CoCalc -- tif_dirread.c

GitHub Repository: wine-mirror/wine
Path: blob/master/libs/tiff/libtiff/tif_dirread.c
⁸⁷⁴⁴ views
1
/*
2
 * Copyright (c) 1988-1997 Sam Leffler
3
 * Copyright (c) 1991-1997 Silicon Graphics, Inc.
4
 *
5
 * Permission to use, copy, modify, distribute, and sell this software and
6
 * its documentation for any purpose is hereby granted without fee, provided
7
 * that (i) the above copyright notices and this permission notice appear in
8
 * all copies of the software and related documentation, and (ii) the names of
9
 * Sam Leffler and Silicon Graphics may not be used in any advertising or
10
 * publicity relating to the software without the specific, prior written
11
 * permission of Sam Leffler and Silicon Graphics.
12
 *
13
 * THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND,
14
 * EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY
15
 * WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
16
 *
17
 * IN NO EVENT SHALL SAM LEFFLER OR SILICON GRAPHICS BE LIABLE FOR
18
 * ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND,
19
 * OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
20
 * WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF
21
 * LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
22
 * OF THIS SOFTWARE.
23
 */
24

25
/*
26
 * TIFF Library.
27
 *
28
 * Directory Read Support Routines.
29
 */
30

31
/* Suggested pending improvements:
32
 * - add a field 'field_info' to the TIFFDirEntry structure, and set that with
33
 *   the pointer to the appropriate TIFFField structure early on in
34
 *   TIFFReadDirectory, so as to eliminate current possibly repetitive lookup.
35
 */
36

37
#include "tiffconf.h"
38
#include "tiffiop.h"
39
#include <float.h>
40
#include <limits.h>
41
#include <stdlib.h>
42
#include <string.h>
43

44
#define FAILED_FII ((uint32_t)-1)
45

46
#ifdef HAVE_IEEEFP
47
#define TIFFCvtIEEEFloatToNative(tif, n, fp)
48
#define TIFFCvtIEEEDoubleToNative(tif, n, dp)
49
#else
50
/* If your machine does not support IEEE floating point then you will need to
51
 * add support to tif_machdep.c to convert between the native format and
52
 * IEEE format. */
53
extern void TIFFCvtIEEEFloatToNative(TIFF *, uint32_t, float *);
54
extern void TIFFCvtIEEEDoubleToNative(TIFF *, uint32_t, double *);
55
#endif
56

57
enum TIFFReadDirEntryErr
58
{
59
    TIFFReadDirEntryErrOk = 0,
60
    TIFFReadDirEntryErrCount = 1,
61
    TIFFReadDirEntryErrType = 2,
62
    TIFFReadDirEntryErrIo = 3,
63
    TIFFReadDirEntryErrRange = 4,
64
    TIFFReadDirEntryErrPsdif = 5,
65
    TIFFReadDirEntryErrSizesan = 6,
66
    TIFFReadDirEntryErrAlloc = 7,
67
};
68

69
static enum TIFFReadDirEntryErr
70
TIFFReadDirEntryByte(TIFF *tif, TIFFDirEntry *direntry, uint8_t *value);
71
static enum TIFFReadDirEntryErr
72
TIFFReadDirEntrySbyte(TIFF *tif, TIFFDirEntry *direntry, int8_t *value);
73
static enum TIFFReadDirEntryErr
74
TIFFReadDirEntryShort(TIFF *tif, TIFFDirEntry *direntry, uint16_t *value);
75
static enum TIFFReadDirEntryErr
76
TIFFReadDirEntrySshort(TIFF *tif, TIFFDirEntry *direntry, int16_t *value);
77
static enum TIFFReadDirEntryErr
78
TIFFReadDirEntryLong(TIFF *tif, TIFFDirEntry *direntry, uint32_t *value);
79
static enum TIFFReadDirEntryErr
80
TIFFReadDirEntrySlong(TIFF *tif, TIFFDirEntry *direntry, int32_t *value);
81
static enum TIFFReadDirEntryErr
82
TIFFReadDirEntryLong8(TIFF *tif, TIFFDirEntry *direntry, uint64_t *value);
83
static enum TIFFReadDirEntryErr
84
TIFFReadDirEntrySlong8(TIFF *tif, TIFFDirEntry *direntry, int64_t *value);
85
static enum TIFFReadDirEntryErr
86
TIFFReadDirEntryFloat(TIFF *tif, TIFFDirEntry *direntry, float *value);
87
static enum TIFFReadDirEntryErr
88
TIFFReadDirEntryDouble(TIFF *tif, TIFFDirEntry *direntry, double *value);
89
static enum TIFFReadDirEntryErr
90
TIFFReadDirEntryIfd8(TIFF *tif, TIFFDirEntry *direntry, uint64_t *value);
91

92
static enum TIFFReadDirEntryErr
93
TIFFReadDirEntryArray(TIFF *tif, TIFFDirEntry *direntry, uint32_t *count,
94
                      uint32_t desttypesize, void **value);
95
static enum TIFFReadDirEntryErr
96
TIFFReadDirEntryByteArray(TIFF *tif, TIFFDirEntry *direntry, uint8_t **value);
97
static enum TIFFReadDirEntryErr
98
TIFFReadDirEntrySbyteArray(TIFF *tif, TIFFDirEntry *direntry, int8_t **value);
99
static enum TIFFReadDirEntryErr
100
TIFFReadDirEntryShortArray(TIFF *tif, TIFFDirEntry *direntry, uint16_t **value);
101
static enum TIFFReadDirEntryErr
102
TIFFReadDirEntrySshortArray(TIFF *tif, TIFFDirEntry *direntry, int16_t **value);
103
static enum TIFFReadDirEntryErr
104
TIFFReadDirEntryLongArray(TIFF *tif, TIFFDirEntry *direntry, uint32_t **value);
105
static enum TIFFReadDirEntryErr
106
TIFFReadDirEntrySlongArray(TIFF *tif, TIFFDirEntry *direntry, int32_t **value);
107
static enum TIFFReadDirEntryErr
108
TIFFReadDirEntryLong8Array(TIFF *tif, TIFFDirEntry *direntry, uint64_t **value);
109
static enum TIFFReadDirEntryErr
110
TIFFReadDirEntrySlong8Array(TIFF *tif, TIFFDirEntry *direntry, int64_t **value);
111
static enum TIFFReadDirEntryErr
112
TIFFReadDirEntryFloatArray(TIFF *tif, TIFFDirEntry *direntry, float **value);
113
static enum TIFFReadDirEntryErr
114
TIFFReadDirEntryDoubleArray(TIFF *tif, TIFFDirEntry *direntry, double **value);
115
static enum TIFFReadDirEntryErr
116
TIFFReadDirEntryIfd8Array(TIFF *tif, TIFFDirEntry *direntry, uint64_t **value);
117

118
static enum TIFFReadDirEntryErr
119
TIFFReadDirEntryPersampleShort(TIFF *tif, TIFFDirEntry *direntry,
120
                               uint16_t *value);
121

122
static void TIFFReadDirEntryCheckedByte(TIFF *tif, TIFFDirEntry *direntry,
123
                                        uint8_t *value);
124
static void TIFFReadDirEntryCheckedSbyte(TIFF *tif, TIFFDirEntry *direntry,
125
                                         int8_t *value);
126
static void TIFFReadDirEntryCheckedShort(TIFF *tif, TIFFDirEntry *direntry,
127
                                         uint16_t *value);
128
static void TIFFReadDirEntryCheckedSshort(TIFF *tif, TIFFDirEntry *direntry,
129
                                          int16_t *value);
130
static void TIFFReadDirEntryCheckedLong(TIFF *tif, TIFFDirEntry *direntry,
131
                                        uint32_t *value);
132
static void TIFFReadDirEntryCheckedSlong(TIFF *tif, TIFFDirEntry *direntry,
133
                                         int32_t *value);
134
static enum TIFFReadDirEntryErr
135
TIFFReadDirEntryCheckedLong8(TIFF *tif, TIFFDirEntry *direntry,
136
                             uint64_t *value);
137
static enum TIFFReadDirEntryErr
138
TIFFReadDirEntryCheckedSlong8(TIFF *tif, TIFFDirEntry *direntry,
139
                              int64_t *value);
140
static enum TIFFReadDirEntryErr
141
TIFFReadDirEntryCheckedRational(TIFF *tif, TIFFDirEntry *direntry,
142
                                double *value);
143
static enum TIFFReadDirEntryErr
144
TIFFReadDirEntryCheckedSrational(TIFF *tif, TIFFDirEntry *direntry,
145
                                 double *value);
146
static void TIFFReadDirEntryCheckedFloat(TIFF *tif, TIFFDirEntry *direntry,
147
                                         float *value);
148
static enum TIFFReadDirEntryErr
149
TIFFReadDirEntryCheckedDouble(TIFF *tif, TIFFDirEntry *direntry, double *value);
150
#if 0
151
static enum TIFFReadDirEntryErr
152
TIFFReadDirEntryCheckedRationalDirect(TIFF *tif, TIFFDirEntry *direntry,
153
                                      TIFFRational_t *value);
154
#endif
155
static enum TIFFReadDirEntryErr
156
TIFFReadDirEntryCheckRangeByteSbyte(int8_t value);
157
static enum TIFFReadDirEntryErr
158
TIFFReadDirEntryCheckRangeByteShort(uint16_t value);
159
static enum TIFFReadDirEntryErr
160
TIFFReadDirEntryCheckRangeByteSshort(int16_t value);
161
static enum TIFFReadDirEntryErr
162
TIFFReadDirEntryCheckRangeByteLong(uint32_t value);
163
static enum TIFFReadDirEntryErr
164
TIFFReadDirEntryCheckRangeByteSlong(int32_t value);
165
static enum TIFFReadDirEntryErr
166
TIFFReadDirEntryCheckRangeByteLong8(uint64_t value);
167
static enum TIFFReadDirEntryErr
168
TIFFReadDirEntryCheckRangeByteSlong8(int64_t value);
169

170
static enum TIFFReadDirEntryErr
171
TIFFReadDirEntryCheckRangeSbyteByte(uint8_t value);
172
static enum TIFFReadDirEntryErr
173
TIFFReadDirEntryCheckRangeSbyteShort(uint16_t value);
174
static enum TIFFReadDirEntryErr
175
TIFFReadDirEntryCheckRangeSbyteSshort(int16_t value);
176
static enum TIFFReadDirEntryErr
177
TIFFReadDirEntryCheckRangeSbyteLong(uint32_t value);
178
static enum TIFFReadDirEntryErr
179
TIFFReadDirEntryCheckRangeSbyteSlong(int32_t value);
180
static enum TIFFReadDirEntryErr
181
TIFFReadDirEntryCheckRangeSbyteLong8(uint64_t value);
182
static enum TIFFReadDirEntryErr
183
TIFFReadDirEntryCheckRangeSbyteSlong8(int64_t value);
184

185
static enum TIFFReadDirEntryErr
186
TIFFReadDirEntryCheckRangeShortSbyte(int8_t value);
187
static enum TIFFReadDirEntryErr
188
TIFFReadDirEntryCheckRangeShortSshort(int16_t value);
189
static enum TIFFReadDirEntryErr
190
TIFFReadDirEntryCheckRangeShortLong(uint32_t value);
191
static enum TIFFReadDirEntryErr
192
TIFFReadDirEntryCheckRangeShortSlong(int32_t value);
193
static enum TIFFReadDirEntryErr
194
TIFFReadDirEntryCheckRangeShortLong8(uint64_t value);
195
static enum TIFFReadDirEntryErr
196
TIFFReadDirEntryCheckRangeShortSlong8(int64_t value);
197

198
static enum TIFFReadDirEntryErr
199
TIFFReadDirEntryCheckRangeSshortShort(uint16_t value);
200
static enum TIFFReadDirEntryErr
201
TIFFReadDirEntryCheckRangeSshortLong(uint32_t value);
202
static enum TIFFReadDirEntryErr
203
TIFFReadDirEntryCheckRangeSshortSlong(int32_t value);
204
static enum TIFFReadDirEntryErr
205
TIFFReadDirEntryCheckRangeSshortLong8(uint64_t value);
206
static enum TIFFReadDirEntryErr
207
TIFFReadDirEntryCheckRangeSshortSlong8(int64_t value);
208

209
static enum TIFFReadDirEntryErr
210
TIFFReadDirEntryCheckRangeLongSbyte(int8_t value);
211
static enum TIFFReadDirEntryErr
212
TIFFReadDirEntryCheckRangeLongSshort(int16_t value);
213
static enum TIFFReadDirEntryErr
214
TIFFReadDirEntryCheckRangeLongSlong(int32_t value);
215
static enum TIFFReadDirEntryErr
216
TIFFReadDirEntryCheckRangeLongLong8(uint64_t value);
217
static enum TIFFReadDirEntryErr
218
TIFFReadDirEntryCheckRangeLongSlong8(int64_t value);
219

220
static enum TIFFReadDirEntryErr
221
TIFFReadDirEntryCheckRangeSlongLong(uint32_t value);
222
static enum TIFFReadDirEntryErr
223
TIFFReadDirEntryCheckRangeSlongLong8(uint64_t value);
224
static enum TIFFReadDirEntryErr
225
TIFFReadDirEntryCheckRangeSlongSlong8(int64_t value);
226

227
static enum TIFFReadDirEntryErr
228
TIFFReadDirEntryCheckRangeLong8Sbyte(int8_t value);
229
static enum TIFFReadDirEntryErr
230
TIFFReadDirEntryCheckRangeLong8Sshort(int16_t value);
231
static enum TIFFReadDirEntryErr
232
TIFFReadDirEntryCheckRangeLong8Slong(int32_t value);
233
static enum TIFFReadDirEntryErr
234
TIFFReadDirEntryCheckRangeLong8Slong8(int64_t value);
235

236
static enum TIFFReadDirEntryErr
237
TIFFReadDirEntryCheckRangeSlong8Long8(uint64_t value);
238

239
static enum TIFFReadDirEntryErr TIFFReadDirEntryData(TIFF *tif, uint64_t offset,
240
                                                     tmsize_t size, void *dest);
241
static void TIFFReadDirEntryOutputErr(TIFF *tif, enum TIFFReadDirEntryErr err,
242
                                      const char *module, const char *tagname,
243
                                      int recover);
244

245
static void TIFFReadDirectoryCheckOrder(TIFF *tif, TIFFDirEntry *dir,
246
                                        uint16_t dircount);
247
static TIFFDirEntry *TIFFReadDirectoryFindEntry(TIFF *tif, TIFFDirEntry *dir,
248
                                                uint16_t dircount,
249
                                                uint16_t tagid);
250
static void TIFFReadDirectoryFindFieldInfo(TIFF *tif, uint16_t tagid,
251
                                           uint32_t *fii);
252

253
static int EstimateStripByteCounts(TIFF *tif, TIFFDirEntry *dir,
254
                                   uint16_t dircount);
255
static void MissingRequired(TIFF *, const char *);
256
static int CheckDirCount(TIFF *, TIFFDirEntry *, uint32_t);
257
static uint16_t TIFFFetchDirectory(TIFF *tif, uint64_t diroff,
258
                                   TIFFDirEntry **pdir, uint64_t *nextdiroff);
259
static int TIFFFetchNormalTag(TIFF *, TIFFDirEntry *, int recover);
260
static int TIFFFetchStripThing(TIFF *tif, TIFFDirEntry *dir, uint32_t nstrips,
261
                               uint64_t **lpp);
262
static int TIFFFetchSubjectDistance(TIFF *, TIFFDirEntry *);
263
static void ChopUpSingleUncompressedStrip(TIFF *);
264
static void TryChopUpUncompressedBigTiff(TIFF *);
265
static uint64_t TIFFReadUInt64(const uint8_t *value);
266
static int _TIFFGetMaxColorChannels(uint16_t photometric);
267

268
static int _TIFFFillStrilesInternal(TIFF *tif, int loadStripByteCount);
269

270
typedef union _UInt64Aligned_t
271
{
272
    double d;
273
    uint64_t l;
274
    uint32_t i[2];
275
    uint16_t s[4];
276
    uint8_t c[8];
277
} UInt64Aligned_t;
278

279
/*
280
  Unaligned safe copy of a uint64_t value from an octet array.
281
*/
282
static uint64_t TIFFReadUInt64(const uint8_t *value)
283
{
284
    UInt64Aligned_t result;
285

286
    result.c[0] = value[0];
287
    result.c[1] = value[1];
288
    result.c[2] = value[2];
289
    result.c[3] = value[3];
290
    result.c[4] = value[4];
291
    result.c[5] = value[5];
292
    result.c[6] = value[6];
293
    result.c[7] = value[7];
294

295
    return result.l;
296
}
297

298
static enum TIFFReadDirEntryErr
299
TIFFReadDirEntryByte(TIFF *tif, TIFFDirEntry *direntry, uint8_t *value)
300
{
301
    enum TIFFReadDirEntryErr err;
302
    if (direntry->tdir_count != 1)
303
        return (TIFFReadDirEntryErrCount);
304
    switch (direntry->tdir_type)
305
    {
306
        case TIFF_BYTE:
307
        case TIFF_UNDEFINED: /* Support to read TIFF_UNDEFINED with
308
                                field_readcount==1 */
309
            TIFFReadDirEntryCheckedByte(tif, direntry, value);
310
            return (TIFFReadDirEntryErrOk);
311
        case TIFF_SBYTE:
312
        {
313
            int8_t m;
314
            TIFFReadDirEntryCheckedSbyte(tif, direntry, &m);
315
            err = TIFFReadDirEntryCheckRangeByteSbyte(m);
316
            if (err != TIFFReadDirEntryErrOk)
317
                return (err);
318
            *value = (uint8_t)m;
319
            return (TIFFReadDirEntryErrOk);
320
        }
321
        case TIFF_SHORT:
322
        {
323
            uint16_t m;
324
            TIFFReadDirEntryCheckedShort(tif, direntry, &m);
325
            err = TIFFReadDirEntryCheckRangeByteShort(m);
326
            if (err != TIFFReadDirEntryErrOk)
327
                return (err);
328
            *value = (uint8_t)m;
329
            return (TIFFReadDirEntryErrOk);
330
        }
331
        case TIFF_SSHORT:
332
        {
333
            int16_t m;
334
            TIFFReadDirEntryCheckedSshort(tif, direntry, &m);
335
            err = TIFFReadDirEntryCheckRangeByteSshort(m);
336
            if (err != TIFFReadDirEntryErrOk)
337
                return (err);
338
            *value = (uint8_t)m;
339
            return (TIFFReadDirEntryErrOk);
340
        }
341
        case TIFF_LONG:
342
        {
343
            uint32_t m;
344
            TIFFReadDirEntryCheckedLong(tif, direntry, &m);
345
            err = TIFFReadDirEntryCheckRangeByteLong(m);
346
            if (err != TIFFReadDirEntryErrOk)
347
                return (err);
348
            *value = (uint8_t)m;
349
            return (TIFFReadDirEntryErrOk);
350
        }
351
        case TIFF_SLONG:
352
        {
353
            int32_t m;
354
            TIFFReadDirEntryCheckedSlong(tif, direntry, &m);
355
            err = TIFFReadDirEntryCheckRangeByteSlong(m);
356
            if (err != TIFFReadDirEntryErrOk)
357
                return (err);
358
            *value = (uint8_t)m;
359
            return (TIFFReadDirEntryErrOk);
360
        }
361
        case TIFF_LONG8:
362
        {
363
            uint64_t m;
364
            err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m);
365
            if (err != TIFFReadDirEntryErrOk)
366
                return (err);
367
            err = TIFFReadDirEntryCheckRangeByteLong8(m);
368
            if (err != TIFFReadDirEntryErrOk)
369
                return (err);
370
            *value = (uint8_t)m;
371
            return (TIFFReadDirEntryErrOk);
372
        }
373
        case TIFF_SLONG8:
374
        {
375
            int64_t m;
376
            err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m);
377
            if (err != TIFFReadDirEntryErrOk)
378
                return (err);
379
            err = TIFFReadDirEntryCheckRangeByteSlong8(m);
380
            if (err != TIFFReadDirEntryErrOk)
381
                return (err);
382
            *value = (uint8_t)m;
383
            return (TIFFReadDirEntryErrOk);
384
        }
385
        default:
386
            return (TIFFReadDirEntryErrType);
387
    }
388
}
389

390
static enum TIFFReadDirEntryErr
391
TIFFReadDirEntrySbyte(TIFF *tif, TIFFDirEntry *direntry, int8_t *value)
392
{
393
    enum TIFFReadDirEntryErr err;
394
    if (direntry->tdir_count != 1)
395
        return (TIFFReadDirEntryErrCount);
396
    switch (direntry->tdir_type)
397
    {
398
        case TIFF_BYTE:
399
        case TIFF_UNDEFINED: /* Support to read TIFF_UNDEFINED with
400
                                field_readcount==1 */
401
        {
402
            uint8_t m;
403
            TIFFReadDirEntryCheckedByte(tif, direntry, &m);
404
            err = TIFFReadDirEntryCheckRangeSbyteByte(m);
405
            if (err != TIFFReadDirEntryErrOk)
406
                return (err);
407
            *value = (int8_t)m;
408
            return (TIFFReadDirEntryErrOk);
409
        }
410
        case TIFF_SBYTE:
411
        {
412
            TIFFReadDirEntryCheckedSbyte(tif, direntry, value);
413
            return (TIFFReadDirEntryErrOk);
414
        }
415
        case TIFF_SHORT:
416
        {
417
            uint16_t m;
418
            TIFFReadDirEntryCheckedShort(tif, direntry, &m);
419
            err = TIFFReadDirEntryCheckRangeSbyteShort(m);
420
            if (err != TIFFReadDirEntryErrOk)
421
                return (err);
422
            *value = (int8_t)m;
423
            return (TIFFReadDirEntryErrOk);
424
        }
425
        case TIFF_SSHORT:
426
        {
427
            int16_t m;
428
            TIFFReadDirEntryCheckedSshort(tif, direntry, &m);
429
            err = TIFFReadDirEntryCheckRangeSbyteSshort(m);
430
            if (err != TIFFReadDirEntryErrOk)
431
                return (err);
432
            *value = (int8_t)m;
433
            return (TIFFReadDirEntryErrOk);
434
        }
435
        case TIFF_LONG:
436
        {
437
            uint32_t m;
438
            TIFFReadDirEntryCheckedLong(tif, direntry, &m);
439
            err = TIFFReadDirEntryCheckRangeSbyteLong(m);
440
            if (err != TIFFReadDirEntryErrOk)
441
                return (err);
442
            *value = (int8_t)m;
443
            return (TIFFReadDirEntryErrOk);
444
        }
445
        case TIFF_SLONG:
446
        {
447
            int32_t m;
448
            TIFFReadDirEntryCheckedSlong(tif, direntry, &m);
449
            err = TIFFReadDirEntryCheckRangeSbyteSlong(m);
450
            if (err != TIFFReadDirEntryErrOk)
451
                return (err);
452
            *value = (int8_t)m;
453
            return (TIFFReadDirEntryErrOk);
454
        }
455
        case TIFF_LONG8:
456
        {
457
            uint64_t m;
458
            err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m);
459
            if (err != TIFFReadDirEntryErrOk)
460
                return (err);
461
            err = TIFFReadDirEntryCheckRangeSbyteLong8(m);
462
            if (err != TIFFReadDirEntryErrOk)
463
                return (err);
464
            *value = (int8_t)m;
465
            return (TIFFReadDirEntryErrOk);
466
        }
467
        case TIFF_SLONG8:
468
        {
469
            int64_t m;
470
            err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m);
471
            if (err != TIFFReadDirEntryErrOk)
472
                return (err);
473
            err = TIFFReadDirEntryCheckRangeSbyteSlong8(m);
474
            if (err != TIFFReadDirEntryErrOk)
475
                return (err);
476
            *value = (int8_t)m;
477
            return (TIFFReadDirEntryErrOk);
478
        }
479
        default:
480
            return (TIFFReadDirEntryErrType);
481
    }
482
} /*-- TIFFReadDirEntrySbyte() --*/
483

484
static enum TIFFReadDirEntryErr
485
TIFFReadDirEntryShort(TIFF *tif, TIFFDirEntry *direntry, uint16_t *value)
486
{
487
    enum TIFFReadDirEntryErr err;
488
    if (direntry->tdir_count != 1)
489
        return (TIFFReadDirEntryErrCount);
490
    switch (direntry->tdir_type)
491
    {
492
        case TIFF_BYTE:
493
        {
494
            uint8_t m;
495
            TIFFReadDirEntryCheckedByte(tif, direntry, &m);
496
            *value = (uint16_t)m;
497
            return (TIFFReadDirEntryErrOk);
498
        }
499
        case TIFF_SBYTE:
500
        {
501
            int8_t m;
502
            TIFFReadDirEntryCheckedSbyte(tif, direntry, &m);
503
            err = TIFFReadDirEntryCheckRangeShortSbyte(m);
504
            if (err != TIFFReadDirEntryErrOk)
505
                return (err);
506
            *value = (uint16_t)m;
507
            return (TIFFReadDirEntryErrOk);
508
        }
509
        case TIFF_SHORT:
510
            TIFFReadDirEntryCheckedShort(tif, direntry, value);
511
            return (TIFFReadDirEntryErrOk);
512
        case TIFF_SSHORT:
513
        {
514
            int16_t m;
515
            TIFFReadDirEntryCheckedSshort(tif, direntry, &m);
516
            err = TIFFReadDirEntryCheckRangeShortSshort(m);
517
            if (err != TIFFReadDirEntryErrOk)
518
                return (err);
519
            *value = (uint16_t)m;
520
            return (TIFFReadDirEntryErrOk);
521
        }
522
        case TIFF_LONG:
523
        {
524
            uint32_t m;
525
            TIFFReadDirEntryCheckedLong(tif, direntry, &m);
526
            err = TIFFReadDirEntryCheckRangeShortLong(m);
527
            if (err != TIFFReadDirEntryErrOk)
528
                return (err);
529
            *value = (uint16_t)m;
530
            return (TIFFReadDirEntryErrOk);
531
        }
532
        case TIFF_SLONG:
533
        {
534
            int32_t m;
535
            TIFFReadDirEntryCheckedSlong(tif, direntry, &m);
536
            err = TIFFReadDirEntryCheckRangeShortSlong(m);
537
            if (err != TIFFReadDirEntryErrOk)
538
                return (err);
539
            *value = (uint16_t)m;
540
            return (TIFFReadDirEntryErrOk);
541
        }
542
        case TIFF_LONG8:
543
        {
544
            uint64_t m;
545
            err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m);
546
            if (err != TIFFReadDirEntryErrOk)
547
                return (err);
548
            err = TIFFReadDirEntryCheckRangeShortLong8(m);
549
            if (err != TIFFReadDirEntryErrOk)
550
                return (err);
551
            *value = (uint16_t)m;
552
            return (TIFFReadDirEntryErrOk);
553
        }
554
        case TIFF_SLONG8:
555
        {
556
            int64_t m;
557
            err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m);
558
            if (err != TIFFReadDirEntryErrOk)
559
                return (err);
560
            err = TIFFReadDirEntryCheckRangeShortSlong8(m);
561
            if (err != TIFFReadDirEntryErrOk)
562
                return (err);
563
            *value = (uint16_t)m;
564
            return (TIFFReadDirEntryErrOk);
565
        }
566
        default:
567
            return (TIFFReadDirEntryErrType);
568
    }
569
} /*-- TIFFReadDirEntryShort() --*/
570

571
static enum TIFFReadDirEntryErr
572
TIFFReadDirEntrySshort(TIFF *tif, TIFFDirEntry *direntry, int16_t *value)
573
{
574
    enum TIFFReadDirEntryErr err;
575
    if (direntry->tdir_count != 1)
576
        return (TIFFReadDirEntryErrCount);
577
    switch (direntry->tdir_type)
578
    {
579
        case TIFF_BYTE:
580
        {
581
            uint8_t m;
582
            TIFFReadDirEntryCheckedByte(tif, direntry, &m);
583
            *value = (int16_t)m;
584
            return (TIFFReadDirEntryErrOk);
585
        }
586
        case TIFF_SBYTE:
587
        {
588
            int8_t m;
589
            TIFFReadDirEntryCheckedSbyte(tif, direntry, &m);
590
            *value = (int16_t)m;
591
            return (TIFFReadDirEntryErrOk);
592
        }
593
        case TIFF_SHORT:
594
        {
595
            uint16_t m;
596
            TIFFReadDirEntryCheckedShort(tif, direntry, &m);
597
            err = TIFFReadDirEntryCheckRangeSshortShort(m);
598
            if (err != TIFFReadDirEntryErrOk)
599
                return (err);
600
            *value = (uint16_t)m;
601
            return (TIFFReadDirEntryErrOk);
602
        }
603
        case TIFF_SSHORT:
604
            TIFFReadDirEntryCheckedSshort(tif, direntry, value);
605
            return (TIFFReadDirEntryErrOk);
606
        case TIFF_LONG:
607
        {
608
            uint32_t m;
609
            TIFFReadDirEntryCheckedLong(tif, direntry, &m);
610
            err = TIFFReadDirEntryCheckRangeSshortLong(m);
611
            if (err != TIFFReadDirEntryErrOk)
612
                return (err);
613
            *value = (int16_t)m;
614
            return (TIFFReadDirEntryErrOk);
615
        }
616
        case TIFF_SLONG:
617
        {
618
            int32_t m;
619
            TIFFReadDirEntryCheckedSlong(tif, direntry, &m);
620
            err = TIFFReadDirEntryCheckRangeSshortSlong(m);
621
            if (err != TIFFReadDirEntryErrOk)
622
                return (err);
623
            *value = (int16_t)m;
624
            return (TIFFReadDirEntryErrOk);
625
        }
626
        case TIFF_LONG8:
627
        {
628
            uint64_t m;
629
            err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m);
630
            if (err != TIFFReadDirEntryErrOk)
631
                return (err);
632
            err = TIFFReadDirEntryCheckRangeSshortLong8(m);
633
            if (err != TIFFReadDirEntryErrOk)
634
                return (err);
635
            *value = (int16_t)m;
636
            return (TIFFReadDirEntryErrOk);
637
        }
638
        case TIFF_SLONG8:
639
        {
640
            int64_t m;
641
            err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m);
642
            if (err != TIFFReadDirEntryErrOk)
643
                return (err);
644
            err = TIFFReadDirEntryCheckRangeSshortSlong8(m);
645
            if (err != TIFFReadDirEntryErrOk)
646
                return (err);
647
            *value = (int16_t)m;
648
            return (TIFFReadDirEntryErrOk);
649
        }
650
        default:
651
            return (TIFFReadDirEntryErrType);
652
    }
653
} /*-- TIFFReadDirEntrySshort() --*/
654

655
static enum TIFFReadDirEntryErr
656
TIFFReadDirEntryLong(TIFF *tif, TIFFDirEntry *direntry, uint32_t *value)
657
{
658
    enum TIFFReadDirEntryErr err;
659
    if (direntry->tdir_count != 1)
660
        return (TIFFReadDirEntryErrCount);
661
    switch (direntry->tdir_type)
662
    {
663
        case TIFF_BYTE:
664
        {
665
            uint8_t m;
666
            TIFFReadDirEntryCheckedByte(tif, direntry, &m);
667
            *value = (uint32_t)m;
668
            return (TIFFReadDirEntryErrOk);
669
        }
670
        case TIFF_SBYTE:
671
        {
672
            int8_t m;
673
            TIFFReadDirEntryCheckedSbyte(tif, direntry, &m);
674
            err = TIFFReadDirEntryCheckRangeLongSbyte(m);
675
            if (err != TIFFReadDirEntryErrOk)
676
                return (err);
677
            *value = (uint32_t)m;
678
            return (TIFFReadDirEntryErrOk);
679
        }
680
        case TIFF_SHORT:
681
        {
682
            uint16_t m;
683
            TIFFReadDirEntryCheckedShort(tif, direntry, &m);
684
            *value = (uint32_t)m;
685
            return (TIFFReadDirEntryErrOk);
686
        }
687
        case TIFF_SSHORT:
688
        {
689
            int16_t m;
690
            TIFFReadDirEntryCheckedSshort(tif, direntry, &m);
691
            err = TIFFReadDirEntryCheckRangeLongSshort(m);
692
            if (err != TIFFReadDirEntryErrOk)
693
                return (err);
694
            *value = (uint32_t)m;
695
            return (TIFFReadDirEntryErrOk);
696
        }
697
        case TIFF_LONG:
698
            TIFFReadDirEntryCheckedLong(tif, direntry, value);
699
            return (TIFFReadDirEntryErrOk);
700
        case TIFF_SLONG:
701
        {
702
            int32_t m;
703
            TIFFReadDirEntryCheckedSlong(tif, direntry, &m);
704
            err = TIFFReadDirEntryCheckRangeLongSlong(m);
705
            if (err != TIFFReadDirEntryErrOk)
706
                return (err);
707
            *value = (uint32_t)m;
708
            return (TIFFReadDirEntryErrOk);
709
        }
710
        case TIFF_LONG8:
711
        {
712
            uint64_t m;
713
            err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m);
714
            if (err != TIFFReadDirEntryErrOk)
715
                return (err);
716
            err = TIFFReadDirEntryCheckRangeLongLong8(m);
717
            if (err != TIFFReadDirEntryErrOk)
718
                return (err);
719
            *value = (uint32_t)m;
720
            return (TIFFReadDirEntryErrOk);
721
        }
722
        case TIFF_SLONG8:
723
        {
724
            int64_t m;
725
            err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m);
726
            if (err != TIFFReadDirEntryErrOk)
727
                return (err);
728
            err = TIFFReadDirEntryCheckRangeLongSlong8(m);
729
            if (err != TIFFReadDirEntryErrOk)
730
                return (err);
731
            *value = (uint32_t)m;
732
            return (TIFFReadDirEntryErrOk);
733
        }
734
        default:
735
            return (TIFFReadDirEntryErrType);
736
    }
737
} /*-- TIFFReadDirEntryLong() --*/
738

739
static enum TIFFReadDirEntryErr
740
TIFFReadDirEntrySlong(TIFF *tif, TIFFDirEntry *direntry, int32_t *value)
741
{
742
    enum TIFFReadDirEntryErr err;
743
    if (direntry->tdir_count != 1)
744
        return (TIFFReadDirEntryErrCount);
745
    switch (direntry->tdir_type)
746
    {
747
        case TIFF_BYTE:
748
        {
749
            uint8_t m;
750
            TIFFReadDirEntryCheckedByte(tif, direntry, &m);
751
            *value = (int32_t)m;
752
            return (TIFFReadDirEntryErrOk);
753
        }
754
        case TIFF_SBYTE:
755
        {
756
            int8_t m;
757
            TIFFReadDirEntryCheckedSbyte(tif, direntry, &m);
758
            *value = (int32_t)m;
759
            return (TIFFReadDirEntryErrOk);
760
        }
761
        case TIFF_SHORT:
762
        {
763
            uint16_t m;
764
            TIFFReadDirEntryCheckedShort(tif, direntry, &m);
765
            *value = (int32_t)m;
766
            return (TIFFReadDirEntryErrOk);
767
        }
768
        case TIFF_SSHORT:
769
        {
770
            int16_t m;
771
            TIFFReadDirEntryCheckedSshort(tif, direntry, &m);
772
            *value = (int32_t)m;
773
            return (TIFFReadDirEntryErrOk);
774
        }
775
        case TIFF_LONG:
776
        {
777
            uint32_t m;
778
            TIFFReadDirEntryCheckedLong(tif, direntry, &m);
779
            err = TIFFReadDirEntryCheckRangeSlongLong(m);
780
            if (err != TIFFReadDirEntryErrOk)
781
                return (err);
782
            *value = (int32_t)m;
783
            return (TIFFReadDirEntryErrOk);
784
        }
785
        case TIFF_SLONG:
786
            TIFFReadDirEntryCheckedSlong(tif, direntry, value);
787
            return (TIFFReadDirEntryErrOk);
788
        case TIFF_LONG8:
789
        {
790
            uint64_t m;
791
            err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m);
792
            if (err != TIFFReadDirEntryErrOk)
793
                return (err);
794
            err = TIFFReadDirEntryCheckRangeSlongLong8(m);
795
            if (err != TIFFReadDirEntryErrOk)
796
                return (err);
797
            *value = (int32_t)m;
798
            return (TIFFReadDirEntryErrOk);
799
        }
800
        case TIFF_SLONG8:
801
        {
802
            int64_t m;
803
            err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m);
804
            if (err != TIFFReadDirEntryErrOk)
805
                return (err);
806
            err = TIFFReadDirEntryCheckRangeSlongSlong8(m);
807
            if (err != TIFFReadDirEntryErrOk)
808
                return (err);
809
            *value = (int32_t)m;
810
            return (TIFFReadDirEntryErrOk);
811
        }
812
        default:
813
            return (TIFFReadDirEntryErrType);
814
    }
815
} /*-- TIFFReadDirEntrySlong() --*/
816

817
static enum TIFFReadDirEntryErr
818
TIFFReadDirEntryLong8(TIFF *tif, TIFFDirEntry *direntry, uint64_t *value)
819
{
820
    enum TIFFReadDirEntryErr err;
821
    if (direntry->tdir_count != 1)
822
        return (TIFFReadDirEntryErrCount);
823
    switch (direntry->tdir_type)
824
    {
825
        case TIFF_BYTE:
826
        {
827
            uint8_t m;
828
            TIFFReadDirEntryCheckedByte(tif, direntry, &m);
829
            *value = (uint64_t)m;
830
            return (TIFFReadDirEntryErrOk);
831
        }
832
        case TIFF_SBYTE:
833
        {
834
            int8_t m;
835
            TIFFReadDirEntryCheckedSbyte(tif, direntry, &m);
836
            err = TIFFReadDirEntryCheckRangeLong8Sbyte(m);
837
            if (err != TIFFReadDirEntryErrOk)
838
                return (err);
839
            *value = (uint64_t)m;
840
            return (TIFFReadDirEntryErrOk);
841
        }
842
        case TIFF_SHORT:
843
        {
844
            uint16_t m;
845
            TIFFReadDirEntryCheckedShort(tif, direntry, &m);
846
            *value = (uint64_t)m;
847
            return (TIFFReadDirEntryErrOk);
848
        }
849
        case TIFF_SSHORT:
850
        {
851
            int16_t m;
852
            TIFFReadDirEntryCheckedSshort(tif, direntry, &m);
853
            err = TIFFReadDirEntryCheckRangeLong8Sshort(m);
854
            if (err != TIFFReadDirEntryErrOk)
855
                return (err);
856
            *value = (uint64_t)m;
857
            return (TIFFReadDirEntryErrOk);
858
        }
859
        case TIFF_LONG:
860
        {
861
            uint32_t m;
862
            TIFFReadDirEntryCheckedLong(tif, direntry, &m);
863
            *value = (uint64_t)m;
864
            return (TIFFReadDirEntryErrOk);
865
        }
866
        case TIFF_SLONG:
867
        {
868
            int32_t m;
869
            TIFFReadDirEntryCheckedSlong(tif, direntry, &m);
870
            err = TIFFReadDirEntryCheckRangeLong8Slong(m);
871
            if (err != TIFFReadDirEntryErrOk)
872
                return (err);
873
            *value = (uint64_t)m;
874
            return (TIFFReadDirEntryErrOk);
875
        }
876
        case TIFF_LONG8:
877
            err = TIFFReadDirEntryCheckedLong8(tif, direntry, value);
878
            return (err);
879
        case TIFF_SLONG8:
880
        {
881
            int64_t m;
882
            err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m);
883
            if (err != TIFFReadDirEntryErrOk)
884
                return (err);
885
            err = TIFFReadDirEntryCheckRangeLong8Slong8(m);
886
            if (err != TIFFReadDirEntryErrOk)
887
                return (err);
888
            *value = (uint64_t)m;
889
            return (TIFFReadDirEntryErrOk);
890
        }
891
        default:
892
            return (TIFFReadDirEntryErrType);
893
    }
894
} /*-- TIFFReadDirEntryLong8() --*/
895

896
static enum TIFFReadDirEntryErr
897
TIFFReadDirEntrySlong8(TIFF *tif, TIFFDirEntry *direntry, int64_t *value)
898
{
899
    enum TIFFReadDirEntryErr err;
900
    if (direntry->tdir_count != 1)
901
        return (TIFFReadDirEntryErrCount);
902
    switch (direntry->tdir_type)
903
    {
904
        case TIFF_BYTE:
905
        {
906
            uint8_t m;
907
            TIFFReadDirEntryCheckedByte(tif, direntry, &m);
908
            *value = (int64_t)m;
909
            return (TIFFReadDirEntryErrOk);
910
        }
911
        case TIFF_SBYTE:
912
        {
913
            int8_t m;
914
            TIFFReadDirEntryCheckedSbyte(tif, direntry, &m);
915
            *value = (int64_t)m;
916
            return (TIFFReadDirEntryErrOk);
917
        }
918
        case TIFF_SHORT:
919
        {
920
            uint16_t m;
921
            TIFFReadDirEntryCheckedShort(tif, direntry, &m);
922
            *value = (int64_t)m;
923
            return (TIFFReadDirEntryErrOk);
924
        }
925
        case TIFF_SSHORT:
926
        {
927
            int16_t m;
928
            TIFFReadDirEntryCheckedSshort(tif, direntry, &m);
929
            *value = (int64_t)m;
930
            return (TIFFReadDirEntryErrOk);
931
        }
932
        case TIFF_LONG:
933
        {
934
            uint32_t m;
935
            TIFFReadDirEntryCheckedLong(tif, direntry, &m);
936
            *value = (int64_t)m;
937
            return (TIFFReadDirEntryErrOk);
938
        }
939
        case TIFF_SLONG:
940
        {
941
            int32_t m;
942
            TIFFReadDirEntryCheckedSlong(tif, direntry, &m);
943
            *value = (int64_t)m;
944
            return (TIFFReadDirEntryErrOk);
945
        }
946
        case TIFF_LONG8:
947
        {
948
            uint64_t m;
949
            err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m);
950
            if (err != TIFFReadDirEntryErrOk)
951
                return (err);
952
            err = TIFFReadDirEntryCheckRangeSlong8Long8(m);
953
            if (err != TIFFReadDirEntryErrOk)
954
                return (err);
955
            *value = (int64_t)m;
956
            return (TIFFReadDirEntryErrOk);
957
        }
958
        case TIFF_SLONG8:
959
            err = TIFFReadDirEntryCheckedSlong8(tif, direntry, value);
960
            return (err);
961
        default:
962
            return (TIFFReadDirEntryErrType);
963
    }
964
} /*-- TIFFReadDirEntrySlong8() --*/
965

