrType);
2306
	}
2307
	err=TIFFReadDirEntryArray(tif,direntry,&count,4,&origdata);
2308
	if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
2309
	{
2310
		*value=0;
2311
		return(err);
2312
	}
2313
	switch (direntry->tdir_type)
2314
	{
2315
		case TIFF_FLOAT:
2316
			if (tif->tif_flags&TIFF_SWAB)
2317
				TIFFSwabArrayOfLong((uint32*)origdata,count);  
2318
			TIFFCvtIEEEDoubleToNative(tif,count,(float*)origdata);
2319
			*value=(float*)origdata;
2320
			return(TIFFReadDirEntryErrOk);
2321
	}
2322
	data=(float*)_TIFFmalloc(count*sizeof(float));
2323
	if (data==0)
2324
	{
2325
		_TIFFfree(origdata);
2326
		return(TIFFReadDirEntryErrAlloc);
2327
	}
2328
	switch (direntry->tdir_type)
2329
	{
2330
		case TIFF_BYTE:
2331
			{
2332
				uint8* ma;
2333
				float* mb;
2334
				uint32 n;
2335
				ma=(uint8*)origdata;
2336
				mb=data;
2337
				for (n=0; n<count; n++)
2338
					*mb++=(float)(*ma++);
2339
			}
2340
			break;
2341
		case TIFF_SBYTE:
2342
			{
2343
				int8* ma;
2344
				float* mb;
2345
				uint32 n;
2346
				ma=(int8*)origdata;
2347
				mb=data;
2348
				for (n=0; n<count; n++)
2349
					*mb++=(float)(*ma++);
2350
			}
2351
			break;
2352
		case TIFF_SHORT:
2353
			{
2354
				uint16* ma;
2355
				float* mb;
2356
				uint32 n;
2357
				ma=(uint16*)origdata;
2358
				mb=data;
2359
				for (n=0; n<count; n++)
2360
				{
2361
					if (tif->tif_flags&TIFF_SWAB)
2362
						TIFFSwabShort(ma);
2363
					*mb++=(float)(*ma++);
2364
				}
2365
			}
2366
			break;
2367
		case TIFF_SSHORT:
2368
			{
2369
				int16* ma;
2370
				float* mb;
2371
				uint32 n;
2372
				ma=(int16*)origdata;
2373
				mb=data;
2374
				for (n=0; n<count; n++)
2375
				{
2376
					if (tif->tif_flags&TIFF_SWAB)
2377
						TIFFSwabShort((uint16*)ma);
2378
					*mb++=(float)(*ma++);
2379
				}
2380
			}
2381
			break;
2382
		case TIFF_LONG:
2383
			{
2384
				uint32* ma;
2385
				float* mb;
2386
				uint32 n;
2387
				ma=(uint32*)origdata;
2388
				mb=data;
2389
				for (n=0; n<count; n++)
2390
				{
2391
					if (tif->tif_flags&TIFF_SWAB)
2392
						TIFFSwabLong(ma);
2393
					*mb++=(float)(*ma++);
2394
				}
2395
			}
2396
			break;
2397
		case TIFF_SLONG:
2398
			{
2399
				int32* ma;
2400
				float* mb;
2401
				uint32 n;
2402
				ma=(int32*)origdata;
2403
				mb=data;
2404
				for (n=0; n<count; n++)
2405
				{
2406
					if (tif->tif_flags&TIFF_SWAB)
2407
						TIFFSwabLong((uint32*)ma);
2408
					*mb++=(float)(*ma++);
2409
				}
2410
			}
2411
			break;
2412
		case TIFF_LONG8:
2413
			{
2414
				uint64* ma;
2415
				float* mb;
2416
				uint32 n;
2417
				ma=(uint64*)origdata;
2418
				mb=data;
2419
				for (n=0; n<count; n++)
2420
				{
2421
					if (tif->tif_flags&TIFF_SWAB)
2422
						TIFFSwabLong8(ma);
2423
#if defined(__WIN32__) && (_MSC_VER < 1500)
2424
					/*
2425
					 * XXX: MSVC 6.0 does not support
2426
					 * conversion of 64-bit integers into
2427
					 * floating point values.
2428
					 */
2429
					*mb++ = _TIFFUInt64ToFloat(*ma++);
2430
#else
2431
					*mb++ = (float)(*ma++);
2432
#endif
2433
				}
2434
			}
2435
			break;
2436
		case TIFF_SLONG8:
2437
			{
2438
				int64* ma;
2439
				float* mb;
2440
				uint32 n;
2441
				ma=(int64*)origdata;
2442
				mb=data;
2443
				for (n=0; n<count; n++)
2444
				{
2445
					if (tif->tif_flags&TIFF_SWAB)
2446
						TIFFSwabLong8((uint64*)ma);
2447
					*mb++=(float)(*ma++);
2448
				}
2449
			}
2450
			break;
2451
		case TIFF_RATIONAL:
2452
			{
2453
				uint32* ma;
2454
				uint32 maa;
2455
				uint32 mab;
2456
				float* mb;
2457
				uint32 n;
2458
				ma=(uint32*)origdata;
2459
				mb=data;
2460
				for (n=0; n<count; n++)
2461
				{
2462
					if (tif->tif_flags&TIFF_SWAB)
2463
						TIFFSwabLong(ma);
2464
					maa=*ma++;
2465
					if (tif->tif_flags&TIFF_SWAB)
2466
						TIFFSwabLong(ma);
2467
					mab=*ma++;
2468
					if (mab==0)
2469
						*mb++=0.0;
2470
					else
2471
						*mb++=(float)maa/(float)mab;
2472
				}
2473
			}
2474
			break;
2475
		case TIFF_SRATIONAL:
2476
			{
2477
				uint32* ma;
2478
				int32 maa;
2479
				uint32 mab;
2480
				float* mb;
2481
				uint32 n;
2482
				ma=(uint32*)origdata;
2483
				mb=data;
2484
				for (n=0; n<count; n++)
2485
				{
2486
					if (tif->tif_flags&TIFF_SWAB)
2487
						TIFFSwabLong(ma);
2488
					maa=*(int32*)ma;
2489
					ma++;
2490
					if (tif->tif_flags&TIFF_SWAB)
2491
						TIFFSwabLong(ma);
2492
					mab=*ma++;
2493
					if (mab==0)
2494
						*mb++=0.0;
2495
					else
2496
						*mb++=(float)maa/(float)mab;
2497
				}
2498
			}
2499
			break;
2500
		case TIFF_DOUBLE:
2501
			{
2502
				double* ma;
2503
				float* mb;
2504
				uint32 n;
2505
				if (tif->tif_flags&TIFF_SWAB)
2506
					TIFFSwabArrayOfLong8((uint64*)origdata,count);
2507
				TIFFCvtIEEEDoubleToNative(tif,count,(double*)origdata);
2508
				ma=(double*)origdata;
2509
				mb=data;
2510
				for (n=0; n<count; n++)
2511
                                {
2512
                                    double val = *ma++;
2513
                                    if( val > FLT_MAX )
2514
                                        val = FLT_MAX;
2515
                                    else if( val < -FLT_MAX )
2516
                                        val = -FLT_MAX;
2517
                                    *mb++=(float)val;
2518
                                }
2519
			}
2520
			break;
2521
	}
2522
	_TIFFfree(origdata);
2523
	*value=data;
2524
	return(TIFFReadDirEntryErrOk);
2525
}
2526

2527
static enum TIFFReadDirEntryErr
2528
TIFFReadDirEntryDoubleArray(TIFF* tif, TIFFDirEntry* direntry, double** value)
2529
{
2530
	enum TIFFReadDirEntryErr err;
2531
	uint32 count;
2532
	void* origdata;
2533
	double* data;
2534
	switch (direntry->tdir_type)
2535
	{
2536
		case TIFF_BYTE:
2537
		case TIFF_SBYTE:
2538
		case TIFF_SHORT:
2539
		case TIFF_SSHORT:
2540
		case TIFF_LONG:
2541
		case TIFF_SLONG:
2542
		case TIFF_LONG8:
2543
		case TIFF_SLONG8:
2544
		case TIFF_RATIONAL:
2545
		case TIFF_SRATIONAL:
2546
		case TIFF_FLOAT:
2547
		case TIFF_DOUBLE:
2548
			break;
2549
		default:
2550
			return(TIFFReadDirEntryErrType);
2551
	}
2552
	err=TIFFReadDirEntryArray(tif,direntry,&count,8,&origdata);
2553
	if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
2554
	{
2555
		*value=0;
2556
		return(err);
2557
	}
2558
	switch (direntry->tdir_type)
2559
	{
2560
		case TIFF_DOUBLE:
2561
			if (tif->tif_flags&TIFF_SWAB)
2562
				TIFFSwabArrayOfLong8((uint64*)origdata,count);
2563
			TIFFCvtIEEEDoubleToNative(tif,count,(double*)origdata);
2564
			*value=(double*)origdata;
2565
			return(TIFFReadDirEntryErrOk);
2566
	}
2567
	data=(double*)_TIFFmalloc(count*sizeof(double));
2568
	if (data==0)
2569
	{
2570
		_TIFFfree(origdata);
2571
		return(TIFFReadDirEntryErrAlloc);
2572
	}
2573
	switch (direntry->tdir_type)
2574
	{
2575
		case TIFF_BYTE:
2576
			{
2577
				uint8* ma;
2578
				double* mb;
2579
				uint32 n;
2580
				ma=(uint8*)origdata;
2581
				mb=data;
2582
				for (n=0; n<count; n++)
2583
					*mb++=(double)(*ma++);
2584
			}
2585
			break;
2586
		case TIFF_SBYTE:
2587
			{
2588
				int8* ma;
2589
				double* mb;
2590
				uint32 n;
2591
				ma=(int8*)origdata;
2592
				mb=data;
2593
				for (n=0; n<count; n++)
2594
					*mb++=(double)(*ma++);
2595
			}
2596
			break;
2597
		case TIFF_SHORT:
2598
			{
2599
				uint16* ma;
2600
				double* mb;
2601
				uint32 n;
2602
				ma=(uint16*)origdata;
2603
				mb=data;
2604
				for (n=0; n<count; n++)
2605
				{
2606
					if (tif->tif_flags&TIFF_SWAB)
2607
						TIFFSwabShort(ma);
2608
					*mb++=(double)(*ma++);
2609
				}
2610
			}
2611
			break;
2612
		case TIFF_SSHORT:
2613
			{
2614
				int16* ma;
2615
				double* mb;
2616
				uint32 n;
2617
				ma=(int16*)origdata;
2618
				mb=data;
2619
				for (n=0; n<count; n++)
2620
				{
2621
					if (tif->tif_flags&TIFF_SWAB)
2622
						TIFFSwabShort((uint16*)ma);
2623
					*mb++=(double)(*ma++);
2624
				}
2625
			}
2626
			break;
2627
		case TIFF_LONG:
2628
			{
2629
				uint32* ma;
2630
				double* mb;
2631
				uint32 n;
2632
				ma=(uint32*)origdata;
2633
				mb=data;
2634
				for (n=0; n<count; n++)
2635
				{
2636
					if (tif->tif_flags&TIFF_SWAB)
2637
						TIFFSwabLong(ma);
2638
					*mb++=(double)(*ma++);
2639
				}
2640
			}
2641
			break;
2642
		case TIFF_SLONG:
2643
			{
2644
				int32* ma;
2645
				double* mb;
2646
				uint32 n;
2647
				ma=(int32*)origdata;
2648
				mb=data;
2649
				for (n=0; n<count; n++)
2650
				{
2651
					if (tif->tif_flags&TIFF_SWAB)
2652
						TIFFSwabLong((uint32*)ma);
2653
					*mb++=(double)(*ma++);
2654
				}
2655
			}
2656
			break;
2657
		case TIFF_LONG8:
2658
			{
2659
				uint64* ma;
2660
				double* mb;
2661
				uint32 n;
2662
				ma=(uint64*)origdata;
2663
				mb=data;
2664
				for (n=0; n<count; n++)
2665
				{
2666
					if (tif->tif_flags&TIFF_SWAB)
2667
						TIFFSwabLong8(ma);
2668
#if defined(__WIN32__) && (_MSC_VER < 1500)
2669
					/*
2670
					 * XXX: MSVC 6.0 does not support
2671
					 * conversion of 64-bit integers into
2672
					 * floating point values.
2673
					 */
2674
					*mb++ = _TIFFUInt64ToDouble(*ma++);
2675
#else
2676
					*mb++ = (double)(*ma++);
2677
#endif
2678
				}
2679
			}
2680
			break;
2681
		case TIFF_SLONG8:
2682
			{
2683
				int64* ma;
2684
				double* mb;
2685
				uint32 n;
2686
				ma=(int64*)origdata;
2687
				mb=data;
2688
				for (n=0; n<count; n++)
2689
				{
2690
					if (tif->tif_flags&TIFF_SWAB)
2691
						TIFFSwabLong8((uint64*)ma);
2692
					*mb++=(double)(*ma++);
2693
				}
2694
			}
2695
			break;
2696
		case TIFF_RATIONAL:
2697
			{
2698
				uint32* ma;
2699
				uint32 maa;
2700
				uint32 mab;
2701
				double* mb;
2702
				uint32 n;
2703
				ma=(uint32*)origdata;
2704
				mb=data;
2705
				for (n=0; n<count; n++)
2706
				{
2707
					if (tif->tif_flags&TIFF_SWAB)
2708
						TIFFSwabLong(ma);
2709
					maa=*ma++;
2710
					if (tif->tif_flags&TIFF_SWAB)
2711
						TIFFSwabLong(ma);
2712
					mab=*ma++;
2713
					if (mab==0)
2714
						*mb++=0.0;
2715
					else
2716
						*mb++=(double)maa/(double)mab;
2717
				}
2718
			}
2719
			break;
2720
		case TIFF_SRATIONAL:
2721
			{
2722
				uint32* ma;
2723
				int32 maa;
2724
				uint32 mab;
2725
				double* mb;
2726
				uint32 n;
2727
				ma=(uint32*)origdata;
2728
				mb=data;
2729
				for (n=0; n<count; n++)
2730
				{
2731
					if (tif->tif_flags&TIFF_SWAB)
2732
						TIFFSwabLong(ma);
2733
					maa=*(int32*)ma;
2734
					ma++;
2735
					if (tif->tif_flags&TIFF_SWAB)
2736
						TIFFSwabLong(ma);
2737
					mab=*ma++;
2738
					if (mab==0)
2739
						*mb++=0.0;
2740
					else
2741
						*mb++=(double)maa/(double)mab;
2742
				}
2743
			}
2744
			break;
2745
		case TIFF_FLOAT:
2746
			{
2747
				float* ma;
2748
				double* mb;
2749
				uint32 n;
2750
				if (tif->tif_flags&TIFF_SWAB)
2751
					TIFFSwabArrayOfLong((uint32*)origdata,count);  
2752
				TIFFCvtIEEEFloatToNative(tif,count,(float*)origdata);
2753
				ma=(float*)origdata;
2754
				mb=data;
2755
				for (n=0; n<count; n++)
2756
					*mb++=(double)(*ma++);
2757
			}
2758
			break;
2759
	}
2760
	_TIFFfree(origdata);
2761
	*value=data;
2762
	return(TIFFReadDirEntryErrOk);
2763
}
2764

2765
static enum TIFFReadDirEntryErr TIFFReadDirEntryIfd8Array(TIFF* tif, TIFFDirEntry* direntry, uint64** value)
2766
{
2767
	enum TIFFReadDirEntryErr err;
2768
	uint32 count;
2769
	void* origdata;
2770
	uint64* data;
2771
	switch (direntry->tdir_type)
2772
	{
2773
		case TIFF_LONG:
2774
		case TIFF_LONG8:
2775
		case TIFF_IFD:
2776
		case TIFF_IFD8:
2777
			break;
2778
		default:
2779
			return(TIFFReadDirEntryErrType);
2780
	}
2781
	err=TIFFReadDirEntryArray(tif,direntry,&count,8,&origdata);
2782
	if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
2783
	{
2784
		*value=0;
2785
		return(err);
2786
	}
2787
	switch (direntry->tdir_type)
2788
	{
2789
		case TIFF_LONG8:
2790
		case TIFF_IFD8:
2791
			*value=(uint64*)origdata;
2792
			if (tif->tif_flags&TIFF_SWAB)
2793
				TIFFSwabArrayOfLong8(*value,count);
2794
			return(TIFFReadDirEntryErrOk);
2795
	}
2796
	data=(uint64*)_TIFFmalloc(count*8);
2797
	if (data==0)
2798
	{
2799
		_TIFFfree(origdata);
2800
		return(TIFFReadDirEntryErrAlloc);
2801
	}
2802
	switch (direntry->tdir_type)
2803
	{
2804
		case TIFF_LONG:
2805
		case TIFF_IFD:
2806
			{
2807
				uint32* ma;
2808
				uint64* mb;
2809
				uint32 n;
2810
				ma=(uint32*)origdata;
2811
				mb=data;
2812
				for (n=0; n<count; n++)
2813
				{
2814
					if (tif->tif_flags&TIFF_SWAB)
2815
						TIFFSwabLong(ma);
2816
					*mb++=(uint64)(*ma++);
2817
				}
2818
			}
2819
			break;
2820
	}
2821
	_TIFFfree(origdata);
2822
	*value=data;
2823
	return(TIFFReadDirEntryErrOk);
2824
}
2825

