Line data Source code
1 : /*
2 : * Copyright (c) 1991-1997 Sam Leffler
3 : * Copyright (c) 1991-1997 Silicon Graphics, Inc.
4 : *
5 : * Permission to use, copy, modify, distribute, and sell this software and
6 : * its documentation for any purpose is hereby granted without fee, provided
7 : * that (i) the above copyright notices and this permission notice appear in
8 : * all copies of the software and related documentation, and (ii) the names of
9 : * Sam Leffler and Silicon Graphics may not be used in any advertising or
10 : * publicity relating to the software without the specific, prior written
11 : * permission of Sam Leffler and Silicon Graphics.
12 : *
13 : * THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND,
14 : * EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY
15 : * WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
16 : *
17 : * IN NO EVENT SHALL SAM LEFFLER OR SILICON GRAPHICS BE LIABLE FOR
18 : * ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND,
19 : * OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
20 : * WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF
21 : * LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
22 : * OF THIS SOFTWARE.
23 : */
24 :
25 : /*
26 : * TIFF Library.
27 : *
28 : * Auxiliary Support Routines.
29 : */
30 : #include "tif_predict.h"
31 : #include "tiffiop.h"
32 : #include <float.h>
33 : #include <math.h>
34 :
35 100173 : uint32_t _TIFFMultiply32(TIFF *tif, uint32_t first, uint32_t second,
36 : const char *where)
37 : {
38 100173 : if (second && first > UINT32_MAX / second)
39 : {
40 0 : TIFFErrorExtR(tif, where, "Integer overflow in %s", where);
41 0 : return 0;
42 : }
43 :
44 100173 : return first * second;
45 : }
46 :
47 14255400 : uint64_t _TIFFMultiply64(TIFF *tif, uint64_t first, uint64_t second,
48 : const char *where)
49 : {
50 14255400 : if (second && first > UINT64_MAX / second)
51 : {
52 0 : TIFFErrorExtR(tif, where, "Integer overflow in %s", where);
53 0 : return 0;
54 : }
55 :
56 14255400 : return first * second;
57 : }
58 :
59 1267720 : tmsize_t _TIFFMultiplySSize(TIFF *tif, tmsize_t first, tmsize_t second,
60 : const char *where)
61 : {
62 1267720 : if (first <= 0 || second <= 0)
63 : {
64 277 : if (tif != NULL && where != NULL)
65 : {
66 0 : TIFFErrorExtR(tif, where,
67 : "Invalid argument to _TIFFMultiplySSize() in %s",
68 : where);
69 : }
70 4 : return 0;
71 : }
72 :
73 1267440 : if (first > TIFF_TMSIZE_T_MAX / second)
74 : {
75 0 : if (tif != NULL && where != NULL)
76 : {
77 0 : TIFFErrorExtR(tif, where, "Integer overflow in %s", where);
78 : }
79 0 : return 0;
80 : }
81 1267440 : return first * second;
82 : }
83 :
84 4754110 : tmsize_t _TIFFCastUInt64ToSSize(TIFF *tif, uint64_t val, const char *module)
85 : {
86 4754110 : if (val > (uint64_t)TIFF_TMSIZE_T_MAX)
87 : {
88 0 : if (tif != NULL && module != NULL)
89 : {
90 0 : TIFFErrorExtR(tif, module, "Integer overflow");
91 : }
92 0 : return 0;
93 : }
94 4754110 : return (tmsize_t)val;
95 : }
96 :
97 1217210 : void *_TIFFCheckRealloc(TIFF *tif, void *buffer, tmsize_t nmemb,
98 : tmsize_t elem_size, const char *what)
99 : {
100 1217210 : void *cp = NULL;
101 1217210 : tmsize_t count = _TIFFMultiplySSize(tif, nmemb, elem_size, NULL);
102 : /*
103 : * Check for integer overflow.
104 : */
105 1217120 : if (count != 0)
106 : {
107 1217010 : cp = _TIFFreallocExt(tif, buffer, count);
108 : }
109 :
110 1217270 : if (cp == NULL)
111 : {
112 4 : TIFFErrorExtR(tif, tif->tif_name,
113 : "Failed to allocate memory for %s "
114 : "(%" TIFF_SSIZE_FORMAT " elements of %" TIFF_SSIZE_FORMAT
115 : " bytes each)",
116 : what, nmemb, elem_size);
117 : }
118 :
119 1217170 : return cp;
120 : }
121 :
122 819276 : void *_TIFFCheckMalloc(TIFF *tif, tmsize_t nmemb, tmsize_t elem_size,
123 : const char *what)
124 : {
125 819276 : return _TIFFCheckRealloc(tif, NULL, nmemb, elem_size, what);
126 : }
127 :
128 2 : static int TIFFDefaultTransferFunction(TIFF *tif, TIFFDirectory *td)
129 : {
130 2 : uint16_t **tf = td->td_transferfunction;
131 : tmsize_t i, n, nbytes;
132 :
133 2 : tf[0] = tf[1] = tf[2] = 0;
134 : // Do not try to generate a default TransferFunction beyond 24 bits.