966
static enum TIFFReadDirEntryErr
967
TIFFReadDirEntryFloat(TIFF *tif, TIFFDirEntry *direntry, float *value)
968
{
969
    enum TIFFReadDirEntryErr err;
970
    if (direntry->tdir_count != 1)
971
        return (TIFFReadDirEntryErrCount);
972
    switch (direntry->tdir_type)
973
    {
974
        case TIFF_BYTE:
975
        {
976
            uint8_t m;
977
            TIFFReadDirEntryCheckedByte(tif, direntry, &m);
978
            *value = (float)m;
979
            return (TIFFReadDirEntryErrOk);
980
        }
981
        case TIFF_SBYTE:
982
        {
983
            int8_t m;
984
            TIFFReadDirEntryCheckedSbyte(tif, direntry, &m);
985
            *value = (float)m;
986
            return (TIFFReadDirEntryErrOk);
987
        }
988
        case TIFF_SHORT:
989
        {
990
            uint16_t m;
991
            TIFFReadDirEntryCheckedShort(tif, direntry, &m);
992
            *value = (float)m;
993
            return (TIFFReadDirEntryErrOk);
994
        }
995
        case TIFF_SSHORT:
996
        {
997
            int16_t m;
998
            TIFFReadDirEntryCheckedSshort(tif, direntry, &m);
999
            *value = (float)m;
1000
            return (TIFFReadDirEntryErrOk);
1001
        }
1002
        case TIFF_LONG:
1003
        {
1004
            uint32_t m;
1005
            TIFFReadDirEntryCheckedLong(tif, direntry, &m);
1006
            *value = (float)m;
1007
            return (TIFFReadDirEntryErrOk);
1008
        }
1009
        case TIFF_SLONG:
1010
        {
1011
            int32_t m;
1012
            TIFFReadDirEntryCheckedSlong(tif, direntry, &m);
1013
            *value = (float)m;
1014
            return (TIFFReadDirEntryErrOk);
1015
        }
1016
        case TIFF_LONG8:
1017
        {
1018
            uint64_t m;
1019
            err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m);
1020
            if (err != TIFFReadDirEntryErrOk)
1021
                return (err);
1022
            *value = (float)m;
1023
            return (TIFFReadDirEntryErrOk);
1024
        }
1025
        case TIFF_SLONG8:
1026
        {
1027
            int64_t m;
1028
            err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m);
1029
            if (err != TIFFReadDirEntryErrOk)
1030
                return (err);
1031
            *value = (float)m;
1032
            return (TIFFReadDirEntryErrOk);
1033
        }
1034
        case TIFF_RATIONAL:
1035
        {
1036
            double m;
1037
            err = TIFFReadDirEntryCheckedRational(tif, direntry, &m);
1038
            if (err != TIFFReadDirEntryErrOk)
1039
                return (err);
1040
            *value = (float)m;
1041
            return (TIFFReadDirEntryErrOk);
1042
        }
1043
        case TIFF_SRATIONAL:
1044
        {
1045
            double m;
1046
            err = TIFFReadDirEntryCheckedSrational(tif, direntry, &m);
1047
            if (err != TIFFReadDirEntryErrOk)
1048
                return (err);
1049
            *value = (float)m;
1050
            return (TIFFReadDirEntryErrOk);
1051
        }
1052
        case TIFF_FLOAT:
1053
            TIFFReadDirEntryCheckedFloat(tif, direntry, value);
1054
            return (TIFFReadDirEntryErrOk);
1055
        case TIFF_DOUBLE:
1056
        {
1057
            double m;
1058
            err = TIFFReadDirEntryCheckedDouble(tif, direntry, &m);
1059
            if (err != TIFFReadDirEntryErrOk)
1060
                return (err);
1061
            if ((m > FLT_MAX) || (m < -FLT_MAX))
1062
                return (TIFFReadDirEntryErrRange);
1063
            *value = (float)m;
1064
            return (TIFFReadDirEntryErrOk);
1065
        }
1066
        default:
1067
            return (TIFFReadDirEntryErrType);
1068
    }
1069
}
1070

1071
static enum TIFFReadDirEntryErr
1072
TIFFReadDirEntryDouble(TIFF *tif, TIFFDirEntry *direntry, double *value)
1073
{
1074
    enum TIFFReadDirEntryErr err;
1075
    if (direntry->tdir_count != 1)
1076
        return (TIFFReadDirEntryErrCount);
1077
    switch (direntry->tdir_type)
1078
    {
1079
        case TIFF_BYTE:
1080
        {
1081
            uint8_t m;
1082
            TIFFReadDirEntryCheckedByte(tif, direntry, &m);
1083
            *value = (double)m;
1084
            return (TIFFReadDirEntryErrOk);
1085
        }
1086
        case TIFF_SBYTE:
1087
        {
1088
            int8_t m;
1089
            TIFFReadDirEntryCheckedSbyte(tif, direntry, &m);
1090
            *value = (double)m;
1091
            return (TIFFReadDirEntryErrOk);
1092
        }
1093
        case TIFF_SHORT:
1094
        {
1095
            uint16_t m;
1096
            TIFFReadDirEntryCheckedShort(tif, direntry, &m);
1097
            *value = (double)m;
1098
            return (TIFFReadDirEntryErrOk);
1099
        }
1100
        case TIFF_SSHORT:
1101
        {
1102
            int16_t m;
1103
            TIFFReadDirEntryCheckedSshort(tif, direntry, &m);
1104
            *value = (double)m;
1105
            return (TIFFReadDirEntryErrOk);
1106
        }
1107
        case TIFF_LONG:
1108
        {
1109
            uint32_t m;
1110
            TIFFReadDirEntryCheckedLong(tif, direntry, &m);
1111
            *value = (double)m;
1112
            return (TIFFReadDirEntryErrOk);
1113
        }
1114
        case TIFF_SLONG:
1115
        {
1116
            int32_t m;
1117
            TIFFReadDirEntryCheckedSlong(tif, direntry, &m);
1118
            *value = (double)m;
1119
            return (TIFFReadDirEntryErrOk);
1120
        }
1121
        case TIFF_LONG8:
1122
        {
1123
            uint64_t m;
1124
            err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m);
1125
            if (err != TIFFReadDirEntryErrOk)
1126
                return (err);
1127
            *value = (double)m;
1128
            return (TIFFReadDirEntryErrOk);
1129
        }
1130
        case TIFF_SLONG8:
1131
        {
1132
            int64_t m;
1133
            err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m);
1134
            if (err != TIFFReadDirEntryErrOk)
1135
                return (err);
1136
            *value = (double)m;
1137
            return (TIFFReadDirEntryErrOk);
1138
        }
1139
        case TIFF_RATIONAL:
1140
            err = TIFFReadDirEntryCheckedRational(tif, direntry, value);
1141
            return (err);
1142
        case TIFF_SRATIONAL:
1143
            err = TIFFReadDirEntryCheckedSrational(tif, direntry, value);
1144
            return (err);
1145
        case TIFF_FLOAT:
1146
        {
1147
            float m;
1148
            TIFFReadDirEntryCheckedFloat(tif, direntry, &m);
1149
            *value = (double)m;
1150
            return (TIFFReadDirEntryErrOk);
1151
        }
1152
        case TIFF_DOUBLE:
1153
            err = TIFFReadDirEntryCheckedDouble(tif, direntry, value);
1154
            return (err);
1155
        default:
1156
            return (TIFFReadDirEntryErrType);
1157
    }
1158
}
1159

1160
static enum TIFFReadDirEntryErr
1161
TIFFReadDirEntryIfd8(TIFF *tif, TIFFDirEntry *direntry, uint64_t *value)
1162
{
1163
    enum TIFFReadDirEntryErr err;
1164
    if (direntry->tdir_count != 1)
1165
        return (TIFFReadDirEntryErrCount);
1166
    switch (direntry->tdir_type)
1167
    {
1168
        case TIFF_LONG:
1169
        case TIFF_IFD:
1170
        {
1171
            uint32_t m;
1172
            TIFFReadDirEntryCheckedLong(tif, direntry, &m);
1173
            *value = (uint64_t)m;
1174
            return (TIFFReadDirEntryErrOk);
1175
        }
1176
        case TIFF_LONG8:
1177
        case TIFF_IFD8:
1178
            err = TIFFReadDirEntryCheckedLong8(tif, direntry, value);
1179
            return (err);
1180
        default:
1181
            return (TIFFReadDirEntryErrType);
1182
    }
1183
}
1184

1185
#define INITIAL_THRESHOLD (1024 * 1024)
1186
#define THRESHOLD_MULTIPLIER 10
1187
#define MAX_THRESHOLD                                                          \
1188
    (THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER *      \
1189
     INITIAL_THRESHOLD)
1190

1191
static enum TIFFReadDirEntryErr TIFFReadDirEntryDataAndRealloc(TIFF *tif,
1192
                                                               uint64_t offset,
1193
                                                               tmsize_t size,
1194
                                                               void **pdest)
1195
{
1196
#if SIZEOF_SIZE_T == 8
1197
    tmsize_t threshold = INITIAL_THRESHOLD;
1198
#endif
1199
    tmsize_t already_read = 0;
1200

1201
    assert(!isMapped(tif));
1202

1203
    if (!SeekOK(tif, offset))
1204
        return (TIFFReadDirEntryErrIo);
1205

1206
    /* On 64 bit processes, read first a maximum of 1 MB, then 10 MB, etc */
1207
    /* so as to avoid allocating too much memory in case the file is too */
1208
    /* short. We could ask for the file size, but this might be */
1209
    /* expensive with some I/O layers (think of reading a gzipped file) */
1210
    /* Restrict to 64 bit processes, so as to avoid reallocs() */
1211
    /* on 32 bit processes where virtual memory is scarce.  */
1212
    while (already_read < size)
1213
    {
1214
        void *new_dest;
1215
        tmsize_t bytes_read;
1216
        tmsize_t to_read = size - already_read;
1217
#if SIZEOF_SIZE_T == 8
1218
        if (to_read >= threshold && threshold < MAX_THRESHOLD)
1219
        {
1220
            to_read = threshold;
1221
            threshold *= THRESHOLD_MULTIPLIER;
1222
        }
1223
#endif
1224

1225
        new_dest =
1226
            (uint8_t *)_TIFFreallocExt(tif, *pdest, already_read + to_read);
1227
        if (new_dest == NULL)
1228
        {
1229
            TIFFErrorExtR(tif, tif->tif_name,
1230
                          "Failed to allocate memory for %s "
1231
                          "(%" TIFF_SSIZE_FORMAT
1232
                          " elements of %" TIFF_SSIZE_FORMAT " bytes each)",
1233
                          "TIFFReadDirEntryArray", (tmsize_t)1,
1234
                          already_read + to_read);
1235
            return TIFFReadDirEntryErrAlloc;
1236
        }
1237
        *pdest = new_dest;
1238

1239
        bytes_read = TIFFReadFile(tif, (char *)*pdest + already_read, to_read);
1240
        already_read += bytes_read;
1241
        if (bytes_read != to_read)
1242
        {
1243
            return TIFFReadDirEntryErrIo;
1244
        }
1245
    }
1246
    return TIFFReadDirEntryErrOk;
1247
}
1248

1249
/* Caution: if raising that value, make sure int32 / uint32 overflows can't
1250
 * occur elsewhere */
1251
#define MAX_SIZE_TAG_DATA 2147483647U
1252

1253
static enum TIFFReadDirEntryErr
1254
TIFFReadDirEntryArrayWithLimit(TIFF *tif, TIFFDirEntry *direntry,
1255
                               uint32_t *count, uint32_t desttypesize,
1256
                               void **value, uint64_t maxcount)
1257
{
1258
    int typesize;
1259
    uint32_t datasize;
1260
    void *data;
1261
    uint64_t target_count64;
1262
    int original_datasize_clamped;
1263
    typesize = TIFFDataWidth(direntry->tdir_type);
1264

1265
    target_count64 =
1266
        (direntry->tdir_count > maxcount) ? maxcount : direntry->tdir_count;
1267

1268
    if ((target_count64 == 0) || (typesize == 0))
1269
    {
1270
        *value = 0;
1271
        return (TIFFReadDirEntryErrOk);
1272
    }
1273
    (void)desttypesize;
1274

1275
    /* We just want to know if the original tag size is more than 4 bytes
1276
     * (classic TIFF) or 8 bytes (BigTIFF)
1277
     */
1278
    original_datasize_clamped =
1279
        ((direntry->tdir_count > 10) ? 10 : (int)direntry->tdir_count) *
1280
        typesize;
1281

1282
    /*
1283
     * As a sanity check, make sure we have no more than a 2GB tag array
1284
     * in either the current data type or the dest data type.  This also
1285
     * avoids problems with overflow of tmsize_t on 32bit systems.
1286
     */
1287
    if ((uint64_t)(MAX_SIZE_TAG_DATA / typesize) < target_count64)
1288
        return (TIFFReadDirEntryErrSizesan);
1289
    if ((uint64_t)(MAX_SIZE_TAG_DATA / desttypesize) < target_count64)
1290
        return (TIFFReadDirEntryErrSizesan);
1291

1292
    *count = (uint32_t)target_count64;
1293
    datasize = (*count) * typesize;
1294
    assert((tmsize_t)datasize > 0);
1295

1296
    if (datasize > 100 * 1024 * 1024)
1297
    {
1298
        /* Before allocating a huge amount of memory for corrupted files, check
1299
         * if size of requested memory is not greater than file size.
1300
         */
1301
        const uint64_t filesize = TIFFGetFileSize(tif);
1302
        if (datasize > filesize)
1303
        {
1304
            TIFFWarningExtR(tif, "ReadDirEntryArray",
1305
                            "Requested memory size for tag %d (0x%x) %" PRIu32
1306
                            " is greater than filesize %" PRIu64
1307
                            ". Memory not allocated, tag not read",
1308
                            direntry->tdir_tag, direntry->tdir_tag, datasize,
1309
                            filesize);
1310
            return (TIFFReadDirEntryErrAlloc);
1311
        }
1312
    }
1313

1314
    if (isMapped(tif) && datasize > (uint64_t)tif->tif_size)
1315
        return TIFFReadDirEntryErrIo;
1316

1317
    if (!isMapped(tif) && (((tif->tif_flags & TIFF_BIGTIFF) && datasize > 8) ||
1318
                           (!(tif->tif_flags & TIFF_BIGTIFF) && datasize > 4)))
1319
    {
1320
        data = NULL;
1321
    }
1322
    else
1323
    {
1324
        data = _TIFFCheckMalloc(tif, *count, typesize, "ReadDirEntryArray");
1325
        if (data == 0)
1326
            return (TIFFReadDirEntryErrAlloc);
1327
    }
1328
    if (!(tif->tif_flags & TIFF_BIGTIFF))
1329
    {
1330
        /* Only the condition on original_datasize_clamped. The second
1331
         * one is implied, but Coverity Scan cannot see it. */
1332
        if (original_datasize_clamped <= 4 && datasize <= 4)
1333
            _TIFFmemcpy(data, &direntry->tdir_offset, datasize);
1334
        else
1335
        {
1336
            enum TIFFReadDirEntryErr err;
1337
            uint32_t offset = direntry->tdir_offset.toff_long;
1338
            if (tif->tif_flags & TIFF_SWAB)
1339
                TIFFSwabLong(&offset);
1340
            if (isMapped(tif))
1341
                err = TIFFReadDirEntryData(tif, (uint64_t)offset,
1342
                                           (tmsize_t)datasize, data);
1343
            else
1344
                err = TIFFReadDirEntryDataAndRealloc(tif, (uint64_t)offset,
1345
                                                     (tmsize_t)datasize, &data);
1346
            if (err != TIFFReadDirEntryErrOk)
1347
            {
1348
                _TIFFfreeExt(tif, data);
1349
                return (err);
1350
            }
1351
        }
1352
    }
1353
    else
1354
    {
1355
        /* See above comment for the Classic TIFF case */
1356
        if (original_datasize_clamped <= 8 && datasize <= 8)
1357
            _TIFFmemcpy(data, &direntry->tdir_offset, datasize);
1358
        else
1359
        {
1360
            enum TIFFReadDirEntryErr err;
1361
            uint64_t offset = direntry->tdir_offset.toff_long8;
1362
            if (tif->tif_flags & TIFF_SWAB)
1363
                TIFFSwabLong8(&offset);
1364
            if (isMapped(tif))
1365
                err = TIFFReadDirEntryData(tif, (uint64_t)offset,
1366
                                           (tmsize_t)datasize, data);
1367
            else
1368
                err = TIFFReadDirEntryDataAndRealloc(tif, (uint64_t)offset,
1369
                                                     (tmsize_t)datasize, &data);
1370
            if (err != TIFFReadDirEntryErrOk)
1371
            {
1372
                _TIFFfreeExt(tif, data);
1373
                return (err);
1374
            }
1375
        }
1376
    }
1377
    *value = data;
1378
    return (TIFFReadDirEntryErrOk);
1379
}
1380

1381
static enum TIFFReadDirEntryErr
1382
TIFFReadDirEntryArray(TIFF *tif, TIFFDirEntry *direntry, uint32_t *count,
1383
                      uint32_t desttypesize, void **value)
1384
{
1385
    return TIFFReadDirEntryArrayWithLimit(tif, direntry, count, desttypesize,
1386
                                          value, ~((uint64_t)0));
1387
}
1388

1389
static enum TIFFReadDirEntryErr
1390
TIFFReadDirEntryByteArray(TIFF *tif, TIFFDirEntry *direntry, uint8_t **value)
1391
{
1392
    enum TIFFReadDirEntryErr err;
1393
    uint32_t count;
1394
    void *origdata;
1395
    uint8_t *data;
1396
    switch (direntry->tdir_type)
1397
    {
1398
        case TIFF_ASCII:
1399
        case TIFF_UNDEFINED:
1400
        case TIFF_BYTE:
1401
        case TIFF_SBYTE:
1402
        case TIFF_SHORT:
1403
        case TIFF_SSHORT:
1404
        case TIFF_LONG:
1405
        case TIFF_SLONG:
1406
        case TIFF_LONG8:
1407
        case TIFF_SLONG8:
1408
            break;
1409
        default:
1410
            return (TIFFReadDirEntryErrType);
1411
    }
1412
    err = TIFFReadDirEntryArray(tif, direntry, &count, 1, &origdata);
1413
    if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
1414
    {
1415
        *value = 0;
1416
        return (err);
1417
    }
1418
    switch (direntry->tdir_type)
1419
    {
1420
        case TIFF_ASCII:
1421
        case TIFF_UNDEFINED:
1422
        case TIFF_BYTE:
1423
            *value = (uint8_t *)origdata;
1424
            return (TIFFReadDirEntryErrOk);
1425
        case TIFF_SBYTE:
1426
        {
1427
            int8_t *m;
1428
            uint32_t n;
1429
            m = (int8_t *)origdata;
1430
            for (n = 0; n < count; n++)
1431
            {
1432
                err = TIFFReadDirEntryCheckRangeByteSbyte(*m);
1433
                if (err != TIFFReadDirEntryErrOk)
1434
                {
1435
                    _TIFFfreeExt(tif, origdata);
1436
                    return (err);
1437
                }
1438
                m++;
1439
            }
1440
            *value = (uint8_t *)origdata;
1441
            return (TIFFReadDirEntryErrOk);
1442
        }
1443
    }
1444
    data = (uint8_t *)_TIFFmallocExt(tif, count);
1445
    if (data == 0)
1446
    {
1447
        _TIFFfreeExt(tif, origdata);
1448
        return (TIFFReadDirEntryErrAlloc);
1449
    }
1450
    switch (direntry->tdir_type)
1451
    {
1452
        case TIFF_SHORT:
1453
        {
1454
            uint16_t *ma;
1455
            uint8_t *mb;
1456
            uint32_t n;
1457
            ma = (uint16_t *)origdata;
1458
            mb = data;
1459
            for (n = 0; n < count; n++)
1460
            {
1461
                if (tif->tif_flags & TIFF_SWAB)
1462
                    TIFFSwabShort(ma);
1463
                err = TIFFReadDirEntryCheckRangeByteShort(*ma);
1464
                if (err != TIFFReadDirEntryErrOk)
1465
                    break;
1466
                *mb++ = (uint8_t)(*ma++);
1467
            }
1468
        }
1469
        break;
1470
        case TIFF_SSHORT:
1471
        {
1472
            int16_t *ma;
1473
            uint8_t *mb;
1474
            uint32_t n;
1475
            ma = (int16_t *)origdata;
1476
            mb = data;
1477
            for (n = 0; n < count; n++)
1478
            {
1479
                if (tif->tif_flags & TIFF_SWAB)
1480
                    TIFFSwabShort((uint16_t *)ma);
1481
                err = TIFFReadDirEntryCheckRangeByteSshort(*ma);
1482
                if (err != TIFFReadDirEntryErrOk)
1483
                    break;
1484
                *mb++ = (uint8_t)(*ma++);
1485
            }
1486
        }
1487
        break;
1488
        case TIFF_LONG:
1489
        {
1490
            uint32_t *ma;
1491
            uint8_t *mb;
1492
            uint32_t n;
1493
            ma = (uint32_t *)origdata;
1494
            mb = data;
1495
            for (n = 0; n < count; n++)
1496
            {
1497
                if (tif->tif_flags & TIFF_SWAB)
1498
                    TIFFSwabLong(ma);
1499
                err = TIFFReadDirEntryCheckRangeByteLong(*ma);
1500
                if (err != TIFFReadDirEntryErrOk)
1501
                    break;
1502
                *mb++ = (uint8_t)(*ma++);
1503
            }
1504
        }
1505
        break;
1506
        case TIFF_SLONG:
1507
        {
1508
            int32_t *ma;
1509
            uint8_t *mb;
1510
            uint32_t n;
1511
            ma = (int32_t *)origdata;
1512
            mb = data;
1513
            for (n = 0; n < count; n++)
1514
            {
1515
                if (tif->tif_flags & TIFF_SWAB)
1516
                    TIFFSwabLong((uint32_t *)ma);
1517
                err = TIFFReadDirEntryCheckRangeByteSlong(*ma);
1518
                if (err != TIFFReadDirEntryErrOk)
1519
                    break;
1520
                *mb++ = (uint8_t)(*ma++);
1521
            }
1522
        }
1523
        break;
1524
        case TIFF_LONG8:
1525
        {
1526
            uint64_t *ma;
1527
            uint8_t *mb;
1528
            uint32_t n;
1529
            ma = (uint64_t *)origdata;
1530
            mb = data;
1531
            for (n = 0; n < count; n++)
1532
            {
1533
                if (tif->tif_flags & TIFF_SWAB)
1534
                    TIFFSwabLong8(ma);
1535
                err = TIFFReadDirEntryCheckRangeByteLong8(*ma);
1536
                if (err != TIFFReadDirEntryErrOk)
1537
                    break;
1538
                *mb++ = (uint8_t)(*ma++);
1539
            }
1540
        }
1541
        break;
1542
        case TIFF_SLONG8:
1543
        {
1544
            int64_t *ma;
1545
            uint8_t *mb;
1546
            uint32_t n;
1547
            ma = (int64_t *)origdata;
1548
            mb = data;
1549
            for (n = 0; n < count; n++)
1550
            {
1551
                if (tif->tif_flags & TIFF_SWAB)
1552
                    TIFFSwabLong8((uint64_t *)ma);
1553
                err = TIFFReadDirEntryCheckRangeByteSlong8(*ma);
1554
                if (err != TIFFReadDirEntryErrOk)
1555
                    break;
1556
                *mb++ = (uint8_t)(*ma++);
1557
            }
1558
        }
1559
        break;
1560
    }
1561
    _TIFFfreeExt(tif, origdata);
1562
    if (err != TIFFReadDirEntryErrOk)
1563
    {
1564
        _TIFFfreeExt(tif, data);
1565
        return (err);
1566
    }
1567
    *value = data;
1568
    return (TIFFReadDirEntryErrOk);
1569
}
1570

1571
static enum TIFFReadDirEntryErr
1572
TIFFReadDirEntrySbyteArray(TIFF *tif, TIFFDirEntry *direntry, int8_t **value)
1573
{
1574
    enum TIFFReadDirEntryErr err;
1575
    uint32_t count;
1576
    void *origdata;
1577
    int8_t *data;
1578
    switch (direntry->tdir_type)
1579
    {
1580
        case TIFF_UNDEFINED:
1581
        case TIFF_BYTE:
1582
        case TIFF_SBYTE:
1583
        case TIFF_SHORT:
1584
        case TIFF_SSHORT:
1585
        case TIFF_LONG:
1586
        case TIFF_SLONG:
1587
        case TIFF_LONG8:
1588
        case TIFF_SLONG8:
1589
            break;
1590
        default:
1591
            return (TIFFReadDirEntryErrType);
1592
    }
1593
    err = TIFFReadDirEntryArray(tif, direntry, &count, 1, &origdata);
1594
    if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
1595
    {
1596
        *value = 0;
1597
        return (err);
1598
    }
1599
    switch (direntry->tdir_type)
1600
    {
1601
        case TIFF_UNDEFINED:
1602
        case TIFF_BYTE:
1603
        {
1604
            uint8_t *m;
1605
            uint32_t n;
1606
            m = (uint8_t *)origdata;
1607
            for (n = 0; n < count; n++)
1608
            {
1609
                err = TIFFReadDirEntryCheckRangeSbyteByte(*m);
1610
                if (err != TIFFReadDirEntryErrOk)
1611
                {
1612
                    _TIFFfreeExt(tif, origdata);
1613
                    return (err);
1614
                }
1615
                m++;
1616
            }
1617
            *value = (int8_t *)origdata;
1618
            return (TIFFReadDirEntryErrOk);
1619
        }
1620
        case TIFF_SBYTE:
1621
            *value = (int8_t *)origdata;
1622
            return (TIFFReadDirEntryErrOk);
1623
    }
1624
    data = (int8_t *)_TIFFmallocExt(tif, count);
1625
    if (data == 0)
1626
    {
1627
        _TIFFfreeExt(tif, origdata);
1628
        return (TIFFReadDirEntryErrAlloc);
1629
    }
1630
    switch (direntry->tdir_type)
1631
    {
1632
        case TIFF_SHORT:
1633
        {
1634
            uint16_t *ma;
1635
            int8_t *mb;
1636
            uint32_t n;
1637
            ma = (uint16_t *)origdata;
1638
            mb = data;
1639
            for (n = 0; n < count; n++)
1640
            {
1641
                if (tif->tif_flags & TIFF_SWAB)
1642
                    TIFFSwabShort(ma);
1643
                err = TIFFReadDirEntryCheckRangeSbyteShort(*ma);
1644
                if (err != TIFFReadDirEntryErrOk)
1645
                    break;
1646
                *mb++ = (int8_t)(*ma++);
1647
            }
1648
        }
1649
        break;
1650
        case TIFF_SSHORT:
1651
        {
1652
            int16_t *ma;
1653
            int8_t *mb;
1654
            uint32_t n;
1655
            ma = (int16_t *)origdata;
1656
            mb = data;
1657
            for (n = 0; n < count; n++)
1658
            {
1659
                if (tif->tif_flags & TIFF_SWAB)
1660
                    TIFFSwabShort((uint16_t *)ma);
1661
                err = TIFFReadDirEntryCheckRangeSbyteSshort(*ma);
1662
                if (err != TIFFReadDirEntryErrOk)
1663
                    break;
1664
                *mb++ = (int8_t)(*ma++);
1665
            }
1666
        }
1667
        break;
1668
        case TIFF_LONG:
1669
        {
1670
            uint32_t *ma;
1671
            int8_t *mb;
1672
            uint32_t n;
1673
            ma = (uint32_t *)origdata;
1674
            mb = data;
1675
            for (n = 0; n < count; n++)
1676
            {
1677
                if (tif->tif_flags & TIFF_SWAB)
1678
                    TIFFSwabLong(ma);
1679
                err = TIFFReadDirEntryCheckRangeSbyteLong(*ma);
1680
                if (err != TIFFReadDirEntryErrOk)
1681
                    break;
1682
                *mb++ = (int8_t)(*ma++);
1683
            }
1684
        }
1685
        break;
1686
        case TIFF_SLONG:
1687
        {
1688
            int32_t *ma;
1689
            int8_t *mb;
1690
            uint32_t n;
1691
            ma = (int32_t *)origdata;
1692
            mb = data;
1693
            for (n = 0; n < count; n++)
1694
            {
1695
                if (tif->tif_flags & TIFF_SWAB)
1696
                    TIFFSwabLong((uint32_t *)ma);
1697
                err = TIFFReadDirEntryCheckRangeSbyteSlong(*ma);
1698
                if (err != TIFFReadDirEntryErrOk)
1699
                    break;
1700
                *mb++ = (int8_t)(*ma++);
1701
            }
1702
        }
1703
        break;
1704
        case TIFF_LONG8:
1705
        {
1706
            uint64_t *ma;
1707
            int8_t *mb;
1708
            uint32_t n;
1709
            ma = (uint64_t *)origdata;
1710
            mb = data;
1711
            for (n = 0; n < count; n++)
1712
            {
1713
                if (tif->tif_flags & TIFF_SWAB)
1714
                    TIFFSwabLong8(ma);
1715
                err = TIFFReadDirEntryCheckRangeSbyteLong8(*ma);
1716
                if (err != TIFFReadDirEntryErrOk)
1717
                    break;
1718
                *mb++ = (int8_t)(*ma++);
1719
            }
1720
        }
1721
        break;
1722
        case TIFF_SLONG8:
1723
        {
1724
            int64_t *ma;
1725
            int8_t *mb;
1726
            uint32_t n;
1727
            ma = (int64_t *)origdata;
1728
            mb = data;
1729
            for (n = 0; n < count; n++)
1730
            {
1731
                if (tif->tif_flags & TIFF_SWAB)
1732
                    TIFFSwabLong8((uint64_t *)ma);
1733
                err = TIFFReadDirEntryCheckRangeSbyteSlong8(*ma);
1734
                if (err != TIFFReadDirEntryErrOk)
1735
                    break;
1736
                *mb++ = (int8_t)(*ma++);
1737
            }
1738
        }
1739
        break;
1740
    }
1741
    _TIFFfreeExt(tif, origdata);
1742
    if (err != TIFFReadDirEntryErrOk)
1743
    {
1744
        _TIFFfreeExt(tif, data);
1745
        return (err);
1746
    }
1747
    *value = data;
1748
    return (TIFFReadDirEntryErrOk);
1749
}
1750

1751
static enum TIFFReadDirEntryErr
1752
TIFFReadDirEntryShortArray(TIFF *tif, TIFFDirEntry *direntry, uint16_t **value)
1753
{
1754
    enum TIFFReadDirEntryErr err;
1755
    uint32_t count;
1756
    void *origdata;
1757
    uint16_t *data;
1758
    switch (direntry->tdir_type)
1759
    {
1760
        case TIFF_BYTE:
1761
        case TIFF_SBYTE:
1762
        case TIFF_SHORT:
1763
        case TIFF_SSHORT:
1764
        case TIFF_LONG:
1765
        case TIFF_SLONG:
1766
        case TIFF_LONG8:
1767
        case TIFF_SLONG8:
1768
            break;
1769
        default:
1770
            return (TIFFReadDirEntryErrType);
1771
    }
1772
    err = TIFFReadDirEntryArray(tif, direntry, &count, 2, &origdata);
1773
    if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
1774
    {
1775
        *value = 0;
1776
        return (err);
1777
    }
1778
    switch (direntry->tdir_type)
1779
    {
1780
        case TIFF_SHORT:
1781
            *value = (uint16_t *)origdata;
1782
            if (tif->tif_flags & TIFF_SWAB)
1783
                TIFFSwabArrayOfShort(*value, count);
1784
            return (TIFFReadDirEntryErrOk);
1785
        case TIFF_SSHORT:
1786
        {
1787
            int16_t *m;
1788
            uint32_t n;
1789
            m = (int16_t *)origdata;
1790
            for (n = 0; n < count; n++)
1791
            {
1792
                if (tif->tif_flags & TIFF_SWAB)
1793
                    TIFFSwabShort((uint16_t *)m);
1794
                err = TIFFReadDirEntryCheckRangeShortSshort(*m);
1795
                if (err != TIFFReadDirEntryErrOk)
1796
                {
1797
                    _TIFFfreeExt(tif, origdata);
1798
                    return (err);
1799
                }
1800
                m++;
1801
            }
1802
            *value = (uint16_t *)origdata;
1803
            return (TIFFReadDirEntryErrOk);
1804
        }
1805
    }
1806
    data = (uint16_t *)_TIFFmallocExt(tif, count * 2);
1807
    if (data == 0)
1808
    {
1809
        _TIFFfreeExt(tif, origdata);
1810
        return (TIFFReadDirEntryErrAlloc);
1811
    }
1812
    switch (direntry->tdir_type)
1813
    {
1814
        case TIFF_BYTE:
1815
        {
1816
            uint8_t *ma;
1817
            uint16_t *mb;
1818
            uint32_t n;
1819
            ma = (uint8_t *)origdata;
1820
            mb = data;
1821
            for (n = 0; n < count; n++)
1822
                *mb++ = (uint16_t)(*ma++);
1823
        }
1824
        break;
1825
        case TIFF_SBYTE:
1826
        {
1827
            int8_t *ma;
1828
            uint16_t *mb;
1829
            uint32_t n;
1830
            ma = (int8_t *)origdata;
1831
            mb = data;
1832
            for (n = 0; n < count; n++)
1833
            {
1834
                err = TIFFReadDirEntryCheckRangeShortSbyte(*ma);
1835
                if (err != TIFFReadDirEntryErrOk)
1836
                    break;
1837
                *mb++ = (uint16_t)(*ma++);
1838
            }
1839
        }
1840
        break;
1841
        case TIFF_LONG:
1842
        {
1843
            uint32_t *ma;
1844
            uint16_t *mb;
1845
            uint32_t n;
1846
            ma = (uint32_t *)origdata;
1847
            mb = data;
1848
            for (n = 0; n < count; n++)
1849
            {
1850
                if (tif->tif_flags & TIFF_SWAB)
1851
                    TIFFSwabLong(ma);
1852
                err = TIFFReadDirEntryCheckRangeShortLong(*ma);
1853
                if (err != TIFFReadDirEntryErrOk)
1854
                    break;
1855
                *mb++ = (uint16_t)(*ma++);
1856
            }
1857
        }
1858
        break;
1859
        case TIFF_SLONG:
1860
        {
1861
            int32_t *ma;
1862
            uint16_t *mb;
1863
            uint32_t n;
1864
            ma = (int32_t *)origdata;
1865
            mb = data;
1866
            for (n = 0; n < count; n++)
1867
            {
1868
                if (tif->tif_flags & TIFF_SWAB)
1869
                    TIFFSwabLong((uint32_t *)ma);
1870
                err = TIFFReadDirEntryCheckRangeShortSlong(*ma);
1871
                if (err != TIFFReadDirEntryErrOk)
1872
                    break;
1873
                *mb++ = (uint16_t)(*ma++);
1874
            }
1875
        }
1876
        break;
1877
        case TIFF_LONG8:
1878
        {
1879
            uint64_t *ma;
1880
            uint16_t *mb;
1881
            uint32_t n;
1882
            ma = (uint64_t *)origdata;
1883
            mb = data;
1884
            for (n = 0; n < count; n++)
1885
            {
1886
                if (tif->tif_flags & TIFF_SWAB)
1887
                    TIFFSwabLong8(ma);
1888
                err = TIFFReadDirEntryCheckRangeShortLong8(*ma);
1889
                if (err != TIFFReadDirEntryErrOk)
1890
                    break;
1891
                *mb++ = (uint16_t)(*ma++);
1892
            }
1893
        }
1894
        break;
1895
        case TIFF_SLONG8:
1896
        {
1897
            int64_t *ma;
1898
            uint16_t *mb;
1899
            uint32_t n;
1900
            ma = (int64_t *)origdata;
1901
            mb = data;
1902
            for (n = 0; n < count; n++)
1903
            {
1904
                if (tif->tif_flags & TIFF_SWAB)
1905
                    TIFFSwabLong8((uint64_t *)ma);
1906
                err = TIFFReadDirEntryCheckRangeShortSlong8(*ma);
1907
                if (err != TIFFReadDirEntryErrOk)
1908
                    break;
1909
                *mb++ = (uint16_t)(*ma++);
1910
            }
1911
        }
1912
        break;
1913
    }
1914
    _TIFFfreeExt(tif, origdata);
1915
    if (err != TIFFReadDirEntryErrOk)
1916
    {
1917
        _TIFFfreeExt(tif, data);
1918
        return (err);
1919
    }
1920
    *value = data;
1921
    return (TIFFReadDirEntryErrOk);
1922
}
1923

1924
static enum TIFFReadDirEntryErr
1925
TIFFReadDirEntrySshortArray(TIFF *tif, TIFFDirEntry *direntry, int16_t **value)
1926
{
1927
    enum TIFFReadDirEntryErr err;
1928
    uint32_t count;
1929
    void *origdata;
1930
    int16_t *data;
1931
    switch (direntry->tdir_type)
1932
    {
1933
        case TIFF_BYTE:
1934
        case TIFF_SBYTE:
1935
        case TIFF_SHORT:
1936
        case TIFF_SSHORT:
1937
        case TIFF_LONG:
1938
        case TIFF_SLONG:
1939
        case TIFF_LONG8:
1940
        case TIFF_SLONG8:
1941
            break;
1942
        default:
1943
            return (TIFFReadDirEntryErrType);
1944
    }
1945
    err = TIFFReadDirEntryArray(tif, direntry, &count, 2, &origdata);
1946
    if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
1947
    {
1948
        *value = 0;
1949
        return (err);
1950
    }
1951
    switch (direntry->tdir_type)
1952
    {
1953
        case TIFF_SHORT:
1954
        {
1955
            uint16_t *m;
1956
            uint32_t n;
1957
            m = (uint16_t *)origdata;
1958
            for (n = 0; n < count; n++)
1959
            {
1960
                if (tif->tif_flags & TIFF_SWAB)
1961
                    TIFFSwabShort(m);
1962
                err = TIFFReadDirEntryCheckRangeSshortShort(*m);
1963
                if (err != TIFFReadDirEntryErrOk)
1964
                {
1965
                    _TIFFfreeExt(tif, origdata);
1966
                    return (err);
1967
                }
1968
                m++;
1969
            }
1970
            *value = (int16_t *)origdata;
1971
            return (TIFFReadDirEntryErrOk);
1972
        }
1973
        case TIFF_SSHORT:
1974
            *value = (int16_t *)origdata;
1975
            if (tif->tif_flags & TIFF_SWAB)
1976
                TIFFSwabArrayOfShort((uint16_t *)(*value), count);
1977
            return (TIFFReadDirEntryErrOk);
1978
    }
1979
    data = (int16_t *)_TIFFmallocExt(tif, count * 2);
1980
    if (data == 0)
1981
    {
1982
        _TIFFfreeExt(tif, origdata);
1983
        return (TIFFReadDirEntryErrAlloc);
1984
    }
1985
    switch (direntry->tdir_type)
1986
    {
1987
        case TIFF_BYTE:
1988
        {
1989
            uint8_t *ma;
1990
            int16_t *mb;
1991
            uint32_t n;
1992
            ma = (uint8_t *)origdata;
1993
            mb = data;
1994
            for (n = 0; n < count; n++)
1995
                *mb++ = (int16_t)(*ma++);
1996
        }
1997
        break;
1998
        case TIFF_SBYTE:
1999
        {
2000
            int8_t *ma;
2001
            int16_t *mb;
2002
            uint32_t n;
2003
            ma = (int8_t *)origdata;
2004
            mb = data;
2005
            for (n = 0; n < count; n++)
2006
                *mb++ = (int16_t)(*ma++);
2007
        }
2008
        break;
2009
        case TIFF_LONG:
2010
        {
2011
            uint32_t *ma;
2012
            int16_t *mb;
2013
            uint32_t n;
2014
            ma = (uint32_t *)origdata;
2015
            mb = data;
2016
            for (n = 0; n < count; n++)
2017
            {
2018
                if (tif->tif_flags & TIFF_SWAB)
2019
                    TIFFSwabLong(ma);
2020
                err = TIFFReadDirEntryCheckRangeSshortLong(*ma);
2021
                if (err != TIFFReadDirEntryErrOk)
2022
                    break;
2023
                *mb++ = (int16_t)(*ma++);
2024
            }
2025
        }
2026
        break;
2027
        case TIFF_SLONG:
2028
        {
2029
            int32_t *ma;
2030
            int16_t *mb;
2031
            uint32_t n;
2032
            ma = (int32_t *)origdata;
2033
            mb = data;
2034
            for (n = 0; n < count; n++)
2035
            {
2036
                if (tif->tif_flags & TIFF_SWAB)
2037
                    TIFFSwabLong((uint32_t *)ma);
2038
                err = TIFFReadDirEntryCheckRangeSshortSlong(*ma);
2039
                if (err != TIFFReadDirEntryErrOk)
2040
                    break;
2041
                *mb++ = (int16_t)(*ma++);
2042
            }
2043
        }
2044
        break;
2045
        case TIFF_LONG8:
2046
        {
2047
            uint64_t *ma;
2048
            int16_t *mb;
2049
            uint32_t n;
2050
            ma = (uint64_t *)origdata;
2051
            mb = data;
2052
            for (n = 0; n < count; n++)
2053
            {
2054
                if (tif->tif_flags & TIFF_SWAB)
2055
                    TIFFSwabLong8(ma);
2056
                err = TIFFReadDirEntryCheckRangeSshortLong8(*ma);
2057
                if (err != TIFFReadDirEntryErrOk)
2058
                    break;
2059
                *mb++ = (int16_t)(*ma++);
2060
            }
2061
        }
2062
        break;
2063
        case TIFF_SLONG8:
2064
        {
2065
            int64_t *ma;
2066
            int16_t *mb;
2067
            uint32_t n;
2068
            ma = (int64_t *)origdata;
2069
            mb = data;
2070
            for (n = 0; n < count; n++)
2071
            {
2072
                if (tif->tif_flags & TIFF_SWAB)
2073
                    TIFFSwabLong8((uint64_t *)ma);
2074
                err = TIFFReadDirEntryCheckRangeSshortSlong8(*ma);
2075
                if (err != TIFFReadDirEntryErrOk)
2076
                    break;
2077
                *mb++ = (int16_t)(*ma++);
2078
            }
2079
        }
2080
        break;
2081
    }
2082
    _TIFFfreeExt(tif, origdata);
2083
    if (err != TIFFReadDirEntryErrOk)
2084
    {
2085
        _TIFFfreeExt(tif, data);
2086
        return (err);
2087
    }
2088
    *value = data;
2089
    return (TIFFReadDirEntryErrOk);
2090
}
2091