2826
static enum TIFFReadDirEntryErr TIFFReadDirEntryPersampleShort(TIFF* tif, TIFFDirEntry* direntry, uint16* value)
2827
{
2828
	enum TIFFReadDirEntryErr err;
2829
	uint16* m;
2830
	uint16* na;
2831
	uint16 nb;
2832
	if (direntry->tdir_count<(uint64)tif->tif_dir.td_samplesperpixel)
2833
		return(TIFFReadDirEntryErrCount);
2834
	err=TIFFReadDirEntryShortArray(tif,direntry,&m);
2835
	if (err!=TIFFReadDirEntryErrOk || m == NULL)
2836
		return(err);
2837
	na=m;
2838
	nb=tif->tif_dir.td_samplesperpixel;
2839
	*value=*na++;
2840
	nb--;
2841
	while (nb>0)
2842
	{
2843
		if (*na++!=*value)
2844
		{
2845
			err=TIFFReadDirEntryErrPsdif;
2846
			break;
2847
		}
2848
		nb--;
2849
	}
2850
	_TIFFfree(m);
2851
	return(err);
2852
}
2853

2854
#if 0
2855
static enum TIFFReadDirEntryErr TIFFReadDirEntryPersampleDouble(TIFF* tif, TIFFDirEntry* direntry, double* value)
2856
{
2857
	enum TIFFReadDirEntryErr err;
2858
	double* m;
2859
	double* na;
2860
	uint16 nb;
2861
	if (direntry->tdir_count<(uint64)tif->tif_dir.td_samplesperpixel)
2862
		return(TIFFReadDirEntryErrCount);
2863
	err=TIFFReadDirEntryDoubleArray(tif,direntry,&m);
2864
	if (err!=TIFFReadDirEntryErrOk)
2865
		return(err);
2866
	na=m;
2867
	nb=tif->tif_dir.td_samplesperpixel;
2868
	*value=*na++;
2869
	nb--;
2870
	while (nb>0)
2871
	{
2872
		if (*na++!=*value)
2873
		{
2874
			err=TIFFReadDirEntryErrPsdif;
2875
			break;
2876
		}
2877
		nb--;
2878
	}
2879
	_TIFFfree(m);
2880
	return(err);
2881
}
2882
#endif
2883

2884
static void TIFFReadDirEntryCheckedByte(TIFF* tif, TIFFDirEntry* direntry, uint8* value)
2885
{
2886
	(void) tif;
2887
	*value=*(uint8*)(&direntry->tdir_offset);
2888
}
2889

2890
static void TIFFReadDirEntryCheckedSbyte(TIFF* tif, TIFFDirEntry* direntry, int8* value)
2891
{
2892
	(void) tif;
2893
	*value=*(int8*)(&direntry->tdir_offset);
2894
}
2895

2896
static void TIFFReadDirEntryCheckedShort(TIFF* tif, TIFFDirEntry* direntry, uint16* value)
2897
{
2898
	*value = direntry->tdir_offset.toff_short;
2899
	/* *value=*(uint16*)(&direntry->tdir_offset); */
2900
	if (tif->tif_flags&TIFF_SWAB)
2901
		TIFFSwabShort(value);
2902
}
2903

2904
static void TIFFReadDirEntryCheckedSshort(TIFF* tif, TIFFDirEntry* direntry, int16* value)
2905
{
2906
	*value=*(int16*)(&direntry->tdir_offset);
2907
	if (tif->tif_flags&TIFF_SWAB)
2908
		TIFFSwabShort((uint16*)value);
2909
}
2910

2911
static void TIFFReadDirEntryCheckedLong(TIFF* tif, TIFFDirEntry* direntry, uint32* value)
2912
{
2913
	*value=*(uint32*)(&direntry->tdir_offset);
2914
	if (tif->tif_flags&TIFF_SWAB)
2915
		TIFFSwabLong(value);
2916
}
2917

2918
static void TIFFReadDirEntryCheckedSlong(TIFF* tif, TIFFDirEntry* direntry, int32* value)
2919
{
2920
	*value=*(int32*)(&direntry->tdir_offset);
2921
	if (tif->tif_flags&TIFF_SWAB)
2922
		TIFFSwabLong((uint32*)value);
2923
}
2924

2925
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedLong8(TIFF* tif, TIFFDirEntry* direntry, uint64* value)
2926
{
2927
	if (!(tif->tif_flags&TIFF_BIGTIFF))
2928
	{
2929
		enum TIFFReadDirEntryErr err;
2930
		uint32 offset = direntry->tdir_offset.toff_long;
2931
		if (tif->tif_flags&TIFF_SWAB)
2932
			TIFFSwabLong(&offset);
2933
		err=TIFFReadDirEntryData(tif,offset,8,value);
2934
		if (err!=TIFFReadDirEntryErrOk)
2935
			return(err);
2936
	}
2937
	else
2938
		*value = direntry->tdir_offset.toff_long8;
2939
	if (tif->tif_flags&TIFF_SWAB)
2940
		TIFFSwabLong8(value);
2941
	return(TIFFReadDirEntryErrOk);
2942
}
2943

2944
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedSlong8(TIFF* tif, TIFFDirEntry* direntry, int64* value)
2945
{
2946
	if (!(tif->tif_flags&TIFF_BIGTIFF))
2947
	{
2948
		enum TIFFReadDirEntryErr err;
2949
		uint32 offset = direntry->tdir_offset.toff_long;
2950
		if (tif->tif_flags&TIFF_SWAB)
2951
			TIFFSwabLong(&offset);
2952
		err=TIFFReadDirEntryData(tif,offset,8,value);
2953
		if (err!=TIFFReadDirEntryErrOk)
2954
			return(err);
2955
	}
2956
	else
2957
		*value=*(int64*)(&direntry->tdir_offset);
2958
	if (tif->tif_flags&TIFF_SWAB)
2959
		TIFFSwabLong8((uint64*)value);
2960
	return(TIFFReadDirEntryErrOk);
2961
}
2962

2963
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedRational(TIFF* tif, TIFFDirEntry* direntry, double* value)
2964
{
2965
	UInt64Aligned_t m;
2966

2967
	assert(sizeof(double)==8);
2968
	assert(sizeof(uint64)==8);
2969
	assert(sizeof(uint32)==4);
2970
	if (!(tif->tif_flags&TIFF_BIGTIFF))
2971
	{
2972
		enum TIFFReadDirEntryErr err;
2973
		uint32 offset = direntry->tdir_offset.toff_long;
2974
		if (tif->tif_flags&TIFF_SWAB)
2975
			TIFFSwabLong(&offset);
2976
		err=TIFFReadDirEntryData(tif,offset,8,m.i);
2977
		if (err!=TIFFReadDirEntryErrOk)
2978
			return(err);
2979
	}
2980
	else
2981
		m.l = direntry->tdir_offset.toff_long8;
2982
	if (tif->tif_flags&TIFF_SWAB)
2983
		TIFFSwabArrayOfLong(m.i,2);
2984
        /* Not completely sure what we should do when m.i[1]==0, but some */
2985
        /* sanitizers do not like division by 0.0: */
2986
        /* http://bugzilla.maptools.org/show_bug.cgi?id=2644 */
2987
	if (m.i[0]==0 || m.i[1]==0)
2988
		*value=0.0;
2989
	else
2990
		*value=(double)m.i[0]/(double)m.i[1];
2991
	return(TIFFReadDirEntryErrOk);
2992
}
2993

2994
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedSrational(TIFF* tif, TIFFDirEntry* direntry, double* value)
2995
{
2996
	UInt64Aligned_t m;
2997
	assert(sizeof(double)==8);
2998
	assert(sizeof(uint64)==8);
2999
	assert(sizeof(int32)==4);
3000
	assert(sizeof(uint32)==4);
3001
	if (!(tif->tif_flags&TIFF_BIGTIFF))
3002
	{
3003
		enum TIFFReadDirEntryErr err;
3004
		uint32 offset = direntry->tdir_offset.toff_long;
3005
		if (tif->tif_flags&TIFF_SWAB)
3006
			TIFFSwabLong(&offset);
3007
		err=TIFFReadDirEntryData(tif,offset,8,m.i);
3008
		if (err!=TIFFReadDirEntryErrOk)
3009
			return(err);
3010
	}
3011
	else
3012
		m.l=direntry->tdir_offset.toff_long8;
3013
	if (tif->tif_flags&TIFF_SWAB)
3014
		TIFFSwabArrayOfLong(m.i,2);
3015
        /* Not completely sure what we should do when m.i[1]==0, but some */
3016
        /* sanitizers do not like division by 0.0: */
3017
        /* http://bugzilla.maptools.org/show_bug.cgi?id=2644 */
3018
	if ((int32)m.i[0]==0 || m.i[1]==0)
3019
		*value=0.0;
3020
	else
3021
		*value=(double)((int32)m.i[0])/(double)m.i[1];
3022
	return(TIFFReadDirEntryErrOk);
3023
}
3024

3025
static void TIFFReadDirEntryCheckedFloat(TIFF* tif, TIFFDirEntry* direntry, float* value)
3026
{
3027
         union
3028
	 {
3029
	   float  f;
3030
	   uint32 i;
3031
	 } float_union;
3032
	assert(sizeof(float)==4);
3033
	assert(sizeof(uint32)==4);
3034
	assert(sizeof(float_union)==4);
3035
	float_union.i=*(uint32*)(&direntry->tdir_offset);
3036
	*value=float_union.f;
3037
	if (tif->tif_flags&TIFF_SWAB)
3038
		TIFFSwabLong((uint32*)value);
3039
}
3040

3041
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedDouble(TIFF* tif, TIFFDirEntry* direntry, double* value)
3042
{
3043
	assert(sizeof(double)==8);
3044
	assert(sizeof(uint64)==8);
3045
	assert(sizeof(UInt64Aligned_t)==8);
3046
	if (!(tif->tif_flags&TIFF_BIGTIFF))
3047
	{
3048
		enum TIFFReadDirEntryErr err;
3049
		uint32 offset = direntry->tdir_offset.toff_long;
3050
		if (tif->tif_flags&TIFF_SWAB)
3051
			TIFFSwabLong(&offset);
3052
		err=TIFFReadDirEntryData(tif,offset,8,value);
3053
		if (err!=TIFFReadDirEntryErrOk)
3054
			return(err);
3055
	}
3056
	else
3057
	{
3058
	       UInt64Aligned_t uint64_union;
3059
	       uint64_union.l=direntry->tdir_offset.toff_long8;
3060
	       *value=uint64_union.d;
3061
	}
3062
	if (tif->tif_flags&TIFF_SWAB)
3063
		TIFFSwabLong8((uint64*)value);
3064
	return(TIFFReadDirEntryErrOk);
3065
}
3066

3067
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSbyte(int8 value)
3068
{
3069
	if (value<0)
3070
		return(TIFFReadDirEntryErrRange);
3071
	else
3072
		return(TIFFReadDirEntryErrOk);
3073
}
3074

3075
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteShort(uint16 value)
3076
{
3077
	if (value>0xFF)
3078
		return(TIFFReadDirEntryErrRange);
3079
	else
3080
		return(TIFFReadDirEntryErrOk);
3081
}
3082

3083
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSshort(int16 value)
3084
{
3085
	if ((value<0)||(value>0xFF))
3086
		return(TIFFReadDirEntryErrRange);
3087
	else
3088
		return(TIFFReadDirEntryErrOk);
3089
}
3090

3091
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteLong(uint32 value)
3092
{
3093
	if (value>0xFF)
3094
		return(TIFFReadDirEntryErrRange);
3095
	else
3096
		return(TIFFReadDirEntryErrOk);
3097
}
3098

3099
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSlong(int32 value)
3100
{
3101
	if ((value<0)||(value>0xFF))
3102
		return(TIFFReadDirEntryErrRange);
3103
	else
3104
		return(TIFFReadDirEntryErrOk);
3105
}
3106

3107
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteLong8(uint64 value)
3108
{
3109
	if (value>0xFF)
3110
		return(TIFFReadDirEntryErrRange);
3111
	else
3112
		return(TIFFReadDirEntryErrOk);
3113
}
3114

3115
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSlong8(int64 value)
3116
{
3117
	if ((value<0)||(value>0xFF))
3118
		return(TIFFReadDirEntryErrRange);
3119
	else
3120
		return(TIFFReadDirEntryErrOk);
3121
}
3122

3123
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteByte(uint8 value)
3124
{
3125
	if (value>0x7F)
3126
		return(TIFFReadDirEntryErrRange);
3127
	else
3128
		return(TIFFReadDirEntryErrOk);
3129
}
3130

3131
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteShort(uint16 value)
3132
{
3133
	if (value>0x7F)
3134
		return(TIFFReadDirEntryErrRange);
3135
	else
3136
		return(TIFFReadDirEntryErrOk);
3137
}
3138

3139
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteSshort(int16 value)
3140
{
3141
	if ((value<-0x80)||(value>0x7F))
3142
		return(TIFFReadDirEntryErrRange);
3143
	else
3144
		return(TIFFReadDirEntryErrOk);
3145
}
3146

3147
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteLong(uint32 value)
3148
{
3149
	if (value>0x7F)
3150
		return(TIFFReadDirEntryErrRange);
3151
	else
3152
		return(TIFFReadDirEntryErrOk);
3153
}
3154

3155
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteSlong(int32 value)
3156
{
3157
	if ((value<-0x80)||(value>0x7F))
3158
		return(TIFFReadDirEntryErrRange);
3159
	else
3160
		return(TIFFReadDirEntryErrOk);
3161
}
3162

3163
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteLong8(uint64 value)
3164
{
3165
	if (value>0x7F)
3166
		return(TIFFReadDirEntryErrRange);
3167
	else
3168
		return(TIFFReadDirEntryErrOk);
3169
}
3170

3171
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteSlong8(int64 value)
3172
{
3173
	if ((value<-0x80)||(value>0x7F))
3174
		return(TIFFReadDirEntryErrRange);
3175
	else
3176
		return(TIFFReadDirEntryErrOk);
3177
}
3178

3179
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSbyte(int8 value)
3180
{
3181
	if (value<0)
3182
		return(TIFFReadDirEntryErrRange);
3183
	else
3184
		return(TIFFReadDirEntryErrOk);
3185
}
3186

3187
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSshort(int16 value)
3188
{
3189
	if (value<0)
3190
		return(TIFFReadDirEntryErrRange);
3191
	else
3192
		return(TIFFReadDirEntryErrOk);
3193
}
3194

3195
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortLong(uint32 value)
3196
{
3197
	if (value>0xFFFF)
3198
		return(TIFFReadDirEntryErrRange);
3199
	else
3200
		return(TIFFReadDirEntryErrOk);
3201
}
3202

3203
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSlong(int32 value)
3204
{
3205
	if ((value<0)||(value>0xFFFF))
3206
		return(TIFFReadDirEntryErrRange);
3207
	else
3208
		return(TIFFReadDirEntryErrOk);
3209
}
3210

3211
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortLong8(uint64 value)
3212
{
3213
	if (value>0xFFFF)
3214
		return(TIFFReadDirEntryErrRange);
3215
	else
3216
		return(TIFFReadDirEntryErrOk);
3217
}
3218

3219
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSlong8(int64 value)
3220
{
3221
	if ((value<0)||(value>0xFFFF))
3222
		return(TIFFReadDirEntryErrRange);
3223
	else
3224
		return(TIFFReadDirEntryErrOk);
3225
}
3226

3227
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortShort(uint16 value)
3228
{
3229
	if (value>0x7FFF)
3230
		return(TIFFReadDirEntryErrRange);
3231
	else
3232
		return(TIFFReadDirEntryErrOk);
3233
}
3234

3235
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortLong(uint32 value)
3236
{
3237
	if (value>0x7FFF)
3238
		return(TIFFReadDirEntryErrRange);
3239
	else
3240
		return(TIFFReadDirEntryErrOk);
3241
}
3242

3243
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortSlong(int32 value)
3244
{
3245
	if ((value<-0x8000)||(value>0x7FFF))
3246
		return(TIFFReadDirEntryErrRange);
3247
	else
3248
		return(TIFFReadDirEntryErrOk);
3249
}
3250

3251
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortLong8(uint64 value)
3252
{
3253
	if (value>0x7FFF)
3254
		return(TIFFReadDirEntryErrRange);
3255
	else
3256
		return(TIFFReadDirEntryErrOk);
3257
}
3258

3259
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortSlong8(int64 value)
3260
{
3261
	if ((value<-0x8000)||(value>0x7FFF))
3262
		return(TIFFReadDirEntryErrRange);
3263
	else
3264
		return(TIFFReadDirEntryErrOk);
3265
}
3266

3267
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongSbyte(int8 value)
3268
{
3269
	if (value<0)
3270
		return(TIFFReadDirEntryErrRange);
3271
	else
3272
		return(TIFFReadDirEntryErrOk);
3273
}
3274

3275
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongSshort(int16 value)
3276
{
3277
	if (value<0)
3278
		return(TIFFReadDirEntryErrRange);
3279
	else
3280
		return(TIFFReadDirEntryErrOk);
3281
}
3282

3283
static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongSlong(int32 value)
3284
{
3285
	if (value<0)
3286
		return(TIFFReadDirEntryErrRange);
3287
	else
3288
		return(TIFFReadDirEntryErrOk);
3289
}
3290

3291
/*
3292
 * Largest 32-bit unsigned integer value.
3293
 */
3294
#define TIFF_UINT32_MAX 0xFFFFFFFFU
3295

3296
static enum TIFFReadDirEntryErr
3297
TIFFReadDirEntryCheckRangeLongLong8(uint64 value)
3298
{
3299
	if (value > TIFF_UINT32_MAX)
3300
		return(TIFFReadDirEntryErrRange);
3301
	else
3302
		return(TIFFReadDirEntryErrOk);
3303
}
3304

3305
static enum TIFFReadDirEntryErr
3306
TIFFReadDirEntryCheckRangeLongSlong8(int64 value)
3307
{
3308
	if ((value < 0) || (value > (int64) TIFF_UINT32_MAX))
3309
		return(TIFFReadDirEntryErrRange);
3310
	else
3311
		return(TIFFReadDirEntryErrOk);
3312
}
3313

