Book a Demo!
CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutPoliciesSign UpSign In
Tetragramm
GitHub Repository: Tetragramm/opencv
Path: blob/master/3rdparty/libtiff/tif_read.c
16337 views
1
/* $Id: tif_read.c,v 1.66 2017-11-17 20:21:00 erouault Exp $ */
2
3
/*
4
* Copyright (c) 1988-1997 Sam Leffler
5
* Copyright (c) 1991-1997 Silicon Graphics, Inc.
6
*
7
* Permission to use, copy, modify, distribute, and sell this software and
8
* its documentation for any purpose is hereby granted without fee, provided
9
* that (i) the above copyright notices and this permission notice appear in
10
* all copies of the software and related documentation, and (ii) the names of
11
* Sam Leffler and Silicon Graphics may not be used in any advertising or
12
* publicity relating to the software without the specific, prior written
13
* permission of Sam Leffler and Silicon Graphics.
14
*
15
* THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND,
16
* EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY
17
* WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
18
*
19
* IN NO EVENT SHALL SAM LEFFLER OR SILICON GRAPHICS BE LIABLE FOR
20
* ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND,
21
* OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
22
* WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF
23
* LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
24
* OF THIS SOFTWARE.
25
*/
26
27
/*
28
* TIFF Library.
29
* Scanline-oriented Read Support
30
*/
31
#include "tiffiop.h"
32
#include <stdio.h>
33
34
#define TIFF_SIZE_T_MAX ((size_t) ~ ((size_t)0))
35
#define TIFF_TMSIZE_T_MAX (tmsize_t)(TIFF_SIZE_T_MAX >> 1)
36
37
int TIFFFillStrip(TIFF* tif, uint32 strip);
38
int TIFFFillTile(TIFF* tif, uint32 tile);
39
static int TIFFStartStrip(TIFF* tif, uint32 strip);
40
static int TIFFStartTile(TIFF* tif, uint32 tile);
41
static int TIFFCheckRead(TIFF*, int);
42
static tmsize_t
43
TIFFReadRawStrip1(TIFF* tif, uint32 strip, void* buf, tmsize_t size,const char* module);
44
static tmsize_t
45
TIFFReadRawTile1(TIFF* tif, uint32 tile, void* buf, tmsize_t size, const char* module);
46
47
#define NOSTRIP ((uint32)(-1)) /* undefined state */
48
#define NOTILE ((uint32)(-1)) /* undefined state */
49
50
#define INITIAL_THRESHOLD (1024 * 1024)
51
#define THRESHOLD_MULTIPLIER 10
52
#define MAX_THRESHOLD (THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER * INITIAL_THRESHOLD)
53
54
/* Read 'size' bytes in tif_rawdata buffer starting at offset 'rawdata_offset'
55
* Returns 1 in case of success, 0 otherwise. */
56
static int TIFFReadAndRealloc( TIFF* tif, tmsize_t size,
57
tmsize_t rawdata_offset,
58
int is_strip, uint32 strip_or_tile,
59
const char* module )
60
{
61
#if SIZEOF_VOIDP == 8 || SIZEOF_SIZE_T == 8
62
tmsize_t threshold = INITIAL_THRESHOLD;
63
#endif
64
tmsize_t already_read = 0;
65
66
/* On 64 bit processes, read first a maximum of 1 MB, then 10 MB, etc */
67
/* so as to avoid allocating too much memory in case the file is too */
68
/* short. We could ask for the file size, but this might be */
69
/* expensive with some I/O layers (think of reading a gzipped file) */
70
/* Restrict to 64 bit processes, so as to avoid reallocs() */
71
/* on 32 bit processes where virtual memory is scarce. */
72
while( already_read < size )
73
{
74
tmsize_t bytes_read;
75
tmsize_t to_read = size - already_read;
76
#if SIZEOF_VOIDP == 8 || SIZEOF_SIZE_T == 8
77
if( to_read >= threshold && threshold < MAX_THRESHOLD &&
78
already_read + to_read + rawdata_offset > tif->tif_rawdatasize )
79
{
80
to_read = threshold;
81
threshold *= THRESHOLD_MULTIPLIER;
82
}
83
#endif
84
if (already_read + to_read + rawdata_offset > tif->tif_rawdatasize) {
85
uint8* new_rawdata;
86
assert((tif->tif_flags & TIFF_MYBUFFER) != 0);
87
tif->tif_rawdatasize = (tmsize_t)TIFFroundup_64(
88
(uint64)already_read + to_read + rawdata_offset, 1024);
89
if (tif->tif_rawdatasize==0) {
90
TIFFErrorExt(tif->tif_clientdata, module,
91
"Invalid buffer size");
92
return 0;
93
}
94
new_rawdata = (uint8*) _TIFFrealloc(
95
tif->tif_rawdata, tif->tif_rawdatasize);
96
if( new_rawdata == 0 )
97
{
98
TIFFErrorExt(tif->tif_clientdata, module,
99
"No space for data buffer at scanline %lu",
100
(unsigned long) tif->tif_row);
101
_TIFFfree(tif->tif_rawdata);
102
tif->tif_rawdata = 0;
103
tif->tif_rawdatasize = 0;
104
return 0;
105
}
106
tif->tif_rawdata = new_rawdata;
107
}
108
109
bytes_read = TIFFReadFile(tif,
110
tif->tif_rawdata + rawdata_offset + already_read, to_read);
111
already_read += bytes_read;
112
if (bytes_read != to_read) {
113
memset( tif->tif_rawdata + rawdata_offset + already_read, 0,
114
tif->tif_rawdatasize - rawdata_offset - already_read );
115
#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
116
if( is_strip )
117
{
118
TIFFErrorExt(tif->tif_clientdata, module,
119
"Read error at scanline %lu; got %I64u bytes, "
120
"expected %I64u",
121
(unsigned long) tif->tif_row,
122
(unsigned __int64) already_read,
123
(unsigned __int64) size);
124
}
125
else
126
{
127
TIFFErrorExt(tif->tif_clientdata, module,
128
"Read error at row %lu, col %lu, tile %lu; "
129
"got %I64u bytes, expected %I64u",
130
(unsigned long) tif->tif_row,
131
(unsigned long) tif->tif_col,
132
(unsigned long) strip_or_tile,
133
(unsigned __int64) already_read,
134
(unsigned __int64) size);
135
}
136
#else
137
if( is_strip )
138
{
139
TIFFErrorExt(tif->tif_clientdata, module,
140
"Read error at scanline %lu; got %llu bytes, "
141
"expected %llu",
142
(unsigned long) tif->tif_row,
143
(unsigned long long) already_read,
144
(unsigned long long) size);
145
}
146
else
147
{
148
TIFFErrorExt(tif->tif_clientdata, module,
149
"Read error at row %lu, col %lu, tile %lu; "
150
"got %llu bytes, expected %llu",
151
(unsigned long) tif->tif_row,
152
(unsigned long) tif->tif_col,
153
(unsigned long) strip_or_tile,
154
(unsigned long long) already_read,
155
(unsigned long long) size);
156
}
157
#endif
158
return 0;
159
}
160
}
161
return 1;
162
}
163
164
165
static int
166
TIFFFillStripPartial( TIFF *tif, int strip, tmsize_t read_ahead, int restart )
167
{
168
static const char module[] = "TIFFFillStripPartial";
169
register TIFFDirectory *td = &tif->tif_dir;
170
tmsize_t unused_data;
171
uint64 read_offset;
172
tmsize_t to_read;
173
tmsize_t read_ahead_mod;
174
/* tmsize_t bytecountm; */
175
176
if (!_TIFFFillStriles( tif ) || !tif->tif_dir.td_stripbytecount)
177
return 0;
178
179
/*
180
* Expand raw data buffer, if needed, to hold data
181
* strip coming from file (perhaps should set upper
182
* bound on the size of a buffer we'll use?).