135 : // This otherwise leads to insane amounts, resulting in denial of service
136 : // See https://github.com/OSGeo/gdal/issues/10875
137 2 : if (td->td_bitspersample > 24)
138 0 : return 0;
139 :
140 2 : n = ((tmsize_t)1) << td->td_bitspersample;
141 2 : nbytes = n * sizeof(uint16_t);
142 2 : tf[0] = (uint16_t *)_TIFFmallocExt(tif, nbytes);
143 2 : if (tf[0] == NULL)
144 0 : return 0;
145 2 : tf[0][0] = 0;
146 512 : for (i = 1; i < n; i++)
147 : {
148 510 : double t = (double)i / ((double)n - 1.);
149 510 : tf[0][i] = (uint16_t)floor(65535. * pow(t, 2.2) + .5);
150 : }
151 :
152 2 : if (td->td_samplesperpixel - td->td_extrasamples > 1)
153 : {
154 1 : tf[1] = (uint16_t *)_TIFFmallocExt(tif, nbytes);
155 1 : if (tf[1] == NULL)
156 0 : goto bad;
157 1 : _TIFFmemcpy(tf[1], tf[0], nbytes);
158 1 : tf[2] = (uint16_t *)_TIFFmallocExt(tif, nbytes);
159 1 : if (tf[2] == NULL)
160 0 : goto bad;
161 1 : _TIFFmemcpy(tf[2], tf[0], nbytes);
162 : }
163 2 : return 1;
164 :
165 0 : bad:
166 0 : if (tf[0])
167 0 : _TIFFfreeExt(tif, tf[0]);
168 0 : if (tf[1])
169 0 : _TIFFfreeExt(tif, tf[1]);
170 0 : if (tf[2])
171 0 : _TIFFfreeExt(tif, tf[2]);
172 0 : tf[0] = tf[1] = tf[2] = 0;
173 0 : return 0;
174 : }
175 :
176 0 : static int TIFFDefaultRefBlackWhite(TIFF *tif, TIFFDirectory *td)
177 : {
178 : int i;
179 :
180 0 : td->td_refblackwhite = (float *)_TIFFmallocExt(tif, 6 * sizeof(float));
181 0 : if (td->td_refblackwhite == NULL)
182 0 : return 0;
183 0 : if (td->td_photometric == PHOTOMETRIC_YCBCR)
184 : {
185 : /*
186 : * YCbCr (Class Y) images must have the ReferenceBlackWhite
187 : * tag set. Fix the broken images, which lacks that tag.
188 : */
189 0 : td->td_refblackwhite[0] = 0.0F;
190 0 : td->td_refblackwhite[1] = td->td_refblackwhite[3] =
191 0 : td->td_refblackwhite[5] = 255.0F;
192 0 : td->td_refblackwhite[2] = td->td_refblackwhite[4] = 128.0F;
193 : }
194 : else
195 : {
196 : /*
197 : * Assume RGB (Class R)
198 : */
199 0 : for (i = 0; i < 3; i++)
200 : {
201 0 : td->td_refblackwhite[2 * i + 0] = 0;
202 0 : td->td_refblackwhite[2 * i + 1] =
203 0 : (float)((1L << td->td_bitspersample) - 1L);
204 : }
205 : }
206 0 : return 1;
207 : }
208 :
209 : /*
210 : * Like TIFFGetField, but return any default
211 : * value if the tag is not present in the directory.
212 : *
213 : * NB: We use the value in the directory, rather than
214 : * explicit values so that defaults exist only one
215 : * place in the library -- in TIFFDefaultDirectory.
216 : */
217 11818 : int TIFFVGetFieldDefaulted(TIFF *tif, uint32_t tag, va_list ap)
218 : {
219 11818 : TIFFDirectory *td = &tif->tif_dir;
220 :
221 11818 : if (TIFFVGetField(tif, tag, ap))
222 10112 : return (1);
223 1706 : switch (tag)
224 : {
225 0 : case TIFFTAG_SUBFILETYPE:
226 0 : *va_arg(ap, uint32_t *) = td->td_subfiletype;
227 0 : return (1);
228 0 : case TIFFTAG_BITSPERSAMPLE:
229 0 : *va_arg(ap, uint16_t *) = td->td_bitspersample;
230 0 : return (1);
231 0 : case TIFFTAG_THRESHHOLDING:
232 0 : *va_arg(ap, uint16_t *) = td->td_threshholding;
233 0 : return (1);
234 0 : case TIFFTAG_FILLORDER:
235 0 : *va_arg(ap, uint16_t *) = td->td_fillorder;
236 0 : return (1);
237 47 : case TIFFTAG_ORIENTATION:
238 47 : *va_arg(ap, uint16_t *) = td->td_orientation;
239 47 : return (1);
240 0 : case TIFFTAG_SAMPLESPERPIXEL:
241 0 : *va_arg(ap, uint16_t *) = td->td_samplesperpixel;
242 0 : return (1);
243 0 : case TIFFTAG_ROWSPERSTRIP:
244 0 : *va_arg(ap, uint32_t *) = td->td_rowsperstrip;
245 0 : return (1);
246 0 : case TIFFTAG_MINSAMPLEVALUE:
247 0 : *va_arg(ap, uint16_t *) = td->td_minsamplevalue;
248 0 : return (1);
249 0 : case TIFFTAG_MAXSAMPLEVALUE:
250 : {
251 : uint16_t maxsamplevalue;
252 : /* td_bitspersample=1 is always set in TIFFDefaultDirectory().
