| /* |
| * Copyright (c) 1988-1997 Sam Leffler |
| * Copyright (c) 1991-1997 Silicon Graphics, Inc. |
| * |
| * Permission to use, copy, modify, distribute, and sell this software and |
| * its documentation for any purpose is hereby granted without fee, provided |
| * that (i) the above copyright notices and this permission notice appear in |
| * all copies of the software and related documentation, and (ii) the names of |
| * Sam Leffler and Silicon Graphics may not be used in any advertising or |
| * publicity relating to the software without the specific, prior written |
| * permission of Sam Leffler and Silicon Graphics. |
| * |
| * THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND, |
| * EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY |
| * WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. |
| * |
| * IN NO EVENT SHALL SAM LEFFLER OR SILICON GRAPHICS BE LIABLE FOR |
| * ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND, |
| * OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, |
| * WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF |
| * LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE |
| * OF THIS SOFTWARE. |
| */ |
| |
| /* |
| * TIFF Library. |
| * Scanline-oriented Read Support |
| */ |
| #include "tiffiop.h" |
| #include <stdio.h> |
| |
| int TIFFFillStrip(TIFF *tif, uint32_t strip); |
| int TIFFFillTile(TIFF *tif, uint32_t tile); |
| static int TIFFStartStrip(TIFF *tif, uint32_t strip); |
| static int TIFFStartTile(TIFF *tif, uint32_t tile); |
| static int TIFFCheckRead(TIFF *, int); |
| static tmsize_t TIFFReadRawStrip1(TIFF *tif, uint32_t strip, void *buf, |
| tmsize_t size, const char *module); |
| static tmsize_t TIFFReadRawTile1(TIFF *tif, uint32_t tile, void *buf, |
| tmsize_t size, const char *module); |
| |
| #define NOSTRIP ((uint32_t)(-1)) /* undefined state */ |
| #define NOTILE ((uint32_t)(-1)) /* undefined state */ |
| |
| #define INITIAL_THRESHOLD (1024 * 1024) |
| #define THRESHOLD_MULTIPLIER 10 |
| #define MAX_THRESHOLD \ |
| (THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER * \ |
| INITIAL_THRESHOLD) |
| |
| #define TIFF_INT64_MAX ((((int64_t)0x7FFFFFFF) << 32) | 0xFFFFFFFF) |
| |
| /* Read 'size' bytes in tif_rawdata buffer starting at offset 'rawdata_offset' |
| * Returns 1 in case of success, 0 otherwise. */ |
| static int TIFFReadAndRealloc(TIFF *tif, tmsize_t size, tmsize_t rawdata_offset, |
| int is_strip, uint32_t strip_or_tile, |
| const char *module) |
| { |
| #if SIZEOF_SIZE_T == 8 |
| tmsize_t threshold = INITIAL_THRESHOLD; |
| #endif |
| tmsize_t already_read = 0; |
| |
| #if SIZEOF_SIZE_T != 8 |
| /* On 32 bit processes, if the request is large enough, check against */ |
| /* file size */ |
| if (size > 1000 * 1000 * 1000) |
| { |
| uint64_t filesize = TIFFGetFileSize(tif); |
| if ((uint64_t)size >= filesize) |
| { |
| TIFFErrorExtR(tif, module, |
| "Chunk size requested is larger than file size."); |
| return 0; |
| } |
| } |
| #endif |
| |
| /* On 64 bit processes, read first a maximum of 1 MB, then 10 MB, etc */ |
| /* so as to avoid allocating too much memory in case the file is too */ |
| /* short. We could ask for the file size, but this might be */ |
| /* expensive with some I/O layers (think of reading a gzipped file) */ |
| /* Restrict to 64 bit processes, so as to avoid reallocs() */ |
| /* on 32 bit processes where virtual memory is scarce. */ |
| while (already_read < size) |
| { |
| tmsize_t bytes_read; |
| tmsize_t to_read = size - already_read; |
| #if SIZEOF_SIZE_T == 8 |
| if (to_read >= threshold && threshold < MAX_THRESHOLD && |
| already_read + to_read + rawdata_offset > tif->tif_rawdatasize) |
| { |
| to_read = threshold; |
| threshold *= THRESHOLD_MULTIPLIER; |
| } |
| #endif |
| if (already_read + to_read + rawdata_offset > tif->tif_rawdatasize) |
| { |
| uint8_t *new_rawdata; |
| assert((tif->tif_flags & TIFF_MYBUFFER) != 0); |
| tif->tif_rawdatasize = (tmsize_t)TIFFroundup_64( |
| (uint64_t)already_read + to_read + rawdata_offset, 1024); |
| if (tif->tif_rawdatasize == 0) |
| { |
| TIFFErrorExtR(tif, module, "Invalid buffer size"); |
| return 0; |
| } |
| new_rawdata = |
| (uint8_t *)_TIFFrealloc(tif->tif_rawdata, tif->tif_rawdatasize); |
| if (new_rawdata == 0) |
| { |
| TIFFErrorExtR(tif, module, |
| "No space for data buffer at scanline %" PRIu32, |
| tif->tif_row); |
| _TIFFfreeExt(tif, tif->tif_rawdata); |
| tif->tif_rawdata = 0; |
| tif->tif_rawdatasize = 0; |
| return 0; |
| } |
| tif->tif_rawdata = new_rawdata; |
| } |
| if (tif->tif_rawdata == NULL) |
| { |
| /* should not happen in practice but helps CoverityScan */ |
| return 0; |
| } |
| |
| bytes_read = TIFFReadFile( |
| tif, tif->tif_rawdata + rawdata_offset + already_read, to_read); |
| already_read += bytes_read; |
| if (bytes_read != to_read) |
| { |
| memset(tif->tif_rawdata + rawdata_offset + already_read, 0, |
| tif->tif_rawdatasize - rawdata_offset - already_read); |
| if (is_strip) |
| { |
| TIFFErrorExtR(tif, module, |
| "Read error at scanline %" PRIu32 |
| "; got %" TIFF_SSIZE_FORMAT " bytes, " |
| "expected %" TIFF_SSIZE_FORMAT, |
| tif->tif_row, already_read, size); |
| } |
| else |
| { |
| TIFFErrorExtR(tif, module, |
| "Read error at row %" PRIu32 ", col %" PRIu32 |
| ", tile %" PRIu32 "; " |
| "got %" TIFF_SSIZE_FORMAT |
| " bytes, expected %" TIFF_SSIZE_FORMAT "", |
| tif->tif_row, tif->tif_col, strip_or_tile, |
| already_read, size); |
| } |
| return 0; |
| } |
| } |
| return 1; |
| } |
| |
| static int TIFFFillStripPartial(TIFF *tif, int strip, tmsize_t read_ahead, |
| int restart) |
| { |
| static const char module[] = "TIFFFillStripPartial"; |
| register TIFFDirectory *td = &tif->tif_dir; |
| tmsize_t unused_data; |
| uint64_t read_offset; |
| tmsize_t to_read; |
| tmsize_t read_ahead_mod; |
| /* tmsize_t bytecountm; */ |
| |
| /* |
| * Expand raw data buffer, if needed, to hold data |