183
*/
184
185
/* bytecountm=(tmsize_t) td->td_stripbytecount[strip]; */
186
187
/* Not completely sure where the * 2 comes from, but probably for */
188
/* an exponentional growth strategy of tif_rawdatasize */
189
if( read_ahead < TIFF_TMSIZE_T_MAX / 2 )
190
read_ahead_mod = read_ahead * 2;
191
else
192
read_ahead_mod = read_ahead;
193
if (read_ahead_mod > tif->tif_rawdatasize) {
194
assert( restart );
195
196
tif->tif_curstrip = NOSTRIP;
197
if ((tif->tif_flags & TIFF_MYBUFFER) == 0) {
198
TIFFErrorExt(tif->tif_clientdata, module,
199
"Data buffer too small to hold part of strip %lu",
200
(unsigned long) strip);
201
return (0);
202
}
203
}
204
205
if( restart )
206
{
207
tif->tif_rawdataloaded = 0;
208
tif->tif_rawdataoff = 0;
209
}
210
211
/*
212
** If we are reading more data, move any unused data to the
213
** start of the buffer.
214
*/
215
if( tif->tif_rawdataloaded > 0 )
216
unused_data = tif->tif_rawdataloaded - (tif->tif_rawcp - tif->tif_rawdata);
217
else
218
unused_data = 0;
219
220
if( unused_data > 0 )
221
{
222
assert((tif->tif_flags&TIFF_BUFFERMMAP)==0);
223
memmove( tif->tif_rawdata, tif->tif_rawcp, unused_data );
224
}
225
226
/*
227
** Seek to the point in the file where more data should be read.
228
*/
229
read_offset = td->td_stripoffset[strip]
230
+ tif->tif_rawdataoff + tif->tif_rawdataloaded;
231
232
if (!SeekOK(tif, read_offset)) {
233
TIFFErrorExt(tif->tif_clientdata, module,
234
"Seek error at scanline %lu, strip %lu",
235
(unsigned long) tif->tif_row, (unsigned long) strip);
236
return 0;
237
}
238
239
/*
240
** How much do we want to read?
241
*/
242
if( read_ahead_mod > tif->tif_rawdatasize )
243
to_read = read_ahead_mod - unused_data;
244
else
245
to_read = tif->tif_rawdatasize - unused_data;
246
if( (uint64) to_read > td->td_stripbytecount[strip]
247
- tif->tif_rawdataoff - tif->tif_rawdataloaded )
248
{
249
to_read = (tmsize_t) td->td_stripbytecount[strip]
250
- tif->tif_rawdataoff - tif->tif_rawdataloaded;
251
}
252
253
assert((tif->tif_flags&TIFF_BUFFERMMAP)==0);
254
if( !TIFFReadAndRealloc( tif, to_read, unused_data,
255
1, /* is_strip */
256
0, /* strip_or_tile */
257
module) )
258
{
259
return 0;
260
}
261
262
tif->tif_rawdataoff = tif->tif_rawdataoff + tif->tif_rawdataloaded - unused_data ;
263
tif->tif_rawdataloaded = unused_data + to_read;
264
265
tif->tif_rawcc = tif->tif_rawdataloaded;
266
tif->tif_rawcp = tif->tif_rawdata;
267
268
if (!isFillOrder(tif, td->td_fillorder) &&
269
(tif->tif_flags & TIFF_NOBITREV) == 0) {
270
assert((tif->tif_flags&TIFF_BUFFERMMAP)==0);
271
TIFFReverseBits(tif->tif_rawdata + unused_data, to_read );
272
}
273
274
/*
275
** When starting a strip from the beginning we need to
276
** restart the decoder.
277
*/
278
if( restart )
279
{
280
281
#ifdef JPEG_SUPPORT
282
/* A bit messy since breaks the codec abstraction. Ultimately */
283
/* there should be a function pointer for that, but it seems */
284
/* only JPEG is affected. */
285
/* For JPEG, if there are multiple scans (can generally be known */
286
/* with the read_ahead used), we need to read the whole strip */
287
if( tif->tif_dir.td_compression==COMPRESSION_JPEG &&
288
(uint64)tif->tif_rawcc < td->td_stripbytecount[strip] )
289
{
290
if( TIFFJPEGIsFullStripRequired(tif) )
291
{
292
return TIFFFillStrip(tif, strip);
293
}
294
}
295
#endif
296
297
return TIFFStartStrip(tif, strip);
298
}
299
else
300
{
301
return 1;
302
}
303
}
304
305
/*
306
* Seek to a random row+sample in a file.
307
*
308
* Only used by TIFFReadScanline, and is only used on
309
* strip organized files. We do some tricky stuff to try
310
* and avoid reading the whole compressed raw data for big
311
* strips.
312
*/
313
static int
314
TIFFSeek(TIFF* tif, uint32 row, uint16 sample )
315
{
316
register TIFFDirectory *td = &tif->tif_dir;
317
uint32 strip;
318
int whole_strip;
319
tmsize_t read_ahead = 0;
320
321
/*
322
** Establish what strip we are working from.
323
*/
324
if (row >= td->td_imagelength) { /* out of range */
325
TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
326
"%lu: Row out of range, max %lu",
327
(unsigned long) row,
328
(unsigned long) td->td_imagelength);
329
return (0);
330
}
331
if (td->td_planarconfig == PLANARCONFIG_SEPARATE) {
332
if (sample >= td->td_samplesperpixel) {
333
TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
334
"%lu: Sample out of range, max %lu",
335
(unsigned long) sample, (unsigned long) td->td_samplesperpixel);
336
return (0);
337
}
338
strip = (uint32)sample*td->td_stripsperimage + row/td->td_rowsperstrip;
339
} else
340
strip = row / td->td_rowsperstrip;
341
342
/*
343
* Do we want to treat this strip as one whole chunk or
344
* read it a few lines at a time?
345
*/
346
#if defined(CHUNKY_STRIP_READ_SUPPORT)
347
if (!_TIFFFillStriles( tif ) || !tif->tif_dir.td_stripbytecount)
348
return 0;
349
whole_strip = tif->tif_dir.td_stripbytecount[strip] < 10
350
|| isMapped(tif);
351
#else
352
whole_strip = 1;
353
#endif
354
355
if( !whole_strip )
356
{
357
/* 16 is for YCbCr mode where we may need to read 16 */
358
/* lines at a time to get a decompressed line, and 5000 */
359
/* is some constant value, for example for JPEG tables */
360
if( tif->tif_scanlinesize < TIFF_TMSIZE_T_MAX / 16 &&
361
tif->tif_scanlinesize * 16 < TIFF_TMSIZE_T_MAX - 5000 )
362
{
363
read_ahead = tif->tif_scanlinesize * 16 + 5000;
364
}
365
else
366
{
367
read_ahead = tif->tif_scanlinesize;
368
}
369
}
370
371
/*
372
* If we haven't loaded this strip, do so now, possibly
373
* only reading the first part.
374
*/
375
if (strip != tif->tif_curstrip) { /* different strip, refill */
376
377
if( whole_strip )
378
{
379
if (!TIFFFillStrip(tif, strip))
380
return (0);
381
}
382
else
383
{
384
if( !TIFFFillStripPartial(tif,strip,read_ahead,1) )
385
return 0;
386
}
387
}
388
389
/*
390
** If we already have some data loaded, do we need to read some more?
391
*/
392
else if( !whole_strip )
393
{
394
if( ((tif->tif_rawdata + tif->tif_rawdataloaded) - tif->tif_rawcp) < read_ahead
395
&& (uint64) tif->tif_rawdataoff+tif->tif_rawdataloaded < td->td_stripbytecount[strip] )
396
{
397
if( !TIFFFillStripPartial(tif,strip,read_ahead,0) )
398
return 0;
399
}
400
}
401
402
if (row < tif->tif_row) {
403
/*
404
* Moving backwards within the same strip: backup
405
* to the start and then decode forward (below).
