CoCalc -- tif_dirread.c

GitHub Repository: wine-mirror/wine
Path: blob/master/libs/tiff/libtiff/tif_dirread.c
⁴³⁹¹ views
1
/*
2
 * Copyright (c) 1988-1997 Sam Leffler
3
 * Copyright (c) 1991-1997 Silicon Graphics, Inc.
4
 *
5
 * Permission to use, copy, modify, distribute, and sell this software and
6
 * its documentation for any purpose is hereby granted without fee, provided
7
 * that (i) the above copyright notices and this permission notice appear in
8
 * all copies of the software and related documentation, and (ii) the names of
9
 * Sam Leffler and Silicon Graphics may not be used in any advertising or
10
 * publicity relating to the software without the specific, prior written
11
 * permission of Sam Leffler and Silicon Graphics.
12
 *
13
 * THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND,
14
 * EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY
15
 * WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
16
 *
17
 * IN NO EVENT SHALL SAM LEFFLER OR SILICON GRAPHICS BE LIABLE FOR
18
 * ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND,
19
 * OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
20
 * WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF
21
 * LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
22
 * OF THIS SOFTWARE.
23
 */
24

25
/*
26
 * TIFF Library.
27
 *
28
 * Directory Read Support Routines.
29
 */
30

31
/* Suggested pending improvements:
32
 * - add a field 'field_info' to the TIFFDirEntry structure, and set that with
33
 *   the pointer to the appropriate TIFFField structure early on in
34
 *   TIFFReadDirectory, so as to eliminate current possibly repetitive lookup.
35
 */
36

37
#include "tiffconf.h"
38
#include "tiffiop.h"
39
#include <float.h>
40
#include <limits.h>
41
#include <stdlib.h>
42
#include <string.h>
43

44
#define FAILED_FII ((uint32_t)-1)
45

46
#ifdef HAVE_IEEEFP
47
#define TIFFCvtIEEEFloatToNative(tif, n, fp)
48
#define TIFFCvtIEEEDoubleToNative(tif, n, dp)
49
#else
50
extern void TIFFCvtIEEEFloatToNative(TIFF *, uint32_t, float *);
51
extern void TIFFCvtIEEEDoubleToNative(TIFF *, uint32_t, double *);
52
#endif
53

54
enum TIFFReadDirEntryErr
55
{
56
    TIFFReadDirEntryErrOk = 0,
57
    TIFFReadDirEntryErrCount = 1,
58
    TIFFReadDirEntryErrType = 2,
59
    TIFFReadDirEntryErrIo = 3,
60
    TIFFReadDirEntryErrRange = 4,
61
    TIFFReadDirEntryErrPsdif = 5,
62
    TIFFReadDirEntryErrSizesan = 6,
63
    TIFFReadDirEntryErrAlloc = 7,
64
};
65

66
static enum TIFFReadDirEntryErr
67
TIFFReadDirEntryByte(TIFF *tif, TIFFDirEntry *direntry, uint8_t *value);
68
static enum TIFFReadDirEntryErr
69
TIFFReadDirEntrySbyte(TIFF *tif, TIFFDirEntry *direntry, int8_t *value);
70
static enum TIFFReadDirEntryErr
71
TIFFReadDirEntryShort(TIFF *tif, TIFFDirEntry *direntry, uint16_t *value);
72
static enum TIFFReadDirEntryErr
73
TIFFReadDirEntrySshort(TIFF *tif, TIFFDirEntry *direntry, int16_t *value);
74
static enum TIFFReadDirEntryErr
75
TIFFReadDirEntryLong(TIFF *tif, TIFFDirEntry *direntry, uint32_t *value);
76
static enum TIFFReadDirEntryErr
77
TIFFReadDirEntrySlong(TIFF *tif, TIFFDirEntry *direntry, int32_t *value);
78
static enum TIFFReadDirEntryErr
79
TIFFReadDirEntryLong8(TIFF *tif, TIFFDirEntry *direntry, uint64_t *value);
80
static enum TIFFReadDirEntryErr
81
TIFFReadDirEntrySlong8(TIFF *tif, TIFFDirEntry *direntry, int64_t *value);
82
static enum TIFFReadDirEntryErr
83
TIFFReadDirEntryFloat(TIFF *tif, TIFFDirEntry *direntry, float *value);
84
static enum TIFFReadDirEntryErr
85
TIFFReadDirEntryDouble(TIFF *tif, TIFFDirEntry *direntry, double *value);
86
static enum TIFFReadDirEntryErr
87
TIFFReadDirEntryIfd8(TIFF *tif, TIFFDirEntry *direntry, uint64_t *value);
88

89
static enum TIFFReadDirEntryErr
90
TIFFReadDirEntryArray(TIFF *tif, TIFFDirEntry *direntry, uint32_t *count,
91
                      uint32_t desttypesize, void **value);
92
static enum TIFFReadDirEntryErr
93
TIFFReadDirEntryByteArray(TIFF *tif, TIFFDirEntry *direntry, uint8_t **value);
94
static enum TIFFReadDirEntryErr
95
TIFFReadDirEntrySbyteArray(TIFF *tif, TIFFDirEntry *direntry, int8_t **value);
96
static enum TIFFReadDirEntryErr
97
TIFFReadDirEntryShortArray(TIFF *tif, TIFFDirEntry *direntry, uint16_t **value);
98
static enum TIFFReadDirEntryErr
99
TIFFReadDirEntrySshortArray(TIFF *tif, TIFFDirEntry *direntry, int16_t **value);
100
static enum TIFFReadDirEntryErr
101
TIFFReadDirEntryLongArray(TIFF *tif, TIFFDirEntry *direntry, uint32_t **value);
102
static enum TIFFReadDirEntryErr
103
TIFFReadDirEntrySlongArray(TIFF *tif, TIFFDirEntry *direntry, int32_t **value);
104
static enum TIFFReadDirEntryErr
105
TIFFReadDirEntryLong8Array(TIFF *tif, TIFFDirEntry *direntry, uint64_t **value);
106
static enum TIFFReadDirEntryErr
107
TIFFReadDirEntrySlong8Array(TIFF *tif, TIFFDirEntry *direntry, int64_t **value);
108
static enum TIFFReadDirEntryErr
109
TIFFReadDirEntryFloatArray(TIFF *tif, TIFFDirEntry *direntry, float **value);
110
static enum TIFFReadDirEntryErr
111
TIFFReadDirEntryDoubleArray(TIFF *tif, TIFFDirEntry *direntry, double **value);
112
static enum TIFFReadDirEntryErr
113
TIFFReadDirEntryIfd8Array(TIFF *tif, TIFFDirEntry *direntry, uint64_t **value);
114

115
static enum TIFFReadDirEntryErr
116
TIFFReadDirEntryPersampleShort(TIFF *tif, TIFFDirEntry *direntry,
117
                               uint16_t *value);
118

119
static void TIFFReadDirEntryCheckedByte(TIFF *tif, TIFFDirEntry *direntry,
120
                                        uint8_t *value);
121
static void TIFFReadDirEntryCheckedSbyte(TIFF *tif, TIFFDirEntry *direntry,
122
                                         int8_t *value);
123
static void TIFFReadDirEntryCheckedShort(TIFF *tif, TIFFDirEntry *direntry,
124
                                         uint16_t *value);
125
static void TIFFReadDirEntryCheckedSshort(TIFF *tif, TIFFDirEntry *direntry,
126
                                          int16_t *value);
127
static void TIFFReadDirEntryCheckedLong(TIFF *tif, TIFFDirEntry *direntry,
128
                                        uint32_t *value);
129
static void TIFFReadDirEntryCheckedSlong(TIFF *tif, TIFFDirEntry *direntry,
130
                                         int32_t *value);
131
static enum TIFFReadDirEntryErr
132
TIFFReadDirEntryCheckedLong8(TIFF *tif, TIFFDirEntry *direntry,
133
                             uint64_t *value);
134
static enum TIFFReadDirEntryErr
135
TIFFReadDirEntryCheckedSlong8(TIFF *tif, TIFFDirEntry *direntry,
136
                              int64_t *value);
137
static enum TIFFReadDirEntryErr
138
TIFFReadDirEntryCheckedRational(TIFF *tif, TIFFDirEntry *direntry,
139
                                double *value);
140
static enum TIFFReadDirEntryErr
141
TIFFReadDirEntryCheckedSrational(TIFF *tif, TIFFDirEntry *direntry,
142
                                 double *value);
143
static void TIFFReadDirEntryCheckedFloat(TIFF *tif, TIFFDirEntry *direntry,
144
                                         float *value);
145
static enum TIFFReadDirEntryErr
146
TIFFReadDirEntryCheckedDouble(TIFF *tif, TIFFDirEntry *direntry, double *value);
147
#if 0
148
static enum TIFFReadDirEntryErr
149
TIFFReadDirEntryCheckedRationalDirect(TIFF *tif, TIFFDirEntry *direntry,
150
                                      TIFFRational_t *value);
151
#endif
152
static enum TIFFReadDirEntryErr
153
TIFFReadDirEntryCheckRangeByteSbyte(int8_t value);
154
static enum TIFFReadDirEntryErr
155
TIFFReadDirEntryCheckRangeByteShort(uint16_t value);
156
static enum TIFFReadDirEntryErr
157
TIFFReadDirEntryCheckRangeByteSshort(int16_t value);
158
static enum TIFFReadDirEntryErr
159
TIFFReadDirEntryCheckRangeByteLong(uint32_t value);
160
static enum TIFFReadDirEntryErr
161
TIFFReadDirEntryCheckRangeByteSlong(int32_t value);
162
static enum TIFFReadDirEntryErr
163
TIFFReadDirEntryCheckRangeByteLong8(uint64_t value);
164
static enum TIFFReadDirEntryErr
165
TIFFReadDirEntryCheckRangeByteSlong8(int64_t value);
166

167
static enum TIFFReadDirEntryErr
168
TIFFReadDirEntryCheckRangeSbyteByte(uint8_t value);
169
static enum TIFFReadDirEntryErr
170
TIFFReadDirEntryCheckRangeSbyteShort(uint16_t value);
171
static enum TIFFReadDirEntryErr
172
TIFFReadDirEntryCheckRangeSbyteSshort(int16_t value);
173
static enum TIFFReadDirEntryErr
174
TIFFReadDirEntryCheckRangeSbyteLong(uint32_t value);
175
static enum TIFFReadDirEntryErr
176
TIFFReadDirEntryCheckRangeSbyteSlong(int32_t value);
177
static enum TIFFReadDirEntryErr
178
TIFFReadDirEntryCheckRangeSbyteLong8(uint64_t value);
179
static enum TIFFReadDirEntryErr
180
TIFFReadDirEntryCheckRangeSbyteSlong8(int64_t value);
181

182
static enum TIFFReadDirEntryErr
183
TIFFReadDirEntryCheckRangeShortSbyte(int8_t value);
184
static enum TIFFReadDirEntryErr
185
TIFFReadDirEntryCheckRangeShortSshort(int16_t value);
186
static enum TIFFReadDirEntryErr
187
TIFFReadDirEntryCheckRangeShortLong(uint32_t value);
188
static enum TIFFReadDirEntryErr
189
TIFFReadDirEntryCheckRangeShortSlong(int32_t value);
190
static enum TIFFReadDirEntryErr
191
TIFFReadDirEntryCheckRangeShortLong8(uint64_t value);
192
static enum TIFFReadDirEntryErr
193
TIFFReadDirEntryCheckRangeShortSlong8(int64_t value);
194

195
static enum TIFFReadDirEntryErr
196
TIFFReadDirEntryCheckRangeSshortShort(uint16_t value);
197
static enum TIFFReadDirEntryErr
198
TIFFReadDirEntryCheckRangeSshortLong(uint32_t value);
199
static enum TIFFReadDirEntryErr
200
TIFFReadDirEntryCheckRangeSshortSlong(int32_t value);
201
static enum TIFFReadDirEntryErr
202
TIFFReadDirEntryCheckRangeSshortLong8(uint64_t value);
203
static enum TIFFReadDirEntryErr
204
TIFFReadDirEntryCheckRangeSshortSlong8(int64_t value);
205

206
static enum TIFFReadDirEntryErr
207
TIFFReadDirEntryCheckRangeLongSbyte(int8_t value);
208
static enum TIFFReadDirEntryErr
209
TIFFReadDirEntryCheckRangeLongSshort(int16_t value);
210
static enum TIFFReadDirEntryErr
211
TIFFReadDirEntryCheckRangeLongSlong(int32_t value);
212
static enum TIFFReadDirEntryErr
213
TIFFReadDirEntryCheckRangeLongLong8(uint64_t value);
214
static enum TIFFReadDirEntryErr
215
TIFFReadDirEntryCheckRangeLongSlong8(int64_t value);
216

217
static enum TIFFReadDirEntryErr
218
TIFFReadDirEntryCheckRangeSlongLong(uint32_t value);
219
static enum TIFFReadDirEntryErr
220
TIFFReadDirEntryCheckRangeSlongLong8(uint64_t value);
221
static enum TIFFReadDirEntryErr
222
TIFFReadDirEntryCheckRangeSlongSlong8(int64_t value);
223

224
static enum TIFFReadDirEntryErr
225
TIFFReadDirEntryCheckRangeLong8Sbyte(int8_t value);
226
static enum TIFFReadDirEntryErr
227
TIFFReadDirEntryCheckRangeLong8Sshort(int16_t value);
228
static enum TIFFReadDirEntryErr
229
TIFFReadDirEntryCheckRangeLong8Slong(int32_t value);
230
static enum TIFFReadDirEntryErr
231
TIFFReadDirEntryCheckRangeLong8Slong8(int64_t value);
232

233
static enum TIFFReadDirEntryErr
234
TIFFReadDirEntryCheckRangeSlong8Long8(uint64_t value);
235

236
static enum TIFFReadDirEntryErr TIFFReadDirEntryData(TIFF *tif, uint64_t offset,
237
                                                     tmsize_t size, void *dest);
238
static void TIFFReadDirEntryOutputErr(TIFF *tif, enum TIFFReadDirEntryErr err,
239
                                      const char *module, const char *tagname,
240
                                      int recover);
241

242
static void TIFFReadDirectoryCheckOrder(TIFF *tif, TIFFDirEntry *dir,
243
                                        uint16_t dircount);
244
static TIFFDirEntry *TIFFReadDirectoryFindEntry(TIFF *tif, TIFFDirEntry *dir,
245
                                                uint16_t dircount,
246
                                                uint16_t tagid);
247
static void TIFFReadDirectoryFindFieldInfo(TIFF *tif, uint16_t tagid,
248
                                           uint32_t *fii);
249

250
static int EstimateStripByteCounts(TIFF *tif, TIFFDirEntry *dir,
251
                                   uint16_t dircount);
252
static void MissingRequired(TIFF *, const char *);
253
static int CheckDirCount(TIFF *, TIFFDirEntry *, uint32_t);
254
static uint16_t TIFFFetchDirectory(TIFF *tif, uint64_t diroff,
255
                                   TIFFDirEntry **pdir, uint64_t *nextdiroff);
256
static int TIFFFetchNormalTag(TIFF *, TIFFDirEntry *, int recover);
257
static int TIFFFetchStripThing(TIFF *tif, TIFFDirEntry *dir, uint32_t nstrips,
258
                               uint64_t **lpp);
259
static int TIFFFetchSubjectDistance(TIFF *, TIFFDirEntry *);
260
static void ChopUpSingleUncompressedStrip(TIFF *);
261
static void TryChopUpUncompressedBigTiff(TIFF *);
262
static uint64_t TIFFReadUInt64(const uint8_t *value);
263
static int _TIFFGetMaxColorChannels(uint16_t photometric);
264

265
static int _TIFFFillStrilesInternal(TIFF *tif, int loadStripByteCount);
266

267
typedef union _UInt64Aligned_t
268
{
269
    double d;
270
    uint64_t l;
271
    uint32_t i[2];
272
    uint16_t s[4];
273
    uint8_t c[8];
274
} UInt64Aligned_t;
275

276
/*
277
  Unaligned safe copy of a uint64_t value from an octet array.
278
*/
279
static uint64_t TIFFReadUInt64(const uint8_t *value)
280
{
281
    UInt64Aligned_t result;
282

283
    result.c[0] = value[0];
284
    result.c[1] = value[1];
285
    result.c[2] = value[2];
286
    result.c[3] = value[3];
287
    result.c[4] = value[4];
288
    result.c[5] = value[5];
289
    result.c[6] = value[6];
290
    result.c[7] = value[7];
291

292
    return result.l;
293
}
294

295
static enum TIFFReadDirEntryErr
296
TIFFReadDirEntryByte(TIFF *tif, TIFFDirEntry *direntry, uint8_t *value)
297
{
298
    enum TIFFReadDirEntryErr err;
299
    if (direntry->tdir_count != 1)
300
        return (TIFFReadDirEntryErrCount);
301
    switch (direntry->tdir_type)
302
    {
303
        case TIFF_BYTE:
304
        case TIFF_UNDEFINED: /* Support to read TIFF_UNDEFINED with
305
                                field_readcount==1 */
306
            TIFFReadDirEntryCheckedByte(tif, direntry, value);
307
            return (TIFFReadDirEntryErrOk);
308
        case TIFF_SBYTE:
309
        {
310
            int8_t m;
311
            TIFFReadDirEntryCheckedSbyte(tif, direntry, &m);
312
            err = TIFFReadDirEntryCheckRangeByteSbyte(m);
313
            if (err != TIFFReadDirEntryErrOk)
314
                return (err);
315
            *value = (uint8_t)m;
316
            return (TIFFReadDirEntryErrOk);
317
        }
318
        case TIFF_SHORT:
319
        {
320
            uint16_t m;
321
            TIFFReadDirEntryCheckedShort(tif, direntry, &m);
322
            err = TIFFReadDirEntryCheckRangeByteShort(m);
323
            if (err != TIFFReadDirEntryErrOk)
324
                return (err);
325
            *value = (uint8_t)m;
326
            return (TIFFReadDirEntryErrOk);
327
        }
328
        case TIFF_SSHORT:
329
        {
330
            int16_t m;
331
            TIFFReadDirEntryCheckedSshort(tif, direntry, &m);
332
            err = TIFFReadDirEntryCheckRangeByteSshort(m);
333
            if (err != TIFFReadDirEntryErrOk)
334
                return (err);
335
            *value = (uint8_t)m;
336
            return (TIFFReadDirEntryErrOk);
337
        }
338
        case TIFF_LONG:
339
        {
340
            uint32_t m;
341
            TIFFReadDirEntryCheckedLong(tif, direntry, &m);
342
            err = TIFFReadDirEntryCheckRangeByteLong(m);
343
            if (err != TIFFReadDirEntryErrOk)
344
                return (err);
345
            *value = (uint8_t)m;
346
            return (TIFFReadDirEntryErrOk);
347
        }
348
        case TIFF_SLONG:
349
        {
350
            int32_t m;
351
            TIFFReadDirEntryCheckedSlong(tif, direntry, &m);
352
            err = TIFFReadDirEntryCheckRangeByteSlong(m);
353
            if (err != TIFFReadDirEntryErrOk)
354
                return (err);
355
            *value = (uint8_t)m;
356
            return (TIFFReadDirEntryErrOk);
357
        }
358
        case TIFF_LONG8:
359
        {
360
            uint64_t m;
361
            err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m);
362
            if (err != TIFFReadDirEntryErrOk)
363
                return (err);
364
            err = TIFFReadDirEntryCheckRangeByteLong8(m);
365
            if (err != TIFFReadDirEntryErrOk)
366
                return (err);
367
            *value = (uint8_t)m;
368
            return (TIFFReadDirEntryErrOk);
369
        }
370
        case TIFF_SLONG8:
371
        {
372
            int64_t m;
373
            err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m);
374
            if (err != TIFFReadDirEntryErrOk)
375
                return (err);
376
            err = TIFFReadDirEntryCheckRangeByteSlong8(m);
377
            if (err != TIFFReadDirEntryErrOk)
378
                return (err);
379
            *value = (uint8_t)m;
380
            return (TIFFReadDirEntryErrOk);
381
        }
382
        default:
383
            return (TIFFReadDirEntryErrType);
384
    }
385
}
386

387
static enum TIFFReadDirEntryErr
388
TIFFReadDirEntrySbyte(TIFF *tif, TIFFDirEntry *direntry, int8_t *value)
389
{
390
    enum TIFFReadDirEntryErr err;
391
    if (direntry->tdir_count != 1)
392
        return (TIFFReadDirEntryErrCount);
393
    switch (direntry->tdir_type)
394
    {
395
        case TIFF_BYTE:
396
        case TIFF_UNDEFINED: /* Support to read TIFF_UNDEFINED with
397
                                field_readcount==1 */
398
        {
399
            uint8_t m;
400
            TIFFReadDirEntryCheckedByte(tif, direntry, &m);
401
            err = TIFFReadDirEntryCheckRangeSbyteByte(m);
402
            if (err != TIFFReadDirEntryErrOk)
403
                return (err);
404
            *value = (int8_t)m;
405
            return (TIFFReadDirEntryErrOk);
406
        }
407
        case TIFF_SBYTE:
408
        {
409
            TIFFReadDirEntryCheckedSbyte(tif, direntry, value);
410
            return (TIFFReadDirEntryErrOk);
411
        }
412
        case TIFF_SHORT:
413
        {
414
            uint16_t m;
415
            TIFFReadDirEntryCheckedShort(tif, direntry, &m);
416
            err = TIFFReadDirEntryCheckRangeSbyteShort(m);
417
            if (err != TIFFReadDirEntryErrOk)
418
                return (err);
419
            *value = (int8_t)m;
420
            return (TIFFReadDirEntryErrOk);
421
        }
422
        case TIFF_SSHORT:
423
        {
424
            int16_t m;
425
            TIFFReadDirEntryCheckedSshort(tif, direntry, &m);
426
            err = TIFFReadDirEntryCheckRangeSbyteSshort(m);
427
            if (err != TIFFReadDirEntryErrOk)
428
                return (err);
429
            *value = (int8_t)m;
430
            return (TIFFReadDirEntryErrOk);
431
        }
432
        case TIFF_LONG:
433
        {
434
            uint32_t m;
435
            TIFFReadDirEntryCheckedLong(tif, direntry, &m);
436
            err = TIFFReadDirEntryCheckRangeSbyteLong(m);
437
            if (err != TIFFReadDirEntryErrOk)
438
                return (err);
439
            *value = (int8_t)m;
440
            return (TIFFReadDirEntryErrOk);
441
        }
442
        case TIFF_SLONG:
443
        {
444
            int32_t m;
445
            TIFFReadDirEntryCheckedSlong(tif, direntry, &m);
446
            err = TIFFReadDirEntryCheckRangeSbyteSlong(m);
447
            if (err != TIFFReadDirEntryErrOk)
448
                return (err);
449
            *value = (int8_t)m;
450
            return (TIFFReadDirEntryErrOk);
451
        }
452
        case TIFF_LONG8:
453
        {
454
            uint64_t m;
455
            err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m);
456
            if (err != TIFFReadDirEntryErrOk)
457
                return (err);
458
            err = TIFFReadDirEntryCheckRangeSbyteLong8(m);
459
            if (err != TIFFReadDirEntryErrOk)
460
                return (err);
461
            *value = (int8_t)m;
462
            return (TIFFReadDirEntryErrOk);
463
        }
464
        case TIFF_SLONG8:
465
        {
466
            int64_t m;
467
            err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m);
468
            if (err != TIFFReadDirEntryErrOk)
469
                return (err);
470
            err = TIFFReadDirEntryCheckRangeSbyteSlong8(m);
471
            if (err != TIFFReadDirEntryErrOk)
472
                return (err);
473
            *value = (int8_t)m;
474
            return (TIFFReadDirEntryErrOk);
475
        }
476
        default:
477
            return (TIFFReadDirEntryErrType);
478
    }
479
} /*-- TIFFReadDirEntrySbyte() --*/
480

481
static enum TIFFReadDirEntryErr
482
TIFFReadDirEntryShort(TIFF *tif, TIFFDirEntry *direntry, uint16_t *value)
483
{
484
    enum TIFFReadDirEntryErr err;
485
    if (direntry->tdir_count != 1)
486
        return (TIFFReadDirEntryErrCount);
487
    switch (direntry->tdir_type)
488
    {
489
        case TIFF_BYTE:
490
        {
491
            uint8_t m;
492
            TIFFReadDirEntryCheckedByte(tif, direntry, &m);
493
            *value = (uint16_t)m;
494
            return (TIFFReadDirEntryErrOk);
495
        }
496
        case TIFF_SBYTE:
497
        {
498
            int8_t m;
499
            TIFFReadDirEntryCheckedSbyte(tif, direntry, &m);
500
            err = TIFFReadDirEntryCheckRangeShortSbyte(m);
501
            if (err != TIFFReadDirEntryErrOk)
502
                return (err);
503
            *value = (uint16_t)m;
504
            return (TIFFReadDirEntryErrOk);
505
        }
506
        case TIFF_SHORT:
507
            TIFFReadDirEntryCheckedShort(tif, direntry, value);
508
            return (TIFFReadDirEntryErrOk);
509
        case TIFF_SSHORT:
510
        {
511
            int16_t m;
512
            TIFFReadDirEntryCheckedSshort(tif, direntry, &m);
513
            err = TIFFReadDirEntryCheckRangeShortSshort(m);
514
            if (err != TIFFReadDirEntryErrOk)
515
                return (err);
516
            *value = (uint16_t)m;
517
            return (TIFFReadDirEntryErrOk);
518
        }
519
        case TIFF_LONG:
520
        {
521
            uint32_t m;
522
            TIFFReadDirEntryCheckedLong(tif, direntry, &m);
523
            err = TIFFReadDirEntryCheckRangeShortLong(m);
524
            if (err != TIFFReadDirEntryErrOk)
525
                return (err);
526
            *value = (uint16_t)m;
527
            return (TIFFReadDirEntryErrOk);
528
        }
529
        case TIFF_SLONG:
530
        {
531
            int32_t m;
532
            TIFFReadDirEntryCheckedSlong(tif, direntry, &m);
533
            err = TIFFReadDirEntryCheckRangeShortSlong(m);
534
            if (err != TIFFReadDirEntryErrOk)
535
                return (err);
536
            *value = (uint16_t)m;
537
            return (TIFFReadDirEntryErrOk);
538
        }
539
        case TIFF_LONG8:
540
        {
541
            uint64_t m;
542
            err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m);
543
            if (err != TIFFReadDirEntryErrOk)
544
                return (err);
545
            err = TIFFReadDirEntryCheckRangeShortLong8(m);
546
            if (err != TIFFReadDirEntryErrOk)
547
                return (err);
548
            *value = (uint16_t)m;
549
            return (TIFFReadDirEntryErrOk);
550
        }
551
        case TIFF_SLONG8:
552
        {
553
            int64_t m;
554
            err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m);
555
            if (err != TIFFReadDirEntryErrOk)
556
                return (err);
557
            err = TIFFReadDirEntryCheckRangeShortSlong8(m);
558
            if (err != TIFFReadDirEntryErrOk)
559
                return (err);
560
            *value = (uint16_t)m;
561
            return (TIFFReadDirEntryErrOk);
562
        }
563
        default:
564
            return (TIFFReadDirEntryErrType);
565
    }
566
} /*-- TIFFReadDirEntryShort() --*/
567

568
static enum TIFFReadDirEntryErr
569
TIFFReadDirEntrySshort(TIFF *tif, TIFFDirEntry *direntry, int16_t *value)
570
{
571
    enum TIFFReadDirEntryErr err;
572
    if (direntry->tdir_count != 1)
573
        return (TIFFReadDirEntryErrCount);
574
    switch (direntry->tdir_type)
575
    {
576
        case TIFF_BYTE:
577
        {
578
            uint8_t m;
579
            TIFFReadDirEntryCheckedByte(tif, direntry, &m);
580
            *value = (int16_t)m;
581
            return (TIFFReadDirEntryErrOk);
582
        }
583
        case TIFF_SBYTE:
584
        {
585
            int8_t m;
586
            TIFFReadDirEntryCheckedSbyte(tif, direntry, &m);
587
            *value = (int16_t)m;
588
            return (TIFFReadDirEntryErrOk);
589
        }
590
        case TIFF_SHORT:
591
        {
592
            uint16_t m;
593
            TIFFReadDirEntryCheckedShort(tif, direntry, &m);
594
            err = TIFFReadDirEntryCheckRangeSshortShort(m);
595
            if (err != TIFFReadDirEntryErrOk)
596
                return (err);
597
            *value = (uint16_t)m;
598
            return (TIFFReadDirEntryErrOk);
599
        }
600
        case TIFF_SSHORT:
601
            TIFFReadDirEntryCheckedSshort(tif, direntry, value);
602
            return (TIFFReadDirEntryErrOk);
603
        case TIFF_LONG:
604
        {
605
            uint32_t m;
606
            TIFFReadDirEntryCheckedLong(tif, direntry, &m);
607
            err = TIFFReadDirEntryCheckRangeSshortLong(m);
608
            if (err != TIFFReadDirEntryErrOk)
609
                return (err);
610
            *value = (int16_t)m;
611
            return (TIFFReadDirEntryErrOk);
612
        }
613
        case TIFF_SLONG:
614
        {
615
            int32_t m;
616
            TIFFReadDirEntryCheckedSlong(tif, direntry, &m);
617
            err = TIFFReadDirEntryCheckRangeSshortSlong(m);
618
            if (err != TIFFReadDirEntryErrOk)
619
                return (err);
620
            *value = (int16_t)m;
621
            return (TIFFReadDirEntryErrOk);
622
        }
623
        case TIFF_LONG8:
624
        {
625
            uint64_t m;
626
            err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m);
627
            if (err != TIFFReadDirEntryErrOk)
628
                return (err);
629
            err = TIFFReadDirEntryCheckRangeSshortLong8(m);
630
            if (err != TIFFReadDirEntryErrOk)
631
                return (err);
632
            *value = (int16_t)m;
633
            return (TIFFReadDirEntryErrOk);
634
        }
635
        case TIFF_SLONG8:
636
        {
637
            int64_t m;
638
            err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m);
639
            if (err != TIFFReadDirEntryErrOk)
640
                return (err);
641
            err = TIFFReadDirEntryCheckRangeSshortSlong8(m);
642
            if (err != TIFFReadDirEntryErrOk)
643
                return (err);
644
            *value = (int16_t)m;
645
            return (TIFFReadDirEntryErrOk);
646
        }
647
        default:
648
            return (TIFFReadDirEntryErrType);
649
    }
650
} /*-- TIFFReadDirEntrySshort() --*/
651

652
static enum TIFFReadDirEntryErr
653
TIFFReadDirEntryLong(TIFF *tif, TIFFDirEntry *direntry, uint32_t *value)
654
{
655
    enum TIFFReadDirEntryErr err;
656
    if (direntry->tdir_count != 1)
657
        return (TIFFReadDirEntryErrCount);
658
    switch (direntry->tdir_type)
659
    {
660
        case TIFF_BYTE:
661
        {
662
            uint8_t m;
663
            TIFFReadDirEntryCheckedByte(tif, direntry, &m);
664
            *value = (uint32_t)m;
665
            return (TIFFReadDirEntryErrOk);
666
        }
667
        case TIFF_SBYTE:
668
        {
669
            int8_t m;
670
            TIFFReadDirEntryCheckedSbyte(tif, direntry, &m);
671
            err = TIFFReadDirEntryCheckRangeLongSbyte(m);
672
            if (err != TIFFReadDirEntryErrOk)
673
                return (err);
674
            *value = (uint32_t)m;
675
            return (TIFFReadDirEntryErrOk);
676
        }
677
        case TIFF_SHORT:
678
        {
679
            uint16_t m;
680
            TIFFReadDirEntryCheckedShort(tif, direntry, &m);
681
            *value = (uint32_t)m;
682
            return (TIFFReadDirEntryErrOk);
683
        }
684
        case TIFF_SSHORT:
685
        {
686
            int16_t m;
687
            TIFFReadDirEntryCheckedSshort(tif, direntry, &m);
688
            err = TIFFReadDirEntryCheckRangeLongSshort(m);
689
            if (err != TIFFReadDirEntryErrOk)
690
                return (err);
691
            *value = (uint32_t)m;
692
            return (TIFFReadDirEntryErrOk);
693
        }
694
        case TIFF_LONG:
695
            TIFFReadDirEntryCheckedLong(tif, direntry, value);
696
            return (TIFFReadDirEntryErrOk);
697
        case TIFF_SLONG:
698
        {
699
            int32_t m;
700
            TIFFReadDirEntryCheckedSlong(tif, direntry, &m);
701
            err = TIFFReadDirEntryCheckRangeLongSlong(m);
702
            if (err != TIFFReadDirEntryErrOk)
703
                return (err);
704
            *value = (uint32_t)m;
705
            return (TIFFReadDirEntryErrOk);
706
        }
707
        case TIFF_LONG8:
708
        {
709
            uint64_t m;
710
            err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m);
711
            if (err != TIFFReadDirEntryErrOk)
712
                return (err);
713
            err = TIFFReadDirEntryCheckRangeLongLong8(m);
714
            if (err != TIFFReadDirEntryErrOk)
715
                return (err);
716
            *value = (uint32_t)m;
717
            return (TIFFReadDirEntryErrOk);
718
        }
719
        case TIFF_SLONG8:
720
        {
721
            int64_t m;
722
            err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m);
723
            if (err != TIFFReadDirEntryErrOk)
724
                return (err);
725
            err = TIFFReadDirEntryCheckRangeLongSlong8(m);
726
            if (err != TIFFReadDirEntryErrOk)
727
                return (err);
728
            *value = (uint32_t)m;
729
            return (TIFFReadDirEntryErrOk);
730
        }
731
        default:
732
            return (TIFFReadDirEntryErrType);
733
    }
734
} /*-- TIFFReadDirEntryLong() --*/
735

736
static enum TIFFReadDirEntryErr
737
TIFFReadDirEntrySlong(TIFF *tif, TIFFDirEntry *direntry, int32_t *value)
738
{
739
    enum TIFFReadDirEntryErr err;
740
    if (direntry->tdir_count != 1)
741
        return (TIFFReadDirEntryErrCount);
742
    switch (direntry->tdir_type)
743
    {
744
        case TIFF_BYTE:
745
        {
746
            uint8_t m;
747
            TIFFReadDirEntryCheckedByte(tif, direntry, &m);
748
            *value = (int32_t)m;
749
            return (TIFFReadDirEntryErrOk);
750
        }
751
        case TIFF_SBYTE:
752
        {
753
            int8_t m;
754
            TIFFReadDirEntryCheckedSbyte(tif, direntry, &m);
755
            *value = (int32_t)m;
756
            return (TIFFReadDirEntryErrOk);
757
        }
758
        case TIFF_SHORT:
759
        {
760
            uint16_t m;
761
            TIFFReadDirEntryCheckedShort(tif, direntry, &m);
762
            *value = (int32_t)m;
763
            return (TIFFReadDirEntryErrOk);
764
        }
765
        case TIFF_SSHORT:
766
        {
767
            int16_t m;
768
            TIFFReadDirEntryCheckedSshort(tif, direntry, &m);
769
            *value = (int32_t)m;
770
            return (TIFFReadDirEntryErrOk);
771
        }
772
        case TIFF_LONG:
773
        {
774
            uint32_t m;
775
            TIFFReadDirEntryCheckedLong(tif, direntry, &m);
776
            err = TIFFReadDirEntryCheckRangeSlongLong(m);
777
            if (err != TIFFReadDirEntryErrOk)
778
                return (err);
779
            *value = (int32_t)m;
780
            return (TIFFReadDirEntryErrOk);
781
        }
782
        case TIFF_SLONG:
783
            TIFFReadDirEntryCheckedSlong(tif, direntry, value);
784
            return (TIFFReadDirEntryErrOk);
785
        case TIFF_LONG8:
786
        {
787
            uint64_t m;
788
            err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m);
789
            if (err != TIFFReadDirEntryErrOk)
790
                return (err);
791
            err = TIFFReadDirEntryCheckRangeSlongLong8(m);
792
            if (err != TIFFReadDirEntryErrOk)
793
                return (err);
794
            *value = (int32_t)m;
795
            return (TIFFReadDirEntryErrOk);
796
        }
797
        case TIFF_SLONG8:
798
        {
799
            int64_t m;
800
            err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m);
801
            if (err != TIFFReadDirEntryErrOk)
802
                return (err);
803
            err = TIFFReadDirEntryCheckRangeSlongSlong8(m);
804
            if (err != TIFFReadDirEntryErrOk)
805
                return (err);
806
            *value = (int32_t)m;
807
            return (TIFFReadDirEntryErrOk);
808
        }
809
        default:
810
            return (TIFFReadDirEntryErrType);
811
    }
812
} /*-- TIFFReadDirEntrySlong() --*/
813

814
static enum TIFFReadDirEntryErr
815
TIFFReadDirEntryLong8(TIFF *tif, TIFFDirEntry *direntry, uint64_t *value)
816
{
817
    enum TIFFReadDirEntryErr err;
818
    if (direntry->tdir_count != 1)
819
        return (TIFFReadDirEntryErrCount);
820
    switch (direntry->tdir_type)
821
    {
822
        case TIFF_BYTE:
823
        {
824
            uint8_t m;
825
            TIFFReadDirEntryCheckedByte(tif, direntry, &m);
826
            *value = (uint64_t)m;
827
            return (TIFFReadDirEntryErrOk);
828
        }
829
        case TIFF_SBYTE:
830
        {
831
            int8_t m;
832
            TIFFReadDirEntryCheckedSbyte(tif, direntry, &m);
833
            err = TIFFReadDirEntryCheckRangeLong8Sbyte(m);
834
            if (err != TIFFReadDirEntryErrOk)
835
                return (err);
836
            *value = (uint64_t)m;
837
            return (TIFFReadDirEntryErrOk);
838
        }
839
        case TIFF_SHORT:
840
        {
841
            uint16_t m;
842
            TIFFReadDirEntryCheckedShort(tif, direntry, &m);
843
            *value = (uint64_t)m;
844
            return (TIFFReadDirEntryErrOk);
845
        }
846
        case TIFF_SSHORT:
847
        {
848
            int16_t m;
849
            TIFFReadDirEntryCheckedSshort(tif, direntry, &m);
850
            err = TIFFReadDirEntryCheckRangeLong8Sshort(m);
851
            if (err != TIFFReadDirEntryErrOk)
852
                return (err);
853
            *value = (uint64_t)m;
854
            return (TIFFReadDirEntryErrOk);
855
        }
856
        case TIFF_LONG:
857
        {
858
            uint32_t m;
859
            TIFFReadDirEntryCheckedLong(tif, direntry, &m);
860
            *value = (uint64_t)m;
861
            return (TIFFReadDirEntryErrOk);
862
        }
863
        case TIFF_SLONG:
864
        {
865
            int32_t m;
866
            TIFFReadDirEntryCheckedSlong(tif, direntry, &m);
867
            err = TIFFReadDirEntryCheckRangeLong8Slong(m);
868
            if (err != TIFFReadDirEntryErrOk)
869
                return (err);
870
            *value = (uint64_t)m;
871
            return (TIFFReadDirEntryErrOk);
872
        }
873
        case TIFF_LONG8:
874
            err = TIFFReadDirEntryCheckedLong8(tif, direntry, value);
875
            return (err);
876
        case TIFF_SLONG8:
877
        {
878
            int64_t m;
879
            err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m);
880
            if (err != TIFFReadDirEntryErrOk)
881
                return (err);
882
            err = TIFFReadDirEntryCheckRangeLong8Slong8(m);
883
            if (err != TIFFReadDirEntryErrOk)
884
                return (err);
885
            *value = (uint64_t)m;
886
            return (TIFFReadDirEntryErrOk);
887
        }
888
        default:
889
            return (TIFFReadDirEntryErrType);
890
    }
891
} /*-- TIFFReadDirEntryLong8() --*/
892

893
static enum TIFFReadDirEntryErr
894
TIFFReadDirEntrySlong8(TIFF *tif, TIFFDirEntry *direntry, int64_t *value)
895
{
896
    enum TIFFReadDirEntryErr err;
897
    if (direntry->tdir_count != 1)
898
        return (TIFFReadDirEntryErrCount);
899
    switch (direntry->tdir_type)
900
    {
901
        case TIFF_BYTE:
902
        {
903
            uint8_t m;
904
            TIFFReadDirEntryCheckedByte(tif, direntry, &m);
905
            *value = (int64_t)m;
906
            return (TIFFReadDirEntryErrOk);
907
        }
908
        case TIFF_SBYTE:
909
        {
910
            int8_t m;
911
            TIFFReadDirEntryCheckedSbyte(tif, direntry, &m);
912
            *value = (int64_t)m;
913
            return (TIFFReadDirEntryErrOk);
914
        }
915
        case TIFF_SHORT:
916
        {
917
            uint16_t m;
918
            TIFFReadDirEntryCheckedShort(tif, direntry, &m);
919
            *value = (int64_t)m;
920
            return (TIFFReadDirEntryErrOk);
921
        }
922
        case TIFF_SSHORT:
923
        {
924
            int16_t m;
925
            TIFFReadDirEntryCheckedSshort(tif, direntry, &m);
926
            *value = (int64_t)m;
927
            return (TIFFReadDirEntryErrOk);
928
        }
929
        case TIFF_LONG:
930
        {
931
            uint32_t m;
932
            TIFFReadDirEntryCheckedLong(tif, direntry, &m);
933
            *value = (int64_t)m;
934
            return (TIFFReadDirEntryErrOk);
935
        }
936
        case TIFF_SLONG:
937
        {
938
            int32_t m;
939
            TIFFReadDirEntryCheckedSlong(tif, direntry, &m);
940
            *value = (int64_t)m;
941
            return (TIFFReadDirEntryErrOk);
942
        }
943
        case TIFF_LONG8:
944
        {
945
            uint64_t m;
946
            err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m);
947
            if (err != TIFFReadDirEntryErrOk)
948
                return (err);
949
            err = TIFFReadDirEntryCheckRangeSlong8Long8(m);
950
            if (err != TIFFReadDirEntryErrOk)
951
                return (err);
952
            *value = (int64_t)m;
953
            return (TIFFReadDirEntryErrOk);
954
        }
955
        case TIFF_SLONG8:
956
            err = TIFFReadDirEntryCheckedSlong8(tif, direntry, value);
957
            return (err);
958
        default:
959
            return (TIFFReadDirEntryErrType);
960
    }
961
} /*-- TIFFReadDirEntrySlong8() --*/
962