| * strip coming from file (perhaps should set upper |
| * bound on the size of a buffer we'll use?). |
| */ |
| |
| /* bytecountm=(tmsize_t) TIFFGetStrileByteCount(tif, strip); */ |
| |
| /* Not completely sure where the * 2 comes from, but probably for */ |
| /* an exponentional growth strategy of tif_rawdatasize */ |
| if (read_ahead < TIFF_TMSIZE_T_MAX / 2) |
| read_ahead_mod = read_ahead * 2; |
| else |
| read_ahead_mod = read_ahead; |
| if (read_ahead_mod > tif->tif_rawdatasize) |
| { |
| assert(restart); |
| |
| tif->tif_curstrip = NOSTRIP; |
| if ((tif->tif_flags & TIFF_MYBUFFER) == 0) |
| { |
| TIFFErrorExtR(tif, module, |
| "Data buffer too small to hold part of strip %d", |
| strip); |
| return (0); |
| } |
| } |
| |
| if (restart) |
| { |
| tif->tif_rawdataloaded = 0; |
| tif->tif_rawdataoff = 0; |
| } |
| |
| /* |
| ** If we are reading more data, move any unused data to the |
| ** start of the buffer. |
| */ |
| if (tif->tif_rawdataloaded > 0) |
| unused_data = |
| tif->tif_rawdataloaded - (tif->tif_rawcp - tif->tif_rawdata); |
| else |
| unused_data = 0; |
| |
| if (unused_data > 0) |
| { |
| assert((tif->tif_flags & TIFF_BUFFERMMAP) == 0); |
| memmove(tif->tif_rawdata, tif->tif_rawcp, unused_data); |
| } |
| |
| /* |
| ** Seek to the point in the file where more data should be read. |
| */ |
| read_offset = TIFFGetStrileOffset(tif, strip) + tif->tif_rawdataoff + |
| tif->tif_rawdataloaded; |
| |
| if (!SeekOK(tif, read_offset)) |
| { |
| TIFFErrorExtR(tif, module, |
| "Seek error at scanline %" PRIu32 ", strip %d", |
| tif->tif_row, strip); |
| return 0; |
| } |
| |
| /* |
| ** How much do we want to read? |
| */ |
| if (read_ahead_mod > tif->tif_rawdatasize) |
| to_read = read_ahead_mod - unused_data; |
| else |
| to_read = tif->tif_rawdatasize - unused_data; |
| if ((uint64_t)to_read > TIFFGetStrileByteCount(tif, strip) - |
| tif->tif_rawdataoff - tif->tif_rawdataloaded) |
| { |
| to_read = (tmsize_t)TIFFGetStrileByteCount(tif, strip) - |
| tif->tif_rawdataoff - tif->tif_rawdataloaded; |
| } |
| |
| assert((tif->tif_flags & TIFF_BUFFERMMAP) == 0); |
| if (!TIFFReadAndRealloc(tif, to_read, unused_data, 1, /* is_strip */ |
| 0, /* strip_or_tile */ |
| module)) |
| { |
| return 0; |
| } |
| |
| tif->tif_rawdataoff = |
| tif->tif_rawdataoff + tif->tif_rawdataloaded - unused_data; |
| tif->tif_rawdataloaded = unused_data + to_read; |
| |
| tif->tif_rawcc = tif->tif_rawdataloaded; |
| tif->tif_rawcp = tif->tif_rawdata; |
| |
| if (!isFillOrder(tif, td->td_fillorder) && |
| (tif->tif_flags & TIFF_NOBITREV) == 0) |
| { |
| assert((tif->tif_flags & TIFF_BUFFERMMAP) == 0); |
| TIFFReverseBits(tif->tif_rawdata + unused_data, to_read); |
| } |
| |
| /* |
| ** When starting a strip from the beginning we need to |
| ** restart the decoder. |
| */ |
| if (restart) |
| { |
| |
| #ifdef JPEG_SUPPORT |
| /* A bit messy since breaks the codec abstraction. Ultimately */ |
| /* there should be a function pointer for that, but it seems */ |
| /* only JPEG is affected. */ |
| /* For JPEG, if there are multiple scans (can generally be known */ |
| /* with the read_ahead used), we need to read the whole strip */ |
| if (tif->tif_dir.td_compression == COMPRESSION_JPEG && |
| (uint64_t)tif->tif_rawcc < TIFFGetStrileByteCount(tif, strip)) |
| { |
| if (TIFFJPEGIsFullStripRequired(tif)) |
| { |
| return TIFFFillStrip(tif, strip); |
| } |
| } |
| #endif |
| |
| return TIFFStartStrip(tif, strip); |
| } |
| else |
| { |
| return 1; |
| } |
| } |
| |
| /* |
| * Seek to a random row+sample in a file. |
| * |
| * Only used by TIFFReadScanline, and is only used on |
| * strip organized files. We do some tricky stuff to try |
| * and avoid reading the whole compressed raw data for big |
| * strips. |
| */ |
| static int TIFFSeek(TIFF *tif, uint32_t row, uint16_t sample) |
| { |
| register TIFFDirectory *td = &tif->tif_dir; |
| uint32_t strip; |
| int whole_strip; |
| tmsize_t read_ahead = 0; |
| |
| /* |
| ** Establish what strip we are working from. |
| */ |
| if (row >= td->td_imagelength) |
| { /* out of range */ |
| TIFFErrorExtR(tif, tif->tif_name, |
| "%" PRIu32 ": Row out of range, max %" PRIu32 "", row, |
| td->td_imagelength); |
| return (0); |
| } |
| if (td->td_planarconfig == PLANARCONFIG_SEPARATE) |
| { |
| if (sample >= td->td_samplesperpixel) |
| { |
| TIFFErrorExtR(tif, tif->tif_name, |
| "%" PRIu16 ": Sample out of range, max %" PRIu16 "", |
| sample, td->td_samplesperpixel); |
| return (0); |
| } |
| strip = (uint32_t)sample * td->td_stripsperimage + |
| row / td->td_rowsperstrip; |
| } |
| else |
| strip = row / td->td_rowsperstrip; |
| |
| /* |
| * Do we want to treat this strip as one whole chunk or |
| * read it a few lines at a time? |
| */ |
| #if defined(CHUNKY_STRIP_READ_SUPPORT) |
| whole_strip = TIFFGetStrileByteCount(tif, strip) < 10 || isMapped(tif); |
| if (td->td_compression == COMPRESSION_LERC || |
| td->td_compression == COMPRESSION_JBIG) |
| { |
| /* Ideally plugins should have a way to declare they don't support |
| * chunk strip */ |
| whole_strip = 1; |
| } |
| #else |
| whole_strip = 1; |
| #endif |
| |
| if (!whole_strip) |
| { |
| /* 16 is for YCbCr mode where we may need to read 16 */ |
| /* lines at a time to get a decompressed line, and 5000 */ |
| /* is some constant value, for example for JPEG tables */ |
| if (tif->tif_scanlinesize < TIFF_TMSIZE_T_MAX / 16 && |
| tif->tif_scanlinesize * 16 < TIFF_TMSIZE_T_MAX - 5000) |
| { |
| read_ahead = tif->tif_scanlinesize * 16 + 5000; |
| } |
| else |
| { |
| read_ahead = tif->tif_scanlinesize; |
| } |
| } |
| |
| /* |
| * If we haven't loaded this strip, do so now, possibly |
| * only reading the first part. |
| */ |
| if (strip != tif->tif_curstrip) |
| { /* different strip, refill */ |
| |
| if (whole_strip) |
| { |
| if (!TIFFFillStrip(tif, strip)) |
| return (0); |
| } |
| else |
| { |
| if (!TIFFFillStripPartial(tif, strip, read_ahead, 1)) |