2092
static enum TIFFReadDirEntryErr
2093
TIFFReadDirEntryLongArray(TIFF *tif, TIFFDirEntry *direntry, uint32_t **value)
2094
{
2095
    enum TIFFReadDirEntryErr err;
2096
    uint32_t count;
2097
    void *origdata;
2098
    uint32_t *data;
2099
    switch (direntry->tdir_type)
2100
    {
2101
        case TIFF_BYTE:
2102
        case TIFF_SBYTE:
2103
        case TIFF_SHORT:
2104
        case TIFF_SSHORT:
2105
        case TIFF_LONG:
2106
        case TIFF_SLONG:
2107
        case TIFF_LONG8:
2108
        case TIFF_SLONG8:
2109
            break;
2110
        default:
2111
            return (TIFFReadDirEntryErrType);
2112
    }
2113
    err = TIFFReadDirEntryArray(tif, direntry, &count, 4, &origdata);
2114
    if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
2115
    {
2116
        *value = 0;
2117
        return (err);
2118
    }
2119
    switch (direntry->tdir_type)
2120
    {
2121
        case TIFF_LONG:
2122
            *value = (uint32_t *)origdata;
2123
            if (tif->tif_flags & TIFF_SWAB)
2124
                TIFFSwabArrayOfLong(*value, count);
2125
            return (TIFFReadDirEntryErrOk);
2126
        case TIFF_SLONG:
2127
        {
2128
            int32_t *m;
2129
            uint32_t n;
2130
            m = (int32_t *)origdata;
2131
            for (n = 0; n < count; n++)
2132
            {
2133
                if (tif->tif_flags & TIFF_SWAB)
2134
                    TIFFSwabLong((uint32_t *)m);
2135
                err = TIFFReadDirEntryCheckRangeLongSlong(*m);
2136
                if (err != TIFFReadDirEntryErrOk)
2137
                {
2138
                    _TIFFfreeExt(tif, origdata);
2139
                    return (err);
2140
                }
2141
                m++;
2142
            }
2143
            *value = (uint32_t *)origdata;
2144
            return (TIFFReadDirEntryErrOk);
2145
        }
2146
    }
2147
    data = (uint32_t *)_TIFFmallocExt(tif, count * 4);
2148
    if (data == 0)
2149
    {
2150
        _TIFFfreeExt(tif, origdata);
2151
        return (TIFFReadDirEntryErrAlloc);
2152
    }
2153
    switch (direntry->tdir_type)
2154
    {
2155
        case TIFF_BYTE:
2156
        {
2157
            uint8_t *ma;
2158
            uint32_t *mb;
2159
            uint32_t n;
2160
            ma = (uint8_t *)origdata;
2161
            mb = data;
2162
            for (n = 0; n < count; n++)
2163
                *mb++ = (uint32_t)(*ma++);
2164
        }
2165
        break;
2166
        case TIFF_SBYTE:
2167
        {
2168
            int8_t *ma;
2169
            uint32_t *mb;
2170
            uint32_t n;
2171
            ma = (int8_t *)origdata;
2172
            mb = data;
2173
            for (n = 0; n < count; n++)
2174
            {
2175
                err = TIFFReadDirEntryCheckRangeLongSbyte(*ma);
2176
                if (err != TIFFReadDirEntryErrOk)
2177
                    break;
2178
                *mb++ = (uint32_t)(*ma++);
2179
            }
2180
        }
2181
        break;
2182
        case TIFF_SHORT:
2183
        {
2184
            uint16_t *ma;
2185
            uint32_t *mb;
2186
            uint32_t n;
2187
            ma = (uint16_t *)origdata;
2188
            mb = data;
2189
            for (n = 0; n < count; n++)
2190
            {
2191
                if (tif->tif_flags & TIFF_SWAB)
2192
                    TIFFSwabShort(ma);
2193
                *mb++ = (uint32_t)(*ma++);
2194
            }
2195
        }
2196
        break;
2197
        case TIFF_SSHORT:
2198
        {
2199
            int16_t *ma;
2200
            uint32_t *mb;
2201
            uint32_t n;
2202
            ma = (int16_t *)origdata;
2203
            mb = data;
2204
            for (n = 0; n < count; n++)
2205
            {
2206
                if (tif->tif_flags & TIFF_SWAB)
2207
                    TIFFSwabShort((uint16_t *)ma);
2208
                err = TIFFReadDirEntryCheckRangeLongSshort(*ma);
2209
                if (err != TIFFReadDirEntryErrOk)
2210
                    break;
2211
                *mb++ = (uint32_t)(*ma++);
2212
            }
2213
        }
2214
        break;
2215
        case TIFF_LONG8:
2216
        {
2217
            uint64_t *ma;
2218
            uint32_t *mb;
2219
            uint32_t n;
2220
            ma = (uint64_t *)origdata;
2221
            mb = data;
2222
            for (n = 0; n < count; n++)
2223
            {
2224
                if (tif->tif_flags & TIFF_SWAB)
2225
                    TIFFSwabLong8(ma);
2226
                err = TIFFReadDirEntryCheckRangeLongLong8(*ma);
2227
                if (err != TIFFReadDirEntryErrOk)
2228
                    break;
2229
                *mb++ = (uint32_t)(*ma++);
2230
            }
2231
        }
2232
        break;
2233
        case TIFF_SLONG8:
2234
        {
2235
            int64_t *ma;
2236
            uint32_t *mb;
2237
            uint32_t n;
2238
            ma = (int64_t *)origdata;
2239
            mb = data;
2240
            for (n = 0; n < count; n++)
2241
            {
2242
                if (tif->tif_flags & TIFF_SWAB)
2243
                    TIFFSwabLong8((uint64_t *)ma);
2244
                err = TIFFReadDirEntryCheckRangeLongSlong8(*ma);
2245
                if (err != TIFFReadDirEntryErrOk)
2246
                    break;
2247
                *mb++ = (uint32_t)(*ma++);
2248
            }
2249
        }
2250
        break;
2251
    }
2252
    _TIFFfreeExt(tif, origdata);
2253
    if (err != TIFFReadDirEntryErrOk)
2254
    {
2255
        _TIFFfreeExt(tif, data);
2256
        return (err);
2257
    }
2258
    *value = data;
2259
    return (TIFFReadDirEntryErrOk);
2260
}
2261

2262
static enum TIFFReadDirEntryErr
2263
TIFFReadDirEntrySlongArray(TIFF *tif, TIFFDirEntry *direntry, int32_t **value)
2264
{
2265
    enum TIFFReadDirEntryErr err;
2266
    uint32_t count;
2267
    void *origdata;
2268
    int32_t *data;
2269
    switch (direntry->tdir_type)
2270
    {
2271
        case TIFF_BYTE:
2272
        case TIFF_SBYTE:
2273
        case TIFF_SHORT:
2274
        case TIFF_SSHORT:
2275
        case TIFF_LONG:
2276
        case TIFF_SLONG:
2277
        case TIFF_LONG8:
2278
        case TIFF_SLONG8:
2279
            break;
2280
        default:
2281
            return (TIFFReadDirEntryErrType);
2282
    }
2283
    err = TIFFReadDirEntryArray(tif, direntry, &count, 4, &origdata);
2284
    if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
2285
    {
2286
        *value = 0;
2287
        return (err);
2288
    }
2289
    switch (direntry->tdir_type)
2290
    {
2291
        case TIFF_LONG:
2292
        {
2293
            uint32_t *m;
2294
            uint32_t n;
2295
            m = (uint32_t *)origdata;
2296
            for (n = 0; n < count; n++)
2297
            {
2298
                if (tif->tif_flags & TIFF_SWAB)
2299
                    TIFFSwabLong((uint32_t *)m);
2300
                err = TIFFReadDirEntryCheckRangeSlongLong(*m);
2301
                if (err != TIFFReadDirEntryErrOk)
2302
                {
2303
                    _TIFFfreeExt(tif, origdata);
2304
                    return (err);
2305
                }
2306
                m++;
2307
            }
2308
            *value = (int32_t *)origdata;
2309
            return (TIFFReadDirEntryErrOk);
2310
        }
2311
        case TIFF_SLONG:
2312
            *value = (int32_t *)origdata;
2313
            if (tif->tif_flags & TIFF_SWAB)
2314
                TIFFSwabArrayOfLong((uint32_t *)(*value), count);
2315
            return (TIFFReadDirEntryErrOk);
2316
    }
2317
    data = (int32_t *)_TIFFmallocExt(tif, count * 4);
2318
    if (data == 0)
2319
    {
2320
        _TIFFfreeExt(tif, origdata);
2321
        return (TIFFReadDirEntryErrAlloc);
2322
    }
2323
    switch (direntry->tdir_type)
2324
    {
2325
        case TIFF_BYTE:
2326
        {
2327
            uint8_t *ma;
2328
            int32_t *mb;
2329
            uint32_t n;
2330
            ma = (uint8_t *)origdata;
2331
            mb = data;
2332
            for (n = 0; n < count; n++)
2333
                *mb++ = (int32_t)(*ma++);
2334
        }
2335
        break;
2336
        case TIFF_SBYTE:
2337
        {
2338
            int8_t *ma;
2339
            int32_t *mb;
2340
            uint32_t n;
2341
            ma = (int8_t *)origdata;
2342
            mb = data;
2343
            for (n = 0; n < count; n++)
2344
                *mb++ = (int32_t)(*ma++);
2345
        }
2346
        break;
2347
        case TIFF_SHORT:
2348
        {
2349
            uint16_t *ma;
2350
            int32_t *mb;
2351
            uint32_t n;
2352
            ma = (uint16_t *)origdata;
2353
            mb = data;
2354
            for (n = 0; n < count; n++)
2355
            {
2356
                if (tif->tif_flags & TIFF_SWAB)
2357
                    TIFFSwabShort(ma);
2358
                *mb++ = (int32_t)(*ma++);
2359
            }
2360
        }
2361
        break;
2362
        case TIFF_SSHORT:
2363
        {
2364
            int16_t *ma;
2365
            int32_t *mb;
2366
            uint32_t n;
2367
            ma = (int16_t *)origdata;
2368
            mb = data;
2369
            for (n = 0; n < count; n++)
2370
            {
2371
                if (tif->tif_flags & TIFF_SWAB)
2372
                    TIFFSwabShort((uint16_t *)ma);
2373
                *mb++ = (int32_t)(*ma++);
2374
            }
2375
        }
2376
        break;
2377
        case TIFF_LONG8:
2378
        {
2379
            uint64_t *ma;
2380
            int32_t *mb;
2381
            uint32_t n;
2382
            ma = (uint64_t *)origdata;
2383
            mb = data;
2384
            for (n = 0; n < count; n++)
2385
            {
2386
                if (tif->tif_flags & TIFF_SWAB)
2387
                    TIFFSwabLong8(ma);
2388
                err = TIFFReadDirEntryCheckRangeSlongLong8(*ma);
2389
                if (err != TIFFReadDirEntryErrOk)
2390
                    break;
2391
                *mb++ = (int32_t)(*ma++);
2392
            }
2393
        }
2394
        break;
2395
        case TIFF_SLONG8:
2396
        {
2397
            int64_t *ma;
2398
            int32_t *mb;
2399
            uint32_t n;
2400
            ma = (int64_t *)origdata;
2401
            mb = data;
2402
            for (n = 0; n < count; n++)
2403
            {
2404
                if (tif->tif_flags & TIFF_SWAB)
2405
                    TIFFSwabLong8((uint64_t *)ma);
2406
                err = TIFFReadDirEntryCheckRangeSlongSlong8(*ma);
2407
                if (err != TIFFReadDirEntryErrOk)
2408
                    break;
2409
                *mb++ = (int32_t)(*ma++);
2410
            }
2411
        }
2412
        break;
2413
    }
2414
    _TIFFfreeExt(tif, origdata);
2415
    if (err != TIFFReadDirEntryErrOk)
2416
    {
2417
        _TIFFfreeExt(tif, data);
2418
        return (err);
2419
    }
2420
    *value = data;
2421
    return (TIFFReadDirEntryErrOk);
2422
}
2423

2424
static enum TIFFReadDirEntryErr
2425
TIFFReadDirEntryLong8ArrayWithLimit(TIFF *tif, TIFFDirEntry *direntry,
2426
                                    uint64_t **value, uint64_t maxcount)
2427
{
2428
    enum TIFFReadDirEntryErr err;
2429
    uint32_t count;
2430
    void *origdata;
2431
    uint64_t *data;
2432
    switch (direntry->tdir_type)
2433
    {
2434
        case TIFF_BYTE:
2435
        case TIFF_SBYTE:
2436
        case TIFF_SHORT:
2437
        case TIFF_SSHORT:
2438
        case TIFF_LONG:
2439
        case TIFF_SLONG:
2440
        case TIFF_LONG8:
2441
        case TIFF_SLONG8:
2442
            break;
2443
        default:
2444
            return (TIFFReadDirEntryErrType);
2445
    }
2446
    err = TIFFReadDirEntryArrayWithLimit(tif, direntry, &count, 8, &origdata,
2447
                                         maxcount);
2448
    if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
2449
    {
2450
        *value = 0;
2451
        return (err);
2452
    }
2453
    switch (direntry->tdir_type)
2454
    {
2455
        case TIFF_LONG8:
2456
            *value = (uint64_t *)origdata;
2457
            if (tif->tif_flags & TIFF_SWAB)
2458
                TIFFSwabArrayOfLong8(*value, count);
2459
            return (TIFFReadDirEntryErrOk);
2460
        case TIFF_SLONG8:
2461
        {
2462
            int64_t *m;
2463
            uint32_t n;
2464
            m = (int64_t *)origdata;
2465
            for (n = 0; n < count; n++)
2466
            {
2467
                if (tif->tif_flags & TIFF_SWAB)
2468
                    TIFFSwabLong8((uint64_t *)m);
2469
                err = TIFFReadDirEntryCheckRangeLong8Slong8(*m);
2470
                if (err != TIFFReadDirEntryErrOk)
2471
                {
2472
                    _TIFFfreeExt(tif, origdata);
2473
                    return (err);
2474
                }
2475
                m++;
2476
            }
2477
            *value = (uint64_t *)origdata;
2478
            return (TIFFReadDirEntryErrOk);
2479
        }
2480
    }
2481
    data = (uint64_t *)_TIFFmallocExt(tif, count * 8);
2482
    if (data == 0)
2483
    {
2484
        _TIFFfreeExt(tif, origdata);
2485
        return (TIFFReadDirEntryErrAlloc);
2486
    }
2487
    switch (direntry->tdir_type)
2488
    {
2489
        case TIFF_BYTE:
2490
        {
2491
            uint8_t *ma;
2492
            uint64_t *mb;
2493
            uint32_t n;
2494
            ma = (uint8_t *)origdata;
2495
            mb = data;
2496
            for (n = 0; n < count; n++)
2497
                *mb++ = (uint64_t)(*ma++);
2498
        }
2499
        break;
2500
        case TIFF_SBYTE:
2501
        {
2502
            int8_t *ma;
2503
            uint64_t *mb;
2504
            uint32_t n;
2505
            ma = (int8_t *)origdata;
2506
            mb = data;
2507
            for (n = 0; n < count; n++)
2508
            {
2509
                err = TIFFReadDirEntryCheckRangeLong8Sbyte(*ma);
2510
                if (err != TIFFReadDirEntryErrOk)
2511
                    break;
2512
                *mb++ = (uint64_t)(*ma++);
2513
            }
2514
        }
2515
        break;
2516
        case TIFF_SHORT:
2517
        {
2518
            uint16_t *ma;
2519
            uint64_t *mb;
2520
            uint32_t n;
2521
            ma = (uint16_t *)origdata;
2522
            mb = data;
2523
            for (n = 0; n < count; n++)
2524
            {
2525
                if (tif->tif_flags & TIFF_SWAB)
2526
                    TIFFSwabShort(ma);
2527
                *mb++ = (uint64_t)(*ma++);
2528
            }
2529
        }
2530
        break;
2531
        case TIFF_SSHORT:
2532
        {
2533
            int16_t *ma;
2534
            uint64_t *mb;
2535
            uint32_t n;
2536
            ma = (int16_t *)origdata;
2537
            mb = data;
2538
            for (n = 0; n < count; n++)
2539
            {
2540
                if (tif->tif_flags & TIFF_SWAB)
2541
                    TIFFSwabShort((uint16_t *)ma);
2542
                err = TIFFReadDirEntryCheckRangeLong8Sshort(*ma);
2543
                if (err != TIFFReadDirEntryErrOk)
2544
                    break;
2545
                *mb++ = (uint64_t)(*ma++);
2546
            }
2547
        }
2548
        break;
2549
        case TIFF_LONG:
2550
        {
2551
            uint32_t *ma;
2552
            uint64_t *mb;
2553
            uint32_t n;
2554
            ma = (uint32_t *)origdata;
2555
            mb = data;
2556
            for (n = 0; n < count; n++)
2557
            {
2558
                if (tif->tif_flags & TIFF_SWAB)
2559
                    TIFFSwabLong(ma);
2560
                *mb++ = (uint64_t)(*ma++);
2561
            }
2562
        }
2563
        break;
2564
        case TIFF_SLONG:
2565
        {
2566
            int32_t *ma;
2567
            uint64_t *mb;
2568
            uint32_t n;
2569
            ma = (int32_t *)origdata;
2570
            mb = data;
2571
            for (n = 0; n < count; n++)
2572
            {
2573
                if (tif->tif_flags & TIFF_SWAB)
2574
                    TIFFSwabLong((uint32_t *)ma);
2575
                err = TIFFReadDirEntryCheckRangeLong8Slong(*ma);
2576
                if (err != TIFFReadDirEntryErrOk)
2577
                    break;
2578
                *mb++ = (uint64_t)(*ma++);
2579
            }
2580
        }
2581
        break;
2582
    }
2583
    _TIFFfreeExt(tif, origdata);
2584
    if (err != TIFFReadDirEntryErrOk)
2585
    {
2586
        _TIFFfreeExt(tif, data);
2587
        return (err);
2588
    }
2589
    *value = data;
2590
    return (TIFFReadDirEntryErrOk);
2591
}
2592

2593
static enum TIFFReadDirEntryErr
2594
TIFFReadDirEntryLong8Array(TIFF *tif, TIFFDirEntry *direntry, uint64_t **value)
2595
{
2596
    return TIFFReadDirEntryLong8ArrayWithLimit(tif, direntry, value,
2597
                                               ~((uint64_t)0));
2598
}
2599

2600
static enum TIFFReadDirEntryErr
2601
TIFFReadDirEntrySlong8Array(TIFF *tif, TIFFDirEntry *direntry, int64_t **value)
2602
{
2603
    enum TIFFReadDirEntryErr err;
2604
    uint32_t count;
2605
    void *origdata;
2606
    int64_t *data;
2607
    switch (direntry->tdir_type)
2608
    {
2609
        case TIFF_BYTE:
2610
        case TIFF_SBYTE:
2611
        case TIFF_SHORT:
2612
        case TIFF_SSHORT:
2613
        case TIFF_LONG:
2614
        case TIFF_SLONG:
2615
        case TIFF_LONG8:
2616
        case TIFF_SLONG8:
2617
            break;
2618
        default:
2619
            return (TIFFReadDirEntryErrType);
2620
    }
2621
    err = TIFFReadDirEntryArray(tif, direntry, &count, 8, &origdata);
2622
    if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
2623
    {
2624
        *value = 0;
2625
        return (err);
2626
    }
2627
    switch (direntry->tdir_type)
2628
    {
2629
        case TIFF_LONG8:
2630
        {
2631
            uint64_t *m;
2632
            uint32_t n;
2633
            m = (uint64_t *)origdata;
2634
            for (n = 0; n < count; n++)
2635
            {
2636
                if (tif->tif_flags & TIFF_SWAB)
2637
                    TIFFSwabLong8(m);
2638
                err = TIFFReadDirEntryCheckRangeSlong8Long8(*m);
2639
                if (err != TIFFReadDirEntryErrOk)
2640
                {
2641
                    _TIFFfreeExt(tif, origdata);
2642
                    return (err);
2643
                }
2644
                m++;
2645
            }
2646
            *value = (int64_t *)origdata;
2647
            return (TIFFReadDirEntryErrOk);
2648
        }
2649
        case TIFF_SLONG8:
2650
            *value = (int64_t *)origdata;
2651
            if (tif->tif_flags & TIFF_SWAB)
2652
                TIFFSwabArrayOfLong8((uint64_t *)(*value), count);
2653
            return (TIFFReadDirEntryErrOk);
2654
    }
2655
    data = (int64_t *)_TIFFmallocExt(tif, count * 8);
2656
    if (data == 0)
2657
    {
2658
        _TIFFfreeExt(tif, origdata);
2659
        return (TIFFReadDirEntryErrAlloc);
2660
    }
2661
    switch (direntry->tdir_type)
2662
    {
2663
        case TIFF_BYTE:
2664
        {
2665
            uint8_t *ma;
2666
            int64_t *mb;
2667
            uint32_t n;
2668
            ma = (uint8_t *)origdata;
2669
            mb = data;
2670
            for (n = 0; n < count; n++)
2671
                *mb++ = (int64_t)(*ma++);
2672
        }
2673
        break;
2674
        case TIFF_SBYTE:
2675
        {
2676
            int8_t *ma;
2677
            int64_t *mb;
2678
            uint32_t n;
2679
            ma = (int8_t *)origdata;
2680
            mb = data;
2681
            for (n = 0; n < count; n++)
2682
                *mb++ = (int64_t)(*ma++);
2683
        }
2684
        break;
2685
        case TIFF_SHORT:
2686
        {
2687
            uint16_t *ma;
2688
            int64_t *mb;
2689
            uint32_t n;
2690
            ma = (uint16_t *)origdata;
2691
            mb = data;
2692
            for (n = 0; n < count; n++)
2693
            {
2694
                if (tif->tif_flags & TIFF_SWAB)
2695
                    TIFFSwabShort(ma);
2696
                *mb++ = (int64_t)(*ma++);
2697
            }
2698
        }
2699
        break;
2700
        case TIFF_SSHORT:
2701
        {
2702
            int16_t *ma;
2703
            int64_t *mb;
2704
            uint32_t n;
2705
            ma = (int16_t *)origdata;
2706
            mb = data;
2707
            for (n = 0; n < count; n++)
2708
            {
2709
                if (tif->tif_flags & TIFF_SWAB)
2710
                    TIFFSwabShort((uint16_t *)ma);
2711
                *mb++ = (int64_t)(*ma++);
2712
            }
2713
        }
2714
        break;
2715
        case TIFF_LONG:
2716
        {
2717
            uint32_t *ma;
2718
            int64_t *mb;
2719
            uint32_t n;
2720
            ma = (uint32_t *)origdata;
2721
            mb = data;
2722
            for (n = 0; n < count; n++)
2723
            {
2724
                if (tif->tif_flags & TIFF_SWAB)
2725
                    TIFFSwabLong(ma);
2726
                *mb++ = (int64_t)(*ma++);
2727
            }
2728
        }
2729
        break;
2730
        case TIFF_SLONG:
2731
        {
2732
            int32_t *ma;
2733
            int64_t *mb;
2734
            uint32_t n;
2735
            ma = (int32_t *)origdata;
2736
            mb = data;
2737
            for (n = 0; n < count; n++)
2738
            {
2739
                if (tif->tif_flags & TIFF_SWAB)
2740
                    TIFFSwabLong((uint32_t *)ma);
2741
                *mb++ = (int64_t)(*ma++);
2742
            }
2743
        }
2744
        break;
2745
    }
2746
    _TIFFfreeExt(tif, origdata);
2747
    *value = data;
2748
    return (TIFFReadDirEntryErrOk);
2749
}
2750

2751
static enum TIFFReadDirEntryErr
2752
TIFFReadDirEntryFloatArray(TIFF *tif, TIFFDirEntry *direntry, float **value)
2753
{
2754
    enum TIFFReadDirEntryErr err;
2755
    uint32_t count;
2756
    void *origdata;
2757
    float *data;
2758
    switch (direntry->tdir_type)
2759
    {
2760
        case TIFF_BYTE:
2761
        case TIFF_SBYTE:
2762
        case TIFF_SHORT:
2763
        case TIFF_SSHORT:
2764
        case TIFF_LONG:
2765
        case TIFF_SLONG:
2766
        case TIFF_LONG8:
2767
        case TIFF_SLONG8:
2768
        case TIFF_RATIONAL:
2769
        case TIFF_SRATIONAL:
2770
        case TIFF_FLOAT:
2771
        case TIFF_DOUBLE:
2772
            break;
2773
        default:
2774
            return (TIFFReadDirEntryErrType);
2775
    }
2776
    err = TIFFReadDirEntryArray(tif, direntry, &count, 4, &origdata);
2777
    if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
2778
    {
2779
        *value = 0;
2780
        return (err);
2781
    }
2782
    switch (direntry->tdir_type)
2783
    {
2784
        case TIFF_FLOAT:
2785
            if (tif->tif_flags & TIFF_SWAB)
2786
                TIFFSwabArrayOfLong((uint32_t *)origdata, count);
2787
            TIFFCvtIEEEFloatToNative(tif, count, (float *)origdata);
2788
            *value = (float *)origdata;
2789
            return (TIFFReadDirEntryErrOk);
2790
    }
2791
    data = (float *)_TIFFmallocExt(tif, count * sizeof(float));
2792
    if (data == 0)
2793
    {
2794
        _TIFFfreeExt(tif, origdata);
2795
        return (TIFFReadDirEntryErrAlloc);
2796
    }
2797
    switch (direntry->tdir_type)
2798
    {
2799
        case TIFF_BYTE:
2800
        {
2801
            uint8_t *ma;
2802
            float *mb;
2803
            uint32_t n;
2804
            ma = (uint8_t *)origdata;
2805
            mb = data;
2806
            for (n = 0; n < count; n++)
2807
                *mb++ = (float)(*ma++);
2808
        }
2809
        break;
2810
        case TIFF_SBYTE:
2811
        {
2812
            int8_t *ma;
2813
            float *mb;
2814
            uint32_t n;
2815
            ma = (int8_t *)origdata;
2816
            mb = data;
2817
            for (n = 0; n < count; n++)
2818
                *mb++ = (float)(*ma++);
2819
        }
2820
        break;
2821
        case TIFF_SHORT:
2822
        {
2823
            uint16_t *ma;
2824
            float *mb;
2825
            uint32_t n;
2826
            ma = (uint16_t *)origdata;
2827
            mb = data;
2828
            for (n = 0; n < count; n++)
2829
            {
2830
                if (tif->tif_flags & TIFF_SWAB)
2831
                    TIFFSwabShort(ma);
2832
                *mb++ = (float)(*ma++);
2833
            }
2834
        }
2835
        break;
2836
        case TIFF_SSHORT:
2837
        {
2838
            int16_t *ma;
2839
            float *mb;
2840
            uint32_t n;
2841
            ma = (int16_t *)origdata;
2842
            mb = data;
2843
            for (n = 0; n < count; n++)
2844
            {
2845
                if (tif->tif_flags & TIFF_SWAB)
2846
                    TIFFSwabShort((uint16_t *)ma);
2847
                *mb++ = (float)(*ma++);
2848
            }
2849
        }
2850
        break;
2851
        case TIFF_LONG:
2852
        {
2853
            uint32_t *ma;
2854
            float *mb;
2855
            uint32_t n;
2856
            ma = (uint32_t *)origdata;
2857
            mb = data;
2858
            for (n = 0; n < count; n++)
2859
            {
2860
                if (tif->tif_flags & TIFF_SWAB)
2861
                    TIFFSwabLong(ma);
2862
                *mb++ = (float)(*ma++);
2863
            }
2864
        }
2865
        break;
2866
        case TIFF_SLONG:
2867
        {
2868
            int32_t *ma;
2869
            float *mb;
2870
            uint32_t n;
2871
            ma = (int32_t *)origdata;
2872
            mb = data;
2873
            for (n = 0; n < count; n++)
2874
            {
2875
                if (tif->tif_flags & TIFF_SWAB)
2876
                    TIFFSwabLong((uint32_t *)ma);
2877
                *mb++ = (float)(*ma++);
2878
            }
2879
        }
2880
        break;
2881
        case TIFF_LONG8:
2882
        {
2883
            uint64_t *ma;
2884
            float *mb;
2885
            uint32_t n;
2886
            ma = (uint64_t *)origdata;
2887
            mb = data;
2888
            for (n = 0; n < count; n++)
2889
            {
2890
                if (tif->tif_flags & TIFF_SWAB)
2891
                    TIFFSwabLong8(ma);
2892
                *mb++ = (float)(*ma++);
2893
            }
2894
        }
2895
        break;
2896
        case TIFF_SLONG8:
2897
        {
2898
            int64_t *ma;
2899
            float *mb;
2900
            uint32_t n;
2901
            ma = (int64_t *)origdata;
2902
            mb = data;
2903
            for (n = 0; n < count; n++)
2904
            {
2905
                if (tif->tif_flags & TIFF_SWAB)
2906
                    TIFFSwabLong8((uint64_t *)ma);
2907
                *mb++ = (float)(*ma++);
2908
            }
2909
        }
2910
        break;
2911
        case TIFF_RATIONAL:
2912
        {
2913
            uint32_t *ma;
2914
            uint32_t maa;
2915
            uint32_t mab;
2916
            float *mb;
2917
            uint32_t n;
2918
            ma = (uint32_t *)origdata;
2919
            mb = data;
2920
            for (n = 0; n < count; n++)
2921
            {
2922
                if (tif->tif_flags & TIFF_SWAB)
2923
                    TIFFSwabLong(ma);
2924
                maa = *ma++;
2925
                if (tif->tif_flags & TIFF_SWAB)
2926
                    TIFFSwabLong(ma);
2927
                mab = *ma++;
2928
                if (mab == 0)
2929
                    *mb++ = 0.0;
2930
                else
2931
                    *mb++ = (float)maa / (float)mab;
2932
            }
2933
        }
2934
        break;
2935
        case TIFF_SRATIONAL:
2936
        {
2937
            uint32_t *ma;
2938
            int32_t maa;
2939
            uint32_t mab;
2940
            float *mb;
2941
            uint32_t n;
2942
            ma = (uint32_t *)origdata;
2943
            mb = data;
2944
            for (n = 0; n < count; n++)
2945
            {
2946
                if (tif->tif_flags & TIFF_SWAB)
2947
                    TIFFSwabLong(ma);
2948
                maa = *(int32_t *)ma;
2949
                ma++;
2950
                if (tif->tif_flags & TIFF_SWAB)
2951
                    TIFFSwabLong(ma);
2952
                mab = *ma++;
2953
                if (mab == 0)
2954
                    *mb++ = 0.0;
2955
                else
2956
                    *mb++ = (float)maa / (float)mab;
2957
            }
2958
        }
2959
        break;
2960
        case TIFF_DOUBLE:
2961
        {
2962
            double *ma;
2963
            float *mb;
2964
            uint32_t n;
2965
            if (tif->tif_flags & TIFF_SWAB)
2966
                TIFFSwabArrayOfLong8((uint64_t *)origdata, count);
2967
            TIFFCvtIEEEDoubleToNative(tif, count, (double *)origdata);
2968
            ma = (double *)origdata;
2969
            mb = data;
2970
            for (n = 0; n < count; n++)
2971
            {
2972
                double val = *ma++;
2973
                if (val > FLT_MAX)
2974
                    val = FLT_MAX;
2975
                else if (val < -FLT_MAX)
2976
                    val = -FLT_MAX;
2977
                *mb++ = (float)val;
2978
            }
2979
        }
2980
        break;
2981
    }
2982
    _TIFFfreeExt(tif, origdata);
2983
    *value = data;
2984
    return (TIFFReadDirEntryErrOk);
2985
}
2986

2987
static enum TIFFReadDirEntryErr
2988
TIFFReadDirEntryDoubleArray(TIFF *tif, TIFFDirEntry *direntry, double **value)
2989
{
2990
    enum TIFFReadDirEntryErr err;
2991
    uint32_t count;
2992
    void *origdata;
2993
    double *data;
2994
    switch (direntry->tdir_type)
2995
    {
2996
        case TIFF_BYTE:
2997
        case TIFF_SBYTE:
2998
        case TIFF_SHORT:
2999
        case TIFF_SSHORT:
3000
        case TIFF_LONG:
3001
        case TIFF_SLONG:
3002
        case TIFF_LONG8:
3003
        case TIFF_SLONG8:
3004
        case TIFF_RATIONAL:
3005
        case TIFF_SRATIONAL:
3006
        case TIFF_FLOAT:
3007
        case TIFF_DOUBLE:
3008
            break;
3009
        default:
3010
            return (TIFFReadDirEntryErrType);
3011
    }
3012
    err = TIFFReadDirEntryArray(tif, direntry, &count, 8, &origdata);
3013
    if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
3014
    {
3015
        *value = 0;
3016
        return (err);
3017
    }
3018
    switch (direntry->tdir_type)
3019
    {
3020
        case TIFF_DOUBLE:
3021
            if (tif->tif_flags & TIFF_SWAB)
3022
                TIFFSwabArrayOfLong8((uint64_t *)origdata, count);
3023
            TIFFCvtIEEEDoubleToNative(tif, count, (double *)origdata);
3024
            *value = (double *)origdata;
3025
            return (TIFFReadDirEntryErrOk);
3026
    }
3027
    data = (double *)_TIFFmallocExt(tif, count * sizeof(double));
3028
    if (data == 0)
3029
    {
3030
        _TIFFfreeExt(tif, origdata);
3031
        return (TIFFReadDirEntryErrAlloc);
3032
    }
3033
    switch (direntry->tdir_type)
3034
    {
3035
        case TIFF_BYTE:
3036
        {
3037
            uint8_t *ma;
3038
            double *mb;
3039
            uint32_t n;
3040
            ma = (uint8_t *)origdata;
3041
            mb = data;
3042
            for (n = 0; n < count; n++)
3043
                *mb++ = (double)(*ma++);
3044
        }
3045
        break;
3046
        case TIFF_SBYTE:
3047
        {
3048
            int8_t *ma;
3049
            double *mb;
3050
            uint32_t n;
3051
            ma = (int8_t *)origdata;
3052
            mb = data;
3053
            for (n = 0; n < count; n++)
3054
                *mb++ = (double)(*ma++);
3055
        }
3056
        break;
3057
        case TIFF_SHORT:
3058
        {
3059
            uint16_t *ma;
3060
            double *mb;
3061
            uint32_t n;
3062
            ma = (uint16_t *)origdata;
3063
            mb = data;
3064
            for (n = 0; n < count; n++)
3065
            {
3066
                if (tif->tif_flags & TIFF_SWAB)
3067
                    TIFFSwabShort(ma);
3068
                *mb++ = (double)(*ma++);
3069
            }
3070
        }
3071
        break;
3072
        case TIFF_SSHORT:
3073
        {
3074
            int16_t *ma;
3075
            double *mb;
3076
            uint32_t n;
3077
            ma = (int16_t *)origdata;
3078
            mb = data;
3079
            for (n = 0; n < count; n++)
3080
            {
3081
                if (tif->tif_flags & TIFF_SWAB)
3082
                    TIFFSwabShort((uint16_t *)ma);
3083
                *mb++ = (double)(*ma++);
3084
            }
3085
        }
3086
        break;
3087
        case TIFF_LONG:
3088
        {
3089
            uint32_t *ma;
3090
            double *mb;
3091
            uint32_t n;
3092
            ma = (uint32_t *)origdata;
3093
            mb = data;
3094
            for (n = 0; n < count; n++)
3095
            {
3096
                if (tif->tif_flags & TIFF_SWAB)
3097
                    TIFFSwabLong(ma);
3098
                *mb++ = (double)(*ma++);
3099
            }
3100
        }
3101
        break;
3102
        case TIFF_SLONG:
3103
        {
3104
            int32_t *ma;
3105
            double *mb;
3106
            uint32_t n;
3107
            ma = (int32_t *)origdata;
3108
            mb = data;
3109
            for (n = 0; n < count; n++)
3110
            {
3111
                if (tif->tif_flags & TIFF_SWAB)
3112
                    TIFFSwabLong((uint32_t *)ma);
3113
                *mb++ = (double)(*ma++);
3114
            }
3115
        }
3116
        break;
3117
        case TIFF_LONG8:
3118
        {
3119
            uint64_t *ma;
3120
            double *mb;
3121
            uint32_t n;
3122
            ma = (uint64_t *)origdata;
3123
            mb = data;
3124
            for (n = 0; n < count; n++)
3125
            {
3126
                if (tif->tif_flags & TIFF_SWAB)
3127
                    TIFFSwabLong8(ma);
3128
                *mb++ = (double)(*ma++);
3129
            }
3130
        }
3131
        break;
3132
        case TIFF_SLONG8:
3133
        {
3134
            int64_t *ma;
3135
            double *mb;
3136
            uint32_t n;
3137
            ma = (int64_t *)origdata;
3138
            mb = data;
3139
            for (n = 0; n < count; n++)
3140
            {
3141
                if (tif->tif_flags & TIFF_SWAB)
3142
                    TIFFSwabLong8((uint64_t *)ma);
3143
                *mb++ = (double)(*ma++);
3144
            }
3145
        }
3146
        break;
3147
        case TIFF_RATIONAL:
3148
        {
3149
            uint32_t *ma;
3150
            uint32_t maa;
3151
            uint32_t mab;
3152
            double *mb;
3153
            uint32_t n;
3154
            ma = (uint32_t *)origdata;
3155
            mb = data;
3156
            for (n = 0; n < count; n++)
3157
            {
3158
                if (tif->tif_flags & TIFF_SWAB)
3159
                    TIFFSwabLong(ma);
3160
                maa = *ma++;
3161
                if (tif->tif_flags & TIFF_SWAB)
3162
                    TIFFSwabLong(ma);
3163
                mab = *ma++;
3164
                if (mab == 0)
3165
                    *mb++ = 0.0;
3166
                else
3167
                    *mb++ = (double)maa / (double)mab;
3168
            }
3169
        }
3170
        break;
3171
        case TIFF_SRATIONAL:
3172
        {
3173
            uint32_t *ma;
3174
            int32_t maa;
3175
            uint32_t mab;
3176
            double *mb;
3177
            uint32_t n;
3178
            ma = (uint32_t *)origdata;
3179
            mb = data;
3180
            for (n = 0; n < count; n++)
3181
            {
3182
                if (tif->tif_flags & TIFF_SWAB)
3183
                    TIFFSwabLong(ma);
3184
                maa = *(int32_t *)ma;
3185
                ma++;
3186
                if (tif->tif_flags & TIFF_SWAB)
3187
                    TIFFSwabLong(ma);
3188
                mab = *ma++;
3189
                if (mab == 0)
3190
                    *mb++ = 0.0;
3191
                else
3192
                    *mb++ = (double)maa / (double)mab;
3193
            }
3194
        }
3195
        break;
3196
        case TIFF_FLOAT:
3197
        {
3198
            float *ma;
3199
            double *mb;
3200
            uint32_t n;
3201
            if (tif->tif_flags & TIFF_SWAB)
3202
                TIFFSwabArrayOfLong((uint32_t *)origdata, count);
3203
            TIFFCvtIEEEFloatToNative(tif, count, (float *)origdata);
3204
            ma = (float *)origdata;
3205
            mb = data;
3206
            for (n = 0; n < count; n++)
3207
                *mb++ = (double)(*ma++);
3208
        }
3209
        break;
3210
    }
3211
    _TIFFfreeExt(tif, origdata);
3212
    *value = data;
3213
    return (TIFFReadDirEntryErrOk);
3214
}
3215

3216
static enum TIFFReadDirEntryErr
3217
TIFFReadDirEntryIfd8Array(TIFF *tif, TIFFDirEntry *direntry, uint64_t **value)
3218
{
3219
    enum TIFFReadDirEntryErr err;
3220
    uint32_t count;
3221
    void *origdata;
3222
    uint64_t *data;
3223
    switch (direntry->tdir_type)
3224
    {
3225
        case TIFF_LONG:
3226
        case TIFF_LONG8:
3227
        case TIFF_IFD:
3228
        case TIFF_IFD8:
3229
            break;
3230
        default:
3231
            return (TIFFReadDirEntryErrType);
3232
    }
3233
    err = TIFFReadDirEntryArray(tif, direntry, &count, 8, &origdata);
3234
    if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
3235
    {
3236
        *value = 0;
3237
        return (err);
3238
    }
3239
    switch (direntry->tdir_type)
3240
    {
3241
        case TIFF_LONG8:
3242
        case TIFF_IFD8:
3243
            *value = (uint64_t *)origdata;
3244
            if (tif->tif_flags & TIFF_SWAB)
3245
                TIFFSwabArrayOfLong8(*value, count);
3246
            return (TIFFReadDirEntryErrOk);
3247
    }
3248
    data = (uint64_t *)_TIFFmallocExt(tif, count * 8);
3249
    if (data == 0)
3250
    {
3251
        _TIFFfreeExt(tif, origdata);
3252
        return (TIFFReadDirEntryErrAlloc);
3253
    }
3254
    switch (direntry->tdir_type)
3255
    {
3256
        case TIFF_LONG:
3257
        case TIFF_IFD:
3258
        {
3259
            uint32_t *ma;
3260
            uint64_t *mb;
3261
            uint32_t n;
3262
            ma = (uint32_t *)origdata;
3263
            mb = data;
3264
            for (n = 0; n < count; n++)
3265
            {
3266
                if (tif->tif_flags & TIFF_SWAB)
3267
                    TIFFSwabLong(ma);
3268
                *mb++ = (uint64_t)(*ma++);
3269
            }
3270
        }
3271
        break;
3272
    }
3273
    _TIFFfreeExt(tif, origdata);
3274
    *value = data;
3275
    return (TIFFReadDirEntryErrOk);
3276
}
3277

3278
static enum TIFFReadDirEntryErr
3279
TIFFReadDirEntryPersampleShort(TIFF *tif, TIFFDirEntry *direntry,
3280
                               uint16_t *value)
3281
{
3282
    enum TIFFReadDirEntryErr err;
3283
    uint16_t *m;
3284
    uint16_t *na;
3285
    uint16_t nb;
3286
    if (direntry->tdir_count < (uint64_t)tif->tif_dir.td_samplesperpixel)
3287
        return (TIFFReadDirEntryErrCount);
3288
    err = TIFFReadDirEntryShortArray(tif, direntry, &m);
3289
    if (err != TIFFReadDirEntryErrOk || m == NULL)
3290
        return (err);
3291
    na = m;
3292
    nb = tif->tif_dir.td_samplesperpixel;
3293
    *value = *na++;
3294
    nb--;
3295
    while (nb > 0)
3296
    {
3297
        if (*na++ != *value)
3298
        {
3299
            err = TIFFReadDirEntryErrPsdif;
3300
            break;
3301
        }
3302
        nb--;
3303
    }
3304
    _TIFFfreeExt(tif, m);
3305
    return (err);
3306
}
3307

