Line data Source code
1 : /*
2 : * Copyright (c) 1991-1997 Sam Leffler
3 : * Copyright (c) 1991-1997 Silicon Graphics, Inc.
4 : *
5 : * Permission to use, copy, modify, distribute, and sell this software and
6 : * its documentation for any purpose is hereby granted without fee, provided
7 : * that (i) the above copyright notices and this permission notice appear in
8 : * all copies of the software and related documentation, and (ii) the names of
9 : * Sam Leffler and Silicon Graphics may not be used in any advertising or
10 : * publicity relating to the software without the specific, prior written
11 : * permission of Sam Leffler and Silicon Graphics.
12 : *
13 : * THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND,
14 : * EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY
15 : * WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
16 : *
17 : * IN NO EVENT SHALL SAM LEFFLER OR SILICON GRAPHICS BE LIABLE FOR
18 : * ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND,
19 : * OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
20 : * WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF
21 : * LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
22 : * OF THIS SOFTWARE.
23 : */
24 :
25 : /*
26 : * TIFF Library.
27 : *
28 : * Auxiliary Support Routines.
29 : */
30 : #include "tif_predict.h"
31 : #include "tiffiop.h"
32 : #include <float.h>
33 : #include <math.h>
34 :
35 119524 : uint32_t _TIFFMultiply32(TIFF *tif, uint32_t first, uint32_t second,
36 : const char *where)
37 : {
38 119524 : if (second && first > UINT32_MAX / second)
39 : {
40 0 : TIFFErrorExtR(tif, where, "Integer overflow in %s", where);
41 0 : return 0;
42 : }
43 :
44 119524 : return first * second;
45 : }
46 :
47 15125200 : uint64_t _TIFFMultiply64(TIFF *tif, uint64_t first, uint64_t second,
48 : const char *where)
49 : {
50 15125200 : if (second && first > UINT64_MAX / second)
51 : {
52 0 : TIFFErrorExtR(tif, where, "Integer overflow in %s", where);
53 0 : return 0;
54 : }
55 :
56 15125200 : return first * second;
57 : }
58 :
59 79264 : uint64_t _TIFFAdd64(TIFF *tif, uint64_t first, uint64_t second,
60 : const char *where)
61 : {
62 79264 : if (first > UINT64_MAX - second)
63 : {
64 0 : if (tif != NULL && where != NULL)
65 : {
66 0 : TIFFErrorExtR(tif, where, "Integer overflow in %s", where);
67 : }
68 0 : return 0;
69 : }
70 :
71 79264 : return first + second;
72 : }
73 :
74 1487730 : tmsize_t _TIFFMultiplySSize(TIFF *tif, tmsize_t first, tmsize_t second,
75 : const char *where)
76 : {
77 1487730 : if (first <= 0 || second <= 0)
78 : {
79 193 : if (tif != NULL && where != NULL)
80 : {
81 0 : TIFFErrorExtR(tif, where,
82 : "Invalid argument to _TIFFMultiplySSize() in %s",
83 : where);
84 : }
85 4 : return 0;
86 : }
87 :
88 1487540 : if (first > TIFF_TMSIZE_T_MAX / second)
89 : {
90 0 : if (tif != NULL && where != NULL)
91 : {
92 0 : TIFFErrorExtR(tif, where, "Integer overflow in %s", where);
93 : }
94 0 : return 0;
95 : }
96 1487540 : return first * second;
97 : }
98 :
99 0 : tmsize_t _TIFFAddSSize(TIFF *tif, tmsize_t first, tmsize_t second,
100 : const char *where)
101 : {
102 0 : if (first < 0 || second < 0)
103 : {
104 0 : if (tif != NULL && where != NULL)
105 : {
106 0 : TIFFErrorExtR(tif, where,
107 : "Invalid argument to _TIFFAddSSize() in %s", where);