| return 0; |
| } |
| } |
| |
| /* |
| ** If we already have some data loaded, do we need to read some more? |
| */ |
| else if (!whole_strip) |
| { |
| if (((tif->tif_rawdata + tif->tif_rawdataloaded) - tif->tif_rawcp) < |
| read_ahead && |
| (uint64_t)tif->tif_rawdataoff + tif->tif_rawdataloaded < |
| TIFFGetStrileByteCount(tif, strip)) |
| { |
| if (!TIFFFillStripPartial(tif, strip, read_ahead, 0)) |
| return 0; |
| } |
| } |
| |
| if (row < tif->tif_row) |
| { |
| /* |
| * Moving backwards within the same strip: backup |
| * to the start and then decode forward (below). |
| * |
| * NB: If you're planning on lots of random access within a |
| * strip, it's better to just read and decode the entire |
| * strip, and then access the decoded data in a random fashion. |
| */ |
| |
| if (tif->tif_rawdataoff != 0) |
| { |
| if (!TIFFFillStripPartial(tif, strip, read_ahead, 1)) |
| return 0; |
| } |
| else |
| { |
| if (!TIFFStartStrip(tif, strip)) |
| return (0); |
| } |
| } |
| |
| if (row != tif->tif_row) |
| { |
| /* |
| * Seek forward to the desired row. |
| */ |
| |
| /* TODO: Will this really work with partial buffers? */ |
| |
| if (!(*tif->tif_seek)(tif, row - tif->tif_row)) |
| return (0); |
| tif->tif_row = row; |
| } |
| |
| return (1); |
| } |
| |
| int TIFFReadScanline(TIFF *tif, void *buf, uint32_t row, uint16_t sample) |
| { |
| int e; |
| |
| if (!TIFFCheckRead(tif, 0)) |
| return (-1); |
| if ((e = TIFFSeek(tif, row, sample)) != 0) |
| { |
| /* |
| * Decompress desired row into user buffer. |
| */ |
| e = (*tif->tif_decoderow)(tif, (uint8_t *)buf, tif->tif_scanlinesize, |
| sample); |
| |
| /* we are now poised at the beginning of the next row */ |
| tif->tif_row = row + 1; |
| |
| if (e) |
| (*tif->tif_postdecode)(tif, (uint8_t *)buf, tif->tif_scanlinesize); |
| } |
| return (e > 0 ? 1 : -1); |
| } |
| |
| /* |
| * Calculate the strip size according to the number of |
| * rows in the strip (check for truncated last strip on any |
| * of the separations). |
| */ |
| static tmsize_t TIFFReadEncodedStripGetStripSize(TIFF *tif, uint32_t strip, |
| uint16_t *pplane) |
| { |
| static const char module[] = "TIFFReadEncodedStrip"; |
| TIFFDirectory *td = &tif->tif_dir; |
| uint32_t rowsperstrip; |
| uint32_t stripsperplane; |
| uint32_t stripinplane; |
| uint32_t rows; |
| tmsize_t stripsize; |
| if (!TIFFCheckRead(tif, 0)) |
| return ((tmsize_t)(-1)); |
| if (strip >= td->td_nstrips) |
| { |
| TIFFErrorExtR(tif, module, |
| "%" PRIu32 ": Strip out of range, max %" PRIu32, strip, |
| td->td_nstrips); |
| return ((tmsize_t)(-1)); |
| } |
| |
| rowsperstrip = td->td_rowsperstrip; |
| if (rowsperstrip > td->td_imagelength) |
| rowsperstrip = td->td_imagelength; |
| stripsperplane = |
| TIFFhowmany_32_maxuint_compat(td->td_imagelength, rowsperstrip); |
| stripinplane = (strip % stripsperplane); |
| if (pplane) |
| *pplane = (uint16_t)(strip / stripsperplane); |
| rows = td->td_imagelength - stripinplane * rowsperstrip; |
| if (rows > rowsperstrip) |
| rows = rowsperstrip; |
| stripsize = TIFFVStripSize(tif, rows); |
| if (stripsize == 0) |
| return ((tmsize_t)(-1)); |
| return stripsize; |
| } |
| |
| /* |
| * Read a strip of data and decompress the specified |
| * amount into the user-supplied buffer. |
| */ |
| tmsize_t TIFFReadEncodedStrip(TIFF *tif, uint32_t strip, void *buf, |
| tmsize_t size) |
| { |
| static const char module[] = "TIFFReadEncodedStrip"; |
| TIFFDirectory *td = &tif->tif_dir; |
| tmsize_t stripsize; |
| uint16_t plane; |
| |
| stripsize = TIFFReadEncodedStripGetStripSize(tif, strip, &plane); |
| if (stripsize == ((tmsize_t)(-1))) |
| return ((tmsize_t)(-1)); |
| |
| /* shortcut to avoid an extra memcpy() */ |
| if (td->td_compression == COMPRESSION_NONE && size != (tmsize_t)(-1) && |
| size >= stripsize && !isMapped(tif) && |
| ((tif->tif_flags & TIFF_NOREADRAW) == 0)) |
| { |
| if (TIFFReadRawStrip1(tif, strip, buf, stripsize, module) != stripsize) |
| return ((tmsize_t)(-1)); |
| |
| if (!isFillOrder(tif, td->td_fillorder) && |
| (tif->tif_flags & TIFF_NOBITREV) == 0) |
| TIFFReverseBits(buf, stripsize); |
| |
| (*tif->tif_postdecode)(tif, buf, stripsize); |
| return (stripsize); |
| } |
| |
| if ((size != (tmsize_t)(-1)) && (size < stripsize)) |
| stripsize = size; |
| if (!TIFFFillStrip(tif, strip)) |
| return ((tmsize_t)(-1)); |
| if ((*tif->tif_decodestrip)(tif, buf, stripsize, plane) <= 0) |
| return ((tmsize_t)(-1)); |
| (*tif->tif_postdecode)(tif, buf, stripsize); |
| return (stripsize); |
| } |
| |
| /* Variant of TIFFReadEncodedStrip() that does |
| * * if *buf == NULL, *buf = _TIFFmallocExt(tif, bufsizetoalloc) only after |
| * TIFFFillStrip() has succeeded. This avoid excessive memory allocation in case |
| * of truncated file. |
| * * calls regular TIFFReadEncodedStrip() if *buf != NULL |
| */ |
| tmsize_t _TIFFReadEncodedStripAndAllocBuffer(TIFF *tif, uint32_t strip, |
| void **buf, |
| tmsize_t bufsizetoalloc, |
| tmsize_t size_to_read) |
| { |
| tmsize_t this_stripsize; |
| uint16_t plane; |
| |
| if (*buf != NULL) |
| { |
| return TIFFReadEncodedStrip(tif, strip, *buf, size_to_read); |
| } |
| |
| this_stripsize = TIFFReadEncodedStripGetStripSize(tif, strip, &plane); |
| if (this_stripsize == ((tmsize_t)(-1))) |
| return ((tmsize_t)(-1)); |
| |
| if ((size_to_read != (tmsize_t)(-1)) && (size_to_read < this_stripsize)) |
| this_stripsize = size_to_read; |
| if (!TIFFFillStrip(tif, strip)) |
| return ((tmsize_t)(-1)); |
| |
| *buf = _TIFFmallocExt(tif, bufsizetoalloc); |
| if (*buf == NULL) |
| { |
| TIFFErrorExtR(tif, TIFFFileName(tif), "No space for strip buffer"); |
| return ((tmsize_t)(-1)); |
| } |
| _TIFFmemset(*buf, 0, bufsizetoalloc); |
| |
| if ((*tif->tif_decodestrip)(tif, *buf, this_stripsize, plane) <= 0) |
| return ((tmsize_t)(-1)); |
| (*tif->tif_postdecode)(tif, *buf, this_stripsize); |
| return (this_stripsize); |
| } |
| |