3314
#undef TIFF_UINT32_MAX
3315

3316
static enum TIFFReadDirEntryErr
3317
TIFFReadDirEntryCheckRangeSlongLong(uint32 value)
3318
{
3319
	if (value > 0x7FFFFFFFUL)
3320
		return(TIFFReadDirEntryErrRange);
3321
	else
3322
		return(TIFFReadDirEntryErrOk);
3323
}
3324

3325
/* Check that the 8-byte unsigned value can fit in a 4-byte unsigned range */
3326
static enum TIFFReadDirEntryErr
3327
TIFFReadDirEntryCheckRangeSlongLong8(uint64 value)
3328
{
3329
	if (value > 0x7FFFFFFF)
3330
		return(TIFFReadDirEntryErrRange);
3331
	else
3332
		return(TIFFReadDirEntryErrOk);
3333
}
3334

3335
/* Check that the 8-byte signed value can fit in a 4-byte signed range */
3336
static enum TIFFReadDirEntryErr
3337
TIFFReadDirEntryCheckRangeSlongSlong8(int64 value)
3338
{
3339
        if ((value < 0-((int64) 0x7FFFFFFF+1)) || (value > 0x7FFFFFFF))
3340
		return(TIFFReadDirEntryErrRange);
3341
	else
3342
		return(TIFFReadDirEntryErrOk);
3343
}
3344

3345
static enum TIFFReadDirEntryErr
3346
TIFFReadDirEntryCheckRangeLong8Sbyte(int8 value)
3347
{
3348
	if (value < 0)
3349
		return(TIFFReadDirEntryErrRange);
3350
	else
3351
		return(TIFFReadDirEntryErrOk);
3352
}
3353

3354
static enum TIFFReadDirEntryErr
3355
TIFFReadDirEntryCheckRangeLong8Sshort(int16 value)
3356
{
3357
	if (value < 0)
3358
		return(TIFFReadDirEntryErrRange);
3359
	else
3360
		return(TIFFReadDirEntryErrOk);
3361
}
3362

3363
static enum TIFFReadDirEntryErr
3364
TIFFReadDirEntryCheckRangeLong8Slong(int32 value)
3365
{
3366
	if (value < 0)
3367
		return(TIFFReadDirEntryErrRange);
3368
	else
3369
		return(TIFFReadDirEntryErrOk);
3370
}
3371

3372
static enum TIFFReadDirEntryErr
3373
TIFFReadDirEntryCheckRangeLong8Slong8(int64 value)
3374
{
3375
	if (value < 0)
3376
		return(TIFFReadDirEntryErrRange);
3377
	else
3378
		return(TIFFReadDirEntryErrOk);
3379
}
3380

3381
/*
3382
 * Largest 64-bit signed integer value.
3383
 */
3384
#define TIFF_INT64_MAX ((int64)(((uint64) ~0) >> 1))
3385

3386
static enum TIFFReadDirEntryErr
3387
TIFFReadDirEntryCheckRangeSlong8Long8(uint64 value)
3388
{
3389
	if (value > TIFF_INT64_MAX)
3390
		return(TIFFReadDirEntryErrRange);
3391
	else
3392
		return(TIFFReadDirEntryErrOk);
3393
}
3394

3395
#undef TIFF_INT64_MAX
3396

3397
static enum TIFFReadDirEntryErr
3398
TIFFReadDirEntryData(TIFF* tif, uint64 offset, tmsize_t size, void* dest)
3399
{
3400
	assert(size>0);
3401
	if (!isMapped(tif)) {
3402
		if (!SeekOK(tif,offset))
3403
			return(TIFFReadDirEntryErrIo);
3404
		if (!ReadOK(tif,dest,size))
3405
			return(TIFFReadDirEntryErrIo);
3406
	} else {
3407
		size_t ma,mb;
3408
		ma=(size_t)offset;
3409
		mb=ma+size;
3410
		if (((uint64)ma!=offset)
3411
		    || (mb < ma)
3412
		    || (mb - ma != (size_t) size)
3413
		    || (mb < (size_t)size)
3414
		    || (mb > (size_t)tif->tif_size)
3415
		    )
3416
			return(TIFFReadDirEntryErrIo);
3417
		_TIFFmemcpy(dest,tif->tif_base+ma,size);
3418
	}
3419
	return(TIFFReadDirEntryErrOk);
3420
}
3421

3422
static void TIFFReadDirEntryOutputErr(TIFF* tif, enum TIFFReadDirEntryErr err, const char* module, const char* tagname, int recover)
3423
{
3424
	if (!recover) {
3425
		switch (err) {
3426
			case TIFFReadDirEntryErrCount:
3427
				TIFFErrorExt(tif->tif_clientdata, module,
3428
					     "Incorrect count for \"%s\"",
3429
					     tagname);
3430
				break;
3431
			case TIFFReadDirEntryErrType:
3432
				TIFFErrorExt(tif->tif_clientdata, module,
3433
					     "Incompatible type for \"%s\"",
3434
					     tagname);
3435
				break;
3436
			case TIFFReadDirEntryErrIo:
3437
				TIFFErrorExt(tif->tif_clientdata, module,
3438
					     "IO error during reading of \"%s\"",
3439
					     tagname);
3440
				break;
3441
			case TIFFReadDirEntryErrRange:
3442
				TIFFErrorExt(tif->tif_clientdata, module,
3443
					     "Incorrect value for \"%s\"",
3444
					     tagname);
3445
				break;
3446
			case TIFFReadDirEntryErrPsdif:
3447
				TIFFErrorExt(tif->tif_clientdata, module,
3448
			"Cannot handle different values per sample for \"%s\"",
3449
					     tagname);
3450
				break;
3451
			case TIFFReadDirEntryErrSizesan:
3452
				TIFFErrorExt(tif->tif_clientdata, module,
3453
				"Sanity check on size of \"%s\" value failed",
3454
					     tagname);
3455
				break;
3456
			case TIFFReadDirEntryErrAlloc:
3457
				TIFFErrorExt(tif->tif_clientdata, module,
3458
					     "Out of memory reading of \"%s\"",
3459
					     tagname);
3460
				break;
3461
			default:
3462
				assert(0);   /* we should never get here */
3463
				break;
3464
		}
3465
	} else {
3466
		switch (err) {
3467
			case TIFFReadDirEntryErrCount:
3468
				TIFFWarningExt(tif->tif_clientdata, module,
3469
				"Incorrect count for \"%s\"; tag ignored",
3470
					     tagname);
3471
				break;
3472
			case TIFFReadDirEntryErrType:
3473
				TIFFWarningExt(tif->tif_clientdata, module,
3474
				"Incompatible type for \"%s\"; tag ignored",
3475
					       tagname);
3476
				break;
3477
			case TIFFReadDirEntryErrIo:
3478
				TIFFWarningExt(tif->tif_clientdata, module,
3479
			"IO error during reading of \"%s\"; tag ignored",
3480
					       tagname);
3481
				break;
3482
			case TIFFReadDirEntryErrRange:
3483
				TIFFWarningExt(tif->tif_clientdata, module,
3484
				"Incorrect value for \"%s\"; tag ignored",
3485
					       tagname);
3486
				break;
3487
			case TIFFReadDirEntryErrPsdif:
3488
				TIFFWarningExt(tif->tif_clientdata, module,
3489
	"Cannot handle different values per sample for \"%s\"; tag ignored",
3490
					       tagname);
3491
				break;
3492
			case TIFFReadDirEntryErrSizesan:
3493
				TIFFWarningExt(tif->tif_clientdata, module,
3494
		"Sanity check on size of \"%s\" value failed; tag ignored",
3495
					       tagname);
3496
				break;
3497
			case TIFFReadDirEntryErrAlloc:
3498
				TIFFWarningExt(tif->tif_clientdata, module,
3499
				"Out of memory reading of \"%s\"; tag ignored",
3500
					       tagname);
3501
				break;
3502
			default:
3503
				assert(0);   /* we should never get here */
3504
				break;
3505
		}
3506
	}
3507
}
3508

3509
/*
3510
 * Read the next TIFF directory from a file and convert it to the internal
3511
 * format. We read directories sequentially.
3512
 */
3513
int
3514
TIFFReadDirectory(TIFF* tif)
3515
{
3516
	static const char module[] = "TIFFReadDirectory";
3517
	TIFFDirEntry* dir;
3518
	uint16 dircount;
3519
	TIFFDirEntry* dp;
3520
	uint16 di;
3521
	const TIFFField* fip;
3522
	uint32 fii=FAILED_FII;
3523
        toff_t nextdiroff;
3524
    int bitspersample_read = FALSE;
3525

3526
	tif->tif_diroff=tif->tif_nextdiroff;
3527
	if (!TIFFCheckDirOffset(tif,tif->tif_nextdiroff))
3528
		return 0;           /* last offset or bad offset (IFD looping) */
3529
	(*tif->tif_cleanup)(tif);   /* cleanup any previous compression state */
3530
	tif->tif_curdir++;
3531
        nextdiroff = tif->tif_nextdiroff;
3532
	dircount=TIFFFetchDirectory(tif,nextdiroff,&dir,&tif->tif_nextdiroff);
3533
	if (!dircount)
3534
	{
3535
		TIFFErrorExt(tif->tif_clientdata,module,
3536
		    "Failed to read directory at offset " TIFF_UINT64_FORMAT,nextdiroff);
3537
		return 0;
3538
	}
3539
	TIFFReadDirectoryCheckOrder(tif,dir,dircount);
3540

3541
        /*
3542
         * Mark duplicates of any tag to be ignored (bugzilla 1994)
3543
         * to avoid certain pathological problems.
3544
         */
3545
	{
3546
		TIFFDirEntry* ma;
3547
		uint16 mb;
3548
		for (ma=dir, mb=0; mb<dircount; ma++, mb++)
3549
		{
3550
			TIFFDirEntry* na;
3551
			uint16 nb;
3552
			for (na=ma+1, nb=mb+1; nb<dircount; na++, nb++)
3553
			{
3554
				if (ma->tdir_tag==na->tdir_tag)
3555
					na->tdir_tag=IGNORE;
3556
			}
3557
		}
3558
	}
3559
        
3560
	tif->tif_flags &= ~TIFF_BEENWRITING;    /* reset before new dir */
3561
	tif->tif_flags &= ~TIFF_BUF4WRITE;      /* reset before new dir */
3562
	/* free any old stuff and reinit */
3563
	TIFFFreeDirectory(tif);
3564
	TIFFDefaultDirectory(tif);
3565
	/*
3566
	 * Electronic Arts writes gray-scale TIFF files
3567
	 * without a PlanarConfiguration directory entry.
3568
	 * Thus we setup a default value here, even though
3569
	 * the TIFF spec says there is no default value.
3570
	 */
3571
	TIFFSetField(tif,TIFFTAG_PLANARCONFIG,PLANARCONFIG_CONTIG);
3572
	/*
3573
	 * Setup default value and then make a pass over
3574
	 * the fields to check type and tag information,
3575
	 * and to extract info required to size data
3576
	 * structures.  A second pass is made afterwards
3577
	 * to read in everything not taken in the first pass.
3578
	 * But we must process the Compression tag first
3579
	 * in order to merge in codec-private tag definitions (otherwise
3580
	 * we may get complaints about unknown tags).  However, the
3581
	 * Compression tag may be dependent on the SamplesPerPixel
3582
	 * tag value because older TIFF specs permitted Compression
3583
	 * to be written as a SamplesPerPixel-count tag entry.
3584
	 * Thus if we don't first figure out the correct SamplesPerPixel
3585
	 * tag value then we may end up ignoring the Compression tag
3586
	 * value because it has an incorrect count value (if the
3587
	 * true value of SamplesPerPixel is not 1).
3588
	 */
3589
	dp=TIFFReadDirectoryFindEntry(tif,dir,dircount,TIFFTAG_SAMPLESPERPIXEL);
3590
	if (dp)
3591
	{
3592
		if (!TIFFFetchNormalTag(tif,dp,0))
3593
			goto bad;
3594
		dp->tdir_tag=IGNORE;
3595
	}
3596
	dp=TIFFReadDirectoryFindEntry(tif,dir,dircount,TIFFTAG_COMPRESSION);
3597
	if (dp)
3598
	{
3599
		/*
3600
		 * The 5.0 spec says the Compression tag has one value, while
3601
		 * earlier specs say it has one value per sample.  Because of
3602
		 * this, we accept the tag if one value is supplied with either
3603
		 * count.
3604
		 */
3605
		uint16 value;
3606
		enum TIFFReadDirEntryErr err;
3607
		err=TIFFReadDirEntryShort(tif,dp,&value);
3608
		if (err==TIFFReadDirEntryErrCount)
3609
			err=TIFFReadDirEntryPersampleShort(tif,dp,&value);
3610
		if (err!=TIFFReadDirEntryErrOk)
3611
		{
3612
			TIFFReadDirEntryOutputErr(tif,err,module,"Compression",0);
3613
			goto bad;
3614
		}
3615
		if (!TIFFSetField(tif,TIFFTAG_COMPRESSION,value))
3616
			goto bad;
3617
		dp->tdir_tag=IGNORE;
3618
	}
3619
	else
3620
	{
3621
		if (!TIFFSetField(tif,TIFFTAG_COMPRESSION,COMPRESSION_NONE))
3622
			goto bad;
3623
	}
3624
	/*
3625
	 * First real pass over the directory.
3626
	 */
3627
	for (di=0, dp=dir; di<dircount; di++, dp++)
3628
	{
3629
		if (dp->tdir_tag!=IGNORE)
3630
		{
3631
			TIFFReadDirectoryFindFieldInfo(tif,dp->tdir_tag,&fii);
3632
			if (fii == FAILED_FII)
3633
			{
3634
				TIFFWarningExt(tif->tif_clientdata, module,
3635
				    "Unknown field with tag %d (0x%x) encountered",
3636
				    dp->tdir_tag,dp->tdir_tag);
3637
                                /* the following knowingly leaks the 
3638
                                   anonymous field structure */
3639
				if (!_TIFFMergeFields(tif,
3640
					_TIFFCreateAnonField(tif,
3641
						dp->tdir_tag,
3642
						(TIFFDataType) dp->tdir_type),
3643
					1)) {
3644
					TIFFWarningExt(tif->tif_clientdata,
3645
					    module,
3646
					    "Registering anonymous field with tag %d (0x%x) failed",
3647
					    dp->tdir_tag,
3648
					    dp->tdir_tag);
3649
					dp->tdir_tag=IGNORE;
3650
				} else {
3651
					TIFFReadDirectoryFindFieldInfo(tif,dp->tdir_tag,&fii);
3652
					assert(fii != FAILED_FII);
3653
				}
3654
			}
3655
		}
3656
		if (dp->tdir_tag!=IGNORE)
3657
		{
3658
			fip=tif->tif_fields[fii];
3659
			if (fip->field_bit==FIELD_IGNORE)
3660
				dp->tdir_tag=IGNORE;
3661
			else
3662
			{
3663
				switch (dp->tdir_tag)
3664
				{
3665
					case TIFFTAG_STRIPOFFSETS:
3666
					case TIFFTAG_STRIPBYTECOUNTS:
3667
					case TIFFTAG_TILEOFFSETS:
3668
					case TIFFTAG_TILEBYTECOUNTS:
3669
						TIFFSetFieldBit(tif,fip->field_bit);
3670
						break;
3671
					case TIFFTAG_IMAGEWIDTH:
3672
					case TIFFTAG_IMAGELENGTH:
3673
					case TIFFTAG_IMAGEDEPTH:
3674
					case TIFFTAG_TILELENGTH:
3675
					case TIFFTAG_TILEWIDTH:
3676
					case TIFFTAG_TILEDEPTH:
3677
					case TIFFTAG_PLANARCONFIG:
3678
					case TIFFTAG_ROWSPERSTRIP:
3679
					case TIFFTAG_EXTRASAMPLES:
3680
						if (!TIFFFetchNormalTag(tif,dp,0))
3681
							goto bad;
3682
						dp->tdir_tag=IGNORE;
3683
						break;
3684
                                        default:
3685
                                            if( !_TIFFCheckFieldIsValidForCodec(tif, dp->tdir_tag) )
3686
                                                dp->tdir_tag=IGNORE;
3687
                                            break;
3688
				}
3689
			}
3690
		}
3691
	}
3692
	/*
3693
	 * XXX: OJPEG hack.
3694
	 * If a) compression is OJPEG, b) planarconfig tag says it's separate,
3695
	 * c) strip offsets/bytecounts tag are both present and
3696
	 * d) both contain exactly one value, then we consistently find
3697
	 * that the buggy implementation of the buggy compression scheme
3698
	 * matches contig planarconfig best. So we 'fix-up' the tag here
3699
	 */
3700
	if ((tif->tif_dir.td_compression==COMPRESSION_OJPEG)&&
3701
	    (tif->tif_dir.td_planarconfig==PLANARCONFIG_SEPARATE))
3702
	{
3703
        if (!_TIFFFillStriles(tif))
3704
            goto bad;
3705
		dp=TIFFReadDirectoryFindEntry(tif,dir,dircount,TIFFTAG_STRIPOFFSETS);
3706
		if ((dp!=0)&&(dp->tdir_count==1))
3707
		{
3708
			dp=TIFFReadDirectoryFindEntry(tif,dir,dircount,
3709
			    TIFFTAG_STRIPBYTECOUNTS);
3710
			if ((dp!=0)&&(dp->tdir_count==1))
3711
			{
3712
				tif->tif_dir.td_planarconfig=PLANARCONFIG_CONTIG;
3713
				TIFFWarningExt(tif->tif_clientdata,module,
3714
				    "Planarconfig tag value assumed incorrect, "
3715
				    "assuming data is contig instead of chunky");
3716
			}
3717
		}
3718
	}
3719
	/*
3720
	 * Allocate directory structure and setup defaults.
3721
	 */
3722
	if (!TIFFFieldSet(tif,FIELD_IMAGEDIMENSIONS))
3723
	{
3724
		MissingRequired(tif,"ImageLength");
3725
		goto bad;
3726
	}
3727
	/*
3728
	 * Setup appropriate structures (by strip or by tile)
3729
	 */
3730
	if (!TIFFFieldSet(tif, FIELD_TILEDIMENSIONS)) {
3731
		tif->tif_dir.td_nstrips = TIFFNumberOfStrips(tif);  
3732
		tif->tif_dir.td_tilewidth = tif->tif_dir.td_imagewidth;
3733
		tif->tif_dir.td_tilelength = tif->tif_dir.td_rowsperstrip;
3734
		tif->tif_dir.td_tiledepth = tif->tif_dir.td_imagedepth;
3735
		tif->tif_flags &= ~TIFF_ISTILED;
3736
	} else {
3737
		tif->tif_dir.td_nstrips = TIFFNumberOfTiles(tif);
3738
		tif->tif_flags |= TIFF_ISTILED;
3739
	}
3740
	if (!tif->tif_dir.td_nstrips) {
3741
		TIFFErrorExt(tif->tif_clientdata, module,
3742
		    "Cannot handle zero number of %s",
3743
		    isTiled(tif) ? "tiles" : "strips");
3744
		goto bad;
3745
	}
3746
	tif->tif_dir.td_stripsperimage = tif->tif_dir.td_nstrips;
3747
	if (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE)
3748
		tif->tif_dir.td_stripsperimage /= tif->tif_dir.td_samplesperpixel;
3749
	if (!TIFFFieldSet(tif, FIELD_STRIPOFFSETS)) {
3750
#ifdef OJPEG_SUPPORT
3751
		if ((tif->tif_dir.td_compression==COMPRESSION_OJPEG) &&
3752
		    (isTiled(tif)==0) &&
3753
		    (tif->tif_dir.td_nstrips==1)) {
3754
			/*
3755
			 * XXX: OJPEG hack.
3756
			 * If a) compression is OJPEG, b) it's not a tiled TIFF,
3757
			 * and c) the number of strips is 1,
3758
			 * then we tolerate the absence of stripoffsets tag,
3759
			 * because, presumably, all required data is in the
3760
			 * JpegInterchangeFormat stream.
3761
			 */
3762
			TIFFSetFieldBit(tif, FIELD_STRIPOFFSETS);
3763
		} else
3764
#endif
3765
        {
3766
			MissingRequired(tif,
3767
				isTiled(tif) ? "TileOffsets" : "StripOffsets");
3768
			goto bad;
3769
		}
3770
	}
3771
	/*
3772
	 * Second pass: extract other information.
3773
	 */
3774
	for (di=0, dp=dir; di<dircount; di++, dp++)
3775
	{
3776
		switch (dp->tdir_tag)
3777
		{
3778
			case IGNORE:
3779
				break;
3780
			case TIFFTAG_MINSAMPLEVALUE:
3781
			case TIFFTAG_MAXSAMPLEVALUE:
3782
			case TIFFTAG_BITSPERSAMPLE:
3783
			case TIFFTAG_DATATYPE:
3784
			case TIFFTAG_SAMPLEFORMAT:
3785
				/*
3786
				 * The MinSampleValue, MaxSampleValue, BitsPerSample
3787
				 * DataType and SampleFormat tags are supposed to be
3788
				 * written as one value/sample, but some vendors
3789
				 * incorrectly write one value only -- so we accept
3790
				 * that as well (yuck). Other vendors write correct
3791
				 * value for NumberOfSamples, but incorrect one for
3792
				 * BitsPerSample and friends, and we will read this
3793
				 * too.
3794
				 */
3795
				{
3796
					uint16 value;
3797
					enum TIFFReadDirEntryErr err;
3798
					err=TIFFReadDirEntryShort(tif,dp,&value);
3799
					if (err==TIFFReadDirEntryErrCount)
3800
						err=TIFFReadDirEntryPersampleShort(tif,dp,&value);
3801
					if (err!=TIFFReadDirEntryErrOk)
3802
					{
3803
						fip = TIFFFieldWithTag(tif,dp->tdir_tag);
3804
						TIFFReadDirEntryOutputErr(tif,err,module,fip ? fip->field_name : "unknown tagname",0);
3805
						goto bad;
3806
					}
3807
					if (!TIFFSetField(tif,dp->tdir_tag,value))
3808
						goto bad;
3809
                    if( dp->tdir_tag == TIFFTAG_BITSPERSAMPLE )
3810
                        bitspersample_read = TRUE;
3811
				}
3812
				break;
3813
			case TIFFTAG_SMINSAMPLEVALUE:
3814
			case TIFFTAG_SMAXSAMPLEVALUE:
3815
				{
3816