3308
static void TIFFReadDirEntryCheckedByte(TIFF *tif, TIFFDirEntry *direntry,
3309
                                        uint8_t *value)
3310
{
3311
    (void)tif;
3312
    *value = *(uint8_t *)(&direntry->tdir_offset);
3313
}
3314

3315
static void TIFFReadDirEntryCheckedSbyte(TIFF *tif, TIFFDirEntry *direntry,
3316
                                         int8_t *value)
3317
{
3318
    (void)tif;
3319
    *value = *(int8_t *)(&direntry->tdir_offset);
3320
}
3321

3322
static void TIFFReadDirEntryCheckedShort(TIFF *tif, TIFFDirEntry *direntry,
3323
                                         uint16_t *value)
3324
{
3325
    *value = direntry->tdir_offset.toff_short;
3326
    /* *value=*(uint16_t*)(&direntry->tdir_offset); */
3327
    if (tif->tif_flags & TIFF_SWAB)
3328
        TIFFSwabShort(value);
3329
}
3330

3331
static void TIFFReadDirEntryCheckedSshort(TIFF *tif, TIFFDirEntry *direntry,
3332
                                          int16_t *value)
3333
{
3334
    *value = *(int16_t *)(&direntry->tdir_offset);
3335
    if (tif->tif_flags & TIFF_SWAB)
3336
        TIFFSwabShort((uint16_t *)value);
3337
}
3338

3339
static void TIFFReadDirEntryCheckedLong(TIFF *tif, TIFFDirEntry *direntry,
3340
                                        uint32_t *value)
3341
{
3342
    *value = *(uint32_t *)(&direntry->tdir_offset);
3343
    if (tif->tif_flags & TIFF_SWAB)
3344
        TIFFSwabLong(value);
3345
}
3346

3347
static void TIFFReadDirEntryCheckedSlong(TIFF *tif, TIFFDirEntry *direntry,
3348
                                         int32_t *value)
3349
{
3350
    *value = *(int32_t *)(&direntry->tdir_offset);
3351
    if (tif->tif_flags & TIFF_SWAB)
3352
        TIFFSwabLong((uint32_t *)value);
3353
}
3354

3355
static enum TIFFReadDirEntryErr
3356
TIFFReadDirEntryCheckedLong8(TIFF *tif, TIFFDirEntry *direntry, uint64_t *value)
3357
{
3358
    if (!(tif->tif_flags & TIFF_BIGTIFF))
3359
    {
3360
        enum TIFFReadDirEntryErr err;
3361
        uint32_t offset = direntry->tdir_offset.toff_long;
3362
        if (tif->tif_flags & TIFF_SWAB)
3363
            TIFFSwabLong(&offset);
3364
        err = TIFFReadDirEntryData(tif, offset, 8, value);
3365
        if (err != TIFFReadDirEntryErrOk)
3366
            return (err);
3367
    }
3368
    else
3369
        *value = direntry->tdir_offset.toff_long8;
3370
    if (tif->tif_flags & TIFF_SWAB)
3371
        TIFFSwabLong8(value);
3372
    return (TIFFReadDirEntryErrOk);
3373
}
3374

3375
static enum TIFFReadDirEntryErr
3376
TIFFReadDirEntryCheckedSlong8(TIFF *tif, TIFFDirEntry *direntry, int64_t *value)
3377
{
3378
    if (!(tif->tif_flags & TIFF_BIGTIFF))
3379
    {
3380
        enum TIFFReadDirEntryErr err;
3381
        uint32_t offset = direntry->tdir_offset.toff_long;
3382
        if (tif->tif_flags & TIFF_SWAB)
3383
            TIFFSwabLong(&offset);
3384
        err = TIFFReadDirEntryData(tif, offset, 8, value);
3385
        if (err != TIFFReadDirEntryErrOk)
3386
            return (err);
3387
    }
3388
    else
3389
        *value = *(int64_t *)(&direntry->tdir_offset);
3390
    if (tif->tif_flags & TIFF_SWAB)
3391
        TIFFSwabLong8((uint64_t *)value);
3392
    return (TIFFReadDirEntryErrOk);
3393
}
3394

3395
static enum TIFFReadDirEntryErr
3396
TIFFReadDirEntryCheckedRational(TIFF *tif, TIFFDirEntry *direntry,
3397
                                double *value)
3398
{
3399
    UInt64Aligned_t m;
3400

3401
    assert(sizeof(double) == 8);
3402
    assert(sizeof(uint64_t) == 8);
3403
    assert(sizeof(uint32_t) == 4);
3404
    if (!(tif->tif_flags & TIFF_BIGTIFF))
3405
    {
3406
        enum TIFFReadDirEntryErr err;
3407
        uint32_t offset = direntry->tdir_offset.toff_long;
3408
        if (tif->tif_flags & TIFF_SWAB)
3409
            TIFFSwabLong(&offset);
3410
        err = TIFFReadDirEntryData(tif, offset, 8, m.i);
3411
        if (err != TIFFReadDirEntryErrOk)
3412
            return (err);
3413
    }
3414
    else
3415
        m.l = direntry->tdir_offset.toff_long8;
3416
    if (tif->tif_flags & TIFF_SWAB)
3417
        TIFFSwabArrayOfLong(m.i, 2);
3418
    /* Not completely sure what we should do when m.i[1]==0, but some */
3419
    /* sanitizers do not like division by 0.0: */
3420
    /* http://bugzilla.maptools.org/show_bug.cgi?id=2644 */
3421
    if (m.i[0] == 0 || m.i[1] == 0)
3422
        *value = 0.0;
3423
    else
3424
        *value = (double)m.i[0] / (double)m.i[1];
3425
    return (TIFFReadDirEntryErrOk);
3426
}
3427

3428
static enum TIFFReadDirEntryErr
3429
TIFFReadDirEntryCheckedSrational(TIFF *tif, TIFFDirEntry *direntry,
3430
                                 double *value)
3431
{
3432
    UInt64Aligned_t m;
3433
    assert(sizeof(double) == 8);
3434
    assert(sizeof(uint64_t) == 8);
3435
    assert(sizeof(int32_t) == 4);
3436
    assert(sizeof(uint32_t) == 4);
3437
    if (!(tif->tif_flags & TIFF_BIGTIFF))
3438
    {
3439
        enum TIFFReadDirEntryErr err;
3440
        uint32_t offset = direntry->tdir_offset.toff_long;
3441
        if (tif->tif_flags & TIFF_SWAB)
3442
            TIFFSwabLong(&offset);
3443
        err = TIFFReadDirEntryData(tif, offset, 8, m.i);
3444
        if (err != TIFFReadDirEntryErrOk)
3445
            return (err);
3446
    }
3447
    else
3448
        m.l = direntry->tdir_offset.toff_long8;
3449
    if (tif->tif_flags & TIFF_SWAB)
3450
        TIFFSwabArrayOfLong(m.i, 2);
3451
    /* Not completely sure what we should do when m.i[1]==0, but some */
3452
    /* sanitizers do not like division by 0.0: */
3453
    /* http://bugzilla.maptools.org/show_bug.cgi?id=2644 */
3454
    if ((int32_t)m.i[0] == 0 || m.i[1] == 0)
3455
        *value = 0.0;
3456
    else
3457
        *value = (double)((int32_t)m.i[0]) / (double)m.i[1];
3458
    return (TIFFReadDirEntryErrOk);
3459
}
3460

3461
#if 0
3462
static enum TIFFReadDirEntryErr
3463
TIFFReadDirEntryCheckedRationalDirect(TIFF *tif, TIFFDirEntry *direntry,
3464
                                      TIFFRational_t *value)
3465
{ /*--: SetGetRATIONAL_directly:_CustomTag: Read rational (and signed rationals)
3466
     directly --*/
3467
    UInt64Aligned_t m;
3468

3469
    assert(sizeof(double) == 8);
3470
    assert(sizeof(uint64_t) == 8);
3471
    assert(sizeof(uint32_t) == 4);
3472

3473
    if (direntry->tdir_count != 1)
3474
        return (TIFFReadDirEntryErrCount);
3475

3476
    if (direntry->tdir_type != TIFF_RATIONAL &&
3477
        direntry->tdir_type != TIFF_SRATIONAL)
3478
        return (TIFFReadDirEntryErrType);
3479

3480
    if (!(tif->tif_flags & TIFF_BIGTIFF))
3481
    {
3482
        enum TIFFReadDirEntryErr err;
3483
        uint32_t offset = direntry->tdir_offset.toff_long;
3484
        if (tif->tif_flags & TIFF_SWAB)
3485
            TIFFSwabLong(&offset);
3486
        err = TIFFReadDirEntryData(tif, offset, 8, m.i);
3487
        if (err != TIFFReadDirEntryErrOk)
3488
            return (err);
3489
    }
3490
    else
3491
    {
3492
        m.l = direntry->tdir_offset.toff_long8;
3493
    }
3494

3495
    if (tif->tif_flags & TIFF_SWAB)
3496
        TIFFSwabArrayOfLong(m.i, 2);
3497

3498
    value->uNum = m.i[0];
3499
    value->uDenom = m.i[1];
3500
    return (TIFFReadDirEntryErrOk);
3501
} /*-- TIFFReadDirEntryCheckedRationalDirect() --*/
3502
#endif
3503

3504
static void TIFFReadDirEntryCheckedFloat(TIFF *tif, TIFFDirEntry *direntry,
3505
                                         float *value)
3506
{
3507
    union
3508
    {
3509
        float f;
3510
        uint32_t i;
3511
    } float_union;
3512
    assert(sizeof(float) == 4);
3513
    assert(sizeof(uint32_t) == 4);
3514
    assert(sizeof(float_union) == 4);
3515
    float_union.i = *(uint32_t *)(&direntry->tdir_offset);
3516
    *value = float_union.f;
3517
    if (tif->tif_flags & TIFF_SWAB)
3518
        TIFFSwabLong((uint32_t *)value);
3519
}
3520

3521
static enum TIFFReadDirEntryErr
3522
TIFFReadDirEntryCheckedDouble(TIFF *tif, TIFFDirEntry *direntry, double *value)
3523
{
3524
    assert(sizeof(double) == 8);
3525
    assert(sizeof(uint64_t) == 8);
3526
    assert(sizeof(UInt64Aligned_t) == 8);
3527
    if (!(tif->tif_flags & TIFF_BIGTIFF))
3528
    {
3529
        enum TIFFReadDirEntryErr err;
3530
        uint32_t offset = direntry->tdir_offset.toff_long;
3531
        if (tif->tif_flags & TIFF_SWAB)
3532
            TIFFSwabLong(&offset);
3533
        err = TIFFReadDirEntryData(tif, offset, 8, value);
3534
        if (err != TIFFReadDirEntryErrOk)
3535
            return (err);
3536
    }
3537
    else
3538
    {
3539
        UInt64Aligned_t uint64_union;
3540
        uint64_union.l = direntry->tdir_offset.toff_long8;
3541
        *value = uint64_union.d;
3542
    }
3543
    if (tif->tif_flags & TIFF_SWAB)
3544
        TIFFSwabLong8((uint64_t *)value);
3545
    return (TIFFReadDirEntryErrOk);
3546
}
3547

3548
static enum TIFFReadDirEntryErr
3549
TIFFReadDirEntryCheckRangeByteSbyte(int8_t value)
3550
{
3551
    if (value < 0)
3552
        return (TIFFReadDirEntryErrRange);
3553
    else
3554
        return (TIFFReadDirEntryErrOk);
3555
}
3556

3557
static enum TIFFReadDirEntryErr
3558
TIFFReadDirEntryCheckRangeByteShort(uint16_t value)
3559
{
3560
    if (value > 0xFF)
3561
        return (TIFFReadDirEntryErrRange);
3562
    else
3563
        return (TIFFReadDirEntryErrOk);
3564
}
3565

3566
static enum TIFFReadDirEntryErr
3567
TIFFReadDirEntryCheckRangeByteSshort(int16_t value)
3568
{
3569
    if ((value < 0) || (value > 0xFF))
3570
        return (TIFFReadDirEntryErrRange);
3571
    else
3572
        return (TIFFReadDirEntryErrOk);
3573
}
3574

3575
static enum TIFFReadDirEntryErr
3576
TIFFReadDirEntryCheckRangeByteLong(uint32_t value)
3577
{
3578
    if (value > 0xFF)
3579
        return (TIFFReadDirEntryErrRange);
3580
    else
3581
        return (TIFFReadDirEntryErrOk);
3582
}
3583

3584
static enum TIFFReadDirEntryErr
3585
TIFFReadDirEntryCheckRangeByteSlong(int32_t value)
3586
{
3587
    if ((value < 0) || (value > 0xFF))
3588
        return (TIFFReadDirEntryErrRange);
3589
    else
3590
        return (TIFFReadDirEntryErrOk);
3591
}
3592

3593
static enum TIFFReadDirEntryErr
3594
TIFFReadDirEntryCheckRangeByteLong8(uint64_t value)
3595
{
3596
    if (value > 0xFF)
3597
        return (TIFFReadDirEntryErrRange);
3598
    else
3599
        return (TIFFReadDirEntryErrOk);
3600
}
3601

3602
static enum TIFFReadDirEntryErr
3603
TIFFReadDirEntryCheckRangeByteSlong8(int64_t value)
3604
{
3605
    if ((value < 0) || (value > 0xFF))
3606
        return (TIFFReadDirEntryErrRange);
3607
    else
3608
        return (TIFFReadDirEntryErrOk);
3609
}
3610

3611
static enum TIFFReadDirEntryErr
3612
TIFFReadDirEntryCheckRangeSbyteByte(uint8_t value)
3613
{
3614
    if (value > 0x7F)
3615
        return (TIFFReadDirEntryErrRange);
3616
    else
3617
        return (TIFFReadDirEntryErrOk);
3618
}
3619

3620
static enum TIFFReadDirEntryErr
3621
TIFFReadDirEntryCheckRangeSbyteShort(uint16_t value)
3622
{
3623
    if (value > 0x7F)
3624
        return (TIFFReadDirEntryErrRange);
3625
    else
3626
        return (TIFFReadDirEntryErrOk);
3627
}
3628

3629
static enum TIFFReadDirEntryErr
3630
TIFFReadDirEntryCheckRangeSbyteSshort(int16_t value)
3631
{
3632
    if ((value < -0x80) || (value > 0x7F))
3633
        return (TIFFReadDirEntryErrRange);
3634
    else
3635
        return (TIFFReadDirEntryErrOk);
3636
}
3637

3638
static enum TIFFReadDirEntryErr
3639
TIFFReadDirEntryCheckRangeSbyteLong(uint32_t value)
3640
{
3641
    if (value > 0x7F)
3642
        return (TIFFReadDirEntryErrRange);
3643
    else
3644
        return (TIFFReadDirEntryErrOk);
3645
}
3646

3647
static enum TIFFReadDirEntryErr
3648
TIFFReadDirEntryCheckRangeSbyteSlong(int32_t value)
3649
{
3650
    if ((value < -0x80) || (value > 0x7F))
3651
        return (TIFFReadDirEntryErrRange);
3652
    else
3653
        return (TIFFReadDirEntryErrOk);
3654
}
3655

3656
static enum TIFFReadDirEntryErr
3657
TIFFReadDirEntryCheckRangeSbyteLong8(uint64_t value)
3658
{
3659
    if (value > 0x7F)
3660
        return (TIFFReadDirEntryErrRange);
3661
    else
3662
        return (TIFFReadDirEntryErrOk);
3663
}
3664

3665
static enum TIFFReadDirEntryErr
3666
TIFFReadDirEntryCheckRangeSbyteSlong8(int64_t value)
3667
{
3668
    if ((value < -0x80) || (value > 0x7F))
3669
        return (TIFFReadDirEntryErrRange);
3670
    else
3671
        return (TIFFReadDirEntryErrOk);
3672
}
3673

3674
static enum TIFFReadDirEntryErr
3675
TIFFReadDirEntryCheckRangeShortSbyte(int8_t value)
3676
{
3677
    if (value < 0)
3678
        return (TIFFReadDirEntryErrRange);
3679
    else
3680
        return (TIFFReadDirEntryErrOk);
3681
}
3682

3683
static enum TIFFReadDirEntryErr
3684
TIFFReadDirEntryCheckRangeShortSshort(int16_t value)
3685
{
3686
    if (value < 0)
3687
        return (TIFFReadDirEntryErrRange);
3688
    else
3689
        return (TIFFReadDirEntryErrOk);
3690
}
3691

3692
static enum TIFFReadDirEntryErr
3693
TIFFReadDirEntryCheckRangeShortLong(uint32_t value)
3694
{
3695
    if (value > 0xFFFF)
3696
        return (TIFFReadDirEntryErrRange);
3697
    else
3698
        return (TIFFReadDirEntryErrOk);
3699
}
3700

3701
static enum TIFFReadDirEntryErr
3702
TIFFReadDirEntryCheckRangeShortSlong(int32_t value)
3703
{
3704
    if ((value < 0) || (value > 0xFFFF))
3705
        return (TIFFReadDirEntryErrRange);
3706
    else
3707
        return (TIFFReadDirEntryErrOk);
3708
}
3709

3710
static enum TIFFReadDirEntryErr
3711
TIFFReadDirEntryCheckRangeShortLong8(uint64_t value)
3712
{
3713
    if (value > 0xFFFF)
3714
        return (TIFFReadDirEntryErrRange);
3715
    else
3716
        return (TIFFReadDirEntryErrOk);
3717
}
3718

3719
static enum TIFFReadDirEntryErr
3720
TIFFReadDirEntryCheckRangeShortSlong8(int64_t value)
3721
{
3722
    if ((value < 0) || (value > 0xFFFF))
3723
        return (TIFFReadDirEntryErrRange);
3724
    else
3725
        return (TIFFReadDirEntryErrOk);
3726
}
3727

3728
static enum TIFFReadDirEntryErr
3729
TIFFReadDirEntryCheckRangeSshortShort(uint16_t value)
3730
{
3731
    if (value > 0x7FFF)
3732
        return (TIFFReadDirEntryErrRange);
3733
    else
3734
        return (TIFFReadDirEntryErrOk);
3735
}
3736

3737
static enum TIFFReadDirEntryErr
3738
TIFFReadDirEntryCheckRangeSshortLong(uint32_t value)
3739
{
3740
    if (value > 0x7FFF)
3741
        return (TIFFReadDirEntryErrRange);
3742
    else
3743
        return (TIFFReadDirEntryErrOk);
3744
}
3745

3746
static enum TIFFReadDirEntryErr
3747
TIFFReadDirEntryCheckRangeSshortSlong(int32_t value)
3748
{
3749
    if ((value < -0x8000) || (value > 0x7FFF))
3750
        return (TIFFReadDirEntryErrRange);
3751
    else
3752
        return (TIFFReadDirEntryErrOk);
3753
}
3754

3755
static enum TIFFReadDirEntryErr
3756
TIFFReadDirEntryCheckRangeSshortLong8(uint64_t value)
3757
{
3758
    if (value > 0x7FFF)
3759
        return (TIFFReadDirEntryErrRange);
3760
    else
3761
        return (TIFFReadDirEntryErrOk);
3762
}
3763

3764
static enum TIFFReadDirEntryErr
3765
TIFFReadDirEntryCheckRangeSshortSlong8(int64_t value)
3766
{
3767
    if ((value < -0x8000) || (value > 0x7FFF))
3768
        return (TIFFReadDirEntryErrRange);
3769
    else
3770
        return (TIFFReadDirEntryErrOk);
3771
}
3772

3773
static enum TIFFReadDirEntryErr
3774
TIFFReadDirEntryCheckRangeLongSbyte(int8_t value)
3775
{
3776
    if (value < 0)
3777
        return (TIFFReadDirEntryErrRange);
3778
    else
3779
        return (TIFFReadDirEntryErrOk);
3780
}
3781

3782
static enum TIFFReadDirEntryErr
3783
TIFFReadDirEntryCheckRangeLongSshort(int16_t value)
3784
{
3785
    if (value < 0)
3786
        return (TIFFReadDirEntryErrRange);
3787
    else
3788
        return (TIFFReadDirEntryErrOk);
3789
}
3790

3791
static enum TIFFReadDirEntryErr
3792
TIFFReadDirEntryCheckRangeLongSlong(int32_t value)
3793
{
3794
    if (value < 0)
3795
        return (TIFFReadDirEntryErrRange);
3796
    else
3797
        return (TIFFReadDirEntryErrOk);
3798
}
3799

3800
static enum TIFFReadDirEntryErr
3801
TIFFReadDirEntryCheckRangeLongLong8(uint64_t value)
3802
{
3803
    if (value > UINT32_MAX)
3804
        return (TIFFReadDirEntryErrRange);
3805
    else
3806
        return (TIFFReadDirEntryErrOk);
3807
}
3808

3809
static enum TIFFReadDirEntryErr
3810
TIFFReadDirEntryCheckRangeLongSlong8(int64_t value)
3811
{
3812
    if ((value < 0) || (value > (int64_t)UINT32_MAX))
3813
        return (TIFFReadDirEntryErrRange);
3814
    else
3815
        return (TIFFReadDirEntryErrOk);
3816
}
3817

3818
static enum TIFFReadDirEntryErr
3819
TIFFReadDirEntryCheckRangeSlongLong(uint32_t value)
3820
{
3821
    if (value > 0x7FFFFFFFUL)
3822
        return (TIFFReadDirEntryErrRange);
3823
    else
3824
        return (TIFFReadDirEntryErrOk);
3825
}
3826

3827
/* Check that the 8-byte unsigned value can fit in a 4-byte unsigned range */
3828
static enum TIFFReadDirEntryErr
3829
TIFFReadDirEntryCheckRangeSlongLong8(uint64_t value)
3830
{
3831
    if (value > 0x7FFFFFFF)
3832
        return (TIFFReadDirEntryErrRange);
3833
    else
3834
        return (TIFFReadDirEntryErrOk);
3835
}
3836

3837
/* Check that the 8-byte signed value can fit in a 4-byte signed range */
3838
static enum TIFFReadDirEntryErr
3839
TIFFReadDirEntryCheckRangeSlongSlong8(int64_t value)
3840
{
3841
    if ((value < 0 - ((int64_t)0x7FFFFFFF + 1)) || (value > 0x7FFFFFFF))
3842
        return (TIFFReadDirEntryErrRange);
3843
    else
3844
        return (TIFFReadDirEntryErrOk);
3845
}
3846

3847
static enum TIFFReadDirEntryErr
3848
TIFFReadDirEntryCheckRangeLong8Sbyte(int8_t value)
3849
{
3850
    if (value < 0)
3851
        return (TIFFReadDirEntryErrRange);
3852
    else
3853
        return (TIFFReadDirEntryErrOk);
3854
}
3855

3856
static enum TIFFReadDirEntryErr
3857
TIFFReadDirEntryCheckRangeLong8Sshort(int16_t value)
3858
{
3859
    if (value < 0)
3860
        return (TIFFReadDirEntryErrRange);
3861
    else
3862
        return (TIFFReadDirEntryErrOk);
3863
}
3864

3865
static enum TIFFReadDirEntryErr
3866
TIFFReadDirEntryCheckRangeLong8Slong(int32_t value)
3867
{
3868
    if (value < 0)
3869
        return (TIFFReadDirEntryErrRange);
3870
    else
3871
        return (TIFFReadDirEntryErrOk);
3872
}
3873

3874
static enum TIFFReadDirEntryErr
3875
TIFFReadDirEntryCheckRangeLong8Slong8(int64_t value)
3876
{
3877
    if (value < 0)
3878
        return (TIFFReadDirEntryErrRange);
3879
    else
3880
        return (TIFFReadDirEntryErrOk);
3881
}
3882

3883
static enum TIFFReadDirEntryErr
3884
TIFFReadDirEntryCheckRangeSlong8Long8(uint64_t value)
3885
{
3886
    if (value > INT64_MAX)
3887
        return (TIFFReadDirEntryErrRange);
3888
    else
3889
        return (TIFFReadDirEntryErrOk);
3890
}
3891

3892
static enum TIFFReadDirEntryErr TIFFReadDirEntryData(TIFF *tif, uint64_t offset,
3893
                                                     tmsize_t size, void *dest)
3894
{
3895
    assert(size > 0);
3896
    if (!isMapped(tif))
3897
    {
3898
        if (!SeekOK(tif, offset))
3899
            return (TIFFReadDirEntryErrIo);
3900
        if (!ReadOK(tif, dest, size))
3901
            return (TIFFReadDirEntryErrIo);
3902
    }
3903
    else
3904
    {
3905
        size_t ma, mb;
3906
        ma = (size_t)offset;
3907
        if ((uint64_t)ma != offset || ma > (~(size_t)0) - (size_t)size)
3908
        {
3909
            return TIFFReadDirEntryErrIo;
3910
        }
3911
        mb = ma + size;
3912
        if (mb > (uint64_t)tif->tif_size)
3913
            return (TIFFReadDirEntryErrIo);
3914
        _TIFFmemcpy(dest, tif->tif_base + ma, size);
3915
    }
3916
    return (TIFFReadDirEntryErrOk);
3917
}
3918

3919
static void TIFFReadDirEntryOutputErr(TIFF *tif, enum TIFFReadDirEntryErr err,
3920
                                      const char *module, const char *tagname,
3921
                                      int recover)
3922
{
3923
    if (!recover)
3924
    {
3925
        switch (err)
3926
        {
3927
            case TIFFReadDirEntryErrCount:
3928
                TIFFErrorExtR(tif, module, "Incorrect count for \"%s\"",
3929
                              tagname);
3930
                break;
3931
            case TIFFReadDirEntryErrType:
3932
                TIFFErrorExtR(tif, module, "Incompatible type for \"%s\"",
3933
                              tagname);
3934
                break;
3935
            case TIFFReadDirEntryErrIo:
3936
                TIFFErrorExtR(tif, module, "IO error during reading of \"%s\"",
3937
                              tagname);
3938
                break;
3939
            case TIFFReadDirEntryErrRange:
3940
                TIFFErrorExtR(tif, module, "Incorrect value for \"%s\"",
3941
                              tagname);
3942
                break;
3943
            case TIFFReadDirEntryErrPsdif:
3944
                TIFFErrorExtR(
3945
                    tif, module,
3946
                    "Cannot handle different values per sample for \"%s\"",
3947
                    tagname);
3948
                break;
3949
            case TIFFReadDirEntryErrSizesan:
3950
                TIFFErrorExtR(tif, module,
3951
                              "Sanity check on size of \"%s\" value failed",
3952
                              tagname);
3953
                break;
3954
            case TIFFReadDirEntryErrAlloc:
3955
                TIFFErrorExtR(tif, module, "Out of memory reading of \"%s\"",
3956
                              tagname);
3957
                break;
3958
            default:
3959
                assert(0); /* we should never get here */
3960
                break;
3961
        }
3962
    }
3963
    else
3964
    {
3965
        switch (err)
3966
        {
3967
            case TIFFReadDirEntryErrCount:
3968
                TIFFWarningExtR(tif, module,
3969
                                "Incorrect count for \"%s\"; tag ignored",
3970
                                tagname);
3971
                break;
3972
            case TIFFReadDirEntryErrType:
3973
                TIFFWarningExtR(tif, module,
3974
                                "Incompatible type for \"%s\"; tag ignored",
3975
                                tagname);
3976
                break;
3977
            case TIFFReadDirEntryErrIo:
3978
                TIFFWarningExtR(
3979
                    tif, module,
3980
                    "IO error during reading of \"%s\"; tag ignored", tagname);
3981
                break;
3982
            case TIFFReadDirEntryErrRange:
3983
                TIFFWarningExtR(tif, module,
3984
                                "Incorrect value for \"%s\"; tag ignored",
3985
                                tagname);
3986
                break;
3987
            case TIFFReadDirEntryErrPsdif:
3988
                TIFFWarningExtR(tif, module,
3989
                                "Cannot handle different values per sample for "
3990
                                "\"%s\"; tag ignored",
3991
                                tagname);
3992
                break;
3993
            case TIFFReadDirEntryErrSizesan:
3994
                TIFFWarningExtR(
3995
                    tif, module,
3996
                    "Sanity check on size of \"%s\" value failed; tag ignored",
3997
                    tagname);
3998
                break;
3999
            case TIFFReadDirEntryErrAlloc:
4000
                TIFFWarningExtR(tif, module,
4001
                                "Out of memory reading of \"%s\"; tag ignored",
4002
                                tagname);
4003
                break;
4004
            default:
4005
                assert(0); /* we should never get here */
4006
                break;
4007
        }
4008
    }
4009
}
4010

4011
/*
4012
 * Return the maximum number of color channels specified for a given photometric
4013
 * type. 0 is returned if photometric type isn't supported or no default value
4014
 * is defined by the specification.
4015
 */
4016
static int _TIFFGetMaxColorChannels(uint16_t photometric)
4017
{
4018
    switch (photometric)
4019
    {
4020
        case PHOTOMETRIC_PALETTE:
4021
        case PHOTOMETRIC_MINISWHITE:
4022
        case PHOTOMETRIC_MINISBLACK:
4023
            return 1;
4024
        case PHOTOMETRIC_YCBCR:
4025
        case PHOTOMETRIC_RGB:
4026
        case PHOTOMETRIC_CIELAB:
4027
        case PHOTOMETRIC_LOGLUV:
4028
        case PHOTOMETRIC_ITULAB:
4029
        case PHOTOMETRIC_ICCLAB:
4030
            return 3;
4031
        case PHOTOMETRIC_SEPARATED:
4032
        case PHOTOMETRIC_MASK:
4033
            return 4;
4034
        case PHOTOMETRIC_LOGL:
4035
        case PHOTOMETRIC_CFA:
4036
        default:
4037
            return 0;
4038
    }
4039
}
4040

4041
static int ByteCountLooksBad(TIFF *tif)
4042
{
4043
    /*
4044
     * Assume we have wrong StripByteCount value (in case
4045
     * of single strip) in following cases:
4046
     *   - it is equal to zero along with StripOffset;
4047
     *   - it is larger than file itself (in case of uncompressed
4048
     *     image);
4049
     *   - it is smaller than the size of the bytes per row
4050
     *     multiplied on the number of rows.  The last case should
4051
     *     not be checked in the case of writing new image,
4052
     *     because we may do not know the exact strip size
4053
     *     until the whole image will be written and directory
4054
     *     dumped out.
4055
     */
4056
    uint64_t bytecount = TIFFGetStrileByteCount(tif, 0);
4057
    uint64_t offset = TIFFGetStrileOffset(tif, 0);
4058
    uint64_t filesize;
4059

4060
    if (offset == 0)
4061
        return 0;
4062
    if (bytecount == 0)
4063
        return 1;
4064
    if (tif->tif_dir.td_compression != COMPRESSION_NONE)
4065
        return 0;
4066
    filesize = TIFFGetFileSize(tif);
4067
    if (offset <= filesize && bytecount > filesize - offset)
4068
        return 1;
4069
    if (tif->tif_mode == O_RDONLY)
4070
    {
4071
        uint64_t scanlinesize = TIFFScanlineSize64(tif);
4072
        if (tif->tif_dir.td_imagelength > 0 &&
4073
            scanlinesize > UINT64_MAX / tif->tif_dir.td_imagelength)
4074
        {
4075
            return 1;
4076
        }
4077
        if (bytecount < scanlinesize * tif->tif_dir.td_imagelength)
4078
            return 1;
4079
    }
4080
    return 0;
4081
}
4082

4083
/*
4084
 * To evaluate the IFD data size when reading, save the offset and data size of
4085
 * all data that does not fit into the IFD entries themselves.
4086
 */
4087
static bool EvaluateIFDdatasizeReading(TIFF *tif, TIFFDirEntry *dp)
4088
{
4089
    const uint64_t data_width = TIFFDataWidth(dp->tdir_type);
4090
    if (data_width != 0 && dp->tdir_count > UINT64_MAX / data_width)
4091
    {
4092
        TIFFErrorExtR(tif, "EvaluateIFDdatasizeReading",
4093
                      "Too large IFD data size");
4094
        return false;
4095
    }
4096
    const uint64_t datalength = dp->tdir_count * data_width;
4097
    if (datalength > ((tif->tif_flags & TIFF_BIGTIFF) ? 0x8U : 0x4U))
4098
    {
4099
        if (tif->tif_dir.td_dirdatasize_read > UINT64_MAX - datalength)
4100
        {
4101
            TIFFErrorExtR(tif, "EvaluateIFDdatasizeReading",
4102
                          "Too large IFD data size");
4103
            return false;
4104
        }
4105
        tif->tif_dir.td_dirdatasize_read += datalength;
4106
        if (!(tif->tif_flags & TIFF_BIGTIFF))
4107
        {
4108
            /* The offset of TIFFDirEntry are not swapped when read in. That has
4109
             * to be done when used. */
4110
            uint32_t offset = dp->tdir_offset.toff_long;
4111
            if (tif->tif_flags & TIFF_SWAB)
4112
                TIFFSwabLong(&offset);
4113
            tif->tif_dir
4114
                .td_dirdatasize_offsets[tif->tif_dir.td_dirdatasize_Noffsets]
4115
                .offset = (uint64_t)offset;
4116
        }
4117
        else
4118
        {
4119
            tif->tif_dir
4120
                .td_dirdatasize_offsets[tif->tif_dir.td_dirdatasize_Noffsets]
4121
                .offset = dp->tdir_offset.toff_long8;
4122
            if (tif->tif_flags & TIFF_SWAB)
4123
                TIFFSwabLong8(
4124
                    &tif->tif_dir
4125
                         .td_dirdatasize_offsets[tif->tif_dir
4126
                                                     .td_dirdatasize_Noffsets]
4127
                         .offset);
4128
        }
4129
        tif->tif_dir
4130
            .td_dirdatasize_offsets[tif->tif_dir.td_dirdatasize_Noffsets]
4131
            .length = datalength;
4132
        tif->tif_dir.td_dirdatasize_Noffsets++;
4133
    }
4134
    return true;
4135
}
4136

4137
/*
4138
 * Compare function for qsort() sorting TIFFEntryOffsetAndLength array entries.
4139
 */
4140
static int cmpTIFFEntryOffsetAndLength(const void *a, const void *b)
4141
{
4142
    const TIFFEntryOffsetAndLength *ta = (const TIFFEntryOffsetAndLength *)a;
4143
    const TIFFEntryOffsetAndLength *tb = (const TIFFEntryOffsetAndLength *)b;
4144
    /* Compare offsets */
4145
    if (ta->offset > tb->offset)
4146
        return 1;
4147
    else if (ta->offset < tb->offset)
4148
        return -1;
4149
    else
4150
        return 0;
4151
}
4152

4153
/*
4154
 * Determine the IFD data size after reading an IFD from the file that can be
4155
 * overwritten and saving it in tif_dir.td_dirdatasize_read. This data size
4156
 * includes the IFD entries themselves as well as the data that does not fit
4157
 * directly into the IFD entries but is located directly after the IFD entries
4158
 * in the file.
4159
 */
4160
static void CalcFinalIFDdatasizeReading(TIFF *tif, uint16_t dircount)
4161
{
4162
    /* IFD data size is only needed if file-writing is enabled.
4163
     * This also avoids the seek() to EOF to determine the file size, which
4164
     * causes the stdin-streaming-friendly mode of libtiff for GDAL to fail. */
4165
    if (tif->tif_mode == O_RDONLY)
4166
        return;
4167

4168
    /* Sort TIFFEntryOffsetAndLength array in ascending order. */
4169
    qsort(tif->tif_dir.td_dirdatasize_offsets,
4170
          tif->tif_dir.td_dirdatasize_Noffsets,
4171
          sizeof(TIFFEntryOffsetAndLength), cmpTIFFEntryOffsetAndLength);
4172

4173
    /* Get offset of end of IFD entry space. */
4174
    uint64_t IFDendoffset;
4175
    if (!(tif->tif_flags & TIFF_BIGTIFF))
4176
        IFDendoffset = tif->tif_diroff + 2 + dircount * 12 + 4;
4177
    else
4178
        IFDendoffset = tif->tif_diroff + 8 + dircount * 20 + 8;
4179

4180
    /* Check which offsets are right behind IFD entries. However, LibTIFF
4181
     * increments the writing address for every external data to an even offset.
4182
     * Thus gaps of 1 byte can occur. */
4183
    uint64_t size = 0;
4184
    uint64_t offset;
4185
    uint32_t i;
4186
    for (i = 0; i < tif->tif_dir.td_dirdatasize_Noffsets; i++)
4187
    {
4188
        offset = tif->tif_dir.td_dirdatasize_offsets[i].offset;
4189
        if (offset == IFDendoffset)
4190
        {
4191
            size += tif->tif_dir.td_dirdatasize_offsets[i].length;
4192
            IFDendoffset += tif->tif_dir.td_dirdatasize_offsets[i].length;
4193
        }
4194
        else if (offset == IFDendoffset + 1)
4195
        {
4196
            /* Add gap byte after previous IFD data set. */
4197
            size += tif->tif_dir.td_dirdatasize_offsets[i].length + 1;
4198
            IFDendoffset += tif->tif_dir.td_dirdatasize_offsets[i].length;
4199
        }
4200
        else
4201
        {
4202
            /* Further data is no more continuously after IFD */
4203
            break;
4204
        }
4205
    }
4206
    /* Check for gap byte of some easy cases. This should cover 90% of cases.
4207
     * Otherwise, IFD will be re-written even it might be safely overwritten. */
4208
    if (tif->tif_nextdiroff != 0)
4209
    {
4210
        if (tif->tif_nextdiroff == IFDendoffset + 1)
4211
            size++;
4212
    }
4213
    else
4214
    {
4215
        /* Check for IFD data ends at EOF. Then IFD can always be safely
4216
         * overwritten. */
4217
        offset = TIFFSeekFile(tif, 0, SEEK_END);
4218
        if (offset == IFDendoffset)
4219
        {
4220
            tif->tif_dir.td_dirdatasize_read = UINT64_MAX;
4221
            return;
4222
        }
4223
    }
4224

4225
    /* Finally, add the size of the IFD tag entries themselves. */
4226
    if (!(tif->tif_flags & TIFF_BIGTIFF))
4227
        tif->tif_dir.td_dirdatasize_read = 2 + dircount * 12 + 4 + size;
4228
    else
4229
        tif->tif_dir.td_dirdatasize_read = 8 + dircount * 20 + 8 + size;
4230
} /*-- CalcFinalIFDdatasizeReading() --*/
4231

4232
/*
4233
 * Read the next TIFF directory from a file and convert it to the internal
4234
 * format. We read directories sequentially.
4235
 */
4236
int TIFFReadDirectory(TIFF *tif)
4237
{
4238
    static const char module[] = "TIFFReadDirectory";
4239
    TIFFDirEntry *dir;
4240
    uint16_t dircount;
4241
    TIFFDirEntry *dp;
4242
    uint16_t di;
4243
    const TIFFField *fip;
4244
    uint32_t fii = FAILED_FII;
4245
    toff_t nextdiroff;
4246
    int bitspersample_read = FALSE;
4247
    int color_channels;
4248

4249
    if (tif->tif_nextdiroff == 0)
4250
    {
4251
        /* In this special case, tif_diroff needs also to be set to 0.
4252
         * This is behind the last IFD, thus no checking or reading necessary.
4253
         */
4254
        tif->tif_diroff = tif->tif_nextdiroff;
4255
        return 0;
4256
    }
4257

4258
    nextdiroff = tif->tif_nextdiroff;
4259
    /* tif_curdir++ and tif_nextdiroff should only be updated after SUCCESSFUL
4260
     * reading of the directory. Otherwise, invalid IFD offsets could corrupt
4261
     * the IFD list. */
4262
    if (!_TIFFCheckDirNumberAndOffset(tif,
4263
                                      tif->tif_curdir ==
4264
                                              TIFF_NON_EXISTENT_DIR_NUMBER
4265
                                          ? 0
4266
                                          : tif->tif_curdir + 1,
4267
                                      nextdiroff))
4268
    {
4269
        return 0; /* bad offset (IFD looping or more than TIFF_MAX_DIR_COUNT
4270
                     IFDs) */
4271
    }
4272
    dircount = TIFFFetchDirectory(tif, nextdiroff, &dir, &tif->tif_nextdiroff);
4273
    if (!dircount)
4274
    {
4275
        TIFFErrorExtR(tif, module,
4276
                      "Failed to read directory at offset %" PRIu64,
4277
                      nextdiroff);
4278
        return 0;
4279
    }
4280
    /* Set global values after a valid directory has been fetched.
4281
     * tif_diroff is already set to nextdiroff in TIFFFetchDirectory() in the
4282
     * beginning. */
4283
    if (tif->tif_curdir == TIFF_NON_EXISTENT_DIR_NUMBER)
4284
        tif->tif_curdir = 0;
4285
    else
4286
        tif->tif_curdir++;
4287

4288
    TIFFReadDirectoryCheckOrder(tif, dir, dircount);
4289

4290
    /*
4291
     * Mark duplicates of any tag to be ignored (bugzilla 1994)
4292
     * to avoid certain pathological problems.
4293
     */
4294
    {
4295
        TIFFDirEntry *ma;
4296
        uint16_t mb;
4297
        for (ma = dir, mb = 0; mb < dircount; ma++, mb++)
4298
        {
4299
            TIFFDirEntry *na;
4300
            uint16_t nb;
4301
            for (na = ma + 1, nb = mb + 1; nb < dircount; na++, nb++)
4302
            {
4303
                if (ma->tdir_tag == na->tdir_tag)
4304
                {
4305
                    na->tdir_ignore = TRUE;
4306
                }
4307
            }
4308
        }
4309
    }
4310

4311
    tif->tif_flags &= ~TIFF_BEENWRITING; /* reset before new dir */
4312
    tif->tif_flags &= ~TIFF_BUF4WRITE;   /* reset before new dir */
4313
    tif->tif_flags &= ~TIFF_CHOPPEDUPARRAYS;
4314

4315
    /* free any old stuff and reinit */
4316
    TIFFFreeDirectory(tif);
4317
    TIFFDefaultDirectory(tif);
4318

4319
    /* After setup a fresh directory indicate that now active IFD is also
4320
     * present on file, even if its entries could not be read successfully
4321
     * below.  */
4322
    tif->tif_dir.td_iswrittentofile = TRUE;
4323