| static tmsize_t TIFFReadRawStrip1(TIFF *tif, uint32_t strip, void *buf, |
| tmsize_t size, const char *module) |
| { |
| assert((tif->tif_flags & TIFF_NOREADRAW) == 0); |
| if (!isMapped(tif)) |
| { |
| tmsize_t cc; |
| |
| if (!SeekOK(tif, TIFFGetStrileOffset(tif, strip))) |
| { |
| TIFFErrorExtR(tif, module, |
| "Seek error at scanline %" PRIu32 ", strip %" PRIu32, |
| tif->tif_row, strip); |
| return ((tmsize_t)(-1)); |
| } |
| cc = TIFFReadFile(tif, buf, size); |
| if (cc != size) |
| { |
| TIFFErrorExtR(tif, module, |
| "Read error at scanline %" PRIu32 |
| "; got %" TIFF_SSIZE_FORMAT |
| " bytes, expected %" TIFF_SSIZE_FORMAT, |
| tif->tif_row, cc, size); |
| return ((tmsize_t)(-1)); |
| } |
| } |
| else |
| { |
| tmsize_t ma = 0; |
| tmsize_t n; |
| if ((TIFFGetStrileOffset(tif, strip) > (uint64_t)TIFF_TMSIZE_T_MAX) || |
| ((ma = (tmsize_t)TIFFGetStrileOffset(tif, strip)) > tif->tif_size)) |
| { |
| n = 0; |
| } |
| else if (ma > TIFF_TMSIZE_T_MAX - size) |
| { |
| n = 0; |
| } |
| else |
| { |
| tmsize_t mb = ma + size; |
| if (mb > tif->tif_size) |
| n = tif->tif_size - ma; |
| else |
| n = size; |
| } |
| if (n != size) |
| { |
| TIFFErrorExtR(tif, module, |
| "Read error at scanline %" PRIu32 ", strip %" PRIu32 |
| "; got %" TIFF_SSIZE_FORMAT |
| " bytes, expected %" TIFF_SSIZE_FORMAT, |
| tif->tif_row, strip, n, size); |
| return ((tmsize_t)(-1)); |
| } |
| _TIFFmemcpy(buf, tif->tif_base + ma, size); |
| } |
| return (size); |
| } |
| |
| static tmsize_t TIFFReadRawStripOrTile2(TIFF *tif, uint32_t strip_or_tile, |
| int is_strip, tmsize_t size, |
| const char *module) |
| { |
| assert(!isMapped(tif)); |
| assert((tif->tif_flags & TIFF_NOREADRAW) == 0); |
| |
| if (!SeekOK(tif, TIFFGetStrileOffset(tif, strip_or_tile))) |
| { |
| if (is_strip) |
| { |
| TIFFErrorExtR(tif, module, |
| "Seek error at scanline %" PRIu32 ", strip %" PRIu32, |
| tif->tif_row, strip_or_tile); |
| } |
| else |
| { |
| TIFFErrorExtR(tif, module, |
| "Seek error at row %" PRIu32 ", col %" PRIu32 |
| ", tile %" PRIu32, |
| tif->tif_row, tif->tif_col, strip_or_tile); |
| } |
| return ((tmsize_t)(-1)); |
| } |
| |
| if (!TIFFReadAndRealloc(tif, size, 0, is_strip, strip_or_tile, module)) |
| { |
| return ((tmsize_t)(-1)); |
| } |
| |
| return (size); |
| } |
| |
| /* |
| * Read a strip of data from the file. |
| */ |
| tmsize_t TIFFReadRawStrip(TIFF *tif, uint32_t strip, void *buf, tmsize_t size) |
| { |
| static const char module[] = "TIFFReadRawStrip"; |
| TIFFDirectory *td = &tif->tif_dir; |
| uint64_t bytecount64; |
| tmsize_t bytecountm; |
| |
| if (!TIFFCheckRead(tif, 0)) |
| return ((tmsize_t)(-1)); |
| if (strip >= td->td_nstrips) |
| { |
| TIFFErrorExtR(tif, module, |
| "%" PRIu32 ": Strip out of range, max %" PRIu32, strip, |
| td->td_nstrips); |
| return ((tmsize_t)(-1)); |
| } |
| if (tif->tif_flags & TIFF_NOREADRAW) |
| { |
| TIFFErrorExtR(tif, module, |
| "Compression scheme does not support access to raw " |
| "uncompressed data"); |
| return ((tmsize_t)(-1)); |
| } |
| bytecount64 = TIFFGetStrileByteCount(tif, strip); |
| if (size != (tmsize_t)(-1) && (uint64_t)size <= bytecount64) |
| bytecountm = size; |
| else |
| bytecountm = _TIFFCastUInt64ToSSize(tif, bytecount64, module); |
| if (bytecountm == 0) |
| { |
| return ((tmsize_t)(-1)); |
| } |
| return (TIFFReadRawStrip1(tif, strip, buf, bytecountm, module)); |
| } |
| |
| TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW |
| static uint64_t NoSanitizeSubUInt64(uint64_t a, uint64_t b) { return a - b; } |
| |
| /* |
| * Read the specified strip and setup for decoding. The data buffer is |
| * expanded, as necessary, to hold the strip's data. |
| */ |
| int TIFFFillStrip(TIFF *tif, uint32_t strip) |
| { |
| static const char module[] = "TIFFFillStrip"; |
| TIFFDirectory *td = &tif->tif_dir; |
| |
| if ((tif->tif_flags & TIFF_NOREADRAW) == 0) |
| { |
| uint64_t bytecount = TIFFGetStrileByteCount(tif, strip); |
| if (bytecount == 0 || bytecount > (uint64_t)TIFF_INT64_MAX) |
| { |
| TIFFErrorExtR(tif, module, |
| "Invalid strip byte count %" PRIu64 |
| ", strip %" PRIu32, |
| bytecount, strip); |
| return (0); |
| } |
| |
| /* To avoid excessive memory allocations: */ |
| /* Byte count should normally not be larger than a number of */ |
| /* times the uncompressed size plus some margin */ |
| if (bytecount > 1024 * 1024) |
| { |
| /* 10 and 4096 are just values that could be adjusted. */ |
| /* Hopefully they are safe enough for all codecs */ |
| tmsize_t stripsize = TIFFStripSize(tif); |
| if (stripsize != 0 && (bytecount - 4096) / 10 > (uint64_t)stripsize) |
| { |
| uint64_t newbytecount = (uint64_t)stripsize * 10 + 4096; |
| TIFFErrorExtR(tif, module, |
| "Too large strip byte count %" PRIu64 |
| ", strip %" PRIu32 ". Limiting to %" PRIu64, |
| bytecount, strip, newbytecount); |
| bytecount = newbytecount; |
| } |
| } |
| |
| if (isMapped(tif)) |
| { |
| /* |
| * We must check for overflow, potentially causing |
| * an OOB read. Instead of simple |
| * |
| * TIFFGetStrileOffset(tif, strip)+bytecount > tif->tif_size |
| * |
| * comparison (which can overflow) we do the following |
| * two comparisons: |
| */ |
| if (bytecount > (uint64_t)tif->tif_size || |
| TIFFGetStrileOffset(tif, strip) > |
| (uint64_t)tif->tif_size - bytecount) |
| { |
| /* |
| * This error message might seem strange, but |
| * it's what would happen if a read were done |
| * instead. |
| */ |
| TIFFErrorExtR( |
| tif, module, |
| |
| "Read error on strip %" PRIu32 "; " |
| "got %" PRIu64 " bytes, expected %" PRIu64, |
| strip, |
| NoSanitizeSubUInt64(tif->tif_size, |
| TIFFGetStrileOffset(tif, strip)), |
| bytecount); |
| tif->tif_curstrip = NOSTRIP; |
| return (0); |
| } |
| } |
| |
| if (isMapped(tif) && (isFillOrder(tif, td->td_fillorder) || |
| (tif->tif_flags & TIFF_NOBITREV))) |
| { |
| /* |
| * The image is mapped into memory and we either don't |
| * need to flip bits or the compression routine is |