3817
					double *data = NULL;
3818
					enum TIFFReadDirEntryErr err;
3819
					uint32 saved_flags;
3820
					int m;
3821
					if (dp->tdir_count != (uint64)tif->tif_dir.td_samplesperpixel)
3822
						err = TIFFReadDirEntryErrCount;
3823
					else
3824
						err = TIFFReadDirEntryDoubleArray(tif, dp, &data);
3825
					if (err!=TIFFReadDirEntryErrOk)
3826
					{
3827
						fip = TIFFFieldWithTag(tif,dp->tdir_tag);
3828
						TIFFReadDirEntryOutputErr(tif,err,module,fip ? fip->field_name : "unknown tagname",0);
3829
						goto bad;
3830
					}
3831
					saved_flags = tif->tif_flags;
3832
					tif->tif_flags |= TIFF_PERSAMPLE;
3833
					m = TIFFSetField(tif,dp->tdir_tag,data);
3834
					tif->tif_flags = saved_flags;
3835
					_TIFFfree(data);
3836
					if (!m)
3837
						goto bad;
3838
				}
3839
				break;
3840
			case TIFFTAG_STRIPOFFSETS:
3841
			case TIFFTAG_TILEOFFSETS:
3842
#if defined(DEFER_STRILE_LOAD)
3843
                                _TIFFmemcpy( &(tif->tif_dir.td_stripoffset_entry),
3844
                                             dp, sizeof(TIFFDirEntry) );
3845
#else                          
3846
                                if( tif->tif_dir.td_stripoffset != NULL )
3847
                                {
3848
                                    TIFFErrorExt(tif->tif_clientdata, module,
3849
                                        "tif->tif_dir.td_stripoffset is "
3850
                                        "already allocated. Likely duplicated "
3851
                                        "StripOffsets/TileOffsets tag");
3852
                                    goto bad;
3853
                                }
3854
				if (!TIFFFetchStripThing(tif,dp,tif->tif_dir.td_nstrips,&tif->tif_dir.td_stripoffset))  
3855
					goto bad;
3856
#endif                                
3857
				break;
3858
			case TIFFTAG_STRIPBYTECOUNTS:
3859
			case TIFFTAG_TILEBYTECOUNTS:
3860
#if defined(DEFER_STRILE_LOAD)
3861
                                _TIFFmemcpy( &(tif->tif_dir.td_stripbytecount_entry),
3862
                                             dp, sizeof(TIFFDirEntry) );
3863
#else                          
3864
                                if( tif->tif_dir.td_stripbytecount != NULL )
3865
                                {
3866
                                    TIFFErrorExt(tif->tif_clientdata, module,
3867
                                        "tif->tif_dir.td_stripbytecount is "
3868
                                        "already allocated. Likely duplicated "
3869
                                        "StripByteCounts/TileByteCounts tag");
3870
                                    goto bad;
3871
                                }
3872
                                if (!TIFFFetchStripThing(tif,dp,tif->tif_dir.td_nstrips,&tif->tif_dir.td_stripbytecount))  
3873
					goto bad;
3874
#endif                                
3875
				break;
3876
			case TIFFTAG_COLORMAP:
3877
			case TIFFTAG_TRANSFERFUNCTION:
3878
				{
3879
					enum TIFFReadDirEntryErr err;
3880
					uint32 countpersample;
3881
					uint32 countrequired;
3882
					uint32 incrementpersample;
3883
					uint16* value=NULL;
3884
                    /* It would be dangerous to instantiate those tag values */
3885
                    /* since if td_bitspersample has not yet been read (due to */
3886
                    /* unordered tags), it could be read afterwards with a */
3887
                    /* values greater than the default one (1), which may cause */
3888
                    /* crashes in user code */
3889
                    if( !bitspersample_read )
3890
                    {
3891
                        fip = TIFFFieldWithTag(tif,dp->tdir_tag);
3892
                        TIFFWarningExt(tif->tif_clientdata,module,
3893
                                       "Ignoring %s since BitsPerSample tag not found",
3894
                                       fip ? fip->field_name : "unknown tagname");
3895
                        continue;
3896
                    }
3897
					/* ColorMap or TransferFunction for high bit */
3898
					/* depths do not make much sense and could be */
3899
					/* used as a denial of service vector */
3900
					if (tif->tif_dir.td_bitspersample > 24)
3901
					{
3902
					    fip = TIFFFieldWithTag(tif,dp->tdir_tag);
3903
					    TIFFWarningExt(tif->tif_clientdata,module,
3904
						"Ignoring %s because BitsPerSample=%d>24",
3905
						fip ? fip->field_name : "unknown tagname",
3906
						tif->tif_dir.td_bitspersample);
3907
					    continue;
3908
					}
3909
					countpersample=(1U<<tif->tif_dir.td_bitspersample);
3910
					if ((dp->tdir_tag==TIFFTAG_TRANSFERFUNCTION)&&(dp->tdir_count==(uint64)countpersample))
3911
					{
3912
						countrequired=countpersample;
3913
						incrementpersample=0;
3914
					}
3915
					else
3916
					{
3917
						countrequired=3*countpersample;
3918
						incrementpersample=countpersample;
3919
					}
3920
					if (dp->tdir_count!=(uint64)countrequired)
3921
						err=TIFFReadDirEntryErrCount;
3922
					else
3923
						err=TIFFReadDirEntryShortArray(tif,dp,&value);
3924
					if (err!=TIFFReadDirEntryErrOk)
3925
                    {
3926
						fip = TIFFFieldWithTag(tif,dp->tdir_tag);
3927
						TIFFReadDirEntryOutputErr(tif,err,module,fip ? fip->field_name : "unknown tagname",1);
3928
                    }
3929
					else
3930
					{
3931
						TIFFSetField(tif,dp->tdir_tag,value,value+incrementpersample,value+2*incrementpersample);
3932
						_TIFFfree(value);
3933
					}
3934
				}
3935
				break;
3936
/* BEGIN REV 4.0 COMPATIBILITY */
3937
			case TIFFTAG_OSUBFILETYPE:
3938
				{
3939
					uint16 valueo;
3940
					uint32 value;
3941
					if (TIFFReadDirEntryShort(tif,dp,&valueo)==TIFFReadDirEntryErrOk)
3942
					{
3943
						switch (valueo)
3944
						{
3945
							case OFILETYPE_REDUCEDIMAGE: value=FILETYPE_REDUCEDIMAGE; break;
3946
							case OFILETYPE_PAGE: value=FILETYPE_PAGE; break;
3947
							default: value=0; break;
3948
						}
3949
						if (value!=0)
3950
							TIFFSetField(tif,TIFFTAG_SUBFILETYPE,value);
3951
					}
3952
				}
3953
				break;
3954
/* END REV 4.0 COMPATIBILITY */
3955
			default:
3956
				(void) TIFFFetchNormalTag(tif, dp, TRUE);
3957
				break;
3958
		}
3959
	}
3960
	/*
3961
	 * OJPEG hack:
3962
	 * - If a) compression is OJPEG, and b) photometric tag is missing,
3963
	 * then we consistently find that photometric should be YCbCr
3964
	 * - If a) compression is OJPEG, and b) photometric tag says it's RGB,
3965
	 * then we consistently find that the buggy implementation of the
3966
	 * buggy compression scheme matches photometric YCbCr instead.
3967
	 * - If a) compression is OJPEG, and b) bitspersample tag is missing,
3968
	 * then we consistently find bitspersample should be 8.
3969
	 * - If a) compression is OJPEG, b) samplesperpixel tag is missing,
3970
	 * and c) photometric is RGB or YCbCr, then we consistently find
3971
	 * samplesperpixel should be 3
3972
	 * - If a) compression is OJPEG, b) samplesperpixel tag is missing,
3973
	 * and c) photometric is MINISWHITE or MINISBLACK, then we consistently
3974
	 * find samplesperpixel should be 3
3975
	 */
3976
	if (tif->tif_dir.td_compression==COMPRESSION_OJPEG)
3977
	{
3978
		if (!TIFFFieldSet(tif,FIELD_PHOTOMETRIC))
3979
		{
3980
			TIFFWarningExt(tif->tif_clientdata, module,
3981
			    "Photometric tag is missing, assuming data is YCbCr");
3982
			if (!TIFFSetField(tif,TIFFTAG_PHOTOMETRIC,PHOTOMETRIC_YCBCR))
3983
				goto bad;
3984
		}
3985
		else if (tif->tif_dir.td_photometric==PHOTOMETRIC_RGB)
3986
		{
3987
			tif->tif_dir.td_photometric=PHOTOMETRIC_YCBCR;
3988
			TIFFWarningExt(tif->tif_clientdata, module,
3989
			    "Photometric tag value assumed incorrect, "
3990
			    "assuming data is YCbCr instead of RGB");
3991
		}
3992
		if (!TIFFFieldSet(tif,FIELD_BITSPERSAMPLE))
3993
		{
3994
			TIFFWarningExt(tif->tif_clientdata,module,
3995
			    "BitsPerSample tag is missing, assuming 8 bits per sample");
3996
			if (!TIFFSetField(tif,TIFFTAG_BITSPERSAMPLE,8))
3997
				goto bad;
3998
		}
3999
		if (!TIFFFieldSet(tif,FIELD_SAMPLESPERPIXEL))
4000
		{
4001
			if (tif->tif_dir.td_photometric==PHOTOMETRIC_RGB)
4002
			{
4003
				TIFFWarningExt(tif->tif_clientdata,module,
4004
				    "SamplesPerPixel tag is missing, "
4005
				    "assuming correct SamplesPerPixel value is 3");
4006
				if (!TIFFSetField(tif,TIFFTAG_SAMPLESPERPIXEL,3))
4007
					goto bad;
4008
			}
4009
			if (tif->tif_dir.td_photometric==PHOTOMETRIC_YCBCR)
4010
			{
4011
				TIFFWarningExt(tif->tif_clientdata,module,
4012
				    "SamplesPerPixel tag is missing, "
4013
				    "applying correct SamplesPerPixel value of 3");
4014
				if (!TIFFSetField(tif,TIFFTAG_SAMPLESPERPIXEL,3))
4015
					goto bad;
4016
			}
4017
			else if ((tif->tif_dir.td_photometric==PHOTOMETRIC_MINISWHITE)
4018
				 || (tif->tif_dir.td_photometric==PHOTOMETRIC_MINISBLACK))
4019
			{
4020
				/*
4021
				 * SamplesPerPixel tag is missing, but is not required
4022
				 * by spec.  Assume correct SamplesPerPixel value of 1.
4023
				 */
4024
				if (!TIFFSetField(tif,TIFFTAG_SAMPLESPERPIXEL,1))
4025
					goto bad;
4026
			}
4027
		}
4028
	}
4029
	/*
4030
	 * Verify Palette image has a Colormap.
4031
	 */
4032
	if (tif->tif_dir.td_photometric == PHOTOMETRIC_PALETTE &&
4033
	    !TIFFFieldSet(tif, FIELD_COLORMAP)) {
4034
		if ( tif->tif_dir.td_bitspersample>=8 && tif->tif_dir.td_samplesperpixel==3)
4035
			tif->tif_dir.td_photometric = PHOTOMETRIC_RGB;
4036
		else if (tif->tif_dir.td_bitspersample>=8)
4037
			tif->tif_dir.td_photometric = PHOTOMETRIC_MINISBLACK;
4038
		else {
4039
			MissingRequired(tif, "Colormap");
4040
			goto bad;
4041
		}
4042
	}
4043
	/*
4044
	 * OJPEG hack:
4045
	 * We do no further messing with strip/tile offsets/bytecounts in OJPEG
4046
	 * TIFFs
4047
	 */
4048
	if (tif->tif_dir.td_compression!=COMPRESSION_OJPEG)
4049
	{
4050
		/*
4051
		 * Attempt to deal with a missing StripByteCounts tag.
4052
		 */
4053
		if (!TIFFFieldSet(tif, FIELD_STRIPBYTECOUNTS)) {
4054
			/*
4055
			 * Some manufacturers violate the spec by not giving
4056
			 * the size of the strips.  In this case, assume there
4057
			 * is one uncompressed strip of data.
4058
			 */
4059
			if ((tif->tif_dir.td_planarconfig == PLANARCONFIG_CONTIG &&
4060
			    tif->tif_dir.td_nstrips > 1) ||
4061
			    (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE &&
4062
			     tif->tif_dir.td_nstrips != (uint32)tif->tif_dir.td_samplesperpixel)) {
4063
			    MissingRequired(tif, "StripByteCounts");
4064
			    goto bad;
4065
			}
4066
			TIFFWarningExt(tif->tif_clientdata, module,
4067
				"TIFF directory is missing required "
4068
				"\"StripByteCounts\" field, calculating from imagelength");
4069
			if (EstimateStripByteCounts(tif, dir, dircount) < 0)
4070
			    goto bad;
4071
		/*
4072
		 * Assume we have wrong StripByteCount value (in case
4073
		 * of single strip) in following cases:
4074
		 *   - it is equal to zero along with StripOffset;
4075
		 *   - it is larger than file itself (in case of uncompressed
4076
		 *     image);
4077
		 *   - it is smaller than the size of the bytes per row
4078
		 *     multiplied on the number of rows.  The last case should
4079
		 *     not be checked in the case of writing new image,
4080
		 *     because we may do not know the exact strip size
4081
		 *     until the whole image will be written and directory
4082
		 *     dumped out.
4083
		 */
4084
		#define	BYTECOUNTLOOKSBAD \
4085
		    ( (tif->tif_dir.td_stripbytecount[0] == 0 && tif->tif_dir.td_stripoffset[0] != 0) || \
4086
		      (tif->tif_dir.td_compression == COMPRESSION_NONE && \
4087
		       (tif->tif_dir.td_stripoffset[0] <= TIFFGetFileSize(tif) && \
4088
		        tif->tif_dir.td_stripbytecount[0] > TIFFGetFileSize(tif) - tif->tif_dir.td_stripoffset[0])) || \
4089
		      (tif->tif_mode == O_RDONLY && \
4090
		       tif->tif_dir.td_compression == COMPRESSION_NONE && \
4091
		       tif->tif_dir.td_stripbytecount[0] < TIFFScanlineSize64(tif) * tif->tif_dir.td_imagelength) )
4092