406
*
407
* NB: If you're planning on lots of random access within a
408
* strip, it's better to just read and decode the entire
409
* strip, and then access the decoded data in a random fashion.
410
*/
411
412
if( tif->tif_rawdataoff != 0 )
413
{
414
if( !TIFFFillStripPartial(tif,strip,read_ahead,1) )
415
return 0;
416
}
417
else
418
{
419
if (!TIFFStartStrip(tif, strip))
420
return (0);
421
}
422
}
423
424
if (row != tif->tif_row) {
425
/*
426
* Seek forward to the desired row.
427
*/
428
429
/* TODO: Will this really work with partial buffers? */
430
431
if (!(*tif->tif_seek)(tif, row - tif->tif_row))
432
return (0);
433
tif->tif_row = row;
434
}
435
436
return (1);
437
}
438
439
int
440
TIFFReadScanline(TIFF* tif, void* buf, uint32 row, uint16 sample)
441
{
442
int e;
443
444
if (!TIFFCheckRead(tif, 0))
445
return (-1);
446
if( (e = TIFFSeek(tif, row, sample)) != 0) {
447
/*
448
* Decompress desired row into user buffer.
449
*/
450
e = (*tif->tif_decoderow)
451
(tif, (uint8*) buf, tif->tif_scanlinesize, sample);
452
453
/* we are now poised at the beginning of the next row */
454
tif->tif_row = row + 1;
455
456
if (e)
457
(*tif->tif_postdecode)(tif, (uint8*) buf,
458
tif->tif_scanlinesize);
459
}
460
return (e > 0 ? 1 : -1);
461
}
462
463
/*
464
* Calculate the strip size according to the number of
465
* rows in the strip (check for truncated last strip on any
466
* of the separations).
467
*/
468
static tmsize_t TIFFReadEncodedStripGetStripSize(TIFF* tif, uint32 strip, uint16* pplane)
469
{
470
static const char module[] = "TIFFReadEncodedStrip";
471
TIFFDirectory *td = &tif->tif_dir;
472
uint32 rowsperstrip;
473
uint32 stripsperplane;
474
uint32 stripinplane;
475
uint32 rows;
476
tmsize_t stripsize;
477
if (!TIFFCheckRead(tif,0))
478
return((tmsize_t)(-1));
479
if (strip>=td->td_nstrips)
480
{
481
TIFFErrorExt(tif->tif_clientdata,module,
482
"%lu: Strip out of range, max %lu",(unsigned long)strip,
483
(unsigned long)td->td_nstrips);
484
return((tmsize_t)(-1));
485
}
486
487
rowsperstrip=td->td_rowsperstrip;
488
if (rowsperstrip>td->td_imagelength)
489
rowsperstrip=td->td_imagelength;
490
stripsperplane= TIFFhowmany_32_maxuint_compat(td->td_imagelength, rowsperstrip);
491
stripinplane=(strip%stripsperplane);
492
if( pplane ) *pplane=(uint16)(strip/stripsperplane);
493
rows=td->td_imagelength-stripinplane*rowsperstrip;
494
if (rows>rowsperstrip)
495
rows=rowsperstrip;
496
stripsize=TIFFVStripSize(tif,rows);
497
if (stripsize==0)
498
return((tmsize_t)(-1));
499
return stripsize;
500
}
501
502
/*
503
* Read a strip of data and decompress the specified
504
* amount into the user-supplied buffer.
505
*/
506
tmsize_t
507
TIFFReadEncodedStrip(TIFF* tif, uint32 strip, void* buf, tmsize_t size)
508
{
509
static const char module[] = "TIFFReadEncodedStrip";
510
TIFFDirectory *td = &tif->tif_dir;
511
tmsize_t stripsize;
512
uint16 plane;
513
514
stripsize=TIFFReadEncodedStripGetStripSize(tif, strip, &plane);
515
if (stripsize==((tmsize_t)(-1)))
516
return((tmsize_t)(-1));
517
518
/* shortcut to avoid an extra memcpy() */
519
if( td->td_compression == COMPRESSION_NONE &&
520
size!=(tmsize_t)(-1) && size >= stripsize &&
521
!isMapped(tif) &&
522
((tif->tif_flags&TIFF_NOREADRAW)==0) )
523
{
524
if (TIFFReadRawStrip1(tif, strip, buf, stripsize, module) != stripsize)
525
return ((tmsize_t)(-1));
526
527
if (!isFillOrder(tif, td->td_fillorder) &&
528
(tif->tif_flags & TIFF_NOBITREV) == 0)
529
TIFFReverseBits(buf,stripsize);
530
531
(*tif->tif_postdecode)(tif,buf,stripsize);
532
return (stripsize);
533
}
534
535
if ((size!=(tmsize_t)(-1))&&(size<stripsize))
536
stripsize=size;
537
if (!TIFFFillStrip(tif,strip))
538
return((tmsize_t)(-1));
539
if ((*tif->tif_decodestrip)(tif,buf,stripsize,plane)<=0)
540
return((tmsize_t)(-1));
541
(*tif->tif_postdecode)(tif,buf,stripsize);
542
return(stripsize);
543
}
544
545
/* Variant of TIFFReadEncodedStrip() that does
546
* * if *buf == NULL, *buf = _TIFFmalloc(bufsizetoalloc) only after TIFFFillStrip() has
547
* succeeded. This avoid excessive memory allocation in case of truncated
548
* file.