| * going to handle this operation itself. In this |
| * case, avoid copying the raw data and instead just |
| * reference the data from the memory mapped file |
| * image. This assumes that the decompression |
| * routines do not modify the contents of the raw data |
| * buffer (if they try to, the application will get a |
| * fault since the file is mapped read-only). |
| */ |
| if ((tif->tif_flags & TIFF_MYBUFFER) && tif->tif_rawdata) |
| { |
| _TIFFfreeExt(tif, tif->tif_rawdata); |
| tif->tif_rawdata = NULL; |
| tif->tif_rawdatasize = 0; |
| } |
| tif->tif_flags &= ~TIFF_MYBUFFER; |
| tif->tif_rawdatasize = (tmsize_t)bytecount; |
| tif->tif_rawdata = |
| tif->tif_base + (tmsize_t)TIFFGetStrileOffset(tif, strip); |
| tif->tif_rawdataoff = 0; |
| tif->tif_rawdataloaded = (tmsize_t)bytecount; |
| |
| /* |
| * When we have tif_rawdata reference directly into the memory |
| * mapped file we need to be pretty careful about how we use the |
| * rawdata. It is not a general purpose working buffer as it |
| * normally otherwise is. So we keep track of this fact to avoid |
| * using it improperly. |
| */ |
| tif->tif_flags |= TIFF_BUFFERMMAP; |
| } |
| else |
| { |
| /* |
| * Expand raw data buffer, if needed, to hold data |
| * strip coming from file (perhaps should set upper |
| * bound on the size of a buffer we'll use?). |
| */ |
| tmsize_t bytecountm; |
| bytecountm = (tmsize_t)bytecount; |
| if ((uint64_t)bytecountm != bytecount) |
| { |
| TIFFErrorExtR(tif, module, "Integer overflow"); |
| return (0); |
| } |
| if (bytecountm > tif->tif_rawdatasize) |
| { |
| tif->tif_curstrip = NOSTRIP; |
| if ((tif->tif_flags & TIFF_MYBUFFER) == 0) |
| { |
| TIFFErrorExtR( |
| tif, module, |
| "Data buffer too small to hold strip %" PRIu32, strip); |
| return (0); |
| } |
| } |
| if (tif->tif_flags & TIFF_BUFFERMMAP) |
| { |
| tif->tif_curstrip = NOSTRIP; |
| tif->tif_rawdata = NULL; |
| tif->tif_rawdatasize = 0; |
| tif->tif_flags &= ~TIFF_BUFFERMMAP; |
| } |
| |
| if (isMapped(tif)) |
| { |
| if (bytecountm > tif->tif_rawdatasize && |
| !TIFFReadBufferSetup(tif, 0, bytecountm)) |
| { |
| return (0); |
| } |
| if (TIFFReadRawStrip1(tif, strip, tif->tif_rawdata, bytecountm, |
| module) != bytecountm) |
| { |
| return (0); |
| } |
| } |
| else |
| { |
| if (TIFFReadRawStripOrTile2(tif, strip, 1, bytecountm, |
| module) != bytecountm) |
| { |
| return (0); |
| } |
| } |
| |
| tif->tif_rawdataoff = 0; |
| tif->tif_rawdataloaded = bytecountm; |
| |
| if (!isFillOrder(tif, td->td_fillorder) && |
| (tif->tif_flags & TIFF_NOBITREV) == 0) |
| TIFFReverseBits(tif->tif_rawdata, bytecountm); |
| } |
| } |
| return (TIFFStartStrip(tif, strip)); |
| } |
| |
| /* |
| * Tile-oriented Read Support |
| * Contributed by Nancy Cam (Silicon Graphics). |
| */ |
| |
| /* |
| * Read and decompress a tile of data. The |
| * tile is selected by the (x,y,z,s) coordinates. |
| */ |
| tmsize_t TIFFReadTile(TIFF *tif, void *buf, uint32_t x, uint32_t y, uint32_t z, |
| uint16_t s) |
| { |
| if (!TIFFCheckRead(tif, 1) || !TIFFCheckTile(tif, x, y, z, s)) |
| return ((tmsize_t)(-1)); |
| return (TIFFReadEncodedTile(tif, TIFFComputeTile(tif, x, y, z, s), buf, |
| (tmsize_t)(-1))); |
| } |
| |
| /* |
| * Read a tile of data and decompress the specified |
| * amount into the user-supplied buffer. |
| */ |
| tmsize_t TIFFReadEncodedTile(TIFF *tif, uint32_t tile, void *buf, tmsize_t size) |
| { |
| static const char module[] = "TIFFReadEncodedTile"; |
| TIFFDirectory *td = &tif->tif_dir; |
| tmsize_t tilesize = tif->tif_tilesize; |
| |
| if (!TIFFCheckRead(tif, 1)) |
| return ((tmsize_t)(-1)); |
| if (tile >= td->td_nstrips) |
| { |
| TIFFErrorExtR(tif, module, |
| "%" PRIu32 ": Tile out of range, max %" PRIu32, tile, |
| td->td_nstrips); |
| return ((tmsize_t)(-1)); |
| } |
| |
| /* shortcut to avoid an extra memcpy() */ |
| if (td->td_compression == COMPRESSION_NONE && size != (tmsize_t)(-1) && |
| size >= tilesize && !isMapped(tif) && |
| ((tif->tif_flags & TIFF_NOREADRAW) == 0)) |
| { |
| if (TIFFReadRawTile1(tif, tile, buf, tilesize, module) != tilesize) |
| return ((tmsize_t)(-1)); |
| |
| if (!isFillOrder(tif, td->td_fillorder) && |
| (tif->tif_flags & TIFF_NOBITREV) == 0) |
| TIFFReverseBits(buf, tilesize); |
| |
| (*tif->tif_postdecode)(tif, buf, tilesize); |
| return (tilesize); |
| } |
| |
| if (size == (tmsize_t)(-1)) |
| size = tilesize; |
| else if (size > tilesize) |
| size = tilesize; |
| if (TIFFFillTile(tif, tile) && |
| (*tif->tif_decodetile)(tif, (uint8_t *)buf, size, |
| (uint16_t)(tile / td->td_stripsperimage))) |
| { |
| (*tif->tif_postdecode)(tif, (uint8_t *)buf, size); |
| return (size); |
| } |
| else |
| return ((tmsize_t)(-1)); |
| } |
| |
| /* Variant of TIFFReadTile() that does |
| * * if *buf == NULL, *buf = _TIFFmallocExt(tif, bufsizetoalloc) only after |
| * TIFFFillTile() has succeeded. This avoid excessive memory allocation in case |
| * of truncated file. |
| * * calls regular TIFFReadEncodedTile() if *buf != NULL |
| */ |
| tmsize_t _TIFFReadTileAndAllocBuffer(TIFF *tif, void **buf, |
| tmsize_t bufsizetoalloc, uint32_t x, |
| uint32_t y, uint32_t z, uint16_t s) |
| { |
| if (!TIFFCheckRead(tif, 1) || !TIFFCheckTile(tif, x, y, z, s)) |
| return ((tmsize_t)(-1)); |
| return (_TIFFReadEncodedTileAndAllocBuffer( |
| tif, TIFFComputeTile(tif, x, y, z, s), buf, bufsizetoalloc, |
| (tmsize_t)(-1))); |
| } |
| |
| /* Variant of TIFFReadEncodedTile() that does |
| * * if *buf == NULL, *buf = _TIFFmallocExt(tif, bufsizetoalloc) only after |
| * TIFFFillTile() has succeeded. This avoid excessive memory allocation in case |
| * of truncated file. |
| * * calls regular TIFFReadEncodedTile() if *buf != NULL |
| */ |
| tmsize_t _TIFFReadEncodedTileAndAllocBuffer(TIFF *tif, uint32_t tile, |
| void **buf, tmsize_t bufsizetoalloc, |
| tmsize_t size_to_read) |
| { |
| static const char module[] = "_TIFFReadEncodedTileAndAllocBuffer"; |