963
static enum TIFFReadDirEntryErr
964
TIFFReadDirEntryFloat(TIFF *tif, TIFFDirEntry *direntry, float *value)
965
{
966
    enum TIFFReadDirEntryErr err;
967
    if (direntry->tdir_count != 1)
968
        return (TIFFReadDirEntryErrCount);
969
    switch (direntry->tdir_type)
970
    {
971
        case TIFF_BYTE:
972
        {
973
            uint8_t m;
974
            TIFFReadDirEntryCheckedByte(tif, direntry, &m);
975
            *value = (float)m;
976
            return (TIFFReadDirEntryErrOk);
977
        }
978
        case TIFF_SBYTE:
979
        {
980
            int8_t m;
981
            TIFFReadDirEntryCheckedSbyte(tif, direntry, &m);
982
            *value = (float)m;
983
            return (TIFFReadDirEntryErrOk);
984
        }
985
        case TIFF_SHORT:
986
        {
987
            uint16_t m;
988
            TIFFReadDirEntryCheckedShort(tif, direntry, &m);
989
            *value = (float)m;
990
            return (TIFFReadDirEntryErrOk);
991
        }
992
        case TIFF_SSHORT:
993
        {
994
            int16_t m;
995
            TIFFReadDirEntryCheckedSshort(tif, direntry, &m);
996
            *value = (float)m;
997
            return (TIFFReadDirEntryErrOk);
998
        }
999
        case TIFF_LONG:
1000
        {
1001
            uint32_t m;
1002
            TIFFReadDirEntryCheckedLong(tif, direntry, &m);
1003
            *value = (float)m;
1004
            return (TIFFReadDirEntryErrOk);
1005
        }
1006
        case TIFF_SLONG:
1007
        {
1008
            int32_t m;
1009
            TIFFReadDirEntryCheckedSlong(tif, direntry, &m);
1010
            *value = (float)m;
1011
            return (TIFFReadDirEntryErrOk);
1012
        }
1013
        case TIFF_LONG8:
1014
        {
1015
            uint64_t m;
1016
            err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m);
1017
            if (err != TIFFReadDirEntryErrOk)
1018
                return (err);
1019
            *value = (float)m;
1020
            return (TIFFReadDirEntryErrOk);
1021
        }
1022
        case TIFF_SLONG8:
1023
        {
1024
            int64_t m;
1025
            err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m);
1026
            if (err != TIFFReadDirEntryErrOk)
1027
                return (err);
1028
            *value = (float)m;
1029
            return (TIFFReadDirEntryErrOk);
1030
        }
1031
        case TIFF_RATIONAL:
1032
        {
1033
            double m;
1034
            err = TIFFReadDirEntryCheckedRational(tif, direntry, &m);
1035
            if (err != TIFFReadDirEntryErrOk)
1036
                return (err);
1037
            *value = (float)m;
1038
            return (TIFFReadDirEntryErrOk);
1039
        }
1040
        case TIFF_SRATIONAL:
1041
        {
1042
            double m;
1043
            err = TIFFReadDirEntryCheckedSrational(tif, direntry, &m);
1044
            if (err != TIFFReadDirEntryErrOk)
1045
                return (err);
1046
            *value = (float)m;
1047
            return (TIFFReadDirEntryErrOk);
1048
        }
1049
        case TIFF_FLOAT:
1050
            TIFFReadDirEntryCheckedFloat(tif, direntry, value);
1051
            return (TIFFReadDirEntryErrOk);
1052
        case TIFF_DOUBLE:
1053
        {
1054
            double m;
1055
            err = TIFFReadDirEntryCheckedDouble(tif, direntry, &m);
1056
            if (err != TIFFReadDirEntryErrOk)
1057
                return (err);
1058
            if ((m > FLT_MAX) || (m < -FLT_MAX))
1059
                return (TIFFReadDirEntryErrRange);
1060
            *value = (float)m;
1061
            return (TIFFReadDirEntryErrOk);
1062
        }
1063
        default:
1064
            return (TIFFReadDirEntryErrType);
1065
    }
1066
}
1067

1068
static enum TIFFReadDirEntryErr
1069
TIFFReadDirEntryDouble(TIFF *tif, TIFFDirEntry *direntry, double *value)
1070
{
1071
    enum TIFFReadDirEntryErr err;
1072
    if (direntry->tdir_count != 1)
1073
        return (TIFFReadDirEntryErrCount);
1074
    switch (direntry->tdir_type)
1075
    {
1076
        case TIFF_BYTE:
1077
        {
1078
            uint8_t m;
1079
            TIFFReadDirEntryCheckedByte(tif, direntry, &m);
1080
            *value = (double)m;
1081
            return (TIFFReadDirEntryErrOk);
1082
        }
1083
        case TIFF_SBYTE:
1084
        {
1085
            int8_t m;
1086
            TIFFReadDirEntryCheckedSbyte(tif, direntry, &m);
1087
            *value = (double)m;
1088
            return (TIFFReadDirEntryErrOk);
1089
        }
1090
        case TIFF_SHORT:
1091
        {
1092
            uint16_t m;
1093
            TIFFReadDirEntryCheckedShort(tif, direntry, &m);
1094
            *value = (double)m;
1095
            return (TIFFReadDirEntryErrOk);
1096
        }
1097
        case TIFF_SSHORT:
1098
        {
1099
            int16_t m;
1100
            TIFFReadDirEntryCheckedSshort(tif, direntry, &m);
1101
            *value = (double)m;
1102
            return (TIFFReadDirEntryErrOk);
1103
        }
1104
        case TIFF_LONG:
1105
        {
1106
            uint32_t m;
1107
            TIFFReadDirEntryCheckedLong(tif, direntry, &m);
1108
            *value = (double)m;
1109
            return (TIFFReadDirEntryErrOk);
1110
        }
1111
        case TIFF_SLONG:
1112
        {
1113
            int32_t m;
1114
            TIFFReadDirEntryCheckedSlong(tif, direntry, &m);
1115
            *value = (double)m;
1116
            return (TIFFReadDirEntryErrOk);
1117
        }
1118
        case TIFF_LONG8:
1119
        {
1120
            uint64_t m;
1121
            err = TIFFReadDirEntryCheckedLong8(tif, direntry, &m);
1122
            if (err != TIFFReadDirEntryErrOk)
1123
                return (err);
1124
            *value = (double)m;
1125
            return (TIFFReadDirEntryErrOk);
1126
        }
1127
        case TIFF_SLONG8:
1128
        {
1129
            int64_t m;
1130
            err = TIFFReadDirEntryCheckedSlong8(tif, direntry, &m);
1131
            if (err != TIFFReadDirEntryErrOk)
1132
                return (err);
1133
            *value = (double)m;
1134
            return (TIFFReadDirEntryErrOk);
1135
        }
1136
        case TIFF_RATIONAL:
1137
            err = TIFFReadDirEntryCheckedRational(tif, direntry, value);
1138
            return (err);
1139
        case TIFF_SRATIONAL:
1140
            err = TIFFReadDirEntryCheckedSrational(tif, direntry, value);
1141
            return (err);
1142
        case TIFF_FLOAT:
1143
        {
1144
            float m;
1145
            TIFFReadDirEntryCheckedFloat(tif, direntry, &m);
1146
            *value = (double)m;
1147
            return (TIFFReadDirEntryErrOk);
1148
        }
1149
        case TIFF_DOUBLE:
1150
            err = TIFFReadDirEntryCheckedDouble(tif, direntry, value);
1151
            return (err);
1152
        default:
1153
            return (TIFFReadDirEntryErrType);
1154
    }
1155
}
1156

1157
static enum TIFFReadDirEntryErr
1158
TIFFReadDirEntryIfd8(TIFF *tif, TIFFDirEntry *direntry, uint64_t *value)
1159
{
1160
    enum TIFFReadDirEntryErr err;
1161
    if (direntry->tdir_count != 1)
1162
        return (TIFFReadDirEntryErrCount);
1163
    switch (direntry->tdir_type)
1164
    {
1165
        case TIFF_LONG:
1166
        case TIFF_IFD:
1167
        {
1168
            uint32_t m;
1169
            TIFFReadDirEntryCheckedLong(tif, direntry, &m);
1170
            *value = (uint64_t)m;
1171
            return (TIFFReadDirEntryErrOk);
1172
        }
1173
        case TIFF_LONG8:
1174
        case TIFF_IFD8:
1175
            err = TIFFReadDirEntryCheckedLong8(tif, direntry, value);
1176
            return (err);
1177
        default:
1178
            return (TIFFReadDirEntryErrType);
1179
    }
1180
}
1181

1182
#define INITIAL_THRESHOLD (1024 * 1024)
1183
#define THRESHOLD_MULTIPLIER 10
1184
#define MAX_THRESHOLD                                                          \
1185
    (THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER *      \
1186
     INITIAL_THRESHOLD)
1187

1188
static enum TIFFReadDirEntryErr TIFFReadDirEntryDataAndRealloc(TIFF *tif,
1189
                                                               uint64_t offset,
1190
                                                               tmsize_t size,
1191
                                                               void **pdest)
1192
{
1193
#if SIZEOF_SIZE_T == 8
1194
    tmsize_t threshold = INITIAL_THRESHOLD;
1195
#endif
1196
    tmsize_t already_read = 0;
1197

1198
    assert(!isMapped(tif));
1199

1200
    if (!SeekOK(tif, offset))
1201
        return (TIFFReadDirEntryErrIo);
1202

1203
    /* On 64 bit processes, read first a maximum of 1 MB, then 10 MB, etc */
1204
    /* so as to avoid allocating too much memory in case the file is too */
1205
    /* short. We could ask for the file size, but this might be */
1206
    /* expensive with some I/O layers (think of reading a gzipped file) */
1207
    /* Restrict to 64 bit processes, so as to avoid reallocs() */
1208
    /* on 32 bit processes where virtual memory is scarce.  */
1209
    while (already_read < size)
1210
    {
1211
        void *new_dest;
1212
        tmsize_t bytes_read;
1213
        tmsize_t to_read = size - already_read;
1214
#if SIZEOF_SIZE_T == 8
1215
        if (to_read >= threshold && threshold < MAX_THRESHOLD)
1216
        {
1217
            to_read = threshold;
1218
            threshold *= THRESHOLD_MULTIPLIER;
1219
        }
1220
#endif
1221

1222
        new_dest =
1223
            (uint8_t *)_TIFFreallocExt(tif, *pdest, already_read + to_read);
1224
        if (new_dest == NULL)
1225
        {
1226
            TIFFErrorExtR(tif, tif->tif_name,
1227
                          "Failed to allocate memory for %s "
1228
                          "(%" TIFF_SSIZE_FORMAT
1229
                          " elements of %" TIFF_SSIZE_FORMAT " bytes each)",
1230
                          "TIFFReadDirEntryArray", (tmsize_t)1,
1231
                          already_read + to_read);
1232
            return TIFFReadDirEntryErrAlloc;
1233
        }
1234
        *pdest = new_dest;
1235

1236
        bytes_read = TIFFReadFile(tif, (char *)*pdest + already_read, to_read);
1237
        already_read += bytes_read;
1238
        if (bytes_read != to_read)
1239
        {
1240
            return TIFFReadDirEntryErrIo;
1241
        }
1242
    }
1243
    return TIFFReadDirEntryErrOk;
1244
}
1245

1246
/* Caution: if raising that value, make sure int32 / uint32 overflows can't
1247
 * occur elsewhere */
1248
#define MAX_SIZE_TAG_DATA 2147483647U
1249

1250
static enum TIFFReadDirEntryErr
1251
TIFFReadDirEntryArrayWithLimit(TIFF *tif, TIFFDirEntry *direntry,
1252
                               uint32_t *count, uint32_t desttypesize,
1253
                               void **value, uint64_t maxcount)
1254
{
1255
    int typesize;
1256
    uint32_t datasize;
1257
    void *data;
1258
    uint64_t target_count64;
1259
    int original_datasize_clamped;
1260
    typesize = TIFFDataWidth(direntry->tdir_type);
1261

1262
    target_count64 =
1263
        (direntry->tdir_count > maxcount) ? maxcount : direntry->tdir_count;
1264

1265
    if ((target_count64 == 0) || (typesize == 0))
1266
    {
1267
        *value = 0;
1268
        return (TIFFReadDirEntryErrOk);
1269
    }
1270
    (void)desttypesize;
1271

1272
    /* We just want to know if the original tag size is more than 4 bytes
1273
     * (classic TIFF) or 8 bytes (BigTIFF)
1274
     */
1275
    original_datasize_clamped =
1276
        ((direntry->tdir_count > 10) ? 10 : (int)direntry->tdir_count) *
1277
        typesize;
1278

1279
    /*
1280
     * As a sanity check, make sure we have no more than a 2GB tag array
1281
     * in either the current data type or the dest data type.  This also
1282
     * avoids problems with overflow of tmsize_t on 32bit systems.
1283
     */
1284
    if ((uint64_t)(MAX_SIZE_TAG_DATA / typesize) < target_count64)
1285
        return (TIFFReadDirEntryErrSizesan);
1286
    if ((uint64_t)(MAX_SIZE_TAG_DATA / desttypesize) < target_count64)
1287
        return (TIFFReadDirEntryErrSizesan);
1288

1289
    *count = (uint32_t)target_count64;
1290
    datasize = (*count) * typesize;
1291
    assert((tmsize_t)datasize > 0);
1292

1293
    if (datasize > 100 * 1024 * 1024)
1294
    {
1295
        /* Before allocating a huge amount of memory for corrupted files, check
1296
         * if size of requested memory is not greater than file size.
1297
         */
1298
        const uint64_t filesize = TIFFGetFileSize(tif);
1299
        if (datasize > filesize)
1300
        {
1301
            TIFFWarningExtR(tif, "ReadDirEntryArray",
1302
                            "Requested memory size for tag %d (0x%x) %" PRIu32
1303
                            " is greater than filesize %" PRIu64
1304
                            ". Memory not allocated, tag not read",
1305
                            direntry->tdir_tag, direntry->tdir_tag, datasize,
1306
                            filesize);
1307
            return (TIFFReadDirEntryErrAlloc);
1308
        }
1309
    }
1310

1311
    if (isMapped(tif) && datasize > (uint64_t)tif->tif_size)
1312
        return TIFFReadDirEntryErrIo;
1313

1314
    if (!isMapped(tif) && (((tif->tif_flags & TIFF_BIGTIFF) && datasize > 8) ||
1315
                           (!(tif->tif_flags & TIFF_BIGTIFF) && datasize > 4)))
1316
    {
1317
        data = NULL;
1318
    }
1319
    else
1320
    {
1321
        data = _TIFFCheckMalloc(tif, *count, typesize, "ReadDirEntryArray");
1322
        if (data == 0)
1323
            return (TIFFReadDirEntryErrAlloc);
1324
    }
1325
    if (!(tif->tif_flags & TIFF_BIGTIFF))
1326
    {
1327
        /* Only the condition on original_datasize_clamped. The second
1328
         * one is implied, but Coverity Scan cannot see it. */
1329
        if (original_datasize_clamped <= 4 && datasize <= 4)
1330
            _TIFFmemcpy(data, &direntry->tdir_offset, datasize);
1331
        else
1332
        {
1333
            enum TIFFReadDirEntryErr err;
1334
            uint32_t offset = direntry->tdir_offset.toff_long;
1335
            if (tif->tif_flags & TIFF_SWAB)
1336
                TIFFSwabLong(&offset);
1337
            if (isMapped(tif))
1338
                err = TIFFReadDirEntryData(tif, (uint64_t)offset,
1339
                                           (tmsize_t)datasize, data);
1340
            else
1341
                err = TIFFReadDirEntryDataAndRealloc(tif, (uint64_t)offset,
1342
                                                     (tmsize_t)datasize, &data);
1343
            if (err != TIFFReadDirEntryErrOk)
1344
            {
1345
                _TIFFfreeExt(tif, data);
1346
                return (err);
1347
            }
1348
        }
1349
    }
1350
    else
1351
    {
1352
        /* See above comment for the Classic TIFF case */
1353
        if (original_datasize_clamped <= 8 && datasize <= 8)
1354
            _TIFFmemcpy(data, &direntry->tdir_offset, datasize);
1355
        else
1356
        {
1357
            enum TIFFReadDirEntryErr err;
1358
            uint64_t offset = direntry->tdir_offset.toff_long8;
1359
            if (tif->tif_flags & TIFF_SWAB)
1360
                TIFFSwabLong8(&offset);
1361
            if (isMapped(tif))
1362
                err = TIFFReadDirEntryData(tif, (uint64_t)offset,
1363
                                           (tmsize_t)datasize, data);
1364
            else
1365
                err = TIFFReadDirEntryDataAndRealloc(tif, (uint64_t)offset,
1366
                                                     (tmsize_t)datasize, &data);
1367
            if (err != TIFFReadDirEntryErrOk)
1368
            {
1369
                _TIFFfreeExt(tif, data);
1370
                return (err);
1371
            }
1372
        }
1373
    }
1374
    *value = data;
1375
    return (TIFFReadDirEntryErrOk);
1376
}
1377

1378
static enum TIFFReadDirEntryErr
1379
TIFFReadDirEntryArray(TIFF *tif, TIFFDirEntry *direntry, uint32_t *count,
1380
                      uint32_t desttypesize, void **value)
1381
{
1382
    return TIFFReadDirEntryArrayWithLimit(tif, direntry, count, desttypesize,
1383
                                          value, ~((uint64_t)0));
1384
}
1385

1386
static enum TIFFReadDirEntryErr
1387
TIFFReadDirEntryByteArray(TIFF *tif, TIFFDirEntry *direntry, uint8_t **value)
1388
{
1389
    enum TIFFReadDirEntryErr err;
1390
    uint32_t count;
1391
    void *origdata;
1392
    uint8_t *data;
1393
    switch (direntry->tdir_type)
1394
    {
1395
        case TIFF_ASCII:
1396
        case TIFF_UNDEFINED:
1397
        case TIFF_BYTE:
1398
        case TIFF_SBYTE:
1399
        case TIFF_SHORT:
1400
        case TIFF_SSHORT:
1401
        case TIFF_LONG:
1402
        case TIFF_SLONG:
1403
        case TIFF_LONG8:
1404
        case TIFF_SLONG8:
1405
            break;
1406
        default:
1407
            return (TIFFReadDirEntryErrType);
1408
    }
1409
    err = TIFFReadDirEntryArray(tif, direntry, &count, 1, &origdata);
1410
    if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
1411
    {
1412
        *value = 0;
1413
        return (err);
1414
    }
1415
    switch (direntry->tdir_type)
1416
    {
1417
        case TIFF_ASCII:
1418
        case TIFF_UNDEFINED:
1419
        case TIFF_BYTE:
1420
            *value = (uint8_t *)origdata;
1421
            return (TIFFReadDirEntryErrOk);
1422
        case TIFF_SBYTE:
1423
        {
1424
            int8_t *m;
1425
            uint32_t n;
1426
            m = (int8_t *)origdata;
1427
            for (n = 0; n < count; n++)
1428
            {
1429
                err = TIFFReadDirEntryCheckRangeByteSbyte(*m);
1430
                if (err != TIFFReadDirEntryErrOk)
1431
                {
1432
                    _TIFFfreeExt(tif, origdata);
1433
                    return (err);
1434
                }
1435
                m++;
1436
            }
1437
            *value = (uint8_t *)origdata;
1438
            return (TIFFReadDirEntryErrOk);
1439
        }
1440
    }
1441
    data = (uint8_t *)_TIFFmallocExt(tif, count);
1442
    if (data == 0)
1443
    {
1444
        _TIFFfreeExt(tif, origdata);
1445
        return (TIFFReadDirEntryErrAlloc);
1446
    }
1447
    switch (direntry->tdir_type)
1448
    {
1449
        case TIFF_SHORT:
1450
        {
1451
            uint16_t *ma;
1452
            uint8_t *mb;
1453
            uint32_t n;
1454
            ma = (uint16_t *)origdata;
1455
            mb = data;
1456
            for (n = 0; n < count; n++)
1457
            {
1458
                if (tif->tif_flags & TIFF_SWAB)
1459
                    TIFFSwabShort(ma);
1460
                err = TIFFReadDirEntryCheckRangeByteShort(*ma);
1461
                if (err != TIFFReadDirEntryErrOk)
1462
                    break;
1463
                *mb++ = (uint8_t)(*ma++);
1464
            }
1465
        }
1466
        break;
1467
        case TIFF_SSHORT:
1468
        {
1469
            int16_t *ma;
1470
            uint8_t *mb;
1471
            uint32_t n;
1472
            ma = (int16_t *)origdata;
1473
            mb = data;
1474
            for (n = 0; n < count; n++)
1475
            {
1476
                if (tif->tif_flags & TIFF_SWAB)
1477
                    TIFFSwabShort((uint16_t *)ma);
1478
                err = TIFFReadDirEntryCheckRangeByteSshort(*ma);
1479
                if (err != TIFFReadDirEntryErrOk)
1480
                    break;
1481
                *mb++ = (uint8_t)(*ma++);
1482
            }
1483
        }
1484
        break;
1485
        case TIFF_LONG:
1486
        {
1487
            uint32_t *ma;
1488
            uint8_t *mb;
1489
            uint32_t n;
1490
            ma = (uint32_t *)origdata;
1491
            mb = data;
1492
            for (n = 0; n < count; n++)
1493
            {
1494
                if (tif->tif_flags & TIFF_SWAB)
1495
                    TIFFSwabLong(ma);
1496
                err = TIFFReadDirEntryCheckRangeByteLong(*ma);
1497
                if (err != TIFFReadDirEntryErrOk)
1498
                    break;
1499
                *mb++ = (uint8_t)(*ma++);
1500
            }
1501
        }
1502
        break;
1503
        case TIFF_SLONG:
1504
        {
1505
            int32_t *ma;
1506
            uint8_t *mb;
1507
            uint32_t n;
1508
            ma = (int32_t *)origdata;
1509
            mb = data;
1510
            for (n = 0; n < count; n++)
1511
            {
1512
                if (tif->tif_flags & TIFF_SWAB)
1513
                    TIFFSwabLong((uint32_t *)ma);
1514
                err = TIFFReadDirEntryCheckRangeByteSlong(*ma);
1515
                if (err != TIFFReadDirEntryErrOk)
1516
                    break;
1517
                *mb++ = (uint8_t)(*ma++);
1518
            }
1519
        }
1520
        break;
1521
        case TIFF_LONG8:
1522
        {
1523
            uint64_t *ma;
1524
            uint8_t *mb;
1525
            uint32_t n;
1526
            ma = (uint64_t *)origdata;
1527
            mb = data;
1528
            for (n = 0; n < count; n++)
1529
            {
1530
                if (tif->tif_flags & TIFF_SWAB)
1531
                    TIFFSwabLong8(ma);
1532
                err = TIFFReadDirEntryCheckRangeByteLong8(*ma);
1533
                if (err != TIFFReadDirEntryErrOk)
1534
                    break;
1535
                *mb++ = (uint8_t)(*ma++);
1536
            }
1537
        }
1538
        break;
1539
        case TIFF_SLONG8:
1540
        {
1541
            int64_t *ma;
1542
            uint8_t *mb;
1543
            uint32_t n;
1544
            ma = (int64_t *)origdata;
1545
            mb = data;
1546
            for (n = 0; n < count; n++)
1547
            {
1548
                if (tif->tif_flags & TIFF_SWAB)
1549
                    TIFFSwabLong8((uint64_t *)ma);
1550
                err = TIFFReadDirEntryCheckRangeByteSlong8(*ma);
1551
                if (err != TIFFReadDirEntryErrOk)
1552
                    break;
1553
                *mb++ = (uint8_t)(*ma++);
1554
            }
1555
        }
1556
        break;
1557
    }
1558
    _TIFFfreeExt(tif, origdata);
1559
    if (err != TIFFReadDirEntryErrOk)
1560
    {
1561
        _TIFFfreeExt(tif, data);
1562
        return (err);
1563
    }
1564
    *value = data;
1565
    return (TIFFReadDirEntryErrOk);
1566
}
1567

1568
static enum TIFFReadDirEntryErr
1569
TIFFReadDirEntrySbyteArray(TIFF *tif, TIFFDirEntry *direntry, int8_t **value)
1570
{
1571
    enum TIFFReadDirEntryErr err;
1572
    uint32_t count;
1573
    void *origdata;
1574
    int8_t *data;
1575
    switch (direntry->tdir_type)
1576
    {
1577
        case TIFF_UNDEFINED:
1578
        case TIFF_BYTE:
1579
        case TIFF_SBYTE:
1580
        case TIFF_SHORT:
1581
        case TIFF_SSHORT:
1582
        case TIFF_LONG:
1583
        case TIFF_SLONG:
1584
        case TIFF_LONG8:
1585
        case TIFF_SLONG8:
1586
            break;
1587
        default:
1588
            return (TIFFReadDirEntryErrType);
1589
    }
1590
    err = TIFFReadDirEntryArray(tif, direntry, &count, 1, &origdata);
1591
    if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
1592
    {
1593
        *value = 0;
1594
        return (err);
1595
    }
1596
    switch (direntry->tdir_type)
1597
    {
1598
        case TIFF_UNDEFINED:
1599
        case TIFF_BYTE:
1600
        {
1601
            uint8_t *m;
1602
            uint32_t n;
1603
            m = (uint8_t *)origdata;
1604
            for (n = 0; n < count; n++)
1605
            {
1606
                err = TIFFReadDirEntryCheckRangeSbyteByte(*m);
1607
                if (err != TIFFReadDirEntryErrOk)
1608
                {
1609
                    _TIFFfreeExt(tif, origdata);
1610
                    return (err);
1611
                }
1612
                m++;
1613
            }
1614
            *value = (int8_t *)origdata;
1615
            return (TIFFReadDirEntryErrOk);
1616
        }
1617
        case TIFF_SBYTE:
1618
            *value = (int8_t *)origdata;
1619
            return (TIFFReadDirEntryErrOk);
1620
    }
1621
    data = (int8_t *)_TIFFmallocExt(tif, count);
1622
    if (data == 0)
1623
    {
1624
        _TIFFfreeExt(tif, origdata);
1625
        return (TIFFReadDirEntryErrAlloc);
1626
    }
1627
    switch (direntry->tdir_type)
1628
    {
1629
        case TIFF_SHORT:
1630
        {
1631
            uint16_t *ma;
1632
            int8_t *mb;
1633
            uint32_t n;
1634
            ma = (uint16_t *)origdata;
1635
            mb = data;
1636
            for (n = 0; n < count; n++)
1637
            {
1638
                if (tif->tif_flags & TIFF_SWAB)
1639
                    TIFFSwabShort(ma);
1640
                err = TIFFReadDirEntryCheckRangeSbyteShort(*ma);
1641
                if (err != TIFFReadDirEntryErrOk)
1642
                    break;
1643
                *mb++ = (int8_t)(*ma++);
1644
            }
1645
        }
1646
        break;
1647
        case TIFF_SSHORT:
1648
        {
1649
            int16_t *ma;
1650
            int8_t *mb;
1651
            uint32_t n;
1652
            ma = (int16_t *)origdata;
1653
            mb = data;
1654
            for (n = 0; n < count; n++)
1655
            {
1656
                if (tif->tif_flags & TIFF_SWAB)
1657
                    TIFFSwabShort((uint16_t *)ma);
1658
                err = TIFFReadDirEntryCheckRangeSbyteSshort(*ma);
1659
                if (err != TIFFReadDirEntryErrOk)
1660
                    break;
1661
                *mb++ = (int8_t)(*ma++);
1662
            }
1663
        }
1664
        break;
1665
        case TIFF_LONG:
1666
        {
1667
            uint32_t *ma;
1668
            int8_t *mb;
1669
            uint32_t n;
1670
            ma = (uint32_t *)origdata;
1671
            mb = data;
1672
            for (n = 0; n < count; n++)
1673
            {
1674
                if (tif->tif_flags & TIFF_SWAB)
1675
                    TIFFSwabLong(ma);
1676
                err = TIFFReadDirEntryCheckRangeSbyteLong(*ma);
1677
                if (err != TIFFReadDirEntryErrOk)
1678
                    break;
1679
                *mb++ = (int8_t)(*ma++);
1680
            }
1681
        }
1682
        break;
1683
        case TIFF_SLONG:
1684
        {
1685
            int32_t *ma;
1686
            int8_t *mb;
1687
            uint32_t n;
1688
            ma = (int32_t *)origdata;
1689
            mb = data;
1690
            for (n = 0; n < count; n++)
1691
            {
1692
                if (tif->tif_flags & TIFF_SWAB)
1693
                    TIFFSwabLong((uint32_t *)ma);
1694
                err = TIFFReadDirEntryCheckRangeSbyteSlong(*ma);
1695
                if (err != TIFFReadDirEntryErrOk)
1696
                    break;
1697
                *mb++ = (int8_t)(*ma++);
1698
            }
1699
        }
1700
        break;
1701
        case TIFF_LONG8:
1702
        {
1703
            uint64_t *ma;
1704
            int8_t *mb;
1705
            uint32_t n;
1706
            ma = (uint64_t *)origdata;
1707
            mb = data;
1708
            for (n = 0; n < count; n++)
1709
            {
1710
                if (tif->tif_flags & TIFF_SWAB)
1711
                    TIFFSwabLong8(ma);
1712
                err = TIFFReadDirEntryCheckRangeSbyteLong8(*ma);
1713
                if (err != TIFFReadDirEntryErrOk)
1714
                    break;
1715
                *mb++ = (int8_t)(*ma++);
1716
            }
1717
        }
1718
        break;
1719
        case TIFF_SLONG8:
1720
        {
1721
            int64_t *ma;
1722
            int8_t *mb;
1723
            uint32_t n;
1724
            ma = (int64_t *)origdata;
1725
            mb = data;
1726
            for (n = 0; n < count; n++)
1727
            {
1728
                if (tif->tif_flags & TIFF_SWAB)
1729
                    TIFFSwabLong8((uint64_t *)ma);
1730
                err = TIFFReadDirEntryCheckRangeSbyteSlong8(*ma);
1731
                if (err != TIFFReadDirEntryErrOk)
1732
                    break;
1733
                *mb++ = (int8_t)(*ma++);
1734
            }
1735
        }
1736
        break;
1737
    }
1738
    _TIFFfreeExt(tif, origdata);
1739
    if (err != TIFFReadDirEntryErrOk)
1740
    {
1741
        _TIFFfreeExt(tif, data);
1742
        return (err);
1743
    }
1744
    *value = data;
1745
    return (TIFFReadDirEntryErrOk);
1746
}
1747

1748
static enum TIFFReadDirEntryErr
1749
TIFFReadDirEntryShortArray(TIFF *tif, TIFFDirEntry *direntry, uint16_t **value)
1750
{
1751
    enum TIFFReadDirEntryErr err;
1752
    uint32_t count;
1753
    void *origdata;
1754
    uint16_t *data;
1755
    switch (direntry->tdir_type)
1756
    {
1757
        case TIFF_BYTE:
1758
        case TIFF_SBYTE:
1759
        case TIFF_SHORT:
1760
        case TIFF_SSHORT:
1761
        case TIFF_LONG:
1762
        case TIFF_SLONG:
1763
        case TIFF_LONG8:
1764
        case TIFF_SLONG8:
1765
            break;
1766
        default:
1767
            return (TIFFReadDirEntryErrType);
1768
    }
1769
    err = TIFFReadDirEntryArray(tif, direntry, &count, 2, &origdata);
1770
    if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
1771
    {
1772
        *value = 0;
1773
        return (err);
1774
    }
1775
    switch (direntry->tdir_type)
1776
    {
1777
        case TIFF_SHORT:
1778
            *value = (uint16_t *)origdata;
1779
            if (tif->tif_flags & TIFF_SWAB)
1780
                TIFFSwabArrayOfShort(*value, count);
1781
            return (TIFFReadDirEntryErrOk);
1782
        case TIFF_SSHORT:
1783
        {
1784
            int16_t *m;
1785
            uint32_t n;
1786
            m = (int16_t *)origdata;
1787
            for (n = 0; n < count; n++)
1788
            {
1789
                if (tif->tif_flags & TIFF_SWAB)
1790
                    TIFFSwabShort((uint16_t *)m);
1791
                err = TIFFReadDirEntryCheckRangeShortSshort(*m);
1792
                if (err != TIFFReadDirEntryErrOk)
1793
                {
1794
                    _TIFFfreeExt(tif, origdata);
1795
                    return (err);
1796
                }
1797
                m++;
1798
            }
1799
            *value = (uint16_t *)origdata;
1800
            return (TIFFReadDirEntryErrOk);
1801
        }
1802
    }
1803
    data = (uint16_t *)_TIFFmallocExt(tif, count * 2);
1804
    if (data == 0)
1805
    {
1806
        _TIFFfreeExt(tif, origdata);
1807
        return (TIFFReadDirEntryErrAlloc);
1808
    }
1809
    switch (direntry->tdir_type)
1810
    {
1811
        case TIFF_BYTE:
1812
        {
1813
            uint8_t *ma;
1814
            uint16_t *mb;
1815
            uint32_t n;
1816
            ma = (uint8_t *)origdata;
1817
            mb = data;
1818
            for (n = 0; n < count; n++)
1819
                *mb++ = (uint16_t)(*ma++);
1820
        }
1821
        break;
1822
        case TIFF_SBYTE:
1823
        {
1824
            int8_t *ma;
1825
            uint16_t *mb;
1826
            uint32_t n;
1827
            ma = (int8_t *)origdata;
1828
            mb = data;
1829
            for (n = 0; n < count; n++)
1830
            {
1831
                err = TIFFReadDirEntryCheckRangeShortSbyte(*ma);
1832
                if (err != TIFFReadDirEntryErrOk)
1833
                    break;
1834
                *mb++ = (uint16_t)(*ma++);
1835
            }
1836
        }
1837
        break;
1838
        case TIFF_LONG:
1839
        {
1840
            uint32_t *ma;
1841
            uint16_t *mb;
1842
            uint32_t n;
1843
            ma = (uint32_t *)origdata;
1844
            mb = data;
1845
            for (n = 0; n < count; n++)
1846
            {
1847
                if (tif->tif_flags & TIFF_SWAB)
1848
                    TIFFSwabLong(ma);
1849
                err = TIFFReadDirEntryCheckRangeShortLong(*ma);
1850
                if (err != TIFFReadDirEntryErrOk)
1851
                    break;
1852
                *mb++ = (uint16_t)(*ma++);
1853
            }
1854
        }
1855
        break;
1856
        case TIFF_SLONG:
1857
        {
1858
            int32_t *ma;
1859
            uint16_t *mb;
1860
            uint32_t n;
1861
            ma = (int32_t *)origdata;
1862
            mb = data;
1863
            for (n = 0; n < count; n++)
1864
            {
1865
                if (tif->tif_flags & TIFF_SWAB)
1866
                    TIFFSwabLong((uint32_t *)ma);
1867
                err = TIFFReadDirEntryCheckRangeShortSlong(*ma);
1868
                if (err != TIFFReadDirEntryErrOk)
1869
                    break;
1870
                *mb++ = (uint16_t)(*ma++);
1871
            }
1872
        }
1873
        break;
1874
        case TIFF_LONG8:
1875
        {
1876
            uint64_t *ma;
1877
            uint16_t *mb;
1878
            uint32_t n;
1879
            ma = (uint64_t *)origdata;
1880
            mb = data;
1881
            for (n = 0; n < count; n++)
1882
            {
1883
                if (tif->tif_flags & TIFF_SWAB)
1884
                    TIFFSwabLong8(ma);
1885
                err = TIFFReadDirEntryCheckRangeShortLong8(*ma);
1886
                if (err != TIFFReadDirEntryErrOk)
1887
                    break;
1888
                *mb++ = (uint16_t)(*ma++);
1889
            }
1890
        }
1891
        break;
1892
        case TIFF_SLONG8:
1893
        {
1894
            int64_t *ma;
1895
            uint16_t *mb;
1896
            uint32_t n;
1897
            ma = (int64_t *)origdata;
1898
            mb = data;
1899
            for (n = 0; n < count; n++)
1900
            {
1901
                if (tif->tif_flags & TIFF_SWAB)
1902
                    TIFFSwabLong8((uint64_t *)ma);
1903
                err = TIFFReadDirEntryCheckRangeShortSlong8(*ma);
1904
                if (err != TIFFReadDirEntryErrOk)
1905
                    break;
1906
                *mb++ = (uint16_t)(*ma++);
1907
            }
1908
        }
1909
        break;
1910
    }
1911
    _TIFFfreeExt(tif, origdata);
1912
    if (err != TIFFReadDirEntryErrOk)
1913
    {
1914
        _TIFFfreeExt(tif, data);
1915
        return (err);
1916
    }
1917
    *value = data;
1918
    return (TIFFReadDirEntryErrOk);
1919
}
1920

1921
static enum TIFFReadDirEntryErr
1922
TIFFReadDirEntrySshortArray(TIFF *tif, TIFFDirEntry *direntry, int16_t **value)
1923
{
1924
    enum TIFFReadDirEntryErr err;
1925
    uint32_t count;
1926
    void *origdata;
1927
    int16_t *data;
1928
    switch (direntry->tdir_type)
1929
    {
1930
        case TIFF_BYTE:
1931
        case TIFF_SBYTE:
1932
        case TIFF_SHORT:
1933
        case TIFF_SSHORT:
1934
        case TIFF_LONG:
1935
        case TIFF_SLONG:
1936
        case TIFF_LONG8:
1937
        case TIFF_SLONG8:
1938
            break;
1939
        default:
1940
            return (TIFFReadDirEntryErrType);
1941
    }
1942
    err = TIFFReadDirEntryArray(tif, direntry, &count, 2, &origdata);
1943
    if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
1944
    {
1945
        *value = 0;
1946
        return (err);
1947
    }
1948
    switch (direntry->tdir_type)
1949
    {
1950
        case TIFF_SHORT:
1951
        {
1952
            uint16_t *m;
1953
            uint32_t n;
1954
            m = (uint16_t *)origdata;
1955
            for (n = 0; n < count; n++)
1956
            {
1957
                if (tif->tif_flags & TIFF_SWAB)
1958
                    TIFFSwabShort(m);
1959
                err = TIFFReadDirEntryCheckRangeSshortShort(*m);
1960
                if (err != TIFFReadDirEntryErrOk)
1961
                {
1962
                    _TIFFfreeExt(tif, origdata);
1963
                    return (err);
1964
                }
1965
                m++;
1966
            }
1967
            *value = (int16_t *)origdata;
1968
            return (TIFFReadDirEntryErrOk);
1969
        }
1970
        case TIFF_SSHORT:
1971
            *value = (int16_t *)origdata;
1972
            if (tif->tif_flags & TIFF_SWAB)
1973
                TIFFSwabArrayOfShort((uint16_t *)(*value), count);
1974
            return (TIFFReadDirEntryErrOk);
1975
    }
1976
    data = (int16_t *)_TIFFmallocExt(tif, count * 2);
1977
    if (data == 0)
1978
    {
1979
        _TIFFfreeExt(tif, origdata);
1980
        return (TIFFReadDirEntryErrAlloc);
1981
    }
1982
    switch (direntry->tdir_type)
1983
    {
1984
        case TIFF_BYTE:
1985
        {
1986
            uint8_t *ma;
1987
            int16_t *mb;
1988
            uint32_t n;
1989
            ma = (uint8_t *)origdata;
1990
            mb = data;
1991
            for (n = 0; n < count; n++)
1992
                *mb++ = (int16_t)(*ma++);
1993
        }
1994
        break;
1995
        case TIFF_SBYTE:
1996
        {
1997
            int8_t *ma;
1998
            int16_t *mb;
1999
            uint32_t n;
2000
            ma = (int8_t *)origdata;
2001
            mb = data;
2002
            for (n = 0; n < count; n++)
2003
                *mb++ = (int16_t)(*ma++);
2004
        }
2005
        break;
2006
        case TIFF_LONG:
2007
        {
2008
            uint32_t *ma;
2009
            int16_t *mb;
2010
            uint32_t n;
2011
            ma = (uint32_t *)origdata;
2012
            mb = data;
2013
            for (n = 0; n < count; n++)
2014
            {
2015
                if (tif->tif_flags & TIFF_SWAB)
2016
                    TIFFSwabLong(ma);
2017
                err = TIFFReadDirEntryCheckRangeSshortLong(*ma);
2018
                if (err != TIFFReadDirEntryErrOk)
2019
                    break;
2020
                *mb++ = (int16_t)(*ma++);
2021
            }
2022
        }
2023
        break;
2024
        case TIFF_SLONG:
2025
        {
2026
            int32_t *ma;
2027
            int16_t *mb;
2028
            uint32_t n;
2029
            ma = (int32_t *)origdata;
2030
            mb = data;
2031
            for (n = 0; n < count; n++)
2032
            {
2033
                if (tif->tif_flags & TIFF_SWAB)
2034
                    TIFFSwabLong((uint32_t *)ma);
2035
                err = TIFFReadDirEntryCheckRangeSshortSlong(*ma);
2036
                if (err != TIFFReadDirEntryErrOk)
2037
                    break;
2038
                *mb++ = (int16_t)(*ma++);
2039
            }
2040
        }
2041
        break;
2042
        case TIFF_LONG8:
2043
        {
2044
            uint64_t *ma;
2045
            int16_t *mb;
2046
            uint32_t n;
2047
            ma = (uint64_t *)origdata;
2048
            mb = data;
2049
            for (n = 0; n < count; n++)
2050
            {
2051
                if (tif->tif_flags & TIFF_SWAB)
2052
                    TIFFSwabLong8(ma);
2053
                err = TIFFReadDirEntryCheckRangeSshortLong8(*ma);
2054
                if (err != TIFFReadDirEntryErrOk)
2055
                    break;
2056
                *mb++ = (int16_t)(*ma++);
2057
            }
2058
        }
2059
        break;
2060
        case TIFF_SLONG8:
2061
        {
2062
            int64_t *ma;
2063
            int16_t *mb;
2064
            uint32_t n;
2065
            ma = (int64_t *)origdata;
2066
            mb = data;
2067
            for (n = 0; n < count; n++)
2068
            {
2069
                if (tif->tif_flags & TIFF_SWAB)
2070
                    TIFFSwabLong8((uint64_t *)ma);
2071
                err = TIFFReadDirEntryCheckRangeSshortSlong8(*ma);
2072
                if (err != TIFFReadDirEntryErrOk)
2073
                    break;
2074
                *mb++ = (int16_t)(*ma++);
2075
            }
2076
        }
2077
        break;
2078
    }
2079
    _TIFFfreeExt(tif, origdata);
2080
    if (err != TIFFReadDirEntryErrOk)
2081
    {
2082
        _TIFFfreeExt(tif, data);
2083
        return (err);
2084
    }
2085
    *value = data;
2086
    return (TIFFReadDirEntryErrOk);
2087
}
2088