4324
    /* Allocate arrays for offset values outside IFD entry for IFD data size
4325
     * checking. Note: Counter are reset within TIFFFreeDirectory(). */
4326
    tif->tif_dir.td_dirdatasize_offsets =
4327
        (TIFFEntryOffsetAndLength *)_TIFFmallocExt(
4328
            tif, dircount * sizeof(TIFFEntryOffsetAndLength));
4329
    if (tif->tif_dir.td_dirdatasize_offsets == NULL)
4330
    {
4331
        TIFFErrorExtR(
4332
            tif, module,
4333
            "Failed to allocate memory for counting IFD data size at reading");
4334
        goto bad;
4335
    }
4336
    /*
4337
     * Electronic Arts writes gray-scale TIFF files
4338
     * without a PlanarConfiguration directory entry.
4339
     * Thus we setup a default value here, even though
4340
     * the TIFF spec says there is no default value.
4341
     * After PlanarConfiguration is preset in TIFFDefaultDirectory()
4342
     * the following setting is not needed, but does not harm either.
4343
     */
4344
    TIFFSetField(tif, TIFFTAG_PLANARCONFIG, PLANARCONFIG_CONTIG);
4345
    /*
4346
     * Setup default value and then make a pass over
4347
     * the fields to check type and tag information,
4348
     * and to extract info required to size data
4349
     * structures.  A second pass is made afterwards
4350
     * to read in everything not taken in the first pass.
4351
     * But we must process the Compression tag first
4352
     * in order to merge in codec-private tag definitions (otherwise
4353
     * we may get complaints about unknown tags).  However, the
4354
     * Compression tag may be dependent on the SamplesPerPixel
4355
     * tag value because older TIFF specs permitted Compression
4356
     * to be written as a SamplesPerPixel-count tag entry.
4357
     * Thus if we don't first figure out the correct SamplesPerPixel
4358
     * tag value then we may end up ignoring the Compression tag
4359
     * value because it has an incorrect count value (if the
4360
     * true value of SamplesPerPixel is not 1).
4361
     */
4362
    dp =
4363
        TIFFReadDirectoryFindEntry(tif, dir, dircount, TIFFTAG_SAMPLESPERPIXEL);
4364
    if (dp)
4365
    {
4366
        if (!TIFFFetchNormalTag(tif, dp, 0))
4367
            goto bad;
4368
        dp->tdir_ignore = TRUE;
4369
    }
4370
    dp = TIFFReadDirectoryFindEntry(tif, dir, dircount, TIFFTAG_COMPRESSION);
4371
    if (dp)
4372
    {
4373
        /*
4374
         * The 5.0 spec says the Compression tag has one value, while
4375
         * earlier specs say it has one value per sample.  Because of
4376
         * this, we accept the tag if one value is supplied with either
4377
         * count.
4378
         */
4379
        uint16_t value;
4380
        enum TIFFReadDirEntryErr err;
4381
        err = TIFFReadDirEntryShort(tif, dp, &value);
4382
        if (err == TIFFReadDirEntryErrCount)
4383
            err = TIFFReadDirEntryPersampleShort(tif, dp, &value);
4384
        if (err != TIFFReadDirEntryErrOk)
4385
        {
4386
            TIFFReadDirEntryOutputErr(tif, err, module, "Compression", 0);
4387
            goto bad;
4388
        }
4389
        if (!TIFFSetField(tif, TIFFTAG_COMPRESSION, value))
4390
            goto bad;
4391
        dp->tdir_ignore = TRUE;
4392
    }
4393
    else
4394
    {
4395
        if (!TIFFSetField(tif, TIFFTAG_COMPRESSION, COMPRESSION_NONE))
4396
            goto bad;
4397
    }
4398
    /*
4399
     * First real pass over the directory.
4400
     */
4401
    for (di = 0, dp = dir; di < dircount; di++, dp++)
4402
    {
4403
        if (!dp->tdir_ignore)
4404
        {
4405
            TIFFReadDirectoryFindFieldInfo(tif, dp->tdir_tag, &fii);
4406
            if (fii == FAILED_FII)
4407
            {
4408
                if (tif->tif_warn_about_unknown_tags)
4409
                {
4410
                    TIFFWarningExtR(tif, module,
4411
                                    "Unknown field with tag %" PRIu16
4412
                                    " (0x%" PRIx16 ") encountered",
4413
                                    dp->tdir_tag, dp->tdir_tag);
4414
                }
4415
                /* the following knowingly leaks the
4416
                   anonymous field structure */
4417
                const TIFFField *fld = _TIFFCreateAnonField(
4418
                    tif, dp->tdir_tag, (TIFFDataType)dp->tdir_type);
4419
                if (fld == NULL || !_TIFFMergeFields(tif, fld, 1))
4420
                {
4421
                    TIFFWarningExtR(
4422
                        tif, module,
4423
                        "Registering anonymous field with tag %" PRIu16
4424
                        " (0x%" PRIx16 ") failed",
4425
                        dp->tdir_tag, dp->tdir_tag);
4426
                    dp->tdir_ignore = TRUE;
4427
                }
4428
                else
4429
                {
4430
                    TIFFReadDirectoryFindFieldInfo(tif, dp->tdir_tag, &fii);
4431
                    assert(fii != FAILED_FII);
4432
                }
4433
            }
4434
        }
4435
        if (!dp->tdir_ignore)
4436
        {
4437
            fip = tif->tif_fields[fii];
4438
            if (fip->field_bit == FIELD_IGNORE)
4439
                dp->tdir_ignore = TRUE;
4440
            else
4441
            {
4442
                switch (dp->tdir_tag)
4443
                {
4444
                    case TIFFTAG_STRIPOFFSETS:
4445
                    case TIFFTAG_STRIPBYTECOUNTS:
4446
                    case TIFFTAG_TILEOFFSETS:
4447
                    case TIFFTAG_TILEBYTECOUNTS:
4448
                        TIFFSetFieldBit(tif, fip->field_bit);
4449
                        break;
4450
                    case TIFFTAG_IMAGEWIDTH:
4451
                    case TIFFTAG_IMAGELENGTH:
4452
                    case TIFFTAG_IMAGEDEPTH:
4453
                    case TIFFTAG_TILELENGTH:
4454
                    case TIFFTAG_TILEWIDTH:
4455
                    case TIFFTAG_TILEDEPTH:
4456
                    case TIFFTAG_PLANARCONFIG:
4457
                    case TIFFTAG_ROWSPERSTRIP:
4458
                    case TIFFTAG_EXTRASAMPLES:
4459
                        if (!TIFFFetchNormalTag(tif, dp, 0))
4460
                            goto bad;
4461
                        dp->tdir_ignore = TRUE;
4462
                        break;
4463
                    default:
4464
                        if (!_TIFFCheckFieldIsValidForCodec(tif, dp->tdir_tag))
4465
                            dp->tdir_ignore = TRUE;
4466
                        break;
4467
                }
4468
            }
4469
        }
4470
    }
4471
    /*
4472
     * XXX: OJPEG hack.
4473
     * If a) compression is OJPEG, b) planarconfig tag says it's separate,
4474
     * c) strip offsets/bytecounts tag are both present and
4475
     * d) both contain exactly one value, then we consistently find
4476
     * that the buggy implementation of the buggy compression scheme
4477
     * matches contig planarconfig best. So we 'fix-up' the tag here
4478
     */
4479
    if ((tif->tif_dir.td_compression == COMPRESSION_OJPEG) &&
4480
        (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE))
4481
    {
4482
        if (!_TIFFFillStriles(tif))
4483
            goto bad;
4484
        dp = TIFFReadDirectoryFindEntry(tif, dir, dircount,
4485
                                        TIFFTAG_STRIPOFFSETS);
4486
        if ((dp != 0) && (dp->tdir_count == 1))
4487
        {
4488
            dp = TIFFReadDirectoryFindEntry(tif, dir, dircount,
4489
                                            TIFFTAG_STRIPBYTECOUNTS);
4490
            if ((dp != 0) && (dp->tdir_count == 1))
4491
            {
4492
                tif->tif_dir.td_planarconfig = PLANARCONFIG_CONTIG;
4493
                TIFFWarningExtR(tif, module,
4494
                                "Planarconfig tag value assumed incorrect, "
4495
                                "assuming data is contig instead of chunky");
4496
            }
4497
        }
4498
    }
4499
    /*
4500
     * Allocate directory structure and setup defaults.
4501
     */
4502
    if (!TIFFFieldSet(tif, FIELD_IMAGEDIMENSIONS))
4503
    {
4504
        MissingRequired(tif, "ImageLength");
4505
        goto bad;
4506
    }
4507

4508
    /*
4509
     * Second pass: extract other information.
4510
     */
4511
    for (di = 0, dp = dir; di < dircount; di++, dp++)
4512
    {
4513
        if (!dp->tdir_ignore)
4514
        {
4515
            switch (dp->tdir_tag)
4516
            {
4517
                case TIFFTAG_MINSAMPLEVALUE:
4518
                case TIFFTAG_MAXSAMPLEVALUE:
4519
                case TIFFTAG_BITSPERSAMPLE:
4520
                case TIFFTAG_DATATYPE:
4521
                case TIFFTAG_SAMPLEFORMAT:
4522
                    /*
4523
                     * The MinSampleValue, MaxSampleValue, BitsPerSample
4524
                     * DataType and SampleFormat tags are supposed to be
4525
                     * written as one value/sample, but some vendors
4526
                     * incorrectly write one value only -- so we accept
4527
                     * that as well (yuck). Other vendors write correct
4528
                     * value for NumberOfSamples, but incorrect one for
4529
                     * BitsPerSample and friends, and we will read this
4530
                     * too.
4531
                     */
4532
                    {
4533
                        uint16_t value;
4534
                        enum TIFFReadDirEntryErr err;
4535
                        err = TIFFReadDirEntryShort(tif, dp, &value);
4536
                        if (!EvaluateIFDdatasizeReading(tif, dp))
4537
                            goto bad;
4538
                        if (err == TIFFReadDirEntryErrCount)
4539
                            err =
4540
                                TIFFReadDirEntryPersampleShort(tif, dp, &value);
4541
                        if (err != TIFFReadDirEntryErrOk)
4542
                        {
4543
                            fip = TIFFFieldWithTag(tif, dp->tdir_tag);
4544
                            TIFFReadDirEntryOutputErr(
4545
                                tif, err, module,
4546
                                fip ? fip->field_name : "unknown tagname", 0);
4547
                            goto bad;
4548
                        }
4549
                        if (!TIFFSetField(tif, dp->tdir_tag, value))
4550
                            goto bad;
4551
                        if (dp->tdir_tag == TIFFTAG_BITSPERSAMPLE)
4552
                            bitspersample_read = TRUE;
4553
                    }
4554
                    break;
4555
                case TIFFTAG_SMINSAMPLEVALUE:
4556
                case TIFFTAG_SMAXSAMPLEVALUE:
4557
                {
4558

4559
                    double *data = NULL;
4560
                    enum TIFFReadDirEntryErr err;
4561
                    uint32_t saved_flags;
4562
                    int m;
4563
                    if (dp->tdir_count !=
4564
                        (uint64_t)tif->tif_dir.td_samplesperpixel)
4565
                        err = TIFFReadDirEntryErrCount;
4566
                    else
4567
                        err = TIFFReadDirEntryDoubleArray(tif, dp, &data);
4568
                    if (!EvaluateIFDdatasizeReading(tif, dp))
4569
                        goto bad;
4570
                    if (err != TIFFReadDirEntryErrOk)
4571
                    {
4572
                        fip = TIFFFieldWithTag(tif, dp->tdir_tag);
4573
                        TIFFReadDirEntryOutputErr(
4574
                            tif, err, module,
4575
                            fip ? fip->field_name : "unknown tagname", 0);
4576
                        goto bad;
4577
                    }
4578
                    saved_flags = tif->tif_flags;
4579
                    tif->tif_flags |= TIFF_PERSAMPLE;
4580
                    m = TIFFSetField(tif, dp->tdir_tag, data);
4581
                    tif->tif_flags = saved_flags;
4582
                    _TIFFfreeExt(tif, data);
4583
                    if (!m)
4584
                        goto bad;
4585
                }
4586
                break;
4587
                case TIFFTAG_STRIPOFFSETS:
4588
                case TIFFTAG_TILEOFFSETS:
4589
                {
4590
                    switch (dp->tdir_type)
4591
                    {
4592
                        case TIFF_SHORT:
4593
                        case TIFF_LONG:
4594
                        case TIFF_LONG8:
4595
                            break;
4596
                        default:
4597
                            /* Warn except if directory typically created with
4598
                             * TIFFDeferStrileArrayWriting() */
4599
                            if (!(tif->tif_mode == O_RDWR &&
4600
                                  dp->tdir_count == 0 && dp->tdir_type == 0 &&
4601
                                  dp->tdir_offset.toff_long8 == 0))
4602
                            {
4603
                                fip = TIFFFieldWithTag(tif, dp->tdir_tag);
4604
                                TIFFWarningExtR(
4605
                                    tif, module, "Invalid data type for tag %s",
4606
                                    fip ? fip->field_name : "unknown tagname");
4607
                            }
4608
                            break;
4609
                    }
4610
                    _TIFFmemcpy(&(tif->tif_dir.td_stripoffset_entry), dp,
4611
                                sizeof(TIFFDirEntry));
4612
                    if (!EvaluateIFDdatasizeReading(tif, dp))
4613
                        goto bad;
4614
                }
4615
                break;
4616
                case TIFFTAG_STRIPBYTECOUNTS:
4617
                case TIFFTAG_TILEBYTECOUNTS:
4618
                {
4619
                    switch (dp->tdir_type)
4620
                    {
4621
                        case TIFF_SHORT:
4622
                        case TIFF_LONG:
4623
                        case TIFF_LONG8:
4624
                            break;
4625
                        default:
4626
                            /* Warn except if directory typically created with
4627
                             * TIFFDeferStrileArrayWriting() */
4628
                            if (!(tif->tif_mode == O_RDWR &&
4629
                                  dp->tdir_count == 0 && dp->tdir_type == 0 &&
4630
                                  dp->tdir_offset.toff_long8 == 0))
4631
                            {
4632
                                fip = TIFFFieldWithTag(tif, dp->tdir_tag);
4633
                                TIFFWarningExtR(
4634
                                    tif, module, "Invalid data type for tag %s",
4635
                                    fip ? fip->field_name : "unknown tagname");
4636
                            }
4637
                            break;
4638
                    }
4639
                    _TIFFmemcpy(&(tif->tif_dir.td_stripbytecount_entry), dp,
4640
                                sizeof(TIFFDirEntry));
4641
                    if (!EvaluateIFDdatasizeReading(tif, dp))
4642
                        goto bad;
4643
                }
4644
                break;
4645
                case TIFFTAG_COLORMAP:
4646
                case TIFFTAG_TRANSFERFUNCTION:
4647
                {
4648
                    enum TIFFReadDirEntryErr err;
4649
                    uint32_t countpersample;
4650
                    uint32_t countrequired;
4651
                    uint32_t incrementpersample;
4652
                    uint16_t *value = NULL;
4653
                    /* It would be dangerous to instantiate those tag values */
4654
                    /* since if td_bitspersample has not yet been read (due to
4655
                     */
4656
                    /* unordered tags), it could be read afterwards with a */
4657
                    /* values greater than the default one (1), which may cause
4658
                     */
4659
                    /* crashes in user code */
4660
                    if (!bitspersample_read)
4661
                    {
4662
                        fip = TIFFFieldWithTag(tif, dp->tdir_tag);
4663
                        TIFFWarningExtR(
4664
                            tif, module,
4665
                            "Ignoring %s since BitsPerSample tag not found",
4666
                            fip ? fip->field_name : "unknown tagname");
4667
                        continue;
4668
                    }
4669
                    /* ColorMap or TransferFunction for high bit */
4670
                    /* depths do not make much sense and could be */
4671
                    /* used as a denial of service vector */
4672
                    if (tif->tif_dir.td_bitspersample > 24)
4673
                    {
4674
                        fip = TIFFFieldWithTag(tif, dp->tdir_tag);
4675
                        TIFFWarningExtR(
4676
                            tif, module,
4677
                            "Ignoring %s because BitsPerSample=%" PRIu16 ">24",
4678
                            fip ? fip->field_name : "unknown tagname",
4679
                            tif->tif_dir.td_bitspersample);
4680
                        continue;
4681
                    }
4682
                    countpersample = (1U << tif->tif_dir.td_bitspersample);
4683
                    if ((dp->tdir_tag == TIFFTAG_TRANSFERFUNCTION) &&
4684
                        (dp->tdir_count == (uint64_t)countpersample))
4685
                    {
4686
                        countrequired = countpersample;
4687
                        incrementpersample = 0;
4688
                    }
4689
                    else
4690
                    {
4691
                        countrequired = 3 * countpersample;
4692
                        incrementpersample = countpersample;
4693
                    }
4694
                    if (dp->tdir_count != (uint64_t)countrequired)
4695
                        err = TIFFReadDirEntryErrCount;
4696
                    else
4697
                        err = TIFFReadDirEntryShortArray(tif, dp, &value);
4698
                    if (!EvaluateIFDdatasizeReading(tif, dp))
4699
                        goto bad;
4700
                    if (err != TIFFReadDirEntryErrOk)
4701
                    {
4702
                        fip = TIFFFieldWithTag(tif, dp->tdir_tag);
4703
                        TIFFReadDirEntryOutputErr(
4704
                            tif, err, module,
4705
                            fip ? fip->field_name : "unknown tagname", 1);
4706
                    }
4707
                    else
4708
                    {
4709
                        TIFFSetField(tif, dp->tdir_tag, value,
4710
                                     value + incrementpersample,
4711
                                     value + 2 * incrementpersample);
4712
                        _TIFFfreeExt(tif, value);
4713
                    }
4714
                }
4715
                break;
4716
                    /* BEGIN REV 4.0 COMPATIBILITY */
4717
                case TIFFTAG_OSUBFILETYPE:
4718
                {
4719
                    uint16_t valueo;
4720
                    uint32_t value;
4721
                    if (TIFFReadDirEntryShort(tif, dp, &valueo) ==
4722
                        TIFFReadDirEntryErrOk)
4723
                    {
4724
                        switch (valueo)
4725
                        {
4726
                            case OFILETYPE_REDUCEDIMAGE:
4727
                                value = FILETYPE_REDUCEDIMAGE;
4728
                                break;
4729
                            case OFILETYPE_PAGE:
4730
                                value = FILETYPE_PAGE;
4731
                                break;
4732
                            default:
4733
                                value = 0;
4734
                                break;
4735
                        }
4736
                        if (value != 0)
4737
                            TIFFSetField(tif, TIFFTAG_SUBFILETYPE, value);
4738
                    }
4739
                }
4740
                break;
4741
                /* END REV 4.0 COMPATIBILITY */
4742
#if 0
4743
                case TIFFTAG_EP_BATTERYLEVEL:
4744
                    /* TIFFTAG_EP_BATTERYLEVEL can be RATIONAL or ASCII.
4745
                     * LibTiff defines it as ASCII and converts RATIONAL to an
4746
                     * ASCII string. */
4747
                    switch (dp->tdir_type)
4748
                    {
4749
                        case TIFF_RATIONAL:
4750
                        {
4751
                            /* Read rational and convert to ASCII*/
4752
                            enum TIFFReadDirEntryErr err;
4753
                            TIFFRational_t rValue;
4754
                            err = TIFFReadDirEntryCheckedRationalDirect(
4755
                                tif, dp, &rValue);
4756
                            if (err != TIFFReadDirEntryErrOk)
4757
                            {
4758
                                fip = TIFFFieldWithTag(tif, dp->tdir_tag);
4759
                                TIFFReadDirEntryOutputErr(
4760
                                    tif, err, module,
4761
                                    fip ? fip->field_name : "unknown tagname",
4762
                                    1);
4763
                            }
4764
                            else
4765
                            {
4766
                                char szAux[32];
4767
                                snprintf(szAux, sizeof(szAux) - 1, "%d/%d",
4768
                                         rValue.uNum, rValue.uDenom);
4769
                                TIFFSetField(tif, dp->tdir_tag, szAux);
4770
                            }
4771
                        }
4772
                        break;
4773
                        case TIFF_ASCII:
4774
                            (void)TIFFFetchNormalTag(tif, dp, TRUE);
4775
                            break;
4776
                        default:
4777
                            fip = TIFFFieldWithTag(tif, dp->tdir_tag);
4778
                            TIFFWarningExtR(tif, module,
4779
                                            "Invalid data type for tag %s. "
4780
                                            "ASCII or RATIONAL expected",
4781
                                            fip ? fip->field_name
4782
                                                : "unknown tagname");
4783
                            break;
4784
                    }
4785
                    break;
4786
#endif
4787
                default:
4788
                    (void)TIFFFetchNormalTag(tif, dp, TRUE);
4789
                    break;
4790
            } /* -- switch (dp->tdir_tag) -- */
4791
        }     /* -- if (!dp->tdir_ignore) */
4792
    }         /* -- for-loop -- */
4793

4794
    /* Evaluate final IFD data size. */
4795
    CalcFinalIFDdatasizeReading(tif, dircount);
4796

4797
    /*
4798
     * OJPEG hack:
4799
     * - If a) compression is OJPEG, and b) photometric tag is missing,
4800
     * then we consistently find that photometric should be YCbCr
4801
     * - If a) compression is OJPEG, and b) photometric tag says it's RGB,
4802
     * then we consistently find that the buggy implementation of the
4803
     * buggy compression scheme matches photometric YCbCr instead.
4804
     * - If a) compression is OJPEG, and b) bitspersample tag is missing,
4805
     * then we consistently find bitspersample should be 8.
4806
     * - If a) compression is OJPEG, b) samplesperpixel tag is missing,
4807
     * and c) photometric is RGB or YCbCr, then we consistently find
4808
     * samplesperpixel should be 3
4809
     * - If a) compression is OJPEG, b) samplesperpixel tag is missing,
4810
     * and c) photometric is MINISWHITE or MINISBLACK, then we consistently
4811
     * find samplesperpixel should be 3
4812
     */
4813
    if (tif->tif_dir.td_compression == COMPRESSION_OJPEG)
4814
    {
4815
        if (!TIFFFieldSet(tif, FIELD_PHOTOMETRIC))
4816
        {
4817
            TIFFWarningExtR(
4818
                tif, module,
4819
                "Photometric tag is missing, assuming data is YCbCr");
4820
            if (!TIFFSetField(tif, TIFFTAG_PHOTOMETRIC, PHOTOMETRIC_YCBCR))
4821
                goto bad;
4822
        }
4823
        else if (tif->tif_dir.td_photometric == PHOTOMETRIC_RGB)
4824
        {
4825
            tif->tif_dir.td_photometric = PHOTOMETRIC_YCBCR;
4826
            TIFFWarningExtR(tif, module,
4827
                            "Photometric tag value assumed incorrect, "
4828
                            "assuming data is YCbCr instead of RGB");
4829
        }
4830
        if (!TIFFFieldSet(tif, FIELD_BITSPERSAMPLE))
4831
        {
4832
            TIFFWarningExtR(
4833
                tif, module,
4834
                "BitsPerSample tag is missing, assuming 8 bits per sample");
4835
            if (!TIFFSetField(tif, TIFFTAG_BITSPERSAMPLE, 8))
4836
                goto bad;
4837
        }
4838
        if (!TIFFFieldSet(tif, FIELD_SAMPLESPERPIXEL))
4839
        {
4840
            if (tif->tif_dir.td_photometric == PHOTOMETRIC_RGB)
4841
            {
4842
                TIFFWarningExtR(tif, module,
4843
                                "SamplesPerPixel tag is missing, "
4844
                                "assuming correct SamplesPerPixel value is 3");
4845
                if (!TIFFSetField(tif, TIFFTAG_SAMPLESPERPIXEL, 3))
4846
                    goto bad;
4847
            }
4848
            if (tif->tif_dir.td_photometric == PHOTOMETRIC_YCBCR)
4849
            {
4850
                TIFFWarningExtR(tif, module,
4851
                                "SamplesPerPixel tag is missing, "
4852
                                "applying correct SamplesPerPixel value of 3");
4853
                if (!TIFFSetField(tif, TIFFTAG_SAMPLESPERPIXEL, 3))
4854
                    goto bad;
4855
            }
4856
            else if ((tif->tif_dir.td_photometric == PHOTOMETRIC_MINISWHITE) ||
4857
                     (tif->tif_dir.td_photometric == PHOTOMETRIC_MINISBLACK))
4858
            {
4859
                /*
4860
                 * SamplesPerPixel tag is missing, but is not required
4861
                 * by spec.  Assume correct SamplesPerPixel value of 1.
4862
                 */
4863
                if (!TIFFSetField(tif, TIFFTAG_SAMPLESPERPIXEL, 1))
4864
                    goto bad;
4865
            }
4866
        }
4867
    }
4868

4869
    /*
4870
     * Setup appropriate structures (by strip or by tile)
4871
     * We do that only after the above OJPEG hack which alters SamplesPerPixel
4872
     * and thus influences the number of strips in the separate planarconfig.
4873
     */
4874
    if (!TIFFFieldSet(tif, FIELD_TILEDIMENSIONS))
4875
    {
4876
        tif->tif_dir.td_nstrips = TIFFNumberOfStrips(tif);
4877
        tif->tif_dir.td_tilewidth = tif->tif_dir.td_imagewidth;
4878
        tif->tif_dir.td_tilelength = tif->tif_dir.td_rowsperstrip;
4879
        tif->tif_dir.td_tiledepth = tif->tif_dir.td_imagedepth;
4880
        tif->tif_flags &= ~TIFF_ISTILED;
4881
    }
4882
    else
4883
    {
4884
        tif->tif_dir.td_nstrips = TIFFNumberOfTiles(tif);
4885
        tif->tif_flags |= TIFF_ISTILED;
4886
    }
4887
    if (!tif->tif_dir.td_nstrips)
4888
    {
4889
        TIFFErrorExtR(tif, module, "Cannot handle zero number of %s",
4890
                      isTiled(tif) ? "tiles" : "strips");
4891
        goto bad;
4892
    }
4893
    tif->tif_dir.td_stripsperimage = tif->tif_dir.td_nstrips;
4894
    if (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE)
4895
        tif->tif_dir.td_stripsperimage /= tif->tif_dir.td_samplesperpixel;
4896
    if (!TIFFFieldSet(tif, FIELD_STRIPOFFSETS))
4897
    {
4898
#ifdef OJPEG_SUPPORT
4899
        if ((tif->tif_dir.td_compression == COMPRESSION_OJPEG) &&
4900
            (isTiled(tif) == 0) && (tif->tif_dir.td_nstrips == 1))
4901
        {
4902
            /*
4903
             * XXX: OJPEG hack.
4904
             * If a) compression is OJPEG, b) it's not a tiled TIFF,
4905
             * and c) the number of strips is 1,
4906
             * then we tolerate the absence of stripoffsets tag,
4907
             * because, presumably, all required data is in the
4908
             * JpegInterchangeFormat stream.
4909
             */
4910
            TIFFSetFieldBit(tif, FIELD_STRIPOFFSETS);
4911
        }
4912
        else
4913
#endif
4914
        {
4915
            MissingRequired(tif, isTiled(tif) ? "TileOffsets" : "StripOffsets");
4916
            goto bad;
4917
        }
4918
    }
4919

4920
    if (tif->tif_mode == O_RDWR &&
4921
        tif->tif_dir.td_stripoffset_entry.tdir_tag != 0 &&
4922
        tif->tif_dir.td_stripoffset_entry.tdir_count == 0 &&
4923
        tif->tif_dir.td_stripoffset_entry.tdir_type == 0 &&
4924
        tif->tif_dir.td_stripoffset_entry.tdir_offset.toff_long8 == 0 &&
4925
        tif->tif_dir.td_stripbytecount_entry.tdir_tag != 0 &&
4926
        tif->tif_dir.td_stripbytecount_entry.tdir_count == 0 &&
4927
        tif->tif_dir.td_stripbytecount_entry.tdir_type == 0 &&
4928
        tif->tif_dir.td_stripbytecount_entry.tdir_offset.toff_long8 == 0)
4929
    {
4930
        /* Directory typically created with TIFFDeferStrileArrayWriting() */
4931
        TIFFSetupStrips(tif);
4932
    }
4933
    else if (!(tif->tif_flags & TIFF_DEFERSTRILELOAD))
4934
    {
4935
        if (tif->tif_dir.td_stripoffset_entry.tdir_tag != 0)
4936
        {
4937
            if (!TIFFFetchStripThing(tif, &(tif->tif_dir.td_stripoffset_entry),
4938
                                     tif->tif_dir.td_nstrips,
4939
                                     &tif->tif_dir.td_stripoffset_p))
4940
            {
4941
                goto bad;
4942
            }
4943
        }
4944
        if (tif->tif_dir.td_stripbytecount_entry.tdir_tag != 0)
4945
        {
4946
            if (!TIFFFetchStripThing(
4947
                    tif, &(tif->tif_dir.td_stripbytecount_entry),
4948
                    tif->tif_dir.td_nstrips, &tif->tif_dir.td_stripbytecount_p))
4949
            {
4950
                goto bad;
4951
            }
4952
        }
4953
    }
4954

4955
    /*
4956
     * Make sure all non-color channels are extrasamples.
4957
     * If it's not the case, define them as such.
4958
     */
4959
    color_channels = _TIFFGetMaxColorChannels(tif->tif_dir.td_photometric);
4960
    if (color_channels &&
4961
        tif->tif_dir.td_samplesperpixel - tif->tif_dir.td_extrasamples >
4962
            color_channels)
4963
    {
4964
        uint16_t old_extrasamples;
4965
        uint16_t *new_sampleinfo;
4966

4967
        TIFFWarningExtR(
4968
            tif, module,
4969
            "Sum of Photometric type-related "
4970
            "color channels and ExtraSamples doesn't match SamplesPerPixel. "
4971
            "Defining non-color channels as ExtraSamples.");
4972

4973
        old_extrasamples = tif->tif_dir.td_extrasamples;
4974
        tif->tif_dir.td_extrasamples =
4975
            (uint16_t)(tif->tif_dir.td_samplesperpixel - color_channels);
4976

4977
        // sampleinfo should contain information relative to these new extra
4978
        // samples
4979
        new_sampleinfo = (uint16_t *)_TIFFcallocExt(
4980
            tif, tif->tif_dir.td_extrasamples, sizeof(uint16_t));
4981
        if (!new_sampleinfo)
4982
        {
4983
            TIFFErrorExtR(tif, module,
4984
                          "Failed to allocate memory for "
4985
                          "temporary new sampleinfo array "
4986
                          "(%" PRIu16 " 16 bit elements)",
4987
                          tif->tif_dir.td_extrasamples);
4988
            goto bad;
4989
        }
4990

4991
        if (old_extrasamples > 0)
4992
            memcpy(new_sampleinfo, tif->tif_dir.td_sampleinfo,
4993
                   old_extrasamples * sizeof(uint16_t));
4994
        _TIFFsetShortArrayExt(tif, &tif->tif_dir.td_sampleinfo, new_sampleinfo,
4995
                              tif->tif_dir.td_extrasamples);
4996
        _TIFFfreeExt(tif, new_sampleinfo);
4997
    }
4998

4999
    /*
5000
     * Verify Palette image has a Colormap.
5001
     */
5002
    if (tif->tif_dir.td_photometric == PHOTOMETRIC_PALETTE &&
5003
        !TIFFFieldSet(tif, FIELD_COLORMAP))
5004
    {
5005
        if (tif->tif_dir.td_bitspersample >= 8 &&
5006
            tif->tif_dir.td_samplesperpixel == 3)
5007
            tif->tif_dir.td_photometric = PHOTOMETRIC_RGB;
5008
        else if (tif->tif_dir.td_bitspersample >= 8)
5009
            tif->tif_dir.td_photometric = PHOTOMETRIC_MINISBLACK;
5010
        else
5011
        {
5012
            MissingRequired(tif, "Colormap");
5013
            goto bad;
5014
        }
5015
    }
5016
    /*
5017
     * OJPEG hack:
5018
     * We do no further messing with strip/tile offsets/bytecounts in OJPEG
5019
     * TIFFs
5020
     */
5021
    if (tif->tif_dir.td_compression != COMPRESSION_OJPEG)
5022
    {
5023
        /*
5024
         * Attempt to deal with a missing StripByteCounts tag.
5025
         */
5026
        if (!TIFFFieldSet(tif, FIELD_STRIPBYTECOUNTS))
5027
        {
5028
            /*
5029
             * Some manufacturers violate the spec by not giving
5030
             * the size of the strips.  In this case, assume there
5031
             * is one uncompressed strip of data.
5032
             */
5033
            if ((tif->tif_dir.td_planarconfig == PLANARCONFIG_CONTIG &&
5034
                 tif->tif_dir.td_nstrips > 1) ||
5035
                (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE &&
5036
                 tif->tif_dir.td_nstrips !=
5037
                     (uint32_t)tif->tif_dir.td_samplesperpixel))
5038
            {
5039
                MissingRequired(tif, "StripByteCounts");
5040
                goto bad;
5041
            }
5042
            TIFFWarningExtR(
5043
                tif, module,
5044
                "TIFF directory is missing required "
5045
                "\"StripByteCounts\" field, calculating from imagelength");
5046
            if (EstimateStripByteCounts(tif, dir, dircount) < 0)
5047
                goto bad;
5048
        }
5049
        else if (tif->tif_dir.td_nstrips == 1 &&
5050
                 !(tif->tif_flags & TIFF_ISTILED) && ByteCountLooksBad(tif))
5051
        {
5052
            /*
5053
             * XXX: Plexus (and others) sometimes give a value of
5054
             * zero for a tag when they don't know what the
5055
             * correct value is!  Try and handle the simple case
5056
             * of estimating the size of a one strip image.
5057
             */
5058
            TIFFWarningExtR(tif, module,
5059
                            "Bogus \"StripByteCounts\" field, ignoring and "
5060
                            "calculating from imagelength");
5061
            if (EstimateStripByteCounts(tif, dir, dircount) < 0)
5062
                goto bad;
5063
        }
5064
        else if (!(tif->tif_flags & TIFF_DEFERSTRILELOAD) &&
5065
                 tif->tif_dir.td_planarconfig == PLANARCONFIG_CONTIG &&
5066
                 tif->tif_dir.td_nstrips > 2 &&
5067
                 tif->tif_dir.td_compression == COMPRESSION_NONE &&
5068
                 TIFFGetStrileByteCount(tif, 0) !=
5069
                     TIFFGetStrileByteCount(tif, 1) &&
5070
                 TIFFGetStrileByteCount(tif, 0) != 0 &&
5071
                 TIFFGetStrileByteCount(tif, 1) != 0)
5072
        {
5073
            /*
5074
             * XXX: Some vendors fill StripByteCount array with
5075
             * absolutely wrong values (it can be equal to
5076
             * StripOffset array, for example). Catch this case
5077
             * here.
5078
             *
5079
             * We avoid this check if deferring strile loading
5080
             * as it would always force us to load the strip/tile
5081
             * information.
5082
             */
5083
            TIFFWarningExtR(tif, module,
5084
                            "Wrong \"StripByteCounts\" field, ignoring and "
5085
                            "calculating from imagelength");
5086
            if (EstimateStripByteCounts(tif, dir, dircount) < 0)
5087
                goto bad;
5088
        }
5089
    }
5090
    if (dir)
5091
    {
5092
        _TIFFfreeExt(tif, dir);
5093
        dir = NULL;
5094
    }
5095
    if (!TIFFFieldSet(tif, FIELD_MAXSAMPLEVALUE))
5096
    {
5097
        if (tif->tif_dir.td_bitspersample >= 16)
5098
            tif->tif_dir.td_maxsamplevalue = 0xFFFF;
5099
        else
5100
            tif->tif_dir.td_maxsamplevalue =
5101
                (uint16_t)((1L << tif->tif_dir.td_bitspersample) - 1);
5102
    }
5103

5104
#ifdef STRIPBYTECOUNTSORTED_UNUSED
5105
    /*
5106
     * XXX: We can optimize checking for the strip bounds using the sorted
5107
     * bytecounts array. See also comments for TIFFAppendToStrip()
5108
     * function in tif_write.c.
5109
     */
5110
    if (!(tif->tif_flags & TIFF_DEFERSTRILELOAD) && tif->tif_dir.td_nstrips > 1)
5111
    {
5112
        uint32_t strip;
5113

5114
        tif->tif_dir.td_stripbytecountsorted = 1;
5115
        for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++)
5116
        {
5117
            if (TIFFGetStrileOffset(tif, strip - 1) >
5118
                TIFFGetStrileOffset(tif, strip))
5119
            {
5120
                tif->tif_dir.td_stripbytecountsorted = 0;
5121
                break;
5122
            }
5123
        }
5124
    }
5125
#endif
5126

5127
    /*
5128
     * An opportunity for compression mode dependent tag fixup
5129
     */
5130
    (*tif->tif_fixuptags)(tif);
5131

5132
    /*
5133
     * Some manufacturers make life difficult by writing
5134
     * large amounts of uncompressed data as a single strip.
5135
     * This is contrary to the recommendations of the spec.
5136
     * The following makes an attempt at breaking such images
5137
     * into strips closer to the recommended 8k bytes.  A
5138
     * side effect, however, is that the RowsPerStrip tag
5139
     * value may be changed.
5140
     */
5141
    if ((tif->tif_dir.td_planarconfig == PLANARCONFIG_CONTIG) &&
5142
        (tif->tif_dir.td_nstrips == 1) &&
5143
        (tif->tif_dir.td_compression == COMPRESSION_NONE) &&
5144
        ((tif->tif_flags & (TIFF_STRIPCHOP | TIFF_ISTILED)) == TIFF_STRIPCHOP))
5145
    {
5146
        ChopUpSingleUncompressedStrip(tif);
5147
    }
5148

5149
    /* There are also uncompressed striped files with strips larger than */
5150
    /* 2 GB, which make them unfriendly with a lot of code. If possible, */
5151
    /* try to expose smaller "virtual" strips. */
5152
    if (tif->tif_dir.td_planarconfig == PLANARCONFIG_CONTIG &&
5153
        tif->tif_dir.td_compression == COMPRESSION_NONE &&
5154
        (tif->tif_flags & (TIFF_STRIPCHOP | TIFF_ISTILED)) == TIFF_STRIPCHOP &&
5155
        TIFFStripSize64(tif) > 0x7FFFFFFFUL)
5156
    {
5157
        TryChopUpUncompressedBigTiff(tif);
5158
    }
5159

5160
    /*
5161
     * Clear the dirty directory flag.
5162
     */
5163
    tif->tif_flags &= ~TIFF_DIRTYDIRECT;
5164
    tif->tif_flags &= ~TIFF_DIRTYSTRIP;
5165

5166
    /*
5167
     * Reinitialize i/o since we are starting on a new directory.
5168
     */
5169
    tif->tif_row = (uint32_t)-1;
5170
    tif->tif_curstrip = (uint32_t)-1;
5171
    tif->tif_col = (uint32_t)-1;
5172
    tif->tif_curtile = (uint32_t)-1;
5173
    tif->tif_tilesize = (tmsize_t)-1;
5174

5175
    tif->tif_scanlinesize = TIFFScanlineSize(tif);
5176
    if (!tif->tif_scanlinesize)
5177
    {
5178
        TIFFErrorExtR(tif, module, "Cannot handle zero scanline size");
5179
        return (0);
5180
    }
5181

5182
    if (isTiled(tif))
5183
    {
5184
        tif->tif_tilesize = TIFFTileSize(tif);
5185
        if (!tif->tif_tilesize)
5186
        {
5187
            TIFFErrorExtR(tif, module, "Cannot handle zero tile size");
5188
            return (0);
5189
        }
5190
    }
5191
    else
5192
    {
5193
        if (!TIFFStripSize(tif))
5194
        {
5195
            TIFFErrorExtR(tif, module, "Cannot handle zero strip size");
5196
            return (0);
5197
        }
5198
    }
5199
    return (1);
5200
bad:
5201
    if (dir)
5202
        _TIFFfreeExt(tif, dir);
5203
    return (0);
5204
} /*-- TIFFReadDirectory() --*/
5205

5206
static void TIFFReadDirectoryCheckOrder(TIFF *tif, TIFFDirEntry *dir,
5207
                                        uint16_t dircount)
5208
{
5209
    static const char module[] = "TIFFReadDirectoryCheckOrder";
5210
    uint32_t m;
5211
    uint16_t n;
5212
    TIFFDirEntry *o;
5213
    m = 0;
5214
    for (n = 0, o = dir; n < dircount; n++, o++)
5215
    {
5216
        if (o->tdir_tag < m)
5217
        {
5218
            TIFFWarningExtR(tif, module,
5219
                            "Invalid TIFF directory; tags are not sorted in "
5220
                            "ascending order");
5221
            break;
5222
        }
5223
        m = o->tdir_tag + 1;
5224
    }
5225
}
5226

5227
static TIFFDirEntry *TIFFReadDirectoryFindEntry(TIFF *tif, TIFFDirEntry *dir,
5228
                                                uint16_t dircount,
5229
                                                uint16_t tagid)
5230
{
5231
    TIFFDirEntry *m;
5232
    uint16_t n;
5233
    (void)tif;
5234
    for (m = dir, n = 0; n < dircount; m++, n++)
5235
    {
5236
        if (m->tdir_tag == tagid)
5237
            return (m);
5238
    }
5239
    return (0);
5240
}
5241

5242
static void TIFFReadDirectoryFindFieldInfo(TIFF *tif, uint16_t tagid,
5243
                                           uint32_t *fii)
5244
{
5245
    int32_t ma, mb, mc;
5246
    ma = -1;
5247
    mc = (int32_t)tif->tif_nfields;
5248
    while (1)
5249
    {
5250
        if (ma + 1 == mc)
5251
        {
5252
            *fii = FAILED_FII;
5253
            return;
5254
        }
5255
        mb = (ma + mc) / 2;
5256
        if (tif->tif_fields[mb]->field_tag == (uint32_t)tagid)
5257
            break;
5258
        if (tif->tif_fields[mb]->field_tag < (uint32_t)tagid)
5259
            ma = mb;
5260
        else
5261
            mc = mb;
5262
    }
5263
    while (1)
5264
    {
5265
        if (mb == 0)
5266
            break;
5267
        if (tif->tif_fields[mb - 1]->field_tag != (uint32_t)tagid)
5268
            break;
5269
        mb--;
5270
    }
5271
    *fii = mb;
5272
}
5273

5274
/*
5275
 * Read custom directory from the arbitrary offset.
5276
 * The code is very similar to TIFFReadDirectory().
5277
 */
5278
int TIFFReadCustomDirectory(TIFF *tif, toff_t diroff,
5279
                            const TIFFFieldArray *infoarray)
5280
{
5281
    static const char module[] = "TIFFReadCustomDirectory";
5282
    TIFFDirEntry *dir;
5283
    uint16_t dircount;
5284
    TIFFDirEntry *dp;
5285
    uint16_t di;
5286
    const TIFFField *fip;
5287
    uint32_t fii;
5288