549
* * calls regular TIFFReadEncodedStrip() if *buf != NULL
550
*/
551
tmsize_t
552
_TIFFReadEncodedStripAndAllocBuffer(TIFF* tif, uint32 strip,
553
void **buf, tmsize_t bufsizetoalloc,
554
tmsize_t size_to_read)
555
{
556
tmsize_t this_stripsize;
557
uint16 plane;
558
559
if( *buf != NULL )
560
{
561
return TIFFReadEncodedStrip(tif, strip, *buf, size_to_read);
562
}
563
564
this_stripsize=TIFFReadEncodedStripGetStripSize(tif, strip, &plane);
565
if (this_stripsize==((tmsize_t)(-1)))
566
return((tmsize_t)(-1));
567
568
if ((size_to_read!=(tmsize_t)(-1))&&(size_to_read<this_stripsize))
569
this_stripsize=size_to_read;
570
if (!TIFFFillStrip(tif,strip))
571
return((tmsize_t)(-1));
572
573
*buf = _TIFFmalloc(bufsizetoalloc);
574
if (*buf == NULL) {
575
TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "No space for strip buffer");
576
return((tmsize_t)(-1));
577
}
578
_TIFFmemset(*buf, 0, bufsizetoalloc);
579
580
if ((*tif->tif_decodestrip)(tif,*buf,this_stripsize,plane)<=0)
581
return((tmsize_t)(-1));
582
(*tif->tif_postdecode)(tif,*buf,this_stripsize);
583
return(this_stripsize);
584
585
586
}
587
588
static tmsize_t
589
TIFFReadRawStrip1(TIFF* tif, uint32 strip, void* buf, tmsize_t size,
590
const char* module)
591
{
592
TIFFDirectory *td = &tif->tif_dir;
593
594
if (!_TIFFFillStriles( tif ))
595
return ((tmsize_t)(-1));
596
597
assert((tif->tif_flags&TIFF_NOREADRAW)==0);
598
if (!isMapped(tif)) {
599
tmsize_t cc;
600
601
if (!SeekOK(tif, td->td_stripoffset[strip])) {
602
TIFFErrorExt(tif->tif_clientdata, module,
603
"Seek error at scanline %lu, strip %lu",
604
(unsigned long) tif->tif_row, (unsigned long) strip);
605
return ((tmsize_t)(-1));
606
}
607
cc = TIFFReadFile(tif, buf, size);
608
if (cc != size) {
609
#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
610
TIFFErrorExt(tif->tif_clientdata, module,
611
"Read error at scanline %lu; got %I64u bytes, expected %I64u",
612
(unsigned long) tif->tif_row,
613
(unsigned __int64) cc,
614
(unsigned __int64) size);
615
#else
616
TIFFErrorExt(tif->tif_clientdata, module,
617
"Read error at scanline %lu; got %llu bytes, expected %llu",
618
(unsigned long) tif->tif_row,
619
(unsigned long long) cc,
620
(unsigned long long) size);
621
#endif
622
return ((tmsize_t)(-1));
623
}
624
} else {
625
tmsize_t ma = 0;
626
tmsize_t n;
627
if ((td->td_stripoffset[strip] > (uint64)TIFF_TMSIZE_T_MAX)||
628
((ma=(tmsize_t)td->td_stripoffset[strip])>tif->tif_size))
629
{
630
n=0;
631
}
632
else if( ma > TIFF_TMSIZE_T_MAX - size )
633
{
634
n=0;
635
}
636
else
637
{
638
tmsize_t mb=ma+size;
639
if (mb>tif->tif_size)
640
n=tif->tif_size-ma;
641
else
642
n=size;
643
}
644
if (n!=size) {
645
#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
646
TIFFErrorExt(tif->tif_clientdata, module,
647
"Read error at scanline %lu, strip %lu; got %I64u bytes, expected %I64u",
648
(unsigned long) tif->tif_row,
649
(unsigned long) strip,
650
(unsigned __int64) n,
651
(unsigned __int64) size);
652
#else
653
TIFFErrorExt(tif->tif_clientdata, module,
654
"Read error at scanline %lu, strip %lu; got %llu bytes, expected %llu",
655
(unsigned long) tif->tif_row,
656
(unsigned long) strip,
657
(unsigned long long) n,
658
(unsigned long long) size);
659
#endif
660
return ((tmsize_t)(-1));
661
}
662
_TIFFmemcpy(buf, tif->tif_base + ma,
663
size);
664
}
665
return (size);
666
}
667
668
static tmsize_t
669
TIFFReadRawStripOrTile2(TIFF* tif, uint32 strip_or_tile, int is_strip,
670
tmsize_t size, const char* module)
671
{
672
TIFFDirectory *td = &tif->tif_dir;
673
674
assert( !isMapped(tif) );
675
assert((tif->tif_flags&TIFF_NOREADRAW)==0);
676
677
if (!SeekOK(tif, td->td_stripoffset[strip_or_tile])) {
678
if( is_strip )
679
{
680
TIFFErrorExt(tif->tif_clientdata, module,
681
"Seek error at scanline %lu, strip %lu",
682
(unsigned long) tif->tif_row,
683
(unsigned long) strip_or_tile);
684
}
685
else
686
{
687
TIFFErrorExt(tif->tif_clientdata, module,
688
"Seek error at row %lu, col %lu, tile %lu",
689
(unsigned long) tif->tif_row,
690
(unsigned long) tif->tif_col,
691
(unsigned long) strip_or_tile);
692
}
693
return ((tmsize_t)(-1));
694
}
695
696
if( !TIFFReadAndRealloc( tif, size, 0, is_strip,
697
strip_or_tile, module ) )
698
{
699
return ((tmsize_t)(-1));
700
}
701
702
return (size);
703
}
704
705
/*
706
* Read a strip of data from the file.
707
*/
708
tmsize_t
709
TIFFReadRawStrip(TIFF* tif, uint32 strip, void* buf, tmsize_t size)
710
{
711
static const char module[] = "TIFFReadRawStrip";
712
TIFFDirectory *td = &tif->tif_dir;
713
uint64 bytecount;
714
tmsize_t bytecountm;
715
716
if (!TIFFCheckRead(tif, 0))
717
return ((tmsize_t)(-1));
718
if (strip >= td->td_nstrips) {
719
TIFFErrorExt(tif->tif_clientdata, module,
720
"%lu: Strip out of range, max %lu",
721
(unsigned long) strip,
722
(unsigned long) td->td_nstrips);
723
return ((tmsize_t)(-1));
724
}
725
if (tif->tif_flags&TIFF_NOREADRAW)
726
{
727
TIFFErrorExt(tif->tif_clientdata, module,
728
"Compression scheme does not support access to raw uncompressed data");
729
return ((tmsize_t)(-1));
730
}
731
bytecount = td->td_stripbytecount[strip];
732
if ((int64)bytecount <= 0) {
733
#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
734
TIFFErrorExt(tif->tif_clientdata, module,
735
"%I64u: Invalid strip byte count, strip %lu",
736
(unsigned __int64) bytecount,
737
(unsigned long) strip);
738
#else
739
TIFFErrorExt(tif->tif_clientdata, module,
740
"%llu: Invalid strip byte count, strip %lu",
741
(unsigned long long) bytecount,
742
(unsigned long) strip);
743
#endif
744
return ((tmsize_t)(-1));
745
}
746
bytecountm = (tmsize_t)bytecount;
747
if ((uint64)bytecountm!=bytecount) {
748
TIFFErrorExt(tif->tif_clientdata, module, "Integer overflow");
749
return ((tmsize_t)(-1));
750
}
751
if (size != (tmsize_t)(-1) && size < bytecountm)
752
bytecountm = size;
753
return (TIFFReadRawStrip1(tif, strip, buf, bytecountm, module));
754
}
755
756
/*
757
* Read the specified strip and setup for decoding. The data buffer is
758
* expanded, as necessary, to hold the strip's data.
759
*/
760
int
761
TIFFFillStrip(TIFF* tif, uint32 strip)
762
{
763
static const char module[] = "TIFFFillStrip";
764
TIFFDirectory *td = &tif->tif_dir;
765
766
if (!_TIFFFillStriles( tif ) || !tif->tif_dir.td_stripbytecount)
767
return 0;
768
769
if ((tif->tif_flags&TIFF_NOREADRAW)==0)
770
{
771
uint64 bytecount = td->td_stripbytecount[strip];
772
if ((int64)bytecount <= 0) {
773
#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
774
TIFFErrorExt(tif->tif_clientdata, module,
775
"Invalid strip byte count %I64u, strip %lu",
776
(unsigned __int64) bytecount,
777
(unsigned long) strip);
778
#else
779
TIFFErrorExt(tif->tif_clientdata, module,
780
"Invalid strip byte count %llu, strip %lu",
781
(unsigned long long) bytecount,
782
(unsigned long) strip);
783
#endif
784
return (0);
785
}
786
787
/* To avoid excessive memory allocations: */
788
/* Byte count should normally not be larger than a number of */
789
/* times the uncompressed size plus some margin */
790
if( bytecount > 1024 * 1024 )
791
{
792
/* 10 and 4096 are just values that could be adjusted. */
793
/* Hopefully they are safe enough for all codecs */
794
tmsize_t stripsize = TIFFStripSize(tif);
795
if( stripsize != 0 &&
796
(bytecount - 4096) / 10 > (uint64)stripsize )
797
{
798
uint64 newbytecount = (uint64)stripsize * 10 + 4096;
799
if( (int64)newbytecount >= 0 )
800
{
801
#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
802
TIFFWarningExt(tif->tif_clientdata, module,
803
"Too large strip byte count %I64u, strip %lu. Limiting to %I64u",
804
(unsigned __int64) bytecount,
805
(unsigned long) strip,
806
(unsigned __int64) newbytecount);
807
#else
808
TIFFErrorExt(tif->tif_clientdata, module,
809
"Too large strip byte count %llu, strip %lu. Limiting to %llu",
810
(unsigned long long) bytecount,
811
(unsigned long) strip,
812
(unsigned long long) newbytecount);
813
#endif
814
bytecount = newbytecount;
815
}
816
}
817
}
818
819
if (isMapped(tif)) {
820
/*
821
* We must check for overflow, potentially causing
822
* an OOB read. Instead of simple
823
*
824
* td->td_stripoffset[strip]+bytecount > tif->tif_size
825
*
826
* comparison (which can overflow) we do the following
827
* two comparisons:
828
*/
829
if (bytecount > (uint64)tif->tif_size ||
830
td->td_stripoffset[strip] > (uint64)tif->tif_size - bytecount) {
831
/*
832
* This error message might seem strange, but
833
* it's what would happen if a read were done
834
* instead.