2089
static enum TIFFReadDirEntryErr
2090
TIFFReadDirEntryLongArray(TIFF *tif, TIFFDirEntry *direntry, uint32_t **value)
2091
{
2092
    enum TIFFReadDirEntryErr err;
2093
    uint32_t count;
2094
    void *origdata;
2095
    uint32_t *data;
2096
    switch (direntry->tdir_type)
2097
    {
2098
        case TIFF_BYTE:
2099
        case TIFF_SBYTE:
2100
        case TIFF_SHORT:
2101
        case TIFF_SSHORT:
2102
        case TIFF_LONG:
2103
        case TIFF_SLONG:
2104
        case TIFF_LONG8:
2105
        case TIFF_SLONG8:
2106
            break;
2107
        default:
2108
            return (TIFFReadDirEntryErrType);
2109
    }
2110
    err = TIFFReadDirEntryArray(tif, direntry, &count, 4, &origdata);
2111
    if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
2112
    {
2113
        *value = 0;
2114
        return (err);
2115
    }
2116
    switch (direntry->tdir_type)
2117
    {
2118
        case TIFF_LONG:
2119
            *value = (uint32_t *)origdata;
2120
            if (tif->tif_flags & TIFF_SWAB)
2121
                TIFFSwabArrayOfLong(*value, count);
2122
            return (TIFFReadDirEntryErrOk);
2123
        case TIFF_SLONG:
2124
        {
2125
            int32_t *m;
2126
            uint32_t n;
2127
            m = (int32_t *)origdata;
2128
            for (n = 0; n < count; n++)
2129
            {
2130
                if (tif->tif_flags & TIFF_SWAB)
2131
                    TIFFSwabLong((uint32_t *)m);
2132
                err = TIFFReadDirEntryCheckRangeLongSlong(*m);
2133
                if (err != TIFFReadDirEntryErrOk)
2134
                {
2135
                    _TIFFfreeExt(tif, origdata);
2136
                    return (err);
2137
                }
2138
                m++;
2139
            }
2140
            *value = (uint32_t *)origdata;
2141
            return (TIFFReadDirEntryErrOk);
2142
        }
2143
    }
2144
    data = (uint32_t *)_TIFFmallocExt(tif, count * 4);
2145
    if (data == 0)
2146
    {
2147
        _TIFFfreeExt(tif, origdata);
2148
        return (TIFFReadDirEntryErrAlloc);
2149
    }
2150
    switch (direntry->tdir_type)
2151
    {
2152
        case TIFF_BYTE:
2153
        {
2154
            uint8_t *ma;
2155
            uint32_t *mb;
2156
            uint32_t n;
2157
            ma = (uint8_t *)origdata;
2158
            mb = data;
2159
            for (n = 0; n < count; n++)
2160
                *mb++ = (uint32_t)(*ma++);
2161
        }
2162
        break;
2163
        case TIFF_SBYTE:
2164
        {
2165
            int8_t *ma;
2166
            uint32_t *mb;
2167
            uint32_t n;
2168
            ma = (int8_t *)origdata;
2169
            mb = data;
2170
            for (n = 0; n < count; n++)
2171
            {
2172
                err = TIFFReadDirEntryCheckRangeLongSbyte(*ma);
2173
                if (err != TIFFReadDirEntryErrOk)
2174
                    break;
2175
                *mb++ = (uint32_t)(*ma++);
2176
            }
2177
        }
2178
        break;
2179
        case TIFF_SHORT:
2180
        {
2181
            uint16_t *ma;
2182
            uint32_t *mb;
2183
            uint32_t n;
2184
            ma = (uint16_t *)origdata;
2185
            mb = data;
2186
            for (n = 0; n < count; n++)
2187
            {
2188
                if (tif->tif_flags & TIFF_SWAB)
2189
                    TIFFSwabShort(ma);
2190
                *mb++ = (uint32_t)(*ma++);
2191
            }
2192
        }
2193
        break;
2194
        case TIFF_SSHORT:
2195
        {
2196
            int16_t *ma;
2197
            uint32_t *mb;
2198
            uint32_t n;
2199
            ma = (int16_t *)origdata;
2200
            mb = data;
2201
            for (n = 0; n < count; n++)
2202
            {
2203
                if (tif->tif_flags & TIFF_SWAB)
2204
                    TIFFSwabShort((uint16_t *)ma);
2205
                err = TIFFReadDirEntryCheckRangeLongSshort(*ma);
2206
                if (err != TIFFReadDirEntryErrOk)
2207
                    break;
2208
                *mb++ = (uint32_t)(*ma++);
2209
            }
2210
        }
2211
        break;
2212
        case TIFF_LONG8:
2213
        {
2214
            uint64_t *ma;
2215
            uint32_t *mb;
2216
            uint32_t n;
2217
            ma = (uint64_t *)origdata;
2218
            mb = data;
2219
            for (n = 0; n < count; n++)
2220
            {
2221
                if (tif->tif_flags & TIFF_SWAB)
2222
                    TIFFSwabLong8(ma);
2223
                err = TIFFReadDirEntryCheckRangeLongLong8(*ma);
2224
                if (err != TIFFReadDirEntryErrOk)
2225
                    break;
2226
                *mb++ = (uint32_t)(*ma++);
2227
            }
2228
        }
2229
        break;
2230
        case TIFF_SLONG8:
2231
        {
2232
            int64_t *ma;
2233
            uint32_t *mb;
2234
            uint32_t n;
2235
            ma = (int64_t *)origdata;
2236
            mb = data;
2237
            for (n = 0; n < count; n++)
2238
            {
2239
                if (tif->tif_flags & TIFF_SWAB)
2240
                    TIFFSwabLong8((uint64_t *)ma);
2241
                err = TIFFReadDirEntryCheckRangeLongSlong8(*ma);
2242
                if (err != TIFFReadDirEntryErrOk)
2243
                    break;
2244
                *mb++ = (uint32_t)(*ma++);
2245
            }
2246
        }
2247
        break;
2248
    }
2249
    _TIFFfreeExt(tif, origdata);
2250
    if (err != TIFFReadDirEntryErrOk)
2251
    {
2252
        _TIFFfreeExt(tif, data);
2253
        return (err);
2254
    }
2255
    *value = data;
2256
    return (TIFFReadDirEntryErrOk);
2257
}
2258

2259
static enum TIFFReadDirEntryErr
2260
TIFFReadDirEntrySlongArray(TIFF *tif, TIFFDirEntry *direntry, int32_t **value)
2261
{
2262
    enum TIFFReadDirEntryErr err;
2263
    uint32_t count;
2264
    void *origdata;
2265
    int32_t *data;
2266
    switch (direntry->tdir_type)
2267
    {
2268
        case TIFF_BYTE:
2269
        case TIFF_SBYTE:
2270
        case TIFF_SHORT:
2271
        case TIFF_SSHORT:
2272
        case TIFF_LONG:
2273
        case TIFF_SLONG:
2274
        case TIFF_LONG8:
2275
        case TIFF_SLONG8:
2276
            break;
2277
        default:
2278
            return (TIFFReadDirEntryErrType);
2279
    }
2280
    err = TIFFReadDirEntryArray(tif, direntry, &count, 4, &origdata);
2281
    if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
2282
    {
2283
        *value = 0;
2284
        return (err);
2285
    }
2286
    switch (direntry->tdir_type)
2287
    {
2288
        case TIFF_LONG:
2289
        {
2290
            uint32_t *m;
2291
            uint32_t n;
2292
            m = (uint32_t *)origdata;
2293
            for (n = 0; n < count; n++)
2294
            {
2295
                if (tif->tif_flags & TIFF_SWAB)
2296
                    TIFFSwabLong((uint32_t *)m);
2297
                err = TIFFReadDirEntryCheckRangeSlongLong(*m);
2298
                if (err != TIFFReadDirEntryErrOk)
2299
                {
2300
                    _TIFFfreeExt(tif, origdata);
2301
                    return (err);
2302
                }
2303
                m++;
2304
            }
2305
            *value = (int32_t *)origdata;
2306
            return (TIFFReadDirEntryErrOk);
2307
        }
2308
        case TIFF_SLONG:
2309
            *value = (int32_t *)origdata;
2310
            if (tif->tif_flags & TIFF_SWAB)
2311
                TIFFSwabArrayOfLong((uint32_t *)(*value), count);
2312
            return (TIFFReadDirEntryErrOk);
2313
    }
2314
    data = (int32_t *)_TIFFmallocExt(tif, count * 4);
2315
    if (data == 0)
2316
    {
2317
        _TIFFfreeExt(tif, origdata);
2318
        return (TIFFReadDirEntryErrAlloc);
2319
    }
2320
    switch (direntry->tdir_type)
2321
    {
2322
        case TIFF_BYTE:
2323
        {
2324
            uint8_t *ma;
2325
            int32_t *mb;
2326
            uint32_t n;
2327
            ma = (uint8_t *)origdata;
2328
            mb = data;
2329
            for (n = 0; n < count; n++)
2330
                *mb++ = (int32_t)(*ma++);
2331
        }
2332
        break;
2333
        case TIFF_SBYTE:
2334
        {
2335
            int8_t *ma;
2336
            int32_t *mb;
2337
            uint32_t n;
2338
            ma = (int8_t *)origdata;
2339
            mb = data;
2340
            for (n = 0; n < count; n++)
2341
                *mb++ = (int32_t)(*ma++);
2342
        }
2343
        break;
2344
        case TIFF_SHORT:
2345
        {
2346
            uint16_t *ma;
2347
            int32_t *mb;
2348
            uint32_t n;
2349
            ma = (uint16_t *)origdata;
2350
            mb = data;
2351
            for (n = 0; n < count; n++)
2352
            {
2353
                if (tif->tif_flags & TIFF_SWAB)
2354
                    TIFFSwabShort(ma);
2355
                *mb++ = (int32_t)(*ma++);
2356
            }
2357
        }
2358
        break;
2359
        case TIFF_SSHORT:
2360
        {
2361
            int16_t *ma;
2362
            int32_t *mb;
2363
            uint32_t n;
2364
            ma = (int16_t *)origdata;
2365
            mb = data;
2366
            for (n = 0; n < count; n++)
2367
            {
2368
                if (tif->tif_flags & TIFF_SWAB)
2369
                    TIFFSwabShort((uint16_t *)ma);
2370
                *mb++ = (int32_t)(*ma++);
2371
            }
2372
        }
2373
        break;
2374
        case TIFF_LONG8:
2375
        {
2376
            uint64_t *ma;
2377
            int32_t *mb;
2378
            uint32_t n;
2379
            ma = (uint64_t *)origdata;
2380
            mb = data;
2381
            for (n = 0; n < count; n++)
2382
            {
2383
                if (tif->tif_flags & TIFF_SWAB)
2384
                    TIFFSwabLong8(ma);
2385
                err = TIFFReadDirEntryCheckRangeSlongLong8(*ma);
2386
                if (err != TIFFReadDirEntryErrOk)
2387
                    break;
2388
                *mb++ = (int32_t)(*ma++);
2389
            }
2390
        }
2391
        break;
2392
        case TIFF_SLONG8:
2393
        {
2394
            int64_t *ma;
2395
            int32_t *mb;
2396
            uint32_t n;
2397
            ma = (int64_t *)origdata;
2398
            mb = data;
2399
            for (n = 0; n < count; n++)
2400
            {
2401
                if (tif->tif_flags & TIFF_SWAB)
2402
                    TIFFSwabLong8((uint64_t *)ma);
2403
                err = TIFFReadDirEntryCheckRangeSlongSlong8(*ma);
2404
                if (err != TIFFReadDirEntryErrOk)
2405
                    break;
2406
                *mb++ = (int32_t)(*ma++);
2407
            }
2408
        }
2409
        break;
2410
    }
2411
    _TIFFfreeExt(tif, origdata);
2412
    if (err != TIFFReadDirEntryErrOk)
2413
    {
2414
        _TIFFfreeExt(tif, data);
2415
        return (err);
2416
    }
2417
    *value = data;
2418
    return (TIFFReadDirEntryErrOk);
2419
}
2420

2421
static enum TIFFReadDirEntryErr
2422
TIFFReadDirEntryLong8ArrayWithLimit(TIFF *tif, TIFFDirEntry *direntry,
2423
                                    uint64_t **value, uint64_t maxcount)
2424
{
2425
    enum TIFFReadDirEntryErr err;
2426
    uint32_t count;
2427
    void *origdata;
2428
    uint64_t *data;
2429
    switch (direntry->tdir_type)
2430
    {
2431
        case TIFF_BYTE:
2432
        case TIFF_SBYTE:
2433
        case TIFF_SHORT:
2434
        case TIFF_SSHORT:
2435
        case TIFF_LONG:
2436
        case TIFF_SLONG:
2437
        case TIFF_LONG8:
2438
        case TIFF_SLONG8:
2439
            break;
2440
        default:
2441
            return (TIFFReadDirEntryErrType);
2442
    }
2443
    err = TIFFReadDirEntryArrayWithLimit(tif, direntry, &count, 8, &origdata,
2444
                                         maxcount);
2445
    if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
2446
    {
2447
        *value = 0;
2448
        return (err);
2449
    }
2450
    switch (direntry->tdir_type)
2451
    {
2452
        case TIFF_LONG8:
2453
            *value = (uint64_t *)origdata;
2454
            if (tif->tif_flags & TIFF_SWAB)
2455
                TIFFSwabArrayOfLong8(*value, count);
2456
            return (TIFFReadDirEntryErrOk);
2457
        case TIFF_SLONG8:
2458
        {
2459
            int64_t *m;
2460
            uint32_t n;
2461
            m = (int64_t *)origdata;
2462
            for (n = 0; n < count; n++)
2463
            {
2464
                if (tif->tif_flags & TIFF_SWAB)
2465
                    TIFFSwabLong8((uint64_t *)m);
2466
                err = TIFFReadDirEntryCheckRangeLong8Slong8(*m);
2467
                if (err != TIFFReadDirEntryErrOk)
2468
                {
2469
                    _TIFFfreeExt(tif, origdata);
2470
                    return (err);
2471
                }
2472
                m++;
2473
            }
2474
            *value = (uint64_t *)origdata;
2475
            return (TIFFReadDirEntryErrOk);
2476
        }
2477
    }
2478
    data = (uint64_t *)_TIFFmallocExt(tif, count * 8);
2479
    if (data == 0)
2480
    {
2481
        _TIFFfreeExt(tif, origdata);
2482
        return (TIFFReadDirEntryErrAlloc);
2483
    }
2484
    switch (direntry->tdir_type)
2485
    {
2486
        case TIFF_BYTE:
2487
        {
2488
            uint8_t *ma;
2489
            uint64_t *mb;
2490
            uint32_t n;
2491
            ma = (uint8_t *)origdata;
2492
            mb = data;
2493
            for (n = 0; n < count; n++)
2494
                *mb++ = (uint64_t)(*ma++);
2495
        }
2496
        break;
2497
        case TIFF_SBYTE:
2498
        {
2499
            int8_t *ma;
2500
            uint64_t *mb;
2501
            uint32_t n;
2502
            ma = (int8_t *)origdata;
2503
            mb = data;
2504
            for (n = 0; n < count; n++)
2505
            {
2506
                err = TIFFReadDirEntryCheckRangeLong8Sbyte(*ma);
2507
                if (err != TIFFReadDirEntryErrOk)
2508
                    break;
2509
                *mb++ = (uint64_t)(*ma++);
2510
            }
2511
        }
2512
        break;
2513
        case TIFF_SHORT:
2514
        {
2515
            uint16_t *ma;
2516
            uint64_t *mb;
2517
            uint32_t n;
2518
            ma = (uint16_t *)origdata;
2519
            mb = data;
2520
            for (n = 0; n < count; n++)
2521
            {
2522
                if (tif->tif_flags & TIFF_SWAB)
2523
                    TIFFSwabShort(ma);
2524
                *mb++ = (uint64_t)(*ma++);
2525
            }
2526
        }
2527
        break;
2528
        case TIFF_SSHORT:
2529
        {
2530
            int16_t *ma;
2531
            uint64_t *mb;
2532
            uint32_t n;
2533
            ma = (int16_t *)origdata;
2534
            mb = data;
2535
            for (n = 0; n < count; n++)
2536
            {
2537
                if (tif->tif_flags & TIFF_SWAB)
2538
                    TIFFSwabShort((uint16_t *)ma);
2539
                err = TIFFReadDirEntryCheckRangeLong8Sshort(*ma);
2540
                if (err != TIFFReadDirEntryErrOk)
2541
                    break;
2542
                *mb++ = (uint64_t)(*ma++);
2543
            }
2544
        }
2545
        break;
2546
        case TIFF_LONG:
2547
        {
2548
            uint32_t *ma;
2549
            uint64_t *mb;
2550
            uint32_t n;
2551
            ma = (uint32_t *)origdata;
2552
            mb = data;
2553
            for (n = 0; n < count; n++)
2554
            {
2555
                if (tif->tif_flags & TIFF_SWAB)
2556
                    TIFFSwabLong(ma);
2557
                *mb++ = (uint64_t)(*ma++);
2558
            }
2559
        }
2560
        break;
2561
        case TIFF_SLONG:
2562
        {
2563
            int32_t *ma;
2564
            uint64_t *mb;
2565
            uint32_t n;
2566
            ma = (int32_t *)origdata;
2567
            mb = data;
2568
            for (n = 0; n < count; n++)
2569
            {
2570
                if (tif->tif_flags & TIFF_SWAB)
2571
                    TIFFSwabLong((uint32_t *)ma);
2572
                err = TIFFReadDirEntryCheckRangeLong8Slong(*ma);
2573
                if (err != TIFFReadDirEntryErrOk)
2574
                    break;
2575
                *mb++ = (uint64_t)(*ma++);
2576
            }
2577
        }
2578
        break;
2579
    }
2580
    _TIFFfreeExt(tif, origdata);
2581
    if (err != TIFFReadDirEntryErrOk)
2582
    {
2583
        _TIFFfreeExt(tif, data);
2584
        return (err);
2585
    }
2586
    *value = data;
2587
    return (TIFFReadDirEntryErrOk);
2588
}
2589

2590
static enum TIFFReadDirEntryErr
2591
TIFFReadDirEntryLong8Array(TIFF *tif, TIFFDirEntry *direntry, uint64_t **value)
2592
{
2593
    return TIFFReadDirEntryLong8ArrayWithLimit(tif, direntry, value,
2594
                                               ~((uint64_t)0));
2595
}
2596

2597
static enum TIFFReadDirEntryErr
2598
TIFFReadDirEntrySlong8Array(TIFF *tif, TIFFDirEntry *direntry, int64_t **value)
2599
{
2600
    enum TIFFReadDirEntryErr err;
2601
    uint32_t count;
2602
    void *origdata;
2603
    int64_t *data;
2604
    switch (direntry->tdir_type)
2605
    {
2606
        case TIFF_BYTE:
2607
        case TIFF_SBYTE:
2608
        case TIFF_SHORT:
2609
        case TIFF_SSHORT:
2610
        case TIFF_LONG:
2611
        case TIFF_SLONG:
2612
        case TIFF_LONG8:
2613
        case TIFF_SLONG8:
2614
            break;
2615
        default:
2616
            return (TIFFReadDirEntryErrType);
2617
    }
2618
    err = TIFFReadDirEntryArray(tif, direntry, &count, 8, &origdata);
2619
    if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
2620
    {
2621
        *value = 0;
2622
        return (err);
2623
    }
2624
    switch (direntry->tdir_type)
2625
    {
2626
        case TIFF_LONG8:
2627
        {
2628
            uint64_t *m;
2629
            uint32_t n;
2630
            m = (uint64_t *)origdata;
2631
            for (n = 0; n < count; n++)
2632
            {
2633
                if (tif->tif_flags & TIFF_SWAB)
2634
                    TIFFSwabLong8(m);
2635
                err = TIFFReadDirEntryCheckRangeSlong8Long8(*m);
2636
                if (err != TIFFReadDirEntryErrOk)
2637
                {
2638
                    _TIFFfreeExt(tif, origdata);
2639
                    return (err);
2640
                }
2641
                m++;
2642
            }
2643
            *value = (int64_t *)origdata;
2644
            return (TIFFReadDirEntryErrOk);
2645
        }
2646
        case TIFF_SLONG8:
2647
            *value = (int64_t *)origdata;
2648
            if (tif->tif_flags & TIFF_SWAB)
2649
                TIFFSwabArrayOfLong8((uint64_t *)(*value), count);
2650
            return (TIFFReadDirEntryErrOk);
2651
    }
2652
    data = (int64_t *)_TIFFmallocExt(tif, count * 8);
2653
    if (data == 0)
2654
    {
2655
        _TIFFfreeExt(tif, origdata);
2656
        return (TIFFReadDirEntryErrAlloc);
2657
    }
2658
    switch (direntry->tdir_type)
2659
    {
2660
        case TIFF_BYTE:
2661
        {
2662
            uint8_t *ma;
2663
            int64_t *mb;
2664
            uint32_t n;
2665
            ma = (uint8_t *)origdata;
2666
            mb = data;
2667
            for (n = 0; n < count; n++)
2668
                *mb++ = (int64_t)(*ma++);
2669
        }
2670
        break;
2671
        case TIFF_SBYTE:
2672
        {
2673
            int8_t *ma;
2674
            int64_t *mb;
2675
            uint32_t n;
2676
            ma = (int8_t *)origdata;
2677
            mb = data;
2678
            for (n = 0; n < count; n++)
2679
                *mb++ = (int64_t)(*ma++);
2680
        }
2681
        break;
2682
        case TIFF_SHORT:
2683
        {
2684
            uint16_t *ma;
2685
            int64_t *mb;
2686
            uint32_t n;
2687
            ma = (uint16_t *)origdata;
2688
            mb = data;
2689
            for (n = 0; n < count; n++)
2690
            {
2691
                if (tif->tif_flags & TIFF_SWAB)
2692
                    TIFFSwabShort(ma);
2693
                *mb++ = (int64_t)(*ma++);
2694
            }
2695
        }
2696
        break;
2697
        case TIFF_SSHORT:
2698
        {
2699
            int16_t *ma;
2700
            int64_t *mb;
2701
            uint32_t n;
2702
            ma = (int16_t *)origdata;
2703
            mb = data;
2704
            for (n = 0; n < count; n++)
2705
            {
2706
                if (tif->tif_flags & TIFF_SWAB)
2707
                    TIFFSwabShort((uint16_t *)ma);
2708
                *mb++ = (int64_t)(*ma++);
2709
            }
2710
        }
2711
        break;
2712
        case TIFF_LONG:
2713
        {
2714
            uint32_t *ma;
2715
            int64_t *mb;
2716
            uint32_t n;
2717
            ma = (uint32_t *)origdata;
2718
            mb = data;
2719
            for (n = 0; n < count; n++)
2720
            {
2721
                if (tif->tif_flags & TIFF_SWAB)
2722
                    TIFFSwabLong(ma);
2723
                *mb++ = (int64_t)(*ma++);
2724
            }
2725
        }
2726
        break;
2727
        case TIFF_SLONG:
2728
        {
2729
            int32_t *ma;
2730
            int64_t *mb;
2731
            uint32_t n;
2732
            ma = (int32_t *)origdata;
2733
            mb = data;
2734
            for (n = 0; n < count; n++)
2735
            {
2736
                if (tif->tif_flags & TIFF_SWAB)
2737
                    TIFFSwabLong((uint32_t *)ma);
2738
                *mb++ = (int64_t)(*ma++);
2739
            }
2740
        }
2741
        break;
2742
    }
2743
    _TIFFfreeExt(tif, origdata);
2744
    *value = data;
2745
    return (TIFFReadDirEntryErrOk);
2746
}
2747

2748
static enum TIFFReadDirEntryErr
2749
TIFFReadDirEntryFloatArray(TIFF *tif, TIFFDirEntry *direntry, float **value)
2750
{
2751
    enum TIFFReadDirEntryErr err;
2752
    uint32_t count;
2753
    void *origdata;
2754
    float *data;
2755
    switch (direntry->tdir_type)
2756
    {
2757
        case TIFF_BYTE:
2758
        case TIFF_SBYTE:
2759
        case TIFF_SHORT:
2760
        case TIFF_SSHORT:
2761
        case TIFF_LONG:
2762
        case TIFF_SLONG:
2763
        case TIFF_LONG8:
2764
        case TIFF_SLONG8:
2765
        case TIFF_RATIONAL:
2766
        case TIFF_SRATIONAL:
2767
        case TIFF_FLOAT:
2768
        case TIFF_DOUBLE:
2769
            break;
2770
        default:
2771
            return (TIFFReadDirEntryErrType);
2772
    }
2773
    err = TIFFReadDirEntryArray(tif, direntry, &count, 4, &origdata);
2774
    if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
2775
    {
2776
        *value = 0;
2777
        return (err);
2778
    }
2779
    switch (direntry->tdir_type)
2780
    {
2781
        case TIFF_FLOAT:
2782
            if (tif->tif_flags & TIFF_SWAB)
2783
                TIFFSwabArrayOfLong((uint32_t *)origdata, count);
2784
            TIFFCvtIEEEDoubleToNative(tif, count, (float *)origdata);
2785
            *value = (float *)origdata;
2786
            return (TIFFReadDirEntryErrOk);
2787
    }
2788
    data = (float *)_TIFFmallocExt(tif, count * sizeof(float));
2789
    if (data == 0)
2790
    {
2791
        _TIFFfreeExt(tif, origdata);
2792
        return (TIFFReadDirEntryErrAlloc);
2793
    }
2794
    switch (direntry->tdir_type)
2795
    {
2796
        case TIFF_BYTE:
2797
        {
2798
            uint8_t *ma;
2799
            float *mb;
2800
            uint32_t n;
2801
            ma = (uint8_t *)origdata;
2802
            mb = data;
2803
            for (n = 0; n < count; n++)
2804
                *mb++ = (float)(*ma++);
2805
        }
2806
        break;
2807
        case TIFF_SBYTE:
2808
        {
2809
            int8_t *ma;
2810
            float *mb;
2811
            uint32_t n;
2812
            ma = (int8_t *)origdata;
2813
            mb = data;
2814
            for (n = 0; n < count; n++)
2815
                *mb++ = (float)(*ma++);
2816
        }
2817
        break;
2818
        case TIFF_SHORT:
2819
        {
2820
            uint16_t *ma;
2821
            float *mb;
2822
            uint32_t n;
2823
            ma = (uint16_t *)origdata;
2824
            mb = data;
2825
            for (n = 0; n < count; n++)
2826
            {
2827
                if (tif->tif_flags & TIFF_SWAB)
2828
                    TIFFSwabShort(ma);
2829
                *mb++ = (float)(*ma++);
2830
            }
2831
        }
2832
        break;
2833
        case TIFF_SSHORT:
2834
        {
2835
            int16_t *ma;
2836
            float *mb;
2837
            uint32_t n;
2838
            ma = (int16_t *)origdata;
2839
            mb = data;
2840
            for (n = 0; n < count; n++)
2841
            {
2842
                if (tif->tif_flags & TIFF_SWAB)
2843
                    TIFFSwabShort((uint16_t *)ma);
2844
                *mb++ = (float)(*ma++);
2845
            }
2846
        }
2847
        break;
2848
        case TIFF_LONG:
2849
        {
2850
            uint32_t *ma;
2851
            float *mb;
2852
            uint32_t n;
2853
            ma = (uint32_t *)origdata;
2854
            mb = data;
2855
            for (n = 0; n < count; n++)
2856
            {
2857
                if (tif->tif_flags & TIFF_SWAB)
2858
                    TIFFSwabLong(ma);
2859
                *mb++ = (float)(*ma++);
2860
            }
2861
        }
2862
        break;
2863
        case TIFF_SLONG:
2864
        {
2865
            int32_t *ma;
2866
            float *mb;
2867
            uint32_t n;
2868
            ma = (int32_t *)origdata;
2869
            mb = data;
2870
            for (n = 0; n < count; n++)
2871
            {
2872
                if (tif->tif_flags & TIFF_SWAB)
2873
                    TIFFSwabLong((uint32_t *)ma);
2874
                *mb++ = (float)(*ma++);
2875
            }
2876
        }
2877
        break;
2878
        case TIFF_LONG8:
2879
        {
2880
            uint64_t *ma;
2881
            float *mb;
2882
            uint32_t n;
2883
            ma = (uint64_t *)origdata;
2884
            mb = data;
2885
            for (n = 0; n < count; n++)
2886
            {
2887
                if (tif->tif_flags & TIFF_SWAB)
2888
                    TIFFSwabLong8(ma);
2889
                *mb++ = (float)(*ma++);
2890
            }
2891
        }
2892
        break;
2893
        case TIFF_SLONG8:
2894
        {
2895
            int64_t *ma;
2896
            float *mb;
2897
            uint32_t n;
2898
            ma = (int64_t *)origdata;
2899
            mb = data;
2900
            for (n = 0; n < count; n++)
2901
            {
2902
                if (tif->tif_flags & TIFF_SWAB)
2903
                    TIFFSwabLong8((uint64_t *)ma);
2904
                *mb++ = (float)(*ma++);
2905
            }
2906
        }
2907
        break;
2908
        case TIFF_RATIONAL:
2909
        {
2910
            uint32_t *ma;
2911
            uint32_t maa;
2912
            uint32_t mab;
2913
            float *mb;
2914
            uint32_t n;
2915
            ma = (uint32_t *)origdata;
2916
            mb = data;
2917
            for (n = 0; n < count; n++)
2918
            {
2919
                if (tif->tif_flags & TIFF_SWAB)
2920
                    TIFFSwabLong(ma);
2921
                maa = *ma++;
2922
                if (tif->tif_flags & TIFF_SWAB)
2923
                    TIFFSwabLong(ma);
2924
                mab = *ma++;
2925
                if (mab == 0)
2926
                    *mb++ = 0.0;
2927
                else
2928
                    *mb++ = (float)maa / (float)mab;
2929
            }
2930
        }
2931
        break;
2932
        case TIFF_SRATIONAL:
2933
        {
2934
            uint32_t *ma;
2935
            int32_t maa;
2936
            uint32_t mab;
2937
            float *mb;
2938
            uint32_t n;
2939
            ma = (uint32_t *)origdata;
2940
            mb = data;
2941
            for (n = 0; n < count; n++)
2942
            {
2943
                if (tif->tif_flags & TIFF_SWAB)
2944
                    TIFFSwabLong(ma);
2945
                maa = *(int32_t *)ma;
2946
                ma++;
2947
                if (tif->tif_flags & TIFF_SWAB)
2948
                    TIFFSwabLong(ma);
2949
                mab = *ma++;
2950
                if (mab == 0)
2951
                    *mb++ = 0.0;
2952
                else
2953
                    *mb++ = (float)maa / (float)mab;
2954
            }
2955
        }
2956
        break;
2957
        case TIFF_DOUBLE:
2958
        {
2959
            double *ma;
2960
            float *mb;
2961
            uint32_t n;
2962
            if (tif->tif_flags & TIFF_SWAB)
2963
                TIFFSwabArrayOfLong8((uint64_t *)origdata, count);
2964
            TIFFCvtIEEEDoubleToNative(tif, count, (double *)origdata);
2965
            ma = (double *)origdata;
2966
            mb = data;
2967
            for (n = 0; n < count; n++)
2968
            {
2969
                double val = *ma++;
2970
                if (val > FLT_MAX)
2971
                    val = FLT_MAX;
2972
                else if (val < -FLT_MAX)
2973
                    val = -FLT_MAX;
2974
                *mb++ = (float)val;
2975
            }
2976
        }
2977
        break;
2978
    }
2979
    _TIFFfreeExt(tif, origdata);
2980
    *value = data;
2981
    return (TIFFReadDirEntryErrOk);
2982
}
2983

2984
static enum TIFFReadDirEntryErr
2985
TIFFReadDirEntryDoubleArray(TIFF *tif, TIFFDirEntry *direntry, double **value)
2986
{
2987
    enum TIFFReadDirEntryErr err;
2988
    uint32_t count;
2989
    void *origdata;
2990
    double *data;
2991
    switch (direntry->tdir_type)
2992
    {
2993
        case TIFF_BYTE:
2994
        case TIFF_SBYTE:
2995
        case TIFF_SHORT:
2996
        case TIFF_SSHORT:
2997
        case TIFF_LONG:
2998
        case TIFF_SLONG:
2999
        case TIFF_LONG8:
3000
        case TIFF_SLONG8:
3001
        case TIFF_RATIONAL:
3002
        case TIFF_SRATIONAL:
3003
        case TIFF_FLOAT:
3004
        case TIFF_DOUBLE:
3005
            break;
3006
        default:
3007
            return (TIFFReadDirEntryErrType);
3008
    }
3009
    err = TIFFReadDirEntryArray(tif, direntry, &count, 8, &origdata);
3010
    if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
3011
    {
3012
        *value = 0;
3013
        return (err);
3014
    }
3015
    switch (direntry->tdir_type)
3016
    {
3017
        case TIFF_DOUBLE:
3018
            if (tif->tif_flags & TIFF_SWAB)
3019
                TIFFSwabArrayOfLong8((uint64_t *)origdata, count);
3020
            TIFFCvtIEEEDoubleToNative(tif, count, (double *)origdata);
3021
            *value = (double *)origdata;
3022
            return (TIFFReadDirEntryErrOk);
3023
    }
3024
    data = (double *)_TIFFmallocExt(tif, count * sizeof(double));
3025
    if (data == 0)
3026
    {
3027
        _TIFFfreeExt(tif, origdata);
3028
        return (TIFFReadDirEntryErrAlloc);
3029
    }
3030
    switch (direntry->tdir_type)
3031
    {
3032
        case TIFF_BYTE:
3033
        {
3034
            uint8_t *ma;
3035
            double *mb;
3036
            uint32_t n;
3037
            ma = (uint8_t *)origdata;
3038
            mb = data;
3039
            for (n = 0; n < count; n++)
3040
                *mb++ = (double)(*ma++);
3041
        }
3042
        break;
3043
        case TIFF_SBYTE:
3044
        {
3045
            int8_t *ma;
3046
            double *mb;
3047
            uint32_t n;
3048
            ma = (int8_t *)origdata;
3049
            mb = data;
3050
            for (n = 0; n < count; n++)
3051
                *mb++ = (double)(*ma++);
3052
        }
3053
        break;
3054
        case TIFF_SHORT:
3055
        {
3056
            uint16_t *ma;
3057
            double *mb;
3058
            uint32_t n;
3059
            ma = (uint16_t *)origdata;
3060
            mb = data;
3061
            for (n = 0; n < count; n++)
3062
            {
3063
                if (tif->tif_flags & TIFF_SWAB)
3064
                    TIFFSwabShort(ma);
3065
                *mb++ = (double)(*ma++);
3066
            }
3067
        }
3068
        break;
3069
        case TIFF_SSHORT:
3070
        {
3071
            int16_t *ma;
3072
            double *mb;
3073
            uint32_t n;
3074
            ma = (int16_t *)origdata;
3075
            mb = data;
3076
            for (n = 0; n < count; n++)
3077
            {
3078
                if (tif->tif_flags & TIFF_SWAB)
3079
                    TIFFSwabShort((uint16_t *)ma);
3080
                *mb++ = (double)(*ma++);
3081
            }
3082
        }
3083
        break;
3084
        case TIFF_LONG:
3085
        {
3086
            uint32_t *ma;
3087
            double *mb;
3088
            uint32_t n;
3089
            ma = (uint32_t *)origdata;
3090
            mb = data;
3091
            for (n = 0; n < count; n++)
3092
            {
3093
                if (tif->tif_flags & TIFF_SWAB)
3094
                    TIFFSwabLong(ma);
3095
                *mb++ = (double)(*ma++);
3096
            }
3097
        }
3098
        break;
3099
        case TIFF_SLONG:
3100
        {
3101
            int32_t *ma;
3102
            double *mb;
3103
            uint32_t n;
3104
            ma = (int32_t *)origdata;
3105
            mb = data;
3106
            for (n = 0; n < count; n++)
3107
            {
3108
                if (tif->tif_flags & TIFF_SWAB)
3109
                    TIFFSwabLong((uint32_t *)ma);
3110
                *mb++ = (double)(*ma++);
3111
            }
3112
        }
3113
        break;
3114
        case TIFF_LONG8:
3115
        {
3116
            uint64_t *ma;
3117
            double *mb;
3118
            uint32_t n;
3119
            ma = (uint64_t *)origdata;
3120
            mb = data;
3121
            for (n = 0; n < count; n++)
3122
            {
3123
                if (tif->tif_flags & TIFF_SWAB)
3124
                    TIFFSwabLong8(ma);
3125
                *mb++ = (double)(*ma++);
3126
            }
3127
        }
3128
        break;
3129
        case TIFF_SLONG8:
3130
        {
3131
            int64_t *ma;
3132
            double *mb;
3133
            uint32_t n;
3134
            ma = (int64_t *)origdata;
3135
            mb = data;
3136
            for (n = 0; n < count; n++)
3137
            {
3138
                if (tif->tif_flags & TIFF_SWAB)
3139
                    TIFFSwabLong8((uint64_t *)ma);
3140
                *mb++ = (double)(*ma++);
3141
            }
3142
        }
3143
        break;
3144
        case TIFF_RATIONAL:
3145
        {
3146
            uint32_t *ma;
3147
            uint32_t maa;
3148
            uint32_t mab;
3149
            double *mb;
3150
            uint32_t n;
3151
            ma = (uint32_t *)origdata;
3152
            mb = data;
3153
            for (n = 0; n < count; n++)
3154
            {
3155
                if (tif->tif_flags & TIFF_SWAB)
3156
                    TIFFSwabLong(ma);
3157
                maa = *ma++;
3158
                if (tif->tif_flags & TIFF_SWAB)
3159
                    TIFFSwabLong(ma);
3160
                mab = *ma++;
3161
                if (mab == 0)
3162
                    *mb++ = 0.0;
3163
                else
3164
                    *mb++ = (double)maa / (double)mab;
3165
            }
3166
        }
3167
        break;
3168
        case TIFF_SRATIONAL:
3169
        {
3170
            uint32_t *ma;
3171
            int32_t maa;
3172
            uint32_t mab;
3173
            double *mb;
3174
            uint32_t n;
3175
            ma = (uint32_t *)origdata;
3176
            mb = data;
3177
            for (n = 0; n < count; n++)
3178
            {
3179
                if (tif->tif_flags & TIFF_SWAB)
3180
                    TIFFSwabLong(ma);
3181
                maa = *(int32_t *)ma;
3182
                ma++;
3183
                if (tif->tif_flags & TIFF_SWAB)
3184
                    TIFFSwabLong(ma);
3185
                mab = *ma++;
3186
                if (mab == 0)
3187
                    *mb++ = 0.0;
3188
                else
3189
                    *mb++ = (double)maa / (double)mab;
3190
            }
3191
        }
3192
        break;
3193
        case TIFF_FLOAT:
3194
        {
3195
            float *ma;
3196
            double *mb;
3197
            uint32_t n;
3198
            if (tif->tif_flags & TIFF_SWAB)
3199
                TIFFSwabArrayOfLong((uint32_t *)origdata, count);
3200
            TIFFCvtIEEEFloatToNative(tif, count, (float *)origdata);
3201
            ma = (float *)origdata;
3202
            mb = data;
3203
            for (n = 0; n < count; n++)
3204
                *mb++ = (double)(*ma++);
3205
        }
3206
        break;
3207
    }
3208
    _TIFFfreeExt(tif, origdata);
3209
    *value = data;
3210
    return (TIFFReadDirEntryErrOk);
3211
}
3212

3213
static enum TIFFReadDirEntryErr
3214
TIFFReadDirEntryIfd8Array(TIFF *tif, TIFFDirEntry *direntry, uint64_t **value)
3215
{
3216
    enum TIFFReadDirEntryErr err;
3217
    uint32_t count;
3218
    void *origdata;
3219
    uint64_t *data;
3220
    switch (direntry->tdir_type)
3221
    {
3222
        case TIFF_LONG:
3223
        case TIFF_LONG8:
3224
        case TIFF_IFD:
3225
        case TIFF_IFD8:
3226
            break;
3227
        default:
3228
            return (TIFFReadDirEntryErrType);
3229
    }
3230
    err = TIFFReadDirEntryArray(tif, direntry, &count, 8, &origdata);
3231
    if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
3232
    {
3233
        *value = 0;
3234
        return (err);
3235
    }
3236
    switch (direntry->tdir_type)
3237
    {
3238
        case TIFF_LONG8:
3239
        case TIFF_IFD8:
3240
            *value = (uint64_t *)origdata;
3241
            if (tif->tif_flags & TIFF_SWAB)
3242
                TIFFSwabArrayOfLong8(*value, count);
3243
            return (TIFFReadDirEntryErrOk);
3244
    }
3245
    data = (uint64_t *)_TIFFmallocExt(tif, count * 8);
3246
    if (data == 0)
3247
    {
3248
        _TIFFfreeExt(tif, origdata);
3249
        return (TIFFReadDirEntryErrAlloc);
3250
    }
3251
    switch (direntry->tdir_type)
3252
    {
3253
        case TIFF_LONG:
3254
        case TIFF_IFD:
3255
        {
3256
            uint32_t *ma;
3257
            uint64_t *mb;
3258
            uint32_t n;
3259
            ma = (uint32_t *)origdata;
3260
            mb = data;
3261
            for (n = 0; n < count; n++)
3262
            {
3263
                if (tif->tif_flags & TIFF_SWAB)
3264
                    TIFFSwabLong(ma);
3265
                *mb++ = (uint64_t)(*ma++);
3266
            }
3267
        }
3268
        break;
3269
    }
3270
    _TIFFfreeExt(tif, origdata);
3271
    *value = data;
3272
    return (TIFFReadDirEntryErrOk);
3273
}
3274

3275
static enum TIFFReadDirEntryErr
3276
TIFFReadDirEntryPersampleShort(TIFF *tif, TIFFDirEntry *direntry,
3277
                               uint16_t *value)
3278
{
3279
    enum TIFFReadDirEntryErr err;
3280
    uint16_t *m;
3281
    uint16_t *na;
3282
    uint16_t nb;
3283
    if (direntry->tdir_count < (uint64_t)tif->tif_dir.td_samplesperpixel)
3284
        return (TIFFReadDirEntryErrCount);
3285
    err = TIFFReadDirEntryShortArray(tif, direntry, &m);
3286
    if (err != TIFFReadDirEntryErrOk || m == NULL)
3287
        return (err);
3288
    na = m;
3289
    nb = tif->tif_dir.td_samplesperpixel;
3290
    *value = *na++;
3291
    nb--;
3292
    while (nb > 0)
3293
    {
3294
        if (*na++ != *value)
3295
        {
3296
            err = TIFFReadDirEntryErrPsdif;
3297
            break;
3298
        }
3299
        nb--;
3300
    }
3301
    _TIFFfreeExt(tif, m);
3302
    return (err);
3303
}
3304