4093
		} else if (tif->tif_dir.td_nstrips == 1
4094
                           && !(tif->tif_flags&TIFF_ISTILED)
4095
                           && _TIFFFillStriles(tif)
4096
			   && tif->tif_dir.td_stripoffset[0] != 0
4097
			   && BYTECOUNTLOOKSBAD) {
4098
			/*
4099
			 * XXX: Plexus (and others) sometimes give a value of
4100
			 * zero for a tag when they don't know what the
4101
			 * correct value is!  Try and handle the simple case
4102
			 * of estimating the size of a one strip image.
4103
			 */
4104
			TIFFWarningExt(tif->tif_clientdata, module,
4105
			    "Bogus \"StripByteCounts\" field, ignoring and calculating from imagelength");
4106
			if(EstimateStripByteCounts(tif, dir, dircount) < 0)
4107
			    goto bad;
4108

4109
#if !defined(DEFER_STRILE_LOAD)
4110
		} else if (tif->tif_dir.td_planarconfig == PLANARCONFIG_CONTIG
4111
			   && tif->tif_dir.td_nstrips > 2
4112
			   && tif->tif_dir.td_compression == COMPRESSION_NONE
4113
			   && tif->tif_dir.td_stripbytecount[0] != tif->tif_dir.td_stripbytecount[1]
4114
			   && tif->tif_dir.td_stripbytecount[0] != 0
4115
			   && tif->tif_dir.td_stripbytecount[1] != 0 ) {
4116
			/*
4117
			 * XXX: Some vendors fill StripByteCount array with
4118
			 * absolutely wrong values (it can be equal to
4119
			 * StripOffset array, for example). Catch this case
4120
			 * here.
4121
                         *
4122
                         * We avoid this check if deferring strile loading
4123
                         * as it would always force us to load the strip/tile
4124
                         * information.
4125
			 */
4126
			TIFFWarningExt(tif->tif_clientdata, module,
4127
			    "Wrong \"StripByteCounts\" field, ignoring and calculating from imagelength");
4128
			if (EstimateStripByteCounts(tif, dir, dircount) < 0)
4129
			    goto bad;
4130
#endif /* !defined(DEFER_STRILE_LOAD) */                        
4131
		}
4132
	}
4133
	if (dir)
4134
	{
4135
		_TIFFfree(dir);
4136
		dir=NULL;
4137
	}
4138
	if (!TIFFFieldSet(tif, FIELD_MAXSAMPLEVALUE))
4139
	{
4140
		if (tif->tif_dir.td_bitspersample>=16)
4141
			tif->tif_dir.td_maxsamplevalue=0xFFFF;
4142
		else
4143
			tif->tif_dir.td_maxsamplevalue = (uint16)((1L<<tif->tif_dir.td_bitspersample)-1);
4144
	}
4145
	/*
4146
	 * XXX: We can optimize checking for the strip bounds using the sorted
4147
	 * bytecounts array. See also comments for TIFFAppendToStrip()
4148
	 * function in tif_write.c.
4149
	 */
4150
#if !defined(DEFER_STRILE_LOAD)        
4151
	if (tif->tif_dir.td_nstrips > 1) {
4152
		uint32 strip;
4153

4154
		tif->tif_dir.td_stripbytecountsorted = 1;
4155
		for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++) {
4156
			if (tif->tif_dir.td_stripoffset[strip - 1] >
4157
			    tif->tif_dir.td_stripoffset[strip]) {
4158
				tif->tif_dir.td_stripbytecountsorted = 0;
4159
				break;
4160
			}
4161
		}
4162
	}
4163
#endif /* !defined(DEFER_STRILE_LOAD) */
4164
        
4165
	/*
4166
	 * An opportunity for compression mode dependent tag fixup
4167
	 */
4168
	(*tif->tif_fixuptags)(tif);
4169

4170
	/*
4171
	 * Some manufacturers make life difficult by writing
4172
	 * large amounts of uncompressed data as a single strip.
4173
	 * This is contrary to the recommendations of the spec.
4174
	 * The following makes an attempt at breaking such images
4175
	 * into strips closer to the recommended 8k bytes.  A
4176
	 * side effect, however, is that the RowsPerStrip tag
4177
	 * value may be changed.
4178
	 */
4179
	if ((tif->tif_dir.td_planarconfig==PLANARCONFIG_CONTIG)&&
4180
	    (tif->tif_dir.td_nstrips==1)&&
4181
	    (tif->tif_dir.td_compression==COMPRESSION_NONE)&&  
4182
	    ((tif->tif_flags&(TIFF_STRIPCHOP|TIFF_ISTILED))==TIFF_STRIPCHOP))
4183
    {
4184
        if ( !_TIFFFillStriles(tif) || !tif->tif_dir.td_stripbytecount )
4185
            return 0;
4186
		ChopUpSingleUncompressedStrip(tif);
4187
    }
4188

4189
        /*
4190
         * Clear the dirty directory flag. 
4191
         */
4192
	tif->tif_flags &= ~TIFF_DIRTYDIRECT;
4193
	tif->tif_flags &= ~TIFF_DIRTYSTRIP;
4194

4195
	/*
4196
	 * Reinitialize i/o since we are starting on a new directory.
4197
	 */
4198
	tif->tif_row = (uint32) -1;
4199
	tif->tif_curstrip = (uint32) -1;
4200
	tif->tif_col = (uint32) -1;
4201
	tif->tif_curtile = (uint32) -1;
4202
	tif->tif_tilesize = (tmsize_t) -1;
4203

4204
	tif->tif_scanlinesize = TIFFScanlineSize(tif);
4205
	if (!tif->tif_scanlinesize) {
4206
		TIFFErrorExt(tif->tif_clientdata, module,
4207
		    "Cannot handle zero scanline size");
4208
		return (0);
4209
	}
4210

4211
	if (isTiled(tif)) {
4212
		tif->tif_tilesize = TIFFTileSize(tif);
4213
		if (!tif->tif_tilesize) {
4214
			TIFFErrorExt(tif->tif_clientdata, module,
4215
			     "Cannot handle zero tile size");
4216
			return (0);
4217
		}
4218
	} else {
4219
		if (!TIFFStripSize(tif)) {
4220
			TIFFErrorExt(tif->tif_clientdata, module,
4221
			    "Cannot handle zero strip size");
4222
			return (0);
4223
		}
4224
	}
4225
	return (1);
4226
bad:
4227
	if (dir)
4228
		_TIFFfree(dir);
4229
	return (0);
4230
}
4231

4232
static void
4233
TIFFReadDirectoryCheckOrder(TIFF* tif, TIFFDirEntry* dir, uint16 dircount)
4234
{
4235
	static const char module[] = "TIFFReadDirectoryCheckOrder";
4236
	uint16 m;
4237
	uint16 n;
4238
	TIFFDirEntry* o;
4239
	m=0;
4240
	for (n=0, o=dir; n<dircount; n++, o++)
4241
	{
4242
		if (o->tdir_tag<m)
4243
		{
4244
			TIFFWarningExt(tif->tif_clientdata,module,
4245
			    "Invalid TIFF directory; tags are not sorted in ascending order");
4246
			break;
4247
		}
4248
		m=o->tdir_tag+1;
4249
	}
4250
}
4251

4252
static TIFFDirEntry*
4253
TIFFReadDirectoryFindEntry(TIFF* tif, TIFFDirEntry* dir, uint16 dircount, uint16 tagid)
4254
{
4255
	TIFFDirEntry* m;
4256
	uint16 n;
4257
	(void) tif;
4258
	for (m=dir, n=0; n<dircount; m++, n++)
4259
	{
4260
		if (m->tdir_tag==tagid)
4261
			return(m);
4262
	}
4263
	return(0);
4264
}
4265

4266
static void
4267
TIFFReadDirectoryFindFieldInfo(TIFF* tif, uint16 tagid, uint32* fii)
4268
{
4269
	int32 ma,mb,mc;
4270
	ma=-1;
4271
	mc=(int32)tif->tif_nfields;
4272
	while (1)
4273
	{
4274
		if (ma+1==mc)
4275
		{
4276
			*fii = FAILED_FII;
4277
			return;
4278
		}
4279
		mb=(ma+mc)/2;
4280
		if (tif->tif_fields[mb]->field_tag==(uint32)tagid)
4281
			break;
4282
		if (tif->tif_fields[mb]->field_tag<(uint32)tagid)
4283
			ma=mb;
4284
		else
4285
			mc=mb;
4286
	}
4287
	while (1)
4288
	{
4289
		if (mb==0)
4290
			break;
4291
		if (tif->tif_fields[mb-1]->field_tag!=(uint32)tagid)
4292
			break;
4293
		mb--;
4294
	}
4295
	*fii=mb;
4296
}
4297

4298
/*
4299
 * Read custom directory from the arbitrary offset.
4300
 * The code is very similar to TIFFReadDirectory().
4301
 */
4302
int
4303
TIFFReadCustomDirectory(TIFF* tif, toff_t diroff,
4304
			const TIFFFieldArray* infoarray)
4305
{
4306
	static const char module[] = "TIFFReadCustomDirectory";
4307
	TIFFDirEntry* dir;
4308
	uint16 dircount;
4309
	TIFFDirEntry* dp;
4310
	uint16 di;
4311
	const TIFFField* fip;
4312
	uint32 fii;
4313
	_TIFFSetupFields(tif, infoarray);
4314
	dircount=TIFFFetchDirectory(tif,diroff,&dir,NULL);
4315
	if (!dircount)
4316
	{
4317
		TIFFErrorExt(tif->tif_clientdata,module,
4318
		    "Failed to read custom directory at offset " TIFF_UINT64_FORMAT,diroff);
4319
		return 0;
4320
	}
4321
	TIFFFreeDirectory(tif);
4322
	_TIFFmemset(&tif->tif_dir, 0, sizeof(TIFFDirectory));
4323
	TIFFReadDirectoryCheckOrder(tif,dir,dircount);
4324
	for (di=0, dp=dir; di<dircount; di++, dp++)
4325
	{
4326
		TIFFReadDirectoryFindFieldInfo(tif,dp->tdir_tag,&fii);
4327
		if (fii == FAILED_FII)
4328
		{
4329
			TIFFWarningExt(tif->tif_clientdata, module,
4330
			    "Unknown field with tag %d (0x%x) encountered",
4331
			    dp->tdir_tag, dp->tdir_tag);
4332
			if (!_TIFFMergeFields(tif, _TIFFCreateAnonField(tif,
4333
						dp->tdir_tag,
4334
						(TIFFDataType) dp->tdir_type),
4335
					     1)) {
4336
				TIFFWarningExt(tif->tif_clientdata, module,
4337
				    "Registering anonymous field with tag %d (0x%x) failed",
4338
				    dp->tdir_tag, dp->tdir_tag);
4339
				dp->tdir_tag=IGNORE;
4340
			} else {
4341
				TIFFReadDirectoryFindFieldInfo(tif,dp->tdir_tag,&fii);
4342
				assert( fii != FAILED_FII );
4343
			}
4344
		}
4345
		if (dp->tdir_tag!=IGNORE)
4346
		{
4347
			fip=tif->tif_fields[fii];
4348
			if (fip->field_bit==FIELD_IGNORE)
4349
				dp->tdir_tag=IGNORE;
4350
			else
4351
			{
4352
				/* check data type */
4353
				while ((fip->field_type!=TIFF_ANY)&&(fip->field_type!=dp->tdir_type))
4354
				{
4355
					fii++;
4356
					if ((fii==tif->tif_nfields)||
4357
					    (tif->tif_fields[fii]->field_tag!=(uint32)dp->tdir_tag))
4358
					{
4359
						fii=0xFFFF;
4360
						break;
4361
					}
4362
					fip=tif->tif_fields[fii];
4363
				}
4364
				if (fii==0xFFFF)
4365
				{
4366
					TIFFWarningExt(tif->tif_clientdata, module,
4367
					    "Wrong data type %d for \"%s\"; tag ignored",
4368
					    dp->tdir_type,fip->field_name);
4369
					dp->tdir_tag=IGNORE;
4370
				}
4371
				else
4372
				{
4373
					/* check count if known in advance */
4374
					if ((fip->field_readcount!=TIFF_VARIABLE)&&
4375
					    (fip->field_readcount!=TIFF_VARIABLE2))
4376
					{
4377
						uint32 expected;
4378
						if (fip->field_readcount==TIFF_SPP)
4379
							expected=(uint32)tif->tif_dir.td_samplesperpixel;
4380
						else
4381
							expected=(uint32)fip->field_readcount;
4382
						if (!CheckDirCount(tif,dp,expected))
4383
							dp->tdir_tag=IGNORE;
4384
					}
4385
				}
4386
			}
4387
			switch (dp->tdir_tag)
4388
			{
4389
				case IGNORE:
4390
					break;
4391
				case EXIFTAG_SUBJECTDISTANCE:
4392
					(void) TIFFFetchSubjectDistance(tif,dp);
4393
					break;
4394
				default:
4395
					(void) TIFFFetchNormalTag(tif, dp, TRUE);
4396
					break;
4397
			}
4398
		}
4399
	}
4400
	if (dir)
4401
		_TIFFfree(dir);
4402
	return 1;
4403
}
4404

4405
/*
4406
 * EXIF is important special case of custom IFD, so we have a special
4407
 * function to read it.
4408
 */
4409
int
4410
TIFFReadEXIFDirectory(TIFF* tif, toff_t diroff)
4411
{
4412
	const TIFFFieldArray* exifFieldArray;
4413
	exifFieldArray = _TIFFGetExifFields();
4414
	return TIFFReadCustomDirectory(tif, diroff, exifFieldArray);  
4415
}
4416

4417
static int
4418
EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount)
4419
{
4420
	static const char module[] = "EstimateStripByteCounts";
4421

4422
	TIFFDirEntry *dp;
4423
	TIFFDirectory *td = &tif->tif_dir;
4424
	uint32 strip;
4425

4426
    /* Do not try to load stripbytecount as we will compute it */
4427
        if( !_TIFFFillStrilesInternal( tif, 0 ) )
4428
            return -1;
4429

4430
	if (td->td_stripbytecount)
4431
		_TIFFfree(td->td_stripbytecount);
4432
	td->td_stripbytecount = (uint64*)
4433
	    _TIFFCheckMalloc(tif, td->td_nstrips, sizeof (uint64),
4434
		"for \"StripByteCounts\" array");
4435
        if( td->td_stripbytecount == NULL )
4436
            return -1;
4437

4438
	if (td->td_compression != COMPRESSION_NONE) {
4439
		uint64 space;
4440
		uint64 filesize;
4441
		uint16 n;
4442
		filesize = TIFFGetFileSize(tif);
4443
		if (!(tif->tif_flags&TIFF_BIGTIFF))
4444
			space=sizeof(TIFFHeaderClassic)+2+dircount*12+4;
4445
		else
4446
			space=sizeof(TIFFHeaderBig)+8+dircount*20+8;
4447
		/* calculate amount of space used by indirect values */
4448
		for (dp = dir, n = dircount; n > 0; n--, dp++)
4449
		{
4450
			uint32 typewidth;
4451
			uint64 datasize;
4452
			typewidth = TIFFDataWidth((TIFFDataType) dp->tdir_type);
4453
			if (typewidth == 0) {
4454
				TIFFErrorExt(tif->tif_clientdata, module,
4455
				    "Cannot determine size of unknown tag type %d",
4456
				    dp->tdir_type);
4457
				return -1;
4458
			}
4459
			datasize=(uint64)typewidth*dp->tdir_count;
4460
			if (!(tif->tif_flags&TIFF_BIGTIFF))
4461
			{
4462
				if (datasize<=4)
4463
					datasize=0;
4464
			}
4465
			else
4466
			{
4467
				if (datasize<=8)
4468
					datasize=0;
4469
			}
4470
			space+=datasize;
4471
		}
4472
		if( filesize < space )
4473
                    /* we should perhaps return in error ? */
4474
                    space = filesize;
4475
                else
4476
                    space = filesize - space;
4477
		if (td->td_planarconfig == PLANARCONFIG_SEPARATE)
4478
			space /= td->td_samplesperpixel;
4479
		for (strip = 0; strip < td->td_nstrips; strip++)
4480
			td->td_stripbytecount[strip] = space;
4481
		/*
4482
		 * This gross hack handles the case were the offset to
4483
		 * the last strip is past the place where we think the strip
4484
		 * should begin.  Since a strip of data must be contiguous,
4485
		 * it's safe to assume that we've overestimated the amount
4486
		 * of data in the strip and trim this number back accordingly.
4487
		 */
4488
		strip--;
4489
		if (td->td_stripoffset[strip]+td->td_stripbytecount[strip] > filesize)
4490
			td->td_stripbytecount[strip] = filesize - td->td_stripoffset[strip];
4491
	} else if (isTiled(tif)) {
4492
		uint64 bytespertile = TIFFTileSize64(tif);
4493