835
*/
836
#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
837
TIFFErrorExt(tif->tif_clientdata, module,
838
839
"Read error on strip %lu; "
840
"got %I64u bytes, expected %I64u",
841
(unsigned long) strip,
842
(unsigned __int64) tif->tif_size - td->td_stripoffset[strip],
843
(unsigned __int64) bytecount);
844
#else
845
TIFFErrorExt(tif->tif_clientdata, module,
846
847
"Read error on strip %lu; "
848
"got %llu bytes, expected %llu",
849
(unsigned long) strip,
850
(unsigned long long) tif->tif_size - td->td_stripoffset[strip],
851
(unsigned long long) bytecount);
852
#endif
853
tif->tif_curstrip = NOSTRIP;
854
return (0);
855
}
856
}
857
858
if (isMapped(tif) &&
859
(isFillOrder(tif, td->td_fillorder)
860
|| (tif->tif_flags & TIFF_NOBITREV))) {
861
/*
862
* The image is mapped into memory and we either don't
863
* need to flip bits or the compression routine is
864
* going to handle this operation itself. In this
865
* case, avoid copying the raw data and instead just
866
* reference the data from the memory mapped file
867
* image. This assumes that the decompression
868
* routines do not modify the contents of the raw data
869
* buffer (if they try to, the application will get a
870
* fault since the file is mapped read-only).
871
*/
872
if ((tif->tif_flags & TIFF_MYBUFFER) && tif->tif_rawdata) {
873
_TIFFfree(tif->tif_rawdata);
874
tif->tif_rawdata = NULL;
875
tif->tif_rawdatasize = 0;
876
}
877
tif->tif_flags &= ~TIFF_MYBUFFER;
878
tif->tif_rawdatasize = (tmsize_t)bytecount;
879
tif->tif_rawdata = tif->tif_base + (tmsize_t)td->td_stripoffset[strip];
880
tif->tif_rawdataoff = 0;
881
tif->tif_rawdataloaded = (tmsize_t) bytecount;
882
883
/*
884
* When we have tif_rawdata reference directly into the memory mapped file
885
* we need to be pretty careful about how we use the rawdata. It is not
886
* a general purpose working buffer as it normally otherwise is. So we
887
* keep track of this fact to avoid using it improperly.
888
*/
889
tif->tif_flags |= TIFF_BUFFERMMAP;
890
} else {
891
/*
892
* Expand raw data buffer, if needed, to hold data
893
* strip coming from file (perhaps should set upper
894
* bound on the size of a buffer we'll use?).
895
*/
896
tmsize_t bytecountm;
897
bytecountm=(tmsize_t)bytecount;
898
if ((uint64)bytecountm!=bytecount)
899
{
900
TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
901
return(0);
902
}
903
if (bytecountm > tif->tif_rawdatasize) {
904
tif->tif_curstrip = NOSTRIP;
905
if ((tif->tif_flags & TIFF_MYBUFFER) == 0) {
906
TIFFErrorExt(tif->tif_clientdata, module,
907
"Data buffer too small to hold strip %lu",
908
(unsigned long) strip);
909
return (0);
910
}
911
}
912
if (tif->tif_flags&TIFF_BUFFERMMAP) {
913
tif->tif_curstrip = NOSTRIP;
914
tif->tif_rawdata = NULL;
915
tif->tif_rawdatasize = 0;
916
tif->tif_flags &= ~TIFF_BUFFERMMAP;
917
}
918
919
if( isMapped(tif) )
920
{
921
if (bytecountm > tif->tif_rawdatasize &&
922
!TIFFReadBufferSetup(tif, 0, bytecountm))
923
{
924
return (0);
925
}
926
if (TIFFReadRawStrip1(tif, strip, tif->tif_rawdata,
927
bytecountm, module) != bytecountm)
928
{
929
return (0);
930
}
931
}
932
else
933
{
934
if (TIFFReadRawStripOrTile2(tif, strip, 1,
935
bytecountm, module) != bytecountm)
936
{
937
return (0);
938
}
939
}
940
941
942
tif->tif_rawdataoff = 0;
943
tif->tif_rawdataloaded = bytecountm;
944
945
if (!isFillOrder(tif, td->td_fillorder) &&
946
(tif->tif_flags & TIFF_NOBITREV) == 0)
947
TIFFReverseBits(tif->tif_rawdata, bytecountm);
948
}
949
}
950
return (TIFFStartStrip(tif, strip));
951
}
952
953
/*
954
* Tile-oriented Read Support
955
* Contributed by Nancy Cam (Silicon Graphics).
956
*/
957
958
/*
959
* Read and decompress a tile of data. The
960
* tile is selected by the (x,y,z,s) coordinates.
961
*/
962
tmsize_t
963
TIFFReadTile(TIFF* tif, void* buf, uint32 x, uint32 y, uint32 z, uint16 s)
964
{
965
if (!TIFFCheckRead(tif, 1) || !TIFFCheckTile(tif, x, y, z, s))
966
return ((tmsize_t)(-1));
967
return (TIFFReadEncodedTile(tif,
968
TIFFComputeTile(tif, x, y, z, s), buf, (tmsize_t)(-1)));
969
}
970
971
/*
972
* Read a tile of data and decompress the specified
973
* amount into the user-supplied buffer.
974
*/
975
tmsize_t
976
TIFFReadEncodedTile(TIFF* tif, uint32 tile, void* buf, tmsize_t size)
977
{
978
static const char module[] = "TIFFReadEncodedTile";
979
TIFFDirectory *td = &tif->tif_dir;
980
tmsize_t tilesize = tif->tif_tilesize;
981
982
if (!TIFFCheckRead(tif, 1))
983
return ((tmsize_t)(-1));
984
if (tile >= td->td_nstrips) {
985
TIFFErrorExt(tif->tif_clientdata, module,
986
"%lu: Tile out of range, max %lu",
987
(unsigned long) tile, (unsigned long) td->td_nstrips);
988
return ((tmsize_t)(-1));
989
}
990
991
/* shortcut to avoid an extra memcpy() */
992
if( td->td_compression == COMPRESSION_NONE &&
993
size!=(tmsize_t)(-1) && size >= tilesize &&
994
!isMapped(tif) &&
995
((tif->tif_flags&TIFF_NOREADRAW)==0) )
996
{
997
if (TIFFReadRawTile1(tif, tile, buf, tilesize, module) != tilesize)
998
return ((tmsize_t)(-1));
999
1000
if (!isFillOrder(tif, td->td_fillorder) &&
1001
(tif->tif_flags & TIFF_NOBITREV) == 0)
1002
TIFFReverseBits(buf,tilesize);
1003
1004
(*tif->tif_postdecode)(tif,buf,tilesize);
1005
return (tilesize);
1006
}
1007
1008
if (size == (tmsize_t)(-1))
1009
size = tilesize;
1010
else if (size > tilesize)
1011
size = tilesize;
1012
if (TIFFFillTile(tif, tile) && (*tif->tif_decodetile)(tif,
1013
(uint8*) buf, size, (uint16)(tile/td->td_stripsperimage))) {
1014
(*tif->tif_postdecode)(tif, (uint8*) buf, size);
1015
return (size);
1016
} else
1017
return ((tmsize_t)(-1));
1018
}
1019
1020
/* Variant of TIFFReadTile() that does
1021
* * if *buf == NULL, *buf = _TIFFmalloc(bufsizetoalloc) only after TIFFFillTile() has
1022
* succeeded. This avoid excessive memory allocation in case of truncated
1023
* file.