3305
static void TIFFReadDirEntryCheckedByte(TIFF *tif, TIFFDirEntry *direntry,
3306
                                        uint8_t *value)
3307
{
3308
    (void)tif;
3309
    *value = *(uint8_t *)(&direntry->tdir_offset);
3310
}
3311

3312
static void TIFFReadDirEntryCheckedSbyte(TIFF *tif, TIFFDirEntry *direntry,
3313
                                         int8_t *value)
3314
{
3315
    (void)tif;
3316
    *value = *(int8_t *)(&direntry->tdir_offset);
3317
}
3318

3319
static void TIFFReadDirEntryCheckedShort(TIFF *tif, TIFFDirEntry *direntry,
3320
                                         uint16_t *value)
3321
{
3322
    *value = direntry->tdir_offset.toff_short;
3323
    /* *value=*(uint16_t*)(&direntry->tdir_offset); */
3324
    if (tif->tif_flags & TIFF_SWAB)
3325
        TIFFSwabShort(value);
3326
}
3327

3328
static void TIFFReadDirEntryCheckedSshort(TIFF *tif, TIFFDirEntry *direntry,
3329
                                          int16_t *value)
3330
{
3331
    *value = *(int16_t *)(&direntry->tdir_offset);
3332
    if (tif->tif_flags & TIFF_SWAB)
3333
        TIFFSwabShort((uint16_t *)value);
3334
}
3335

3336
static void TIFFReadDirEntryCheckedLong(TIFF *tif, TIFFDirEntry *direntry,
3337
                                        uint32_t *value)
3338
{
3339
    *value = *(uint32_t *)(&direntry->tdir_offset);
3340
    if (tif->tif_flags & TIFF_SWAB)
3341
        TIFFSwabLong(value);
3342
}
3343

3344
static void TIFFReadDirEntryCheckedSlong(TIFF *tif, TIFFDirEntry *direntry,
3345
                                         int32_t *value)
3346
{
3347
    *value = *(int32_t *)(&direntry->tdir_offset);
3348
    if (tif->tif_flags & TIFF_SWAB)
3349
        TIFFSwabLong((uint32_t *)value);
3350
}
3351

3352
static enum TIFFReadDirEntryErr
3353
TIFFReadDirEntryCheckedLong8(TIFF *tif, TIFFDirEntry *direntry, uint64_t *value)
3354
{
3355
    if (!(tif->tif_flags & TIFF_BIGTIFF))
3356
    {
3357
        enum TIFFReadDirEntryErr err;
3358
        uint32_t offset = direntry->tdir_offset.toff_long;
3359
        if (tif->tif_flags & TIFF_SWAB)
3360
            TIFFSwabLong(&offset);
3361
        err = TIFFReadDirEntryData(tif, offset, 8, value);
3362
        if (err != TIFFReadDirEntryErrOk)
3363
            return (err);
3364
    }
3365
    else
3366
        *value = direntry->tdir_offset.toff_long8;
3367
    if (tif->tif_flags & TIFF_SWAB)
3368
        TIFFSwabLong8(value);
3369
    return (TIFFReadDirEntryErrOk);
3370
}
3371

3372
static enum TIFFReadDirEntryErr
3373
TIFFReadDirEntryCheckedSlong8(TIFF *tif, TIFFDirEntry *direntry, int64_t *value)
3374
{
3375
    if (!(tif->tif_flags & TIFF_BIGTIFF))
3376
    {
3377
        enum TIFFReadDirEntryErr err;
3378
        uint32_t offset = direntry->tdir_offset.toff_long;
3379
        if (tif->tif_flags & TIFF_SWAB)
3380
            TIFFSwabLong(&offset);
3381
        err = TIFFReadDirEntryData(tif, offset, 8, value);
3382
        if (err != TIFFReadDirEntryErrOk)
3383
            return (err);
3384
    }
3385
    else
3386
        *value = *(int64_t *)(&direntry->tdir_offset);
3387
    if (tif->tif_flags & TIFF_SWAB)
3388
        TIFFSwabLong8((uint64_t *)value);
3389
    return (TIFFReadDirEntryErrOk);
3390
}
3391

3392
static enum TIFFReadDirEntryErr
3393
TIFFReadDirEntryCheckedRational(TIFF *tif, TIFFDirEntry *direntry,
3394
                                double *value)
3395
{
3396
    UInt64Aligned_t m;
3397

3398
    assert(sizeof(double) == 8);
3399
    assert(sizeof(uint64_t) == 8);
3400
    assert(sizeof(uint32_t) == 4);
3401
    if (!(tif->tif_flags & TIFF_BIGTIFF))
3402
    {
3403
        enum TIFFReadDirEntryErr err;
3404
        uint32_t offset = direntry->tdir_offset.toff_long;
3405
        if (tif->tif_flags & TIFF_SWAB)
3406
            TIFFSwabLong(&offset);
3407
        err = TIFFReadDirEntryData(tif, offset, 8, m.i);
3408
        if (err != TIFFReadDirEntryErrOk)
3409
            return (err);
3410
    }
3411
    else
3412
        m.l = direntry->tdir_offset.toff_long8;
3413
    if (tif->tif_flags & TIFF_SWAB)
3414
        TIFFSwabArrayOfLong(m.i, 2);
3415
    /* Not completely sure what we should do when m.i[1]==0, but some */
3416
    /* sanitizers do not like division by 0.0: */
3417
    /* http://bugzilla.maptools.org/show_bug.cgi?id=2644 */
3418
    if (m.i[0] == 0 || m.i[1] == 0)
3419
        *value = 0.0;
3420
    else
3421
        *value = (double)m.i[0] / (double)m.i[1];
3422
    return (TIFFReadDirEntryErrOk);
3423
}
3424

3425
static enum TIFFReadDirEntryErr
3426
TIFFReadDirEntryCheckedSrational(TIFF *tif, TIFFDirEntry *direntry,
3427
                                 double *value)
3428
{
3429
    UInt64Aligned_t m;
3430
    assert(sizeof(double) == 8);
3431
    assert(sizeof(uint64_t) == 8);
3432
    assert(sizeof(int32_t) == 4);
3433
    assert(sizeof(uint32_t) == 4);
3434
    if (!(tif->tif_flags & TIFF_BIGTIFF))
3435
    {
3436
        enum TIFFReadDirEntryErr err;
3437
        uint32_t offset = direntry->tdir_offset.toff_long;
3438
        if (tif->tif_flags & TIFF_SWAB)
3439
            TIFFSwabLong(&offset);
3440
        err = TIFFReadDirEntryData(tif, offset, 8, m.i);
3441
        if (err != TIFFReadDirEntryErrOk)
3442
            return (err);
3443
    }
3444
    else
3445
        m.l = direntry->tdir_offset.toff_long8;
3446
    if (tif->tif_flags & TIFF_SWAB)
3447
        TIFFSwabArrayOfLong(m.i, 2);
3448
    /* Not completely sure what we should do when m.i[1]==0, but some */
3449
    /* sanitizers do not like division by 0.0: */
3450
    /* http://bugzilla.maptools.org/show_bug.cgi?id=2644 */
3451
    if ((int32_t)m.i[0] == 0 || m.i[1] == 0)
3452
        *value = 0.0;
3453
    else
3454
        *value = (double)((int32_t)m.i[0]) / (double)m.i[1];
3455
    return (TIFFReadDirEntryErrOk);
3456
}
3457

3458
#if 0
3459
static enum TIFFReadDirEntryErr
3460
TIFFReadDirEntryCheckedRationalDirect(TIFF *tif, TIFFDirEntry *direntry,
3461
                                      TIFFRational_t *value)
3462
{ /*--: SetGetRATIONAL_directly:_CustomTag: Read rational (and signed rationals)
3463
     directly --*/
3464
    UInt64Aligned_t m;
3465

3466
    assert(sizeof(double) == 8);
3467
    assert(sizeof(uint64_t) == 8);
3468
    assert(sizeof(uint32_t) == 4);
3469

3470
    if (direntry->tdir_count != 1)
3471
        return (TIFFReadDirEntryErrCount);
3472

3473
    if (direntry->tdir_type != TIFF_RATIONAL &&
3474
        direntry->tdir_type != TIFF_SRATIONAL)
3475
        return (TIFFReadDirEntryErrType);
3476

3477
    if (!(tif->tif_flags & TIFF_BIGTIFF))
3478
    {
3479
        enum TIFFReadDirEntryErr err;
3480
        uint32_t offset = direntry->tdir_offset.toff_long;
3481
        if (tif->tif_flags & TIFF_SWAB)
3482
            TIFFSwabLong(&offset);
3483
        err = TIFFReadDirEntryData(tif, offset, 8, m.i);
3484
        if (err != TIFFReadDirEntryErrOk)
3485
            return (err);
3486
    }
3487
    else
3488
    {
3489
        m.l = direntry->tdir_offset.toff_long8;
3490
    }
3491

3492
    if (tif->tif_flags & TIFF_SWAB)
3493
        TIFFSwabArrayOfLong(m.i, 2);
3494

3495
    value->uNum = m.i[0];
3496
    value->uDenom = m.i[1];
3497
    return (TIFFReadDirEntryErrOk);
3498
} /*-- TIFFReadDirEntryCheckedRationalDirect() --*/
3499
#endif
3500

3501
static void TIFFReadDirEntryCheckedFloat(TIFF *tif, TIFFDirEntry *direntry,
3502
                                         float *value)
3503
{
3504
    union
3505
    {
3506
        float f;
3507
        uint32_t i;
3508
    } float_union;
3509
    assert(sizeof(float) == 4);
3510
    assert(sizeof(uint32_t) == 4);
3511
    assert(sizeof(float_union) == 4);
3512
    float_union.i = *(uint32_t *)(&direntry->tdir_offset);
3513
    *value = float_union.f;
3514
    if (tif->tif_flags & TIFF_SWAB)
3515
        TIFFSwabLong((uint32_t *)value);
3516
}
3517

3518
static enum TIFFReadDirEntryErr
3519
TIFFReadDirEntryCheckedDouble(TIFF *tif, TIFFDirEntry *direntry, double *value)
3520
{
3521
    assert(sizeof(double) == 8);
3522
    assert(sizeof(uint64_t) == 8);
3523
    assert(sizeof(UInt64Aligned_t) == 8);
3524
    if (!(tif->tif_flags & TIFF_BIGTIFF))
3525
    {
3526
        enum TIFFReadDirEntryErr err;
3527
        uint32_t offset = direntry->tdir_offset.toff_long;
3528
        if (tif->tif_flags & TIFF_SWAB)
3529
            TIFFSwabLong(&offset);
3530
        err = TIFFReadDirEntryData(tif, offset, 8, value);
3531
        if (err != TIFFReadDirEntryErrOk)
3532
            return (err);
3533
    }
3534
    else
3535
    {
3536
        UInt64Aligned_t uint64_union;
3537
        uint64_union.l = direntry->tdir_offset.toff_long8;
3538
        *value = uint64_union.d;
3539
    }
3540
    if (tif->tif_flags & TIFF_SWAB)
3541
        TIFFSwabLong8((uint64_t *)value);
3542
    return (TIFFReadDirEntryErrOk);
3543
}
3544

3545
static enum TIFFReadDirEntryErr
3546
TIFFReadDirEntryCheckRangeByteSbyte(int8_t value)
3547
{
3548
    if (value < 0)
3549
        return (TIFFReadDirEntryErrRange);
3550
    else
3551
        return (TIFFReadDirEntryErrOk);
3552
}
3553

3554
static enum TIFFReadDirEntryErr
3555
TIFFReadDirEntryCheckRangeByteShort(uint16_t value)
3556
{
3557
    if (value > 0xFF)
3558
        return (TIFFReadDirEntryErrRange);
3559
    else
3560
        return (TIFFReadDirEntryErrOk);
3561
}
3562

3563
static enum TIFFReadDirEntryErr
3564
TIFFReadDirEntryCheckRangeByteSshort(int16_t value)
3565
{
3566
    if ((value < 0) || (value > 0xFF))
3567
        return (TIFFReadDirEntryErrRange);
3568
    else
3569
        return (TIFFReadDirEntryErrOk);
3570
}
3571

3572
static enum TIFFReadDirEntryErr
3573
TIFFReadDirEntryCheckRangeByteLong(uint32_t value)
3574
{
3575
    if (value > 0xFF)
3576
        return (TIFFReadDirEntryErrRange);
3577
    else
3578
        return (TIFFReadDirEntryErrOk);
3579
}
3580

3581
static enum TIFFReadDirEntryErr
3582
TIFFReadDirEntryCheckRangeByteSlong(int32_t value)
3583
{
3584
    if ((value < 0) || (value > 0xFF))
3585
        return (TIFFReadDirEntryErrRange);
3586
    else
3587
        return (TIFFReadDirEntryErrOk);
3588
}
3589

3590
static enum TIFFReadDirEntryErr
3591
TIFFReadDirEntryCheckRangeByteLong8(uint64_t value)
3592
{
3593
    if (value > 0xFF)
3594
        return (TIFFReadDirEntryErrRange);
3595
    else
3596
        return (TIFFReadDirEntryErrOk);
3597
}
3598

3599
static enum TIFFReadDirEntryErr
3600
TIFFReadDirEntryCheckRangeByteSlong8(int64_t value)
3601
{
3602
    if ((value < 0) || (value > 0xFF))
3603
        return (TIFFReadDirEntryErrRange);
3604
    else
3605
        return (TIFFReadDirEntryErrOk);
3606
}
3607

3608
static enum TIFFReadDirEntryErr
3609
TIFFReadDirEntryCheckRangeSbyteByte(uint8_t value)
3610
{
3611
    if (value > 0x7F)
3612
        return (TIFFReadDirEntryErrRange);
3613
    else
3614
        return (TIFFReadDirEntryErrOk);
3615
}
3616

3617
static enum TIFFReadDirEntryErr
3618
TIFFReadDirEntryCheckRangeSbyteShort(uint16_t value)
3619
{
3620
    if (value > 0x7F)
3621
        return (TIFFReadDirEntryErrRange);
3622
    else
3623
        return (TIFFReadDirEntryErrOk);
3624
}
3625

3626
static enum TIFFReadDirEntryErr
3627
TIFFReadDirEntryCheckRangeSbyteSshort(int16_t value)
3628
{
3629
    if ((value < -0x80) || (value > 0x7F))
3630
        return (TIFFReadDirEntryErrRange);
3631
    else
3632
        return (TIFFReadDirEntryErrOk);
3633
}
3634

3635
static enum TIFFReadDirEntryErr
3636
TIFFReadDirEntryCheckRangeSbyteLong(uint32_t value)
3637
{
3638
    if (value > 0x7F)
3639
        return (TIFFReadDirEntryErrRange);
3640
    else
3641
        return (TIFFReadDirEntryErrOk);
3642
}
3643

3644
static enum TIFFReadDirEntryErr
3645
TIFFReadDirEntryCheckRangeSbyteSlong(int32_t value)
3646
{
3647
    if ((value < -0x80) || (value > 0x7F))
3648
        return (TIFFReadDirEntryErrRange);
3649
    else
3650
        return (TIFFReadDirEntryErrOk);
3651
}
3652

3653
static enum TIFFReadDirEntryErr
3654
TIFFReadDirEntryCheckRangeSbyteLong8(uint64_t value)
3655
{
3656
    if (value > 0x7F)
3657
        return (TIFFReadDirEntryErrRange);
3658
    else
3659
        return (TIFFReadDirEntryErrOk);
3660
}
3661

3662
static enum TIFFReadDirEntryErr
3663
TIFFReadDirEntryCheckRangeSbyteSlong8(int64_t value)
3664
{
3665
    if ((value < -0x80) || (value > 0x7F))
3666
        return (TIFFReadDirEntryErrRange);
3667
    else
3668
        return (TIFFReadDirEntryErrOk);
3669
}
3670

3671
static enum TIFFReadDirEntryErr
3672
TIFFReadDirEntryCheckRangeShortSbyte(int8_t value)
3673
{
3674
    if (value < 0)
3675
        return (TIFFReadDirEntryErrRange);
3676
    else
3677
        return (TIFFReadDirEntryErrOk);
3678
}
3679

3680
static enum TIFFReadDirEntryErr
3681
TIFFReadDirEntryCheckRangeShortSshort(int16_t value)
3682
{
3683
    if (value < 0)
3684
        return (TIFFReadDirEntryErrRange);
3685
    else
3686
        return (TIFFReadDirEntryErrOk);
3687
}
3688

3689
static enum TIFFReadDirEntryErr
3690
TIFFReadDirEntryCheckRangeShortLong(uint32_t value)
3691
{
3692
    if (value > 0xFFFF)
3693
        return (TIFFReadDirEntryErrRange);
3694
    else
3695
        return (TIFFReadDirEntryErrOk);
3696
}
3697

3698
static enum TIFFReadDirEntryErr
3699
TIFFReadDirEntryCheckRangeShortSlong(int32_t value)
3700
{
3701
    if ((value < 0) || (value > 0xFFFF))
3702
        return (TIFFReadDirEntryErrRange);
3703
    else
3704
        return (TIFFReadDirEntryErrOk);
3705
}
3706

3707
static enum TIFFReadDirEntryErr
3708
TIFFReadDirEntryCheckRangeShortLong8(uint64_t value)
3709
{
3710
    if (value > 0xFFFF)
3711
        return (TIFFReadDirEntryErrRange);
3712
    else
3713
        return (TIFFReadDirEntryErrOk);
3714
}
3715

3716
static enum TIFFReadDirEntryErr
3717
TIFFReadDirEntryCheckRangeShortSlong8(int64_t value)
3718
{
3719
    if ((value < 0) || (value > 0xFFFF))
3720
        return (TIFFReadDirEntryErrRange);
3721
    else
3722
        return (TIFFReadDirEntryErrOk);
3723
}
3724

3725
static enum TIFFReadDirEntryErr
3726
TIFFReadDirEntryCheckRangeSshortShort(uint16_t value)
3727
{
3728
    if (value > 0x7FFF)
3729
        return (TIFFReadDirEntryErrRange);
3730
    else
3731
        return (TIFFReadDirEntryErrOk);
3732
}
3733

3734
static enum TIFFReadDirEntryErr
3735
TIFFReadDirEntryCheckRangeSshortLong(uint32_t value)
3736
{
3737
    if (value > 0x7FFF)
3738
        return (TIFFReadDirEntryErrRange);
3739
    else
3740
        return (TIFFReadDirEntryErrOk);
3741
}
3742

3743
static enum TIFFReadDirEntryErr
3744
TIFFReadDirEntryCheckRangeSshortSlong(int32_t value)
3745
{
3746
    if ((value < -0x8000) || (value > 0x7FFF))
3747
        return (TIFFReadDirEntryErrRange);
3748
    else
3749
        return (TIFFReadDirEntryErrOk);
3750
}
3751

3752
static enum TIFFReadDirEntryErr
3753
TIFFReadDirEntryCheckRangeSshortLong8(uint64_t value)
3754
{
3755
    if (value > 0x7FFF)
3756
        return (TIFFReadDirEntryErrRange);
3757
    else
3758
        return (TIFFReadDirEntryErrOk);
3759
}
3760

3761
static enum TIFFReadDirEntryErr
3762
TIFFReadDirEntryCheckRangeSshortSlong8(int64_t value)
3763
{
3764
    if ((value < -0x8000) || (value > 0x7FFF))
3765
        return (TIFFReadDirEntryErrRange);
3766
    else
3767
        return (TIFFReadDirEntryErrOk);
3768
}
3769

3770
static enum TIFFReadDirEntryErr
3771
TIFFReadDirEntryCheckRangeLongSbyte(int8_t value)
3772
{
3773
    if (value < 0)
3774
        return (TIFFReadDirEntryErrRange);
3775
    else
3776
        return (TIFFReadDirEntryErrOk);
3777
}
3778

3779
static enum TIFFReadDirEntryErr
3780
TIFFReadDirEntryCheckRangeLongSshort(int16_t value)
3781
{
3782
    if (value < 0)
3783
        return (TIFFReadDirEntryErrRange);
3784
    else
3785
        return (TIFFReadDirEntryErrOk);
3786
}
3787

3788
static enum TIFFReadDirEntryErr
3789
TIFFReadDirEntryCheckRangeLongSlong(int32_t value)
3790
{
3791
    if (value < 0)
3792
        return (TIFFReadDirEntryErrRange);
3793
    else
3794
        return (TIFFReadDirEntryErrOk);
3795
}
3796

3797
static enum TIFFReadDirEntryErr
3798
TIFFReadDirEntryCheckRangeLongLong8(uint64_t value)
3799
{
3800
    if (value > UINT32_MAX)
3801
        return (TIFFReadDirEntryErrRange);
3802
    else
3803
        return (TIFFReadDirEntryErrOk);
3804
}
3805

3806
static enum TIFFReadDirEntryErr
3807
TIFFReadDirEntryCheckRangeLongSlong8(int64_t value)
3808
{
3809
    if ((value < 0) || (value > (int64_t)UINT32_MAX))
3810
        return (TIFFReadDirEntryErrRange);
3811
    else
3812
        return (TIFFReadDirEntryErrOk);
3813
}
3814

3815
static enum TIFFReadDirEntryErr
3816
TIFFReadDirEntryCheckRangeSlongLong(uint32_t value)
3817
{
3818
    if (value > 0x7FFFFFFFUL)
3819
        return (TIFFReadDirEntryErrRange);
3820
    else
3821
        return (TIFFReadDirEntryErrOk);
3822
}
3823

3824
/* Check that the 8-byte unsigned value can fit in a 4-byte unsigned range */
3825
static enum TIFFReadDirEntryErr
3826
TIFFReadDirEntryCheckRangeSlongLong8(uint64_t value)
3827
{
3828
    if (value > 0x7FFFFFFF)
3829
        return (TIFFReadDirEntryErrRange);
3830
    else
3831
        return (TIFFReadDirEntryErrOk);
3832
}
3833

3834
/* Check that the 8-byte signed value can fit in a 4-byte signed range */
3835
static enum TIFFReadDirEntryErr
3836
TIFFReadDirEntryCheckRangeSlongSlong8(int64_t value)
3837
{
3838
    if ((value < 0 - ((int64_t)0x7FFFFFFF + 1)) || (value > 0x7FFFFFFF))
3839
        return (TIFFReadDirEntryErrRange);
3840
    else
3841
        return (TIFFReadDirEntryErrOk);
3842
}
3843

3844
static enum TIFFReadDirEntryErr
3845
TIFFReadDirEntryCheckRangeLong8Sbyte(int8_t value)
3846
{
3847
    if (value < 0)
3848
        return (TIFFReadDirEntryErrRange);
3849
    else
3850
        return (TIFFReadDirEntryErrOk);
3851
}
3852

3853
static enum TIFFReadDirEntryErr
3854
TIFFReadDirEntryCheckRangeLong8Sshort(int16_t value)
3855
{
3856
    if (value < 0)
3857
        return (TIFFReadDirEntryErrRange);
3858
    else
3859
        return (TIFFReadDirEntryErrOk);
3860
}
3861

3862
static enum TIFFReadDirEntryErr
3863
TIFFReadDirEntryCheckRangeLong8Slong(int32_t value)
3864
{
3865
    if (value < 0)
3866
        return (TIFFReadDirEntryErrRange);
3867
    else
3868
        return (TIFFReadDirEntryErrOk);
3869
}
3870

3871
static enum TIFFReadDirEntryErr
3872
TIFFReadDirEntryCheckRangeLong8Slong8(int64_t value)
3873
{
3874
    if (value < 0)
3875
        return (TIFFReadDirEntryErrRange);
3876
    else
3877
        return (TIFFReadDirEntryErrOk);
3878
}
3879

3880
static enum TIFFReadDirEntryErr
3881
TIFFReadDirEntryCheckRangeSlong8Long8(uint64_t value)
3882
{
3883
    if (value > INT64_MAX)
3884
        return (TIFFReadDirEntryErrRange);
3885
    else
3886
        return (TIFFReadDirEntryErrOk);
3887
}
3888

3889
static enum TIFFReadDirEntryErr TIFFReadDirEntryData(TIFF *tif, uint64_t offset,
3890
                                                     tmsize_t size, void *dest)
3891
{
3892
    assert(size > 0);
3893
    if (!isMapped(tif))
3894
    {
3895
        if (!SeekOK(tif, offset))
3896
            return (TIFFReadDirEntryErrIo);
3897
        if (!ReadOK(tif, dest, size))
3898
            return (TIFFReadDirEntryErrIo);
3899
    }
3900
    else
3901
    {
3902
        size_t ma, mb;
3903
        ma = (size_t)offset;
3904
        if ((uint64_t)ma != offset || ma > (~(size_t)0) - (size_t)size)
3905
        {
3906
            return TIFFReadDirEntryErrIo;
3907
        }
3908
        mb = ma + size;
3909
        if (mb > (uint64_t)tif->tif_size)
3910
            return (TIFFReadDirEntryErrIo);
3911
        _TIFFmemcpy(dest, tif->tif_base + ma, size);
3912
    }
3913
    return (TIFFReadDirEntryErrOk);
3914
}
3915

3916
static void TIFFReadDirEntryOutputErr(TIFF *tif, enum TIFFReadDirEntryErr err,
3917
                                      const char *module, const char *tagname,
3918
                                      int recover)
3919
{
3920
    if (!recover)
3921
    {
3922
        switch (err)
3923
        {
3924
            case TIFFReadDirEntryErrCount:
3925
                TIFFErrorExtR(tif, module, "Incorrect count for \"%s\"",
3926
                              tagname);
3927
                break;
3928
            case TIFFReadDirEntryErrType:
3929
                TIFFErrorExtR(tif, module, "Incompatible type for \"%s\"",
3930
                              tagname);
3931
                break;
3932
            case TIFFReadDirEntryErrIo:
3933
                TIFFErrorExtR(tif, module, "IO error during reading of \"%s\"",
3934
                              tagname);
3935
                break;
3936
            case TIFFReadDirEntryErrRange:
3937
                TIFFErrorExtR(tif, module, "Incorrect value for \"%s\"",
3938
                              tagname);
3939
                break;
3940
            case TIFFReadDirEntryErrPsdif:
3941
                TIFFErrorExtR(
3942
                    tif, module,
3943
                    "Cannot handle different values per sample for \"%s\"",
3944
                    tagname);
3945
                break;
3946
            case TIFFReadDirEntryErrSizesan:
3947
                TIFFErrorExtR(tif, module,
3948
                              "Sanity check on size of \"%s\" value failed",
3949
                              tagname);
3950
                break;
3951
            case TIFFReadDirEntryErrAlloc:
3952
                TIFFErrorExtR(tif, module, "Out of memory reading of \"%s\"",
3953
                              tagname);
3954
                break;
3955
            default:
3956
                assert(0); /* we should never get here */
3957
                break;
3958
        }
3959
    }
3960
    else
3961
    {
3962
        switch (err)
3963
        {
3964
            case TIFFReadDirEntryErrCount:
3965
                TIFFWarningExtR(tif, module,
3966
                                "Incorrect count for \"%s\"; tag ignored",
3967
                                tagname);
3968
                break;
3969
            case TIFFReadDirEntryErrType:
3970
                TIFFWarningExtR(tif, module,
3971
                                "Incompatible type for \"%s\"; tag ignored",
3972
                                tagname);
3973
                break;
3974
            case TIFFReadDirEntryErrIo:
3975
                TIFFWarningExtR(
3976
                    tif, module,
3977
                    "IO error during reading of \"%s\"; tag ignored", tagname);
3978
                break;
3979
            case TIFFReadDirEntryErrRange:
3980
                TIFFWarningExtR(tif, module,
3981
                                "Incorrect value for \"%s\"; tag ignored",
3982
                                tagname);
3983
                break;
3984
            case TIFFReadDirEntryErrPsdif:
3985
                TIFFWarningExtR(tif, module,
3986
                                "Cannot handle different values per sample for "
3987
                                "\"%s\"; tag ignored",
3988
                                tagname);
3989
                break;
3990
            case TIFFReadDirEntryErrSizesan:
3991
                TIFFWarningExtR(
3992
                    tif, module,
3993
                    "Sanity check on size of \"%s\" value failed; tag ignored",
3994
                    tagname);
3995
                break;
3996
            case TIFFReadDirEntryErrAlloc:
3997
                TIFFWarningExtR(tif, module,
3998
                                "Out of memory reading of \"%s\"; tag ignored",
3999
                                tagname);
4000
                break;
4001
            default:
4002
                assert(0); /* we should never get here */
4003
                break;
4004
        }
4005
    }
4006
}
4007

4008
/*
4009
 * Return the maximum number of color channels specified for a given photometric
4010
 * type. 0 is returned if photometric type isn't supported or no default value
4011
 * is defined by the specification.
4012
 */
4013
static int _TIFFGetMaxColorChannels(uint16_t photometric)
4014
{
4015
    switch (photometric)
4016
    {
4017
        case PHOTOMETRIC_PALETTE:
4018
        case PHOTOMETRIC_MINISWHITE:
4019
        case PHOTOMETRIC_MINISBLACK:
4020
            return 1;
4021
        case PHOTOMETRIC_YCBCR:
4022
        case PHOTOMETRIC_RGB:
4023
        case PHOTOMETRIC_CIELAB:
4024
        case PHOTOMETRIC_LOGLUV:
4025
        case PHOTOMETRIC_ITULAB:
4026
        case PHOTOMETRIC_ICCLAB:
4027
            return 3;
4028
        case PHOTOMETRIC_SEPARATED:
4029
        case PHOTOMETRIC_MASK:
4030
            return 4;
4031
        case PHOTOMETRIC_LOGL:
4032
        case PHOTOMETRIC_CFA:
4033
        default:
4034
            return 0;
4035
    }
4036
}
4037

4038
static int ByteCountLooksBad(TIFF *tif)
4039
{
4040
    /*
4041
     * Assume we have wrong StripByteCount value (in case
4042
     * of single strip) in following cases:
4043
     *   - it is equal to zero along with StripOffset;
4044
     *   - it is larger than file itself (in case of uncompressed
4045
     *     image);
4046
     *   - it is smaller than the size of the bytes per row
4047
     *     multiplied on the number of rows.  The last case should
4048
     *     not be checked in the case of writing new image,
4049
     *     because we may do not know the exact strip size
4050
     *     until the whole image will be written and directory
4051
     *     dumped out.
4052
     */
4053
    uint64_t bytecount = TIFFGetStrileByteCount(tif, 0);
4054
    uint64_t offset = TIFFGetStrileOffset(tif, 0);
4055
    uint64_t filesize;
4056

4057
    if (offset == 0)
4058
        return 0;
4059
    if (bytecount == 0)
4060
        return 1;
4061
    if (tif->tif_dir.td_compression != COMPRESSION_NONE)
4062
        return 0;
4063
    filesize = TIFFGetFileSize(tif);
4064
    if (offset <= filesize && bytecount > filesize - offset)
4065
        return 1;
4066
    if (tif->tif_mode == O_RDONLY)
4067
    {
4068
        uint64_t scanlinesize = TIFFScanlineSize64(tif);
4069
        if (tif->tif_dir.td_imagelength > 0 &&
4070
            scanlinesize > UINT64_MAX / tif->tif_dir.td_imagelength)
4071
        {
4072
            return 1;
4073
        }
4074
        if (bytecount < scanlinesize * tif->tif_dir.td_imagelength)
4075
            return 1;
4076
    }
4077
    return 0;
4078
}
4079

4080
/*
4081
 * To evaluate the IFD data size when reading, save the offset and data size of
4082
 * all data that does not fit into the IFD entries themselves.
4083
 */
4084
static bool EvaluateIFDdatasizeReading(TIFF *tif, TIFFDirEntry *dp)
4085
{
4086
    const uint64_t data_width = TIFFDataWidth(dp->tdir_type);
4087
    if (data_width != 0 && dp->tdir_count > UINT64_MAX / data_width)
4088
    {
4089
        TIFFErrorExtR(tif, "EvaluateIFDdatasizeReading",
4090
                      "Too large IFD data size");
4091
        return false;
4092
    }
4093
    const uint64_t datalength = dp->tdir_count * data_width;
4094
    if (datalength > ((tif->tif_flags & TIFF_BIGTIFF) ? 0x8U : 0x4U))
4095
    {
4096
        if (tif->tif_dir.td_dirdatasize_read > UINT64_MAX - datalength)
4097
        {
4098
            TIFFErrorExtR(tif, "EvaluateIFDdatasizeReading",
4099
                          "Too large IFD data size");
4100
            return false;
4101
        }
4102
        tif->tif_dir.td_dirdatasize_read += datalength;
4103
        if (!(tif->tif_flags & TIFF_BIGTIFF))
4104
        {
4105
            /* The offset of TIFFDirEntry are not swapped when read in. That has
4106
             * to be done when used. */
4107
            uint32_t offset = dp->tdir_offset.toff_long;
4108
            if (tif->tif_flags & TIFF_SWAB)
4109
                TIFFSwabLong(&offset);
4110
            tif->tif_dir
4111
                .td_dirdatasize_offsets[tif->tif_dir.td_dirdatasize_Noffsets]
4112
                .offset = (uint64_t)offset;
4113
        }
4114
        else
4115
        {
4116
            tif->tif_dir
4117
                .td_dirdatasize_offsets[tif->tif_dir.td_dirdatasize_Noffsets]
4118
                .offset = dp->tdir_offset.toff_long8;
4119
            if (tif->tif_flags & TIFF_SWAB)
4120
                TIFFSwabLong8(
4121
                    &tif->tif_dir
4122
                         .td_dirdatasize_offsets[tif->tif_dir
4123
                                                     .td_dirdatasize_Noffsets]
4124
                         .offset);
4125
        }
4126
        tif->tif_dir
4127
            .td_dirdatasize_offsets[tif->tif_dir.td_dirdatasize_Noffsets]
4128
            .length = datalength;
4129
        tif->tif_dir.td_dirdatasize_Noffsets++;
4130
    }
4131
    return true;
4132
}
4133

4134
/*
4135
 * Compare function for qsort() sorting TIFFEntryOffsetAndLength array entries.
4136
 */
4137
static int cmpTIFFEntryOffsetAndLength(const void *a, const void *b)
4138
{
4139
    const TIFFEntryOffsetAndLength *ta = (const TIFFEntryOffsetAndLength *)a;
4140
    const TIFFEntryOffsetAndLength *tb = (const TIFFEntryOffsetAndLength *)b;
4141
    /* Compare offsets */
4142
    if (ta->offset > tb->offset)
4143
        return 1;
4144
    else if (ta->offset < tb->offset)
4145
        return -1;
4146
    else
4147
        return 0;
4148
}
4149

4150
/*
4151
 * Determine the IFD data size after reading an IFD from the file that can be
4152
 * overwritten and saving it in tif_dir.td_dirdatasize_read. This data size
4153
 * includes the IFD entries themselves as well as the data that does not fit
4154
 * directly into the IFD entries but is located directly after the IFD entries
4155
 * in the file.
4156
 */
4157
static void CalcFinalIFDdatasizeReading(TIFF *tif, uint16_t dircount)
4158
{
4159
    /* IFD data size is only needed if file-writing is enabled.
4160
     * This also avoids the seek() to EOF to determine the file size, which
4161
     * causes the stdin-streaming-friendly mode of libtiff for GDAL to fail. */
4162
    if (tif->tif_mode == O_RDONLY)
4163
        return;
4164

4165
    /* Sort TIFFEntryOffsetAndLength array in ascending order. */
4166
    qsort(tif->tif_dir.td_dirdatasize_offsets,
4167
          tif->tif_dir.td_dirdatasize_Noffsets,
4168
          sizeof(TIFFEntryOffsetAndLength), cmpTIFFEntryOffsetAndLength);
4169

4170
    /* Get offset of end of IFD entry space. */
4171
    uint64_t IFDendoffset;
4172
    if (!(tif->tif_flags & TIFF_BIGTIFF))
4173
        IFDendoffset = tif->tif_diroff + 2 + dircount * 12 + 4;
4174
    else
4175
        IFDendoffset = tif->tif_diroff + 8 + dircount * 20 + 8;
4176

4177
    /* Check which offsets are right behind IFD entries. However, LibTIFF
4178
     * increments the writing address for every external data to an even offset.
4179
     * Thus gaps of 1 byte can occur. */
4180
    uint64_t size = 0;
4181
    uint64_t offset;
4182
    uint32_t i;
4183
    for (i = 0; i < tif->tif_dir.td_dirdatasize_Noffsets; i++)
4184
    {
4185
        offset = tif->tif_dir.td_dirdatasize_offsets[i].offset;
4186
        if (offset == IFDendoffset)
4187
        {
4188
            size += tif->tif_dir.td_dirdatasize_offsets[i].length;
4189
            IFDendoffset += tif->tif_dir.td_dirdatasize_offsets[i].length;
4190
        }
4191
        else if (offset == IFDendoffset + 1)
4192
        {
4193
            /* Add gap byte after previous IFD data set. */
4194
            size += tif->tif_dir.td_dirdatasize_offsets[i].length + 1;
4195
            IFDendoffset += tif->tif_dir.td_dirdatasize_offsets[i].length;
4196
        }
4197
        else
4198
        {
4199
            /* Further data is no more continuously after IFD */
4200
            break;
4201
        }
4202
    }
4203
    /* Check for gap byte of some easy cases. This should cover 90% of cases.
4204
     * Otherwise, IFD will be re-written even it might be safely overwritten. */
4205
    if (tif->tif_nextdiroff != 0)
4206
    {
4207
        if (tif->tif_nextdiroff == IFDendoffset + 1)
4208
            size++;
4209
    }
4210
    else
4211
    {
4212
        /* Check for IFD data ends at EOF. Then IFD can always be safely
4213
         * overwritten. */
4214
        offset = TIFFSeekFile(tif, 0, SEEK_END);
4215
        if (offset == IFDendoffset)
4216
        {
4217
            tif->tif_dir.td_dirdatasize_read = UINT64_MAX;
4218
            return;
4219
        }
4220
    }
4221

4222
    /* Finally, add the size of the IFD tag entries themselves. */
4223
    if (!(tif->tif_flags & TIFF_BIGTIFF))
4224
        tif->tif_dir.td_dirdatasize_read = 2 + dircount * 12 + 4 + size;
4225
    else
4226
        tif->tif_dir.td_dirdatasize_read = 8 + dircount * 20 + 8 + size;
4227
} /*-- CalcFinalIFDdatasizeReading() --*/
4228

4229
/*
4230
 * Read the next TIFF directory from a file and convert it to the internal
4231
 * format. We read directories sequentially.
4232
 */
4233
int TIFFReadDirectory(TIFF *tif)
4234
{
4235
    static const char module[] = "TIFFReadDirectory";
4236
    TIFFDirEntry *dir;
4237
    uint16_t dircount;
4238
    TIFFDirEntry *dp;
4239
    uint16_t di;
4240
    const TIFFField *fip;
4241
    uint32_t fii = FAILED_FII;
4242
    toff_t nextdiroff;
4243
    int bitspersample_read = FALSE;
4244
    int color_channels;
4245

4246
    if (tif->tif_nextdiroff == 0)
4247
    {
4248
        /* In this special case, tif_diroff needs also to be set to 0.
4249
         * This is behind the last IFD, thus no checking or reading necessary.
4250
         */
4251
        tif->tif_diroff = tif->tif_nextdiroff;
4252
        return 0;
4253
    }
4254

4255
    nextdiroff = tif->tif_nextdiroff;
4256
    /* tif_curdir++ and tif_nextdiroff should only be updated after SUCCESSFUL
4257
     * reading of the directory. Otherwise, invalid IFD offsets could corrupt
4258
     * the IFD list. */
4259
    if (!_TIFFCheckDirNumberAndOffset(tif,
4260
                                      tif->tif_curdir ==
4261
                                              TIFF_NON_EXISTENT_DIR_NUMBER
4262
                                          ? 0
4263
                                          : tif->tif_curdir + 1,
4264
                                      nextdiroff))
4265
    {
4266
        return 0; /* bad offset (IFD looping or more than TIFF_MAX_DIR_COUNT
4267
                     IFDs) */
4268
    }
4269
    dircount = TIFFFetchDirectory(tif, nextdiroff, &dir, &tif->tif_nextdiroff);
4270
    if (!dircount)
4271
    {
4272
        TIFFErrorExtR(tif, module,
4273
                      "Failed to read directory at offset %" PRIu64,
4274
                      nextdiroff);
4275
        return 0;
4276
    }
4277
    /* Set global values after a valid directory has been fetched.
4278
     * tif_diroff is already set to nextdiroff in TIFFFetchDirectory() in the
4279
     * beginning. */
4280
    if (tif->tif_curdir == TIFF_NON_EXISTENT_DIR_NUMBER)
4281
        tif->tif_curdir = 0;
4282
    else
4283
        tif->tif_curdir++;
4284

4285
    TIFFReadDirectoryCheckOrder(tif, dir, dircount);
4286

4287
    /*
4288
     * Mark duplicates of any tag to be ignored (bugzilla 1994)
4289
     * to avoid certain pathological problems.
4290
     */
4291
    {
4292
        TIFFDirEntry *ma;
4293
        uint16_t mb;
4294
        for (ma = dir, mb = 0; mb < dircount; ma++, mb++)
4295
        {
4296
            TIFFDirEntry *na;
4297
            uint16_t nb;
4298
            for (na = ma + 1, nb = mb + 1; nb < dircount; na++, nb++)
4299
            {
4300
                if (ma->tdir_tag == na->tdir_tag)
4301
                {
4302
                    na->tdir_ignore = TRUE;
4303
                }
4304
            }
4305
        }
4306
    }
4307

4308
    tif->tif_flags &= ~TIFF_BEENWRITING; /* reset before new dir */
4309
    tif->tif_flags &= ~TIFF_BUF4WRITE;   /* reset before new dir */
4310
    tif->tif_flags &= ~TIFF_CHOPPEDUPARRAYS;
4311

4312
    /* free any old stuff and reinit */
4313
    (*tif->tif_cleanup)(tif); /* cleanup any previous compression state */
4314
    TIFFFreeDirectory(tif);
4315
    TIFFDefaultDirectory(tif);
4316

4317
    /* After setup a fresh directory indicate that now active IFD is also
4318
     * present on file, even if its entries could not be read successfully
4319
     * below.  */
4320
    tif->tif_dir.td_iswrittentofile = TRUE;
4321