4494
		for (strip = 0; strip < td->td_nstrips; strip++)
4495
		    td->td_stripbytecount[strip] = bytespertile;
4496
	} else {
4497
		uint64 rowbytes = TIFFScanlineSize64(tif);
4498
		uint32 rowsperstrip = td->td_imagelength/td->td_stripsperimage;
4499
		for (strip = 0; strip < td->td_nstrips; strip++)
4500
			td->td_stripbytecount[strip] = rowbytes * rowsperstrip;
4501
	}
4502
	TIFFSetFieldBit(tif, FIELD_STRIPBYTECOUNTS);
4503
	if (!TIFFFieldSet(tif, FIELD_ROWSPERSTRIP))
4504
		td->td_rowsperstrip = td->td_imagelength;
4505
	return 1;
4506
}
4507

4508
static void
4509
MissingRequired(TIFF* tif, const char* tagname)
4510
{
4511
	static const char module[] = "MissingRequired";
4512

4513
	TIFFErrorExt(tif->tif_clientdata, module,
4514
	    "TIFF directory is missing required \"%s\" field",
4515
	    tagname);
4516
}
4517

4518
/*
4519
 * Check the directory offset against the list of already seen directory
4520
 * offsets. This is a trick to prevent IFD looping. The one can create TIFF
4521
 * file with looped directory pointers. We will maintain a list of already
4522
 * seen directories and check every IFD offset against that list.
4523
 */
4524
static int
4525
TIFFCheckDirOffset(TIFF* tif, uint64 diroff)
4526
{
4527
	uint16 n;
4528

4529
	if (diroff == 0)			/* no more directories */
4530
		return 0;
4531
	if (tif->tif_dirnumber == 65535) {
4532
	    TIFFErrorExt(tif->tif_clientdata, "TIFFCheckDirOffset",
4533
			 "Cannot handle more than 65535 TIFF directories");
4534
	    return 0;
4535
	}
4536

4537
	for (n = 0; n < tif->tif_dirnumber && tif->tif_dirlist; n++) {
4538
		if (tif->tif_dirlist[n] == diroff)
4539
			return 0;
4540
	}
4541

4542
	tif->tif_dirnumber++;
4543

4544
	if (tif->tif_dirlist == NULL || tif->tif_dirnumber > tif->tif_dirlistsize) {
4545
		uint64* new_dirlist;
4546

4547
		/*
4548
		 * XXX: Reduce memory allocation granularity of the dirlist
4549
		 * array.
4550
		 */
4551
		new_dirlist = (uint64*)_TIFFCheckRealloc(tif, tif->tif_dirlist,
4552
		    tif->tif_dirnumber, 2 * sizeof(uint64), "for IFD list");
4553
		if (!new_dirlist)
4554
			return 0;
4555
		if( tif->tif_dirnumber >= 32768 )
4556
		    tif->tif_dirlistsize = 65535;
4557
		else
4558
		    tif->tif_dirlistsize = 2 * tif->tif_dirnumber;
4559
		tif->tif_dirlist = new_dirlist;
4560
	}
4561

4562
	tif->tif_dirlist[tif->tif_dirnumber - 1] = diroff;
4563

4564
	return 1;
4565
}
4566

4567
/*
4568
 * Check the count field of a directory entry against a known value.  The
4569
 * caller is expected to skip/ignore the tag if there is a mismatch.
4570
 */
4571
static int
4572
CheckDirCount(TIFF* tif, TIFFDirEntry* dir, uint32 count)
4573
{
4574
	if ((uint64)count > dir->tdir_count) {
4575
		const TIFFField* fip = TIFFFieldWithTag(tif, dir->tdir_tag);
4576
		TIFFWarningExt(tif->tif_clientdata, tif->tif_name,
4577
	"incorrect count for field \"%s\" (" TIFF_UINT64_FORMAT ", expecting %u); tag ignored",
4578
		    fip ? fip->field_name : "unknown tagname",
4579
		    dir->tdir_count, count);
4580
		return (0);
4581
	} else if ((uint64)count < dir->tdir_count) {
4582
		const TIFFField* fip = TIFFFieldWithTag(tif, dir->tdir_tag);
4583
		TIFFWarningExt(tif->tif_clientdata, tif->tif_name,
4584
	"incorrect count for field \"%s\" (" TIFF_UINT64_FORMAT ", expecting %u); tag trimmed",
4585
		    fip ? fip->field_name : "unknown tagname",
4586
		    dir->tdir_count, count);
4587
		dir->tdir_count = count;
4588
		return (1);
4589
	}
4590
	return (1);
4591
}
4592

4593
/*
4594
 * Read IFD structure from the specified offset. If the pointer to
4595
 * nextdiroff variable has been specified, read it too. Function returns a
4596
 * number of fields in the directory or 0 if failed.
4597
 */
4598
static uint16
4599
TIFFFetchDirectory(TIFF* tif, uint64 diroff, TIFFDirEntry** pdir,
4600
                   uint64 *nextdiroff)
4601
{
4602
	static const char module[] = "TIFFFetchDirectory";
4603

4604
	void* origdir;
4605
	uint16 dircount16;
4606
	uint32 dirsize;
4607
	TIFFDirEntry* dir;
4608
	uint8* ma;
4609
	TIFFDirEntry* mb;
4610
	uint16 n;
4611

4612
	assert(pdir);
4613

4614
	tif->tif_diroff = diroff;
4615
	if (nextdiroff)
4616
		*nextdiroff = 0;
4617
	if (!isMapped(tif)) {
4618
		if (!SeekOK(tif, tif->tif_diroff)) {
4619
			TIFFErrorExt(tif->tif_clientdata, module,
4620
				"%s: Seek error accessing TIFF directory",
4621
				tif->tif_name);
4622
			return 0;
4623
		}
4624
		if (!(tif->tif_flags&TIFF_BIGTIFF))
4625
		{
4626
			if (!ReadOK(tif, &dircount16, sizeof (uint16))) {
4627
				TIFFErrorExt(tif->tif_clientdata, module,
4628
				    "%s: Can not read TIFF directory count",
4629
				    tif->tif_name);
4630
				return 0;
4631
			}
4632
			if (tif->tif_flags & TIFF_SWAB)
4633
				TIFFSwabShort(&dircount16);
4634
			if (dircount16>4096)
4635
			{
4636
				TIFFErrorExt(tif->tif_clientdata, module,
4637
				    "Sanity check on directory count failed, this is probably not a valid IFD offset");
4638
				return 0;
4639
			}
4640
			dirsize = 12;
4641
		} else {
4642
			uint64 dircount64;
4643
			if (!ReadOK(tif, &dircount64, sizeof (uint64))) {
4644
				TIFFErrorExt(tif->tif_clientdata, module,
4645
					"%s: Can not read TIFF directory count",
4646
					tif->tif_name);
4647
				return 0;
4648
			}
4649
			if (tif->tif_flags & TIFF_SWAB)
4650
				TIFFSwabLong8(&dircount64);
4651
			if (dircount64>4096)
4652
			{
4653
				TIFFErrorExt(tif->tif_clientdata, module,
4654
				    "Sanity check on directory count failed, this is probably not a valid IFD offset");
4655
				return 0;
4656
			}
4657
			dircount16 = (uint16)dircount64;
4658
			dirsize = 20;
4659
		}
4660
		origdir = _TIFFCheckMalloc(tif, dircount16,
4661
		    dirsize, "to read TIFF directory");
4662
		if (origdir == NULL)
4663
			return 0;
4664
		if (!ReadOK(tif, origdir, (tmsize_t)(dircount16*dirsize))) {
4665
			TIFFErrorExt(tif->tif_clientdata, module,
4666
				"%.100s: Can not read TIFF directory",
4667
				tif->tif_name);
4668
			_TIFFfree(origdir);
4669
			return 0;
4670
		}
4671
		/*
4672
		 * Read offset to next directory for sequential scans if
4673
		 * needed.
4674
		 */
4675
		if (nextdiroff)
4676
		{
4677
			if (!(tif->tif_flags&TIFF_BIGTIFF))
4678
			{
4679
				uint32 nextdiroff32;
4680
				if (!ReadOK(tif, &nextdiroff32, sizeof(uint32)))
4681
					nextdiroff32 = 0;
4682
				if (tif->tif_flags&TIFF_SWAB)
4683
					TIFFSwabLong(&nextdiroff32);
4684
				*nextdiroff=nextdiroff32;
4685
			} else {
4686
				if (!ReadOK(tif, nextdiroff, sizeof(uint64)))
4687
					*nextdiroff = 0;
4688
				if (tif->tif_flags&TIFF_SWAB)
4689
					TIFFSwabLong8(nextdiroff);
4690
			}
4691
		}
4692
	} else {
4693
		tmsize_t m;
4694
		tmsize_t off = (tmsize_t) tif->tif_diroff;
4695
		if ((uint64)off!=tif->tif_diroff)
4696
		{
4697
			TIFFErrorExt(tif->tif_clientdata,module,"Can not read TIFF directory count");
4698
			return(0);
4699
		}
4700

4701
		/*
4702
		 * Check for integer overflow when validating the dir_off,
4703
		 * otherwise a very high offset may cause an OOB read and
4704
		 * crash the client. Make two comparisons instead of
4705
		 *
4706
		 *  off + sizeof(uint16) > tif->tif_size
4707
		 *
4708
		 * to avoid overflow.
4709
		 */
4710
		if (!(tif->tif_flags&TIFF_BIGTIFF))
4711
		{
4712
			m=off+sizeof(uint16);
4713
			if ((m<off)||(m<(tmsize_t)sizeof(uint16))||(m>tif->tif_size)) {
4714
				TIFFErrorExt(tif->tif_clientdata, module,
4715
					"Can not read TIFF directory count");
4716
				return 0;
4717
			} else {
4718
				_TIFFmemcpy(&dircount16, tif->tif_base + off,
4719
					    sizeof(uint16));
4720
			}
4721
			off += sizeof (uint16);
4722
			if (tif->tif_flags & TIFF_SWAB)
4723
				TIFFSwabShort(&dircount16);
4724
			if (dircount16>4096)
4725
			{
4726
				TIFFErrorExt(tif->tif_clientdata, module,
4727
				    "Sanity check on directory count failed, this is probably not a valid IFD offset");
4728
				return 0;
4729
			}
4730
			dirsize = 12;
4731
		}
4732
		else
4733
		{
4734
			uint64 dircount64;
4735
			m=off+sizeof(uint64);
4736
			if ((m<off)||(m<(tmsize_t)sizeof(uint64))||(m>tif->tif_size)) {
4737
				TIFFErrorExt(tif->tif_clientdata, module,
4738
					"Can not read TIFF directory count");
4739
				return 0;
4740
			} else {
4741
				_TIFFmemcpy(&dircount64, tif->tif_base + off,
4742
					    sizeof(uint64));
4743
			}
4744
			off += sizeof (uint64);
4745
			if (tif->tif_flags & TIFF_SWAB)
4746
				TIFFSwabLong8(&dircount64);
4747
			if (dircount64>4096)
4748
			{
4749
				TIFFErrorExt(tif->tif_clientdata, module,
4750
				    "Sanity check on directory count failed, this is probably not a valid IFD offset");
4751
				return 0;
4752
			}
4753
			dircount16 = (uint16)dircount64;
4754
			dirsize = 20;
4755
		}
4756
		if (dircount16 == 0 )
4757
		{
4758
			TIFFErrorExt(tif->tif_clientdata, module,
4759
			             "Sanity check on directory count failed, zero tag directories not supported");
4760
			return 0;
4761
		}
4762
		origdir = _TIFFCheckMalloc(tif, dircount16,
4763
						dirsize,
4764
						"to read TIFF directory");
4765
		if (origdir == NULL)
4766
			return 0;
4767
		m=off+dircount16*dirsize;
4768
		if ((m<off)||(m<(tmsize_t)(dircount16*dirsize))||(m>tif->tif_size)) {
4769
			TIFFErrorExt(tif->tif_clientdata, module,
4770
				     "Can not read TIFF directory");
4771
			_TIFFfree(origdir);
4772
			return 0;
4773
		} else {
4774
			_TIFFmemcpy(origdir, tif->tif_base + off,
4775
				    dircount16 * dirsize);
4776
		}
4777
		if (nextdiroff) {
4778
			off += dircount16 * dirsize;
4779
			if (!(tif->tif_flags&TIFF_BIGTIFF))
4780
			{
4781
				uint32 nextdiroff32;
4782
				m=off+sizeof(uint32);
4783
				if ((m<off)||(m<(tmsize_t)sizeof(uint32))||(m>tif->tif_size))
4784
					nextdiroff32 = 0;
4785
				else
4786
					_TIFFmemcpy(&nextdiroff32, tif->tif_base + off,
4787
						    sizeof (uint32));
4788
				if (tif->tif_flags&TIFF_SWAB)
4789
					TIFFSwabLong(&nextdiroff32);
4790
				*nextdiroff = nextdiroff32;
4791
			}
4792
			else
4793
			{
4794
				m=off+sizeof(uint64);
4795
				if ((m<off)||(m<(tmsize_t)sizeof(uint64))||(m>tif->tif_size))
4796
					*nextdiroff = 0;
4797
				else
4798
					_TIFFmemcpy(nextdiroff, tif->tif_base + off,
4799
						    sizeof (uint64));
4800
				if (tif->tif_flags&TIFF_SWAB)
4801
					TIFFSwabLong8(nextdiroff);
4802
			}
4803
		}
4804
	}
4805
	dir = (TIFFDirEntry*)_TIFFCheckMalloc(tif, dircount16,
4806
						sizeof(TIFFDirEntry),
4807
						"to read TIFF directory");
4808
	if (dir==0)
4809
	{
4810
		_TIFFfree(origdir);
4811
		return 0;
4812
	}
4813
	ma=(uint8*)origdir;
4814
	mb=dir;
4815
	for (n=0; n<dircount16; n++)
4816
	{
4817
		if (tif->tif_flags&TIFF_SWAB)
4818
			TIFFSwabShort((uint16*)ma);
4819
		mb->tdir_tag=*(uint16*)ma;
4820
		ma+=sizeof(uint16);
4821
		if (tif->tif_flags&TIFF_SWAB)
4822
			TIFFSwabShort((uint16*)ma);
4823
		mb->tdir_type=*(uint16*)ma;
4824
		ma+=sizeof(uint16);
4825
		if (!(tif->tif_flags&TIFF_BIGTIFF))
4826
		{
4827
			if (tif->tif_flags&TIFF_SWAB)
4828
				TIFFSwabLong((uint32*)ma);
4829
			mb->tdir_count=(uint64)(*(uint32*)ma);
4830
			ma+=sizeof(uint32);
4831
			*(uint32*)(&mb->tdir_offset)=*(uint32*)ma;
4832
			ma+=sizeof(uint32);
4833
		}
4834
		else
4835
		{
4836
			if (tif->tif_flags&TIFF_SWAB)
4837
				TIFFSwabLong8((uint64*)ma);
4838
                        mb->tdir_count=TIFFReadUInt64(ma);
4839
			ma+=sizeof(uint64);
4840
			mb->tdir_offset.toff_long8=TIFFReadUInt64(ma);
4841
			ma+=sizeof(uint64);
4842
		}
4843
		mb++;
4844
	}
4845
	_TIFFfree(origdir);
4846
	*pdir = dir;
4847
	return dircount16;
4848
}
4849