1024
* * calls regular TIFFReadEncodedTile() if *buf != NULL
1025
*/
1026
tmsize_t
1027
_TIFFReadTileAndAllocBuffer(TIFF* tif,
1028
void **buf, tmsize_t bufsizetoalloc,
1029
uint32 x, uint32 y, uint32 z, uint16 s)
1030
{
1031
if (!TIFFCheckRead(tif, 1) || !TIFFCheckTile(tif, x, y, z, s))
1032
return ((tmsize_t)(-1));
1033
return (_TIFFReadEncodedTileAndAllocBuffer(tif,
1034
TIFFComputeTile(tif, x, y, z, s),
1035
buf, bufsizetoalloc,
1036
(tmsize_t)(-1)));
1037
}
1038
1039
/* Variant of TIFFReadEncodedTile() that does
1040
* * if *buf == NULL, *buf = _TIFFmalloc(bufsizetoalloc) only after TIFFFillTile() has
1041
* succeeded. This avoid excessive memory allocation in case of truncated
1042
* file.
1043
* * calls regular TIFFReadEncodedTile() if *buf != NULL
1044
*/
1045
tmsize_t
1046
_TIFFReadEncodedTileAndAllocBuffer(TIFF* tif, uint32 tile,
1047
void **buf, tmsize_t bufsizetoalloc,
1048
tmsize_t size_to_read)
1049
{
1050
static const char module[] = "_TIFFReadEncodedTileAndAllocBuffer";
1051
TIFFDirectory *td = &tif->tif_dir;
1052
tmsize_t tilesize = tif->tif_tilesize;
1053
1054
if( *buf != NULL )
1055
{
1056
return TIFFReadEncodedTile(tif, tile, *buf, size_to_read);
1057
}
1058
1059
if (!TIFFCheckRead(tif, 1))
1060
return ((tmsize_t)(-1));
1061
if (tile >= td->td_nstrips) {
1062
TIFFErrorExt(tif->tif_clientdata, module,
1063
"%lu: Tile out of range, max %lu",
1064
(unsigned long) tile, (unsigned long) td->td_nstrips);
1065
return ((tmsize_t)(-1));
1066
}
1067
1068
if (!TIFFFillTile(tif,tile))
1069
return((tmsize_t)(-1));
1070
1071
*buf = _TIFFmalloc(bufsizetoalloc);
1072
if (*buf == NULL) {
1073
TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif),
1074
"No space for tile buffer");
1075
return((tmsize_t)(-1));
1076
}
1077
_TIFFmemset(*buf, 0, bufsizetoalloc);
1078
1079
if (size_to_read == (tmsize_t)(-1))
1080
size_to_read = tilesize;
1081
else if (size_to_read > tilesize)
1082
size_to_read = tilesize;
1083
if( (*tif->tif_decodetile)(tif,
1084
(uint8*) *buf, size_to_read, (uint16)(tile/td->td_stripsperimage))) {
1085
(*tif->tif_postdecode)(tif, (uint8*) *buf, size_to_read);
1086
return (size_to_read);
1087
} else
1088
return ((tmsize_t)(-1));
1089
}
1090
1091
static tmsize_t
1092
TIFFReadRawTile1(TIFF* tif, uint32 tile, void* buf, tmsize_t size, const char* module)
1093
{
1094
TIFFDirectory *td = &tif->tif_dir;
1095
1096
if (!_TIFFFillStriles( tif ))
1097
return ((tmsize_t)(-1));
1098
1099
assert((tif->tif_flags&TIFF_NOREADRAW)==0);
1100
if (!isMapped(tif)) {
1101
tmsize_t cc;
1102
1103
if (!SeekOK(tif, td->td_stripoffset[tile])) {
1104
TIFFErrorExt(tif->tif_clientdata, module,
1105
"Seek error at row %lu, col %lu, tile %lu",
1106
(unsigned long) tif->tif_row,
1107
(unsigned long) tif->tif_col,
1108
(unsigned long) tile);
1109
return ((tmsize_t)(-1));
1110
}
1111
cc = TIFFReadFile(tif, buf, size);
1112
if (cc != size) {
1113
#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
1114
TIFFErrorExt(tif->tif_clientdata, module,
1115
"Read error at row %lu, col %lu; got %I64u bytes, expected %I64u",
1116
(unsigned long) tif->tif_row,
1117
(unsigned long) tif->tif_col,
1118
(unsigned __int64) cc,
1119
(unsigned __int64) size);
1120
#else
1121
TIFFErrorExt(tif->tif_clientdata, module,
1122
"Read error at row %lu, col %lu; got %llu bytes, expected %llu",
1123
(unsigned long) tif->tif_row,
1124
(unsigned long) tif->tif_col,
1125
(unsigned long long) cc,
1126
(unsigned long long) size);
1127
#endif
1128
return ((tmsize_t)(-1));
1129
}
1130
} else {
1131
tmsize_t ma,mb;
1132
tmsize_t n;
1133
ma=(tmsize_t)td->td_stripoffset[tile];
1134
mb=ma+size;
1135
if ((td->td_stripoffset[tile] > (uint64)TIFF_TMSIZE_T_MAX)||(ma>tif->tif_size))
1136
n=0;
1137
else if ((mb<ma)||(mb<size)||(mb>tif->tif_size))
1138
n=tif->tif_size-ma;
1139
else
1140
n=size;
1141
if (n!=size) {
1142
#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
1143
TIFFErrorExt(tif->tif_clientdata, module,
1144
"Read error at row %lu, col %lu, tile %lu; got %I64u bytes, expected %I64u",
1145
(unsigned long) tif->tif_row,
1146
(unsigned long) tif->tif_col,
1147
(unsigned long) tile,
1148
(unsigned __int64) n,
1149
(unsigned __int64) size);
1150
#else
1151
TIFFErrorExt(tif->tif_clientdata, module,
1152
"Read error at row %lu, col %lu, tile %lu; got %llu bytes, expected %llu",
1153
(unsigned long) tif->tif_row,
1154
(unsigned long) tif->tif_col,
1155
(unsigned long) tile,
1156
(unsigned long long) n,
1157
(unsigned long long) size);
1158
#endif
1159
return ((tmsize_t)(-1));
1160
}
1161
_TIFFmemcpy(buf, tif->tif_base + ma, size);
1162
}
1163
return (size);
1164
}
1165
1166
/*
1167
* Read a tile of data from the file.
1168
*/
1169
tmsize_t
1170
TIFFReadRawTile(TIFF* tif, uint32 tile, void* buf, tmsize_t size)
1171
{
1172
static const char module[] = "TIFFReadRawTile";
1173
TIFFDirectory *td = &tif->tif_dir;
1174
uint64 bytecount64;
1175
tmsize_t bytecountm;
1176
1177
if (!TIFFCheckRead(tif, 1))
1178
return ((tmsize_t)(-1));
1179
if (tile >= td->td_nstrips) {
1180
TIFFErrorExt(tif->tif_clientdata, module,
1181
"%lu: Tile out of range, max %lu",
1182
(unsigned long) tile, (unsigned long) td->td_nstrips);
1183
return ((tmsize_t)(-1));
1184
}
1185
if (tif->tif_flags&TIFF_NOREADRAW)
1186
{
1187
TIFFErrorExt(tif->tif_clientdata, module,
1188
"Compression scheme does not support access to raw uncompressed data");
1189
return ((tmsize_t)(-1));
1190
}
1191
bytecount64 = td->td_stripbytecount[tile];
1192
if (size != (tmsize_t)(-1) && (uint64)size < bytecount64)
1193
bytecount64 = (uint64)size;
1194
bytecountm = (tmsize_t)bytecount64;
1195
if ((uint64)bytecountm!=bytecount64)
1196
{
1197
TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
1198
return ((tmsize_t)(-1));
1199
}
1200
return (TIFFReadRawTile1(tif, tile, buf, bytecountm, module));
1201
}
1202
1203
/*
1204
* Read the specified tile and setup for decoding. The data buffer is
1205
* expanded, as necessary, to hold the tile's data.