5289
    assert(infoarray != NULL);
5290
    dircount = TIFFFetchDirectory(tif, diroff, &dir, NULL);
5291
    if (!dircount)
5292
    {
5293
        TIFFErrorExtR(tif, module,
5294
                      "Failed to read custom directory at offset %" PRIu64,
5295
                      diroff);
5296
        return 0;
5297
    }
5298
    TIFFReadDirectoryCheckOrder(tif, dir, dircount);
5299

5300
    /*
5301
     * Mark duplicates of any tag to be ignored (bugzilla 1994)
5302
     * to avoid certain pathological problems.
5303
     */
5304
    {
5305
        TIFFDirEntry *ma;
5306
        uint16_t mb;
5307
        for (ma = dir, mb = 0; mb < dircount; ma++, mb++)
5308
        {
5309
            TIFFDirEntry *na;
5310
            uint16_t nb;
5311
            for (na = ma + 1, nb = mb + 1; nb < dircount; na++, nb++)
5312
            {
5313
                if (ma->tdir_tag == na->tdir_tag)
5314
                {
5315
                    na->tdir_ignore = TRUE;
5316
                }
5317
            }
5318
        }
5319
    }
5320

5321
    /* Free any old stuff and reinit. */
5322
    TIFFFreeDirectory(tif);
5323
    /* Even if custom directories do not need the default settings of a standard
5324
     * IFD, the pointer to the TIFFSetField() and TIFFGetField() (i.e.
5325
     * tif->tif_tagmethods.vsetfield and tif->tif_tagmethods.vgetfield) need to
5326
     * be initialized, which is done in TIFFDefaultDirectory().
5327
     * After that, the field array for the custom tags needs to be setup again.
5328
     */
5329
    TIFFDefaultDirectory(tif);
5330
    _TIFFSetupFields(tif, infoarray);
5331

5332
    /* Allocate arrays for offset values outside IFD entry for IFD data size
5333
     * checking. Note: Counter are reset within TIFFFreeDirectory(). */
5334
    tif->tif_dir.td_dirdatasize_offsets =
5335
        (TIFFEntryOffsetAndLength *)_TIFFmallocExt(
5336
            tif, dircount * sizeof(TIFFEntryOffsetAndLength));
5337
    if (tif->tif_dir.td_dirdatasize_offsets == NULL)
5338
    {
5339
        TIFFErrorExtR(
5340
            tif, module,
5341
            "Failed to allocate memory for counting IFD data size at reading");
5342
        if (dir)
5343
            _TIFFfreeExt(tif, dir);
5344
        return 0;
5345
    }
5346

5347
    for (di = 0, dp = dir; di < dircount; di++, dp++)
5348
    {
5349
        TIFFReadDirectoryFindFieldInfo(tif, dp->tdir_tag, &fii);
5350
        if (fii == FAILED_FII)
5351
        {
5352
            if (tif->tif_warn_about_unknown_tags)
5353
            {
5354
                TIFFWarningExtR(tif, module,
5355
                                "Unknown field with tag %" PRIu16 " (0x%" PRIx16
5356
                                ") encountered",
5357
                                dp->tdir_tag, dp->tdir_tag);
5358
            }
5359
            const TIFFField *fld = _TIFFCreateAnonField(
5360
                tif, dp->tdir_tag, (TIFFDataType)dp->tdir_type);
5361
            if (fld == NULL || !_TIFFMergeFields(tif, fld, 1))
5362
            {
5363
                if (tif->tif_warn_about_unknown_tags)
5364
                {
5365
                    TIFFWarningExtR(
5366
                        tif, module,
5367
                        "Registering anonymous field with tag %" PRIu16
5368
                        " (0x%" PRIx16 ") failed",
5369
                        dp->tdir_tag, dp->tdir_tag);
5370
                }
5371
                dp->tdir_ignore = TRUE;
5372
            }
5373
            else
5374
            {
5375
                TIFFReadDirectoryFindFieldInfo(tif, dp->tdir_tag, &fii);
5376
                assert(fii != FAILED_FII);
5377
            }
5378
        }
5379
        if (!dp->tdir_ignore)
5380
        {
5381
            fip = tif->tif_fields[fii];
5382
            if (fip->field_bit == FIELD_IGNORE)
5383
                dp->tdir_ignore = TRUE;
5384
            else
5385
            {
5386
                /* check data type */
5387
                while ((fip->field_type != TIFF_ANY) &&
5388
                       (fip->field_type != dp->tdir_type))
5389
                {
5390
                    fii++;
5391
                    if ((fii == tif->tif_nfields) ||
5392
                        (tif->tif_fields[fii]->field_tag !=
5393
                         (uint32_t)dp->tdir_tag))
5394
                    {
5395
                        fii = 0xFFFF;
5396
                        break;
5397
                    }
5398
                    fip = tif->tif_fields[fii];
5399
                }
5400
                if (fii == 0xFFFF)
5401
                {
5402
                    TIFFWarningExtR(tif, module,
5403
                                    "Wrong data type %" PRIu16
5404
                                    " for \"%s\"; tag ignored",
5405
                                    dp->tdir_type, fip->field_name);
5406
                    dp->tdir_ignore = TRUE;
5407
                }
5408
                else
5409
                {
5410
                    /* check count if known in advance */
5411
                    if ((fip->field_readcount != TIFF_VARIABLE) &&
5412
                        (fip->field_readcount != TIFF_VARIABLE2))
5413
                    {
5414
                        uint32_t expected;
5415
                        if (fip->field_readcount == TIFF_SPP)
5416
                            expected =
5417
                                (uint32_t)tif->tif_dir.td_samplesperpixel;
5418
                        else
5419
                            expected = (uint32_t)fip->field_readcount;
5420
                        if (!CheckDirCount(tif, dp, expected))
5421
                            dp->tdir_ignore = TRUE;
5422
                    }
5423
                }
5424
            }
5425
            if (!dp->tdir_ignore)
5426
            {
5427
                switch (dp->tdir_tag)
5428
                {
5429
                    case EXIFTAG_SUBJECTDISTANCE:
5430
                        if (!TIFFFieldIsAnonymous(fip))
5431
                        {
5432
                            /* should only be called on a Exif directory */
5433
                            /* when exifFields[] is active */
5434
                            (void)TIFFFetchSubjectDistance(tif, dp);
5435
                        }
5436
                        else
5437
                        {
5438
                            (void)TIFFFetchNormalTag(tif, dp, TRUE);
5439
                        }
5440
                        break;
5441
                    default:
5442
                        (void)TIFFFetchNormalTag(tif, dp, TRUE);
5443
                        break;
5444
                }
5445
            } /*-- if (!dp->tdir_ignore) */
5446
        }
5447
    }
5448
    /* Evaluate final IFD data size. */
5449
    CalcFinalIFDdatasizeReading(tif, dircount);
5450

5451
    /* To be able to return from SubIFD or custom-IFD to main-IFD */
5452
    tif->tif_setdirectory_force_absolute = TRUE;
5453
    if (dir)
5454
        _TIFFfreeExt(tif, dir);
5455
    return 1;
5456
}
5457

5458
/*
5459
 * EXIF is important special case of custom IFD, so we have a special
5460
 * function to read it.
5461
 */
5462
int TIFFReadEXIFDirectory(TIFF *tif, toff_t diroff)
5463
{
5464
    return TIFFReadCustomDirectory(tif, diroff, _TIFFGetExifFields());
5465
}
5466

5467
/*
5468
 *--: EXIF-GPS custom directory reading as another special case of custom IFD.
5469
 */
5470
int TIFFReadGPSDirectory(TIFF *tif, toff_t diroff)
5471
{
5472
    return TIFFReadCustomDirectory(tif, diroff, _TIFFGetGpsFields());
5473
}
5474

5475
static int EstimateStripByteCounts(TIFF *tif, TIFFDirEntry *dir,
5476
                                   uint16_t dircount)
5477
{
5478
    static const char module[] = "EstimateStripByteCounts";
5479

5480
    TIFFDirEntry *dp;
5481
    TIFFDirectory *td = &tif->tif_dir;
5482
    uint32_t strip;
5483

5484
    /* Do not try to load stripbytecount as we will compute it */
5485
    if (!_TIFFFillStrilesInternal(tif, 0))
5486
        return -1;
5487

5488
    const uint64_t allocsize = (uint64_t)td->td_nstrips * sizeof(uint64_t);
5489
    uint64_t filesize = 0;
5490
    if (allocsize > 100 * 1024 * 1024)
5491
    {
5492
        /* Before allocating a huge amount of memory for corrupted files, check
5493
         * if size of requested memory is not greater than file size. */
5494
        filesize = TIFFGetFileSize(tif);
5495
        if (allocsize > filesize)
5496
        {
5497
            TIFFWarningExtR(
5498
                tif, module,
5499
                "Requested memory size for StripByteCounts of %" PRIu64
5500
                " is greater than filesize %" PRIu64 ". Memory not allocated",
5501
                allocsize, filesize);
5502
            return -1;
5503
        }
5504
    }
5505

5506
    if (td->td_stripbytecount_p)
5507
        _TIFFfreeExt(tif, td->td_stripbytecount_p);
5508
    td->td_stripbytecount_p = (uint64_t *)_TIFFCheckMalloc(
5509
        tif, td->td_nstrips, sizeof(uint64_t), "for \"StripByteCounts\" array");
5510
    if (td->td_stripbytecount_p == NULL)
5511
        return -1;
5512

5513
    if (td->td_compression != COMPRESSION_NONE)
5514
    {
5515
        uint64_t space;
5516
        uint16_t n;
5517
        if (!(tif->tif_flags & TIFF_BIGTIFF))
5518
            space = sizeof(TIFFHeaderClassic) + 2 + dircount * 12 + 4;
5519
        else
5520
            space = sizeof(TIFFHeaderBig) + 8 + dircount * 20 + 8;
5521
        /* calculate amount of space used by indirect values */
5522
        for (dp = dir, n = dircount; n > 0; n--, dp++)
5523
        {
5524
            uint32_t typewidth;
5525
            uint64_t datasize;
5526
            typewidth = TIFFDataWidth((TIFFDataType)dp->tdir_type);
5527
            if (typewidth == 0)
5528
            {
5529
                TIFFErrorExtR(
5530
                    tif, module,
5531
                    "Cannot determine size of unknown tag type %" PRIu16,
5532
                    dp->tdir_type);
5533
                return -1;
5534
            }
5535
            if (dp->tdir_count > UINT64_MAX / typewidth)
5536
                return -1;
5537
            datasize = (uint64_t)typewidth * dp->tdir_count;
5538
            if (!(tif->tif_flags & TIFF_BIGTIFF))
5539
            {
5540
                if (datasize <= 4)
5541
                    datasize = 0;
5542
            }
5543
            else
5544
            {
5545
                if (datasize <= 8)
5546
                    datasize = 0;
5547
            }
5548
            if (space > UINT64_MAX - datasize)
5549
                return -1;
5550
            space += datasize;
5551
        }
5552
        if (filesize == 0)
5553
            filesize = TIFFGetFileSize(tif);
5554
        if (filesize < space)
5555
            /* we should perhaps return in error ? */
5556
            space = filesize;
5557
        else
5558
            space = filesize - space;
5559
        if (td->td_planarconfig == PLANARCONFIG_SEPARATE)
5560
            space /= td->td_samplesperpixel;
5561
        for (strip = 0; strip < td->td_nstrips; strip++)
5562
            td->td_stripbytecount_p[strip] = space;
5563
        /*
5564
         * This gross hack handles the case were the offset to
5565
         * the last strip is past the place where we think the strip
5566
         * should begin.  Since a strip of data must be contiguous,
5567
         * it's safe to assume that we've overestimated the amount
5568
         * of data in the strip and trim this number back accordingly.
5569
         */
5570
        strip--;
5571
        if (td->td_stripoffset_p[strip] >
5572
            UINT64_MAX - td->td_stripbytecount_p[strip])
5573
            return -1;
5574
        if (td->td_stripoffset_p[strip] + td->td_stripbytecount_p[strip] >
5575
            filesize)
5576
        {
5577
            if (td->td_stripoffset_p[strip] >= filesize)
5578
            {
5579
                /* Not sure what we should in that case... */
5580
                td->td_stripbytecount_p[strip] = 0;
5581
            }
5582
            else
5583
            {
5584
                td->td_stripbytecount_p[strip] =
5585
                    filesize - td->td_stripoffset_p[strip];
5586
            }
5587
        }
5588
    }
5589
    else if (isTiled(tif))
5590
    {
5591
        uint64_t bytespertile = TIFFTileSize64(tif);
5592

5593
        for (strip = 0; strip < td->td_nstrips; strip++)
5594
            td->td_stripbytecount_p[strip] = bytespertile;
5595
    }
5596
    else
5597
    {
5598
        uint64_t rowbytes = TIFFScanlineSize64(tif);
5599
        uint32_t rowsperstrip = td->td_imagelength / td->td_stripsperimage;
5600
        for (strip = 0; strip < td->td_nstrips; strip++)
5601
        {
5602
            if (rowbytes > 0 && rowsperstrip > UINT64_MAX / rowbytes)
5603
                return -1;
5604
            td->td_stripbytecount_p[strip] = rowbytes * rowsperstrip;
5605
        }
5606
    }
5607
    TIFFSetFieldBit(tif, FIELD_STRIPBYTECOUNTS);
5608
    if (!TIFFFieldSet(tif, FIELD_ROWSPERSTRIP))
5609
        td->td_rowsperstrip = td->td_imagelength;
5610
    return 1;
5611
}
5612

5613
static void MissingRequired(TIFF *tif, const char *tagname)
5614
{
5615
    static const char module[] = "MissingRequired";
5616

5617
    TIFFErrorExtR(tif, module,
5618
                  "TIFF directory is missing required \"%s\" field", tagname);
5619
}
5620

5621
static unsigned long hashFuncOffsetToNumber(const void *elt)
5622
{
5623
    const TIFFOffsetAndDirNumber *offsetAndDirNumber =
5624
        (const TIFFOffsetAndDirNumber *)elt;
5625
    const uint32_t hash = (uint32_t)(offsetAndDirNumber->offset >> 32) ^
5626
                          ((uint32_t)offsetAndDirNumber->offset & 0xFFFFFFFFU);
5627
    return hash;
5628
}
5629

5630
static bool equalFuncOffsetToNumber(const void *elt1, const void *elt2)
5631
{
5632
    const TIFFOffsetAndDirNumber *offsetAndDirNumber1 =
5633
        (const TIFFOffsetAndDirNumber *)elt1;
5634
    const TIFFOffsetAndDirNumber *offsetAndDirNumber2 =
5635
        (const TIFFOffsetAndDirNumber *)elt2;
5636
    return offsetAndDirNumber1->offset == offsetAndDirNumber2->offset;
5637
}
5638

5639
static unsigned long hashFuncNumberToOffset(const void *elt)
5640
{
5641
    const TIFFOffsetAndDirNumber *offsetAndDirNumber =
5642
        (const TIFFOffsetAndDirNumber *)elt;
5643
    return offsetAndDirNumber->dirNumber;
5644
}
5645

5646
static bool equalFuncNumberToOffset(const void *elt1, const void *elt2)
5647
{
5648
    const TIFFOffsetAndDirNumber *offsetAndDirNumber1 =
5649
        (const TIFFOffsetAndDirNumber *)elt1;
5650
    const TIFFOffsetAndDirNumber *offsetAndDirNumber2 =
5651
        (const TIFFOffsetAndDirNumber *)elt2;
5652
    return offsetAndDirNumber1->dirNumber == offsetAndDirNumber2->dirNumber;
5653
}
5654

5655
/*
5656
 * Check the directory number and offset against the list of already seen
5657
 * directory numbers and offsets. This is a trick to prevent IFD looping.
5658
 * The one can create TIFF file with looped directory pointers. We will
5659
 * maintain a list of already seen directories and check every IFD offset
5660
 * and its IFD number against that list. However, the offset of an IFD number
5661
 * can change - e.g. when writing updates to file.
5662
 * Returns 1 if all is ok; 0 if last directory or IFD loop is encountered,
5663
 * or an error has occurred.
5664
 */
5665
int _TIFFCheckDirNumberAndOffset(TIFF *tif, tdir_t dirn, uint64_t diroff)
5666
{
5667
    if (diroff == 0) /* no more directories */
5668
        return 0;
5669

5670
    if (tif->tif_map_dir_offset_to_number == NULL)
5671
    {
5672
        tif->tif_map_dir_offset_to_number = TIFFHashSetNew(
5673
            hashFuncOffsetToNumber, equalFuncOffsetToNumber, free);
5674
        if (tif->tif_map_dir_offset_to_number == NULL)
5675
        {
5676
            TIFFErrorExtR(tif, "_TIFFCheckDirNumberAndOffset",
5677
                          "Not enough memory");
5678
            return 1;
5679
        }
5680
    }
5681

5682
    if (tif->tif_map_dir_number_to_offset == NULL)
5683
    {
5684
        /* No free callback for this map, as it shares the same items as
5685
         * tif->tif_map_dir_offset_to_number. */
5686
        tif->tif_map_dir_number_to_offset = TIFFHashSetNew(
5687
            hashFuncNumberToOffset, equalFuncNumberToOffset, NULL);
5688
        if (tif->tif_map_dir_number_to_offset == NULL)
5689
        {
5690
            TIFFErrorExtR(tif, "_TIFFCheckDirNumberAndOffset",
5691
                          "Not enough memory");
5692
            return 1;
5693
        }
5694
    }
5695

5696
    /* Check if offset is already in the list:
5697
     * - yes: check, if offset is at the same IFD number - if not, it is an IFD
5698
     * loop
5699
     * -  no: add to list or update offset at that IFD number
5700
     */
5701
    TIFFOffsetAndDirNumber entry;
5702
    entry.offset = diroff;
5703
    entry.dirNumber = dirn;
5704

5705
    TIFFOffsetAndDirNumber *foundEntry =
5706
        (TIFFOffsetAndDirNumber *)TIFFHashSetLookup(
5707
            tif->tif_map_dir_offset_to_number, &entry);
5708
    if (foundEntry)
5709
    {
5710
        if (foundEntry->dirNumber == dirn)
5711
        {
5712
            return 1;
5713
        }
5714
        else
5715
        {
5716
            TIFFWarningExtR(tif, "_TIFFCheckDirNumberAndOffset",
5717
                            "TIFF directory %d has IFD looping to directory %u "
5718
                            "at offset 0x%" PRIx64 " (%" PRIu64 ")",
5719
                            (int)dirn - 1, foundEntry->dirNumber, diroff,
5720
                            diroff);
5721
            return 0;
5722
        }
5723
    }
5724

5725
    /* Check if offset of an IFD has been changed and update offset of that IFD
5726
     * number. */
5727
    foundEntry = (TIFFOffsetAndDirNumber *)TIFFHashSetLookup(
5728
        tif->tif_map_dir_number_to_offset, &entry);
5729
    if (foundEntry)
5730
    {
5731
        if (foundEntry->offset != diroff)
5732
        {
5733
            TIFFOffsetAndDirNumber entryOld;
5734
            entryOld.offset = foundEntry->offset;
5735
            entryOld.dirNumber = dirn;
5736
            /* We must remove first from tif_map_dir_number_to_offset as the */
5737
            /* entry is owned (and thus freed) by */
5738
            /* tif_map_dir_offset_to_number */
5739
            TIFFOffsetAndDirNumber *foundEntryOld =
5740
                (TIFFOffsetAndDirNumber *)TIFFHashSetLookup(
5741
                    tif->tif_map_dir_number_to_offset, &entryOld);
5742
            if (foundEntryOld)
5743
            {
5744
                TIFFHashSetRemove(tif->tif_map_dir_number_to_offset,
5745
                                  foundEntryOld);
5746
            }
5747
            foundEntryOld = (TIFFOffsetAndDirNumber *)TIFFHashSetLookup(
5748
                tif->tif_map_dir_offset_to_number, &entryOld);
5749
            if (foundEntryOld)
5750
            {
5751
                TIFFHashSetRemove(tif->tif_map_dir_offset_to_number,
5752
                                  foundEntryOld);
5753
            }
5754

5755
            TIFFOffsetAndDirNumber *entryPtr = (TIFFOffsetAndDirNumber *)malloc(
5756
                sizeof(TIFFOffsetAndDirNumber));
5757
            if (entryPtr == NULL)
5758
            {
5759
                return 0;
5760
            }
5761

5762
            /* Add IFD offset and dirn to IFD directory list */
5763
            *entryPtr = entry;
5764

5765
            if (!TIFFHashSetInsert(tif->tif_map_dir_offset_to_number, entryPtr))
5766
            {
5767
                TIFFErrorExtR(
5768
                    tif, "_TIFFCheckDirNumberAndOffset",
5769
                    "Insertion in tif_map_dir_offset_to_number failed");
5770
                return 0;
5771
            }
5772
            if (!TIFFHashSetInsert(tif->tif_map_dir_number_to_offset, entryPtr))
5773
            {
5774
                TIFFErrorExtR(
5775
                    tif, "_TIFFCheckDirNumberAndOffset",
5776
                    "Insertion in tif_map_dir_number_to_offset failed");
5777
                return 0;
5778
            }
5779
        }
5780
        return 1;
5781
    }
5782

5783
    /* Arbitrary (hopefully big enough) limit */
5784
    if (TIFFHashSetSize(tif->tif_map_dir_offset_to_number) >=
5785
        TIFF_MAX_DIR_COUNT)
5786
    {
5787
        TIFFErrorExtR(tif, "_TIFFCheckDirNumberAndOffset",
5788
                      "Cannot handle more than %u TIFF directories",
5789
                      TIFF_MAX_DIR_COUNT);
5790
        return 0;
5791
    }
5792

5793
    TIFFOffsetAndDirNumber *entryPtr =
5794
        (TIFFOffsetAndDirNumber *)malloc(sizeof(TIFFOffsetAndDirNumber));
5795
    if (entryPtr == NULL)
5796
    {
5797
        TIFFErrorExtR(tif, "_TIFFCheckDirNumberAndOffset",
5798
                      "malloc(sizeof(TIFFOffsetAndDirNumber)) failed");
5799
        return 0;
5800
    }
5801

5802
    /* Add IFD offset and dirn to IFD directory list */
5803
    *entryPtr = entry;
5804

5805
    if (!TIFFHashSetInsert(tif->tif_map_dir_offset_to_number, entryPtr))
5806
    {
5807
        TIFFErrorExtR(tif, "_TIFFCheckDirNumberAndOffset",
5808
                      "Insertion in tif_map_dir_offset_to_number failed");
5809
        return 0;
5810
    }
5811
    if (!TIFFHashSetInsert(tif->tif_map_dir_number_to_offset, entryPtr))
5812
    {
5813
        TIFFErrorExtR(tif, "_TIFFCheckDirNumberAndOffset",
5814
                      "Insertion in tif_map_dir_number_to_offset failed");
5815
        return 0;
5816
    }
5817

5818
    return 1;
5819
} /* --- _TIFFCheckDirNumberAndOffset() ---*/
5820

5821
/*
5822
 * Retrieve the matching IFD directory number of a given IFD offset
5823
 * from the list of directories already seen.
5824
 * Returns 1 if the offset was in the list and the directory number
5825
 * can be returned.
5826
 * Otherwise returns 0 or if an error occurred.
5827
 */
5828
int _TIFFGetDirNumberFromOffset(TIFF *tif, uint64_t diroff, tdir_t *dirn)
5829
{
5830
    if (diroff == 0) /* no more directories */
5831
        return 0;
5832

5833
    /* Check if offset is already in the list and return matching directory
5834
     * number. Otherwise update IFD list using TIFFNumberOfDirectories() and
5835
     * search again in IFD list.
5836
     */
5837
    if (tif->tif_map_dir_offset_to_number == NULL)
5838
        return 0;
5839
    TIFFOffsetAndDirNumber entry;
5840
    entry.offset = diroff;
5841
    entry.dirNumber = 0; /* not used */
5842

5843
    TIFFOffsetAndDirNumber *foundEntry =
5844
        (TIFFOffsetAndDirNumber *)TIFFHashSetLookup(
5845
            tif->tif_map_dir_offset_to_number, &entry);
5846
    if (foundEntry)
5847
    {
5848
        *dirn = foundEntry->dirNumber;
5849
        return 1;
5850
    }
5851

5852
    /* This updates the directory list for all main-IFDs in the file. */
5853
    TIFFNumberOfDirectories(tif);
5854

5855
    foundEntry = (TIFFOffsetAndDirNumber *)TIFFHashSetLookup(
5856
        tif->tif_map_dir_offset_to_number, &entry);
5857
    if (foundEntry)
5858
    {
5859
        *dirn = foundEntry->dirNumber;
5860
        return 1;
5861
    }
5862

5863
    return 0;
5864
} /*--- _TIFFGetDirNumberFromOffset() ---*/
5865

5866
/*
5867
 * Retrieve the matching IFD directory offset of a given IFD number
5868
 * from the list of directories already seen.
5869
 * Returns 1 if the offset was in the list of already seen IFDs and the
5870
 * directory offset can be returned. The directory list is not updated.
5871
 * Otherwise returns 0 or if an error occurred.
5872
 */
5873
int _TIFFGetOffsetFromDirNumber(TIFF *tif, tdir_t dirn, uint64_t *diroff)
5874
{
5875

5876
    if (tif->tif_map_dir_number_to_offset == NULL)
5877
        return 0;
5878
    TIFFOffsetAndDirNumber entry;
5879
    entry.offset = 0; /* not used */
5880
    entry.dirNumber = dirn;
5881

5882
    TIFFOffsetAndDirNumber *foundEntry =
5883
        (TIFFOffsetAndDirNumber *)TIFFHashSetLookup(
5884
            tif->tif_map_dir_number_to_offset, &entry);
5885
    if (foundEntry)
5886
    {
5887
        *diroff = foundEntry->offset;
5888
        return 1;
5889
    }
5890

5891
    return 0;
5892
} /*--- _TIFFGetOffsetFromDirNumber() ---*/
5893

5894
/*
5895
 * Remove an entry from the directory list of already seen directories
5896
 * by directory offset.
5897
 * If an entry is to be removed from the list, it is also okay if the entry
5898
 * is not in the list or the list does not exist.
5899
 */
5900
int _TIFFRemoveEntryFromDirectoryListByOffset(TIFF *tif, uint64_t diroff)
5901
{
5902
    if (tif->tif_map_dir_offset_to_number == NULL)
5903
        return 1;
5904

5905
    TIFFOffsetAndDirNumber entryOld;
5906
    entryOld.offset = diroff;
5907
    entryOld.dirNumber = 0;
5908
    /* We must remove first from tif_map_dir_number_to_offset as the
5909
     * entry is owned (and thus freed) by tif_map_dir_offset_to_number.
5910
     * However, we need firstly to find the directory number from offset. */
5911

5912
    TIFFOffsetAndDirNumber *foundEntryOldOff =
5913
        (TIFFOffsetAndDirNumber *)TIFFHashSetLookup(
5914
            tif->tif_map_dir_offset_to_number, &entryOld);
5915
    if (foundEntryOldOff)
5916
    {
5917
        entryOld.dirNumber = foundEntryOldOff->dirNumber;
5918
        if (tif->tif_map_dir_number_to_offset != NULL)
5919
        {
5920
            TIFFOffsetAndDirNumber *foundEntryOldDir =
5921
                (TIFFOffsetAndDirNumber *)TIFFHashSetLookup(
5922
                    tif->tif_map_dir_number_to_offset, &entryOld);
5923
            if (foundEntryOldDir)
5924
            {
5925
                TIFFHashSetRemove(tif->tif_map_dir_number_to_offset,
5926
                                  foundEntryOldDir);
5927
                TIFFHashSetRemove(tif->tif_map_dir_offset_to_number,
5928
                                  foundEntryOldOff);
5929
                return 1;
5930
            }
5931
        }
5932
        else
5933
        {
5934
            TIFFErrorExtR(tif, "_TIFFRemoveEntryFromDirectoryListByOffset",
5935
                          "Unexpectedly tif_map_dir_number_to_offset is "
5936
                          "missing but tif_map_dir_offset_to_number exists.");
5937
            return 0;
5938
        }
5939
    }
5940
    return 1;
5941
} /*--- _TIFFRemoveEntryFromDirectoryListByOffset() ---*/
5942

5943
/*
5944
 * Check the count field of a directory entry against a known value.  The
5945
 * caller is expected to skip/ignore the tag if there is a mismatch.
5946
 */
5947
static int CheckDirCount(TIFF *tif, TIFFDirEntry *dir, uint32_t count)
5948
{
5949
    if ((uint64_t)count > dir->tdir_count)
5950
    {
5951
        const TIFFField *fip = TIFFFieldWithTag(tif, dir->tdir_tag);
5952
        TIFFWarningExtR(tif, tif->tif_name,
5953
                        "incorrect count for field \"%s\" (%" PRIu64
5954
                        ", expecting %" PRIu32 "); tag ignored",
5955
                        fip ? fip->field_name : "unknown tagname",
5956
                        dir->tdir_count, count);
5957
        return (0);
5958
    }
5959
    else if ((uint64_t)count < dir->tdir_count)
5960
    {
5961
        const TIFFField *fip = TIFFFieldWithTag(tif, dir->tdir_tag);
5962
        TIFFWarningExtR(tif, tif->tif_name,
5963
                        "incorrect count for field \"%s\" (%" PRIu64
5964
                        ", expecting %" PRIu32 "); tag trimmed",
5965
                        fip ? fip->field_name : "unknown tagname",
5966
                        dir->tdir_count, count);
5967
        dir->tdir_count = count;
5968
        return (1);
5969
    }
5970
    return (1);
5971
}
5972

5973
/*
5974
 * Read IFD structure from the specified offset. If the pointer to
5975
 * nextdiroff variable has been specified, read it too. Function returns a
5976
 * number of fields in the directory or 0 if failed.
5977
 */
5978
static uint16_t TIFFFetchDirectory(TIFF *tif, uint64_t diroff,
5979
                                   TIFFDirEntry **pdir, uint64_t *nextdiroff)
5980
{
5981
    static const char module[] = "TIFFFetchDirectory";
5982

5983
    void *origdir;
5984
    uint16_t dircount16;
5985
    uint32_t dirsize;
5986
    TIFFDirEntry *dir;
5987
    uint8_t *ma;
5988
    TIFFDirEntry *mb;
5989
    uint16_t n;
5990

5991
    assert(pdir);
5992

5993
    tif->tif_diroff = diroff;
5994
    if (nextdiroff)
5995
        *nextdiroff = 0;
5996
    if (!isMapped(tif))
5997
    {
5998
        if (!SeekOK(tif, tif->tif_diroff))
5999
        {
6000
            TIFFErrorExtR(tif, module,
6001
                          "%s: Seek error accessing TIFF directory",
6002
                          tif->tif_name);
6003
            return 0;
6004
        }
6005
        if (!(tif->tif_flags & TIFF_BIGTIFF))
6006
        {
6007
            if (!ReadOK(tif, &dircount16, sizeof(uint16_t)))
6008
            {
6009
                TIFFErrorExtR(tif, module,
6010
                              "%s: Can not read TIFF directory count",
6011
                              tif->tif_name);
6012
                return 0;
6013
            }
6014
            if (tif->tif_flags & TIFF_SWAB)
6015
                TIFFSwabShort(&dircount16);
6016
            if (dircount16 > 4096)
6017
            {
6018
                TIFFErrorExtR(tif, module,
6019
                              "Sanity check on directory count failed, this is "
6020
                              "probably not a valid IFD offset");
6021
                return 0;
6022
            }
6023
            dirsize = 12;
6024
        }
6025
        else
6026
        {
6027
            uint64_t dircount64;
6028
            if (!ReadOK(tif, &dircount64, sizeof(uint64_t)))
6029
            {
6030
                TIFFErrorExtR(tif, module,
6031
                              "%s: Can not read TIFF directory count",
6032
                              tif->tif_name);
6033
                return 0;
6034
            }
6035
            if (tif->tif_flags & TIFF_SWAB)
6036
                TIFFSwabLong8(&dircount64);
6037
            if (dircount64 > 4096)
6038
            {
6039
                TIFFErrorExtR(tif, module,
6040
                              "Sanity check on directory count failed, this is "
6041
                              "probably not a valid IFD offset");
6042
                return 0;
6043
            }
6044
            dircount16 = (uint16_t)dircount64;
6045
            dirsize = 20;
6046
        }
6047
        origdir = _TIFFCheckMalloc(tif, dircount16, dirsize,
6048
                                   "to read TIFF directory");
6049
        if (origdir == NULL)
6050
            return 0;
6051
        if (!ReadOK(tif, origdir, (tmsize_t)(dircount16 * dirsize)))
6052
        {
6053
            TIFFErrorExtR(tif, module, "%.100s: Can not read TIFF directory",
6054
                          tif->tif_name);
6055
            _TIFFfreeExt(tif, origdir);
6056
            return 0;
6057
        }
6058
        /*
6059
         * Read offset to next directory for sequential scans if
6060
         * needed.
6061
         */
6062
        if (nextdiroff)
6063
        {
6064
            if (!(tif->tif_flags & TIFF_BIGTIFF))
6065
            {
6066
                uint32_t nextdiroff32;
6067
                if (!ReadOK(tif, &nextdiroff32, sizeof(uint32_t)))
6068
                    nextdiroff32 = 0;
6069
                if (tif->tif_flags & TIFF_SWAB)
6070
                    TIFFSwabLong(&nextdiroff32);
6071
                *nextdiroff = nextdiroff32;
6072
            }
6073
            else
6074
            {
6075
                if (!ReadOK(tif, nextdiroff, sizeof(uint64_t)))
6076
                    *nextdiroff = 0;
6077
                if (tif->tif_flags & TIFF_SWAB)
6078
                    TIFFSwabLong8(nextdiroff);
6079
            }
6080
        }
6081
    }
6082
    else
6083
    {
6084
        tmsize_t m;
6085
        tmsize_t off;
6086
        if (tif->tif_diroff > (uint64_t)INT64_MAX)
6087
        {
6088
            TIFFErrorExtR(tif, module, "Can not read TIFF directory count");
6089
            return (0);
6090
        }
6091
        off = (tmsize_t)tif->tif_diroff;
6092

6093
        /*
6094
         * Check for integer overflow when validating the dir_off,
6095
         * otherwise a very high offset may cause an OOB read and
6096
         * crash the client. Make two comparisons instead of
6097
         *
6098
         *  off + sizeof(uint16_t) > tif->tif_size
6099
         *
6100
         * to avoid overflow.
6101
         */
6102
        if (!(tif->tif_flags & TIFF_BIGTIFF))
6103
        {
6104
            m = off + sizeof(uint16_t);
6105
            if ((m < off) || (m < (tmsize_t)sizeof(uint16_t)) ||
6106
                (m > tif->tif_size))
6107
            {
6108
                TIFFErrorExtR(tif, module, "Can not read TIFF directory count");
6109
                return 0;
6110
            }
6111
            else
6112
            {
6113
                _TIFFmemcpy(&dircount16, tif->tif_base + off, sizeof(uint16_t));
6114
            }
6115
            off += sizeof(uint16_t);
6116
            if (tif->tif_flags & TIFF_SWAB)
6117
                TIFFSwabShort(&dircount16);
6118
            if (dircount16 > 4096)
6119
            {
6120
                TIFFErrorExtR(tif, module,
6121
                              "Sanity check on directory count failed, this is "
6122
                              "probably not a valid IFD offset");
6123
                return 0;
6124
            }
6125
            dirsize = 12;
6126
        }
6127
        else
6128
        {
6129
            uint64_t dircount64;
6130
            m = off + sizeof(uint64_t);
6131
            if ((m < off) || (m < (tmsize_t)sizeof(uint64_t)) ||
6132
                (m > tif->tif_size))
6133
            {
6134
                TIFFErrorExtR(tif, module, "Can not read TIFF directory count");
6135
                return 0;
6136
            }
6137
            else
6138
            {
6139
                _TIFFmemcpy(&dircount64, tif->tif_base + off, sizeof(uint64_t));
6140
            }
6141
            off += sizeof(uint64_t);
6142
            if (tif->tif_flags & TIFF_SWAB)
6143
                TIFFSwabLong8(&dircount64);
6144
            if (dircount64 > 4096)
6145
            {
6146
                TIFFErrorExtR(tif, module,
6147
                              "Sanity check on directory count failed, this is "
6148
                              "probably not a valid IFD offset");
6149
                return 0;
6150
            }
6151
            dircount16 = (uint16_t)dircount64;
6152
            dirsize = 20;
6153
        }
6154
        if (dircount16 == 0)
6155
        {
6156
            TIFFErrorExtR(tif, module,
6157
                          "Sanity check on directory count failed, zero tag "
6158
                          "directories not supported");
6159
            return 0;
6160
        }
6161
        /* Before allocating a huge amount of memory for corrupted files, check
6162
         * if size of requested memory is not greater than file size. */
6163
        uint64_t filesize = TIFFGetFileSize(tif);
6164
        uint64_t allocsize = (uint64_t)dircount16 * dirsize;
6165
        if (allocsize > filesize)
6166
        {
6167
            TIFFWarningExtR(
6168
                tif, module,
6169
                "Requested memory size for TIFF directory of %" PRIu64
6170
                " is greater than filesize %" PRIu64
6171
                ". Memory not allocated, TIFF directory not read",
6172
                allocsize, filesize);
6173
            return 0;
6174
        }
6175
        origdir = _TIFFCheckMalloc(tif, dircount16, dirsize,
6176
                                   "to read TIFF directory");
6177
        if (origdir == NULL)
6178
            return 0;
6179
        m = off + dircount16 * dirsize;
6180
        if ((m < off) || (m < (tmsize_t)(dircount16 * dirsize)) ||
6181
            (m > tif->tif_size))
6182
        {
6183
            TIFFErrorExtR(tif, module, "Can not read TIFF directory");
6184
            _TIFFfreeExt(tif, origdir);
6185
            return 0;
6186
        }
6187
        else
6188
        {
6189
            _TIFFmemcpy(origdir, tif->tif_base + off, dircount16 * dirsize);
6190
        }
6191
        if (nextdiroff)
6192
        {
6193
            off += dircount16 * dirsize;
6194
            if (!(tif->tif_flags & TIFF_BIGTIFF))
6195
            {
6196
                uint32_t nextdiroff32;
6197
                m = off + sizeof(uint32_t);
6198
                if ((m < off) || (m < (tmsize_t)sizeof(uint32_t)) ||
6199
                    (m > tif->tif_size))
6200
                    nextdiroff32 = 0;
6201
                else
6202
                    _TIFFmemcpy(&nextdiroff32, tif->tif_base + off,
6203
                                sizeof(uint32_t));
6204
                if (tif->tif_flags & TIFF_SWAB)
6205
                    TIFFSwabLong(&nextdiroff32);
6206
                *nextdiroff = nextdiroff32;
6207
            }
6208
            else
6209
            {
6210
                m = off + sizeof(uint64_t);
6211
                if ((m < off) || (m < (tmsize_t)sizeof(uint64_t)) ||
6212
                    (m > tif->tif_size))
6213
                    *nextdiroff = 0;
6214
                else
6215
                    _TIFFmemcpy(nextdiroff, tif->tif_base + off,
6216
                                sizeof(uint64_t));
6217
                if (tif->tif_flags & TIFF_SWAB)
6218
                    TIFFSwabLong8(nextdiroff);
6219
            }
6220
        }
6221
    }
6222
    /* No check against filesize needed here because "dir" should have same size
6223
     * than "origdir" checked above. */
6224
    dir = (TIFFDirEntry *)_TIFFCheckMalloc(
6225
        tif, dircount16, sizeof(TIFFDirEntry), "to read TIFF directory");
6226
    if (dir == 0)
6227
    {
6228
        _TIFFfreeExt(tif, origdir);
6229
        return 0;
6230
    }
6231
    ma = (uint8_t *)origdir;
6232
    mb = dir;
6233
    for (n = 0; n < dircount16; n++)
6234
    {
6235
        mb->tdir_ignore = FALSE;
6236
        if (tif->tif_flags & TIFF_SWAB)
6237
            TIFFSwabShort((uint16_t *)ma);
6238
        mb->tdir_tag = *(uint16_t *)ma;
6239
        ma += sizeof(uint16_t);
6240
        if (tif->tif_flags & TIFF_SWAB)
6241
            TIFFSwabShort((uint16_t *)ma);
6242
        mb->tdir_type = *(uint16_t *)ma;
6243
        ma += sizeof(uint16_t);
6244
        if (!(tif->tif_flags & TIFF_BIGTIFF))
6245
        {
6246
            if (tif->tif_flags & TIFF_SWAB)
6247
                TIFFSwabLong((uint32_t *)ma);
6248
            mb->tdir_count = (uint64_t)(*(uint32_t *)ma);
6249
            ma += sizeof(uint32_t);
6250
            mb->tdir_offset.toff_long8 = 0;
6251
            *(uint32_t *)(&mb->tdir_offset) = *(uint32_t *)ma;
6252
            ma += sizeof(uint32_t);
6253
        }
6254
        else
6255
        {
6256
            if (tif->tif_flags & TIFF_SWAB)
6257
                TIFFSwabLong8((uint64_t *)ma);
6258
            mb->tdir_count = TIFFReadUInt64(ma);
6259
            ma += sizeof(uint64_t);
6260
            mb->tdir_offset.toff_long8 = TIFFReadUInt64(ma);
6261
            ma += sizeof(uint64_t);
6262
        }
6263
        mb++;
6264
    }
6265
    _TIFFfreeExt(tif, origdir);
6266
    *pdir = dir;
6267
    return dircount16;
6268
}
6269