4850
/*
4851
 * Fetch a tag that is not handled by special case code.
4852
 */
4853
static int
4854
TIFFFetchNormalTag(TIFF* tif, TIFFDirEntry* dp, int recover)
4855
{
4856
	static const char module[] = "TIFFFetchNormalTag";
4857
	enum TIFFReadDirEntryErr err;
4858
	uint32 fii;
4859
	const TIFFField* fip = NULL;
4860
	TIFFReadDirectoryFindFieldInfo(tif,dp->tdir_tag,&fii);
4861
        if( fii == FAILED_FII )
4862
        {
4863
            TIFFErrorExt(tif->tif_clientdata, "TIFFFetchNormalTag",
4864
                         "No definition found for tag %d",
4865
                         dp->tdir_tag);
4866
            return 0;
4867
        }
4868
	fip=tif->tif_fields[fii];
4869
	assert(fip != NULL); /* should not happen */
4870
	assert(fip->set_field_type!=TIFF_SETGET_OTHER);  /* if so, we shouldn't arrive here but deal with this in specialized code */
4871
	assert(fip->set_field_type!=TIFF_SETGET_INT);    /* if so, we shouldn't arrive here as this is only the case for pseudo-tags */
4872
	err=TIFFReadDirEntryErrOk;
4873
	switch (fip->set_field_type)
4874
	{
4875
		case TIFF_SETGET_UNDEFINED:
4876
			break;
4877
		case TIFF_SETGET_ASCII:
4878
			{
4879
				uint8* data;
4880
				assert(fip->field_passcount==0);
4881
				err=TIFFReadDirEntryByteArray(tif,dp,&data);
4882
				if (err==TIFFReadDirEntryErrOk)
4883
				{
4884
					uint8* ma;
4885
					uint32 mb;
4886
					int n;
4887
					ma=data;
4888
					mb=0;
4889
					while (mb<(uint32)dp->tdir_count)
4890
					{
4891
						if (*ma==0)
4892
							break;
4893
						ma++;
4894
						mb++;
4895
					}
4896
					if (mb+1<(uint32)dp->tdir_count)
4897
						TIFFWarningExt(tif->tif_clientdata,module,"ASCII value for tag \"%s\" contains null byte in value; value incorrectly truncated during reading due to implementation limitations",fip->field_name);
4898
					else if (mb+1>(uint32)dp->tdir_count)
4899
					{
4900
						uint8* o;
4901
						TIFFWarningExt(tif->tif_clientdata,module,"ASCII value for tag \"%s\" does not end in null byte",fip->field_name);
4902
						if ((uint32)dp->tdir_count+1!=dp->tdir_count+1)
4903
							o=NULL;
4904
						else
4905
							o=_TIFFmalloc((uint32)dp->tdir_count+1);
4906
						if (o==NULL)
4907
						{
4908
							if (data!=NULL)
4909
								_TIFFfree(data);
4910
							return(0);
4911
						}
4912
						_TIFFmemcpy(o,data,(uint32)dp->tdir_count);
4913
						o[(uint32)dp->tdir_count]=0;
4914
						if (data!=0)
4915
							_TIFFfree(data);
4916
						data=o;
4917
					}
4918
					n=TIFFSetField(tif,dp->tdir_tag,data);
4919
					if (data!=0)
4920
						_TIFFfree(data);
4921
					if (!n)
4922
						return(0);
4923
				}
4924
			}
4925
			break;
4926
		case TIFF_SETGET_UINT8:
4927
			{
4928
				uint8 data=0;
4929
				assert(fip->field_readcount==1);
4930
				assert(fip->field_passcount==0);
4931
				err=TIFFReadDirEntryByte(tif,dp,&data);
4932
				if (err==TIFFReadDirEntryErrOk)
4933
				{
4934
					if (!TIFFSetField(tif,dp->tdir_tag,data))
4935
						return(0);
4936
				}
4937
			}
4938
			break;
4939
		case TIFF_SETGET_UINT16:
4940
			{
4941
				uint16 data;
4942
				assert(fip->field_readcount==1);
4943
				assert(fip->field_passcount==0);
4944
				err=TIFFReadDirEntryShort(tif,dp,&data);
4945
				if (err==TIFFReadDirEntryErrOk)
4946
				{
4947
					if (!TIFFSetField(tif,dp->tdir_tag,data))
4948
						return(0);
4949
				}
4950
			}
4951
			break;
4952
		case TIFF_SETGET_UINT32:
4953
			{
4954
				uint32 data;
4955
				assert(fip->field_readcount==1);
4956
				assert(fip->field_passcount==0);
4957
				err=TIFFReadDirEntryLong(tif,dp,&data);
4958
				if (err==TIFFReadDirEntryErrOk)
4959
				{
4960
					if (!TIFFSetField(tif,dp->tdir_tag,data))
4961
						return(0);
4962
				}
4963
			}
4964
			break;
4965
		case TIFF_SETGET_UINT64:
4966
			{
4967
				uint64 data;
4968
				assert(fip->field_readcount==1);
4969
				assert(fip->field_passcount==0);
4970
				err=TIFFReadDirEntryLong8(tif,dp,&data);
4971
				if (err==TIFFReadDirEntryErrOk)
4972
				{
4973
					if (!TIFFSetField(tif,dp->tdir_tag,data))
4974
						return(0);
4975
				}
4976
			}
4977
			break;
4978
		case TIFF_SETGET_FLOAT:
4979
			{
4980
				float data;
4981
				assert(fip->field_readcount==1);
4982
				assert(fip->field_passcount==0);
4983
				err=TIFFReadDirEntryFloat(tif,dp,&data);
4984
				if (err==TIFFReadDirEntryErrOk)
4985
				{
4986
					if (!TIFFSetField(tif,dp->tdir_tag,data))
4987
						return(0);
4988
				}
4989
			}
4990
			break;
4991
		case TIFF_SETGET_DOUBLE:
4992
			{
4993
				double data;
4994
				assert(fip->field_readcount==1);
4995
				assert(fip->field_passcount==0);
4996
				err=TIFFReadDirEntryDouble(tif,dp,&data);
4997
				if (err==TIFFReadDirEntryErrOk)
4998
				{
4999
					if (!TIFFSetField(tif,dp->tdir_tag,data))
5000
						return(0);
5001
				}
5002
			}
5003
			break;
5004
		case TIFF_SETGET_IFD8:
5005
			{
5006
				uint64 data;
5007
				assert(fip->field_readcount==1);
5008
				assert(fip->field_passcount==0);
5009
				err=TIFFReadDirEntryIfd8(tif,dp,&data);
5010
				if (err==TIFFReadDirEntryErrOk)
5011
				{
5012
					if (!TIFFSetField(tif,dp->tdir_tag,data))
5013
						return(0);
5014
				}
5015
			}
5016
			break;
5017
		case TIFF_SETGET_UINT16_PAIR:
5018
			{
5019
				uint16* data;
5020
				assert(fip->field_readcount==2);
5021
				assert(fip->field_passcount==0);
5022
				if (dp->tdir_count!=2) {
5023
					TIFFWarningExt(tif->tif_clientdata,module,
5024
						       "incorrect count for field \"%s\", expected 2, got %d",
5025
						       fip->field_name,(int)dp->tdir_count);
5026
					return(0);
5027
				}
5028
				err=TIFFReadDirEntryShortArray(tif,dp,&data);
5029
				if (err==TIFFReadDirEntryErrOk)
5030
				{
5031
					int m;
5032
					m=TIFFSetField(tif,dp->tdir_tag,data[0],data[1]);
5033
					_TIFFfree(data);
5034
					if (!m)
5035
						return(0);
5036
				}
5037
			}
5038
			break;
5039
		case TIFF_SETGET_C0_UINT8:
5040
			{
5041
				uint8* data;
5042
				assert(fip->field_readcount>=1);
5043
				assert(fip->field_passcount==0);
5044
				if (dp->tdir_count!=(uint64)fip->field_readcount) {
5045
					TIFFWarningExt(tif->tif_clientdata,module,
5046
						       "incorrect count for field \"%s\", expected %d, got %d",
5047
						       fip->field_name,(int) fip->field_readcount, (int)dp->tdir_count);
5048
					return 0;
5049
				}
5050
				else
5051
				{
5052
					err=TIFFReadDirEntryByteArray(tif,dp,&data);
5053
					if (err==TIFFReadDirEntryErrOk)
5054
					{
5055
						int m;
5056
						m=TIFFSetField(tif,dp->tdir_tag,data);
5057
						if (data!=0)
5058
							_TIFFfree(data);
5059
						if (!m)
5060
							return(0);
5061
					}
5062
				}
5063
			}
5064
			break;
5065
		case TIFF_SETGET_C0_UINT16:
5066
			{
5067
				uint16* data;
5068
				assert(fip->field_readcount>=1);
5069
				assert(fip->field_passcount==0);
5070
				if (dp->tdir_count!=(uint64)fip->field_readcount)
5071
                                    /* corrupt file */;
5072
				else
5073
				{
5074
					err=TIFFReadDirEntryShortArray(tif,dp,&data);
5075
					if (err==TIFFReadDirEntryErrOk)
5076
					{
5077
						int m;
5078
						m=TIFFSetField(tif,dp->tdir_tag,data);
5079
						if (data!=0)
5080
							_TIFFfree(data);
5081
						if (!m)
5082
							return(0);
5083
					}
5084
				}
5085
			}
5086
			break;
5087
		case TIFF_SETGET_C0_UINT32:
5088
			{
5089
				uint32* data;
5090
				assert(fip->field_readcount>=1);
5091
				assert(fip->field_passcount==0);
5092
				if (dp->tdir_count!=(uint64)fip->field_readcount)
5093
                                    /* corrupt file */;
5094
				else
5095
				{
5096
					err=TIFFReadDirEntryLongArray(tif,dp,&data);
5097
					if (err==TIFFReadDirEntryErrOk)
5098
					{
5099
						int m;
5100
						m=TIFFSetField(tif,dp->tdir_tag,data);
5101
						if (data!=0)
5102
							_TIFFfree(data);
5103
						if (!m)
5104
							return(0);
5105
					}
5106
				}
5107
			}
5108
			break;
5109
		case TIFF_SETGET_C0_FLOAT:
5110
			{
5111
				float* data;
5112
				assert(fip->field_readcount>=1);
5113
				assert(fip->field_passcount==0);
5114
				if (dp->tdir_count!=(uint64)fip->field_readcount)
5115
                                    /* corrupt file */;
5116
				else
5117
				{
5118
					err=TIFFReadDirEntryFloatArray(tif,dp,&data);
5119
					if (err==TIFFReadDirEntryErrOk)
5120
					{
5121
						int m;
5122
						m=TIFFSetField(tif,dp->tdir_tag,data);
5123
						if (data!=0)
5124
							_TIFFfree(data);
5125
						if (!m)
5126
							return(0);
5127
					}
5128
				}
5129
			}
5130
			break;
5131
		case TIFF_SETGET_C16_ASCII:
5132
			{
5133
				uint8* data;
5134
				assert(fip->field_readcount==TIFF_VARIABLE);
5135
				assert(fip->field_passcount==1);
5136
				if (dp->tdir_count>0xFFFF)
5137
					err=TIFFReadDirEntryErrCount;
5138
				else
5139
				{
5140
					err=TIFFReadDirEntryByteArray(tif,dp,&data);
5141
					if (err==TIFFReadDirEntryErrOk)
5142
					{
5143
						int m;
5144
                        if( dp->tdir_count > 0 && data[dp->tdir_count-1] != '\0' )
5145
                        {
5146
                            TIFFWarningExt(tif->tif_clientdata,module,"ASCII value for tag \"%s\" does not end in null byte. Forcing it to be null",fip->field_name);
5147
                            data[dp->tdir_count-1] = '\0';
5148
                        }
5149
						m=TIFFSetField(tif,dp->tdir_tag,(uint16)(dp->tdir_count),data);
5150
						if (data!=0)
5151
							_TIFFfree(data);
5152
						if (!m)
5153
							return(0);
5154
					}
5155
				}
5156
			}
5157
			break;
5158
		case TIFF_SETGET_C16_UINT8:
5159
			{
5160
				uint8* data;
5161
				assert(fip->field_readcount==TIFF_VARIABLE);
5162
				assert(fip->field_passcount==1);
5163
				if (dp->tdir_count>0xFFFF)
5164
					err=TIFFReadDirEntryErrCount;
5165
				else
5166
				{
5167
					err=TIFFReadDirEntryByteArray(tif,dp,&data);
5168
					if (err==TIFFReadDirEntryErrOk)
5169
					{
5170
						int m;
5171
						m=TIFFSetField(tif,dp->tdir_tag,(uint16)(dp->tdir_count),data);
5172
						if (data!=0)
5173
							_TIFFfree(data);
5174
						if (!m)
5175
							return(0);
5176
					}
5177
				}
5178
			}
5179
			break;
5180
		case TIFF_SETGET_C16_UINT16:
5181
			{
5182
				uint16* data;
5183
				assert(fip->field_readcount==TIFF_VARIABLE);
5184
				assert(fip->field_passcount==1);
5185
				if (dp->tdir_count>0xFFFF)
5186
					err=TIFFReadDirEntryErrCount;
5187
				else
5188
				{
5189
					err=TIFFReadDirEntryShortArray(tif,dp,&data);
5190
					if (err==TIFFReadDirEntryErrOk)
5191
					{
5192
						int m;
5193
						m=TIFFSetField(tif,dp->tdir_tag,(uint16)(dp->tdir_count),data);
5194
						if (data!=0)
5195
							_TIFFfree(data);
5196
						if (!m)
5197
							return(0);
5198
					}
5199
				}
5200
			}
5201
			break;
5202
		case TIFF_SETGET_C16_UINT32:
5203
			{
5204
				uint32* data;
5205
				assert(fip->field_readcount==TIFF_VARIABLE);
5206
				assert(fip->field_passcount==1);
5207
				if (dp->tdir_count>0xFFFF)
5208
					err=TIFFReadDirEntryErrCount;
5209
				else
5210
				{
5211
					err=TIFFReadDirEntryLongArray(tif,dp,&data);
5212
					if (err==TIFFReadDirEntryErrOk)
5213
					{
5214
						int m;
5215
						m=TIFFSetField(tif,dp->tdir_tag,(uint16)(dp->tdir_count),data);
5216
						if (data!=0)
5217
							_TIFFfree(data);
5218
						if (!m)
5219
							return(0);
5220
					}
5221
				}
5222
			}
5223
			break;
5224
		case TIFF_SETGET_C16_UINT64:
5225
			{
5226
				uint64* data;
5227
				assert(fip->field_readcount==TIFF_VARIABLE);
5228
				assert(fip->field_passcount==1);
5229
				if (dp->tdir_count>0xFFFF)
5230
					err=TIFFReadDirEntryErrCount;
5231
				else
5232
				{
5233
					err=TIFFReadDirEntryLong8Array(tif,dp,&data);
5234
					if (err==TIFFReadDirEntryErrOk)
5235
					{
5236
						int m;
5237
						m=TIFFSetField(tif,dp->tdir_tag,(uint16)(dp->tdir_count),data);
5238
						if (data!=0)
5239
							_TIFFfree(data);
5240
						if (!m)
5241
							return(0);
5242
					}
5243
				}
5244
			}
5245
			break;
5246
		case TIFF_SETGET_C16_FLOAT:
5247
			{
5248
				float* data;
5249
				assert(fip->field_readcount==TIFF_VARIABLE);
5250
				assert(fip->field_passcount==1);
5251
				if (dp->tdir_count>0xFFFF)
5252
					err=TIFFReadDirEntryErrCount;
5253
				else
5254
				{
5255
					err=TIFFReadDirEntryFloatArray(tif,dp,&data);
5256
					if (err==TIFFReadDirEntryErrOk)
5257
					{
5258
						int m;
5259
						m=TIFFSetField(tif,dp->tdir_tag,(uint16)(dp->tdir_count),data);
5260
						if (data!=0)
5261
							_TIFFfree(data);
5262
						if (!m)
5263
							return(0);
5264
					}
5265
				}
5266
			}
5267
			break;
5268
		case TIFF_SETGET_C16_DOUBLE:
5269
			{
5270
				double* data;
5271
				assert(fip->field_readcount==TIFF_VARIABLE);
5272
				assert(fip->field_passcount==1);
5273
				if (dp->tdir_count>0xFFFF)
5274
					err=TIFFReadDirEntryErrCount;
5275
				else
5276
				{
5277
					err=TIFFReadDirEntryDoubleArray(tif,dp,&data);
5278
					if (err==TIFFReadDirEntryErrOk)
5279
					{
5280
						int m;
5281
						m=TIFFSetField(tif,dp->tdir_tag,(uint16)(dp->tdir_count),data);
5282
						if (data!=0)
5283
							_TIFFfree(data);
5284
						if (!m)
5285
							return(0);
5286
					}
5287
				}
5288
			}
5289
			break;
5290
		case TIFF_SETGET_C16_IFD8:
5291
			{
5292
				uint64* data;
5293
				assert(fip->field_readcount==TIFF_VARIABLE);
5294
				assert(fip->field_passcount==1);
5295
				if (dp->tdir_count>0xFFFF)
5296
					err=TIFFReadDirEntryErrCount;
5297
				else
5298
				{
5299
					err=TIFFReadDirEntryIfd8Array(tif,dp,&data);
5300
					if (err==TIFFReadDirEntryErrOk)
5301
					{
5302
						int m;
5303
						m=TIFFSetField(tif,dp->tdir_tag,(uint16)(dp->tdir_count),data);
5304
						if (data!=0)
5305
							_TIFFfree(data);
5306
						if (!m)
5307
							return(0);
5308
					}
5309
				}
5310
			}
5311
			break;
5312
		case TIFF_SETGET_C32_ASCII:
5313
			{
5314
				uint8* data;
5315
				assert(fip->field_readcount==TIFF_VARIABLE2);
5316
				assert(fip->field_passcount==1);
5317
				err=TIFFReadDirEntryByteArray(tif,dp,&data);
5318
				if (err==TIFFReadDirEntryErrOk)
5319
				{
5320
					int m;
5321
                    if( dp->tdir_count > 0 && data[dp->tdir_count-1] != '\0' )
5322
                    {
5323
                        TIFFWarningExt(tif->tif_clientdata,module,"ASCII value for tag \"%s\" does not end in null byte. Forcing it to be null",fip->field_name);
5324
                        data[dp->tdir_count-1] = '\0';
5325
                    }
5326
					m=TIFFSetField(tif,dp->tdir_tag,(uint32)(dp->tdir_count),data);
5327
					if (data!=0)
5328
						_TIFFfree(data);
5329
					if (!m)
5330
						return(0);
5331
				}
5332
			}
5333
			break;
5334
		case TIFF_SETGET_C32_UINT8:
5335
			{
5336
				uint8* data;
5337
				assert(fip->field_readcount==TIFF_VARIABLE2);
5338
				assert(fip->field_passcount==1);
5339
				err=TIFFReadDirEntryByteArray(tif,dp,&data);
5340
				if (err==TIFFReadDirEntryErrOk)
5341
				{
5342
					int m;
5343
					m=TIFFSetField(tif,dp->tdir_tag,(uint32)(dp->tdir_count),data);
5344
					if (data!=0)
5345
						_TIFFfree(data);
5346
					if (!m)
5347
						return(0);
5348
				}
5349
			}
5350
			break;
5351
		case TIFF_SETGET_C32_SINT8:
5352
			{
5353
				int8* data = NULL;
5354
				assert(fip->field_readcount==TIFF_VARIABLE2);
5355
				assert(fip->field_passcount==1);
5356
				err=TIFFReadDirEntrySbyteArray(tif,dp,&data);
5357
				if (err==TIFFReadDirEntryErrOk)
5358
				{
5359
					int m;
5360
					m=TIFFSetField(tif,dp->tdir_tag,(uint32)(dp->tdir_count),data);
5361
					if (data!=0)
5362
						_TIFFfree(data);
5363
					if (!m)
5364
						return(0);
5365
				}
5366
			}
5367
			break;
5368
		case TIFF_SETGET_C32_UINT16:
5369
			{
5370
				uint16* data;
5371
				assert(fip->field_readcount==TIFF_VARIABLE2);
5372
				assert(fip->field_passcount==1);
5373
				err=TIFFReadDirEntryShortArray(tif,dp,&data);
5374
				if (err==TIFFReadDirEntryErrOk)
5375
				{
5376
					int m;
5377
					m=TIFFSetField(tif,dp->tdir_tag,(uint32)(dp->tdir_count),data);
5378
					if (data!=0)
5379
						_TIFFfree(data);
5380
					if (!m)
5381
						return(0);
5382
				}
5383
			}
5384
			break;
5385
		case TIFF_SETGET_C32_SINT16:
5386
			{
5387
				int16* data = NULL;
5388
				assert(fip->field_readcount==TIFF_VARIABLE2);
5389
				assert(fip->field_passcount==1);
5390
				err=TIFFReadDirEntrySshortArray(tif,dp,&data);
5391
				if (err==TIFFReadDirEntryErrOk)
5392
				{
5393
					int m;
5394
					m=TIFFSetField(tif,dp->tdir_tag,(uint32)(dp->tdir_count),data);
5395
					if (data!=0)
5396
						_TIFFfree(data);
5397
					if (!m)
5398
						return(0);
5399
				}
5400
			}
5401
			break;
5402
		case TIFF_SETGET_C32_UINT32:
5403
			{
5404
				uint32* data;
5405
				assert(fip->field_readcount==TIFF_VARIABLE2);
5406
				assert(fip->field_passcount==1);
5407
				err=TIFFReadDirEntryLongArray(tif,dp,&data);
5408
				if (err==TIFFReadDirEntryErrOk)
5409
				{
5410
					int m;
5411
					m=TIFFSetField(tif,dp->tdir_tag,(uint32)(dp->tdir_count),data);
5412
					if (data!=0)
5413
						_TIFFfree(data);
5414
					if (!m)
5415
						return(0);
5416
				}
5417
			}
5418
			break;
5419
		case TIFF_SETGET_C32_SINT32:
5420
			{
5421
				int32* data = NULL;
5422
				assert(fip->field_readcount==TIFF_VARIABLE2);
5423
				assert(fip->field_passcount==1);
5424
				err=TIFFReadDirEntrySlongArray(tif,dp,&data);
5425
				if (err==TIFFReadDirEntryErrOk)
5426
				{
5427
					int m;
5428
					m=TIFFSetField(tif,dp->tdir_tag,(uint32)(dp->tdir_count),data);
5429
					if (data!=0)
5430
						_TIFFfree(data);
5431
					if (!m)
5432
						return(0);
5433
				}
5434
			}
5435
			break;
5436
		case TIFF_SETGET_C32_UINT64:
5437
			{
5438
				uint64* data;
5439
				assert(fip->field_readcount==TIFF_VARIABLE2);
5440
				assert(fip->field_passcount==1);
5441
				err=TIFFReadDirEntryLong8Array(tif,dp,&data);
5442
				if (err==TIFFReadDirEntryErrOk)
5443
				{
5444
					int m;
5445
					m=TIFFSetField(tif,dp->tdir_tag,(uint32)(dp->tdir_count),data);
5446
					if (data!=0)
5447
						_TIFFfree(data);
5448
					if (!m)
5449
						return(0);
5450
				}
5451
			}
5452
			break;
5453
		case TIFF_SETGET_C32_SINT64:
5454
			{
5455
				int64* data = NULL;
5456
				assert(fip->field_readcount==TIFF_VARIABLE2);
5457
				assert(fip->field_passcount==1);
5458
				err=TIFFReadDirEntrySlong8Array(tif,dp,&data);
5459
				if (err==TIFFReadDirEntryErrOk)
5460
				{
5461
					int m;
5462
					m=TIFFSetField(tif,dp->tdir_tag,(uint32)(dp->tdir_count),data);
5463
					if (data!=0)
5464
						_TIFFfree(data);
5465
					if (!m)
5466
						return(0);
5467
				}
5468
			}
5469
			break;
5470
		case TIFF_SETGET_C32_FLOAT:
5471
			{
5472
				float* data;
5473
				assert(fip->field_readcount==TIFF_VARIABLE2);
5474
				assert(fip->field_passcount==1);
5475
				err=TIFFReadDirEntryFloatArray(tif,dp,&data);
5476
				if (err==TIFFReadDirEntryErrOk)
5477
				{
5478
					int m;
5479
					m=TIFFSetField(tif,dp->tdir_tag,(uint32)(dp->tdir_count),data);
5480
					if (data!=0)
5481
						_TIFFfree(data);
5482
					if (!m)
5483
						return(0);
5484
				}
5485
			}
5486
			break;
5487
		case TIFF_SETGET_C32_DOUBLE:
5488
			{
5489
				double* data;
5490
				assert(fip->field_readcount==TIFF_VARIABLE2);
5491
				assert(fip->field_passcount==1);
5492
				err=TIFFReadDirEntryDoubleArray(tif,dp,&data);
5493
				if (err==TIFFReadDirEntryErrOk)
5494
				{
5495
					int m;
5496
					m=TIFFSetField(tif,dp->tdir_tag,(uint32)(dp->tdir_count),data);
5497
					if (data!=0)
5498
						_TIFFfree(data);
5499
					if (!m)
5500
						return(0);
5501
				}
5502
			}
5503
			break;
5504
		case TIFF_SETGET_C32_IFD8:
5505
			{
5506
				uint64* data;
5507
				assert(fip->field_readcount==TIFF_VARIABLE2);
5508
				assert(fip->field_passcount==1);
5509
				err=TIFFReadDirEntryIfd8Array(tif,dp,&data);
5510
				if (err==TIFFReadDirEntryErrOk)
5511
				{
5512
					int m;
5513
					m=TIFFSetField(tif,dp->tdir_tag,(uint32)(dp->tdir_count),data);
5514
					if (data!=0)
5515
						_TIFFfree(data);
5516
					if (!m)
5517
						return(0);
5518
				}
5519
			}
5520
			break;
5521
		default:
5522
			assert(0);    /* we should never get here */
5523
			break;
5524
	}
5525
	if (err!=TIFFReadDirEntryErrOk)
5526
	{
5527
		TIFFReadDirEntryOutputErr(tif,err,module,fip->field_name,recover);
5528
		return(0);
5529
	}
5530
	return(1);
5531
}
5532