108 : }
109 0 : return 0;
110 : }
111 :
112 0 : if (first > TIFF_TMSIZE_T_MAX - second)
113 : {
114 0 : if (tif != NULL && where != NULL)
115 : {
116 0 : TIFFErrorExtR(tif, where, "Integer overflow in %s", where);
117 : }
118 0 : return 0;
119 : }
120 0 : return first + second;
121 : }
122 :
123 5022440 : tmsize_t _TIFFCastUInt64ToSSize(TIFF *tif, uint64_t val, const char *module)
124 : {
125 5022440 : if (val > (uint64_t)TIFF_TMSIZE_T_MAX)
126 : {
127 0 : if (tif != NULL && module != NULL)
128 : {
129 0 : TIFFErrorExtR(tif, module, "Integer overflow");
130 : }
131 0 : return 0;
132 : }
133 5022440 : return (tmsize_t)val;
134 : }
135 :
136 79416 : uint32_t _TIFFCastUInt64ToUInt32(TIFF *tif, uint64_t val, const char *module)
137 : {
138 79416 : if (val > UINT32_MAX)
139 : {
140 0 : if (tif != NULL && module != NULL)
141 : {
142 0 : TIFFErrorExtR(tif, module, "Integer overflow");
143 : }
144 0 : return 0;
145 : }
146 79416 : return (uint32_t)val;
147 : }
148 :
149 0 : tmsize_t _TIFFComputeRowOffset(TIFF *tif, tmsize_t rowstride, uint32_t row,
150 : const char *where)
151 : {
152 0 : if (row == 0)
153 0 : return 0;
154 0 : return _TIFFMultiplySSize(tif, rowstride, (tmsize_t)row, where);
155 : }
156 :
157 0 : uint64_t _TIFFComputeBitOffset(TIFF *tif, uint32_t col, uint16_t spp,
158 : uint16_t bps, const char *where)
159 : {
160 0 : uint64_t samples = _TIFFMultiply64(tif, col, spp, where);
161 0 : if (samples == 0 && col != 0)
162 0 : return 0;
163 0 : return _TIFFMultiply64(tif, samples, bps, where);
164 : }
165 :
166 : /*
167 : * Returns 0 on overflow or invalid zero-sized row inputs. Callers that
168 : * intentionally allow empty rows should not use this helper directly.
169 : */
170 0 : uint64_t _TIFFComputeRowSize64(TIFF *tif, uint32_t width, uint16_t spp,
171 : uint16_t bps, const char *where)
172 : {
173 0 : uint64_t samples = _TIFFMultiply64(tif, width, spp, where);
174 : uint64_t bits;
175 0 : if (samples == 0)
176 0 : return 0;
177 :
178 0 : bits = _TIFFMultiply64(tif, samples, bps, where);
179 0 : if (bits == 0)
180 0 : return 0;
181 :
182 0 : return TIFFhowmany8_64(bits);
183 : }
184 :
185 1428280 : void *_TIFFCheckRealloc(TIFF *tif, void *buffer, tmsize_t nmemb,
186 : tmsize_t elem_size, const char *what)
187 : {
188 1428280 : void *cp = NULL;
189 1428280 : tmsize_t count = _TIFFMultiplySSize(tif, nmemb, elem_size, NULL);
190 : /*
191 : * Check for integer overflow.
192 : */
193 1428170 : if (count != 0)
194 : {
195 1428170 : cp = _TIFFreallocExt(tif, buffer, count);
196 : }
197 :
198 1428240 : if (cp == NULL)
199 : {
200 4 : TIFFErrorExtR(tif, tif->tif_name,
201 : "Failed to allocate memory for %s "
202 : "(%" TIFF_SSIZE_FORMAT " elements of %" TIFF_SSIZE_FORMAT
203 : " bytes each)",
204 : what, nmemb, elem_size);
205 : }
206 :
207 1428250 : return cp;
208 : }
209 :
210 969180 : void *_TIFFCheckMalloc(TIFF *tif, tmsize_t nmemb, tmsize_t elem_size,
211 : const char *what)
212 : {
213 969180 : return _TIFFCheckRealloc(tif, NULL, nmemb, elem_size, what);
214 : }
215 :
216 2 : static int TIFFDefaultTransferFunction(TIFF *tif, TIFFDirectory *td)
217 : {
218 2 : uint16_t **tf = td->td_transferfunction;
219 : tmsize_t i, n, nbytes;
220 :
221 2 : tf[0] = tf[1] = tf[2] = 0;
222 : // Do not try to generate a default TransferFunction beyond 24 bits.