6270
/*
6271
 * Fetch a tag that is not handled by special case code.
6272
 */
6273
static int TIFFFetchNormalTag(TIFF *tif, TIFFDirEntry *dp, int recover)
6274
{
6275
    static const char module[] = "TIFFFetchNormalTag";
6276
    enum TIFFReadDirEntryErr err;
6277
    uint32_t fii;
6278
    const TIFFField *fip = NULL;
6279
    TIFFReadDirectoryFindFieldInfo(tif, dp->tdir_tag, &fii);
6280
    if (fii == FAILED_FII)
6281
    {
6282
        TIFFErrorExtR(tif, "TIFFFetchNormalTag",
6283
                      "No definition found for tag %" PRIu16, dp->tdir_tag);
6284
        return 0;
6285
    }
6286
    fip = tif->tif_fields[fii];
6287
    assert(fip != NULL); /* should not happen */
6288
    assert(fip->set_get_field_type !=
6289
           TIFF_SETGET_OTHER); /* if so, we shouldn't arrive here but deal with
6290
                                  this in specialized code */
6291
    assert(fip->set_get_field_type !=
6292
           TIFF_SETGET_INT); /* if so, we shouldn't arrive here as this is only
6293
                                the case for pseudo-tags */
6294
    err = TIFFReadDirEntryErrOk;
6295
    switch (fip->set_get_field_type)
6296
    {
6297
        case TIFF_SETGET_UNDEFINED:
6298
            TIFFErrorExtR(
6299
                tif, "TIFFFetchNormalTag",
6300
                "Defined set_get_field_type of custom tag %u (%s) is "
6301
                "TIFF_SETGET_UNDEFINED and thus tag is not read from file",
6302
                fip->field_tag, fip->field_name);
6303
            break;
6304
        case TIFF_SETGET_ASCII:
6305
        {
6306
            uint8_t *data;
6307
            assert(fip->field_passcount == 0);
6308
            err = TIFFReadDirEntryByteArray(tif, dp, &data);
6309
            if (err == TIFFReadDirEntryErrOk)
6310
            {
6311
                size_t mb = 0;
6312
                int n;
6313
                if (data != NULL)
6314
                {
6315
                    if (dp->tdir_count > 0 && data[dp->tdir_count - 1] == 0)
6316
                    {
6317
                        /* optimization: if data is known to be 0 terminated, we
6318
                         * can use strlen() */
6319
                        mb = strlen((const char *)data);
6320
                    }
6321
                    else
6322
                    {
6323
                        /* general case. equivalent to non-portable */
6324
                        /* mb = strnlen((const char*)data,
6325
                         * (uint32_t)dp->tdir_count); */
6326
                        uint8_t *ma = data;
6327
                        while (mb < (uint32_t)dp->tdir_count)
6328
                        {
6329
                            if (*ma == 0)
6330
                                break;
6331
                            ma++;
6332
                            mb++;
6333
                        }
6334
                    }
6335
                }
6336
                if (!EvaluateIFDdatasizeReading(tif, dp))
6337
                {
6338
                    if (data != NULL)
6339
                        _TIFFfreeExt(tif, data);
6340
                    return (0);
6341
                }
6342
                if (mb + 1 < (uint32_t)dp->tdir_count)
6343
                    TIFFWarningExtR(
6344
                        tif, module,
6345
                        "ASCII value for tag \"%s\" contains null byte in "
6346
                        "value; value incorrectly truncated during reading due "
6347
                        "to implementation limitations",
6348
                        fip->field_name);
6349
                else if (mb + 1 > (uint32_t)dp->tdir_count)
6350
                {
6351
                    TIFFWarningExtR(tif, module,
6352
                                    "ASCII value for tag \"%s\" does not end "
6353
                                    "in null byte. Forcing it to be null",
6354
                                    fip->field_name);
6355
                    /* TIFFReadDirEntryArrayWithLimit() ensures this can't be
6356
                     * larger than MAX_SIZE_TAG_DATA */
6357
                    assert((uint32_t)dp->tdir_count + 1 == dp->tdir_count + 1);
6358
                    uint8_t *o =
6359
                        _TIFFmallocExt(tif, (uint32_t)dp->tdir_count + 1);
6360
                    if (o == NULL)
6361
                    {
6362
                        if (data != NULL)
6363
                            _TIFFfreeExt(tif, data);
6364
                        return (0);
6365
                    }
6366
                    if (dp->tdir_count > 0)
6367
                    {
6368
                        _TIFFmemcpy(o, data, (uint32_t)dp->tdir_count);
6369
                    }
6370
                    o[(uint32_t)dp->tdir_count] = 0;
6371
                    if (data != 0)
6372
                        _TIFFfreeExt(tif, data);
6373
                    data = o;
6374
                }
6375
                n = TIFFSetField(tif, dp->tdir_tag, data);
6376
                if (data != 0)
6377
                    _TIFFfreeExt(tif, data);
6378
                if (!n)
6379
                    return (0);
6380
            }
6381
        }
6382
        break;
6383
        case TIFF_SETGET_UINT8:
6384
        {
6385
            uint8_t data = 0;
6386
            assert(fip->field_readcount == 1);
6387
            assert(fip->field_passcount == 0);
6388
            err = TIFFReadDirEntryByte(tif, dp, &data);
6389
            if (err == TIFFReadDirEntryErrOk)
6390
            {
6391
                if (!TIFFSetField(tif, dp->tdir_tag, data))
6392
                    return (0);
6393
            }
6394
        }
6395
        break;
6396
        case TIFF_SETGET_SINT8:
6397
        {
6398
            int8_t data = 0;
6399
            assert(fip->field_readcount == 1);
6400
            assert(fip->field_passcount == 0);
6401
            err = TIFFReadDirEntrySbyte(tif, dp, &data);
6402
            if (err == TIFFReadDirEntryErrOk)
6403
            {
6404
                if (!TIFFSetField(tif, dp->tdir_tag, data))
6405
                    return (0);
6406
            }
6407
        }
6408
        break;
6409
        case TIFF_SETGET_UINT16:
6410
        {
6411
            uint16_t data;
6412
            assert(fip->field_readcount == 1);
6413
            assert(fip->field_passcount == 0);
6414
            err = TIFFReadDirEntryShort(tif, dp, &data);
6415
            if (err == TIFFReadDirEntryErrOk)
6416
            {
6417
                if (!TIFFSetField(tif, dp->tdir_tag, data))
6418
                    return (0);
6419
            }
6420
        }
6421
        break;
6422
        case TIFF_SETGET_SINT16:
6423
        {
6424
            int16_t data;
6425
            assert(fip->field_readcount == 1);
6426
            assert(fip->field_passcount == 0);
6427
            err = TIFFReadDirEntrySshort(tif, dp, &data);
6428
            if (err == TIFFReadDirEntryErrOk)
6429
            {
6430
                if (!TIFFSetField(tif, dp->tdir_tag, data))
6431
                    return (0);
6432
            }
6433
        }
6434
        break;
6435
        case TIFF_SETGET_UINT32:
6436
        {
6437
            uint32_t data;
6438
            assert(fip->field_readcount == 1);
6439
            assert(fip->field_passcount == 0);
6440
            err = TIFFReadDirEntryLong(tif, dp, &data);
6441
            if (err == TIFFReadDirEntryErrOk)
6442
            {
6443
                if (!TIFFSetField(tif, dp->tdir_tag, data))
6444
                    return (0);
6445
            }
6446
        }
6447
        break;
6448
        case TIFF_SETGET_SINT32:
6449
        {
6450
            int32_t data;
6451
            assert(fip->field_readcount == 1);
6452
            assert(fip->field_passcount == 0);
6453
            err = TIFFReadDirEntrySlong(tif, dp, &data);
6454
            if (err == TIFFReadDirEntryErrOk)
6455
            {
6456
                if (!TIFFSetField(tif, dp->tdir_tag, data))
6457
                    return (0);
6458
            }
6459
        }
6460
        break;
6461
        case TIFF_SETGET_UINT64:
6462
        {
6463
            uint64_t data;
6464
            assert(fip->field_readcount == 1);
6465
            assert(fip->field_passcount == 0);
6466
            err = TIFFReadDirEntryLong8(tif, dp, &data);
6467
            if (err == TIFFReadDirEntryErrOk)
6468
            {
6469
                if (!EvaluateIFDdatasizeReading(tif, dp))
6470
                    return 0;
6471
                if (!TIFFSetField(tif, dp->tdir_tag, data))
6472
                    return (0);
6473
            }
6474
        }
6475
        break;
6476
        case TIFF_SETGET_SINT64:
6477
        {
6478
            int64_t data;
6479
            assert(fip->field_readcount == 1);
6480
            assert(fip->field_passcount == 0);
6481
            err = TIFFReadDirEntrySlong8(tif, dp, &data);
6482
            if (err == TIFFReadDirEntryErrOk)
6483
            {
6484
                if (!EvaluateIFDdatasizeReading(tif, dp))
6485
                    return 0;
6486
                if (!TIFFSetField(tif, dp->tdir_tag, data))
6487
                    return (0);
6488
            }
6489
        }
6490
        break;
6491
        case TIFF_SETGET_FLOAT:
6492
        {
6493
            float data;
6494
            assert(fip->field_readcount == 1);
6495
            assert(fip->field_passcount == 0);
6496
            err = TIFFReadDirEntryFloat(tif, dp, &data);
6497
            if (err == TIFFReadDirEntryErrOk)
6498
            {
6499
                if (!EvaluateIFDdatasizeReading(tif, dp))
6500
                    return 0;
6501
                if (!TIFFSetField(tif, dp->tdir_tag, data))
6502
                    return (0);
6503
            }
6504
        }
6505
        break;
6506
        case TIFF_SETGET_DOUBLE:
6507
        {
6508
            double data;
6509
            assert(fip->field_readcount == 1);
6510
            assert(fip->field_passcount == 0);
6511
            err = TIFFReadDirEntryDouble(tif, dp, &data);
6512
            if (err == TIFFReadDirEntryErrOk)
6513
            {
6514
                if (!EvaluateIFDdatasizeReading(tif, dp))
6515
                    return 0;
6516
                if (!TIFFSetField(tif, dp->tdir_tag, data))
6517
                    return (0);
6518
            }
6519
        }
6520
        break;
6521
        case TIFF_SETGET_IFD8:
6522
        {
6523
            uint64_t data;
6524
            assert(fip->field_readcount == 1);
6525
            assert(fip->field_passcount == 0);
6526
            err = TIFFReadDirEntryIfd8(tif, dp, &data);
6527
            if (err == TIFFReadDirEntryErrOk)
6528
            {
6529
                if (!EvaluateIFDdatasizeReading(tif, dp))
6530
                    return 0;
6531
                if (!TIFFSetField(tif, dp->tdir_tag, data))
6532
                    return (0);
6533
            }
6534
        }
6535
        break;
6536
        case TIFF_SETGET_UINT16_PAIR:
6537
        {
6538
            uint16_t *data;
6539
            assert(fip->field_readcount == 2);
6540
            assert(fip->field_passcount == 0);
6541
            if (dp->tdir_count != 2)
6542
            {
6543
                TIFFWarningExtR(tif, module,
6544
                                "incorrect count for field \"%s\", expected 2, "
6545
                                "got %" PRIu64,
6546
                                fip->field_name, dp->tdir_count);
6547
                return (0);
6548
            }
6549
            err = TIFFReadDirEntryShortArray(tif, dp, &data);
6550
            if (err == TIFFReadDirEntryErrOk)
6551
            {
6552
                int m;
6553
                assert(data); /* avoid CLang static Analyzer false positive */
6554
                m = TIFFSetField(tif, dp->tdir_tag, data[0], data[1]);
6555
                _TIFFfreeExt(tif, data);
6556
                if (!m)
6557
                    return (0);
6558
            }
6559
        }
6560
        break;
6561
        case TIFF_SETGET_C0_UINT8:
6562
        {
6563
            uint8_t *data;
6564
            assert(fip->field_readcount >= 1);
6565
            assert(fip->field_passcount == 0);
6566
            if (dp->tdir_count != (uint64_t)fip->field_readcount)
6567
            {
6568
                TIFFWarningExtR(tif, module,
6569
                                "incorrect count for field \"%s\", expected "
6570
                                "%d, got %" PRIu64,
6571
                                fip->field_name, (int)fip->field_readcount,
6572
                                dp->tdir_count);
6573
                return (0);
6574
            }
6575
            else
6576
            {
6577
                err = TIFFReadDirEntryByteArray(tif, dp, &data);
6578
                if (err == TIFFReadDirEntryErrOk)
6579
                {
6580
                    if (!EvaluateIFDdatasizeReading(tif, dp))
6581
                    {
6582
                        if (data != 0)
6583
                            _TIFFfreeExt(tif, data);
6584
                        return 0;
6585
                    }
6586
                    int m;
6587
                    m = TIFFSetField(tif, dp->tdir_tag, data);
6588
                    if (data != 0)
6589
                        _TIFFfreeExt(tif, data);
6590
                    if (!m)
6591
                        return (0);
6592
                }
6593
            }
6594
        }
6595
        break;
6596
        case TIFF_SETGET_C0_SINT8:
6597
        {
6598
            int8_t *data;
6599
            assert(fip->field_readcount >= 1);
6600
            assert(fip->field_passcount == 0);
6601
            if (dp->tdir_count != (uint64_t)fip->field_readcount)
6602
            {
6603
                TIFFWarningExtR(tif, module,
6604
                                "incorrect count for field \"%s\", expected "
6605
                                "%d, got %" PRIu64,
6606
                                fip->field_name, (int)fip->field_readcount,
6607
                                dp->tdir_count);
6608
                return (0);
6609
            }
6610
            else
6611
            {
6612
                err = TIFFReadDirEntrySbyteArray(tif, dp, &data);
6613
                if (err == TIFFReadDirEntryErrOk)
6614
                {
6615
                    if (!EvaluateIFDdatasizeReading(tif, dp))
6616
                    {
6617
                        if (data != 0)
6618
                            _TIFFfreeExt(tif, data);
6619
                        return 0;
6620
                    }
6621
                    int m;
6622
                    m = TIFFSetField(tif, dp->tdir_tag, data);
6623
                    if (data != 0)
6624
                        _TIFFfreeExt(tif, data);
6625
                    if (!m)
6626
                        return (0);
6627
                }
6628
            }
6629
        }
6630
        break;
6631
        case TIFF_SETGET_C0_UINT16:
6632
        {
6633
            uint16_t *data;
6634
            assert(fip->field_readcount >= 1);
6635
            assert(fip->field_passcount == 0);
6636
            if (dp->tdir_count != (uint64_t)fip->field_readcount)
6637
            {
6638
                TIFFWarningExtR(tif, module,
6639
                                "incorrect count for field \"%s\", expected "
6640
                                "%d, got %" PRIu64,
6641
                                fip->field_name, (int)fip->field_readcount,
6642
                                dp->tdir_count);
6643
                return (0);
6644
            }
6645
            else
6646
            {
6647
                err = TIFFReadDirEntryShortArray(tif, dp, &data);
6648
                if (err == TIFFReadDirEntryErrOk)
6649
                {
6650
                    if (!EvaluateIFDdatasizeReading(tif, dp))
6651
                    {
6652
                        if (data != 0)
6653
                            _TIFFfreeExt(tif, data);
6654
                        return 0;
6655
                    }
6656
                    int m;
6657
                    m = TIFFSetField(tif, dp->tdir_tag, data);
6658
                    if (data != 0)
6659
                        _TIFFfreeExt(tif, data);
6660
                    if (!m)
6661
                        return (0);
6662
                }
6663
            }
6664
        }
6665
        break;
6666
        case TIFF_SETGET_C0_SINT16:
6667
        {
6668
            int16_t *data;
6669
            assert(fip->field_readcount >= 1);
6670
            assert(fip->field_passcount == 0);
6671
            if (dp->tdir_count != (uint64_t)fip->field_readcount)
6672
            {
6673
                TIFFWarningExtR(tif, module,
6674
                                "incorrect count for field \"%s\", expected "
6675
                                "%d, got %" PRIu64,
6676
                                fip->field_name, (int)fip->field_readcount,
6677
                                dp->tdir_count);
6678
                return (0);
6679
            }
6680
            else
6681
            {
6682
                err = TIFFReadDirEntrySshortArray(tif, dp, &data);
6683
                if (err == TIFFReadDirEntryErrOk)
6684
                {
6685
                    if (!EvaluateIFDdatasizeReading(tif, dp))
6686
                    {
6687
                        if (data != 0)
6688
                            _TIFFfreeExt(tif, data);
6689
                        return 0;
6690
                    }
6691
                    int m;
6692
                    m = TIFFSetField(tif, dp->tdir_tag, data);
6693
                    if (data != 0)
6694
                        _TIFFfreeExt(tif, data);
6695
                    if (!m)
6696
                        return (0);
6697
                }
6698
            }
6699
        }
6700
        break;
6701
        case TIFF_SETGET_C0_UINT32:
6702
        {
6703
            uint32_t *data;
6704
            assert(fip->field_readcount >= 1);
6705
            assert(fip->field_passcount == 0);
6706
            if (dp->tdir_count != (uint64_t)fip->field_readcount)
6707
            {
6708
                TIFFWarningExtR(tif, module,
6709
                                "incorrect count for field \"%s\", expected "
6710
                                "%d, got %" PRIu64,
6711
                                fip->field_name, (int)fip->field_readcount,
6712
                                dp->tdir_count);
6713
                return (0);
6714
            }
6715
            else
6716
            {
6717
                err = TIFFReadDirEntryLongArray(tif, dp, &data);
6718
                if (err == TIFFReadDirEntryErrOk)
6719
                {
6720
                    if (!EvaluateIFDdatasizeReading(tif, dp))
6721
                    {
6722
                        if (data != 0)
6723
                            _TIFFfreeExt(tif, data);
6724
                        return 0;
6725
                    }
6726
                    int m;
6727
                    m = TIFFSetField(tif, dp->tdir_tag, data);
6728
                    if (data != 0)
6729
                        _TIFFfreeExt(tif, data);
6730
                    if (!m)
6731
                        return (0);
6732
                }
6733
            }
6734
        }
6735
        break;
6736
        case TIFF_SETGET_C0_SINT32:
6737
        {
6738
            int32_t *data;
6739
            assert(fip->field_readcount >= 1);
6740
            assert(fip->field_passcount == 0);
6741
            if (dp->tdir_count != (uint64_t)fip->field_readcount)
6742
            {
6743
                TIFFWarningExtR(tif, module,
6744
                                "incorrect count for field \"%s\", expected "
6745
                                "%d, got %" PRIu64,
6746
                                fip->field_name, (int)fip->field_readcount,
6747
                                dp->tdir_count);
6748
                return (0);
6749
            }
6750
            else
6751
            {
6752
                err = TIFFReadDirEntrySlongArray(tif, dp, &data);
6753
                if (err == TIFFReadDirEntryErrOk)
6754
                {
6755
                    if (!EvaluateIFDdatasizeReading(tif, dp))
6756
                    {
6757
                        if (data != 0)
6758
                            _TIFFfreeExt(tif, data);
6759
                        return 0;
6760
                    }
6761
                    int m;
6762
                    m = TIFFSetField(tif, dp->tdir_tag, data);
6763
                    if (data != 0)
6764
                        _TIFFfreeExt(tif, data);
6765
                    if (!m)
6766
                        return (0);
6767
                }
6768
            }
6769
        }
6770
        break;
6771
        case TIFF_SETGET_C0_UINT64:
6772
        {
6773
            uint64_t *data;
6774
            assert(fip->field_readcount >= 1);
6775
            assert(fip->field_passcount == 0);
6776
            if (dp->tdir_count != (uint64_t)fip->field_readcount)
6777
            {
6778
                TIFFWarningExtR(tif, module,
6779
                                "incorrect count for field \"%s\", expected "
6780
                                "%d, got %" PRIu64,
6781
                                fip->field_name, (int)fip->field_readcount,
6782
                                dp->tdir_count);
6783
                return (0);
6784
            }
6785
            else
6786
            {
6787
                err = TIFFReadDirEntryLong8Array(tif, dp, &data);
6788
                if (err == TIFFReadDirEntryErrOk)
6789
                {
6790
                    if (!EvaluateIFDdatasizeReading(tif, dp))
6791
                    {
6792
                        if (data != 0)
6793
                            _TIFFfreeExt(tif, data);
6794
                        return 0;
6795
                    }
6796
                    int m;
6797
                    m = TIFFSetField(tif, dp->tdir_tag, data);
6798
                    if (data != 0)
6799
                        _TIFFfreeExt(tif, data);
6800
                    if (!m)
6801
                        return (0);
6802
                }
6803
            }
6804
        }
6805
        break;
6806
        case TIFF_SETGET_C0_SINT64:
6807
        {
6808
            int64_t *data;
6809
            assert(fip->field_readcount >= 1);
6810
            assert(fip->field_passcount == 0);
6811
            if (dp->tdir_count != (uint64_t)fip->field_readcount)
6812
            {
6813
                TIFFWarningExtR(tif, module,
6814
                                "incorrect count for field \"%s\", expected "
6815
                                "%d, got %" PRIu64,
6816
                                fip->field_name, (int)fip->field_readcount,
6817
                                dp->tdir_count);
6818
                return (0);
6819
            }
6820
            else
6821
            {
6822
                err = TIFFReadDirEntrySlong8Array(tif, dp, &data);
6823
                if (err == TIFFReadDirEntryErrOk)
6824
                {
6825
                    if (!EvaluateIFDdatasizeReading(tif, dp))
6826
                    {
6827
                        if (data != 0)
6828
                            _TIFFfreeExt(tif, data);
6829
                        return 0;
6830
                    }
6831
                    int m;
6832
                    m = TIFFSetField(tif, dp->tdir_tag, data);
6833
                    if (data != 0)
6834
                        _TIFFfreeExt(tif, data);
6835
                    if (!m)
6836
                        return (0);
6837
                }
6838
            }
6839
        }
6840
        break;
6841
        case TIFF_SETGET_C0_FLOAT:
6842
        {
6843
            float *data;
6844
            assert(fip->field_readcount >= 1);
6845
            assert(fip->field_passcount == 0);
6846
            if (dp->tdir_count != (uint64_t)fip->field_readcount)
6847
            {
6848
                TIFFWarningExtR(tif, module,
6849
                                "incorrect count for field \"%s\", expected "
6850
                                "%d, got %" PRIu64,
6851
                                fip->field_name, (int)fip->field_readcount,
6852
                                dp->tdir_count);
6853
                return (0);
6854
            }
6855
            else
6856
            {
6857
                err = TIFFReadDirEntryFloatArray(tif, dp, &data);
6858
                if (err == TIFFReadDirEntryErrOk)
6859
                {
6860
                    if (!EvaluateIFDdatasizeReading(tif, dp))
6861
                    {
6862
                        if (data != 0)
6863
                            _TIFFfreeExt(tif, data);
6864
                        return 0;
6865
                    }
6866
                    int m;
6867
                    m = TIFFSetField(tif, dp->tdir_tag, data);
6868
                    if (data != 0)
6869
                        _TIFFfreeExt(tif, data);
6870
                    if (!m)
6871
                        return (0);
6872
                }
6873
            }
6874
        }
6875
        break;
6876
        /*--: Rational2Double: Extend for Double Arrays and Rational-Arrays read
6877
         * into Double-Arrays. */
6878
        case TIFF_SETGET_C0_DOUBLE:
6879
        {
6880
            double *data;
6881
            assert(fip->field_readcount >= 1);
6882
            assert(fip->field_passcount == 0);
6883
            if (dp->tdir_count != (uint64_t)fip->field_readcount)
6884
            {
6885
                TIFFWarningExtR(tif, module,
6886
                                "incorrect count for field \"%s\", expected "
6887
                                "%d, got %" PRIu64,
6888
                                fip->field_name, (int)fip->field_readcount,
6889
                                dp->tdir_count);
6890
                return (0);
6891
            }
6892
            else
6893
            {
6894
                err = TIFFReadDirEntryDoubleArray(tif, dp, &data);
6895
                if (err == TIFFReadDirEntryErrOk)
6896
                {
6897
                    if (!EvaluateIFDdatasizeReading(tif, dp))
6898
                    {
6899
                        if (data != 0)
6900
                            _TIFFfreeExt(tif, data);
6901
                        return 0;
6902
                    }
6903
                    int m;
6904
                    m = TIFFSetField(tif, dp->tdir_tag, data);
6905
                    if (data != 0)
6906
                        _TIFFfreeExt(tif, data);
6907
                    if (!m)
6908
                        return (0);
6909
                }
6910
            }
6911
        }
6912
        break;
6913
        case TIFF_SETGET_C16_ASCII:
6914
        {
6915
            uint8_t *data;
6916
            assert(fip->field_readcount == TIFF_VARIABLE);
6917
            assert(fip->field_passcount == 1);
6918
            if (dp->tdir_count > 0xFFFF)
6919
                err = TIFFReadDirEntryErrCount;
6920
            else
6921
            {
6922
                err = TIFFReadDirEntryByteArray(tif, dp, &data);
6923
                if (err == TIFFReadDirEntryErrOk)
6924
                {
6925
                    if (!EvaluateIFDdatasizeReading(tif, dp))
6926
                    {
6927
                        if (data != 0)
6928
                            _TIFFfreeExt(tif, data);
6929
                        return 0;
6930
                    }
6931
                    int m;
6932
                    if (data != 0 && dp->tdir_count > 0 &&
6933
                        data[dp->tdir_count - 1] != '\0')
6934
                    {
6935
                        TIFFWarningExtR(tif, module,
6936
                                        "ASCII value for ASCII array tag "
6937
                                        "\"%s\" does not end in null "
6938
                                        "byte. Forcing it to be null",
6939
                                        fip->field_name);
6940
                        /* Enlarge buffer and add terminating null. */
6941
                        uint8_t *o =
6942
                            _TIFFmallocExt(tif, (uint32_t)dp->tdir_count + 1);
6943
                        if (o == NULL)
6944
                        {
6945
                            if (data != NULL)
6946
                                _TIFFfreeExt(tif, data);
6947
                            return (0);
6948
                        }
6949
                        if (dp->tdir_count > 0)
6950
                        {
6951
                            _TIFFmemcpy(o, data, (uint32_t)dp->tdir_count);
6952
                        }
6953
                        o[(uint32_t)dp->tdir_count] = 0;
6954
                        dp->tdir_count++; /* Increment for added null. */
6955
                        if (data != 0)
6956
                            _TIFFfreeExt(tif, data);
6957
                        data = o;
6958
                    }
6959
                    m = TIFFSetField(tif, dp->tdir_tag,
6960
                                     (uint16_t)(dp->tdir_count), data);
6961
                    if (data != 0)
6962
                        _TIFFfreeExt(tif, data);
6963
                    if (!m)
6964
                        return (0);
6965
                }
6966
            }
6967
        }
6968
        break;
6969
        case TIFF_SETGET_C16_UINT8:
6970
        {
6971
            uint8_t *data;
6972
            assert(fip->field_readcount == TIFF_VARIABLE);
6973
            assert(fip->field_passcount == 1);
6974
            if (dp->tdir_count > 0xFFFF)
6975
                err = TIFFReadDirEntryErrCount;
6976
            else
6977
            {
6978
                err = TIFFReadDirEntryByteArray(tif, dp, &data);
6979
                if (err == TIFFReadDirEntryErrOk)
6980
                {
6981
                    if (!EvaluateIFDdatasizeReading(tif, dp))
6982
                    {
6983
                        if (data != 0)
6984
                            _TIFFfreeExt(tif, data);
6985
                        return 0;
6986
                    }
6987
                    int m;
6988
                    m = TIFFSetField(tif, dp->tdir_tag,
6989
                                     (uint16_t)(dp->tdir_count), data);
6990
                    if (data != 0)
6991
                        _TIFFfreeExt(tif, data);
6992
                    if (!m)
6993
                        return (0);
6994
                }
6995
            }
6996
        }
6997
        break;
6998
        case TIFF_SETGET_C16_SINT8:
6999
        {
7000
            int8_t *data;
7001
            assert(fip->field_readcount == TIFF_VARIABLE);
7002
            assert(fip->field_passcount == 1);
7003
            if (dp->tdir_count > 0xFFFF)
7004
                err = TIFFReadDirEntryErrCount;
7005
            else
7006
            {
7007
                err = TIFFReadDirEntrySbyteArray(tif, dp, &data);
7008
                if (err == TIFFReadDirEntryErrOk)
7009
                {
7010
                    if (!EvaluateIFDdatasizeReading(tif, dp))
7011
                    {
7012
                        if (data != 0)
7013
                            _TIFFfreeExt(tif, data);
7014
                        return 0;
7015
                    }
7016
                    int m;
7017
                    m = TIFFSetField(tif, dp->tdir_tag,
7018
                                     (uint16_t)(dp->tdir_count), data);
7019
                    if (data != 0)
7020
                        _TIFFfreeExt(tif, data);
7021
                    if (!m)
7022
                        return (0);
7023
                }
7024
            }
7025
        }
7026
        break;
7027
        case TIFF_SETGET_C16_UINT16:
7028
        {
7029
            uint16_t *data;
7030
            assert(fip->field_readcount == TIFF_VARIABLE);
7031
            assert(fip->field_passcount == 1);
7032
            if (dp->tdir_count > 0xFFFF)
7033
                err = TIFFReadDirEntryErrCount;
7034
            else
7035
            {
7036
                err = TIFFReadDirEntryShortArray(tif, dp, &data);
7037
                if (err == TIFFReadDirEntryErrOk)
7038
                {
7039
                    if (!EvaluateIFDdatasizeReading(tif, dp))
7040
                    {
7041
                        if (data != 0)
7042
                            _TIFFfreeExt(tif, data);
7043
                        return 0;
7044
                    }
7045
                    int m;
7046
                    m = TIFFSetField(tif, dp->tdir_tag,
7047
                                     (uint16_t)(dp->tdir_count), data);
7048
                    if (data != 0)
7049
                        _TIFFfreeExt(tif, data);
7050
                    if (!m)
7051
                        return (0);
7052
                }
7053
            }
7054
        }
7055
        break;
7056
        case TIFF_SETGET_C16_SINT16:
7057
        {
7058
            int16_t *data;
7059
            assert(fip->field_readcount == TIFF_VARIABLE);
7060
            assert(fip->field_passcount == 1);
7061
            if (dp->tdir_count > 0xFFFF)
7062
                err = TIFFReadDirEntryErrCount;
7063
            else
7064
            {
7065
                err = TIFFReadDirEntrySshortArray(tif, dp, &data);
7066
                if (err == TIFFReadDirEntryErrOk)
7067
                {
7068
                    if (!EvaluateIFDdatasizeReading(tif, dp))
7069
                    {
7070
                        if (data != 0)
7071
                            _TIFFfreeExt(tif, data);
7072
                        return 0;
7073
                    }
7074
                    int m;
7075
                    m = TIFFSetField(tif, dp->tdir_tag,
7076
                                     (uint16_t)(dp->tdir_count), data);
7077
                    if (data != 0)
7078
                        _TIFFfreeExt(tif, data);
7079
                    if (!m)
7080
                        return (0);
7081
                }
7082
            }
7083
        }
7084
        break;
7085
        case TIFF_SETGET_C16_UINT32:
7086
        {
7087
            uint32_t *data;
7088
            assert(fip->field_readcount == TIFF_VARIABLE);
7089
            assert(fip->field_passcount == 1);
7090
            if (dp->tdir_count > 0xFFFF)
7091
                err = TIFFReadDirEntryErrCount;
7092
            else
7093
            {
7094
                err = TIFFReadDirEntryLongArray(tif, dp, &data);
7095
                if (err == TIFFReadDirEntryErrOk)
7096
                {
7097
                    if (!EvaluateIFDdatasizeReading(tif, dp))
7098
                    {
7099
                        if (data != 0)
7100
                            _TIFFfreeExt(tif, data);
7101
                        return 0;
7102
                    }
7103
                    int m;
7104
                    m = TIFFSetField(tif, dp->tdir_tag,
7105
                                     (uint16_t)(dp->tdir_count), data);
7106
                    if (data != 0)
7107
                        _TIFFfreeExt(tif, data);
7108
                    if (!m)
7109
                        return (0);
7110
                }
7111
            }
7112
        }
7113
        break;
7114
        case TIFF_SETGET_C16_SINT32:
7115
        {
7116
            int32_t *data;
7117
            assert(fip->field_readcount == TIFF_VARIABLE);
7118
            assert(fip->field_passcount == 1);
7119
            if (dp->tdir_count > 0xFFFF)
7120
                err = TIFFReadDirEntryErrCount;
7121
            else
7122
            {
7123
                err = TIFFReadDirEntrySlongArray(tif, dp, &data);
7124
                if (err == TIFFReadDirEntryErrOk)
7125
                {
7126
                    if (!EvaluateIFDdatasizeReading(tif, dp))
7127
                    {
7128
                        if (data != 0)
7129
                            _TIFFfreeExt(tif, data);
7130
                        return 0;
7131
                    }
7132
                    int m;
7133
                    m = TIFFSetField(tif, dp->tdir_tag,
7134
                                     (uint16_t)(dp->tdir_count), data);
7135
                    if (data != 0)
7136
                        _TIFFfreeExt(tif, data);
7137
                    if (!m)
7138
                        return (0);
7139
                }
7140
            }
7141
        }
7142
        break;
7143
        case TIFF_SETGET_C16_UINT64:
7144
        {
7145
            uint64_t *data;
7146
            assert(fip->field_readcount == TIFF_VARIABLE);
7147
            assert(fip->field_passcount == 1);
7148
            if (dp->tdir_count > 0xFFFF)
7149
                err = TIFFReadDirEntryErrCount;
7150
            else
7151
            {
7152
                err = TIFFReadDirEntryLong8Array(tif, dp, &data);
7153
                if (err == TIFFReadDirEntryErrOk)
7154
                {
7155
                    if (!EvaluateIFDdatasizeReading(tif, dp))
7156
                    {
7157
                        if (data != 0)
7158
                            _TIFFfreeExt(tif, data);
7159
                        return 0;
7160
                    }
7161
                    int m;
7162
                    m = TIFFSetField(tif, dp->tdir_tag,
7163
                                     (uint16_t)(dp->tdir_count), data);
7164
                    if (data != 0)
7165
                        _TIFFfreeExt(tif, data);
7166
                    if (!m)
7167
                        return (0);
7168
                }
7169
            }
7170
        }
7171
        break;
7172
        case TIFF_SETGET_C16_SINT64:
7173
        {
7174
            int64_t *data;
7175
            assert(fip->field_readcount == TIFF_VARIABLE);
7176
            assert(fip->field_passcount == 1);
7177
            if (dp->tdir_count > 0xFFFF)
7178
                err = TIFFReadDirEntryErrCount;
7179
            else
7180
            {
7181
                err = TIFFReadDirEntrySlong8Array(tif, dp, &data);
7182
                if (err == TIFFReadDirEntryErrOk)
7183
                {
7184
                    if (!EvaluateIFDdatasizeReading(tif, dp))
7185
                    {
7186
                        if (data != 0)
7187
                            _TIFFfreeExt(tif, data);
7188
                        return 0;
7189
                    }
7190
                    int m;
7191
                    m = TIFFSetField(tif, dp->tdir_tag,
7192
                                     (uint16_t)(dp->tdir_count), data);
7193
                    if (data != 0)
7194
                        _TIFFfreeExt(tif, data);
7195
                    if (!m)
7196
                        return (0);
7197
                }
7198
            }
7199
        }
7200
        break;
7201
        case TIFF_SETGET_C16_FLOAT:
7202
        {
7203
            float *data;
7204
            assert(fip->field_readcount == TIFF_VARIABLE);
7205
            assert(fip->field_passcount == 1);
7206
            if (dp->tdir_count > 0xFFFF)
7207
                err = TIFFReadDirEntryErrCount;
7208
            else
7209
            {
7210
                err = TIFFReadDirEntryFloatArray(tif, dp, &data);
7211
                if (err == TIFFReadDirEntryErrOk)
7212
                {
7213
                    if (!EvaluateIFDdatasizeReading(tif, dp))
7214
                    {
7215
                        if (data != 0)
7216
                            _TIFFfreeExt(tif, data);
7217
                        return 0;
7218
                    }
7219
                    int m;
7220
                    m = TIFFSetField(tif, dp->tdir_tag,
7221
                                     (uint16_t)(dp->tdir_count), data);
7222
                    if (data != 0)
7223
                        _TIFFfreeExt(tif, data);
7224
                    if (!m)
7225
                        return (0);
7226
                }
7227
            }
7228
        }
7229
        break;
7230
        case TIFF_SETGET_C16_DOUBLE:
7231
        {
7232
            double *data;
7233
            assert(fip->field_readcount == TIFF_VARIABLE);
7234
            assert(fip->field_passcount == 1);
7235
            if (dp->tdir_count > 0xFFFF)
7236
                err = TIFFReadDirEntryErrCount;
7237
            else
7238
            {
7239
                err = TIFFReadDirEntryDoubleArray(tif, dp, &data);
7240
                if (err == TIFFReadDirEntryErrOk)
7241
                {
7242
                    if (!EvaluateIFDdatasizeReading(tif, dp))
7243
                    {
7244
                        if (data != 0)
7245
                            _TIFFfreeExt(tif, data);
7246
                        return 0;
7247
                    }
7248
                    int m;
7249
                    m = TIFFSetField(tif, dp->tdir_tag,
7250
                                     (uint16_t)(dp->tdir_count), data);
7251
                    if (data != 0)
7252
                        _TIFFfreeExt(tif, data);
7253
                    if (!m)
7254
                        return (0);
7255
                }
7256
            }
7257
        }
7258
        break;
7259
        case TIFF_SETGET_C16_IFD8:
7260
        {
7261
            uint64_t *data;
7262
            assert(fip->field_readcount == TIFF_VARIABLE);
7263
            assert(fip->field_passcount == 1);
7264
            if (dp->tdir_count > 0xFFFF)
7265
                err = TIFFReadDirEntryErrCount;
7266
            else
7267
            {
7268
                err = TIFFReadDirEntryIfd8Array(tif, dp, &data);
7269
                if (err == TIFFReadDirEntryErrOk)
7270
                {
7271
                    if (!EvaluateIFDdatasizeReading(tif, dp))
7272
                    {
7273
                        if (data != 0)
7274
                            _TIFFfreeExt(tif, data);
7275
                        return 0;
7276
                    }
7277
                    int m;
7278
                    m = TIFFSetField(tif, dp->tdir_tag,
7279
                                     (uint16_t)(dp->tdir_count), data);
7280
                    if (data != 0)
7281
                        _TIFFfreeExt(tif, data);
7282
                    if (!m)
7283
                        return (0);
7284
                }
7285
            }
7286
        }
7287
        break;
7288
        case TIFF_SETGET_C32_ASCII:
7289
        {
7290
            uint8_t *data;
7291
            assert(fip->field_readcount == TIFF_VARIABLE2);
7292
            assert(fip->field_passcount == 1);
7293
            err = TIFFReadDirEntryByteArray(tif, dp, &data);
7294
            if (err == TIFFReadDirEntryErrOk)
7295
            {
7296
                if (!EvaluateIFDdatasizeReading(tif, dp))
7297
                {
7298
                    if (data != 0)
7299
                        _TIFFfreeExt(tif, data);
7300
                    return 0;
7301
                }
7302
                int m;
7303
                if (data != 0 && dp->tdir_count > 0 &&
7304
                    data[dp->tdir_count - 1] != '\0')
7305
                {
7306
                    TIFFWarningExtR(
7307
                        tif, module,
7308
                        "ASCII value for ASCII array tag \"%s\" does not end "
7309
                        "in null byte. Forcing it to be null",
7310
                        fip->field_name);
7311
                    /* Enlarge buffer and add terminating null. */
7312
                    uint8_t *o =
7313
                        _TIFFmallocExt(tif, (uint32_t)dp->tdir_count + 1);
7314
                    if (o == NULL)
7315
                    {
7316
                        if (data != NULL)
7317
                            _TIFFfreeExt(tif, data);
7318
                        return (0);
7319
                    }
7320
                    if (dp->tdir_count > 0)
7321
                    {
7322
                        _TIFFmemcpy(o, data, (uint32_t)dp->tdir_count);
7323
                    }
7324
                    o[(uint32_t)dp->tdir_count] = 0;
7325
                    dp->tdir_count++; /* Increment for added null. */
7326
                    if (data != 0)
7327
                        _TIFFfreeExt(tif, data);
7328
                    data = o;
7329
                }
7330
                m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
7331
                                 data);
7332
                if (data != 0)
7333
                    _TIFFfreeExt(tif, data);
7334
                if (!m)
7335
                    return (0);
7336
            }
7337
        }
7338
        break;
7339
        case TIFF_SETGET_C32_UINT8:
7340
        {
7341
            uint8_t *data;
7342
            uint32_t count = 0;
7343
            assert(fip->field_readcount == TIFF_VARIABLE2);
7344
            assert(fip->field_passcount == 1);
7345
            if (fip->field_tag == TIFFTAG_RICHTIFFIPTC &&
7346
                dp->tdir_type == TIFF_LONG)
7347
            {
7348
                /* Adobe's software (wrongly) writes RichTIFFIPTC tag with
7349
                 * data type LONG instead of UNDEFINED. Work around this
7350
                 * frequently found issue */
7351
                void *origdata;
7352
                err = TIFFReadDirEntryArray(tif, dp, &count, 4, &origdata);
7353
                if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
7354
                {
7355
                    data = NULL;
7356
                }
7357
                else
7358
                {
7359
                    if (tif->tif_flags & TIFF_SWAB)
7360
                        TIFFSwabArrayOfLong((uint32_t *)origdata, count);
7361
                    data = (uint8_t *)origdata;
7362
                    count = (uint32_t)(count * 4);
7363
                }
7364
            }
7365
            else
7366
            {
7367
                err = TIFFReadDirEntryByteArray(tif, dp, &data);
7368
                count = (uint32_t)(dp->tdir_count);
7369
            }
7370
            if (err == TIFFReadDirEntryErrOk)
7371
            {
7372
                if (!EvaluateIFDdatasizeReading(tif, dp))
7373
                {
7374
                    if (data != 0)
7375
                        _TIFFfreeExt(tif, data);
7376
                    return 0;
7377
                }
7378
                int m;
7379
                m = TIFFSetField(tif, dp->tdir_tag, count, data);
7380
                if (data != 0)
7381
                    _TIFFfreeExt(tif, data);
7382
                if (!m)
7383
                    return (0);
7384
            }
7385
        }
7386
        break;
7387
        case TIFF_SETGET_C32_SINT8:
7388
        {
7389
            int8_t *data = NULL;
7390
            assert(fip->field_readcount == TIFF_VARIABLE2);
7391
            assert(fip->field_passcount == 1);
7392
            err = TIFFReadDirEntrySbyteArray(tif, dp, &data);
7393
            if (err == TIFFReadDirEntryErrOk)
7394
            {
7395
                if (!EvaluateIFDdatasizeReading(tif, dp))
7396
                {
7397
                    if (data != 0)
7398
                        _TIFFfreeExt(tif, data);
7399
                    return 0;
7400
                }
7401
                int m;
7402
                m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
7403
                                 data);
7404
                if (data != 0)
7405
                    _TIFFfreeExt(tif, data);
7406
                if (!m)
7407
                    return (0);
7408
            }
7409
        }
7410
        break;
7411
        case TIFF_SETGET_C32_UINT16:
7412
        {
7413
            uint16_t *data;
7414
            assert(fip->field_readcount == TIFF_VARIABLE2);
7415
            assert(fip->field_passcount == 1);
7416
            err = TIFFReadDirEntryShortArray(tif, dp, &data);
7417
            if (err == TIFFReadDirEntryErrOk)
7418
            {
7419
                if (!EvaluateIFDdatasizeReading(tif, dp))
7420
                {
7421
                    if (data != 0)
7422
                        _TIFFfreeExt(tif, data);
7423
                    return 0;
7424
                }
7425
                int m;
7426
                m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
7427
                                 data);
7428
                if (data != 0)
7429
                    _TIFFfreeExt(tif, data);
7430
                if (!m)
7431
                    return (0);
7432
            }
7433
        }
7434
        break;
7435
        case TIFF_SETGET_C32_SINT16:
7436
        {
7437
            int16_t *data = NULL;
7438
            assert(fip->field_readcount == TIFF_VARIABLE2);
7439
            assert(fip->field_passcount == 1);
7440
            err = TIFFReadDirEntrySshortArray(tif, dp, &data);
7441
            if (err == TIFFReadDirEntryErrOk)
7442
            {
7443
                if (!EvaluateIFDdatasizeReading(tif, dp))
7444
                {
7445
                    if (data != 0)
7446
                        _TIFFfreeExt(tif, data);
7447
                    return 0;
7448
                }
7449
                int m;
7450
                m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
7451
                                 data);
7452
                if (data != 0)
7453
                    _TIFFfreeExt(tif, data);
7454
                if (!m)
7455
                    return (0);
7456
            }
7457
        }
7458
        break;
7459
        case TIFF_SETGET_C32_UINT32:
7460
        {
7461
            uint32_t *data;
7462
            assert(fip->field_readcount == TIFF_VARIABLE2);
7463
            assert(fip->field_passcount == 1);
7464
            err = TIFFReadDirEntryLongArray(tif, dp, &data);
7465
            if (err == TIFFReadDirEntryErrOk)
7466
            {
7467
                if (!EvaluateIFDdatasizeReading(tif, dp))
7468
                {
7469
                    if (data != 0)
7470
                        _TIFFfreeExt(tif, data);
7471
                    return 0;
7472
                }
7473
                int m;
7474
                m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
7475
                                 data);
7476
                if (data != 0)
7477
                    _TIFFfreeExt(tif, data);
7478
                if (!m)
7479
                    return (0);
7480
            }
7481
        }
7482
        break;
7483
        case TIFF_SETGET_C32_SINT32:
7484
        {
7485
            int32_t *data = NULL;
7486
            assert(fip->field_readcount == TIFF_VARIABLE2);
7487
            assert(fip->field_passcount == 1);
7488
            err = TIFFReadDirEntrySlongArray(tif, dp, &data);
7489
            if (err == TIFFReadDirEntryErrOk)
7490
            {
7491
                if (!EvaluateIFDdatasizeReading(tif, dp))
7492
                {
7493
                    if (data != 0)
7494
                        _TIFFfreeExt(tif, data);
7495
                    return 0;
7496
                }
7497
                int m;
7498
                m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
7499
                                 data);
7500
                if (data != 0)
7501
                    _TIFFfreeExt(tif, data);
7502
                if (!m)
7503
                    return (0);
7504
            }
7505
        }
7506
        break;
7507
        case TIFF_SETGET_C32_UINT64:
7508
        {
7509
            uint64_t *data;
7510
            assert(fip->field_readcount == TIFF_VARIABLE2);
7511
            assert(fip->field_passcount == 1);
7512
            err = TIFFReadDirEntryLong8Array(tif, dp, &data);
7513
            if (err == TIFFReadDirEntryErrOk)
7514
            {
7515
                if (!EvaluateIFDdatasizeReading(tif, dp))
7516
                {
7517
                    if (data != 0)
7518
                        _TIFFfreeExt(tif, data);
7519
                    return 0;
7520
                }
7521
                int m;
7522
                m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
7523
                                 data);
7524
                if (data != 0)
7525
                    _TIFFfreeExt(tif, data);
7526
                if (!m)
7527
                    return (0);
7528
            }
7529
        }
7530
        break;
7531
        case TIFF_SETGET_C32_SINT64:
7532
        {
7533
            int64_t *data = NULL;
7534
            assert(fip->field_readcount == TIFF_VARIABLE2);
7535
            assert(fip->field_passcount == 1);
7536
            err = TIFFReadDirEntrySlong8Array(tif, dp, &data);
7537
            if (err == TIFFReadDirEntryErrOk)
7538
            {
7539
                if (!EvaluateIFDdatasizeReading(tif, dp))
7540
                {
7541
                    if (data != 0)
7542
                        _TIFFfreeExt(tif, data);
7543
                    return 0;
7544
                }
7545
                int m;
7546
                m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
7547
                                 data);
7548
                if (data != 0)
7549
                    _TIFFfreeExt(tif, data);
7550
                if (!m)
7551
                    return (0);
7552
            }
7553
        }
7554
        break;
7555
        case TIFF_SETGET_C32_FLOAT:
7556
        {
7557
            float *data;
7558
            assert(fip->field_readcount == TIFF_VARIABLE2);
7559
            assert(fip->field_passcount == 1);
7560
            err = TIFFReadDirEntryFloatArray(tif, dp, &data);
7561
            if (err == TIFFReadDirEntryErrOk)
7562
            {
7563
                if (!EvaluateIFDdatasizeReading(tif, dp))
7564
                {
7565
                    if (data != 0)
7566
                        _TIFFfreeExt(tif, data);
7567
                    return 0;
7568
                }
7569
                int m;
7570
                m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
7571
                                 data);
7572
                if (data != 0)
7573
                    _TIFFfreeExt(tif, data);
7574
                if (!m)
7575
                    return (0);
7576
            }
7577
        }
7578
        break;
7579
        case TIFF_SETGET_C32_DOUBLE:
7580
        {
7581
            double *data;
7582
            assert(fip->field_readcount == TIFF_VARIABLE2);
7583
            assert(fip->field_passcount == 1);
7584
            err = TIFFReadDirEntryDoubleArray(tif, dp, &data);
7585
            if (err == TIFFReadDirEntryErrOk)
7586
            {
7587
                if (!EvaluateIFDdatasizeReading(tif, dp))
7588
                {
7589
                    if (data != 0)
7590
                        _TIFFfreeExt(tif, data);
7591
                    return 0;
7592
                }
7593
                int m;
7594
                m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
7595
                                 data);
7596
                if (data != 0)
7597
                    _TIFFfreeExt(tif, data);
7598
                if (!m)
7599
                    return (0);
7600
            }
7601
        }
7602
        break;
7603
        case TIFF_SETGET_C32_IFD8:
7604
        {
7605
            uint64_t *data;
7606
            assert(fip->field_readcount == TIFF_VARIABLE2);
7607
            assert(fip->field_passcount == 1);
7608
            err = TIFFReadDirEntryIfd8Array(tif, dp, &data);
7609
            if (err == TIFFReadDirEntryErrOk)
7610
            {
7611
                if (!EvaluateIFDdatasizeReading(tif, dp))
7612
                {
7613
                    if (data != 0)
7614
                        _TIFFfreeExt(tif, data);
7615
                    return 0;
7616
                }
7617
                int m;
7618
                m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
7619
                                 data);
7620
                if (data != 0)
7621
                    _TIFFfreeExt(tif, data);
7622
                if (!m)
7623
                    return (0);
7624
            }
7625
        }
7626
        break;
7627
        default:
7628
            assert(0); /* we should never get here */
7629
            break;
7630
    }
7631
    if (err != TIFFReadDirEntryErrOk)
7632
    {
7633
        TIFFReadDirEntryOutputErr(tif, err, module, fip->field_name, recover);
7634
        return (0);
7635
    }
7636
    return (1);
7637
}
7638