| TIFFDirectory *td = &tif->tif_dir; |
| tmsize_t tilesize = tif->tif_tilesize; |
| |
| if (*buf != NULL) |
| { |
| return TIFFReadEncodedTile(tif, tile, *buf, size_to_read); |
| } |
| |
| if (!TIFFCheckRead(tif, 1)) |
| return ((tmsize_t)(-1)); |
| if (tile >= td->td_nstrips) |
| { |
| TIFFErrorExtR(tif, module, |
| "%" PRIu32 ": Tile out of range, max %" PRIu32, tile, |
| td->td_nstrips); |
| return ((tmsize_t)(-1)); |
| } |
| |
| if (!TIFFFillTile(tif, tile)) |
| return ((tmsize_t)(-1)); |
| |
| /* Sanity checks to avoid excessive memory allocation */ |
| /* Cf https://gitlab.com/libtiff/libtiff/-/issues/479 */ |
| if (td->td_compression == COMPRESSION_NONE) |
| { |
| if (tif->tif_rawdatasize != tilesize) |
| { |
| TIFFErrorExtR(tif, TIFFFileName(tif), |
| "Invalid tile byte count for tile %u. " |
| "Expected %" PRIu64 ", got %" PRIu64, |
| tile, (uint64_t)tilesize, |
| (uint64_t)tif->tif_rawdatasize); |
| return ((tmsize_t)(-1)); |
| } |
| } |
| else |
| { |
| /* Max compression ratio experimentally determined. Might be fragile... |
| * Only apply this heuristics to situations where the memory allocation |
| * would be big, to avoid breaking nominal use cases. |
| */ |
| const int maxCompressionRatio = |
| td->td_compression == COMPRESSION_ZSTD ? 33000 |
| : td->td_compression == COMPRESSION_JXL |
| ? |
| /* Evaluated on a 8000x8000 tile */ |
| 25000 * (td->td_planarconfig == PLANARCONFIG_CONTIG |
| ? td->td_samplesperpixel |
| : 1) |
| : td->td_compression == COMPRESSION_LZMA ? 7000 : 1000; |
| if (bufsizetoalloc > 100 * 1000 * 1000 && |
| tif->tif_rawdatasize < tilesize / maxCompressionRatio) |
| { |
| TIFFErrorExtR(tif, TIFFFileName(tif), |
| "Likely invalid tile byte count for tile %u. " |
| "Uncompressed tile size is %" PRIu64 ", " |
| "compressed one is %" PRIu64, |
| tile, (uint64_t)tilesize, |
| (uint64_t)tif->tif_rawdatasize); |
| return ((tmsize_t)(-1)); |
| } |
| } |
| |
| *buf = _TIFFmallocExt(tif, bufsizetoalloc); |
| if (*buf == NULL) |
| { |
| TIFFErrorExtR(tif, TIFFFileName(tif), "No space for tile buffer"); |
| return ((tmsize_t)(-1)); |
| } |
| _TIFFmemset(*buf, 0, bufsizetoalloc); |
| |
| if (size_to_read == (tmsize_t)(-1)) |
| size_to_read = tilesize; |
| else if (size_to_read > tilesize) |
| size_to_read = tilesize; |
| if ((*tif->tif_decodetile)(tif, (uint8_t *)*buf, size_to_read, |
| (uint16_t)(tile / td->td_stripsperimage))) |
| { |
| (*tif->tif_postdecode)(tif, (uint8_t *)*buf, size_to_read); |
| return (size_to_read); |
| } |
| else |
| return ((tmsize_t)(-1)); |
| } |
| |
| static tmsize_t TIFFReadRawTile1(TIFF *tif, uint32_t tile, void *buf, |
| tmsize_t size, const char *module) |
| { |
| assert((tif->tif_flags & TIFF_NOREADRAW) == 0); |
| if (!isMapped(tif)) |
| { |
| tmsize_t cc; |
| |
| if (!SeekOK(tif, TIFFGetStrileOffset(tif, tile))) |
| { |
| TIFFErrorExtR(tif, module, |
| "Seek error at row %" PRIu32 ", col %" PRIu32 |
| ", tile %" PRIu32, |
| tif->tif_row, tif->tif_col, tile); |
| return ((tmsize_t)(-1)); |
| } |
| cc = TIFFReadFile(tif, buf, size); |
| if (cc != size) |
| { |
| TIFFErrorExtR(tif, module, |
| "Read error at row %" PRIu32 ", col %" PRIu32 |
| "; got %" TIFF_SSIZE_FORMAT |
| " bytes, expected %" TIFF_SSIZE_FORMAT, |
| tif->tif_row, tif->tif_col, cc, size); |
| return ((tmsize_t)(-1)); |
| } |
| } |
| else |
| { |
| tmsize_t ma, mb; |
| tmsize_t n; |
| ma = (tmsize_t)TIFFGetStrileOffset(tif, tile); |
| mb = ma + size; |
| if ((TIFFGetStrileOffset(tif, tile) > (uint64_t)TIFF_TMSIZE_T_MAX) || |
| (ma > tif->tif_size)) |
| n = 0; |
| else if ((mb < ma) || (mb < size) || (mb > tif->tif_size)) |
| n = tif->tif_size - ma; |
| else |
| n = size; |
| if (n != size) |
| { |
| TIFFErrorExtR(tif, module, |
| "Read error at row %" PRIu32 ", col %" PRIu32 |
| ", tile %" PRIu32 "; got %" TIFF_SSIZE_FORMAT |
| " bytes, expected %" TIFF_SSIZE_FORMAT, |
| tif->tif_row, tif->tif_col, tile, n, size); |
| return ((tmsize_t)(-1)); |
| } |
| _TIFFmemcpy(buf, tif->tif_base + ma, size); |
| } |
| return (size); |
| } |
| |
| /* |
| * Read a tile of data from the file. |
| */ |
| tmsize_t TIFFReadRawTile(TIFF *tif, uint32_t tile, void *buf, tmsize_t size) |
| { |
| static const char module[] = "TIFFReadRawTile"; |
| TIFFDirectory *td = &tif->tif_dir; |
| uint64_t bytecount64; |
| tmsize_t bytecountm; |
| |
| if (!TIFFCheckRead(tif, 1)) |
| return ((tmsize_t)(-1)); |
| if (tile >= td->td_nstrips) |
| { |
| TIFFErrorExtR(tif, module, |
| "%" PRIu32 ": Tile out of range, max %" PRIu32, tile, |
| td->td_nstrips); |
| return ((tmsize_t)(-1)); |
| } |
| if (tif->tif_flags & TIFF_NOREADRAW) |
| { |
| TIFFErrorExtR(tif, module, |
| "Compression scheme does not support access to raw " |
| "uncompressed data"); |
| return ((tmsize_t)(-1)); |
| } |
| bytecount64 = TIFFGetStrileByteCount(tif, tile); |
| if (size != (tmsize_t)(-1) && (uint64_t)size <= bytecount64) |
| bytecountm = size; |
| else |
| bytecountm = _TIFFCastUInt64ToSSize(tif, bytecount64, module); |
| if (bytecountm == 0) |
| { |
| return ((tmsize_t)(-1)); |
| } |
| return (TIFFReadRawTile1(tif, tile, buf, bytecountm, module)); |
| } |
| |
| /* |
| * Read the specified tile and setup for decoding. The data buffer is |
| * expanded, as necessary, to hold the tile's data. |
| */ |
| int TIFFFillTile(TIFF *tif, uint32_t tile) |
| { |
| static const char module[] = "TIFFFillTile"; |
| TIFFDirectory *td = &tif->tif_dir; |
| |
| if ((tif->tif_flags & TIFF_NOREADRAW) == 0) |
| { |
| uint64_t bytecount = TIFFGetStrileByteCount(tif, tile); |
| if (bytecount == 0 || bytecount > (uint64_t)TIFF_INT64_MAX) |
| { |
| TIFFErrorExtR(tif, module, |
| "%" PRIu64 ": Invalid tile byte count, tile %" PRIu32, |
| bytecount, tile); |
| return (0); |
| } |
| |
| /* To avoid excessive memory allocations: */ |
| /* Byte count should normally not be larger than a number of */ |
| /* times the uncompressed size plus some margin */ |