223 : // This otherwise leads to insane amounts, resulting in denial of service
224 : // See https://github.com/OSGeo/gdal/issues/10875
225 2 : if (td->td_bitspersample > 24)
226 0 : return 0;
227 :
228 2 : n = (tmsize_t)(1ULL << td->td_bitspersample);
229 2 : nbytes = (tmsize_t)((uint64_t)n * sizeof(uint16_t));
230 2 : tf[0] = (uint16_t *)_TIFFmallocExt(tif, nbytes);
231 2 : if (tf[0] == NULL)
232 0 : return 0;
233 2 : tf[0][0] = 0;
234 512 : for (i = 1; i < n; i++)
235 : {
236 510 : double t = (double)i / ((double)n - 1.);
237 510 : tf[0][i] = (uint16_t)floor(65535. * pow(t, 2.2) + .5);
238 : }
239 :
240 2 : if (td->td_samplesperpixel - td->td_extrasamples > 1)
241 : {
242 1 : tf[1] = (uint16_t *)_TIFFmallocExt(tif, nbytes);
243 1 : if (tf[1] == NULL)
244 0 : goto bad;
245 1 : _TIFFmemcpy(tf[1], tf[0], nbytes);
246 1 : tf[2] = (uint16_t *)_TIFFmallocExt(tif, nbytes);
247 1 : if (tf[2] == NULL)
248 0 : goto bad;
249 1 : _TIFFmemcpy(tf[2], tf[0], nbytes);
250 : }
251 2 : return 1;
252 :
253 0 : bad:
254 0 : if (tf[0])
255 0 : _TIFFfreeExt(tif, tf[0]);
256 0 : if (tf[1])
257 0 : _TIFFfreeExt(tif, tf[1]);
258 0 : if (tf[2])
259 0 : _TIFFfreeExt(tif, tf[2]);
260 0 : tf[0] = tf[1] = tf[2] = 0;
261 0 : return 0;
262 : }
263 :
264 0 : static int TIFFDefaultRefBlackWhite(TIFF *tif, TIFFDirectory *td)
265 : {
266 : int i;
267 :
268 0 : td->td_refblackwhite = (float *)_TIFFmallocExt(tif, 6 * sizeof(float));
269 0 : if (td->td_refblackwhite == NULL)
270 0 : return 0;
271 0 : if (td->td_photometric == PHOTOMETRIC_YCBCR)
272 : {
273 : /*
274 : * YCbCr (Class Y) images must have the ReferenceBlackWhite
275 : * tag set. Fix the broken images, which lacks that tag.
276 : */
277 0 : td->td_refblackwhite[0] = 0.0f;
278 0 : td->td_refblackwhite[1] = td->td_refblackwhite[3] =
279 0 : td->td_refblackwhite[5] = 255.0f;
280 0 : td->td_refblackwhite[2] = td->td_refblackwhite[4] = 128.0f;
281 : }
282 : else
283 : {
284 : /*
285 : * Assume RGB (Class R)
286 : */
287 0 : for (i = 0; i < 3; i++)
288 : {
289 0 : td->td_refblackwhite[2 * i + 0] = 0;
290 0 : if (td->td_bitspersample < 64)
291 0 : td->td_refblackwhite[2 * i + 1] =
292 0 : (float)((1ULL << td->td_bitspersample) - 1ULL);
293 : else
294 0 : td->td_refblackwhite[2 * i + 1] = (float)UINT64_MAX;
295 : }
296 : }
297 0 : return 1;
298 : }
299 :
300 : /*
301 : * Like TIFFGetField, but return any default
302 : * value if the tag is not present in the directory.
303 : *
304 : * NB: We use the value in the directory, rather than
305 : * explicit values so that defaults exist only one
306 : * place in the library -- in TIFFDefaultDirectory.
307 : */
308 11056 : int TIFFVGetFieldDefaulted(TIFF *tif, uint32_t tag, va_list ap)
309 : {
310 11056 : TIFFDirectory *td = &tif->tif_dir;
311 :
312 11056 : if (TIFFVGetField(tif, tag, ap))
313 10755 : return (1);
314 301 : switch (tag)
315 : {
316 0 : case TIFFTAG_SUBFILETYPE:
317 0 : *va_arg(ap, uint32_t *) = td->td_subfiletype;
318 0 : return (1);
319 0 : case TIFFTAG_BITSPERSAMPLE:
320 0 : *va_arg(ap, uint16_t *) = td->td_bitspersample;
321 0 : return (1);
322 0 : case TIFFTAG_THRESHHOLDING:
323 0 : *va_arg(ap, uint16_t *) = td->td_threshholding;
324 0 : return (1);
325 0 : case TIFFTAG_FILLORDER:
326 0 : *va_arg(ap, uint16_t *) = td->td_fillorder;
327 0 : return (1);
328 47 : case TIFFTAG_ORIENTATION:
329 47 : *va_arg(ap, uint16_t *) = td->td_orientation;
330 47 : return (1);
331 0 : case TIFFTAG_SAMPLESPERPIXEL:
332 0 : *va_arg(ap, uint16_t *) = td->td_samplesperpixel;
333 0 : return (1);
334 0 : case TIFFTAG_ROWSPERSTRIP:
335 0 : *va_arg(ap, uint32_t *) = td->td_rowsperstrip;
336 0 : return (1);
337 0 : case TIFFTAG_MINSAMPLEVALUE:
338 0 : *va_arg(ap, uint16_t *) = td->td_minsamplevalue;
339 0 : return (1);
340 0 : case TIFFTAG_MAXSAMPLEVALUE:
341 : {
342 : uint16_t maxsamplevalue;
343 : /* td_bitspersample=1 is always set in TIFFDefaultDirectory().