7639
/*
7640
 * Fetch a set of offsets or lengths.
7641
 * While this routine says "strips", in fact it's also used for tiles.
7642
 */
7643
static int TIFFFetchStripThing(TIFF *tif, TIFFDirEntry *dir, uint32_t nstrips,
7644
                               uint64_t **lpp)
7645
{
7646
    static const char module[] = "TIFFFetchStripThing";
7647
    enum TIFFReadDirEntryErr err;
7648
    uint64_t *data;
7649
    err = TIFFReadDirEntryLong8ArrayWithLimit(tif, dir, &data, nstrips);
7650
    if (err != TIFFReadDirEntryErrOk)
7651
    {
7652
        const TIFFField *fip = TIFFFieldWithTag(tif, dir->tdir_tag);
7653
        TIFFReadDirEntryOutputErr(tif, err, module,
7654
                                  fip ? fip->field_name : "unknown tagname", 0);
7655
        return (0);
7656
    }
7657
    if (dir->tdir_count < (uint64_t)nstrips)
7658
    {
7659
        uint64_t *resizeddata;
7660
        const TIFFField *fip = TIFFFieldWithTag(tif, dir->tdir_tag);
7661
        const char *pszMax = getenv("LIBTIFF_STRILE_ARRAY_MAX_RESIZE_COUNT");
7662
        uint32_t max_nstrips = 1000000;
7663
        if (pszMax)
7664
            max_nstrips = (uint32_t)atoi(pszMax);
7665
        TIFFReadDirEntryOutputErr(tif, TIFFReadDirEntryErrCount, module,
7666
                                  fip ? fip->field_name : "unknown tagname",
7667
                                  (nstrips <= max_nstrips));
7668

7669
        if (nstrips > max_nstrips)
7670
        {
7671
            _TIFFfreeExt(tif, data);
7672
            return (0);
7673
        }
7674

7675
        const uint64_t allocsize = (uint64_t)nstrips * sizeof(uint64_t);
7676
        if (allocsize > 100 * 1024 * 1024)
7677
        {
7678
            /* Before allocating a huge amount of memory for corrupted files,
7679
             * check if size of requested memory is not greater than file size.
7680
             */
7681
            const uint64_t filesize = TIFFGetFileSize(tif);
7682
            if (allocsize > filesize)
7683
            {
7684
                TIFFWarningExtR(
7685
                    tif, module,
7686
                    "Requested memory size for StripArray of %" PRIu64
7687
                    " is greater than filesize %" PRIu64
7688
                    ". Memory not allocated",
7689
                    allocsize, filesize);
7690
                _TIFFfreeExt(tif, data);
7691
                return (0);
7692
            }
7693
        }
7694
        resizeddata = (uint64_t *)_TIFFCheckMalloc(
7695
            tif, nstrips, sizeof(uint64_t), "for strip array");
7696
        if (resizeddata == 0)
7697
        {
7698
            _TIFFfreeExt(tif, data);
7699
            return (0);
7700
        }
7701
        if (dir->tdir_count)
7702
            _TIFFmemcpy(resizeddata, data,
7703
                        (uint32_t)dir->tdir_count * sizeof(uint64_t));
7704
        _TIFFmemset(resizeddata + (uint32_t)dir->tdir_count, 0,
7705
                    (nstrips - (uint32_t)dir->tdir_count) * sizeof(uint64_t));
7706
        _TIFFfreeExt(tif, data);
7707
        data = resizeddata;
7708
    }
7709
    *lpp = data;
7710
    return (1);
7711
}
7712

7713
/*
7714
 * Fetch and set the SubjectDistance EXIF tag.
7715
 */
7716
static int TIFFFetchSubjectDistance(TIFF *tif, TIFFDirEntry *dir)
7717
{
7718
    static const char module[] = "TIFFFetchSubjectDistance";
7719
    enum TIFFReadDirEntryErr err;
7720
    UInt64Aligned_t m;
7721
    m.l = 0;
7722
    assert(sizeof(double) == 8);
7723
    assert(sizeof(uint64_t) == 8);
7724
    assert(sizeof(uint32_t) == 4);
7725
    if (dir->tdir_count != 1)
7726
        err = TIFFReadDirEntryErrCount;
7727
    else if (dir->tdir_type != TIFF_RATIONAL)
7728
        err = TIFFReadDirEntryErrType;
7729
    else
7730
    {
7731
        if (!(tif->tif_flags & TIFF_BIGTIFF))
7732
        {
7733
            uint32_t offset;
7734
            offset = *(uint32_t *)(&dir->tdir_offset);
7735
            if (tif->tif_flags & TIFF_SWAB)
7736
                TIFFSwabLong(&offset);
7737
            err = TIFFReadDirEntryData(tif, offset, 8, m.i);
7738
        }
7739
        else
7740
        {
7741
            m.l = dir->tdir_offset.toff_long8;
7742
            err = TIFFReadDirEntryErrOk;
7743
        }
7744
    }
7745
    if (err == TIFFReadDirEntryErrOk)
7746
    {
7747
        double n;
7748
        if (tif->tif_flags & TIFF_SWAB)
7749
            TIFFSwabArrayOfLong(m.i, 2);
7750
        if (m.i[0] == 0)
7751
            n = 0.0;
7752
        else if (m.i[0] == 0xFFFFFFFF || m.i[1] == 0)
7753
            /*
7754
             * XXX: Numerator 0xFFFFFFFF means that we have infinite
7755
             * distance. Indicate that with a negative floating point
7756
             * SubjectDistance value.
7757
             */
7758
            n = -1.0;
7759
        else
7760
            n = (double)m.i[0] / (double)m.i[1];
7761
        return (TIFFSetField(tif, dir->tdir_tag, n));
7762
    }
7763
    else
7764
    {
7765
        TIFFReadDirEntryOutputErr(tif, err, module, "SubjectDistance", TRUE);
7766
        return (0);
7767
    }
7768
}
7769

7770
static void allocChoppedUpStripArrays(TIFF *tif, uint32_t nstrips,
7771
                                      uint64_t stripbytes,
7772
                                      uint32_t rowsperstrip)
7773
{
7774
    TIFFDirectory *td = &tif->tif_dir;
7775
    uint64_t bytecount;
7776
    uint64_t offset;
7777
    uint64_t last_offset;
7778
    uint64_t last_bytecount;
7779
    uint32_t i;
7780
    uint64_t *newcounts;
7781
    uint64_t *newoffsets;
7782

7783
    offset = TIFFGetStrileOffset(tif, 0);
7784
    last_offset = TIFFGetStrileOffset(tif, td->td_nstrips - 1);
7785
    last_bytecount = TIFFGetStrileByteCount(tif, td->td_nstrips - 1);
7786
    if (last_offset > UINT64_MAX - last_bytecount ||
7787
        last_offset + last_bytecount < offset)
7788
    {
7789
        return;
7790
    }
7791
    bytecount = last_offset + last_bytecount - offset;
7792

7793
    /* Before allocating a huge amount of memory for corrupted files, check if
7794
     * size of StripByteCount and StripOffset tags is not greater than
7795
     * file size.
7796
     */
7797
    const uint64_t allocsize = (uint64_t)nstrips * sizeof(uint64_t) * 2;
7798
    if (allocsize > 100 * 1024 * 1024)
7799
    {
7800
        const uint64_t filesize = TIFFGetFileSize(tif);
7801
        if (allocsize > filesize)
7802
        {
7803
            TIFFWarningExtR(tif, "allocChoppedUpStripArrays",
7804
                            "Requested memory size for StripByteCount and "
7805
                            "StripOffsets %" PRIu64
7806
                            " is greater than filesize %" PRIu64
7807
                            ". Memory not allocated",
7808
                            allocsize, filesize);
7809
            return;
7810
        }
7811
    }
7812

7813
    newcounts =
7814
        (uint64_t *)_TIFFCheckMalloc(tif, nstrips, sizeof(uint64_t),
7815
                                     "for chopped \"StripByteCounts\" array");
7816
    newoffsets = (uint64_t *)_TIFFCheckMalloc(
7817
        tif, nstrips, sizeof(uint64_t), "for chopped \"StripOffsets\" array");
7818
    if (newcounts == NULL || newoffsets == NULL)
7819
    {
7820
        /*
7821
         * Unable to allocate new strip information, give up and use
7822
         * the original one strip information.
7823
         */
7824
        if (newcounts != NULL)
7825
            _TIFFfreeExt(tif, newcounts);
7826
        if (newoffsets != NULL)
7827
            _TIFFfreeExt(tif, newoffsets);
7828
        return;
7829
    }
7830

7831
    /*
7832
     * Fill the strip information arrays with new bytecounts and offsets
7833
     * that reflect the broken-up format.
7834
     */
7835
    for (i = 0; i < nstrips; i++)
7836
    {
7837
        if (stripbytes > bytecount)
7838
            stripbytes = bytecount;
7839
        newcounts[i] = stripbytes;
7840
        newoffsets[i] = stripbytes ? offset : 0;
7841
        offset += stripbytes;
7842
        bytecount -= stripbytes;
7843
    }
7844

7845
    /*
7846
     * Replace old single strip info with multi-strip info.
7847
     */
7848
    td->td_stripsperimage = td->td_nstrips = nstrips;
7849
    TIFFSetField(tif, TIFFTAG_ROWSPERSTRIP, rowsperstrip);
7850

7851
    _TIFFfreeExt(tif, td->td_stripbytecount_p);
7852
    _TIFFfreeExt(tif, td->td_stripoffset_p);
7853
    td->td_stripbytecount_p = newcounts;
7854
    td->td_stripoffset_p = newoffsets;
7855
#ifdef STRIPBYTECOUNTSORTED_UNUSED
7856
    td->td_stripbytecountsorted = 1;
7857
#endif
7858
    tif->tif_flags |= TIFF_CHOPPEDUPARRAYS;
7859
}
7860

7861
/*
7862
 * Replace a single strip (tile) of uncompressed data by multiple strips
7863
 * (tiles), each approximately STRIP_SIZE_DEFAULT bytes. This is useful for
7864
 * dealing with large images or for dealing with machines with a limited
7865
 * amount memory.
7866
 */
7867
static void ChopUpSingleUncompressedStrip(TIFF *tif)
7868
{
7869
    register TIFFDirectory *td = &tif->tif_dir;
7870
    uint64_t bytecount;
7871
    uint64_t offset;
7872
    uint32_t rowblock;
7873
    uint64_t rowblockbytes;
7874
    uint64_t stripbytes;
7875
    uint32_t nstrips;
7876
    uint32_t rowsperstrip;
7877

7878
    bytecount = TIFFGetStrileByteCount(tif, 0);
7879
    /* On a newly created file, just re-opened to be filled, we */
7880
    /* don't want strip chop to trigger as it is going to cause issues */
7881
    /* later ( StripOffsets and StripByteCounts improperly filled) . */
7882
    if (bytecount == 0 && tif->tif_mode != O_RDONLY)
7883
        return;
7884
    offset = TIFFGetStrileByteCount(tif, 0);
7885
    assert(td->td_planarconfig == PLANARCONFIG_CONTIG);
7886
    if ((td->td_photometric == PHOTOMETRIC_YCBCR) && (!isUpSampled(tif)))
7887
        rowblock = td->td_ycbcrsubsampling[1];
7888
    else
7889
        rowblock = 1;
7890
    rowblockbytes = TIFFVTileSize64(tif, rowblock);
7891
    /*
7892
     * Make the rows hold at least one scanline, but fill specified amount
7893
     * of data if possible.
7894
     */
7895
    if (rowblockbytes > STRIP_SIZE_DEFAULT)
7896
    {
7897
        stripbytes = rowblockbytes;
7898
        rowsperstrip = rowblock;
7899
    }
7900
    else if (rowblockbytes > 0)
7901
    {
7902
        uint32_t rowblocksperstrip;
7903
        rowblocksperstrip = (uint32_t)(STRIP_SIZE_DEFAULT / rowblockbytes);
7904
        rowsperstrip = rowblocksperstrip * rowblock;
7905
        stripbytes = rowblocksperstrip * rowblockbytes;
7906
    }
7907
    else
7908
        return;
7909

7910
    /*
7911
     * never increase the number of rows per strip
7912
     */
7913
    if (rowsperstrip >= td->td_rowsperstrip || rowsperstrip == 0)
7914
        return;
7915
    nstrips = TIFFhowmany_32(td->td_imagelength, rowsperstrip);
7916
    if (nstrips == 0)
7917
        return;
7918

7919
    /* If we are going to allocate a lot of memory, make sure that the */
7920
    /* file is as big as needed */
7921
    if (tif->tif_mode == O_RDONLY && nstrips > 1000000 &&
7922
        (offset >= TIFFGetFileSize(tif) ||
7923
         stripbytes > (TIFFGetFileSize(tif) - offset) / (nstrips - 1)))
7924
    {
7925
        return;
7926
    }
7927

7928
    allocChoppedUpStripArrays(tif, nstrips, stripbytes, rowsperstrip);
7929
}
7930

7931
/*
7932
 * Replace a file with contiguous strips > 2 GB of uncompressed data by
7933
 * multiple smaller strips. This is useful for
7934
 * dealing with large images or for dealing with machines with a limited
7935
 * amount memory.
7936
 */
7937
static void TryChopUpUncompressedBigTiff(TIFF *tif)
7938
{
7939
    TIFFDirectory *td = &tif->tif_dir;
7940
    uint32_t rowblock;
7941
    uint64_t rowblockbytes;
7942
    uint32_t i;
7943
    uint64_t stripsize;
7944
    uint32_t rowblocksperstrip;
7945
    uint32_t rowsperstrip;
7946
    uint64_t stripbytes;
7947
    uint32_t nstrips;
7948

7949
    stripsize = TIFFStripSize64(tif);
7950

7951
    assert(tif->tif_dir.td_planarconfig == PLANARCONFIG_CONTIG);
7952
    assert(tif->tif_dir.td_compression == COMPRESSION_NONE);
7953
    assert((tif->tif_flags & (TIFF_STRIPCHOP | TIFF_ISTILED)) ==
7954
           TIFF_STRIPCHOP);
7955
    assert(stripsize > 0x7FFFFFFFUL);
7956

7957
    /* On a newly created file, just re-opened to be filled, we */
7958
    /* don't want strip chop to trigger as it is going to cause issues */
7959
    /* later ( StripOffsets and StripByteCounts improperly filled) . */
7960
    if (TIFFGetStrileByteCount(tif, 0) == 0 && tif->tif_mode != O_RDONLY)
7961
        return;
7962

7963
    if ((td->td_photometric == PHOTOMETRIC_YCBCR) && (!isUpSampled(tif)))
7964
        rowblock = td->td_ycbcrsubsampling[1];
7965
    else
7966
        rowblock = 1;
7967
    rowblockbytes = TIFFVStripSize64(tif, rowblock);
7968
    if (rowblockbytes == 0 || rowblockbytes > 0x7FFFFFFFUL)
7969
    {
7970
        /* In case of file with gigantic width */
7971
        return;
7972
    }
7973

7974
    /* Check that the strips are contiguous and of the expected size */
7975
    for (i = 0; i < td->td_nstrips; i++)
7976
    {
7977
        if (i == td->td_nstrips - 1)
7978
        {
7979
            if (TIFFGetStrileByteCount(tif, i) <
7980
                TIFFVStripSize64(tif,
7981
                                 td->td_imagelength - i * td->td_rowsperstrip))
7982
            {
7983
                return;
7984
            }
7985
        }
7986
        else
7987
        {
7988
            if (TIFFGetStrileByteCount(tif, i) != stripsize)
7989
            {
7990
                return;
7991
            }
7992
            if (i > 0 && TIFFGetStrileOffset(tif, i) !=
7993
                             TIFFGetStrileOffset(tif, i - 1) +
7994
                                 TIFFGetStrileByteCount(tif, i - 1))
7995
            {
7996
                return;
7997
            }
7998
        }
7999
    }
8000

8001
    /* Aim for 512 MB strips (that will still be manageable by 32 bit builds */
8002
    rowblocksperstrip = (uint32_t)(512 * 1024 * 1024 / rowblockbytes);
8003
    if (rowblocksperstrip == 0)
8004
        rowblocksperstrip = 1;
8005
    rowsperstrip = rowblocksperstrip * rowblock;
8006
    stripbytes = rowblocksperstrip * rowblockbytes;
8007
    assert(stripbytes <= 0x7FFFFFFFUL);
8008

8009
    if (rowsperstrip == 0)
8010
        return;
8011
    nstrips = TIFFhowmany_32(td->td_imagelength, rowsperstrip);
8012
    if (nstrips == 0)
8013
        return;
8014

8015
    /* If we are going to allocate a lot of memory, make sure that the */
8016
    /* file is as big as needed */
8017
    if (tif->tif_mode == O_RDONLY && nstrips > 1000000)
8018
    {
8019
        uint64_t last_offset = TIFFGetStrileOffset(tif, td->td_nstrips - 1);
8020
        uint64_t filesize = TIFFGetFileSize(tif);
8021
        uint64_t last_bytecount =
8022
            TIFFGetStrileByteCount(tif, td->td_nstrips - 1);
8023
        if (last_offset > filesize || last_bytecount > filesize - last_offset)
8024
        {
8025
            return;
8026
        }
8027
    }
8028

8029
    allocChoppedUpStripArrays(tif, nstrips, stripbytes, rowsperstrip);
8030
}
8031

8032
TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
8033
static uint64_t _TIFFUnsanitizedAddUInt64AndInt(uint64_t a, int b)
8034
{
8035
    return a + b;
8036
}
8037

8038
/* Read the value of [Strip|Tile]Offset or [Strip|Tile]ByteCount around
8039
 * strip/tile of number strile. Also fetch the neighbouring values using a
8040
 * 4096 byte page size.
8041
 */
8042
static int _TIFFPartialReadStripArray(TIFF *tif, TIFFDirEntry *dirent,
8043
                                      int strile, uint64_t *panVals)
8044
{
8045
    static const char module[] = "_TIFFPartialReadStripArray";
8046
#define IO_CACHE_PAGE_SIZE 4096
8047

8048
    size_t sizeofval;
8049
    const int bSwab = (tif->tif_flags & TIFF_SWAB) != 0;
8050
    int sizeofvalint;
8051
    uint64_t nBaseOffset;
8052
    uint64_t nOffset;
8053
    uint64_t nOffsetStartPage;
8054
    uint64_t nOffsetEndPage;
8055
    tmsize_t nToRead;
8056
    tmsize_t nRead;
8057
    uint64_t nLastStripOffset;
8058
    int iStartBefore;
8059
    int i;
8060
    const uint32_t arraySize = tif->tif_dir.td_stripoffsetbyteallocsize;
8061
    unsigned char buffer[2 * IO_CACHE_PAGE_SIZE];
8062

8063
    assert(dirent->tdir_count > 4);
8064

8065
    if (dirent->tdir_type == TIFF_SHORT)
8066
    {
8067
        sizeofval = sizeof(uint16_t);
8068
    }
8069
    else if (dirent->tdir_type == TIFF_LONG)
8070
    {
8071
        sizeofval = sizeof(uint32_t);
8072
    }
8073
    else if (dirent->tdir_type == TIFF_LONG8)
8074
    {
8075
        sizeofval = sizeof(uint64_t);
8076
    }
8077
    else if (dirent->tdir_type == TIFF_SLONG8)
8078
    {
8079
        /* Non conformant but used by some images as in */
8080
        /* https://github.com/OSGeo/gdal/issues/2165 */
8081
        sizeofval = sizeof(int64_t);
8082
    }
8083
    else
8084
    {
8085
        TIFFErrorExtR(tif, module,
8086
                      "Invalid type for [Strip|Tile][Offset/ByteCount] tag");
8087
        panVals[strile] = 0;
8088
        return 0;
8089
    }
8090
    sizeofvalint = (int)(sizeofval);
8091

8092
    if (tif->tif_flags & TIFF_BIGTIFF)
8093
    {
8094
        uint64_t offset = dirent->tdir_offset.toff_long8;
8095
        if (bSwab)
8096
            TIFFSwabLong8(&offset);
8097
        nBaseOffset = offset;
8098
    }
8099
    else
8100
    {
8101
        uint32_t offset = dirent->tdir_offset.toff_long;
8102
        if (bSwab)
8103
            TIFFSwabLong(&offset);
8104
        nBaseOffset = offset;
8105
    }
8106
    /* To avoid later unsigned integer overflows */
8107
    if (nBaseOffset > (uint64_t)INT64_MAX)
8108
    {
8109
        TIFFErrorExtR(tif, module, "Cannot read offset/size for strile %d",
8110
                      strile);
8111
        panVals[strile] = 0;
8112
        return 0;
8113
    }
8114
    nOffset = nBaseOffset + sizeofval * strile;
8115
    nOffsetStartPage = (nOffset / IO_CACHE_PAGE_SIZE) * IO_CACHE_PAGE_SIZE;
8116
    nOffsetEndPage = nOffsetStartPage + IO_CACHE_PAGE_SIZE;
8117

8118
    if (nOffset + sizeofval > nOffsetEndPage)
8119
        nOffsetEndPage += IO_CACHE_PAGE_SIZE;
8120
#undef IO_CACHE_PAGE_SIZE
8121

8122
    nLastStripOffset = nBaseOffset + arraySize * sizeofval;
8123
    if (nLastStripOffset < nOffsetEndPage)
8124
        nOffsetEndPage = nLastStripOffset;
8125
    if (nOffsetStartPage >= nOffsetEndPage)
8126
    {
8127
        TIFFErrorExtR(tif, module, "Cannot read offset/size for strile %d",
8128
                      strile);
8129
        panVals[strile] = 0;
8130
        return 0;
8131
    }
8132
    if (!SeekOK(tif, nOffsetStartPage))
8133
    {
8134
        panVals[strile] = 0;
8135
        return 0;
8136
    }
8137

8138
    nToRead = (tmsize_t)(nOffsetEndPage - nOffsetStartPage);
8139
    nRead = TIFFReadFile(tif, buffer, nToRead);
8140
    if (nRead < nToRead)
8141
    {
8142
        TIFFErrorExtR(tif, module,
8143
                      "Cannot read offset/size for strile around ~%d", strile);
8144
        return 0;
8145
    }
8146
    iStartBefore = -(int)((nOffset - nOffsetStartPage) / sizeofval);
8147
    if (strile + iStartBefore < 0)
8148
        iStartBefore = -strile;
8149
    for (i = iStartBefore;
8150
         (uint32_t)(strile + i) < arraySize &&
8151
         _TIFFUnsanitizedAddUInt64AndInt(nOffset, (i + 1) * sizeofvalint) <=
8152
             nOffsetEndPage;
8153
         ++i)
8154
    {
8155
        if (dirent->tdir_type == TIFF_SHORT)
8156
        {
8157
            uint16_t val;
8158
            memcpy(&val,
8159
                   buffer + (nOffset - nOffsetStartPage) + i * sizeofvalint,
8160
                   sizeof(val));
8161
            if (bSwab)
8162
                TIFFSwabShort(&val);
8163
            panVals[strile + i] = val;
8164
        }
8165
        else if (dirent->tdir_type == TIFF_LONG)
8166
        {
8167
            uint32_t val;
8168
            memcpy(&val,
8169
                   buffer + (nOffset - nOffsetStartPage) + i * sizeofvalint,
8170
                   sizeof(val));
8171
            if (bSwab)
8172
                TIFFSwabLong(&val);
8173
            panVals[strile + i] = val;
8174
        }
8175
        else if (dirent->tdir_type == TIFF_LONG8)
8176
        {
8177
            uint64_t val;
8178
            memcpy(&val,
8179
                   buffer + (nOffset - nOffsetStartPage) + i * sizeofvalint,
8180
                   sizeof(val));
8181
            if (bSwab)
8182
                TIFFSwabLong8(&val);
8183
            panVals[strile + i] = val;
8184
        }
8185
        else /* if( dirent->tdir_type == TIFF_SLONG8 ) */
8186
        {
8187
            /* Non conformant data type */
8188
            int64_t val;
8189
            memcpy(&val,
8190
                   buffer + (nOffset - nOffsetStartPage) + i * sizeofvalint,
8191
                   sizeof(val));
8192
            if (bSwab)
8193
                TIFFSwabLong8((uint64_t *)&val);
8194
            panVals[strile + i] = (uint64_t)val;
8195
        }
8196
    }
8197
    return 1;
8198
}
8199

8200
static int _TIFFFetchStrileValue(TIFF *tif, uint32_t strile,
8201
                                 TIFFDirEntry *dirent, uint64_t **parray)
8202
{
8203
    static const char module[] = "_TIFFFetchStrileValue";
8204
    TIFFDirectory *td = &tif->tif_dir;
8205
    if (strile >= dirent->tdir_count)
8206
    {
8207
        return 0;
8208
    }
8209
    if (strile >= td->td_stripoffsetbyteallocsize)
8210
    {
8211
        uint32_t nStripArrayAllocBefore = td->td_stripoffsetbyteallocsize;
8212
        uint32_t nStripArrayAllocNew;
8213
        uint64_t nArraySize64;
8214
        size_t nArraySize;
8215
        uint64_t *offsetArray;
8216
        uint64_t *bytecountArray;
8217

8218
        if (strile > 1000000)
8219
        {
8220
            uint64_t filesize = TIFFGetFileSize(tif);
8221
            /* Avoid excessive memory allocation attempt */
8222
            /* For such a big blockid we need at least a TIFF_LONG per strile */
8223
            /* for the offset array. */
8224
            if (strile > filesize / sizeof(uint32_t))
8225
            {
8226
                TIFFErrorExtR(tif, module, "File too short");
8227
                return 0;
8228
            }
8229
        }
8230

8231
        if (td->td_stripoffsetbyteallocsize == 0 &&
8232
            td->td_nstrips < 1024 * 1024)
8233
        {
8234
            nStripArrayAllocNew = td->td_nstrips;
8235
        }
8236
        else
8237
        {
8238
#define TIFF_MAX(a, b) (((a) > (b)) ? (a) : (b))
8239
#define TIFF_MIN(a, b) (((a) < (b)) ? (a) : (b))
8240
            nStripArrayAllocNew = TIFF_MAX(strile + 1, 1024U * 512U);
8241
            if (nStripArrayAllocNew < 0xFFFFFFFFU / 2)
8242
                nStripArrayAllocNew *= 2;
8243
            nStripArrayAllocNew = TIFF_MIN(nStripArrayAllocNew, td->td_nstrips);
8244
        }
8245
        assert(strile < nStripArrayAllocNew);
8246
        nArraySize64 = (uint64_t)sizeof(uint64_t) * nStripArrayAllocNew;
8247
        nArraySize = (size_t)(nArraySize64);
8248
#if SIZEOF_SIZE_T == 4
8249
        if (nArraySize != nArraySize64)
8250
        {
8251
            TIFFErrorExtR(tif, module,
8252
                          "Cannot allocate strip offset and bytecount arrays");
8253
            return 0;
8254
        }
8255
#endif
8256
        offsetArray = (uint64_t *)(_TIFFreallocExt(tif, td->td_stripoffset_p,
8257
                                                   nArraySize));
8258
        bytecountArray = (uint64_t *)(_TIFFreallocExt(
8259
            tif, td->td_stripbytecount_p, nArraySize));
8260
        if (offsetArray)
8261
            td->td_stripoffset_p = offsetArray;
8262
        if (bytecountArray)
8263
            td->td_stripbytecount_p = bytecountArray;
8264
        if (offsetArray && bytecountArray)
8265
        {
8266
            td->td_stripoffsetbyteallocsize = nStripArrayAllocNew;
8267
            /* Initialize new entries to ~0 / -1 */
8268
            /* coverity[overrun-buffer-arg] */
8269
            memset(td->td_stripoffset_p + nStripArrayAllocBefore, 0xFF,
8270
                   (td->td_stripoffsetbyteallocsize - nStripArrayAllocBefore) *
8271
                       sizeof(uint64_t));
8272
            /* coverity[overrun-buffer-arg] */
8273
            memset(td->td_stripbytecount_p + nStripArrayAllocBefore, 0xFF,
8274
                   (td->td_stripoffsetbyteallocsize - nStripArrayAllocBefore) *
8275
                       sizeof(uint64_t));
8276
        }
8277
        else
8278
        {
8279
            TIFFErrorExtR(tif, module,
8280
                          "Cannot allocate strip offset and bytecount arrays");
8281
            _TIFFfreeExt(tif, td->td_stripoffset_p);
8282
            td->td_stripoffset_p = NULL;
8283
            _TIFFfreeExt(tif, td->td_stripbytecount_p);
8284
            td->td_stripbytecount_p = NULL;
8285
            td->td_stripoffsetbyteallocsize = 0;
8286
        }
8287
    }
8288
    if (*parray == NULL || strile >= td->td_stripoffsetbyteallocsize)
8289
        return 0;
8290

8291
    if (~((*parray)[strile]) == 0)
8292
    {
8293
        if (!_TIFFPartialReadStripArray(tif, dirent, strile, *parray))
8294
        {
8295
            (*parray)[strile] = 0;
8296
            return 0;
8297
        }
8298
    }
8299

8300
    return 1;
8301
}
8302

8303
static uint64_t _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32_t strile,
8304
                                                     TIFFDirEntry *dirent,
8305
                                                     uint64_t **parray,
8306
                                                     int *pbErr)
8307
{
8308
    TIFFDirectory *td = &tif->tif_dir;
8309
    if (pbErr)
8310
        *pbErr = 0;
8311
    if ((tif->tif_flags & TIFF_DEFERSTRILELOAD) &&
8312
        !(tif->tif_flags & TIFF_CHOPPEDUPARRAYS))
8313
    {
8314
        if (!(tif->tif_flags & TIFF_LAZYSTRILELOAD) ||
8315
            /* If the values may fit in the toff_long/toff_long8 member */
8316
            /* then use _TIFFFillStriles to simplify _TIFFFetchStrileValue */
8317
            dirent->tdir_count <= 4)
8318
        {
8319
            if (!_TIFFFillStriles(tif))
8320
            {
8321
                if (pbErr)
8322
                    *pbErr = 1;
8323
                /* Do not return, as we want this function to always */
8324
                /* return the same value if called several times with */
8325
                /* the same arguments */
8326
            }
8327
        }
8328
        else
8329
        {
8330
            if (!_TIFFFetchStrileValue(tif, strile, dirent, parray))
8331
            {
8332
                if (pbErr)
8333
                    *pbErr = 1;
8334
                return 0;
8335
            }
8336
        }
8337
    }
8338
    if (*parray == NULL || strile >= td->td_nstrips)
8339
    {
8340
        if (pbErr)
8341
            *pbErr = 1;
8342
        return 0;
8343
    }
8344
    return (*parray)[strile];
8345
}
8346

8347
/* Return the value of the TileOffsets/StripOffsets array for the specified
8348
 * tile/strile */
8349
uint64_t TIFFGetStrileOffset(TIFF *tif, uint32_t strile)
8350
{
8351
    return TIFFGetStrileOffsetWithErr(tif, strile, NULL);
8352
}
8353

8354
/* Return the value of the TileOffsets/StripOffsets array for the specified
8355
 * tile/strile */
8356
uint64_t TIFFGetStrileOffsetWithErr(TIFF *tif, uint32_t strile, int *pbErr)
8357
{
8358
    TIFFDirectory *td = &tif->tif_dir;
8359
    return _TIFFGetStrileOffsetOrByteCountValue(tif, strile,
8360
                                                &(td->td_stripoffset_entry),
8361
                                                &(td->td_stripoffset_p), pbErr);
8362
}
8363

8364
/* Return the value of the TileByteCounts/StripByteCounts array for the
8365
 * specified tile/strile */
8366
uint64_t TIFFGetStrileByteCount(TIFF *tif, uint32_t strile)
8367
{
8368
    return TIFFGetStrileByteCountWithErr(tif, strile, NULL);
8369
}
8370

8371
/* Return the value of the TileByteCounts/StripByteCounts array for the
8372
 * specified tile/strile */
8373
uint64_t TIFFGetStrileByteCountWithErr(TIFF *tif, uint32_t strile, int *pbErr)
8374
{
8375
    TIFFDirectory *td = &tif->tif_dir;
8376
    return _TIFFGetStrileOffsetOrByteCountValue(
8377
        tif, strile, &(td->td_stripbytecount_entry), &(td->td_stripbytecount_p),
8378
        pbErr);
8379
}
8380

8381
int _TIFFFillStriles(TIFF *tif) { return _TIFFFillStrilesInternal(tif, 1); }
8382

8383
static int _TIFFFillStrilesInternal(TIFF *tif, int loadStripByteCount)
8384
{
8385
    register TIFFDirectory *td = &tif->tif_dir;
8386
    int return_value = 1;
8387

8388
    /* Do not do anything if TIFF_DEFERSTRILELOAD is not set */
8389
    if (!(tif->tif_flags & TIFF_DEFERSTRILELOAD) ||
8390
        (tif->tif_flags & TIFF_CHOPPEDUPARRAYS) != 0)
8391
        return 1;
8392

8393
    if (tif->tif_flags & TIFF_LAZYSTRILELOAD)
8394
    {
8395
        /* In case of lazy loading, reload completely the arrays */
8396
        _TIFFfreeExt(tif, td->td_stripoffset_p);
8397
        _TIFFfreeExt(tif, td->td_stripbytecount_p);
8398
        td->td_stripoffset_p = NULL;
8399
        td->td_stripbytecount_p = NULL;
8400
        td->td_stripoffsetbyteallocsize = 0;
8401
        tif->tif_flags &= ~TIFF_LAZYSTRILELOAD;
8402
    }
8403

8404
    /* If stripoffset array is already loaded, exit with success */
8405
    if (td->td_stripoffset_p != NULL)
8406
        return 1;
8407

8408
    /* If tdir_count was canceled, then we already got there, but in error */
8409
    if (td->td_stripoffset_entry.tdir_count == 0)
8410
        return 0;
8411

8412
    if (!TIFFFetchStripThing(tif, &(td->td_stripoffset_entry), td->td_nstrips,
8413
                             &td->td_stripoffset_p))
8414
    {
8415
        return_value = 0;
8416
    }
8417

8418
    if (loadStripByteCount &&
8419
        !TIFFFetchStripThing(tif, &(td->td_stripbytecount_entry),
8420
                             td->td_nstrips, &td->td_stripbytecount_p))
8421
    {
8422
        return_value = 0;
8423
    }
8424

8425
    _TIFFmemset(&(td->td_stripoffset_entry), 0, sizeof(TIFFDirEntry));
8426
    _TIFFmemset(&(td->td_stripbytecount_entry), 0, sizeof(TIFFDirEntry));
8427

8428
#ifdef STRIPBYTECOUNTSORTED_UNUSED
8429
    if (tif->tif_dir.td_nstrips > 1 && return_value == 1)
8430
    {
8431
        uint32_t strip;
8432

8433
        tif->tif_dir.td_stripbytecountsorted = 1;
8434
        for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++)
8435
        {
8436
            if (tif->tif_dir.td_stripoffset_p[strip - 1] >
8437
                tif->tif_dir.td_stripoffset_p[strip])
8438
            {
8439
                tif->tif_dir.td_stripbytecountsorted = 0;
8440
                break;
8441
            }
8442
        }
8443
    }
8444
#endif
8445

8446
    return return_value;
8447
}
8448

8449
Product

Resources

Company