4322
    /* Allocate arrays for offset values outside IFD entry for IFD data size
4323
     * checking. Note: Counter are reset within TIFFFreeDirectory(). */
4324
    tif->tif_dir.td_dirdatasize_offsets =
4325
        (TIFFEntryOffsetAndLength *)_TIFFmallocExt(
4326
            tif, dircount * sizeof(TIFFEntryOffsetAndLength));
4327
    if (tif->tif_dir.td_dirdatasize_offsets == NULL)
4328
    {
4329
        TIFFErrorExtR(
4330
            tif, module,
4331
            "Failed to allocate memory for counting IFD data size at reading");
4332
        goto bad;
4333
    }
4334
    /*
4335
     * Electronic Arts writes gray-scale TIFF files
4336
     * without a PlanarConfiguration directory entry.
4337
     * Thus we setup a default value here, even though
4338
     * the TIFF spec says there is no default value.
4339
     * After PlanarConfiguration is preset in TIFFDefaultDirectory()
4340
     * the following setting is not needed, but does not harm either.
4341
     */
4342
    TIFFSetField(tif, TIFFTAG_PLANARCONFIG, PLANARCONFIG_CONTIG);
4343
    /*
4344
     * Setup default value and then make a pass over
4345
     * the fields to check type and tag information,
4346
     * and to extract info required to size data
4347
     * structures.  A second pass is made afterwards
4348
     * to read in everything not taken in the first pass.
4349
     * But we must process the Compression tag first
4350
     * in order to merge in codec-private tag definitions (otherwise
4351
     * we may get complaints about unknown tags).  However, the
4352
     * Compression tag may be dependent on the SamplesPerPixel
4353
     * tag value because older TIFF specs permitted Compression
4354
     * to be written as a SamplesPerPixel-count tag entry.
4355
     * Thus if we don't first figure out the correct SamplesPerPixel
4356
     * tag value then we may end up ignoring the Compression tag
4357
     * value because it has an incorrect count value (if the
4358
     * true value of SamplesPerPixel is not 1).
4359
     */
4360
    dp =
4361
        TIFFReadDirectoryFindEntry(tif, dir, dircount, TIFFTAG_SAMPLESPERPIXEL);
4362
    if (dp)
4363
    {
4364
        if (!TIFFFetchNormalTag(tif, dp, 0))
4365
            goto bad;
4366
        dp->tdir_ignore = TRUE;
4367
    }
4368
    dp = TIFFReadDirectoryFindEntry(tif, dir, dircount, TIFFTAG_COMPRESSION);
4369
    if (dp)
4370
    {
4371
        /*
4372
         * The 5.0 spec says the Compression tag has one value, while
4373
         * earlier specs say it has one value per sample.  Because of
4374
         * this, we accept the tag if one value is supplied with either
4375
         * count.
4376
         */
4377
        uint16_t value;
4378
        enum TIFFReadDirEntryErr err;
4379
        err = TIFFReadDirEntryShort(tif, dp, &value);
4380
        if (err == TIFFReadDirEntryErrCount)
4381
            err = TIFFReadDirEntryPersampleShort(tif, dp, &value);
4382
        if (err != TIFFReadDirEntryErrOk)
4383
        {
4384
            TIFFReadDirEntryOutputErr(tif, err, module, "Compression", 0);
4385
            goto bad;
4386
        }
4387
        if (!TIFFSetField(tif, TIFFTAG_COMPRESSION, value))
4388
            goto bad;
4389
        dp->tdir_ignore = TRUE;
4390
    }
4391
    else
4392
    {
4393
        if (!TIFFSetField(tif, TIFFTAG_COMPRESSION, COMPRESSION_NONE))
4394
            goto bad;
4395
    }
4396
    /*
4397
     * First real pass over the directory.
4398
     */
4399
    for (di = 0, dp = dir; di < dircount; di++, dp++)
4400
    {
4401
        if (!dp->tdir_ignore)
4402
        {
4403
            TIFFReadDirectoryFindFieldInfo(tif, dp->tdir_tag, &fii);
4404
            if (fii == FAILED_FII)
4405
            {
4406
                TIFFWarningExtR(tif, module,
4407
                                "Unknown field with tag %" PRIu16 " (0x%" PRIx16
4408
                                ") encountered",
4409
                                dp->tdir_tag, dp->tdir_tag);
4410
                /* the following knowingly leaks the
4411
                   anonymous field structure */
4412
                const TIFFField *fld = _TIFFCreateAnonField(
4413
                    tif, dp->tdir_tag, (TIFFDataType)dp->tdir_type);
4414
                if (fld == NULL || !_TIFFMergeFields(tif, fld, 1))
4415
                {
4416
                    TIFFWarningExtR(
4417
                        tif, module,
4418
                        "Registering anonymous field with tag %" PRIu16
4419
                        " (0x%" PRIx16 ") failed",
4420
                        dp->tdir_tag, dp->tdir_tag);
4421
                    dp->tdir_ignore = TRUE;
4422
                }
4423
                else
4424
                {
4425
                    TIFFReadDirectoryFindFieldInfo(tif, dp->tdir_tag, &fii);
4426
                    assert(fii != FAILED_FII);
4427
                }
4428
            }
4429
        }
4430
        if (!dp->tdir_ignore)
4431
        {
4432
            fip = tif->tif_fields[fii];
4433
            if (fip->field_bit == FIELD_IGNORE)
4434
                dp->tdir_ignore = TRUE;
4435
            else
4436
            {
4437
                switch (dp->tdir_tag)
4438
                {
4439
                    case TIFFTAG_STRIPOFFSETS:
4440
                    case TIFFTAG_STRIPBYTECOUNTS:
4441
                    case TIFFTAG_TILEOFFSETS:
4442
                    case TIFFTAG_TILEBYTECOUNTS:
4443
                        TIFFSetFieldBit(tif, fip->field_bit);
4444
                        break;
4445
                    case TIFFTAG_IMAGEWIDTH:
4446
                    case TIFFTAG_IMAGELENGTH:
4447
                    case TIFFTAG_IMAGEDEPTH:
4448
                    case TIFFTAG_TILELENGTH:
4449
                    case TIFFTAG_TILEWIDTH:
4450
                    case TIFFTAG_TILEDEPTH:
4451
                    case TIFFTAG_PLANARCONFIG:
4452
                    case TIFFTAG_ROWSPERSTRIP:
4453
                    case TIFFTAG_EXTRASAMPLES:
4454
                        if (!TIFFFetchNormalTag(tif, dp, 0))
4455
                            goto bad;
4456
                        dp->tdir_ignore = TRUE;
4457
                        break;
4458
                    default:
4459
                        if (!_TIFFCheckFieldIsValidForCodec(tif, dp->tdir_tag))
4460
                            dp->tdir_ignore = TRUE;
4461
                        break;
4462
                }
4463
            }
4464
        }
4465
    }
4466
    /*
4467
     * XXX: OJPEG hack.
4468
     * If a) compression is OJPEG, b) planarconfig tag says it's separate,
4469
     * c) strip offsets/bytecounts tag are both present and
4470
     * d) both contain exactly one value, then we consistently find
4471
     * that the buggy implementation of the buggy compression scheme
4472
     * matches contig planarconfig best. So we 'fix-up' the tag here
4473
     */
4474
    if ((tif->tif_dir.td_compression == COMPRESSION_OJPEG) &&
4475
        (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE))
4476
    {
4477
        if (!_TIFFFillStriles(tif))
4478
            goto bad;
4479
        dp = TIFFReadDirectoryFindEntry(tif, dir, dircount,
4480
                                        TIFFTAG_STRIPOFFSETS);
4481
        if ((dp != 0) && (dp->tdir_count == 1))
4482
        {
4483
            dp = TIFFReadDirectoryFindEntry(tif, dir, dircount,
4484
                                            TIFFTAG_STRIPBYTECOUNTS);
4485
            if ((dp != 0) && (dp->tdir_count == 1))
4486
            {
4487
                tif->tif_dir.td_planarconfig = PLANARCONFIG_CONTIG;
4488
                TIFFWarningExtR(tif, module,
4489
                                "Planarconfig tag value assumed incorrect, "
4490
                                "assuming data is contig instead of chunky");
4491
            }
4492
        }
4493
    }
4494
    /*
4495
     * Allocate directory structure and setup defaults.
4496
     */
4497
    if (!TIFFFieldSet(tif, FIELD_IMAGEDIMENSIONS))
4498
    {
4499
        MissingRequired(tif, "ImageLength");
4500
        goto bad;
4501
    }
4502

4503
    /*
4504
     * Second pass: extract other information.
4505
     */
4506
    for (di = 0, dp = dir; di < dircount; di++, dp++)
4507
    {
4508
        if (!dp->tdir_ignore)
4509
        {
4510
            switch (dp->tdir_tag)
4511
            {
4512
                case TIFFTAG_MINSAMPLEVALUE:
4513
                case TIFFTAG_MAXSAMPLEVALUE:
4514
                case TIFFTAG_BITSPERSAMPLE:
4515
                case TIFFTAG_DATATYPE:
4516
                case TIFFTAG_SAMPLEFORMAT:
4517
                    /*
4518
                     * The MinSampleValue, MaxSampleValue, BitsPerSample
4519
                     * DataType and SampleFormat tags are supposed to be
4520
                     * written as one value/sample, but some vendors
4521
                     * incorrectly write one value only -- so we accept
4522
                     * that as well (yuck). Other vendors write correct
4523
                     * value for NumberOfSamples, but incorrect one for
4524
                     * BitsPerSample and friends, and we will read this
4525
                     * too.
4526
                     */
4527
                    {
4528
                        uint16_t value;
4529
                        enum TIFFReadDirEntryErr err;
4530
                        err = TIFFReadDirEntryShort(tif, dp, &value);
4531
                        if (!EvaluateIFDdatasizeReading(tif, dp))
4532
                            goto bad;
4533
                        if (err == TIFFReadDirEntryErrCount)
4534
                            err =
4535
                                TIFFReadDirEntryPersampleShort(tif, dp, &value);
4536
                        if (err != TIFFReadDirEntryErrOk)
4537
                        {
4538
                            fip = TIFFFieldWithTag(tif, dp->tdir_tag);
4539
                            TIFFReadDirEntryOutputErr(
4540
                                tif, err, module,
4541
                                fip ? fip->field_name : "unknown tagname", 0);
4542
                            goto bad;
4543
                        }
4544
                        if (!TIFFSetField(tif, dp->tdir_tag, value))
4545
                            goto bad;
4546
                        if (dp->tdir_tag == TIFFTAG_BITSPERSAMPLE)
4547
                            bitspersample_read = TRUE;
4548
                    }
4549
                    break;
4550
                case TIFFTAG_SMINSAMPLEVALUE:
4551
                case TIFFTAG_SMAXSAMPLEVALUE:
4552
                {
4553

4554
                    double *data = NULL;
4555
                    enum TIFFReadDirEntryErr err;
4556
                    uint32_t saved_flags;
4557
                    int m;
4558
                    if (dp->tdir_count !=
4559
                        (uint64_t)tif->tif_dir.td_samplesperpixel)
4560
                        err = TIFFReadDirEntryErrCount;
4561
                    else
4562
                        err = TIFFReadDirEntryDoubleArray(tif, dp, &data);
4563
                    if (!EvaluateIFDdatasizeReading(tif, dp))
4564
                        goto bad;
4565
                    if (err != TIFFReadDirEntryErrOk)
4566
                    {
4567
                        fip = TIFFFieldWithTag(tif, dp->tdir_tag);
4568
                        TIFFReadDirEntryOutputErr(
4569
                            tif, err, module,
4570
                            fip ? fip->field_name : "unknown tagname", 0);
4571
                        goto bad;
4572
                    }
4573
                    saved_flags = tif->tif_flags;
4574
                    tif->tif_flags |= TIFF_PERSAMPLE;
4575
                    m = TIFFSetField(tif, dp->tdir_tag, data);
4576
                    tif->tif_flags = saved_flags;
4577
                    _TIFFfreeExt(tif, data);
4578
                    if (!m)
4579
                        goto bad;
4580
                }
4581
                break;
4582
                case TIFFTAG_STRIPOFFSETS:
4583
                case TIFFTAG_TILEOFFSETS:
4584
                {
4585
                    switch (dp->tdir_type)
4586
                    {
4587
                        case TIFF_SHORT:
4588
                        case TIFF_LONG:
4589
                        case TIFF_LONG8:
4590
                            break;
4591
                        default:
4592
                            /* Warn except if directory typically created with
4593
                             * TIFFDeferStrileArrayWriting() */
4594
                            if (!(tif->tif_mode == O_RDWR &&
4595
                                  dp->tdir_count == 0 && dp->tdir_type == 0 &&
4596
                                  dp->tdir_offset.toff_long8 == 0))
4597
                            {
4598
                                fip = TIFFFieldWithTag(tif, dp->tdir_tag);
4599
                                TIFFWarningExtR(
4600
                                    tif, module, "Invalid data type for tag %s",
4601
                                    fip ? fip->field_name : "unknown tagname");
4602
                            }
4603
                            break;
4604
                    }
4605
                    _TIFFmemcpy(&(tif->tif_dir.td_stripoffset_entry), dp,
4606
                                sizeof(TIFFDirEntry));
4607
                    if (!EvaluateIFDdatasizeReading(tif, dp))
4608
                        goto bad;
4609
                }
4610
                break;
4611
                case TIFFTAG_STRIPBYTECOUNTS:
4612
                case TIFFTAG_TILEBYTECOUNTS:
4613
                {
4614
                    switch (dp->tdir_type)
4615
                    {
4616
                        case TIFF_SHORT:
4617
                        case TIFF_LONG:
4618
                        case TIFF_LONG8:
4619
                            break;
4620
                        default:
4621
                            /* Warn except if directory typically created with
4622
                             * TIFFDeferStrileArrayWriting() */
4623
                            if (!(tif->tif_mode == O_RDWR &&
4624
                                  dp->tdir_count == 0 && dp->tdir_type == 0 &&
4625
                                  dp->tdir_offset.toff_long8 == 0))
4626
                            {
4627
                                fip = TIFFFieldWithTag(tif, dp->tdir_tag);
4628
                                TIFFWarningExtR(
4629
                                    tif, module, "Invalid data type for tag %s",
4630
                                    fip ? fip->field_name : "unknown tagname");
4631
                            }
4632
                            break;
4633
                    }
4634
                    _TIFFmemcpy(&(tif->tif_dir.td_stripbytecount_entry), dp,
4635
                                sizeof(TIFFDirEntry));
4636
                    if (!EvaluateIFDdatasizeReading(tif, dp))
4637
                        goto bad;
4638
                }
4639
                break;
4640
                case TIFFTAG_COLORMAP:
4641
                case TIFFTAG_TRANSFERFUNCTION:
4642
                {
4643
                    enum TIFFReadDirEntryErr err;
4644
                    uint32_t countpersample;
4645
                    uint32_t countrequired;
4646
                    uint32_t incrementpersample;
4647
                    uint16_t *value = NULL;
4648
                    /* It would be dangerous to instantiate those tag values */
4649
                    /* since if td_bitspersample has not yet been read (due to
4650
                     */
4651
                    /* unordered tags), it could be read afterwards with a */
4652
                    /* values greater than the default one (1), which may cause
4653
                     */
4654
                    /* crashes in user code */
4655
                    if (!bitspersample_read)
4656
                    {
4657
                        fip = TIFFFieldWithTag(tif, dp->tdir_tag);
4658
                        TIFFWarningExtR(
4659
                            tif, module,
4660
                            "Ignoring %s since BitsPerSample tag not found",
4661
                            fip ? fip->field_name : "unknown tagname");
4662
                        continue;
4663
                    }
4664
                    /* ColorMap or TransferFunction for high bit */
4665
                    /* depths do not make much sense and could be */
4666
                    /* used as a denial of service vector */
4667
                    if (tif->tif_dir.td_bitspersample > 24)
4668
                    {
4669
                        fip = TIFFFieldWithTag(tif, dp->tdir_tag);
4670
                        TIFFWarningExtR(
4671
                            tif, module,
4672
                            "Ignoring %s because BitsPerSample=%" PRIu16 ">24",
4673
                            fip ? fip->field_name : "unknown tagname",
4674
                            tif->tif_dir.td_bitspersample);
4675
                        continue;
4676
                    }
4677
                    countpersample = (1U << tif->tif_dir.td_bitspersample);
4678
                    if ((dp->tdir_tag == TIFFTAG_TRANSFERFUNCTION) &&
4679
                        (dp->tdir_count == (uint64_t)countpersample))
4680
                    {
4681
                        countrequired = countpersample;
4682
                        incrementpersample = 0;
4683
                    }
4684
                    else
4685
                    {
4686
                        countrequired = 3 * countpersample;
4687
                        incrementpersample = countpersample;
4688
                    }
4689
                    if (dp->tdir_count != (uint64_t)countrequired)
4690
                        err = TIFFReadDirEntryErrCount;
4691
                    else
4692
                        err = TIFFReadDirEntryShortArray(tif, dp, &value);
4693
                    if (!EvaluateIFDdatasizeReading(tif, dp))
4694
                        goto bad;
4695
                    if (err != TIFFReadDirEntryErrOk)
4696
                    {
4697
                        fip = TIFFFieldWithTag(tif, dp->tdir_tag);
4698
                        TIFFReadDirEntryOutputErr(
4699
                            tif, err, module,
4700
                            fip ? fip->field_name : "unknown tagname", 1);
4701
                    }
4702
                    else
4703
                    {
4704
                        TIFFSetField(tif, dp->tdir_tag, value,
4705
                                     value + incrementpersample,
4706
                                     value + 2 * incrementpersample);
4707
                        _TIFFfreeExt(tif, value);
4708
                    }
4709
                }
4710
                break;
4711
                    /* BEGIN REV 4.0 COMPATIBILITY */
4712
                case TIFFTAG_OSUBFILETYPE:
4713
                {
4714
                    uint16_t valueo;
4715
                    uint32_t value;
4716
                    if (TIFFReadDirEntryShort(tif, dp, &valueo) ==
4717
                        TIFFReadDirEntryErrOk)
4718
                    {
4719
                        switch (valueo)
4720
                        {
4721
                            case OFILETYPE_REDUCEDIMAGE:
4722
                                value = FILETYPE_REDUCEDIMAGE;
4723
                                break;
4724
                            case OFILETYPE_PAGE:
4725
                                value = FILETYPE_PAGE;
4726
                                break;
4727
                            default:
4728
                                value = 0;
4729
                                break;
4730
                        }
4731
                        if (value != 0)
4732
                            TIFFSetField(tif, TIFFTAG_SUBFILETYPE, value);
4733
                    }
4734
                }
4735
                break;
4736
                /* END REV 4.0 COMPATIBILITY */
4737
#if 0
4738
                case TIFFTAG_EP_BATTERYLEVEL:
4739
                    /* TIFFTAG_EP_BATTERYLEVEL can be RATIONAL or ASCII.
4740
                     * LibTiff defines it as ASCII and converts RATIONAL to an
4741
                     * ASCII string. */
4742
                    switch (dp->tdir_type)
4743
                    {
4744
                        case TIFF_RATIONAL:
4745
                        {
4746
                            /* Read rational and convert to ASCII*/
4747
                            enum TIFFReadDirEntryErr err;
4748
                            TIFFRational_t rValue;
4749
                            err = TIFFReadDirEntryCheckedRationalDirect(
4750
                                tif, dp, &rValue);
4751
                            if (err != TIFFReadDirEntryErrOk)
4752
                            {
4753
                                fip = TIFFFieldWithTag(tif, dp->tdir_tag);
4754
                                TIFFReadDirEntryOutputErr(
4755
                                    tif, err, module,
4756
                                    fip ? fip->field_name : "unknown tagname",
4757
                                    1);
4758
                            }
4759
                            else
4760
                            {
4761
                                char szAux[32];
4762
                                snprintf(szAux, sizeof(szAux) - 1, "%d/%d",
4763
                                         rValue.uNum, rValue.uDenom);
4764
                                TIFFSetField(tif, dp->tdir_tag, szAux);
4765
                            }
4766
                        }
4767
                        break;
4768
                        case TIFF_ASCII:
4769
                            (void)TIFFFetchNormalTag(tif, dp, TRUE);
4770
                            break;
4771
                        default:
4772
                            fip = TIFFFieldWithTag(tif, dp->tdir_tag);
4773
                            TIFFWarningExtR(tif, module,
4774
                                            "Invalid data type for tag %s. "
4775
                                            "ASCII or RATIONAL expected",
4776
                                            fip ? fip->field_name
4777
                                                : "unknown tagname");
4778
                            break;
4779
                    }
4780
                    break;
4781
#endif
4782
                default:
4783
                    (void)TIFFFetchNormalTag(tif, dp, TRUE);
4784
                    break;
4785
            } /* -- switch (dp->tdir_tag) -- */
4786
        }     /* -- if (!dp->tdir_ignore) */
4787
    }         /* -- for-loop -- */
4788

4789
    /* Evaluate final IFD data size. */
4790
    CalcFinalIFDdatasizeReading(tif, dircount);
4791

4792
    /*
4793
     * OJPEG hack:
4794
     * - If a) compression is OJPEG, and b) photometric tag is missing,
4795
     * then we consistently find that photometric should be YCbCr
4796
     * - If a) compression is OJPEG, and b) photometric tag says it's RGB,
4797
     * then we consistently find that the buggy implementation of the
4798
     * buggy compression scheme matches photometric YCbCr instead.
4799
     * - If a) compression is OJPEG, and b) bitspersample tag is missing,
4800
     * then we consistently find bitspersample should be 8.
4801
     * - If a) compression is OJPEG, b) samplesperpixel tag is missing,
4802
     * and c) photometric is RGB or YCbCr, then we consistently find
4803
     * samplesperpixel should be 3
4804
     * - If a) compression is OJPEG, b) samplesperpixel tag is missing,
4805
     * and c) photometric is MINISWHITE or MINISBLACK, then we consistently
4806
     * find samplesperpixel should be 3
4807
     */
4808
    if (tif->tif_dir.td_compression == COMPRESSION_OJPEG)
4809
    {
4810
        if (!TIFFFieldSet(tif, FIELD_PHOTOMETRIC))
4811
        {
4812
            TIFFWarningExtR(
4813
                tif, module,
4814
                "Photometric tag is missing, assuming data is YCbCr");
4815
            if (!TIFFSetField(tif, TIFFTAG_PHOTOMETRIC, PHOTOMETRIC_YCBCR))
4816
                goto bad;
4817
        }
4818
        else if (tif->tif_dir.td_photometric == PHOTOMETRIC_RGB)
4819
        {
4820
            tif->tif_dir.td_photometric = PHOTOMETRIC_YCBCR;
4821
            TIFFWarningExtR(tif, module,
4822
                            "Photometric tag value assumed incorrect, "
4823
                            "assuming data is YCbCr instead of RGB");
4824
        }
4825
        if (!TIFFFieldSet(tif, FIELD_BITSPERSAMPLE))
4826
        {
4827
            TIFFWarningExtR(
4828
                tif, module,
4829
                "BitsPerSample tag is missing, assuming 8 bits per sample");
4830
            if (!TIFFSetField(tif, TIFFTAG_BITSPERSAMPLE, 8))
4831
                goto bad;
4832
        }
4833
        if (!TIFFFieldSet(tif, FIELD_SAMPLESPERPIXEL))
4834
        {
4835
            if (tif->tif_dir.td_photometric == PHOTOMETRIC_RGB)
4836
            {
4837
                TIFFWarningExtR(tif, module,
4838
                                "SamplesPerPixel tag is missing, "
4839
                                "assuming correct SamplesPerPixel value is 3");
4840
                if (!TIFFSetField(tif, TIFFTAG_SAMPLESPERPIXEL, 3))
4841
                    goto bad;
4842
            }
4843
            if (tif->tif_dir.td_photometric == PHOTOMETRIC_YCBCR)
4844
            {
4845
                TIFFWarningExtR(tif, module,
4846
                                "SamplesPerPixel tag is missing, "
4847
                                "applying correct SamplesPerPixel value of 3");
4848
                if (!TIFFSetField(tif, TIFFTAG_SAMPLESPERPIXEL, 3))
4849
                    goto bad;
4850
            }
4851
            else if ((tif->tif_dir.td_photometric == PHOTOMETRIC_MINISWHITE) ||
4852
                     (tif->tif_dir.td_photometric == PHOTOMETRIC_MINISBLACK))
4853
            {
4854
                /*
4855
                 * SamplesPerPixel tag is missing, but is not required
4856
                 * by spec.  Assume correct SamplesPerPixel value of 1.
4857
                 */
4858
                if (!TIFFSetField(tif, TIFFTAG_SAMPLESPERPIXEL, 1))
4859
                    goto bad;
4860
            }
4861
        }
4862
    }
4863

4864
    /*
4865
     * Setup appropriate structures (by strip or by tile)
4866
     * We do that only after the above OJPEG hack which alters SamplesPerPixel
4867
     * and thus influences the number of strips in the separate planarconfig.
4868
     */
4869
    if (!TIFFFieldSet(tif, FIELD_TILEDIMENSIONS))
4870
    {
4871
        tif->tif_dir.td_nstrips = TIFFNumberOfStrips(tif);
4872
        tif->tif_dir.td_tilewidth = tif->tif_dir.td_imagewidth;
4873
        tif->tif_dir.td_tilelength = tif->tif_dir.td_rowsperstrip;
4874
        tif->tif_dir.td_tiledepth = tif->tif_dir.td_imagedepth;
4875
        tif->tif_flags &= ~TIFF_ISTILED;
4876
    }
4877
    else
4878
    {
4879
        tif->tif_dir.td_nstrips = TIFFNumberOfTiles(tif);
4880
        tif->tif_flags |= TIFF_ISTILED;
4881
    }
4882
    if (!tif->tif_dir.td_nstrips)
4883
    {
4884
        TIFFErrorExtR(tif, module, "Cannot handle zero number of %s",
4885
                      isTiled(tif) ? "tiles" : "strips");
4886
        goto bad;
4887
    }
4888
    tif->tif_dir.td_stripsperimage = tif->tif_dir.td_nstrips;
4889
    if (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE)
4890
        tif->tif_dir.td_stripsperimage /= tif->tif_dir.td_samplesperpixel;
4891
    if (!TIFFFieldSet(tif, FIELD_STRIPOFFSETS))
4892
    {
4893
#ifdef OJPEG_SUPPORT
4894
        if ((tif->tif_dir.td_compression == COMPRESSION_OJPEG) &&
4895
            (isTiled(tif) == 0) && (tif->tif_dir.td_nstrips == 1))
4896
        {
4897
            /*
4898
             * XXX: OJPEG hack.
4899
             * If a) compression is OJPEG, b) it's not a tiled TIFF,
4900
             * and c) the number of strips is 1,
4901
             * then we tolerate the absence of stripoffsets tag,
4902
             * because, presumably, all required data is in the
4903
             * JpegInterchangeFormat stream.
4904
             */
4905
            TIFFSetFieldBit(tif, FIELD_STRIPOFFSETS);
4906
        }
4907
        else
4908
#endif
4909
        {
4910
            MissingRequired(tif, isTiled(tif) ? "TileOffsets" : "StripOffsets");
4911
            goto bad;
4912
        }
4913
    }
4914

4915
    if (tif->tif_mode == O_RDWR &&
4916
        tif->tif_dir.td_stripoffset_entry.tdir_tag != 0 &&
4917
        tif->tif_dir.td_stripoffset_entry.tdir_count == 0 &&
4918
        tif->tif_dir.td_stripoffset_entry.tdir_type == 0 &&
4919
        tif->tif_dir.td_stripoffset_entry.tdir_offset.toff_long8 == 0 &&
4920
        tif->tif_dir.td_stripbytecount_entry.tdir_tag != 0 &&
4921
        tif->tif_dir.td_stripbytecount_entry.tdir_count == 0 &&
4922
        tif->tif_dir.td_stripbytecount_entry.tdir_type == 0 &&
4923
        tif->tif_dir.td_stripbytecount_entry.tdir_offset.toff_long8 == 0)
4924
    {
4925
        /* Directory typically created with TIFFDeferStrileArrayWriting() */
4926
        TIFFSetupStrips(tif);
4927
    }
4928
    else if (!(tif->tif_flags & TIFF_DEFERSTRILELOAD))
4929
    {
4930
        if (tif->tif_dir.td_stripoffset_entry.tdir_tag != 0)
4931
        {
4932
            if (!TIFFFetchStripThing(tif, &(tif->tif_dir.td_stripoffset_entry),
4933
                                     tif->tif_dir.td_nstrips,
4934
                                     &tif->tif_dir.td_stripoffset_p))
4935
            {
4936
                goto bad;
4937
            }
4938
        }
4939
        if (tif->tif_dir.td_stripbytecount_entry.tdir_tag != 0)
4940
        {
4941
            if (!TIFFFetchStripThing(
4942
                    tif, &(tif->tif_dir.td_stripbytecount_entry),
4943
                    tif->tif_dir.td_nstrips, &tif->tif_dir.td_stripbytecount_p))
4944
            {
4945
                goto bad;
4946
            }
4947
        }
4948
    }
4949

4950
    /*
4951
     * Make sure all non-color channels are extrasamples.
4952
     * If it's not the case, define them as such.
4953
     */
4954
    color_channels = _TIFFGetMaxColorChannels(tif->tif_dir.td_photometric);
4955
    if (color_channels &&
4956
        tif->tif_dir.td_samplesperpixel - tif->tif_dir.td_extrasamples >
4957
            color_channels)
4958
    {
4959
        uint16_t old_extrasamples;
4960
        uint16_t *new_sampleinfo;
4961

4962
        TIFFWarningExtR(
4963
            tif, module,
4964
            "Sum of Photometric type-related "
4965
            "color channels and ExtraSamples doesn't match SamplesPerPixel. "
4966
            "Defining non-color channels as ExtraSamples.");
4967

4968
        old_extrasamples = tif->tif_dir.td_extrasamples;
4969
        tif->tif_dir.td_extrasamples =
4970
            (uint16_t)(tif->tif_dir.td_samplesperpixel - color_channels);
4971

4972
        // sampleinfo should contain information relative to these new extra
4973
        // samples
4974
        new_sampleinfo = (uint16_t *)_TIFFcallocExt(
4975
            tif, tif->tif_dir.td_extrasamples, sizeof(uint16_t));
4976
        if (!new_sampleinfo)
4977
        {
4978
            TIFFErrorExtR(tif, module,
4979
                          "Failed to allocate memory for "
4980
                          "temporary new sampleinfo array "
4981
                          "(%" PRIu16 " 16 bit elements)",
4982
                          tif->tif_dir.td_extrasamples);
4983
            goto bad;
4984
        }
4985

4986
        if (old_extrasamples > 0)
4987
            memcpy(new_sampleinfo, tif->tif_dir.td_sampleinfo,
4988
                   old_extrasamples * sizeof(uint16_t));
4989
        _TIFFsetShortArrayExt(tif, &tif->tif_dir.td_sampleinfo, new_sampleinfo,
4990
                              tif->tif_dir.td_extrasamples);
4991
        _TIFFfreeExt(tif, new_sampleinfo);
4992
    }
4993

4994
    /*
4995
     * Verify Palette image has a Colormap.
4996
     */
4997
    if (tif->tif_dir.td_photometric == PHOTOMETRIC_PALETTE &&
4998
        !TIFFFieldSet(tif, FIELD_COLORMAP))
4999
    {
5000
        if (tif->tif_dir.td_bitspersample >= 8 &&
5001
            tif->tif_dir.td_samplesperpixel == 3)
5002
            tif->tif_dir.td_photometric = PHOTOMETRIC_RGB;
5003
        else if (tif->tif_dir.td_bitspersample >= 8)
5004
            tif->tif_dir.td_photometric = PHOTOMETRIC_MINISBLACK;
5005
        else
5006
        {
5007
            MissingRequired(tif, "Colormap");
5008
            goto bad;
5009
        }
5010
    }
5011
    /*
5012
     * OJPEG hack:
5013
     * We do no further messing with strip/tile offsets/bytecounts in OJPEG
5014
     * TIFFs
5015
     */
5016
    if (tif->tif_dir.td_compression != COMPRESSION_OJPEG)
5017
    {
5018
        /*
5019
         * Attempt to deal with a missing StripByteCounts tag.
5020
         */
5021
        if (!TIFFFieldSet(tif, FIELD_STRIPBYTECOUNTS))
5022
        {
5023
            /*
5024
             * Some manufacturers violate the spec by not giving
5025
             * the size of the strips.  In this case, assume there
5026
             * is one uncompressed strip of data.
5027
             */
5028
            if ((tif->tif_dir.td_planarconfig == PLANARCONFIG_CONTIG &&
5029
                 tif->tif_dir.td_nstrips > 1) ||
5030
                (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE &&
5031
                 tif->tif_dir.td_nstrips !=
5032
                     (uint32_t)tif->tif_dir.td_samplesperpixel))
5033
            {
5034
                MissingRequired(tif, "StripByteCounts");
5035
                goto bad;
5036
            }
5037
            TIFFWarningExtR(
5038
                tif, module,
5039
                "TIFF directory is missing required "
5040
                "\"StripByteCounts\" field, calculating from imagelength");
5041
            if (EstimateStripByteCounts(tif, dir, dircount) < 0)
5042
                goto bad;
5043
        }
5044
        else if (tif->tif_dir.td_nstrips == 1 &&
5045
                 !(tif->tif_flags & TIFF_ISTILED) && ByteCountLooksBad(tif))
5046
        {
5047
            /*
5048
             * XXX: Plexus (and others) sometimes give a value of
5049
             * zero for a tag when they don't know what the
5050
             * correct value is!  Try and handle the simple case
5051
             * of estimating the size of a one strip image.
5052
             */
5053
            TIFFWarningExtR(tif, module,
5054
                            "Bogus \"StripByteCounts\" field, ignoring and "
5055
                            "calculating from imagelength");
5056
            if (EstimateStripByteCounts(tif, dir, dircount) < 0)
5057
                goto bad;
5058
        }
5059
        else if (!(tif->tif_flags & TIFF_DEFERSTRILELOAD) &&
5060
                 tif->tif_dir.td_planarconfig == PLANARCONFIG_CONTIG &&
5061
                 tif->tif_dir.td_nstrips > 2 &&
5062
                 tif->tif_dir.td_compression == COMPRESSION_NONE &&
5063
                 TIFFGetStrileByteCount(tif, 0) !=
5064
                     TIFFGetStrileByteCount(tif, 1) &&
5065
                 TIFFGetStrileByteCount(tif, 0) != 0 &&
5066
                 TIFFGetStrileByteCount(tif, 1) != 0)
5067
        {
5068
            /*
5069
             * XXX: Some vendors fill StripByteCount array with
5070
             * absolutely wrong values (it can be equal to
5071
             * StripOffset array, for example). Catch this case
5072
             * here.
5073
             *
5074
             * We avoid this check if deferring strile loading
5075
             * as it would always force us to load the strip/tile
5076
             * information.
5077
             */
5078
            TIFFWarningExtR(tif, module,
5079
                            "Wrong \"StripByteCounts\" field, ignoring and "
5080
                            "calculating from imagelength");
5081
            if (EstimateStripByteCounts(tif, dir, dircount) < 0)
5082
                goto bad;
5083
        }
5084
    }
5085
    if (dir)
5086
    {
5087
        _TIFFfreeExt(tif, dir);
5088
        dir = NULL;
5089
    }
5090
    if (!TIFFFieldSet(tif, FIELD_MAXSAMPLEVALUE))
5091
    {
5092
        if (tif->tif_dir.td_bitspersample >= 16)
5093
            tif->tif_dir.td_maxsamplevalue = 0xFFFF;
5094
        else
5095
            tif->tif_dir.td_maxsamplevalue =
5096
                (uint16_t)((1L << tif->tif_dir.td_bitspersample) - 1);
5097
    }
5098

5099
#ifdef STRIPBYTECOUNTSORTED_UNUSED
5100
    /*
5101
     * XXX: We can optimize checking for the strip bounds using the sorted
5102
     * bytecounts array. See also comments for TIFFAppendToStrip()
5103
     * function in tif_write.c.
5104
     */
5105
    if (!(tif->tif_flags & TIFF_DEFERSTRILELOAD) && tif->tif_dir.td_nstrips > 1)
5106
    {
5107
        uint32_t strip;
5108

5109
        tif->tif_dir.td_stripbytecountsorted = 1;
5110
        for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++)
5111
        {
5112
            if (TIFFGetStrileOffset(tif, strip - 1) >
5113
                TIFFGetStrileOffset(tif, strip))
5114
            {
5115
                tif->tif_dir.td_stripbytecountsorted = 0;
5116
                break;
5117
            }
5118
        }
5119
    }
5120
#endif
5121

5122
    /*
5123
     * An opportunity for compression mode dependent tag fixup
5124
     */
5125
    (*tif->tif_fixuptags)(tif);
5126

5127
    /*
5128
     * Some manufacturers make life difficult by writing
5129
     * large amounts of uncompressed data as a single strip.
5130
     * This is contrary to the recommendations of the spec.
5131
     * The following makes an attempt at breaking such images
5132
     * into strips closer to the recommended 8k bytes.  A
5133
     * side effect, however, is that the RowsPerStrip tag
5134
     * value may be changed.
5135
     */
5136
    if ((tif->tif_dir.td_planarconfig == PLANARCONFIG_CONTIG) &&
5137
        (tif->tif_dir.td_nstrips == 1) &&
5138
        (tif->tif_dir.td_compression == COMPRESSION_NONE) &&
5139
        ((tif->tif_flags & (TIFF_STRIPCHOP | TIFF_ISTILED)) == TIFF_STRIPCHOP))
5140
    {
5141
        ChopUpSingleUncompressedStrip(tif);
5142
    }
5143

5144
    /* There are also uncompressed striped files with strips larger than */
5145
    /* 2 GB, which make them unfriendly with a lot of code. If possible, */
5146
    /* try to expose smaller "virtual" strips. */
5147
    if (tif->tif_dir.td_planarconfig == PLANARCONFIG_CONTIG &&
5148
        tif->tif_dir.td_compression == COMPRESSION_NONE &&
5149
        (tif->tif_flags & (TIFF_STRIPCHOP | TIFF_ISTILED)) == TIFF_STRIPCHOP &&
5150
        TIFFStripSize64(tif) > 0x7FFFFFFFUL)
5151
    {
5152
        TryChopUpUncompressedBigTiff(tif);
5153
    }
5154

5155
    /*
5156
     * Clear the dirty directory flag.
5157
     */
5158
    tif->tif_flags &= ~TIFF_DIRTYDIRECT;
5159
    tif->tif_flags &= ~TIFF_DIRTYSTRIP;
5160

5161
    /*
5162
     * Reinitialize i/o since we are starting on a new directory.
5163
     */
5164
    tif->tif_row = (uint32_t)-1;
5165
    tif->tif_curstrip = (uint32_t)-1;
5166
    tif->tif_col = (uint32_t)-1;
5167
    tif->tif_curtile = (uint32_t)-1;
5168
    tif->tif_tilesize = (tmsize_t)-1;
5169

5170
    tif->tif_scanlinesize = TIFFScanlineSize(tif);
5171
    if (!tif->tif_scanlinesize)
5172
    {
5173
        TIFFErrorExtR(tif, module, "Cannot handle zero scanline size");
5174
        return (0);
5175
    }
5176

5177
    if (isTiled(tif))
5178
    {
5179
        tif->tif_tilesize = TIFFTileSize(tif);
5180
        if (!tif->tif_tilesize)
5181
        {
5182
            TIFFErrorExtR(tif, module, "Cannot handle zero tile size");
5183
            return (0);
5184
        }
5185
    }
5186
    else
5187
    {
5188
        if (!TIFFStripSize(tif))
5189
        {
5190
            TIFFErrorExtR(tif, module, "Cannot handle zero strip size");
5191
            return (0);
5192
        }
5193
    }
5194
    return (1);
5195
bad:
5196
    if (dir)
5197
        _TIFFfreeExt(tif, dir);
5198
    return (0);
5199
} /*-- TIFFReadDirectory() --*/
5200

5201
static void TIFFReadDirectoryCheckOrder(TIFF *tif, TIFFDirEntry *dir,
5202
                                        uint16_t dircount)
5203
{
5204
    static const char module[] = "TIFFReadDirectoryCheckOrder";
5205
    uint32_t m;
5206
    uint16_t n;
5207
    TIFFDirEntry *o;
5208
    m = 0;
5209
    for (n = 0, o = dir; n < dircount; n++, o++)
5210
    {
5211
        if (o->tdir_tag < m)
5212
        {
5213
            TIFFWarningExtR(tif, module,
5214
                            "Invalid TIFF directory; tags are not sorted in "
5215
                            "ascending order");
5216
            break;
5217
        }
5218
        m = o->tdir_tag + 1;
5219
    }
5220
}
5221

5222
static TIFFDirEntry *TIFFReadDirectoryFindEntry(TIFF *tif, TIFFDirEntry *dir,
5223
                                                uint16_t dircount,
5224
                                                uint16_t tagid)
5225
{
5226
    TIFFDirEntry *m;
5227
    uint16_t n;
5228
    (void)tif;
5229
    for (m = dir, n = 0; n < dircount; m++, n++)
5230
    {
5231
        if (m->tdir_tag == tagid)
5232
            return (m);
5233
    }
5234
    return (0);
5235
}
5236

5237
static void TIFFReadDirectoryFindFieldInfo(TIFF *tif, uint16_t tagid,
5238
                                           uint32_t *fii)
5239
{
5240
    int32_t ma, mb, mc;
5241
    ma = -1;
5242
    mc = (int32_t)tif->tif_nfields;
5243
    while (1)
5244
    {
5245
        if (ma + 1 == mc)
5246
        {
5247
            *fii = FAILED_FII;
5248
            return;
5249
        }
5250
        mb = (ma + mc) / 2;
5251
        if (tif->tif_fields[mb]->field_tag == (uint32_t)tagid)
5252
            break;
5253
        if (tif->tif_fields[mb]->field_tag < (uint32_t)tagid)
5254
            ma = mb;
5255
        else
5256
            mc = mb;
5257
    }
5258
    while (1)
5259
    {
5260
        if (mb == 0)
5261
            break;
5262
        if (tif->tif_fields[mb - 1]->field_tag != (uint32_t)tagid)
5263
            break;
5264
        mb--;
5265
    }
5266
    *fii = mb;
5267
}
5268

5269
/*
5270
 * Read custom directory from the arbitrary offset.
5271
 * The code is very similar to TIFFReadDirectory().
5272
 */
5273
int TIFFReadCustomDirectory(TIFF *tif, toff_t diroff,
5274
                            const TIFFFieldArray *infoarray)
5275
{
5276
    static const char module[] = "TIFFReadCustomDirectory";
5277
    TIFFDirEntry *dir;
5278
    uint16_t dircount;
5279
    TIFFDirEntry *dp;
5280
    uint16_t di;
5281
    const TIFFField *fip;
5282
    uint32_t fii;
5283