1206
*/
1207
int
1208
TIFFFillTile(TIFF* tif, uint32 tile)
1209
{
1210
static const char module[] = "TIFFFillTile";
1211
TIFFDirectory *td = &tif->tif_dir;
1212
1213
if (!_TIFFFillStriles( tif ) || !tif->tif_dir.td_stripbytecount)
1214
return 0;
1215
1216
if ((tif->tif_flags&TIFF_NOREADRAW)==0)
1217
{
1218
uint64 bytecount = td->td_stripbytecount[tile];
1219
if ((int64)bytecount <= 0) {
1220
#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
1221
TIFFErrorExt(tif->tif_clientdata, module,
1222
"%I64u: Invalid tile byte count, tile %lu",
1223
(unsigned __int64) bytecount,
1224
(unsigned long) tile);
1225
#else
1226
TIFFErrorExt(tif->tif_clientdata, module,
1227
"%llu: Invalid tile byte count, tile %lu",
1228
(unsigned long long) bytecount,
1229
(unsigned long) tile);
1230
#endif
1231
return (0);
1232
}
1233
1234
/* To avoid excessive memory allocations: */
1235
/* Byte count should normally not be larger than a number of */
1236
/* times the uncompressed size plus some margin */
1237
if( bytecount > 1024 * 1024 )
1238
{
1239
/* 10 and 4096 are just values that could be adjusted. */
1240
/* Hopefully they are safe enough for all codecs */
1241
tmsize_t stripsize = TIFFTileSize(tif);
1242
if( stripsize != 0 &&
1243
(bytecount - 4096) / 10 > (uint64)stripsize )
1244
{
1245
uint64 newbytecount = (uint64)stripsize * 10 + 4096;
1246
if( (int64)newbytecount >= 0 )
1247
{
1248
#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
1249
TIFFWarningExt(tif->tif_clientdata, module,
1250
"Too large tile byte count %I64u, tile %lu. Limiting to %I64u",
1251
(unsigned __int64) bytecount,
1252
(unsigned long) tile,
1253
(unsigned __int64) newbytecount);
1254
#else
1255
TIFFErrorExt(tif->tif_clientdata, module,
1256
"Too large tile byte count %llu, tile %lu. Limiting to %llu",
1257
(unsigned long long) bytecount,
1258
(unsigned long) tile,
1259
(unsigned long long) newbytecount);
1260
#endif
1261
bytecount = newbytecount;
1262
}
1263
}
1264
}
1265
1266
if (isMapped(tif)) {
1267
/*
1268
* We must check for overflow, potentially causing
1269
* an OOB read. Instead of simple
1270
*
1271
* td->td_stripoffset[tile]+bytecount > tif->tif_size
1272
*
1273
* comparison (which can overflow) we do the following
1274
* two comparisons:
1275
*/
1276
if (bytecount > (uint64)tif->tif_size ||
1277
td->td_stripoffset[tile] > (uint64)tif->tif_size - bytecount) {
1278
tif->tif_curtile = NOTILE;
1279
return (0);
1280
}
1281
}
1282
1283
if (isMapped(tif) &&
1284
(isFillOrder(tif, td->td_fillorder)
1285
|| (tif->tif_flags & TIFF_NOBITREV))) {
1286
/*
1287
* The image is mapped into memory and we either don't
1288
* need to flip bits or the compression routine is
1289
* going to handle this operation itself. In this
1290
* case, avoid copying the raw data and instead just
1291
* reference the data from the memory mapped file
1292
* image. This assumes that the decompression
1293
* routines do not modify the contents of the raw data
1294
* buffer (if they try to, the application will get a
1295
* fault since the file is mapped read-only).
1296
*/
1297
if ((tif->tif_flags & TIFF_MYBUFFER) && tif->tif_rawdata) {
1298
_TIFFfree(tif->tif_rawdata);
1299
tif->tif_rawdata = NULL;
1300
tif->tif_rawdatasize = 0;
1301
}
1302
tif->tif_flags &= ~TIFF_MYBUFFER;
1303
1304
tif->tif_rawdatasize = (tmsize_t)bytecount;
1305
tif->tif_rawdata =
1306
tif->tif_base + (tmsize_t)td->td_stripoffset[tile];
1307
tif->tif_rawdataoff = 0;
1308
tif->tif_rawdataloaded = (tmsize_t) bytecount;
1309
tif->tif_flags |= TIFF_BUFFERMMAP;
1310
} else {
1311
/*
1312
* Expand raw data buffer, if needed, to hold data
1313
* tile coming from file (perhaps should set upper
1314
* bound on the size of a buffer we'll use?).
1315
*/
1316
tmsize_t bytecountm;
1317
bytecountm=(tmsize_t)bytecount;
1318
if ((uint64)bytecountm!=bytecount)
1319
{
1320
TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
1321
return(0);
1322
}
1323
if (bytecountm > tif->tif_rawdatasize) {
1324
tif->tif_curtile = NOTILE;
1325
if ((tif->tif_flags & TIFF_MYBUFFER) == 0) {
1326
TIFFErrorExt(tif->tif_clientdata, module,
1327
"Data buffer too small to hold tile %lu",
1328
(unsigned long) tile);
1329
return (0);
1330
}
1331
}
1332
if (tif->tif_flags&TIFF_BUFFERMMAP) {
1333
tif->tif_curtile = NOTILE;
1334
tif->tif_rawdata = NULL;
1335
tif->tif_rawdatasize = 0;
1336
tif->tif_flags &= ~TIFF_BUFFERMMAP;
1337
}
1338
1339
if( isMapped(tif) )
1340
{
1341
if (bytecountm > tif->tif_rawdatasize &&
1342
!TIFFReadBufferSetup(tif, 0, bytecountm))
1343
{
1344
return (0);
1345
}
1346
if (TIFFReadRawTile1(tif, tile, tif->tif_rawdata,
1347
bytecountm, module) != bytecountm)
1348
{
1349
return (0);
1350
}
1351
}
1352
else
1353
{
1354
if (TIFFReadRawStripOrTile2(tif, tile, 0,
1355
bytecountm, module) != bytecountm)
1356
{
1357
return (0);
1358
}
1359
}
1360
1361
1362
tif->tif_rawdataoff = 0;
1363
tif->tif_rawdataloaded = bytecountm;
1364
1365
if (!isFillOrder(tif, td->td_fillorder) &&
1366
(tif->tif_flags & TIFF_NOBITREV) == 0)
1367
TIFFReverseBits(tif->tif_rawdata,
1368
tif->tif_rawdataloaded);
1369
}
1370
}
1371
return (TIFFStartTile(tif, tile));
1372
}
1373
1374
/*
1375
* Setup the raw data buffer in preparation for
1376
* reading a strip of raw data. If the buffer
1377
* is specified as zero, then a buffer of appropriate
1378
* size is allocated by the library. Otherwise,
1379
* the client must guarantee that the buffer is
1380
* large enough to hold any individual strip of
1381
* raw data.