344 : * Therefore, td_maxsamplevalue has to be re-calculated in
345 : * TIFFGetFieldDefaulted(). */
346 0 : if (td->td_bitspersample > 0)
347 : {
348 : /* This shift operation into a uint16_t limits the value to
349 : * 65535 even if td_bitspersamle is > 16 */
350 0 : if (td->td_bitspersample <= 16)
351 : {
352 0 : maxsamplevalue = (uint16_t)((1U << td->td_bitspersample) -
353 : 1); /* 2**(BitsPerSample) - 1 */
354 : }
355 : else
356 : {
357 0 : maxsamplevalue = 65535;
358 : }
359 : }
360 : else
361 : {
362 0 : maxsamplevalue = 0;
363 : }
364 0 : *va_arg(ap, uint16_t *) = maxsamplevalue;
365 0 : return (1);
366 : }
367 0 : case TIFFTAG_PLANARCONFIG:
368 0 : *va_arg(ap, uint16_t *) = td->td_planarconfig;
369 0 : return (1);
370 0 : case TIFFTAG_RESOLUTIONUNIT:
371 0 : *va_arg(ap, uint16_t *) = td->td_resolutionunit;
372 0 : return (1);
373 0 : case TIFFTAG_PREDICTOR:
374 : {
375 0 : TIFFPredictorState *sp = (TIFFPredictorState *)tif->tif_data;
376 0 : if (sp == NULL)
377 : {
378 0 : TIFFErrorExtR(
379 0 : tif, tif->tif_name,
380 : "Cannot get \"Predictor\" tag as plugin is not configured");
381 0 : *va_arg(ap, uint16_t *) = 0;
382 0 : return 0;
383 : }
384 0 : *va_arg(ap, uint16_t *) = (uint16_t)sp->predictor;
385 0 : return 1;
386 : }
387 0 : case TIFFTAG_DOTRANGE:
388 0 : *va_arg(ap, uint16_t *) = 0;
389 0 : if (td->td_bitspersample <= 16)
390 0 : *va_arg(ap, uint16_t *) =
391 0 : (uint16_t)((1U << td->td_bitspersample) - 1);
392 : else
393 0 : *va_arg(ap, uint16_t *) = 65535;
394 0 : return (1);
395 22 : case TIFFTAG_INKSET:
396 22 : *va_arg(ap, uint16_t *) = INKSET_CMYK;
397 22 : return 1;
398 0 : case TIFFTAG_NUMBEROFINKS:
399 0 : *va_arg(ap, uint16_t *) = 4;
400 0 : return (1);
401 30 : case TIFFTAG_EXTRASAMPLES:
402 30 : *va_arg(ap, uint16_t *) = td->td_extrasamples;
403 30 : *va_arg(ap, const uint16_t **) = td->td_sampleinfo;
404 30 : return (1);
405 0 : case TIFFTAG_MATTEING:
406 0 : *va_arg(ap, uint16_t *) =
407 0 : (td->td_extrasamples == 1 && td->td_sampleinfo &&
408 0 : td->td_sampleinfo[0] == EXTRASAMPLE_ASSOCALPHA);
409 0 : return (1);
410 0 : case TIFFTAG_TILEDEPTH:
411 0 : *va_arg(ap, uint32_t *) = td->td_tiledepth;
412 0 : return (1);
413 0 : case TIFFTAG_DATATYPE:
414 0 : *va_arg(ap, uint16_t *) = (uint16_t)(td->td_sampleformat - 1);
415 0 : return (1);
416 0 : case TIFFTAG_SAMPLEFORMAT:
417 0 : *va_arg(ap, uint16_t *) = td->td_sampleformat;
418 0 : return (1);
419 0 : case TIFFTAG_IMAGEDEPTH:
420 0 : *va_arg(ap, uint32_t *) = td->td_imagedepth;
421 0 : return (1);
422 0 : case TIFFTAG_YCBCRCOEFFICIENTS:
423 : {
424 : /* defaults are from CCIR Recommendation 601-1 */
425 : static const float ycbcrcoeffs[] = {0.299f, 0.587f, 0.114f};
426 0 : *va_arg(ap, const float **) = ycbcrcoeffs;