5533
/*
5534
 * Fetch a set of offsets or lengths.
5535
 * While this routine says "strips", in fact it's also used for tiles.
5536
 */
5537
static int
5538
TIFFFetchStripThing(TIFF* tif, TIFFDirEntry* dir, uint32 nstrips, uint64** lpp)
5539
{
5540
	static const char module[] = "TIFFFetchStripThing";
5541
	enum TIFFReadDirEntryErr err;
5542
	uint64* data;
5543
	err=TIFFReadDirEntryLong8ArrayWithLimit(tif,dir,&data,nstrips);
5544
	if (err!=TIFFReadDirEntryErrOk)
5545
	{
5546
		const TIFFField* fip = TIFFFieldWithTag(tif,dir->tdir_tag); 
5547
		TIFFReadDirEntryOutputErr(tif,err,module,fip ? fip->field_name : "unknown tagname",0);
5548
		return(0);
5549
	}
5550
	if (dir->tdir_count<(uint64)nstrips)
5551
	{
5552
		uint64* resizeddata;
5553
		const TIFFField* fip = TIFFFieldWithTag(tif,dir->tdir_tag);
5554
		const char* pszMax = getenv("LIBTIFF_STRILE_ARRAY_MAX_RESIZE_COUNT");
5555
		uint32 max_nstrips = 1000000;
5556
		if( pszMax )
5557
			max_nstrips = (uint32) atoi(pszMax);
5558
		TIFFReadDirEntryOutputErr(tif,TIFFReadDirEntryErrCount,
5559
		            module,
5560
		            fip ? fip->field_name : "unknown tagname",
5561
		            ( nstrips <= max_nstrips ) );
5562

5563
		if( nstrips > max_nstrips )
5564
		{
5565
			_TIFFfree(data);
5566
			return(0);
5567
		}
5568

5569
		resizeddata=(uint64*)_TIFFCheckMalloc(tif,nstrips,sizeof(uint64),"for strip array");
5570
		if (resizeddata==0) {
5571
			_TIFFfree(data);
5572
			return(0);
5573
		}
5574
                _TIFFmemcpy(resizeddata,data,(uint32)dir->tdir_count*sizeof(uint64));
5575
                _TIFFmemset(resizeddata+(uint32)dir->tdir_count,0,(nstrips-(uint32)dir->tdir_count)*sizeof(uint64));
5576
		_TIFFfree(data);
5577
		data=resizeddata;
5578
	}
5579
	*lpp=data;
5580
	return(1);
5581
}
5582

5583
/*
5584
 * Fetch and set the SubjectDistance EXIF tag.
5585
 */
5586
static int
5587
TIFFFetchSubjectDistance(TIFF* tif, TIFFDirEntry* dir)
5588
{
5589
	static const char module[] = "TIFFFetchSubjectDistance";
5590
	enum TIFFReadDirEntryErr err;
5591
	UInt64Aligned_t m;
5592
    m.l=0;
5593
	assert(sizeof(double)==8);
5594
	assert(sizeof(uint64)==8);
5595
	assert(sizeof(uint32)==4);
5596
	if (dir->tdir_count!=1)
5597
		err=TIFFReadDirEntryErrCount;
5598
	else if (dir->tdir_type!=TIFF_RATIONAL)
5599
		err=TIFFReadDirEntryErrType;
5600
	else
5601
	{
5602
		if (!(tif->tif_flags&TIFF_BIGTIFF))
5603
		{
5604
			uint32 offset;
5605
			offset=*(uint32*)(&dir->tdir_offset);
5606
			if (tif->tif_flags&TIFF_SWAB)
5607
				TIFFSwabLong(&offset);
5608
			err=TIFFReadDirEntryData(tif,offset,8,m.i);
5609
		}
5610
		else
5611
		{
5612
			m.l=dir->tdir_offset.toff_long8;
5613
			err=TIFFReadDirEntryErrOk;
5614
		}
5615
	}
5616
	if (err==TIFFReadDirEntryErrOk)
5617
	{
5618
		double n;
5619
		if (tif->tif_flags&TIFF_SWAB)
5620
			TIFFSwabArrayOfLong(m.i,2);
5621
		if (m.i[0]==0)
5622
			n=0.0;
5623
		else if (m.i[0]==0xFFFFFFFF)
5624
			/*
5625
			 * XXX: Numerator 0xFFFFFFFF means that we have infinite
5626
			 * distance. Indicate that with a negative floating point
5627
			 * SubjectDistance value.
5628
			 */
5629
			n=-1.0;
5630
		else
5631
			n=(double)m.i[0]/(double)m.i[1];
5632
		return(TIFFSetField(tif,dir->tdir_tag,n));
5633
	}
5634
	else
5635
	{
5636
		TIFFReadDirEntryOutputErr(tif,err,module,"SubjectDistance",TRUE);
5637
		return(0);
5638
	}
5639
}
5640

5641
/*
5642
 * Replace a single strip (tile) of uncompressed data by multiple strips
5643
 * (tiles), each approximately STRIP_SIZE_DEFAULT bytes. This is useful for
5644
 * dealing with large images or for dealing with machines with a limited
5645
 * amount memory.
5646
 */
5647
static void
5648
ChopUpSingleUncompressedStrip(TIFF* tif)
5649
{
5650
	register TIFFDirectory *td = &tif->tif_dir;
5651
	uint64 bytecount;
5652
	uint64 offset;
5653
	uint32 rowblock;
5654
	uint64 rowblockbytes;
5655
	uint64 stripbytes;
5656
	uint32 strip;
5657
	uint32 nstrips;
5658
	uint32 rowsperstrip;
5659
	uint64* newcounts;
5660
	uint64* newoffsets;
5661

5662
	bytecount = td->td_stripbytecount[0];
5663
        /* On a newly created file, just re-opened to be filled, we */
5664
        /* don't want strip chop to trigger as it is going to cause issues */
5665
        /* later ( StripOffsets and StripByteCounts improperly filled) . */
5666
        if( bytecount == 0 && tif->tif_mode != O_RDONLY )
5667
            return;
5668
	offset = td->td_stripoffset[0];
5669
	assert(td->td_planarconfig == PLANARCONFIG_CONTIG);
5670
	if ((td->td_photometric == PHOTOMETRIC_YCBCR)&&
5671
	    (!isUpSampled(tif)))
5672
		rowblock = td->td_ycbcrsubsampling[1];
5673
	else
5674
		rowblock = 1;
5675
	rowblockbytes = TIFFVTileSize64(tif, rowblock);
5676
	/*
5677
	 * Make the rows hold at least one scanline, but fill specified amount
5678
	 * of data if possible.
5679
	 */
5680
	if (rowblockbytes > STRIP_SIZE_DEFAULT) {
5681
		stripbytes = rowblockbytes;
5682
		rowsperstrip = rowblock;
5683
	} else if (rowblockbytes > 0 ) {
5684
		uint32 rowblocksperstrip;
5685
		rowblocksperstrip = (uint32) (STRIP_SIZE_DEFAULT / rowblockbytes);
5686
		rowsperstrip = rowblocksperstrip * rowblock;
5687
		stripbytes = rowblocksperstrip * rowblockbytes;
5688
	}
5689
	else
5690
	    return;
5691

5692
	/*
5693
	 * never increase the number of rows per strip
5694
	 */
5695
	if (rowsperstrip >= td->td_rowsperstrip)
5696
		return;
5697
        nstrips = TIFFhowmany_32(td->td_imagelength, rowsperstrip);
5698
        if( nstrips == 0 )
5699
            return;
5700

5701
	newcounts = (uint64*) _TIFFCheckMalloc(tif, nstrips, sizeof (uint64),
5702
				"for chopped \"StripByteCounts\" array");
5703
	newoffsets = (uint64*) _TIFFCheckMalloc(tif, nstrips, sizeof (uint64),
5704
				"for chopped \"StripOffsets\" array");
5705
	if (newcounts == NULL || newoffsets == NULL) {
5706
		/*
5707
		 * Unable to allocate new strip information, give up and use
5708
		 * the original one strip information.
5709
		 */
5710
		if (newcounts != NULL)
5711
			_TIFFfree(newcounts);
5712
		if (newoffsets != NULL)
5713
			_TIFFfree(newoffsets);
5714
		return;
5715
	}
5716
	/*
5717
	 * Fill the strip information arrays with new bytecounts and offsets
5718
	 * that reflect the broken-up format.
5719
	 */
5720
	for (strip = 0; strip < nstrips; strip++) {
5721
		if (stripbytes > bytecount)
5722
			stripbytes = bytecount;
5723
		newcounts[strip] = stripbytes;
5724
		newoffsets[strip] = stripbytes ? offset : 0;
5725
		offset += stripbytes;
5726
		bytecount -= stripbytes;
5727
	}
5728
	/*
5729
	 * Replace old single strip info with multi-strip info.
5730
	 */
5731
	td->td_stripsperimage = td->td_nstrips = nstrips;
5732
	TIFFSetField(tif, TIFFTAG_ROWSPERSTRIP, rowsperstrip);
5733

5734
	_TIFFfree(td->td_stripbytecount);
5735
	_TIFFfree(td->td_stripoffset);
5736
	td->td_stripbytecount = newcounts;
5737
	td->td_stripoffset = newoffsets;
5738
	td->td_stripbytecountsorted = 1;
5739
}
5740

5741
int _TIFFFillStriles( TIFF *tif )
5742
{
5743
    return _TIFFFillStrilesInternal( tif, 1 );
5744
}
5745

5746
static int _TIFFFillStrilesInternal( TIFF *tif, int loadStripByteCount )
5747
{
5748
#if defined(DEFER_STRILE_LOAD)
5749
        register TIFFDirectory *td = &tif->tif_dir;
5750
        int return_value = 1;
5751

5752
        if( td->td_stripoffset != NULL )
5753
                return 1;
5754

5755
        if( td->td_stripoffset_entry.tdir_count == 0 )
5756
                return 0;
5757

5758
        if (!TIFFFetchStripThing(tif,&(td->td_stripoffset_entry),
5759
                                 td->td_nstrips,&td->td_stripoffset))
5760
        {
5761
                return_value = 0;
5762
        }
5763

5764
        if (loadStripByteCount &&
5765
            !TIFFFetchStripThing(tif,&(td->td_stripbytecount_entry),
5766
                                 td->td_nstrips,&td->td_stripbytecount))
5767
        {
5768
                return_value = 0;
5769
        }
5770

5771
        _TIFFmemset( &(td->td_stripoffset_entry), 0, sizeof(TIFFDirEntry));
5772
        _TIFFmemset( &(td->td_stripbytecount_entry), 0, sizeof(TIFFDirEntry));
5773

5774
	if (tif->tif_dir.td_nstrips > 1 && return_value == 1 ) {
5775
		uint32 strip;
5776

5777
		tif->tif_dir.td_stripbytecountsorted = 1;
5778
		for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++) {
5779
			if (tif->tif_dir.td_stripoffset[strip - 1] >
5780
			    tif->tif_dir.td_stripoffset[strip]) {
5781
				tif->tif_dir.td_stripbytecountsorted = 0;
5782
				break;
5783
			}
5784
		}
5785
	}
5786

5787
        return return_value;
5788
#else /* !defined(DEFER_STRILE_LOAD) */
5789
        (void) tif;
5790
        (void) loadStripByteCount;
5791
        return 1;
5792
#endif 
5793
}
5794

5795

5796
/* vim: set ts=8 sts=8 sw=8 noet: */
5797
/*
5798
 * Local Variables:
5799
 * mode: c
5800
 * c-basic-offset: 8
5801
 * fill-column: 78
5802
 * End:
5803
 */
5804

5805
Product

Resources

Company