5284
    dircount = TIFFFetchDirectory(tif, diroff, &dir, NULL);
5285
    if (!dircount)
5286
    {
5287
        TIFFErrorExtR(tif, module,
5288
                      "Failed to read custom directory at offset %" PRIu64,
5289
                      diroff);
5290
        return 0;
5291
    }
5292
    TIFFReadDirectoryCheckOrder(tif, dir, dircount);
5293

5294
    /*
5295
     * Mark duplicates of any tag to be ignored (bugzilla 1994)
5296
     * to avoid certain pathological problems.
5297
     */
5298
    {
5299
        TIFFDirEntry *ma;
5300
        uint16_t mb;
5301
        for (ma = dir, mb = 0; mb < dircount; ma++, mb++)
5302
        {
5303
            TIFFDirEntry *na;
5304
            uint16_t nb;
5305
            for (na = ma + 1, nb = mb + 1; nb < dircount; na++, nb++)
5306
            {
5307
                if (ma->tdir_tag == na->tdir_tag)
5308
                {
5309
                    na->tdir_ignore = TRUE;
5310
                }
5311
            }
5312
        }
5313
    }
5314

5315
    /* Free any old stuff and reinit. */
5316
    (*tif->tif_cleanup)(tif); /* cleanup any previous compression state */
5317
    TIFFFreeDirectory(tif);
5318
    /* Even if custom directories do not need the default settings of a standard
5319
     * IFD, the pointer to the TIFFSetField() and TIFFGetField() (i.e.
5320
     * tif->tif_tagmethods.vsetfield and tif->tif_tagmethods.vgetfield) need to
5321
     * be initialized, which is done in TIFFDefaultDirectory().
5322
     * After that, the field array for the custom tags needs to be setup again.
5323
     */
5324
    TIFFDefaultDirectory(tif);
5325
    _TIFFSetupFields(tif, infoarray);
5326

5327
    /* Allocate arrays for offset values outside IFD entry for IFD data size
5328
     * checking. Note: Counter are reset within TIFFFreeDirectory(). */
5329
    tif->tif_dir.td_dirdatasize_offsets =
5330
        (TIFFEntryOffsetAndLength *)_TIFFmallocExt(
5331
            tif, dircount * sizeof(TIFFEntryOffsetAndLength));
5332
    if (tif->tif_dir.td_dirdatasize_offsets == NULL)
5333
    {
5334
        TIFFErrorExtR(
5335
            tif, module,
5336
            "Failed to allocate memory for counting IFD data size at reading");
5337
        if (dir)
5338
            _TIFFfreeExt(tif, dir);
5339
        return 0;
5340
    }
5341

5342
    for (di = 0, dp = dir; di < dircount; di++, dp++)
5343
    {
5344
        TIFFReadDirectoryFindFieldInfo(tif, dp->tdir_tag, &fii);
5345
        if (fii == FAILED_FII)
5346
        {
5347
            TIFFWarningExtR(tif, module,
5348
                            "Unknown field with tag %" PRIu16 " (0x%" PRIx16
5349
                            ") encountered",
5350
                            dp->tdir_tag, dp->tdir_tag);
5351
            const TIFFField *fld = _TIFFCreateAnonField(
5352
                tif, dp->tdir_tag, (TIFFDataType)dp->tdir_type);
5353
            if (fld == NULL || !_TIFFMergeFields(tif, fld, 1))
5354
            {
5355
                TIFFWarningExtR(tif, module,
5356
                                "Registering anonymous field with tag %" PRIu16
5357
                                " (0x%" PRIx16 ") failed",
5358
                                dp->tdir_tag, dp->tdir_tag);
5359
                dp->tdir_ignore = TRUE;
5360
            }
5361
            else
5362
            {
5363
                TIFFReadDirectoryFindFieldInfo(tif, dp->tdir_tag, &fii);
5364
                assert(fii != FAILED_FII);
5365
            }
5366
        }
5367
        if (!dp->tdir_ignore)
5368
        {
5369
            fip = tif->tif_fields[fii];
5370
            if (fip->field_bit == FIELD_IGNORE)
5371
                dp->tdir_ignore = TRUE;
5372
            else
5373
            {
5374
                /* check data type */
5375
                while ((fip->field_type != TIFF_ANY) &&
5376
                       (fip->field_type != dp->tdir_type))
5377
                {
5378
                    fii++;
5379
                    if ((fii == tif->tif_nfields) ||
5380
                        (tif->tif_fields[fii]->field_tag !=
5381
                         (uint32_t)dp->tdir_tag))
5382
                    {
5383
                        fii = 0xFFFF;
5384
                        break;
5385
                    }
5386
                    fip = tif->tif_fields[fii];
5387
                }
5388
                if (fii == 0xFFFF)
5389
                {
5390
                    TIFFWarningExtR(tif, module,
5391
                                    "Wrong data type %" PRIu16
5392
                                    " for \"%s\"; tag ignored",
5393
                                    dp->tdir_type, fip->field_name);
5394
                    dp->tdir_ignore = TRUE;
5395
                }
5396
                else
5397
                {
5398
                    /* check count if known in advance */
5399
                    if ((fip->field_readcount != TIFF_VARIABLE) &&
5400
                        (fip->field_readcount != TIFF_VARIABLE2))
5401
                    {
5402
                        uint32_t expected;
5403
                        if (fip->field_readcount == TIFF_SPP)
5404
                            expected =
5405
                                (uint32_t)tif->tif_dir.td_samplesperpixel;
5406
                        else
5407
                            expected = (uint32_t)fip->field_readcount;
5408
                        if (!CheckDirCount(tif, dp, expected))
5409
                            dp->tdir_ignore = TRUE;
5410
                    }
5411
                }
5412
            }
5413
            if (!dp->tdir_ignore)
5414
            {
5415
                switch (dp->tdir_tag)
5416
                {
5417
                    case EXIFTAG_SUBJECTDISTANCE:
5418
                        if (!TIFFFieldIsAnonymous(fip))
5419
                        {
5420
                            /* should only be called on a Exif directory */
5421
                            /* when exifFields[] is active */
5422
                            (void)TIFFFetchSubjectDistance(tif, dp);
5423
                        }
5424
                        else
5425
                        {
5426
                            (void)TIFFFetchNormalTag(tif, dp, TRUE);
5427
                        }
5428
                        break;
5429
                    default:
5430
                        (void)TIFFFetchNormalTag(tif, dp, TRUE);
5431
                        break;
5432
                }
5433
            } /*-- if (!dp->tdir_ignore) */
5434
        }
5435
    }
5436
    /* Evaluate final IFD data size. */
5437
    CalcFinalIFDdatasizeReading(tif, dircount);
5438

5439
    /* To be able to return from SubIFD or custom-IFD to main-IFD */
5440
    tif->tif_setdirectory_force_absolute = TRUE;
5441
    if (dir)
5442
        _TIFFfreeExt(tif, dir);
5443
    return 1;
5444
}
5445

5446
/*
5447
 * EXIF is important special case of custom IFD, so we have a special
5448
 * function to read it.
5449
 */
5450
int TIFFReadEXIFDirectory(TIFF *tif, toff_t diroff)
5451
{
5452
    return TIFFReadCustomDirectory(tif, diroff, _TIFFGetExifFields());
5453
}
5454

5455
/*
5456
 *--: EXIF-GPS custom directory reading as another special case of custom IFD.
5457
 */
5458
int TIFFReadGPSDirectory(TIFF *tif, toff_t diroff)
5459
{
5460
    return TIFFReadCustomDirectory(tif, diroff, _TIFFGetGpsFields());
5461
}
5462

5463
static int EstimateStripByteCounts(TIFF *tif, TIFFDirEntry *dir,
5464
                                   uint16_t dircount)
5465
{
5466
    static const char module[] = "EstimateStripByteCounts";
5467

5468
    TIFFDirEntry *dp;
5469
    TIFFDirectory *td = &tif->tif_dir;
5470
    uint32_t strip;
5471

5472
    /* Do not try to load stripbytecount as we will compute it */
5473
    if (!_TIFFFillStrilesInternal(tif, 0))
5474
        return -1;
5475

5476
    const uint64_t allocsize = (uint64_t)td->td_nstrips * sizeof(uint64_t);
5477
    uint64_t filesize = 0;
5478
    if (allocsize > 100 * 1024 * 1024)
5479
    {
5480
        /* Before allocating a huge amount of memory for corrupted files, check
5481
         * if size of requested memory is not greater than file size. */
5482
        filesize = TIFFGetFileSize(tif);
5483
        if (allocsize > filesize)
5484
        {
5485
            TIFFWarningExtR(
5486
                tif, module,
5487
                "Requested memory size for StripByteCounts of %" PRIu64
5488
                " is greater than filesize %" PRIu64 ". Memory not allocated",
5489
                allocsize, filesize);
5490
            return -1;
5491
        }
5492
    }
5493

5494
    if (td->td_stripbytecount_p)
5495
        _TIFFfreeExt(tif, td->td_stripbytecount_p);
5496
    td->td_stripbytecount_p = (uint64_t *)_TIFFCheckMalloc(
5497
        tif, td->td_nstrips, sizeof(uint64_t), "for \"StripByteCounts\" array");
5498
    if (td->td_stripbytecount_p == NULL)
5499
        return -1;
5500

5501
    if (td->td_compression != COMPRESSION_NONE)
5502
    {
5503
        uint64_t space;
5504
        uint16_t n;
5505
        if (!(tif->tif_flags & TIFF_BIGTIFF))
5506
            space = sizeof(TIFFHeaderClassic) + 2 + dircount * 12 + 4;
5507
        else
5508
            space = sizeof(TIFFHeaderBig) + 8 + dircount * 20 + 8;
5509
        /* calculate amount of space used by indirect values */
5510
        for (dp = dir, n = dircount; n > 0; n--, dp++)
5511
        {
5512
            uint32_t typewidth;
5513
            uint64_t datasize;
5514
            typewidth = TIFFDataWidth((TIFFDataType)dp->tdir_type);
5515
            if (typewidth == 0)
5516
            {
5517
                TIFFErrorExtR(
5518
                    tif, module,
5519
                    "Cannot determine size of unknown tag type %" PRIu16,
5520
                    dp->tdir_type);
5521
                return -1;
5522
            }
5523
            if (dp->tdir_count > UINT64_MAX / typewidth)
5524
                return -1;
5525
            datasize = (uint64_t)typewidth * dp->tdir_count;
5526
            if (!(tif->tif_flags & TIFF_BIGTIFF))
5527
            {
5528
                if (datasize <= 4)
5529
                    datasize = 0;
5530
            }
5531
            else
5532
            {
5533
                if (datasize <= 8)
5534
                    datasize = 0;
5535
            }
5536
            if (space > UINT64_MAX - datasize)
5537
                return -1;
5538
            space += datasize;
5539
        }
5540
        if (filesize == 0)
5541
            filesize = TIFFGetFileSize(tif);
5542
        if (filesize < space)
5543
            /* we should perhaps return in error ? */
5544
            space = filesize;
5545
        else
5546
            space = filesize - space;
5547
        if (td->td_planarconfig == PLANARCONFIG_SEPARATE)
5548
            space /= td->td_samplesperpixel;
5549
        for (strip = 0; strip < td->td_nstrips; strip++)
5550
            td->td_stripbytecount_p[strip] = space;
5551
        /*
5552
         * This gross hack handles the case were the offset to
5553
         * the last strip is past the place where we think the strip
5554
         * should begin.  Since a strip of data must be contiguous,
5555
         * it's safe to assume that we've overestimated the amount
5556
         * of data in the strip and trim this number back accordingly.
5557
         */
5558
        strip--;
5559
        if (td->td_stripoffset_p[strip] >
5560
            UINT64_MAX - td->td_stripbytecount_p[strip])
5561
            return -1;
5562
        if (td->td_stripoffset_p[strip] + td->td_stripbytecount_p[strip] >
5563
            filesize)
5564
        {
5565
            if (td->td_stripoffset_p[strip] >= filesize)
5566
            {
5567
                /* Not sure what we should in that case... */
5568
                td->td_stripbytecount_p[strip] = 0;
5569
            }
5570
            else
5571
            {
5572
                td->td_stripbytecount_p[strip] =
5573
                    filesize - td->td_stripoffset_p[strip];
5574
            }
5575
        }
5576
    }
5577
    else if (isTiled(tif))
5578
    {
5579
        uint64_t bytespertile = TIFFTileSize64(tif);
5580

5581
        for (strip = 0; strip < td->td_nstrips; strip++)
5582
            td->td_stripbytecount_p[strip] = bytespertile;
5583
    }
5584
    else
5585
    {
5586
        uint64_t rowbytes = TIFFScanlineSize64(tif);
5587
        uint32_t rowsperstrip = td->td_imagelength / td->td_stripsperimage;
5588
        for (strip = 0; strip < td->td_nstrips; strip++)
5589
        {
5590
            if (rowbytes > 0 && rowsperstrip > UINT64_MAX / rowbytes)
5591
                return -1;
5592
            td->td_stripbytecount_p[strip] = rowbytes * rowsperstrip;
5593
        }
5594
    }
5595
    TIFFSetFieldBit(tif, FIELD_STRIPBYTECOUNTS);
5596
    if (!TIFFFieldSet(tif, FIELD_ROWSPERSTRIP))
5597
        td->td_rowsperstrip = td->td_imagelength;
5598
    return 1;
5599
}
5600

5601
static void MissingRequired(TIFF *tif, const char *tagname)
5602
{
5603
    static const char module[] = "MissingRequired";
5604

5605
    TIFFErrorExtR(tif, module,
5606
                  "TIFF directory is missing required \"%s\" field", tagname);
5607
}
5608

5609
static unsigned long hashFuncOffsetToNumber(const void *elt)
5610
{
5611
    const TIFFOffsetAndDirNumber *offsetAndDirNumber =
5612
        (const TIFFOffsetAndDirNumber *)elt;
5613
    const uint32_t hash = (uint32_t)(offsetAndDirNumber->offset >> 32) ^
5614
                          ((uint32_t)offsetAndDirNumber->offset & 0xFFFFFFFFU);
5615
    return hash;
5616
}
5617

5618
static bool equalFuncOffsetToNumber(const void *elt1, const void *elt2)
5619
{
5620
    const TIFFOffsetAndDirNumber *offsetAndDirNumber1 =
5621
        (const TIFFOffsetAndDirNumber *)elt1;
5622
    const TIFFOffsetAndDirNumber *offsetAndDirNumber2 =
5623
        (const TIFFOffsetAndDirNumber *)elt2;
5624
    return offsetAndDirNumber1->offset == offsetAndDirNumber2->offset;
5625
}
5626

5627
static unsigned long hashFuncNumberToOffset(const void *elt)
5628
{
5629
    const TIFFOffsetAndDirNumber *offsetAndDirNumber =
5630
        (const TIFFOffsetAndDirNumber *)elt;
5631
    return offsetAndDirNumber->dirNumber;
5632
}
5633

5634
static bool equalFuncNumberToOffset(const void *elt1, const void *elt2)
5635
{
5636
    const TIFFOffsetAndDirNumber *offsetAndDirNumber1 =
5637
        (const TIFFOffsetAndDirNumber *)elt1;
5638
    const TIFFOffsetAndDirNumber *offsetAndDirNumber2 =
5639
        (const TIFFOffsetAndDirNumber *)elt2;
5640
    return offsetAndDirNumber1->dirNumber == offsetAndDirNumber2->dirNumber;
5641
}
5642

5643
/*
5644
 * Check the directory number and offset against the list of already seen
5645
 * directory numbers and offsets. This is a trick to prevent IFD looping.
5646
 * The one can create TIFF file with looped directory pointers. We will
5647
 * maintain a list of already seen directories and check every IFD offset
5648
 * and its IFD number against that list. However, the offset of an IFD number
5649
 * can change - e.g. when writing updates to file.
5650
 * Returns 1 if all is ok; 0 if last directory or IFD loop is encountered,
5651
 * or an error has occurred.
5652
 */
5653
int _TIFFCheckDirNumberAndOffset(TIFF *tif, tdir_t dirn, uint64_t diroff)
5654
{
5655
    if (diroff == 0) /* no more directories */
5656
        return 0;
5657

5658
    if (tif->tif_map_dir_offset_to_number == NULL)
5659
    {
5660
        tif->tif_map_dir_offset_to_number = TIFFHashSetNew(
5661
            hashFuncOffsetToNumber, equalFuncOffsetToNumber, free);
5662
        if (tif->tif_map_dir_offset_to_number == NULL)
5663
        {
5664
            TIFFErrorExtR(tif, "_TIFFCheckDirNumberAndOffset",
5665
                          "Not enough memory");
5666
            return 1;
5667
        }
5668
    }
5669

5670
    if (tif->tif_map_dir_number_to_offset == NULL)
5671
    {
5672
        /* No free callback for this map, as it shares the same items as
5673
         * tif->tif_map_dir_offset_to_number. */
5674
        tif->tif_map_dir_number_to_offset = TIFFHashSetNew(
5675
            hashFuncNumberToOffset, equalFuncNumberToOffset, NULL);
5676
        if (tif->tif_map_dir_number_to_offset == NULL)
5677
        {
5678
            TIFFErrorExtR(tif, "_TIFFCheckDirNumberAndOffset",
5679
                          "Not enough memory");
5680
            return 1;
5681
        }
5682
    }
5683

5684
    /* Check if offset is already in the list:
5685
     * - yes: check, if offset is at the same IFD number - if not, it is an IFD
5686
     * loop
5687
     * -  no: add to list or update offset at that IFD number
5688
     */
5689
    TIFFOffsetAndDirNumber entry;
5690
    entry.offset = diroff;
5691
    entry.dirNumber = dirn;
5692

5693
    TIFFOffsetAndDirNumber *foundEntry =
5694
        (TIFFOffsetAndDirNumber *)TIFFHashSetLookup(
5695
            tif->tif_map_dir_offset_to_number, &entry);
5696
    if (foundEntry)
5697
    {
5698
        if (foundEntry->dirNumber == dirn)
5699
        {
5700
            return 1;
5701
        }
5702
        else
5703
        {
5704
            TIFFWarningExtR(tif, "_TIFFCheckDirNumberAndOffset",
5705
                            "TIFF directory %d has IFD looping to directory %u "
5706
                            "at offset 0x%" PRIx64 " (%" PRIu64 ")",
5707
                            (int)dirn - 1, foundEntry->dirNumber, diroff,
5708
                            diroff);
5709
            return 0;
5710
        }
5711
    }
5712

5713
    /* Check if offset of an IFD has been changed and update offset of that IFD
5714
     * number. */
5715
    foundEntry = (TIFFOffsetAndDirNumber *)TIFFHashSetLookup(
5716
        tif->tif_map_dir_number_to_offset, &entry);
5717
    if (foundEntry)
5718
    {
5719
        if (foundEntry->offset != diroff)
5720
        {
5721
            TIFFOffsetAndDirNumber entryOld;
5722
            entryOld.offset = foundEntry->offset;
5723
            entryOld.dirNumber = dirn;
5724
            /* We must remove first from tif_map_dir_number_to_offset as the */
5725
            /* entry is owned (and thus freed) by */
5726
            /* tif_map_dir_offset_to_number */
5727
            TIFFOffsetAndDirNumber *foundEntryOld =
5728
                (TIFFOffsetAndDirNumber *)TIFFHashSetLookup(
5729
                    tif->tif_map_dir_number_to_offset, &entryOld);
5730
            if (foundEntryOld)
5731
            {
5732
                TIFFHashSetRemove(tif->tif_map_dir_number_to_offset,
5733
                                  foundEntryOld);
5734
            }
5735
            foundEntryOld = (TIFFOffsetAndDirNumber *)TIFFHashSetLookup(
5736
                tif->tif_map_dir_offset_to_number, &entryOld);
5737
            if (foundEntryOld)
5738
            {
5739
                TIFFHashSetRemove(tif->tif_map_dir_offset_to_number,
5740
                                  foundEntryOld);
5741
            }
5742

5743
            TIFFOffsetAndDirNumber *entryPtr = (TIFFOffsetAndDirNumber *)malloc(
5744
                sizeof(TIFFOffsetAndDirNumber));
5745
            if (entryPtr == NULL)
5746
            {
5747
                return 0;
5748
            }
5749

5750
            /* Add IFD offset and dirn to IFD directory list */
5751
            *entryPtr = entry;
5752

5753
            if (!TIFFHashSetInsert(tif->tif_map_dir_offset_to_number, entryPtr))
5754
            {
5755
                TIFFErrorExtR(
5756
                    tif, "_TIFFCheckDirNumberAndOffset",
5757
                    "Insertion in tif_map_dir_offset_to_number failed");
5758
                return 0;
5759
            }
5760
            if (!TIFFHashSetInsert(tif->tif_map_dir_number_to_offset, entryPtr))
5761
            {
5762
                TIFFErrorExtR(
5763
                    tif, "_TIFFCheckDirNumberAndOffset",
5764
                    "Insertion in tif_map_dir_number_to_offset failed");
5765
                return 0;
5766
            }
5767
        }
5768
        return 1;
5769
    }
5770

5771
    /* Arbitrary (hopefully big enough) limit */
5772
    if (TIFFHashSetSize(tif->tif_map_dir_offset_to_number) >=
5773
        TIFF_MAX_DIR_COUNT)
5774
    {
5775
        TIFFErrorExtR(tif, "_TIFFCheckDirNumberAndOffset",
5776
                      "Cannot handle more than %u TIFF directories",
5777
                      TIFF_MAX_DIR_COUNT);
5778
        return 0;
5779
    }
5780

5781
    TIFFOffsetAndDirNumber *entryPtr =
5782
        (TIFFOffsetAndDirNumber *)malloc(sizeof(TIFFOffsetAndDirNumber));
5783
    if (entryPtr == NULL)
5784
    {
5785
        TIFFErrorExtR(tif, "_TIFFCheckDirNumberAndOffset",
5786
                      "malloc(sizeof(TIFFOffsetAndDirNumber)) failed");
5787
        return 0;
5788
    }
5789

5790
    /* Add IFD offset and dirn to IFD directory list */
5791
    *entryPtr = entry;
5792

5793
    if (!TIFFHashSetInsert(tif->tif_map_dir_offset_to_number, entryPtr))
5794
    {
5795
        TIFFErrorExtR(tif, "_TIFFCheckDirNumberAndOffset",
5796
                      "Insertion in tif_map_dir_offset_to_number failed");
5797
        return 0;
5798
    }
5799
    if (!TIFFHashSetInsert(tif->tif_map_dir_number_to_offset, entryPtr))
5800
    {
5801
        TIFFErrorExtR(tif, "_TIFFCheckDirNumberAndOffset",
5802
                      "Insertion in tif_map_dir_number_to_offset failed");
5803
        return 0;
5804
    }
5805

5806
    return 1;
5807
} /* --- _TIFFCheckDirNumberAndOffset() ---*/
5808

5809
/*
5810
 * Retrieve the matching IFD directory number of a given IFD offset
5811
 * from the list of directories already seen.
5812
 * Returns 1 if the offset was in the list and the directory number
5813
 * can be returned.
5814
 * Otherwise returns 0 or if an error occurred.
5815
 */
5816
int _TIFFGetDirNumberFromOffset(TIFF *tif, uint64_t diroff, tdir_t *dirn)
5817
{
5818
    if (diroff == 0) /* no more directories */
5819
        return 0;
5820

5821
    /* Check if offset is already in the list and return matching directory
5822
     * number. Otherwise update IFD list using TIFFNumberOfDirectories() and
5823
     * search again in IFD list.
5824
     */
5825
    if (tif->tif_map_dir_offset_to_number == NULL)
5826
        return 0;
5827
    TIFFOffsetAndDirNumber entry;
5828
    entry.offset = diroff;
5829
    entry.dirNumber = 0; /* not used */
5830

5831
    TIFFOffsetAndDirNumber *foundEntry =
5832
        (TIFFOffsetAndDirNumber *)TIFFHashSetLookup(
5833
            tif->tif_map_dir_offset_to_number, &entry);
5834
    if (foundEntry)
5835
    {
5836
        *dirn = foundEntry->dirNumber;
5837
        return 1;
5838
    }
5839

5840
    /* This updates the directory list for all main-IFDs in the file. */
5841
    TIFFNumberOfDirectories(tif);
5842

5843
    foundEntry = (TIFFOffsetAndDirNumber *)TIFFHashSetLookup(
5844
        tif->tif_map_dir_offset_to_number, &entry);
5845
    if (foundEntry)
5846
    {
5847
        *dirn = foundEntry->dirNumber;
5848
        return 1;
5849
    }
5850

5851
    return 0;
5852
} /*--- _TIFFGetDirNumberFromOffset() ---*/
5853

5854
/*
5855
 * Retrieve the matching IFD directory offset of a given IFD number
5856
 * from the list of directories already seen.
5857
 * Returns 1 if the offset was in the list of already seen IFDs and the
5858
 * directory offset can be returned. The directory list is not updated.
5859
 * Otherwise returns 0 or if an error occurred.
5860
 */
5861
int _TIFFGetOffsetFromDirNumber(TIFF *tif, tdir_t dirn, uint64_t *diroff)
5862
{
5863

5864
    if (tif->tif_map_dir_number_to_offset == NULL)
5865
        return 0;
5866
    TIFFOffsetAndDirNumber entry;
5867
    entry.offset = 0; /* not used */
5868
    entry.dirNumber = dirn;
5869

5870
    TIFFOffsetAndDirNumber *foundEntry =
5871
        (TIFFOffsetAndDirNumber *)TIFFHashSetLookup(
5872
            tif->tif_map_dir_number_to_offset, &entry);
5873
    if (foundEntry)
5874
    {
5875
        *diroff = foundEntry->offset;
5876
        return 1;
5877
    }
5878

5879
    return 0;
5880
} /*--- _TIFFGetOffsetFromDirNumber() ---*/
5881

5882
/*
5883
 * Remove an entry from the directory list of already seen directories
5884
 * by directory offset.
5885
 * If an entry is to be removed from the list, it is also okay if the entry
5886
 * is not in the list or the list does not exist.
5887
 */
5888
int _TIFFRemoveEntryFromDirectoryListByOffset(TIFF *tif, uint64_t diroff)
5889
{
5890
    if (tif->tif_map_dir_offset_to_number == NULL)
5891
        return 1;
5892

5893
    TIFFOffsetAndDirNumber entryOld;
5894
    entryOld.offset = diroff;
5895
    entryOld.dirNumber = 0;
5896
    /* We must remove first from tif_map_dir_number_to_offset as the
5897
     * entry is owned (and thus freed) by tif_map_dir_offset_to_number.
5898
     * However, we need firstly to find the directory number from offset. */
5899

5900
    TIFFOffsetAndDirNumber *foundEntryOldOff =
5901
        (TIFFOffsetAndDirNumber *)TIFFHashSetLookup(
5902
            tif->tif_map_dir_offset_to_number, &entryOld);
5903
    if (foundEntryOldOff)
5904
    {
5905
        entryOld.dirNumber = foundEntryOldOff->dirNumber;
5906
        if (tif->tif_map_dir_number_to_offset != NULL)
5907
        {
5908
            TIFFOffsetAndDirNumber *foundEntryOldDir =
5909
                (TIFFOffsetAndDirNumber *)TIFFHashSetLookup(
5910
                    tif->tif_map_dir_number_to_offset, &entryOld);
5911
            if (foundEntryOldDir)
5912
            {
5913
                TIFFHashSetRemove(tif->tif_map_dir_number_to_offset,
5914
                                  foundEntryOldDir);
5915
                TIFFHashSetRemove(tif->tif_map_dir_offset_to_number,
5916
                                  foundEntryOldOff);
5917
                return 1;
5918
            }
5919
        }
5920
        else
5921
        {
5922
            TIFFErrorExtR(tif, "_TIFFRemoveEntryFromDirectoryListByOffset",
5923
                          "Unexpectedly tif_map_dir_number_to_offset is "
5924
                          "missing but tif_map_dir_offset_to_number exists.");
5925
            return 0;
5926
        }
5927
    }
5928
    return 1;
5929
} /*--- _TIFFRemoveEntryFromDirectoryListByOffset() ---*/
5930

5931
/*
5932
 * Check the count field of a directory entry against a known value.  The
5933
 * caller is expected to skip/ignore the tag if there is a mismatch.
5934
 */
5935
static int CheckDirCount(TIFF *tif, TIFFDirEntry *dir, uint32_t count)
5936
{
5937
    if ((uint64_t)count > dir->tdir_count)
5938
    {
5939
        const TIFFField *fip = TIFFFieldWithTag(tif, dir->tdir_tag);
5940
        TIFFWarningExtR(tif, tif->tif_name,
5941
                        "incorrect count for field \"%s\" (%" PRIu64
5942
                        ", expecting %" PRIu32 "); tag ignored",
5943
                        fip ? fip->field_name : "unknown tagname",
5944
                        dir->tdir_count, count);
5945
        return (0);
5946
    }
5947
    else if ((uint64_t)count < dir->tdir_count)
5948
    {
5949
        const TIFFField *fip = TIFFFieldWithTag(tif, dir->tdir_tag);
5950
        TIFFWarningExtR(tif, tif->tif_name,
5951
                        "incorrect count for field \"%s\" (%" PRIu64
5952
                        ", expecting %" PRIu32 "); tag trimmed",
5953
                        fip ? fip->field_name : "unknown tagname",
5954
                        dir->tdir_count, count);
5955
        dir->tdir_count = count;
5956
        return (1);
5957
    }
5958
    return (1);
5959
}
5960

5961
/*
5962
 * Read IFD structure from the specified offset. If the pointer to
5963
 * nextdiroff variable has been specified, read it too. Function returns a
5964
 * number of fields in the directory or 0 if failed.
5965
 */
5966
static uint16_t TIFFFetchDirectory(TIFF *tif, uint64_t diroff,
5967
                                   TIFFDirEntry **pdir, uint64_t *nextdiroff)
5968
{
5969
    static const char module[] = "TIFFFetchDirectory";
5970

5971
    void *origdir;
5972
    uint16_t dircount16;
5973
    uint32_t dirsize;
5974
    TIFFDirEntry *dir;
5975
    uint8_t *ma;
5976
    TIFFDirEntry *mb;
5977
    uint16_t n;
5978

5979
    assert(pdir);
5980

5981
    tif->tif_diroff = diroff;
5982
    if (nextdiroff)
5983
        *nextdiroff = 0;
5984
    if (!isMapped(tif))
5985
    {
5986
        if (!SeekOK(tif, tif->tif_diroff))
5987
        {
5988
            TIFFErrorExtR(tif, module,
5989
                          "%s: Seek error accessing TIFF directory",
5990
                          tif->tif_name);
5991
            return 0;
5992
        }
5993
        if (!(tif->tif_flags & TIFF_BIGTIFF))
5994
        {
5995
            if (!ReadOK(tif, &dircount16, sizeof(uint16_t)))
5996
            {
5997
                TIFFErrorExtR(tif, module,
5998
                              "%s: Can not read TIFF directory count",
5999
                              tif->tif_name);
6000
                return 0;
6001
            }
6002
            if (tif->tif_flags & TIFF_SWAB)
6003
                TIFFSwabShort(&dircount16);
6004
            if (dircount16 > 4096)
6005
            {
6006
                TIFFErrorExtR(tif, module,
6007
                              "Sanity check on directory count failed, this is "
6008
                              "probably not a valid IFD offset");
6009
                return 0;
6010
            }
6011
            dirsize = 12;
6012
        }
6013
        else
6014
        {
6015
            uint64_t dircount64;
6016
            if (!ReadOK(tif, &dircount64, sizeof(uint64_t)))
6017
            {
6018
                TIFFErrorExtR(tif, module,
6019
                              "%s: Can not read TIFF directory count",
6020
                              tif->tif_name);
6021
                return 0;
6022
            }
6023
            if (tif->tif_flags & TIFF_SWAB)
6024
                TIFFSwabLong8(&dircount64);
6025
            if (dircount64 > 4096)
6026
            {
6027
                TIFFErrorExtR(tif, module,
6028
                              "Sanity check on directory count failed, this is "
6029
                              "probably not a valid IFD offset");
6030
                return 0;
6031
            }
6032
            dircount16 = (uint16_t)dircount64;
6033
            dirsize = 20;
6034
        }
6035
        origdir = _TIFFCheckMalloc(tif, dircount16, dirsize,
6036
                                   "to read TIFF directory");
6037
        if (origdir == NULL)
6038
            return 0;
6039
        if (!ReadOK(tif, origdir, (tmsize_t)(dircount16 * dirsize)))
6040
        {
6041
            TIFFErrorExtR(tif, module, "%.100s: Can not read TIFF directory",
6042
                          tif->tif_name);
6043
            _TIFFfreeExt(tif, origdir);
6044
            return 0;
6045
        }
6046
        /*
6047
         * Read offset to next directory for sequential scans if
6048
         * needed.
6049
         */
6050
        if (nextdiroff)
6051
        {
6052
            if (!(tif->tif_flags & TIFF_BIGTIFF))
6053
            {
6054
                uint32_t nextdiroff32;
6055
                if (!ReadOK(tif, &nextdiroff32, sizeof(uint32_t)))
6056
                    nextdiroff32 = 0;
6057
                if (tif->tif_flags & TIFF_SWAB)
6058
                    TIFFSwabLong(&nextdiroff32);
6059
                *nextdiroff = nextdiroff32;
6060
            }
6061
            else
6062
            {
6063
                if (!ReadOK(tif, nextdiroff, sizeof(uint64_t)))
6064
                    *nextdiroff = 0;
6065
                if (tif->tif_flags & TIFF_SWAB)
6066
                    TIFFSwabLong8(nextdiroff);
6067
            }
6068
        }
6069
    }
6070
    else
6071
    {
6072
        tmsize_t m;
6073
        tmsize_t off;
6074
        if (tif->tif_diroff > (uint64_t)INT64_MAX)
6075
        {
6076
            TIFFErrorExtR(tif, module, "Can not read TIFF directory count");
6077
            return (0);
6078
        }
6079
        off = (tmsize_t)tif->tif_diroff;
6080

6081
        /*
6082
         * Check for integer overflow when validating the dir_off,
6083
         * otherwise a very high offset may cause an OOB read and
6084
         * crash the client. Make two comparisons instead of
6085
         *
6086
         *  off + sizeof(uint16_t) > tif->tif_size
6087
         *
6088
         * to avoid overflow.
6089
         */
6090
        if (!(tif->tif_flags & TIFF_BIGTIFF))
6091
        {
6092
            m = off + sizeof(uint16_t);
6093
            if ((m < off) || (m < (tmsize_t)sizeof(uint16_t)) ||
6094
                (m > tif->tif_size))
6095
            {
6096
                TIFFErrorExtR(tif, module, "Can not read TIFF directory count");
6097
                return 0;
6098
            }
6099
            else
6100
            {
6101
                _TIFFmemcpy(&dircount16, tif->tif_base + off, sizeof(uint16_t));
6102
            }
6103
            off += sizeof(uint16_t);
6104
            if (tif->tif_flags & TIFF_SWAB)
6105
                TIFFSwabShort(&dircount16);
6106
            if (dircount16 > 4096)
6107
            {
6108
                TIFFErrorExtR(tif, module,
6109
                              "Sanity check on directory count failed, this is "
6110
                              "probably not a valid IFD offset");
6111
                return 0;
6112
            }
6113
            dirsize = 12;
6114
        }
6115
        else
6116
        {
6117
            uint64_t dircount64;
6118
            m = off + sizeof(uint64_t);
6119
            if ((m < off) || (m < (tmsize_t)sizeof(uint64_t)) ||
6120
                (m > tif->tif_size))
6121
            {
6122
                TIFFErrorExtR(tif, module, "Can not read TIFF directory count");
6123
                return 0;
6124
            }
6125
            else
6126
            {
6127
                _TIFFmemcpy(&dircount64, tif->tif_base + off, sizeof(uint64_t));
6128
            }
6129
            off += sizeof(uint64_t);
6130
            if (tif->tif_flags & TIFF_SWAB)
6131
                TIFFSwabLong8(&dircount64);
6132
            if (dircount64 > 4096)
6133
            {
6134
                TIFFErrorExtR(tif, module,
6135
                              "Sanity check on directory count failed, this is "
6136
                              "probably not a valid IFD offset");
6137
                return 0;
6138
            }
6139
            dircount16 = (uint16_t)dircount64;
6140
            dirsize = 20;
6141
        }
6142
        if (dircount16 == 0)
6143
        {
6144
            TIFFErrorExtR(tif, module,
6145
                          "Sanity check on directory count failed, zero tag "
6146
                          "directories not supported");
6147
            return 0;
6148
        }
6149
        /* Before allocating a huge amount of memory for corrupted files, check
6150
         * if size of requested memory is not greater than file size. */
6151
        uint64_t filesize = TIFFGetFileSize(tif);
6152
        uint64_t allocsize = (uint64_t)dircount16 * dirsize;
6153
        if (allocsize > filesize)
6154
        {
6155
            TIFFWarningExtR(
6156
                tif, module,
6157
                "Requested memory size for TIFF directory of %" PRIu64
6158
                " is greater than filesize %" PRIu64
6159
                ". Memory not allocated, TIFF directory not read",
6160
                allocsize, filesize);
6161
            return 0;
6162
        }
6163
        origdir = _TIFFCheckMalloc(tif, dircount16, dirsize,
6164
                                   "to read TIFF directory");
6165
        if (origdir == NULL)
6166
            return 0;
6167
        m = off + dircount16 * dirsize;
6168
        if ((m < off) || (m < (tmsize_t)(dircount16 * dirsize)) ||
6169
            (m > tif->tif_size))
6170
        {
6171
            TIFFErrorExtR(tif, module, "Can not read TIFF directory");
6172
            _TIFFfreeExt(tif, origdir);
6173
            return 0;
6174
        }
6175
        else
6176
        {
6177
            _TIFFmemcpy(origdir, tif->tif_base + off, dircount16 * dirsize);
6178
        }
6179
        if (nextdiroff)
6180
        {
6181
            off += dircount16 * dirsize;
6182
            if (!(tif->tif_flags & TIFF_BIGTIFF))
6183
            {
6184
                uint32_t nextdiroff32;
6185
                m = off + sizeof(uint32_t);
6186
                if ((m < off) || (m < (tmsize_t)sizeof(uint32_t)) ||
6187
                    (m > tif->tif_size))
6188
                    nextdiroff32 = 0;
6189
                else
6190
                    _TIFFmemcpy(&nextdiroff32, tif->tif_base + off,
6191
                                sizeof(uint32_t));
6192
                if (tif->tif_flags & TIFF_SWAB)
6193
                    TIFFSwabLong(&nextdiroff32);
6194
                *nextdiroff = nextdiroff32;
6195
            }
6196
            else
6197
            {
6198
                m = off + sizeof(uint64_t);
6199
                if ((m < off) || (m < (tmsize_t)sizeof(uint64_t)) ||
6200
                    (m > tif->tif_size))
6201
                    *nextdiroff = 0;
6202
                else
6203
                    _TIFFmemcpy(nextdiroff, tif->tif_base + off,
6204
                                sizeof(uint64_t));
6205
                if (tif->tif_flags & TIFF_SWAB)
6206
                    TIFFSwabLong8(nextdiroff);
6207
            }
6208
        }
6209
    }
6210
    /* No check against filesize needed here because "dir" should have same size
6211
     * than "origdir" checked above. */
6212
    dir = (TIFFDirEntry *)_TIFFCheckMalloc(
6213
        tif, dircount16, sizeof(TIFFDirEntry), "to read TIFF directory");
6214
    if (dir == 0)
6215
    {
6216
        _TIFFfreeExt(tif, origdir);
6217
        return 0;
6218
    }
6219
    ma = (uint8_t *)origdir;
6220
    mb = dir;
6221
    for (n = 0; n < dircount16; n++)
6222
    {
6223
        mb->tdir_ignore = FALSE;
6224
        if (tif->tif_flags & TIFF_SWAB)
6225
            TIFFSwabShort((uint16_t *)ma);
6226
        mb->tdir_tag = *(uint16_t *)ma;
6227
        ma += sizeof(uint16_t);
6228
        if (tif->tif_flags & TIFF_SWAB)
6229
            TIFFSwabShort((uint16_t *)ma);
6230
        mb->tdir_type = *(uint16_t *)ma;
6231
        ma += sizeof(uint16_t);
6232
        if (!(tif->tif_flags & TIFF_BIGTIFF))
6233
        {
6234
            if (tif->tif_flags & TIFF_SWAB)
6235
                TIFFSwabLong((uint32_t *)ma);
6236
            mb->tdir_count = (uint64_t)(*(uint32_t *)ma);
6237
            ma += sizeof(uint32_t);
6238
            mb->tdir_offset.toff_long8 = 0;
6239
            *(uint32_t *)(&mb->tdir_offset) = *(uint32_t *)ma;
6240
            ma += sizeof(uint32_t);
6241
        }
6242
        else
6243
        {
6244
            if (tif->tif_flags & TIFF_SWAB)
6245
                TIFFSwabLong8((uint64_t *)ma);
6246
            mb->tdir_count = TIFFReadUInt64(ma);
6247
            ma += sizeof(uint64_t);
6248
            mb->tdir_offset.toff_long8 = TIFFReadUInt64(ma);
6249
            ma += sizeof(uint64_t);
6250
        }
6251
        mb++;
6252
    }
6253
    _TIFFfreeExt(tif, origdir);
6254
    *pdir = dir;
6255
    return dircount16;
6256
}
6257