427 0 : return 1;
428 : }
429 192 : case TIFFTAG_YCBCRSUBSAMPLING:
430 192 : *va_arg(ap, uint16_t *) = td->td_ycbcrsubsampling[0];
431 192 : *va_arg(ap, uint16_t *) = td->td_ycbcrsubsampling[1];
432 192 : return (1);
433 0 : case TIFFTAG_YCBCRPOSITIONING:
434 0 : *va_arg(ap, uint16_t *) = td->td_ycbcrpositioning;
435 0 : return (1);
436 1 : case TIFFTAG_WHITEPOINT:
437 : {
438 : /* TIFF 6.0 specification tells that it is no default
439 : value for the WhitePoint, but AdobePhotoshop TIFF
440 : Technical Note tells that it should be CIE D50. */
441 : static const float whitepoint[] = {
442 : D50_X0 / (D50_X0 + D50_Y0 + D50_Z0),
443 : D50_Y0 / (D50_X0 + D50_Y0 + D50_Z0)};
444 1 : *va_arg(ap, const float **) = whitepoint;
445 1 : return 1;
446 : }
447 2 : case TIFFTAG_TRANSFERFUNCTION:
448 4 : if (!td->td_transferfunction[0] &&
449 2 : !TIFFDefaultTransferFunction(tif, td))
450 : {
451 0 : TIFFErrorExtR(tif, tif->tif_name,
452 : "No space for \"TransferFunction\" tag");
453 0 : return (0);
454 : }
455 2 : *va_arg(ap, const uint16_t **) = td->td_transferfunction[0];
456 2 : if (td->td_samplesperpixel - td->td_extrasamples > 1)
457 : {
458 1 : *va_arg(ap, const uint16_t **) = td->td_transferfunction[1];
459 1 : *va_arg(ap, const uint16_t **) = td->td_transferfunction[2];
460 : }
461 2 : return (1);
462 0 : case TIFFTAG_REFERENCEBLACKWHITE:
463 0 : if (!td->td_refblackwhite && !TIFFDefaultRefBlackWhite(tif, td))
464 0 : return (0);
465 0 : *va_arg(ap, const float **) = td->td_refblackwhite;
466 0 : return (1);
467 7 : default:
468 7 : break;
469 : }
470 7 : return 0;
471 : }
472 :
473 : /*
474 : * Like TIFFGetField, but return any default
475 : * value if the tag is not present in the directory.
476 : */
477 11056 : int TIFFGetFieldDefaulted(TIFF *tif, uint32_t tag, ...)
478 : {
479 : int ok;
480 : va_list ap;
481 :
482 11056 : va_start(ap, tag);
483 11056 : ok = TIFFVGetFieldDefaulted(tif, tag, ap);
484 11056 : va_end(ap);
485 11056 : return (ok);
486 : }
487 :
488 264 : float _TIFFClampDoubleToFloat(double val)
489 : {
490 264 : if (val > (double)FLT_MAX)
491 0 : return FLT_MAX;
492 264 : if (val < -(double)FLT_MAX)
493 0 : return -FLT_MAX;
494 264 : return (float)val;
495 : }
496 :
497 0 : uint32_t _TIFFClampDoubleToUInt32(double val)
498 : {
499 0 : if (val < 0)
500 0 : return 0;
501 0 : if (val > 0xFFFFFFFFU || isnan(val))
502 0 : return 0xFFFFFFFFU;
503 0 : return (uint32_t)val;
504 : }
505 :
506 2565420 : int _TIFFSeekOK(TIFF *tif, toff_t off)
507 : {
508 : /* Huge offsets, especially -1 / UINT64_MAX, can cause issues */
509 : /* See http://bugzilla.maptools.org/show_bug.cgi?id=2726 */
510 2565420 : return off <= (~(uint64_t)0) / 2 && TIFFSeekFile(tif, off, SEEK_SET) == off;
511 : }
|