1382
*/
1383
int
1384
TIFFReadBufferSetup(TIFF* tif, void* bp, tmsize_t size)
1385
{
1386
static const char module[] = "TIFFReadBufferSetup";
1387
1388
assert((tif->tif_flags&TIFF_NOREADRAW)==0);
1389
tif->tif_flags &= ~TIFF_BUFFERMMAP;
1390
1391
if (tif->tif_rawdata) {
1392
if (tif->tif_flags & TIFF_MYBUFFER)
1393
_TIFFfree(tif->tif_rawdata);
1394
tif->tif_rawdata = NULL;
1395
tif->tif_rawdatasize = 0;
1396
}
1397
if (bp) {
1398
tif->tif_rawdatasize = size;
1399
tif->tif_rawdata = (uint8*) bp;
1400
tif->tif_flags &= ~TIFF_MYBUFFER;
1401
} else {
1402
tif->tif_rawdatasize = (tmsize_t)TIFFroundup_64((uint64)size, 1024);
1403
if (tif->tif_rawdatasize==0) {
1404
TIFFErrorExt(tif->tif_clientdata, module,
1405
"Invalid buffer size");
1406
return (0);
1407
}
1408
/* Initialize to zero to avoid uninitialized buffers in case of */
1409
/* short reads (http://bugzilla.maptools.org/show_bug.cgi?id=2651) */
1410
tif->tif_rawdata = (uint8*) _TIFFcalloc(1, tif->tif_rawdatasize);
1411
tif->tif_flags |= TIFF_MYBUFFER;
1412
}
1413
if (tif->tif_rawdata == NULL) {
1414
TIFFErrorExt(tif->tif_clientdata, module,
1415
"No space for data buffer at scanline %lu",
1416
(unsigned long) tif->tif_row);
1417
tif->tif_rawdatasize = 0;
1418
return (0);
1419
}
1420
return (1);
1421
}
1422
1423
/*
1424
* Set state to appear as if a
1425
* strip has just been read in.
1426
*/
1427
static int
1428
TIFFStartStrip(TIFF* tif, uint32 strip)
1429
{
1430
TIFFDirectory *td = &tif->tif_dir;
1431
1432
if (!_TIFFFillStriles( tif ) || !tif->tif_dir.td_stripbytecount)
1433
return 0;
1434
1435
if ((tif->tif_flags & TIFF_CODERSETUP) == 0) {
1436
if (!(*tif->tif_setupdecode)(tif))
1437
return (0);
1438
tif->tif_flags |= TIFF_CODERSETUP;
1439
}
1440
tif->tif_curstrip = strip;
1441
tif->tif_row = (strip % td->td_stripsperimage) * td->td_rowsperstrip;
1442
tif->tif_flags &= ~TIFF_BUF4WRITE;
1443
1444
if (tif->tif_flags&TIFF_NOREADRAW)
1445
{
1446
tif->tif_rawcp = NULL;
1447
tif->tif_rawcc = 0;
1448
}
1449
else
1450
{
1451
tif->tif_rawcp = tif->tif_rawdata;
1452
if( tif->tif_rawdataloaded > 0 )
1453
tif->tif_rawcc = tif->tif_rawdataloaded;
1454
else
1455
tif->tif_rawcc = (tmsize_t)td->td_stripbytecount[strip];
1456
}
1457
return ((*tif->tif_predecode)(tif,
1458
(uint16)(strip / td->td_stripsperimage)));
1459
}
1460
1461
/*
1462
* Set state to appear as if a
1463
* tile has just been read in.
1464
*/
1465
static int
1466
TIFFStartTile(TIFF* tif, uint32 tile)
1467
{
1468
static const char module[] = "TIFFStartTile";
1469
TIFFDirectory *td = &tif->tif_dir;
1470
uint32 howmany32;
1471
1472
if (!_TIFFFillStriles( tif ) || !tif->tif_dir.td_stripbytecount)
1473
return 0;
1474
1475
if ((tif->tif_flags & TIFF_CODERSETUP) == 0) {
1476
if (!(*tif->tif_setupdecode)(tif))
1477
return (0);
1478
tif->tif_flags |= TIFF_CODERSETUP;
1479
}
1480
tif->tif_curtile = tile;
1481
howmany32=TIFFhowmany_32(td->td_imagewidth, td->td_tilewidth);
1482
if (howmany32 == 0) {
1483
TIFFErrorExt(tif->tif_clientdata,module,"Zero tiles");
1484
return 0;
1485
}
1486
tif->tif_row = (tile % howmany32) * td->td_tilelength;
1487
howmany32=TIFFhowmany_32(td->td_imagelength, td->td_tilelength);
1488
if (howmany32 == 0) {
1489
TIFFErrorExt(tif->tif_clientdata,module,"Zero tiles");
1490
return 0;
1491
}
1492
tif->tif_col = (tile % howmany32) * td->td_tilewidth;
1493
tif->tif_flags &= ~TIFF_BUF4WRITE;
1494
if (tif->tif_flags&TIFF_NOREADRAW)
1495
{
1496
tif->tif_rawcp = NULL;
1497
tif->tif_rawcc = 0;
1498
}
1499
else
1500
{
1501
tif->tif_rawcp = tif->tif_rawdata;
1502
if( tif->tif_rawdataloaded > 0 )
1503
tif->tif_rawcc = tif->tif_rawdataloaded;
1504
else
1505
tif->tif_rawcc = (tmsize_t)td->td_stripbytecount[tile];
1506
}
1507
return ((*tif->tif_predecode)(tif,
1508
(uint16)(tile/td->td_stripsperimage)));
1509
}
1510
1511
static int
1512
TIFFCheckRead(TIFF* tif, int tiles)
1513
{
1514
if (tif->tif_mode == O_WRONLY) {
1515
TIFFErrorExt(tif->tif_clientdata, tif->tif_name, "File not open for reading");
1516
return (0);
1517
}
1518
if (tiles ^ isTiled(tif)) {
1519
TIFFErrorExt(tif->tif_clientdata, tif->tif_name, tiles ?
1520
"Can not read tiles from a stripped image" :
1521
"Can not read scanlines from a tiled image");
1522
return (0);
1523
}
1524
return (1);
1525
}
1526
1527
void
1528
_TIFFNoPostDecode(TIFF* tif, uint8* buf, tmsize_t cc)
1529
{
1530
(void) tif; (void) buf; (void) cc;
1531
}
1532
1533
void
1534
_TIFFSwab16BitData(TIFF* tif, uint8* buf, tmsize_t cc)
1535
{
1536
(void) tif;
1537
assert((cc & 1) == 0);
1538
TIFFSwabArrayOfShort((uint16*) buf, cc/2);
1539
}
1540
1541
void
1542
_TIFFSwab24BitData(TIFF* tif, uint8* buf, tmsize_t cc)
1543
{
1544
(void) tif;
1545
assert((cc % 3) == 0);
1546
TIFFSwabArrayOfTriples((uint8*) buf, cc/3);
1547
}
1548
1549
void
1550
_TIFFSwab32BitData(TIFF* tif, uint8* buf, tmsize_t cc)
1551
{
1552
(void) tif;
1553
assert((cc & 3) == 0);
1554
TIFFSwabArrayOfLong((uint32*) buf, cc/4);
1555
}
1556
1557
void
1558
_TIFFSwab64BitData(TIFF* tif, uint8* buf, tmsize_t cc)
1559
{
1560
(void) tif;
1561
assert((cc & 7) == 0);
1562
TIFFSwabArrayOfDouble((double*) buf, cc/8);
1563
}
1564
1565
/* vim: set ts=8 sts=8 sw=8 noet: */
1566
/*
1567
* Local Variables:
1568
* mode: c
1569
* c-basic-offset: 8
1570
* fill-column: 78
1571
* End:
1572
*/
1573
1574