| if (bytecount > 1024 * 1024) |
| { |
| /* 10 and 4096 are just values that could be adjusted. */ |
| /* Hopefully they are safe enough for all codecs */ |
| tmsize_t stripsize = TIFFTileSize(tif); |
| if (stripsize != 0 && (bytecount - 4096) / 10 > (uint64_t)stripsize) |
| { |
| uint64_t newbytecount = (uint64_t)stripsize * 10 + 4096; |
| TIFFErrorExtR(tif, module, |
| "Too large tile byte count %" PRIu64 |
| ", tile %" PRIu32 ". Limiting to %" PRIu64, |
| bytecount, tile, newbytecount); |
| bytecount = newbytecount; |
| } |
| } |
| |
| if (isMapped(tif)) |
| { |
| /* |
| * We must check for overflow, potentially causing |
| * an OOB read. Instead of simple |
| * |
| * TIFFGetStrileOffset(tif, tile)+bytecount > tif->tif_size |
| * |
| * comparison (which can overflow) we do the following |
| * two comparisons: |
| */ |
| if (bytecount > (uint64_t)tif->tif_size || |
| TIFFGetStrileOffset(tif, tile) > |
| (uint64_t)tif->tif_size - bytecount) |
| { |
| tif->tif_curtile = NOTILE; |
| return (0); |
| } |
| } |
| |
| if (isMapped(tif) && (isFillOrder(tif, td->td_fillorder) || |
| (tif->tif_flags & TIFF_NOBITREV))) |
| { |
| /* |
| * The image is mapped into memory and we either don't |
| * need to flip bits or the compression routine is |
| * going to handle this operation itself. In this |
| * case, avoid copying the raw data and instead just |
| * reference the data from the memory mapped file |
| * image. This assumes that the decompression |
| * routines do not modify the contents of the raw data |
| * buffer (if they try to, the application will get a |
| * fault since the file is mapped read-only). |
| */ |
| if ((tif->tif_flags & TIFF_MYBUFFER) && tif->tif_rawdata) |
| { |
| _TIFFfreeExt(tif, tif->tif_rawdata); |
| tif->tif_rawdata = NULL; |
| tif->tif_rawdatasize = 0; |
| } |
| tif->tif_flags &= ~TIFF_MYBUFFER; |
| |
| tif->tif_rawdatasize = (tmsize_t)bytecount; |
| tif->tif_rawdata = |
| tif->tif_base + (tmsize_t)TIFFGetStrileOffset(tif, tile); |
| tif->tif_rawdataoff = 0; |
| tif->tif_rawdataloaded = (tmsize_t)bytecount; |
| tif->tif_flags |= TIFF_BUFFERMMAP; |
| } |
| else |
| { |
| /* |
| * Expand raw data buffer, if needed, to hold data |
| * tile coming from file (perhaps should set upper |
| * bound on the size of a buffer we'll use?). |
| */ |
| tmsize_t bytecountm; |
| bytecountm = (tmsize_t)bytecount; |
| if ((uint64_t)bytecountm != bytecount) |
| { |
| TIFFErrorExtR(tif, module, "Integer overflow"); |
| return (0); |
| } |
| if (bytecountm > tif->tif_rawdatasize) |
| { |
| tif->tif_curtile = NOTILE; |
| if ((tif->tif_flags & TIFF_MYBUFFER) == 0) |
| { |
| TIFFErrorExtR(tif, module, |
| "Data buffer too small to hold tile %" PRIu32, |
| tile); |
| return (0); |
| } |
| } |
| if (tif->tif_flags & TIFF_BUFFERMMAP) |
| { |
| tif->tif_curtile = NOTILE; |
| tif->tif_rawdata = NULL; |
| tif->tif_rawdatasize = 0; |
| tif->tif_flags &= ~TIFF_BUFFERMMAP; |
| } |
| |
| if (isMapped(tif)) |
| { |
| if (bytecountm > tif->tif_rawdatasize && |
| !TIFFReadBufferSetup(tif, 0, bytecountm)) |
| { |
| return (0); |
| } |
| if (TIFFReadRawTile1(tif, tile, tif->tif_rawdata, bytecountm, |
| module) != bytecountm) |
| { |
| return (0); |
| } |
| } |
| else |
| { |
| if (TIFFReadRawStripOrTile2(tif, tile, 0, bytecountm, module) != |
| bytecountm) |
| { |
| return (0); |
| } |
| } |
| |
| tif->tif_rawdataoff = 0; |
| tif->tif_rawdataloaded = bytecountm; |
| |
| if (tif->tif_rawdata != NULL && |
| !isFillOrder(tif, td->td_fillorder) && |
| (tif->tif_flags & TIFF_NOBITREV) == 0) |
| TIFFReverseBits(tif->tif_rawdata, tif->tif_rawdataloaded); |
| } |
| } |
| return (TIFFStartTile(tif, tile)); |
| } |
| |
| /* |
| * Setup the raw data buffer in preparation for |
| * reading a strip of raw data. If the buffer |
| * is specified as zero, then a buffer of appropriate |
| * size is allocated by the library. Otherwise, |
| * the client must guarantee that the buffer is |
| * large enough to hold any individual strip of |
| * raw data. |
| */ |
| int TIFFReadBufferSetup(TIFF *tif, void *bp, tmsize_t size) |
| { |
| static const char module[] = "TIFFReadBufferSetup"; |
| |
| assert((tif->tif_flags & TIFF_NOREADRAW) == 0); |
| tif->tif_flags &= ~TIFF_BUFFERMMAP; |
| |
| if (tif->tif_rawdata) |
| { |
| if (tif->tif_flags & TIFF_MYBUFFER) |
| _TIFFfreeExt(tif, tif->tif_rawdata); |
| tif->tif_rawdata = NULL; |
| tif->tif_rawdatasize = 0; |
| } |
| if (bp) |
| { |
| tif->tif_rawdatasize = size; |
| tif->tif_rawdata = (uint8_t *)bp; |
| tif->tif_flags &= ~TIFF_MYBUFFER; |
| } |
| else |
| { |
| tif->tif_rawdatasize = (tmsize_t)TIFFroundup_64((uint64_t)size, 1024); |
| if (tif->tif_rawdatasize == 0) |
| { |
| TIFFErrorExtR(tif, module, "Invalid buffer size"); |
| return (0); |
| } |
| /* Initialize to zero to avoid uninitialized buffers in case of */ |
| /* short reads (http://bugzilla.maptools.org/show_bug.cgi?id=2651) */ |
| tif->tif_rawdata = |
| (uint8_t *)_TIFFcallocExt(tif, 1, tif->tif_rawdatasize); |
| tif->tif_flags |= TIFF_MYBUFFER; |
| } |
| if (tif->tif_rawdata == NULL) |
| { |
| TIFFErrorExtR(tif, module, |
| "No space for data buffer at scanline %" PRIu32, |
| tif->tif_row); |
| tif->tif_rawdatasize = 0; |
| return (0); |
| } |
| return (1); |
| } |
| |
| /* |
| * Set state to appear as if a |
| * strip has just been read in. |
| */ |
| static int TIFFStartStrip(TIFF *tif, uint32_t strip) |
| { |
| TIFFDirectory *td = &tif->tif_dir; |
| |
| if ((tif->tif_flags & TIFF_CODERSETUP) == 0) |
| { |
| if (!(*tif->tif_setupdecode)(tif)) |
| return (0); |
| tif->tif_flags |= TIFF_CODERSETUP; |
| } |
| tif->tif_curstrip = strip; |
| tif->tif_row = (strip % td->td_stripsperimage) * td->td_rowsperstrip; |
| tif->tif_flags &= ~TIFF_BUF4WRITE; |
| |
| if (tif->tif_flags & TIFF_NOREADRAW) |
| { |
| tif->tif_rawcp = NULL; |
| tif->tif_rawcc = 0; |
| } |
| else |
| { |
| tif->tif_rawcp = tif->tif_rawdata; |