6258
/*
6259
 * Fetch a tag that is not handled by special case code.
6260
 */
6261
static int TIFFFetchNormalTag(TIFF *tif, TIFFDirEntry *dp, int recover)
6262
{
6263
    static const char module[] = "TIFFFetchNormalTag";
6264
    enum TIFFReadDirEntryErr err;
6265
    uint32_t fii;
6266
    const TIFFField *fip = NULL;
6267
    TIFFReadDirectoryFindFieldInfo(tif, dp->tdir_tag, &fii);
6268
    if (fii == FAILED_FII)
6269
    {
6270
        TIFFErrorExtR(tif, "TIFFFetchNormalTag",
6271
                      "No definition found for tag %" PRIu16, dp->tdir_tag);
6272
        return 0;
6273
    }
6274
    fip = tif->tif_fields[fii];
6275
    assert(fip != NULL); /* should not happen */
6276
    assert(fip->set_field_type !=
6277
           TIFF_SETGET_OTHER); /* if so, we shouldn't arrive here but deal with
6278
                                  this in specialized code */
6279
    assert(fip->set_field_type !=
6280
           TIFF_SETGET_INT); /* if so, we shouldn't arrive here as this is only
6281
                                the case for pseudo-tags */
6282
    err = TIFFReadDirEntryErrOk;
6283
    switch (fip->set_field_type)
6284
    {
6285
        case TIFF_SETGET_UNDEFINED:
6286
            TIFFErrorExtR(
6287
                tif, "TIFFFetchNormalTag",
6288
                "Defined set_field_type of custom tag %u (%s) is "
6289
                "TIFF_SETGET_UNDEFINED and thus tag is not read from file",
6290
                fip->field_tag, fip->field_name);
6291
            break;
6292
        case TIFF_SETGET_ASCII:
6293
        {
6294
            uint8_t *data;
6295
            assert(fip->field_passcount == 0);
6296
            err = TIFFReadDirEntryByteArray(tif, dp, &data);
6297
            if (err == TIFFReadDirEntryErrOk)
6298
            {
6299
                size_t mb = 0;
6300
                int n;
6301
                if (data != NULL)
6302
                {
6303
                    if (dp->tdir_count > 0 && data[dp->tdir_count - 1] == 0)
6304
                    {
6305
                        /* optimization: if data is known to be 0 terminated, we
6306
                         * can use strlen() */
6307
                        mb = strlen((const char *)data);
6308
                    }
6309
                    else
6310
                    {
6311
                        /* general case. equivalent to non-portable */
6312
                        /* mb = strnlen((const char*)data,
6313
                         * (uint32_t)dp->tdir_count); */
6314
                        uint8_t *ma = data;
6315
                        while (mb < (uint32_t)dp->tdir_count)
6316
                        {
6317
                            if (*ma == 0)
6318
                                break;
6319
                            ma++;
6320
                            mb++;
6321
                        }
6322
                    }
6323
                }
6324
                if (!EvaluateIFDdatasizeReading(tif, dp))
6325
                {
6326
                    if (data != NULL)
6327
                        _TIFFfreeExt(tif, data);
6328
                    return (0);
6329
                }
6330
                if (mb + 1 < (uint32_t)dp->tdir_count)
6331
                    TIFFWarningExtR(
6332
                        tif, module,
6333
                        "ASCII value for tag \"%s\" contains null byte in "
6334
                        "value; value incorrectly truncated during reading due "
6335
                        "to implementation limitations",
6336
                        fip->field_name);
6337
                else if (mb + 1 > (uint32_t)dp->tdir_count)
6338
                {
6339
                    TIFFWarningExtR(tif, module,
6340
                                    "ASCII value for tag \"%s\" does not end "
6341
                                    "in null byte. Forcing it to be null",
6342
                                    fip->field_name);
6343
                    /* TIFFReadDirEntryArrayWithLimit() ensures this can't be
6344
                     * larger than MAX_SIZE_TAG_DATA */
6345
                    assert((uint32_t)dp->tdir_count + 1 == dp->tdir_count + 1);
6346
                    uint8_t *o =
6347
                        _TIFFmallocExt(tif, (uint32_t)dp->tdir_count + 1);
6348
                    if (o == NULL)
6349
                    {
6350
                        if (data != NULL)
6351
                            _TIFFfreeExt(tif, data);
6352
                        return (0);
6353
                    }
6354
                    if (dp->tdir_count > 0)
6355
                    {
6356
                        _TIFFmemcpy(o, data, (uint32_t)dp->tdir_count);
6357
                    }
6358
                    o[(uint32_t)dp->tdir_count] = 0;
6359
                    if (data != 0)
6360
                        _TIFFfreeExt(tif, data);
6361
                    data = o;
6362
                }
6363
                n = TIFFSetField(tif, dp->tdir_tag, data);
6364
                if (data != 0)
6365
                    _TIFFfreeExt(tif, data);
6366
                if (!n)
6367
                    return (0);
6368
            }
6369
        }
6370
        break;
6371
        case TIFF_SETGET_UINT8:
6372
        {
6373
            uint8_t data = 0;
6374
            assert(fip->field_readcount == 1);
6375
            assert(fip->field_passcount == 0);
6376
            err = TIFFReadDirEntryByte(tif, dp, &data);
6377
            if (err == TIFFReadDirEntryErrOk)
6378
            {
6379
                if (!TIFFSetField(tif, dp->tdir_tag, data))
6380
                    return (0);
6381
            }
6382
        }
6383
        break;
6384
        case TIFF_SETGET_SINT8:
6385
        {
6386
            int8_t data = 0;
6387
            assert(fip->field_readcount == 1);
6388
            assert(fip->field_passcount == 0);
6389
            err = TIFFReadDirEntrySbyte(tif, dp, &data);
6390
            if (err == TIFFReadDirEntryErrOk)
6391
            {
6392
                if (!TIFFSetField(tif, dp->tdir_tag, data))
6393
                    return (0);
6394
            }
6395
        }
6396
        break;
6397
        case TIFF_SETGET_UINT16:
6398
        {
6399
            uint16_t data;
6400
            assert(fip->field_readcount == 1);
6401
            assert(fip->field_passcount == 0);
6402
            err = TIFFReadDirEntryShort(tif, dp, &data);
6403
            if (err == TIFFReadDirEntryErrOk)
6404
            {
6405
                if (!TIFFSetField(tif, dp->tdir_tag, data))
6406
                    return (0);
6407
            }
6408
        }
6409
        break;
6410
        case TIFF_SETGET_SINT16:
6411
        {
6412
            int16_t data;
6413
            assert(fip->field_readcount == 1);
6414
            assert(fip->field_passcount == 0);
6415
            err = TIFFReadDirEntrySshort(tif, dp, &data);
6416
            if (err == TIFFReadDirEntryErrOk)
6417
            {
6418
                if (!TIFFSetField(tif, dp->tdir_tag, data))
6419
                    return (0);
6420
            }
6421
        }
6422
        break;
6423
        case TIFF_SETGET_UINT32:
6424
        {
6425
            uint32_t data;
6426
            assert(fip->field_readcount == 1);
6427
            assert(fip->field_passcount == 0);
6428
            err = TIFFReadDirEntryLong(tif, dp, &data);
6429
            if (err == TIFFReadDirEntryErrOk)
6430
            {
6431
                if (!TIFFSetField(tif, dp->tdir_tag, data))
6432
                    return (0);
6433
            }
6434
        }
6435
        break;
6436
        case TIFF_SETGET_SINT32:
6437
        {
6438
            int32_t data;
6439
            assert(fip->field_readcount == 1);
6440
            assert(fip->field_passcount == 0);
6441
            err = TIFFReadDirEntrySlong(tif, dp, &data);
6442
            if (err == TIFFReadDirEntryErrOk)
6443
            {
6444
                if (!TIFFSetField(tif, dp->tdir_tag, data))
6445
                    return (0);
6446
            }
6447
        }
6448
        break;
6449
        case TIFF_SETGET_UINT64:
6450
        {
6451
            uint64_t data;
6452
            assert(fip->field_readcount == 1);
6453
            assert(fip->field_passcount == 0);
6454
            err = TIFFReadDirEntryLong8(tif, dp, &data);
6455
            if (err == TIFFReadDirEntryErrOk)
6456
            {
6457
                if (!EvaluateIFDdatasizeReading(tif, dp))
6458
                    return 0;
6459
                if (!TIFFSetField(tif, dp->tdir_tag, data))
6460
                    return (0);
6461
            }
6462
        }
6463
        break;
6464
        case TIFF_SETGET_SINT64:
6465
        {
6466
            int64_t data;
6467
            assert(fip->field_readcount == 1);
6468
            assert(fip->field_passcount == 0);
6469
            err = TIFFReadDirEntrySlong8(tif, dp, &data);
6470
            if (err == TIFFReadDirEntryErrOk)
6471
            {
6472
                if (!EvaluateIFDdatasizeReading(tif, dp))
6473
                    return 0;
6474
                if (!TIFFSetField(tif, dp->tdir_tag, data))
6475
                    return (0);
6476
            }
6477
        }
6478
        break;
6479
        case TIFF_SETGET_FLOAT:
6480
        {
6481
            float data;
6482
            assert(fip->field_readcount == 1);
6483
            assert(fip->field_passcount == 0);
6484
            err = TIFFReadDirEntryFloat(tif, dp, &data);
6485
            if (err == TIFFReadDirEntryErrOk)
6486
            {
6487
                if (!EvaluateIFDdatasizeReading(tif, dp))
6488
                    return 0;
6489
                if (!TIFFSetField(tif, dp->tdir_tag, data))
6490
                    return (0);
6491
            }
6492
        }
6493
        break;
6494
        case TIFF_SETGET_DOUBLE:
6495
        {
6496
            double data;
6497
            assert(fip->field_readcount == 1);
6498
            assert(fip->field_passcount == 0);
6499
            err = TIFFReadDirEntryDouble(tif, dp, &data);
6500
            if (err == TIFFReadDirEntryErrOk)
6501
            {
6502
                if (!EvaluateIFDdatasizeReading(tif, dp))
6503
                    return 0;
6504
                if (!TIFFSetField(tif, dp->tdir_tag, data))
6505
                    return (0);
6506
            }
6507
        }
6508
        break;
6509
        case TIFF_SETGET_IFD8:
6510
        {
6511
            uint64_t data;
6512
            assert(fip->field_readcount == 1);
6513
            assert(fip->field_passcount == 0);
6514
            err = TIFFReadDirEntryIfd8(tif, dp, &data);
6515
            if (err == TIFFReadDirEntryErrOk)
6516
            {
6517
                if (!EvaluateIFDdatasizeReading(tif, dp))
6518
                    return 0;
6519
                if (!TIFFSetField(tif, dp->tdir_tag, data))
6520
                    return (0);
6521
            }
6522
        }
6523
        break;
6524
        case TIFF_SETGET_UINT16_PAIR:
6525
        {
6526
            uint16_t *data;
6527
            assert(fip->field_readcount == 2);
6528
            assert(fip->field_passcount == 0);
6529
            if (dp->tdir_count != 2)
6530
            {
6531
                TIFFWarningExtR(tif, module,
6532
                                "incorrect count for field \"%s\", expected 2, "
6533
                                "got %" PRIu64,
6534
                                fip->field_name, dp->tdir_count);
6535
                return (0);
6536
            }
6537
            err = TIFFReadDirEntryShortArray(tif, dp, &data);
6538
            if (err == TIFFReadDirEntryErrOk)
6539
            {
6540
                int m;
6541
                assert(data); /* avoid CLang static Analyzer false positive */
6542
                m = TIFFSetField(tif, dp->tdir_tag, data[0], data[1]);
6543
                _TIFFfreeExt(tif, data);
6544
                if (!m)
6545
                    return (0);
6546
            }
6547
        }
6548
        break;
6549
        case TIFF_SETGET_C0_UINT8:
6550
        {
6551
            uint8_t *data;
6552
            assert(fip->field_readcount >= 1);
6553
            assert(fip->field_passcount == 0);
6554
            if (dp->tdir_count != (uint64_t)fip->field_readcount)
6555
            {
6556
                TIFFWarningExtR(tif, module,
6557
                                "incorrect count for field \"%s\", expected "
6558
                                "%d, got %" PRIu64,
6559
                                fip->field_name, (int)fip->field_readcount,
6560
                                dp->tdir_count);
6561
                return (0);
6562
            }
6563
            else
6564
            {
6565
                err = TIFFReadDirEntryByteArray(tif, dp, &data);
6566
                if (err == TIFFReadDirEntryErrOk)
6567
                {
6568
                    if (!EvaluateIFDdatasizeReading(tif, dp))
6569
                    {
6570
                        if (data != 0)
6571
                            _TIFFfreeExt(tif, data);
6572
                        return 0;
6573
                    }
6574
                    int m;
6575
                    m = TIFFSetField(tif, dp->tdir_tag, data);
6576
                    if (data != 0)
6577
                        _TIFFfreeExt(tif, data);
6578
                    if (!m)
6579
                        return (0);
6580
                }
6581
            }
6582
        }
6583
        break;
6584
        case TIFF_SETGET_C0_SINT8:
6585
        {
6586
            int8_t *data;
6587
            assert(fip->field_readcount >= 1);
6588
            assert(fip->field_passcount == 0);
6589
            if (dp->tdir_count != (uint64_t)fip->field_readcount)
6590
            {
6591
                TIFFWarningExtR(tif, module,
6592
                                "incorrect count for field \"%s\", expected "
6593
                                "%d, got %" PRIu64,
6594
                                fip->field_name, (int)fip->field_readcount,
6595
                                dp->tdir_count);
6596
                return (0);
6597
            }
6598
            else
6599
            {
6600
                err = TIFFReadDirEntrySbyteArray(tif, dp, &data);
6601
                if (err == TIFFReadDirEntryErrOk)
6602
                {
6603
                    if (!EvaluateIFDdatasizeReading(tif, dp))
6604
                    {
6605
                        if (data != 0)
6606
                            _TIFFfreeExt(tif, data);
6607
                        return 0;
6608
                    }
6609
                    int m;
6610
                    m = TIFFSetField(tif, dp->tdir_tag, data);
6611
                    if (data != 0)
6612
                        _TIFFfreeExt(tif, data);
6613
                    if (!m)
6614
                        return (0);
6615
                }
6616
            }
6617
        }
6618
        break;
6619
        case TIFF_SETGET_C0_UINT16:
6620
        {
6621
            uint16_t *data;
6622
            assert(fip->field_readcount >= 1);
6623
            assert(fip->field_passcount == 0);
6624
            if (dp->tdir_count != (uint64_t)fip->field_readcount)
6625
            {
6626
                TIFFWarningExtR(tif, module,
6627
                                "incorrect count for field \"%s\", expected "
6628
                                "%d, got %" PRIu64,
6629
                                fip->field_name, (int)fip->field_readcount,
6630
                                dp->tdir_count);
6631
                return (0);
6632
            }
6633
            else
6634
            {
6635
                err = TIFFReadDirEntryShortArray(tif, dp, &data);
6636
                if (err == TIFFReadDirEntryErrOk)
6637
                {
6638
                    if (!EvaluateIFDdatasizeReading(tif, dp))
6639
                    {
6640
                        if (data != 0)
6641
                            _TIFFfreeExt(tif, data);
6642
                        return 0;
6643
                    }
6644
                    int m;
6645
                    m = TIFFSetField(tif, dp->tdir_tag, data);
6646
                    if (data != 0)
6647
                        _TIFFfreeExt(tif, data);
6648
                    if (!m)
6649
                        return (0);
6650
                }
6651
            }
6652
        }
6653
        break;
6654
        case TIFF_SETGET_C0_SINT16:
6655
        {
6656
            int16_t *data;
6657
            assert(fip->field_readcount >= 1);
6658
            assert(fip->field_passcount == 0);
6659
            if (dp->tdir_count != (uint64_t)fip->field_readcount)
6660
            {
6661
                TIFFWarningExtR(tif, module,
6662
                                "incorrect count for field \"%s\", expected "
6663
                                "%d, got %" PRIu64,
6664
                                fip->field_name, (int)fip->field_readcount,
6665
                                dp->tdir_count);
6666
                return (0);
6667
            }
6668
            else
6669
            {
6670
                err = TIFFReadDirEntrySshortArray(tif, dp, &data);
6671
                if (err == TIFFReadDirEntryErrOk)
6672
                {
6673
                    if (!EvaluateIFDdatasizeReading(tif, dp))
6674
                    {
6675
                        if (data != 0)
6676
                            _TIFFfreeExt(tif, data);
6677
                        return 0;
6678
                    }
6679
                    int m;
6680
                    m = TIFFSetField(tif, dp->tdir_tag, data);
6681
                    if (data != 0)
6682
                        _TIFFfreeExt(tif, data);
6683
                    if (!m)
6684
                        return (0);
6685
                }
6686
            }
6687
        }
6688
        break;
6689
        case TIFF_SETGET_C0_UINT32:
6690
        {
6691
            uint32_t *data;
6692
            assert(fip->field_readcount >= 1);
6693
            assert(fip->field_passcount == 0);
6694
            if (dp->tdir_count != (uint64_t)fip->field_readcount)
6695
            {
6696
                TIFFWarningExtR(tif, module,
6697
                                "incorrect count for field \"%s\", expected "
6698
                                "%d, got %" PRIu64,
6699
                                fip->field_name, (int)fip->field_readcount,
6700
                                dp->tdir_count);
6701
                return (0);
6702
            }
6703
            else
6704
            {
6705
                err = TIFFReadDirEntryLongArray(tif, dp, &data);
6706
                if (err == TIFFReadDirEntryErrOk)
6707
                {
6708
                    if (!EvaluateIFDdatasizeReading(tif, dp))
6709
                    {
6710
                        if (data != 0)
6711
                            _TIFFfreeExt(tif, data);
6712
                        return 0;
6713
                    }
6714
                    int m;
6715
                    m = TIFFSetField(tif, dp->tdir_tag, data);
6716
                    if (data != 0)
6717
                        _TIFFfreeExt(tif, data);
6718
                    if (!m)
6719
                        return (0);
6720
                }
6721
            }
6722
        }
6723
        break;
6724
        case TIFF_SETGET_C0_SINT32:
6725
        {
6726
            int32_t *data;
6727
            assert(fip->field_readcount >= 1);
6728
            assert(fip->field_passcount == 0);
6729
            if (dp->tdir_count != (uint64_t)fip->field_readcount)
6730
            {
6731
                TIFFWarningExtR(tif, module,
6732
                                "incorrect count for field \"%s\", expected "
6733
                                "%d, got %" PRIu64,
6734
                                fip->field_name, (int)fip->field_readcount,
6735
                                dp->tdir_count);
6736
                return (0);
6737
            }
6738
            else
6739
            {
6740
                err = TIFFReadDirEntrySlongArray(tif, dp, &data);
6741
                if (err == TIFFReadDirEntryErrOk)
6742
                {
6743
                    if (!EvaluateIFDdatasizeReading(tif, dp))
6744
                    {
6745
                        if (data != 0)
6746
                            _TIFFfreeExt(tif, data);
6747
                        return 0;
6748
                    }
6749
                    int m;
6750
                    m = TIFFSetField(tif, dp->tdir_tag, data);
6751
                    if (data != 0)
6752
                        _TIFFfreeExt(tif, data);
6753
                    if (!m)
6754
                        return (0);
6755
                }
6756
            }
6757
        }
6758
        break;
6759
        case TIFF_SETGET_C0_UINT64:
6760
        {
6761
            uint64_t *data;
6762
            assert(fip->field_readcount >= 1);
6763
            assert(fip->field_passcount == 0);
6764
            if (dp->tdir_count != (uint64_t)fip->field_readcount)
6765
            {
6766
                TIFFWarningExtR(tif, module,
6767
                                "incorrect count for field \"%s\", expected "
6768
                                "%d, got %" PRIu64,
6769
                                fip->field_name, (int)fip->field_readcount,
6770
                                dp->tdir_count);
6771
                return (0);
6772
            }
6773
            else
6774
            {
6775
                err = TIFFReadDirEntryLong8Array(tif, dp, &data);
6776
                if (err == TIFFReadDirEntryErrOk)
6777
                {
6778
                    if (!EvaluateIFDdatasizeReading(tif, dp))
6779
                    {
6780
                        if (data != 0)
6781
                            _TIFFfreeExt(tif, data);
6782
                        return 0;
6783
                    }
6784
                    int m;
6785
                    m = TIFFSetField(tif, dp->tdir_tag, data);
6786
                    if (data != 0)
6787
                        _TIFFfreeExt(tif, data);
6788
                    if (!m)
6789
                        return (0);
6790
                }
6791
            }
6792
        }
6793
        break;
6794
        case TIFF_SETGET_C0_SINT64:
6795
        {
6796
            int64_t *data;
6797
            assert(fip->field_readcount >= 1);
6798
            assert(fip->field_passcount == 0);
6799
            if (dp->tdir_count != (uint64_t)fip->field_readcount)
6800
            {
6801
                TIFFWarningExtR(tif, module,
6802
                                "incorrect count for field \"%s\", expected "
6803
                                "%d, got %" PRIu64,
6804
                                fip->field_name, (int)fip->field_readcount,
6805
                                dp->tdir_count);
6806
                return (0);
6807
            }
6808
            else
6809
            {
6810
                err = TIFFReadDirEntrySlong8Array(tif, dp, &data);
6811
                if (err == TIFFReadDirEntryErrOk)
6812
                {
6813
                    if (!EvaluateIFDdatasizeReading(tif, dp))
6814
                    {
6815
                        if (data != 0)
6816
                            _TIFFfreeExt(tif, data);
6817
                        return 0;
6818
                    }
6819
                    int m;
6820
                    m = TIFFSetField(tif, dp->tdir_tag, data);
6821
                    if (data != 0)
6822
                        _TIFFfreeExt(tif, data);
6823
                    if (!m)
6824
                        return (0);
6825
                }
6826
            }
6827
        }
6828
        break;
6829
        case TIFF_SETGET_C0_FLOAT:
6830
        {
6831
            float *data;
6832
            assert(fip->field_readcount >= 1);
6833
            assert(fip->field_passcount == 0);
6834
            if (dp->tdir_count != (uint64_t)fip->field_readcount)
6835
            {
6836
                TIFFWarningExtR(tif, module,
6837
                                "incorrect count for field \"%s\", expected "
6838
                                "%d, got %" PRIu64,
6839
                                fip->field_name, (int)fip->field_readcount,
6840
                                dp->tdir_count);
6841
                return (0);
6842
            }
6843
            else
6844
            {
6845
                err = TIFFReadDirEntryFloatArray(tif, dp, &data);
6846
                if (err == TIFFReadDirEntryErrOk)
6847
                {
6848
                    if (!EvaluateIFDdatasizeReading(tif, dp))
6849
                    {
6850
                        if (data != 0)
6851
                            _TIFFfreeExt(tif, data);
6852
                        return 0;
6853
                    }
6854
                    int m;
6855
                    m = TIFFSetField(tif, dp->tdir_tag, data);
6856
                    if (data != 0)
6857
                        _TIFFfreeExt(tif, data);
6858
                    if (!m)
6859
                        return (0);
6860
                }
6861
            }
6862
        }
6863
        break;
6864
        /*--: Rational2Double: Extend for Double Arrays and Rational-Arrays read
6865
         * into Double-Arrays. */
6866
        case TIFF_SETGET_C0_DOUBLE:
6867
        {
6868
            double *data;
6869
            assert(fip->field_readcount >= 1);
6870
            assert(fip->field_passcount == 0);
6871
            if (dp->tdir_count != (uint64_t)fip->field_readcount)
6872
            {
6873
                TIFFWarningExtR(tif, module,
6874
                                "incorrect count for field \"%s\", expected "
6875
                                "%d, got %" PRIu64,
6876
                                fip->field_name, (int)fip->field_readcount,
6877
                                dp->tdir_count);
6878
                return (0);
6879
            }
6880
            else
6881
            {
6882
                err = TIFFReadDirEntryDoubleArray(tif, dp, &data);
6883
                if (err == TIFFReadDirEntryErrOk)
6884
                {
6885
                    if (!EvaluateIFDdatasizeReading(tif, dp))
6886
                    {
6887
                        if (data != 0)
6888
                            _TIFFfreeExt(tif, data);
6889
                        return 0;
6890
                    }
6891
                    int m;
6892
                    m = TIFFSetField(tif, dp->tdir_tag, data);
6893
                    if (data != 0)
6894
                        _TIFFfreeExt(tif, data);
6895
                    if (!m)
6896
                        return (0);
6897
                }
6898
            }
6899
        }
6900
        break;
6901
        case TIFF_SETGET_C16_ASCII:
6902
        {
6903
            uint8_t *data;
6904
            assert(fip->field_readcount == TIFF_VARIABLE);
6905
            assert(fip->field_passcount == 1);
6906
            if (dp->tdir_count > 0xFFFF)
6907
                err = TIFFReadDirEntryErrCount;
6908
            else
6909
            {
6910
                err = TIFFReadDirEntryByteArray(tif, dp, &data);
6911
                if (err == TIFFReadDirEntryErrOk)
6912
                {
6913
                    if (!EvaluateIFDdatasizeReading(tif, dp))
6914
                    {
6915
                        if (data != 0)
6916
                            _TIFFfreeExt(tif, data);
6917
                        return 0;
6918
                    }
6919
                    int m;
6920
                    if (data != 0 && dp->tdir_count > 0 &&
6921
                        data[dp->tdir_count - 1] != '\0')
6922
                    {
6923
                        TIFFWarningExtR(tif, module,
6924
                                        "ASCII value for ASCII array tag "
6925
                                        "\"%s\" does not end in null "
6926
                                        "byte. Forcing it to be null",
6927
                                        fip->field_name);
6928
                        /* Enlarge buffer and add terminating null. */
6929
                        uint8_t *o =
6930
                            _TIFFmallocExt(tif, (uint32_t)dp->tdir_count + 1);
6931
                        if (o == NULL)
6932
                        {
6933
                            if (data != NULL)
6934
                                _TIFFfreeExt(tif, data);
6935
                            return (0);
6936
                        }
6937
                        if (dp->tdir_count > 0)
6938
                        {
6939
                            _TIFFmemcpy(o, data, (uint32_t)dp->tdir_count);
6940
                        }
6941
                        o[(uint32_t)dp->tdir_count] = 0;
6942
                        dp->tdir_count++; /* Increment for added null. */
6943
                        if (data != 0)
6944
                            _TIFFfreeExt(tif, data);
6945
                        data = o;
6946
                    }
6947
                    m = TIFFSetField(tif, dp->tdir_tag,
6948
                                     (uint16_t)(dp->tdir_count), data);
6949
                    if (data != 0)
6950
                        _TIFFfreeExt(tif, data);
6951
                    if (!m)
6952
                        return (0);
6953
                }
6954
            }
6955
        }
6956
        break;
6957
        case TIFF_SETGET_C16_UINT8:
6958
        {
6959
            uint8_t *data;
6960
            assert(fip->field_readcount == TIFF_VARIABLE);
6961
            assert(fip->field_passcount == 1);
6962
            if (dp->tdir_count > 0xFFFF)
6963
                err = TIFFReadDirEntryErrCount;
6964
            else
6965
            {
6966
                err = TIFFReadDirEntryByteArray(tif, dp, &data);
6967
                if (err == TIFFReadDirEntryErrOk)
6968
                {
6969
                    if (!EvaluateIFDdatasizeReading(tif, dp))
6970
                    {
6971
                        if (data != 0)
6972
                            _TIFFfreeExt(tif, data);
6973
                        return 0;
6974
                    }
6975
                    int m;
6976
                    m = TIFFSetField(tif, dp->tdir_tag,
6977
                                     (uint16_t)(dp->tdir_count), data);
6978
                    if (data != 0)
6979
                        _TIFFfreeExt(tif, data);
6980
                    if (!m)
6981
                        return (0);
6982
                }
6983
            }
6984
        }
6985
        break;
6986
        case TIFF_SETGET_C16_SINT8:
6987
        {
6988
            int8_t *data;
6989
            assert(fip->field_readcount == TIFF_VARIABLE);
6990
            assert(fip->field_passcount == 1);
6991
            if (dp->tdir_count > 0xFFFF)
6992
                err = TIFFReadDirEntryErrCount;
6993
            else
6994
            {
6995
                err = TIFFReadDirEntrySbyteArray(tif, dp, &data);
6996
                if (err == TIFFReadDirEntryErrOk)
6997
                {
6998
                    if (!EvaluateIFDdatasizeReading(tif, dp))
6999
                    {
7000
                        if (data != 0)
7001
                            _TIFFfreeExt(tif, data);
7002
                        return 0;
7003
                    }
7004
                    int m;
7005
                    m = TIFFSetField(tif, dp->tdir_tag,
7006
                                     (uint16_t)(dp->tdir_count), data);
7007
                    if (data != 0)
7008
                        _TIFFfreeExt(tif, data);
7009
                    if (!m)
7010
                        return (0);
7011
                }
7012
            }
7013
        }
7014
        break;
7015
        case TIFF_SETGET_C16_UINT16:
7016
        {
7017
            uint16_t *data;
7018
            assert(fip->field_readcount == TIFF_VARIABLE);
7019
            assert(fip->field_passcount == 1);
7020
            if (dp->tdir_count > 0xFFFF)
7021
                err = TIFFReadDirEntryErrCount;
7022
            else
7023
            {
7024
                err = TIFFReadDirEntryShortArray(tif, dp, &data);
7025
                if (err == TIFFReadDirEntryErrOk)
7026
                {
7027
                    if (!EvaluateIFDdatasizeReading(tif, dp))
7028
                    {
7029
                        if (data != 0)
7030
                            _TIFFfreeExt(tif, data);
7031
                        return 0;
7032
                    }
7033
                    int m;
7034
                    m = TIFFSetField(tif, dp->tdir_tag,
7035
                                     (uint16_t)(dp->tdir_count), data);
7036
                    if (data != 0)
7037
                        _TIFFfreeExt(tif, data);
7038
                    if (!m)
7039
                        return (0);
7040
                }
7041
            }
7042
        }
7043
        break;
7044
        case TIFF_SETGET_C16_SINT16:
7045
        {
7046
            int16_t *data;
7047
            assert(fip->field_readcount == TIFF_VARIABLE);
7048
            assert(fip->field_passcount == 1);
7049
            if (dp->tdir_count > 0xFFFF)
7050
                err = TIFFReadDirEntryErrCount;
7051
            else
7052
            {
7053
                err = TIFFReadDirEntrySshortArray(tif, dp, &data);
7054
                if (err == TIFFReadDirEntryErrOk)
7055
                {
7056
                    if (!EvaluateIFDdatasizeReading(tif, dp))
7057
                    {
7058
                        if (data != 0)
7059
                            _TIFFfreeExt(tif, data);
7060
                        return 0;
7061
                    }
7062
                    int m;
7063
                    m = TIFFSetField(tif, dp->tdir_tag,
7064
                                     (uint16_t)(dp->tdir_count), data);
7065
                    if (data != 0)
7066
                        _TIFFfreeExt(tif, data);
7067
                    if (!m)
7068
                        return (0);
7069
                }
7070
            }
7071
        }
7072
        break;
7073
        case TIFF_SETGET_C16_UINT32:
7074
        {
7075
            uint32_t *data;
7076
            assert(fip->field_readcount == TIFF_VARIABLE);
7077
            assert(fip->field_passcount == 1);
7078
            if (dp->tdir_count > 0xFFFF)
7079
                err = TIFFReadDirEntryErrCount;
7080
            else
7081
            {
7082
                err = TIFFReadDirEntryLongArray(tif, dp, &data);
7083
                if (err == TIFFReadDirEntryErrOk)
7084
                {
7085
                    if (!EvaluateIFDdatasizeReading(tif, dp))
7086
                    {
7087
                        if (data != 0)
7088
                            _TIFFfreeExt(tif, data);
7089
                        return 0;
7090
                    }
7091
                    int m;
7092
                    m = TIFFSetField(tif, dp->tdir_tag,
7093
                                     (uint16_t)(dp->tdir_count), data);
7094
                    if (data != 0)
7095
                        _TIFFfreeExt(tif, data);
7096
                    if (!m)
7097
                        return (0);
7098
                }
7099
            }
7100
        }
7101
        break;
7102
        case TIFF_SETGET_C16_SINT32:
7103
        {
7104
            int32_t *data;
7105
            assert(fip->field_readcount == TIFF_VARIABLE);
7106
            assert(fip->field_passcount == 1);
7107
            if (dp->tdir_count > 0xFFFF)
7108
                err = TIFFReadDirEntryErrCount;
7109
            else
7110
            {
7111
                err = TIFFReadDirEntrySlongArray(tif, dp, &data);
7112
                if (err == TIFFReadDirEntryErrOk)
7113
                {
7114
                    if (!EvaluateIFDdatasizeReading(tif, dp))
7115
                    {
7116
                        if (data != 0)
7117
                            _TIFFfreeExt(tif, data);
7118
                        return 0;
7119
                    }
7120
                    int m;
7121
                    m = TIFFSetField(tif, dp->tdir_tag,
7122
                                     (uint16_t)(dp->tdir_count), data);
7123
                    if (data != 0)
7124
                        _TIFFfreeExt(tif, data);
7125
                    if (!m)
7126
                        return (0);
7127
                }
7128
            }
7129
        }
7130
        break;
7131
        case TIFF_SETGET_C16_UINT64:
7132
        {
7133
            uint64_t *data;
7134
            assert(fip->field_readcount == TIFF_VARIABLE);
7135
            assert(fip->field_passcount == 1);
7136
            if (dp->tdir_count > 0xFFFF)
7137
                err = TIFFReadDirEntryErrCount;
7138
            else
7139
            {
7140
                err = TIFFReadDirEntryLong8Array(tif, dp, &data);
7141
                if (err == TIFFReadDirEntryErrOk)
7142
                {
7143
                    if (!EvaluateIFDdatasizeReading(tif, dp))
7144
                    {
7145
                        if (data != 0)
7146
                            _TIFFfreeExt(tif, data);
7147
                        return 0;
7148
                    }
7149
                    int m;
7150
                    m = TIFFSetField(tif, dp->tdir_tag,
7151
                                     (uint16_t)(dp->tdir_count), data);
7152
                    if (data != 0)
7153
                        _TIFFfreeExt(tif, data);
7154
                    if (!m)
7155
                        return (0);
7156
                }
7157
            }
7158
        }
7159
        break;
7160
        case TIFF_SETGET_C16_SINT64:
7161
        {
7162
            int64_t *data;
7163
            assert(fip->field_readcount == TIFF_VARIABLE);
7164
            assert(fip->field_passcount == 1);
7165
            if (dp->tdir_count > 0xFFFF)
7166
                err = TIFFReadDirEntryErrCount;
7167
            else
7168
            {
7169
                err = TIFFReadDirEntrySlong8Array(tif, dp, &data);
7170
                if (err == TIFFReadDirEntryErrOk)
7171
                {
7172
                    if (!EvaluateIFDdatasizeReading(tif, dp))
7173
                    {
7174
                        if (data != 0)
7175
                            _TIFFfreeExt(tif, data);
7176
                        return 0;
7177
                    }
7178
                    int m;
7179
                    m = TIFFSetField(tif, dp->tdir_tag,
7180
                                     (uint16_t)(dp->tdir_count), data);
7181
                    if (data != 0)
7182
                        _TIFFfreeExt(tif, data);
7183
                    if (!m)
7184
                        return (0);
7185
                }
7186
            }
7187
        }
7188
        break;
7189
        case TIFF_SETGET_C16_FLOAT:
7190
        {
7191
            float *data;
7192
            assert(fip->field_readcount == TIFF_VARIABLE);
7193
            assert(fip->field_passcount == 1);
7194
            if (dp->tdir_count > 0xFFFF)
7195
                err = TIFFReadDirEntryErrCount;
7196
            else
7197
            {
7198
                err = TIFFReadDirEntryFloatArray(tif, dp, &data);
7199
                if (err == TIFFReadDirEntryErrOk)
7200
                {
7201
                    if (!EvaluateIFDdatasizeReading(tif, dp))
7202
                    {
7203
                        if (data != 0)
7204
                            _TIFFfreeExt(tif, data);
7205
                        return 0;
7206
                    }
7207
                    int m;
7208
                    m = TIFFSetField(tif, dp->tdir_tag,
7209
                                     (uint16_t)(dp->tdir_count), data);
7210
                    if (data != 0)
7211
                        _TIFFfreeExt(tif, data);
7212
                    if (!m)
7213
                        return (0);
7214
                }
7215
            }
7216
        }
7217
        break;
7218
        case TIFF_SETGET_C16_DOUBLE:
7219
        {
7220
            double *data;
7221
            assert(fip->field_readcount == TIFF_VARIABLE);
7222
            assert(fip->field_passcount == 1);
7223
            if (dp->tdir_count > 0xFFFF)
7224
                err = TIFFReadDirEntryErrCount;
7225
            else
7226
            {
7227
                err = TIFFReadDirEntryDoubleArray(tif, dp, &data);
7228
                if (err == TIFFReadDirEntryErrOk)
7229
                {
7230
                    if (!EvaluateIFDdatasizeReading(tif, dp))
7231
                    {
7232
                        if (data != 0)
7233
                            _TIFFfreeExt(tif, data);
7234
                        return 0;
7235
                    }
7236
                    int m;
7237
                    m = TIFFSetField(tif, dp->tdir_tag,
7238
                                     (uint16_t)(dp->tdir_count), data);
7239
                    if (data != 0)
7240
                        _TIFFfreeExt(tif, data);
7241
                    if (!m)
7242
                        return (0);
7243
                }
7244
            }
7245
        }
7246
        break;
7247
        case TIFF_SETGET_C16_IFD8:
7248
        {
7249
            uint64_t *data;
7250
            assert(fip->field_readcount == TIFF_VARIABLE);
7251
            assert(fip->field_passcount == 1);
7252
            if (dp->tdir_count > 0xFFFF)
7253
                err = TIFFReadDirEntryErrCount;
7254
            else
7255
            {
7256
                err = TIFFReadDirEntryIfd8Array(tif, dp, &data);
7257
                if (err == TIFFReadDirEntryErrOk)
7258
                {
7259
                    if (!EvaluateIFDdatasizeReading(tif, dp))
7260
                    {
7261
                        if (data != 0)
7262
                            _TIFFfreeExt(tif, data);
7263
                        return 0;
7264
                    }
7265
                    int m;
7266
                    m = TIFFSetField(tif, dp->tdir_tag,
7267
                                     (uint16_t)(dp->tdir_count), data);
7268
                    if (data != 0)
7269
                        _TIFFfreeExt(tif, data);
7270
                    if (!m)
7271
                        return (0);
7272
                }
7273
            }
7274
        }
7275
        break;
7276
        case TIFF_SETGET_C32_ASCII:
7277
        {
7278
            uint8_t *data;
7279
            assert(fip->field_readcount == TIFF_VARIABLE2);
7280
            assert(fip->field_passcount == 1);
7281
            err = TIFFReadDirEntryByteArray(tif, dp, &data);
7282
            if (err == TIFFReadDirEntryErrOk)
7283
            {
7284
                if (!EvaluateIFDdatasizeReading(tif, dp))
7285
                {
7286
                    if (data != 0)
7287
                        _TIFFfreeExt(tif, data);
7288
                    return 0;
7289
                }
7290
                int m;
7291
                if (data != 0 && dp->tdir_count > 0 &&
7292
                    data[dp->tdir_count - 1] != '\0')
7293
                {
7294
                    TIFFWarningExtR(
7295
                        tif, module,
7296
                        "ASCII value for ASCII array tag \"%s\" does not end "
7297
                        "in null byte. Forcing it to be null",
7298
                        fip->field_name);
7299
                    /* Enlarge buffer and add terminating null. */
7300
                    uint8_t *o =
7301
                        _TIFFmallocExt(tif, (uint32_t)dp->tdir_count + 1);
7302
                    if (o == NULL)
7303
                    {
7304
                        if (data != NULL)
7305
                            _TIFFfreeExt(tif, data);
7306
                        return (0);
7307
                    }
7308
                    if (dp->tdir_count > 0)
7309
                    {
7310
                        _TIFFmemcpy(o, data, (uint32_t)dp->tdir_count);
7311
                    }
7312
                    o[(uint32_t)dp->tdir_count] = 0;
7313
                    dp->tdir_count++; /* Increment for added null. */
7314
                    if (data != 0)
7315
                        _TIFFfreeExt(tif, data);
7316
                    data = o;
7317
                }
7318
                m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
7319
                                 data);
7320
                if (data != 0)
7321
                    _TIFFfreeExt(tif, data);
7322
                if (!m)
7323
                    return (0);
7324
            }
7325
        }
7326
        break;
7327
        case TIFF_SETGET_C32_UINT8:
7328
        {
7329
            uint8_t *data;
7330
            uint32_t count = 0;
7331
            assert(fip->field_readcount == TIFF_VARIABLE2);
7332
            assert(fip->field_passcount == 1);
7333
            if (fip->field_tag == TIFFTAG_RICHTIFFIPTC &&
7334
                dp->tdir_type == TIFF_LONG)
7335
            {
7336
                /* Adobe's software (wrongly) writes RichTIFFIPTC tag with
7337
                 * data type LONG instead of UNDEFINED. Work around this
7338
                 * frequently found issue */
7339
                void *origdata;
7340
                err = TIFFReadDirEntryArray(tif, dp, &count, 4, &origdata);
7341
                if ((err != TIFFReadDirEntryErrOk) || (origdata == 0))
7342
                {
7343
                    data = NULL;
7344
                }
7345
                else
7346
                {
7347
                    if (tif->tif_flags & TIFF_SWAB)
7348
                        TIFFSwabArrayOfLong((uint32_t *)origdata, count);
7349
                    data = (uint8_t *)origdata;
7350
                    count = (uint32_t)(count * 4);
7351
                }
7352
            }
7353
            else
7354
            {
7355
                err = TIFFReadDirEntryByteArray(tif, dp, &data);
7356
                count = (uint32_t)(dp->tdir_count);
7357
            }
7358
            if (err == TIFFReadDirEntryErrOk)
7359
            {
7360
                if (!EvaluateIFDdatasizeReading(tif, dp))
7361
                {
7362
                    if (data != 0)
7363
                        _TIFFfreeExt(tif, data);
7364
                    return 0;
7365
                }
7366
                int m;
7367
                m = TIFFSetField(tif, dp->tdir_tag, count, data);
7368
                if (data != 0)
7369
                    _TIFFfreeExt(tif, data);
7370
                if (!m)
7371
                    return (0);
7372
            }
7373
        }
7374
        break;
7375
        case TIFF_SETGET_C32_SINT8:
7376
        {
7377
            int8_t *data = NULL;
7378
            assert(fip->field_readcount == TIFF_VARIABLE2);
7379
            assert(fip->field_passcount == 1);
7380
            err = TIFFReadDirEntrySbyteArray(tif, dp, &data);
7381
            if (err == TIFFReadDirEntryErrOk)
7382
            {
7383
                if (!EvaluateIFDdatasizeReading(tif, dp))
7384
                {
7385
                    if (data != 0)
7386
                        _TIFFfreeExt(tif, data);
7387
                    return 0;
7388
                }
7389
                int m;
7390
                m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
7391
                                 data);
7392
                if (data != 0)
7393
                    _TIFFfreeExt(tif, data);
7394
                if (!m)
7395
                    return (0);
7396
            }
7397
        }
7398
        break;
7399
        case TIFF_SETGET_C32_UINT16:
7400
        {
7401
            uint16_t *data;
7402
            assert(fip->field_readcount == TIFF_VARIABLE2);
7403
            assert(fip->field_passcount == 1);
7404
            err = TIFFReadDirEntryShortArray(tif, dp, &data);
7405
            if (err == TIFFReadDirEntryErrOk)
7406
            {
7407
                if (!EvaluateIFDdatasizeReading(tif, dp))
7408
                {
7409
                    if (data != 0)
7410
                        _TIFFfreeExt(tif, data);
7411
                    return 0;
7412
                }
7413
                int m;
7414
                m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
7415
                                 data);
7416
                if (data != 0)
7417
                    _TIFFfreeExt(tif, data);
7418
                if (!m)
7419
                    return (0);
7420
            }
7421
        }
7422
        break;
7423
        case TIFF_SETGET_C32_SINT16:
7424
        {
7425
            int16_t *data = NULL;
7426
            assert(fip->field_readcount == TIFF_VARIABLE2);
7427
            assert(fip->field_passcount == 1);
7428
            err = TIFFReadDirEntrySshortArray(tif, dp, &data);
7429
            if (err == TIFFReadDirEntryErrOk)
7430
            {
7431
                if (!EvaluateIFDdatasizeReading(tif, dp))
7432
                {
7433
                    if (data != 0)
7434
                        _TIFFfreeExt(tif, data);
7435
                    return 0;
7436
                }
7437
                int m;
7438
                m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
7439
                                 data);
7440
                if (data != 0)
7441
                    _TIFFfreeExt(tif, data);
7442
                if (!m)
7443
                    return (0);
7444
            }
7445
        }
7446
        break;
7447
        case TIFF_SETGET_C32_UINT32:
7448
        {
7449
            uint32_t *data;
7450
            assert(fip->field_readcount == TIFF_VARIABLE2);
7451
            assert(fip->field_passcount == 1);
7452
            err = TIFFReadDirEntryLongArray(tif, dp, &data);
7453
            if (err == TIFFReadDirEntryErrOk)
7454
            {
7455
                if (!EvaluateIFDdatasizeReading(tif, dp))
7456
                {
7457
                    if (data != 0)
7458
                        _TIFFfreeExt(tif, data);
7459
                    return 0;
7460
                }
7461
                int m;
7462
                m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
7463
                                 data);
7464
                if (data != 0)
7465
                    _TIFFfreeExt(tif, data);
7466
                if (!m)
7467
                    return (0);
7468
            }
7469
        }
7470
        break;
7471
        case TIFF_SETGET_C32_SINT32:
7472
        {
7473
            int32_t *data = NULL;
7474
            assert(fip->field_readcount == TIFF_VARIABLE2);
7475
            assert(fip->field_passcount == 1);
7476
            err = TIFFReadDirEntrySlongArray(tif, dp, &data);
7477
            if (err == TIFFReadDirEntryErrOk)
7478
            {
7479
                if (!EvaluateIFDdatasizeReading(tif, dp))
7480
                {
7481
                    if (data != 0)
7482
                        _TIFFfreeExt(tif, data);
7483
                    return 0;
7484
                }
7485
                int m;
7486
                m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
7487
                                 data);
7488
                if (data != 0)
7489
                    _TIFFfreeExt(tif, data);
7490
                if (!m)
7491
                    return (0);
7492
            }
7493
        }
7494
        break;
7495
        case TIFF_SETGET_C32_UINT64:
7496
        {
7497
            uint64_t *data;
7498
            assert(fip->field_readcount == TIFF_VARIABLE2);
7499
            assert(fip->field_passcount == 1);
7500
            err = TIFFReadDirEntryLong8Array(tif, dp, &data);
7501
            if (err == TIFFReadDirEntryErrOk)
7502
            {
7503
                if (!EvaluateIFDdatasizeReading(tif, dp))
7504
                {
7505
                    if (data != 0)
7506
                        _TIFFfreeExt(tif, data);
7507
                    return 0;
7508
                }
7509
                int m;
7510
                m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
7511
                                 data);
7512
                if (data != 0)
7513
                    _TIFFfreeExt(tif, data);
7514
                if (!m)
7515
                    return (0);
7516
            }
7517
        }
7518
        break;
7519
        case TIFF_SETGET_C32_SINT64:
7520
        {
7521
            int64_t *data = NULL;
7522
            assert(fip->field_readcount == TIFF_VARIABLE2);
7523
            assert(fip->field_passcount == 1);
7524
            err = TIFFReadDirEntrySlong8Array(tif, dp, &data);
7525
            if (err == TIFFReadDirEntryErrOk)
7526
            {
7527
                if (!EvaluateIFDdatasizeReading(tif, dp))
7528
                {
7529
                    if (data != 0)
7530
                        _TIFFfreeExt(tif, data);
7531
                    return 0;
7532
                }
7533
                int m;
7534
                m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
7535
                                 data);
7536
                if (data != 0)
7537
                    _TIFFfreeExt(tif, data);
7538
                if (!m)
7539
                    return (0);
7540
            }
7541
        }
7542
        break;
7543
        case TIFF_SETGET_C32_FLOAT:
7544
        {
7545
            float *data;
7546
            assert(fip->field_readcount == TIFF_VARIABLE2);
7547
            assert(fip->field_passcount == 1);
7548
            err = TIFFReadDirEntryFloatArray(tif, dp, &data);
7549
            if (err == TIFFReadDirEntryErrOk)
7550
            {
7551
                if (!EvaluateIFDdatasizeReading(tif, dp))
7552
                {
7553
                    if (data != 0)
7554
                        _TIFFfreeExt(tif, data);
7555
                    return 0;
7556
                }
7557
                int m;
7558
                m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
7559
                                 data);
7560
                if (data != 0)
7561
                    _TIFFfreeExt(tif, data);
7562
                if (!m)
7563
                    return (0);
7564
            }
7565
        }
7566
        break;
7567
        case TIFF_SETGET_C32_DOUBLE:
7568
        {
7569
            double *data;
7570
            assert(fip->field_readcount == TIFF_VARIABLE2);
7571
            assert(fip->field_passcount == 1);
7572
            err = TIFFReadDirEntryDoubleArray(tif, dp, &data);
7573
            if (err == TIFFReadDirEntryErrOk)
7574
            {
7575
                if (!EvaluateIFDdatasizeReading(tif, dp))
7576
                {
7577
                    if (data != 0)
7578
                        _TIFFfreeExt(tif, data);
7579
                    return 0;
7580
                }
7581
                int m;
7582
                m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
7583
                                 data);
7584
                if (data != 0)
7585
                    _TIFFfreeExt(tif, data);
7586
                if (!m)
7587
                    return (0);
7588
            }
7589
        }
7590
        break;
7591
        case TIFF_SETGET_C32_IFD8:
7592
        {
7593
            uint64_t *data;
7594
            assert(fip->field_readcount == TIFF_VARIABLE2);
7595
            assert(fip->field_passcount == 1);
7596
            err = TIFFReadDirEntryIfd8Array(tif, dp, &data);
7597
            if (err == TIFFReadDirEntryErrOk)
7598
            {
7599
                if (!EvaluateIFDdatasizeReading(tif, dp))
7600
                {
7601
                    if (data != 0)
7602
                        _TIFFfreeExt(tif, data);
7603
                    return 0;
7604
                }
7605
                int m;
7606
                m = TIFFSetField(tif, dp->tdir_tag, (uint32_t)(dp->tdir_count),
7607
                                 data);
7608
                if (data != 0)
7609
                    _TIFFfreeExt(tif, data);
7610
                if (!m)
7611
                    return (0);
7612
            }
7613
        }
7614
        break;
7615
        default:
7616
            assert(0); /* we should never get here */
7617
            break;
7618
    }
7619
    if (err != TIFFReadDirEntryErrOk)
7620
    {
7621
        TIFFReadDirEntryOutputErr(tif, err, module, fip->field_name, recover);
7622
        return (0);
7623
    }
7624
    return (1);
7625
}
7626