| if (tif->tif_rawdataloaded > 0) |
| tif->tif_rawcc = tif->tif_rawdataloaded; |
| else |
| tif->tif_rawcc = (tmsize_t)TIFFGetStrileByteCount(tif, strip); |
| } |
| if ((*tif->tif_predecode)(tif, (uint16_t)(strip / td->td_stripsperimage)) == |
| 0) |
| { |
| /* Needed for example for scanline access, if tif_predecode */ |
| /* fails, and we try to read the same strip again. Without invalidating |
| */ |
| /* tif_curstrip, we'd call tif_decoderow() on a possibly invalid */ |
| /* codec state. */ |
| tif->tif_curstrip = NOSTRIP; |
| return 0; |
| } |
| return 1; |
| } |
| |
| /* |
| * Set state to appear as if a |
| * tile has just been read in. |
| */ |
| static int TIFFStartTile(TIFF *tif, uint32_t tile) |
| { |
| static const char module[] = "TIFFStartTile"; |
| TIFFDirectory *td = &tif->tif_dir; |
| uint32_t howmany32; |
| |
| if ((tif->tif_flags & TIFF_CODERSETUP) == 0) |
| { |
| if (!(*tif->tif_setupdecode)(tif)) |
| return (0); |
| tif->tif_flags |= TIFF_CODERSETUP; |
| } |
| tif->tif_curtile = tile; |
| howmany32 = TIFFhowmany_32(td->td_imagewidth, td->td_tilewidth); |
| if (howmany32 == 0) |
| { |
| TIFFErrorExtR(tif, module, "Zero tiles"); |
| return 0; |
| } |
| tif->tif_row = (tile % howmany32) * td->td_tilelength; |
| howmany32 = TIFFhowmany_32(td->td_imagelength, td->td_tilelength); |
| if (howmany32 == 0) |
| { |
| TIFFErrorExtR(tif, module, "Zero tiles"); |
| return 0; |
| } |
| tif->tif_col = (tile % howmany32) * td->td_tilewidth; |
| tif->tif_flags &= ~TIFF_BUF4WRITE; |
| if (tif->tif_flags & TIFF_NOREADRAW) |
| { |
| tif->tif_rawcp = NULL; |
| tif->tif_rawcc = 0; |
| } |
| else |
| { |
| tif->tif_rawcp = tif->tif_rawdata; |
| if (tif->tif_rawdataloaded > 0) |
| tif->tif_rawcc = tif->tif_rawdataloaded; |
| else |
| tif->tif_rawcc = (tmsize_t)TIFFGetStrileByteCount(tif, tile); |
| } |
| return ( |
| (*tif->tif_predecode)(tif, (uint16_t)(tile / td->td_stripsperimage))); |
| } |
| |
| static int TIFFCheckRead(TIFF *tif, int tiles) |
| { |
| if (tif->tif_mode == O_WRONLY) |
| { |
| TIFFErrorExtR(tif, tif->tif_name, "File not open for reading"); |
| return (0); |
| } |
| if (tiles ^ isTiled(tif)) |
| { |
| TIFFErrorExtR(tif, tif->tif_name, |
| tiles ? "Can not read tiles from a striped image" |
| : "Can not read scanlines from a tiled image"); |
| return (0); |
| } |
| return (1); |
| } |
| |
| /* Use the provided input buffer (inbuf, insize) and decompress it into |
| * (outbuf, outsize). |
| * This function replaces the use of |
| * TIFFReadEncodedStrip()/TIFFReadEncodedTile() when the user can provide the |
| * buffer for the input data, for example when he wants to avoid libtiff to read |
| * the strile offset/count values from the [Strip|Tile][Offsets/ByteCounts] |
| * array. inbuf content must be writable (if bit reversal is needed) Returns 1 |
| * in case of success, 0 otherwise. |
| */ |
| int TIFFReadFromUserBuffer(TIFF *tif, uint32_t strile, void *inbuf, |
| tmsize_t insize, void *outbuf, tmsize_t outsize) |
| { |
| static const char module[] = "TIFFReadFromUserBuffer"; |
| TIFFDirectory *td = &tif->tif_dir; |
| int ret = 1; |
| uint32_t old_tif_flags = tif->tif_flags; |
| tmsize_t old_rawdatasize = tif->tif_rawdatasize; |
| void *old_rawdata = tif->tif_rawdata; |
| |
| if (tif->tif_mode == O_WRONLY) |
| { |
| TIFFErrorExtR(tif, tif->tif_name, "File not open for reading"); |
| return 0; |
| } |
| if (tif->tif_flags & TIFF_NOREADRAW) |
| { |
| TIFFErrorExtR(tif, module, |
| "Compression scheme does not support access to raw " |
| "uncompressed data"); |
| return 0; |
| } |
| |
| tif->tif_flags &= ~TIFF_MYBUFFER; |
| tif->tif_flags |= TIFF_BUFFERMMAP; |
| tif->tif_rawdatasize = insize; |
| tif->tif_rawdata = inbuf; |
| tif->tif_rawdataoff = 0; |
| tif->tif_rawdataloaded = insize; |
| |
| if (!isFillOrder(tif, td->td_fillorder) && |
| (tif->tif_flags & TIFF_NOBITREV) == 0) |
| { |
| TIFFReverseBits(inbuf, insize); |
| } |
| |
| if (TIFFIsTiled(tif)) |
| { |
| if (!TIFFStartTile(tif, strile) || |
| !(*tif->tif_decodetile)(tif, (uint8_t *)outbuf, outsize, |
| (uint16_t)(strile / td->td_stripsperimage))) |
| { |
| ret = 0; |
| } |
| } |
| else |
| { |
| uint32_t rowsperstrip = td->td_rowsperstrip; |
| uint32_t stripsperplane; |
| if (rowsperstrip > td->td_imagelength) |
| rowsperstrip = td->td_imagelength; |
| stripsperplane = |
| TIFFhowmany_32_maxuint_compat(td->td_imagelength, rowsperstrip); |
| if (!TIFFStartStrip(tif, strile) || |
| !(*tif->tif_decodestrip)(tif, (uint8_t *)outbuf, outsize, |
| (uint16_t)(strile / stripsperplane))) |
| { |
| ret = 0; |
| } |
| } |
| if (ret) |
| { |
| (*tif->tif_postdecode)(tif, (uint8_t *)outbuf, outsize); |
| } |
| |
| if (!isFillOrder(tif, td->td_fillorder) && |
| (tif->tif_flags & TIFF_NOBITREV) == 0) |
| { |
| TIFFReverseBits(inbuf, insize); |
| } |
| |
| tif->tif_flags = (old_tif_flags & (TIFF_MYBUFFER | TIFF_BUFFERMMAP)) | |
| (tif->tif_flags & ~(TIFF_MYBUFFER | TIFF_BUFFERMMAP)); |
| tif->tif_rawdatasize = old_rawdatasize; |
| tif->tif_rawdata = old_rawdata; |
| tif->tif_rawdataoff = 0; |
| tif->tif_rawdataloaded = 0; |
| |
| return ret; |
| } |
| |
| void _TIFFNoPostDecode(TIFF *tif, uint8_t *buf, tmsize_t cc) |
| { |
| (void)tif; |
| (void)buf; |
| (void)cc; |
| } |
| |
| void _TIFFSwab16BitData(TIFF *tif, uint8_t *buf, tmsize_t cc) |
| { |
| (void)tif; |
| assert((cc & 1) == 0); |
| TIFFSwabArrayOfShort((uint16_t *)buf, cc / 2); |
| } |
| |
| void _TIFFSwab24BitData(TIFF *tif, uint8_t *buf, tmsize_t cc) |
| { |
| (void)tif; |
| assert((cc % 3) == 0); |
| TIFFSwabArrayOfTriples((uint8_t *)buf, cc / 3); |
| } |
| |
| void _TIFFSwab32BitData(TIFF *tif, uint8_t *buf, tmsize_t cc) |
| { |
| (void)tif; |
| assert((cc & 3) == 0); |
| TIFFSwabArrayOfLong((uint32_t *)buf, cc / 4); |
| } |
| |
| void _TIFFSwab64BitData(TIFF *tif, uint8_t *buf, tmsize_t cc) |
| { |
| (void)tif; |
| assert((cc & 7) == 0); |
| TIFFSwabArrayOfDouble((double *)buf, cc / 8); |
| } |