7627
/*
7628
 * Fetch a set of offsets or lengths.
7629
 * While this routine says "strips", in fact it's also used for tiles.
7630
 */
7631
static int TIFFFetchStripThing(TIFF *tif, TIFFDirEntry *dir, uint32_t nstrips,
7632
                               uint64_t **lpp)
7633
{
7634
    static const char module[] = "TIFFFetchStripThing";
7635
    enum TIFFReadDirEntryErr err;
7636
    uint64_t *data;
7637
    err = TIFFReadDirEntryLong8ArrayWithLimit(tif, dir, &data, nstrips);
7638
    if (err != TIFFReadDirEntryErrOk)
7639
    {
7640
        const TIFFField *fip = TIFFFieldWithTag(tif, dir->tdir_tag);
7641
        TIFFReadDirEntryOutputErr(tif, err, module,
7642
                                  fip ? fip->field_name : "unknown tagname", 0);
7643
        return (0);
7644
    }
7645
    if (dir->tdir_count < (uint64_t)nstrips)
7646
    {
7647
        uint64_t *resizeddata;
7648
        const TIFFField *fip = TIFFFieldWithTag(tif, dir->tdir_tag);
7649
        const char *pszMax = getenv("LIBTIFF_STRILE_ARRAY_MAX_RESIZE_COUNT");
7650
        uint32_t max_nstrips = 1000000;
7651
        if (pszMax)
7652
            max_nstrips = (uint32_t)atoi(pszMax);
7653
        TIFFReadDirEntryOutputErr(tif, TIFFReadDirEntryErrCount, module,
7654
                                  fip ? fip->field_name : "unknown tagname",
7655
                                  (nstrips <= max_nstrips));
7656

7657
        if (nstrips > max_nstrips)
7658
        {
7659
            _TIFFfreeExt(tif, data);
7660
            return (0);
7661
        }
7662

7663
        const uint64_t allocsize = (uint64_t)nstrips * sizeof(uint64_t);
7664
        if (allocsize > 100 * 1024 * 1024)
7665
        {
7666
            /* Before allocating a huge amount of memory for corrupted files,
7667
             * check if size of requested memory is not greater than file size.
7668
             */
7669
            const uint64_t filesize = TIFFGetFileSize(tif);
7670
            if (allocsize > filesize)
7671
            {
7672
                TIFFWarningExtR(
7673
                    tif, module,
7674
                    "Requested memory size for StripArray of %" PRIu64
7675
                    " is greater than filesize %" PRIu64
7676
                    ". Memory not allocated",
7677
                    allocsize, filesize);
7678
                _TIFFfreeExt(tif, data);
7679
                return (0);
7680
            }
7681
        }
7682
        resizeddata = (uint64_t *)_TIFFCheckMalloc(
7683
            tif, nstrips, sizeof(uint64_t), "for strip array");
7684
        if (resizeddata == 0)
7685
        {
7686
            _TIFFfreeExt(tif, data);
7687
            return (0);
7688
        }
7689
        if (dir->tdir_count)
7690
            _TIFFmemcpy(resizeddata, data,
7691
                        (uint32_t)dir->tdir_count * sizeof(uint64_t));
7692
        _TIFFmemset(resizeddata + (uint32_t)dir->tdir_count, 0,
7693
                    (nstrips - (uint32_t)dir->tdir_count) * sizeof(uint64_t));
7694
        _TIFFfreeExt(tif, data);
7695
        data = resizeddata;
7696
    }
7697
    *lpp = data;
7698
    return (1);
7699
}
7700

7701
/*
7702
 * Fetch and set the SubjectDistance EXIF tag.
7703
 */
7704
static int TIFFFetchSubjectDistance(TIFF *tif, TIFFDirEntry *dir)
7705
{
7706
    static const char module[] = "TIFFFetchSubjectDistance";
7707
    enum TIFFReadDirEntryErr err;
7708
    UInt64Aligned_t m;
7709
    m.l = 0;
7710
    assert(sizeof(double) == 8);
7711
    assert(sizeof(uint64_t) == 8);
7712
    assert(sizeof(uint32_t) == 4);
7713
    if (dir->tdir_count != 1)
7714
        err = TIFFReadDirEntryErrCount;
7715
    else if (dir->tdir_type != TIFF_RATIONAL)
7716
        err = TIFFReadDirEntryErrType;
7717
    else
7718
    {
7719
        if (!(tif->tif_flags & TIFF_BIGTIFF))
7720
        {
7721
            uint32_t offset;
7722
            offset = *(uint32_t *)(&dir->tdir_offset);
7723
            if (tif->tif_flags & TIFF_SWAB)
7724
                TIFFSwabLong(&offset);
7725
            err = TIFFReadDirEntryData(tif, offset, 8, m.i);
7726
        }
7727
        else
7728
        {
7729
            m.l = dir->tdir_offset.toff_long8;
7730
            err = TIFFReadDirEntryErrOk;
7731
        }
7732
    }
7733
    if (err == TIFFReadDirEntryErrOk)
7734
    {
7735
        double n;
7736
        if (tif->tif_flags & TIFF_SWAB)
7737
            TIFFSwabArrayOfLong(m.i, 2);
7738
        if (m.i[0] == 0)
7739
            n = 0.0;
7740
        else if (m.i[0] == 0xFFFFFFFF || m.i[1] == 0)
7741
            /*
7742
             * XXX: Numerator 0xFFFFFFFF means that we have infinite
7743
             * distance. Indicate that with a negative floating point
7744
             * SubjectDistance value.
7745
             */
7746
            n = -1.0;
7747
        else
7748
            n = (double)m.i[0] / (double)m.i[1];
7749
        return (TIFFSetField(tif, dir->tdir_tag, n));
7750
    }
7751
    else
7752
    {
7753
        TIFFReadDirEntryOutputErr(tif, err, module, "SubjectDistance", TRUE);
7754
        return (0);
7755
    }
7756
}
7757

7758
static void allocChoppedUpStripArrays(TIFF *tif, uint32_t nstrips,
7759
                                      uint64_t stripbytes,
7760
                                      uint32_t rowsperstrip)
7761
{
7762
    TIFFDirectory *td = &tif->tif_dir;
7763
    uint64_t bytecount;
7764
    uint64_t offset;
7765
    uint64_t last_offset;
7766
    uint64_t last_bytecount;
7767
    uint32_t i;
7768
    uint64_t *newcounts;
7769
    uint64_t *newoffsets;
7770

7771
    offset = TIFFGetStrileOffset(tif, 0);
7772
    last_offset = TIFFGetStrileOffset(tif, td->td_nstrips - 1);
7773
    last_bytecount = TIFFGetStrileByteCount(tif, td->td_nstrips - 1);
7774
    if (last_offset > UINT64_MAX - last_bytecount ||
7775
        last_offset + last_bytecount < offset)
7776
    {
7777
        return;
7778
    }
7779
    bytecount = last_offset + last_bytecount - offset;
7780

7781
    /* Before allocating a huge amount of memory for corrupted files, check if
7782
     * size of StripByteCount and StripOffset tags is not greater than
7783
     * file size.
7784
     */
7785
    const uint64_t allocsize = (uint64_t)nstrips * sizeof(uint64_t) * 2;
7786
    if (allocsize > 100 * 1024 * 1024)
7787
    {
7788
        const uint64_t filesize = TIFFGetFileSize(tif);
7789
        if (allocsize > filesize)
7790
        {
7791
            TIFFWarningExtR(tif, "allocChoppedUpStripArrays",
7792
                            "Requested memory size for StripByteCount and "
7793
                            "StripOffsets %" PRIu64
7794
                            " is greater than filesize %" PRIu64
7795
                            ". Memory not allocated",
7796
                            allocsize, filesize);
7797
            return;
7798
        }
7799
    }
7800

7801
    newcounts =
7802
        (uint64_t *)_TIFFCheckMalloc(tif, nstrips, sizeof(uint64_t),
7803
                                     "for chopped \"StripByteCounts\" array");
7804
    newoffsets = (uint64_t *)_TIFFCheckMalloc(
7805
        tif, nstrips, sizeof(uint64_t), "for chopped \"StripOffsets\" array");
7806
    if (newcounts == NULL || newoffsets == NULL)
7807
    {
7808
        /*
7809
         * Unable to allocate new strip information, give up and use
7810
         * the original one strip information.
7811
         */
7812
        if (newcounts != NULL)
7813
            _TIFFfreeExt(tif, newcounts);
7814
        if (newoffsets != NULL)
7815
            _TIFFfreeExt(tif, newoffsets);
7816
        return;
7817
    }
7818

7819
    /*
7820
     * Fill the strip information arrays with new bytecounts and offsets
7821
     * that reflect the broken-up format.
7822
     */
7823
    for (i = 0; i < nstrips; i++)
7824
    {
7825
        if (stripbytes > bytecount)
7826
            stripbytes = bytecount;
7827
        newcounts[i] = stripbytes;
7828
        newoffsets[i] = stripbytes ? offset : 0;
7829
        offset += stripbytes;
7830
        bytecount -= stripbytes;
7831
    }
7832

7833
    /*
7834
     * Replace old single strip info with multi-strip info.
7835
     */
7836
    td->td_stripsperimage = td->td_nstrips = nstrips;
7837
    TIFFSetField(tif, TIFFTAG_ROWSPERSTRIP, rowsperstrip);
7838

7839
    _TIFFfreeExt(tif, td->td_stripbytecount_p);
7840
    _TIFFfreeExt(tif, td->td_stripoffset_p);
7841
    td->td_stripbytecount_p = newcounts;
7842
    td->td_stripoffset_p = newoffsets;
7843
#ifdef STRIPBYTECOUNTSORTED_UNUSED
7844
    td->td_stripbytecountsorted = 1;
7845
#endif
7846
    tif->tif_flags |= TIFF_CHOPPEDUPARRAYS;
7847
}
7848

7849
/*
7850
 * Replace a single strip (tile) of uncompressed data by multiple strips
7851
 * (tiles), each approximately STRIP_SIZE_DEFAULT bytes. This is useful for
7852
 * dealing with large images or for dealing with machines with a limited
7853
 * amount memory.
7854
 */
7855
static void ChopUpSingleUncompressedStrip(TIFF *tif)
7856
{
7857
    register TIFFDirectory *td = &tif->tif_dir;
7858
    uint64_t bytecount;
7859
    uint64_t offset;
7860
    uint32_t rowblock;
7861
    uint64_t rowblockbytes;
7862
    uint64_t stripbytes;
7863
    uint32_t nstrips;
7864
    uint32_t rowsperstrip;
7865

7866
    bytecount = TIFFGetStrileByteCount(tif, 0);
7867
    /* On a newly created file, just re-opened to be filled, we */
7868
    /* don't want strip chop to trigger as it is going to cause issues */
7869
    /* later ( StripOffsets and StripByteCounts improperly filled) . */
7870
    if (bytecount == 0 && tif->tif_mode != O_RDONLY)
7871
        return;
7872
    offset = TIFFGetStrileByteCount(tif, 0);
7873
    assert(td->td_planarconfig == PLANARCONFIG_CONTIG);
7874
    if ((td->td_photometric == PHOTOMETRIC_YCBCR) && (!isUpSampled(tif)))
7875
        rowblock = td->td_ycbcrsubsampling[1];
7876
    else
7877
        rowblock = 1;
7878
    rowblockbytes = TIFFVTileSize64(tif, rowblock);
7879
    /*
7880
     * Make the rows hold at least one scanline, but fill specified amount
7881
     * of data if possible.
7882
     */
7883
    if (rowblockbytes > STRIP_SIZE_DEFAULT)
7884
    {
7885
        stripbytes = rowblockbytes;
7886
        rowsperstrip = rowblock;
7887
    }
7888
    else if (rowblockbytes > 0)
7889
    {
7890
        uint32_t rowblocksperstrip;
7891
        rowblocksperstrip = (uint32_t)(STRIP_SIZE_DEFAULT / rowblockbytes);
7892
        rowsperstrip = rowblocksperstrip * rowblock;
7893
        stripbytes = rowblocksperstrip * rowblockbytes;
7894
    }
7895
    else
7896
        return;
7897

7898
    /*
7899
     * never increase the number of rows per strip
7900
     */
7901
    if (rowsperstrip >= td->td_rowsperstrip || rowsperstrip == 0)
7902
        return;
7903
    nstrips = TIFFhowmany_32(td->td_imagelength, rowsperstrip);
7904
    if (nstrips == 0)
7905
        return;
7906

7907
    /* If we are going to allocate a lot of memory, make sure that the */
7908
    /* file is as big as needed */
7909
    if (tif->tif_mode == O_RDONLY && nstrips > 1000000 &&
7910
        (offset >= TIFFGetFileSize(tif) ||
7911
         stripbytes > (TIFFGetFileSize(tif) - offset) / (nstrips - 1)))
7912
    {
7913
        return;
7914
    }
7915

7916
    allocChoppedUpStripArrays(tif, nstrips, stripbytes, rowsperstrip);
7917
}
7918

7919
/*
7920
 * Replace a file with contiguous strips > 2 GB of uncompressed data by
7921
 * multiple smaller strips. This is useful for
7922
 * dealing with large images or for dealing with machines with a limited
7923
 * amount memory.
7924
 */
7925
static void TryChopUpUncompressedBigTiff(TIFF *tif)
7926
{
7927
    TIFFDirectory *td = &tif->tif_dir;
7928
    uint32_t rowblock;
7929
    uint64_t rowblockbytes;
7930
    uint32_t i;
7931
    uint64_t stripsize;
7932
    uint32_t rowblocksperstrip;
7933
    uint32_t rowsperstrip;
7934
    uint64_t stripbytes;
7935
    uint32_t nstrips;
7936

7937
    stripsize = TIFFStripSize64(tif);
7938

7939
    assert(tif->tif_dir.td_planarconfig == PLANARCONFIG_CONTIG);
7940
    assert(tif->tif_dir.td_compression == COMPRESSION_NONE);
7941
    assert((tif->tif_flags & (TIFF_STRIPCHOP | TIFF_ISTILED)) ==
7942
           TIFF_STRIPCHOP);
7943
    assert(stripsize > 0x7FFFFFFFUL);
7944

7945
    /* On a newly created file, just re-opened to be filled, we */
7946
    /* don't want strip chop to trigger as it is going to cause issues */
7947
    /* later ( StripOffsets and StripByteCounts improperly filled) . */
7948
    if (TIFFGetStrileByteCount(tif, 0) == 0 && tif->tif_mode != O_RDONLY)
7949
        return;
7950

7951
    if ((td->td_photometric == PHOTOMETRIC_YCBCR) && (!isUpSampled(tif)))
7952
        rowblock = td->td_ycbcrsubsampling[1];
7953
    else
7954
        rowblock = 1;
7955
    rowblockbytes = TIFFVStripSize64(tif, rowblock);
7956
    if (rowblockbytes == 0 || rowblockbytes > 0x7FFFFFFFUL)
7957
    {
7958
        /* In case of file with gigantic width */
7959
        return;
7960
    }
7961

7962
    /* Check that the strips are contiguous and of the expected size */
7963
    for (i = 0; i < td->td_nstrips; i++)
7964
    {
7965
        if (i == td->td_nstrips - 1)
7966
        {
7967
            if (TIFFGetStrileByteCount(tif, i) <
7968
                TIFFVStripSize64(tif,
7969
                                 td->td_imagelength - i * td->td_rowsperstrip))
7970
            {
7971
                return;
7972
            }
7973
        }
7974
        else
7975
        {
7976
            if (TIFFGetStrileByteCount(tif, i) != stripsize)
7977
            {
7978
                return;
7979
            }
7980
            if (i > 0 && TIFFGetStrileOffset(tif, i) !=
7981
                             TIFFGetStrileOffset(tif, i - 1) +
7982
                                 TIFFGetStrileByteCount(tif, i - 1))
7983
            {
7984
                return;
7985
            }
7986
        }
7987
    }
7988

7989
    /* Aim for 512 MB strips (that will still be manageable by 32 bit builds */
7990
    rowblocksperstrip = (uint32_t)(512 * 1024 * 1024 / rowblockbytes);
7991
    if (rowblocksperstrip == 0)
7992
        rowblocksperstrip = 1;
7993
    rowsperstrip = rowblocksperstrip * rowblock;
7994
    stripbytes = rowblocksperstrip * rowblockbytes;
7995
    assert(stripbytes <= 0x7FFFFFFFUL);
7996

7997
    if (rowsperstrip == 0)
7998
        return;
7999
    nstrips = TIFFhowmany_32(td->td_imagelength, rowsperstrip);
8000
    if (nstrips == 0)
8001
        return;
8002

8003
    /* If we are going to allocate a lot of memory, make sure that the */
8004
    /* file is as big as needed */
8005
    if (tif->tif_mode == O_RDONLY && nstrips > 1000000)
8006
    {
8007
        uint64_t last_offset = TIFFGetStrileOffset(tif, td->td_nstrips - 1);
8008
        uint64_t filesize = TIFFGetFileSize(tif);
8009
        uint64_t last_bytecount =
8010
            TIFFGetStrileByteCount(tif, td->td_nstrips - 1);
8011
        if (last_offset > filesize || last_bytecount > filesize - last_offset)
8012
        {
8013
            return;
8014
        }
8015
    }
8016

8017
    allocChoppedUpStripArrays(tif, nstrips, stripbytes, rowsperstrip);
8018
}
8019

8020
TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
8021
static uint64_t _TIFFUnsanitizedAddUInt64AndInt(uint64_t a, int b)
8022
{
8023
    return a + b;
8024
}
8025

8026
/* Read the value of [Strip|Tile]Offset or [Strip|Tile]ByteCount around
8027
 * strip/tile of number strile. Also fetch the neighbouring values using a
8028
 * 4096 byte page size.
8029
 */
8030
static int _TIFFPartialReadStripArray(TIFF *tif, TIFFDirEntry *dirent,
8031
                                      int strile, uint64_t *panVals)
8032
{
8033
    static const char module[] = "_TIFFPartialReadStripArray";
8034
#define IO_CACHE_PAGE_SIZE 4096
8035

8036
    size_t sizeofval;
8037
    const int bSwab = (tif->tif_flags & TIFF_SWAB) != 0;
8038
    int sizeofvalint;
8039
    uint64_t nBaseOffset;
8040
    uint64_t nOffset;
8041
    uint64_t nOffsetStartPage;
8042
    uint64_t nOffsetEndPage;
8043
    tmsize_t nToRead;
8044
    tmsize_t nRead;
8045
    uint64_t nLastStripOffset;
8046
    int iStartBefore;
8047
    int i;
8048
    const uint32_t arraySize = tif->tif_dir.td_stripoffsetbyteallocsize;
8049
    unsigned char buffer[2 * IO_CACHE_PAGE_SIZE];
8050

8051
    assert(dirent->tdir_count > 4);
8052

8053
    if (dirent->tdir_type == TIFF_SHORT)
8054
    {
8055
        sizeofval = sizeof(uint16_t);
8056
    }
8057
    else if (dirent->tdir_type == TIFF_LONG)
8058
    {
8059
        sizeofval = sizeof(uint32_t);
8060
    }
8061
    else if (dirent->tdir_type == TIFF_LONG8)
8062
    {
8063
        sizeofval = sizeof(uint64_t);
8064
    }
8065
    else if (dirent->tdir_type == TIFF_SLONG8)
8066
    {
8067
        /* Non conformant but used by some images as in */
8068
        /* https://github.com/OSGeo/gdal/issues/2165 */
8069
        sizeofval = sizeof(int64_t);
8070
    }
8071
    else
8072
    {
8073
        TIFFErrorExtR(tif, module,
8074
                      "Invalid type for [Strip|Tile][Offset/ByteCount] tag");
8075
        panVals[strile] = 0;
8076
        return 0;
8077
    }
8078
    sizeofvalint = (int)(sizeofval);
8079

8080
    if (tif->tif_flags & TIFF_BIGTIFF)
8081
    {
8082
        uint64_t offset = dirent->tdir_offset.toff_long8;
8083
        if (bSwab)
8084
            TIFFSwabLong8(&offset);
8085
        nBaseOffset = offset;
8086
    }
8087
    else
8088
    {
8089
        uint32_t offset = dirent->tdir_offset.toff_long;
8090
        if (bSwab)
8091
            TIFFSwabLong(&offset);
8092
        nBaseOffset = offset;
8093
    }
8094
    /* To avoid later unsigned integer overflows */
8095
    if (nBaseOffset > (uint64_t)INT64_MAX)
8096
    {
8097
        TIFFErrorExtR(tif, module, "Cannot read offset/size for strile %d",
8098
                      strile);
8099
        panVals[strile] = 0;
8100
        return 0;
8101
    }
8102
    nOffset = nBaseOffset + sizeofval * strile;
8103
    nOffsetStartPage = (nOffset / IO_CACHE_PAGE_SIZE) * IO_CACHE_PAGE_SIZE;
8104
    nOffsetEndPage = nOffsetStartPage + IO_CACHE_PAGE_SIZE;
8105

8106
    if (nOffset + sizeofval > nOffsetEndPage)
8107
        nOffsetEndPage += IO_CACHE_PAGE_SIZE;
8108
#undef IO_CACHE_PAGE_SIZE
8109

8110
    nLastStripOffset = nBaseOffset + arraySize * sizeofval;
8111
    if (nLastStripOffset < nOffsetEndPage)
8112
        nOffsetEndPage = nLastStripOffset;
8113
    if (nOffsetStartPage >= nOffsetEndPage)
8114
    {
8115
        TIFFErrorExtR(tif, module, "Cannot read offset/size for strile %d",
8116
                      strile);
8117
        panVals[strile] = 0;
8118
        return 0;
8119
    }
8120
    if (!SeekOK(tif, nOffsetStartPage))
8121
    {
8122
        panVals[strile] = 0;
8123
        return 0;
8124
    }
8125

8126
    nToRead = (tmsize_t)(nOffsetEndPage - nOffsetStartPage);
8127
    nRead = TIFFReadFile(tif, buffer, nToRead);
8128
    if (nRead < nToRead)
8129
    {
8130
        TIFFErrorExtR(tif, module,
8131
                      "Cannot read offset/size for strile around ~%d", strile);
8132
        return 0;
8133
    }
8134
    iStartBefore = -(int)((nOffset - nOffsetStartPage) / sizeofval);
8135
    if (strile + iStartBefore < 0)
8136
        iStartBefore = -strile;
8137
    for (i = iStartBefore;
8138
         (uint32_t)(strile + i) < arraySize &&
8139
         _TIFFUnsanitizedAddUInt64AndInt(nOffset, (i + 1) * sizeofvalint) <=
8140
             nOffsetEndPage;
8141
         ++i)
8142
    {
8143
        if (dirent->tdir_type == TIFF_SHORT)
8144
        {
8145
            uint16_t val;
8146
            memcpy(&val,
8147
                   buffer + (nOffset - nOffsetStartPage) + i * sizeofvalint,
8148
                   sizeof(val));
8149
            if (bSwab)
8150
                TIFFSwabShort(&val);
8151
            panVals[strile + i] = val;
8152
        }
8153
        else if (dirent->tdir_type == TIFF_LONG)
8154
        {
8155
            uint32_t val;
8156
            memcpy(&val,
8157
                   buffer + (nOffset - nOffsetStartPage) + i * sizeofvalint,
8158
                   sizeof(val));
8159
            if (bSwab)
8160
                TIFFSwabLong(&val);
8161
            panVals[strile + i] = val;
8162
        }
8163
        else if (dirent->tdir_type == TIFF_LONG8)
8164
        {
8165
            uint64_t val;
8166
            memcpy(&val,
8167
                   buffer + (nOffset - nOffsetStartPage) + i * sizeofvalint,
8168
                   sizeof(val));
8169
            if (bSwab)
8170
                TIFFSwabLong8(&val);
8171
            panVals[strile + i] = val;
8172
        }
8173
        else /* if( dirent->tdir_type == TIFF_SLONG8 ) */
8174
        {
8175
            /* Non conformant data type */
8176
            int64_t val;
8177
            memcpy(&val,
8178
                   buffer + (nOffset - nOffsetStartPage) + i * sizeofvalint,
8179
                   sizeof(val));
8180
            if (bSwab)
8181
                TIFFSwabLong8((uint64_t *)&val);
8182
            panVals[strile + i] = (uint64_t)val;
8183
        }
8184
    }
8185
    return 1;
8186
}
8187

8188
static int _TIFFFetchStrileValue(TIFF *tif, uint32_t strile,
8189
                                 TIFFDirEntry *dirent, uint64_t **parray)
8190
{
8191
    static const char module[] = "_TIFFFetchStrileValue";
8192
    TIFFDirectory *td = &tif->tif_dir;
8193
    if (strile >= dirent->tdir_count)
8194
    {
8195
        return 0;
8196
    }
8197
    if (strile >= td->td_stripoffsetbyteallocsize)
8198
    {
8199
        uint32_t nStripArrayAllocBefore = td->td_stripoffsetbyteallocsize;
8200
        uint32_t nStripArrayAllocNew;
8201
        uint64_t nArraySize64;
8202
        size_t nArraySize;
8203
        uint64_t *offsetArray;
8204
        uint64_t *bytecountArray;
8205

8206
        if (strile > 1000000)
8207
        {
8208
            uint64_t filesize = TIFFGetFileSize(tif);
8209
            /* Avoid excessive memory allocation attempt */
8210
            /* For such a big blockid we need at least a TIFF_LONG per strile */
8211
            /* for the offset array. */
8212
            if (strile > filesize / sizeof(uint32_t))
8213
            {
8214
                TIFFErrorExtR(tif, module, "File too short");
8215
                return 0;
8216
            }
8217
        }
8218

8219
        if (td->td_stripoffsetbyteallocsize == 0 &&
8220
            td->td_nstrips < 1024 * 1024)
8221
        {
8222
            nStripArrayAllocNew = td->td_nstrips;
8223
        }
8224
        else
8225
        {
8226
#define TIFF_MAX(a, b) (((a) > (b)) ? (a) : (b))
8227
#define TIFF_MIN(a, b) (((a) < (b)) ? (a) : (b))
8228
            nStripArrayAllocNew = TIFF_MAX(strile + 1, 1024U * 512U);
8229
            if (nStripArrayAllocNew < 0xFFFFFFFFU / 2)
8230
                nStripArrayAllocNew *= 2;
8231
            nStripArrayAllocNew = TIFF_MIN(nStripArrayAllocNew, td->td_nstrips);
8232
        }
8233
        assert(strile < nStripArrayAllocNew);
8234
        nArraySize64 = (uint64_t)sizeof(uint64_t) * nStripArrayAllocNew;
8235
        nArraySize = (size_t)(nArraySize64);
8236
#if SIZEOF_SIZE_T == 4
8237
        if (nArraySize != nArraySize64)
8238
        {
8239
            TIFFErrorExtR(tif, module,
8240
                          "Cannot allocate strip offset and bytecount arrays");
8241
            return 0;
8242
        }
8243
#endif
8244
        offsetArray = (uint64_t *)(_TIFFreallocExt(tif, td->td_stripoffset_p,
8245
                                                   nArraySize));
8246
        bytecountArray = (uint64_t *)(_TIFFreallocExt(
8247
            tif, td->td_stripbytecount_p, nArraySize));
8248
        if (offsetArray)
8249
            td->td_stripoffset_p = offsetArray;
8250
        if (bytecountArray)
8251
            td->td_stripbytecount_p = bytecountArray;
8252
        if (offsetArray && bytecountArray)
8253
        {
8254
            td->td_stripoffsetbyteallocsize = nStripArrayAllocNew;
8255
            /* Initialize new entries to ~0 / -1 */
8256
            /* coverity[overrun-buffer-arg] */
8257
            memset(td->td_stripoffset_p + nStripArrayAllocBefore, 0xFF,
8258
                   (td->td_stripoffsetbyteallocsize - nStripArrayAllocBefore) *
8259
                       sizeof(uint64_t));
8260
            /* coverity[overrun-buffer-arg] */
8261
            memset(td->td_stripbytecount_p + nStripArrayAllocBefore, 0xFF,
8262
                   (td->td_stripoffsetbyteallocsize - nStripArrayAllocBefore) *
8263
                       sizeof(uint64_t));
8264
        }
8265
        else
8266
        {
8267
            TIFFErrorExtR(tif, module,
8268
                          "Cannot allocate strip offset and bytecount arrays");
8269
            _TIFFfreeExt(tif, td->td_stripoffset_p);
8270
            td->td_stripoffset_p = NULL;
8271
            _TIFFfreeExt(tif, td->td_stripbytecount_p);
8272
            td->td_stripbytecount_p = NULL;
8273
            td->td_stripoffsetbyteallocsize = 0;
8274
        }
8275
    }
8276
    if (*parray == NULL || strile >= td->td_stripoffsetbyteallocsize)
8277
        return 0;
8278

8279
    if (~((*parray)[strile]) == 0)
8280
    {
8281
        if (!_TIFFPartialReadStripArray(tif, dirent, strile, *parray))
8282
        {
8283
            (*parray)[strile] = 0;
8284
            return 0;
8285
        }
8286
    }
8287

8288
    return 1;
8289
}
8290

8291
static uint64_t _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32_t strile,
8292
                                                     TIFFDirEntry *dirent,
8293
                                                     uint64_t **parray,
8294
                                                     int *pbErr)
8295
{
8296
    TIFFDirectory *td = &tif->tif_dir;
8297
    if (pbErr)
8298
        *pbErr = 0;
8299
    if ((tif->tif_flags & TIFF_DEFERSTRILELOAD) &&
8300
        !(tif->tif_flags & TIFF_CHOPPEDUPARRAYS))
8301
    {
8302
        if (!(tif->tif_flags & TIFF_LAZYSTRILELOAD) ||
8303
            /* If the values may fit in the toff_long/toff_long8 member */
8304
            /* then use _TIFFFillStriles to simplify _TIFFFetchStrileValue */
8305
            dirent->tdir_count <= 4)
8306
        {
8307
            if (!_TIFFFillStriles(tif))
8308
            {
8309
                if (pbErr)
8310
                    *pbErr = 1;
8311
                /* Do not return, as we want this function to always */
8312
                /* return the same value if called several times with */
8313
                /* the same arguments */
8314
            }
8315
        }
8316
        else
8317
        {
8318
            if (!_TIFFFetchStrileValue(tif, strile, dirent, parray))
8319
            {
8320
                if (pbErr)
8321
                    *pbErr = 1;
8322
                return 0;
8323
            }
8324
        }
8325
    }
8326
    if (*parray == NULL || strile >= td->td_nstrips)
8327
    {
8328
        if (pbErr)
8329
            *pbErr = 1;
8330
        return 0;
8331
    }
8332
    return (*parray)[strile];
8333
}
8334

8335
/* Return the value of the TileOffsets/StripOffsets array for the specified
8336
 * tile/strile */
8337
uint64_t TIFFGetStrileOffset(TIFF *tif, uint32_t strile)
8338
{
8339
    return TIFFGetStrileOffsetWithErr(tif, strile, NULL);
8340
}
8341

8342
/* Return the value of the TileOffsets/StripOffsets array for the specified
8343
 * tile/strile */
8344
uint64_t TIFFGetStrileOffsetWithErr(TIFF *tif, uint32_t strile, int *pbErr)
8345
{
8346
    TIFFDirectory *td = &tif->tif_dir;
8347
    return _TIFFGetStrileOffsetOrByteCountValue(tif, strile,
8348
                                                &(td->td_stripoffset_entry),
8349
                                                &(td->td_stripoffset_p), pbErr);
8350
}
8351

8352
/* Return the value of the TileByteCounts/StripByteCounts array for the
8353
 * specified tile/strile */
8354
uint64_t TIFFGetStrileByteCount(TIFF *tif, uint32_t strile)
8355
{
8356
    return TIFFGetStrileByteCountWithErr(tif, strile, NULL);
8357
}
8358

8359
/* Return the value of the TileByteCounts/StripByteCounts array for the
8360
 * specified tile/strile */
8361
uint64_t TIFFGetStrileByteCountWithErr(TIFF *tif, uint32_t strile, int *pbErr)
8362
{
8363
    TIFFDirectory *td = &tif->tif_dir;
8364
    return _TIFFGetStrileOffsetOrByteCountValue(
8365
        tif, strile, &(td->td_stripbytecount_entry), &(td->td_stripbytecount_p),
8366
        pbErr);
8367
}
8368

8369
int _TIFFFillStriles(TIFF *tif) { return _TIFFFillStrilesInternal(tif, 1); }
8370

8371
static int _TIFFFillStrilesInternal(TIFF *tif, int loadStripByteCount)
8372
{
8373
    register TIFFDirectory *td = &tif->tif_dir;
8374
    int return_value = 1;
8375

8376
    /* Do not do anything if TIFF_DEFERSTRILELOAD is not set */
8377
    if (!(tif->tif_flags & TIFF_DEFERSTRILELOAD) ||
8378
        (tif->tif_flags & TIFF_CHOPPEDUPARRAYS) != 0)
8379
        return 1;
8380

8381
    if (tif->tif_flags & TIFF_LAZYSTRILELOAD)
8382
    {
8383
        /* In case of lazy loading, reload completely the arrays */
8384
        _TIFFfreeExt(tif, td->td_stripoffset_p);
8385
        _TIFFfreeExt(tif, td->td_stripbytecount_p);
8386
        td->td_stripoffset_p = NULL;
8387
        td->td_stripbytecount_p = NULL;
8388
        td->td_stripoffsetbyteallocsize = 0;
8389
        tif->tif_flags &= ~TIFF_LAZYSTRILELOAD;
8390
    }
8391

8392
    /* If stripoffset array is already loaded, exit with success */
8393
    if (td->td_stripoffset_p != NULL)
8394
        return 1;
8395

8396
    /* If tdir_count was canceled, then we already got there, but in error */
8397
    if (td->td_stripoffset_entry.tdir_count == 0)
8398
        return 0;
8399

8400
    if (!TIFFFetchStripThing(tif, &(td->td_stripoffset_entry), td->td_nstrips,
8401
                             &td->td_stripoffset_p))
8402
    {
8403
        return_value = 0;
8404
    }
8405

8406
    if (loadStripByteCount &&
8407
        !TIFFFetchStripThing(tif, &(td->td_stripbytecount_entry),
8408
                             td->td_nstrips, &td->td_stripbytecount_p))
8409
    {
8410
        return_value = 0;
8411
    }
8412

8413
    _TIFFmemset(&(td->td_stripoffset_entry), 0, sizeof(TIFFDirEntry));
8414
    _TIFFmemset(&(td->td_stripbytecount_entry), 0, sizeof(TIFFDirEntry));
8415

8416
#ifdef STRIPBYTECOUNTSORTED_UNUSED
8417
    if (tif->tif_dir.td_nstrips > 1 && return_value == 1)
8418
    {
8419
        uint32_t strip;
8420

8421
        tif->tif_dir.td_stripbytecountsorted = 1;
8422
        for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++)
8423
        {
8424
            if (tif->tif_dir.td_stripoffset_p[strip - 1] >
8425
                tif->tif_dir.td_stripoffset_p[strip])
8426
            {
8427
                tif->tif_dir.td_stripbytecountsorted = 0;
8428
                break;
8429
            }
8430
        }
8431
    }
8432
#endif
8433

8434
    return return_value;
8435
}
8436

8437
Product

Resources

Company