253 : * Therefore, td_maxsamplevalue has to be re-calculated in
254 : * TIFFGetFieldDefaulted(). */
255 0 : if (td->td_bitspersample > 0)
256 : {
257 : /* This shift operation into a uint16_t limits the value to
258 : * 65535 even if td_bitspersamle is > 16 */
259 0 : if (td->td_bitspersample <= 16)
260 : {
261 0 : maxsamplevalue = (1 << td->td_bitspersample) -
262 : 1; /* 2**(BitsPerSample) - 1 */
263 : }
264 : else
265 : {
266 0 : maxsamplevalue = 65535;
267 : }
268 : }
269 : else
270 : {
271 0 : maxsamplevalue = 0;
272 : }
273 0 : *va_arg(ap, uint16_t *) = maxsamplevalue;
274 0 : return (1);
275 : }
276 0 : case TIFFTAG_PLANARCONFIG:
277 0 : *va_arg(ap, uint16_t *) = td->td_planarconfig;
278 0 : return (1);
279 0 : case TIFFTAG_RESOLUTIONUNIT:
280 0 : *va_arg(ap, uint16_t *) = td->td_resolutionunit;
281 0 : return (1);
282 0 : case TIFFTAG_PREDICTOR:
283 : {
284 0 : TIFFPredictorState *sp = (TIFFPredictorState *)tif->tif_data;
285 0 : if (sp == NULL)
286 : {
287 0 : TIFFErrorExtR(
288 0 : tif, tif->tif_name,
289 : "Cannot get \"Predictor\" tag as plugin is not configured");
290 0 : *va_arg(ap, uint16_t *) = 0;
291 0 : return 0;
292 : }
293 0 : *va_arg(ap, uint16_t *) = (uint16_t)sp->predictor;
294 0 : return 1;
295 : }
296 0 : case TIFFTAG_DOTRANGE:
297 0 : *va_arg(ap, uint16_t *) = 0;
298 0 : *va_arg(ap, uint16_t *) = (1 << td->td_bitspersample) - 1;
299 0 : return (1);
300 28 : case TIFFTAG_INKSET:
301 28 : *va_arg(ap, uint16_t *) = INKSET_CMYK;
302 28 : return 1;
303 0 : case TIFFTAG_NUMBEROFINKS:
304 0 : *va_arg(ap, uint16_t *) = 4;
305 0 : return (1);
306 30 : case TIFFTAG_EXTRASAMPLES:
307 30 : *va_arg(ap, uint16_t *) = td->td_extrasamples;
308 30 : *va_arg(ap, const uint16_t **) = td->td_sampleinfo;
309 30 : return (1);
310 0 : case TIFFTAG_MATTEING:
311 0 : *va_arg(ap, uint16_t *) =
312 0 : (td->td_extrasamples == 1 &&
313 0 : td->td_sampleinfo[0] == EXTRASAMPLE_ASSOCALPHA);
314 0 : return (1);
315 0 : case TIFFTAG_TILEDEPTH:
316 0 : *va_arg(ap, uint32_t *) = td->td_tiledepth;
317 0 : return (1);
318 0 : case TIFFTAG_DATATYPE:
319 0 : *va_arg(ap, uint16_t *) = td->td_sampleformat - 1;
320 0 : return (1);
321 0 : case TIFFTAG_SAMPLEFORMAT:
322 0 : *va_arg(ap, uint16_t *) = td->td_sampleformat;
323 0 : return (1);
324 0 : case TIFFTAG_IMAGEDEPTH:
325 0 : *va_arg(ap, uint32_t *) = td->td_imagedepth;
326 0 : return (1);
327 0 : case TIFFTAG_YCBCRCOEFFICIENTS:
328 : {
329 : /* defaults are from CCIR Recommendation 601-1 */
330 : static const float ycbcrcoeffs[] = {0.299f, 0.587f, 0.114f};
331 0 : *va_arg(ap, const float **) = ycbcrcoeffs;
332 0 : return 1;
333 : }
334 1591 : case TIFFTAG_YCBCRSUBSAMPLING:
335 1591 : *va_arg(ap, uint16_t *) = td->td_ycbcrsubsampling[0];
336 1591 : *va_arg(ap, uint16_t *) = td->td_ycbcrsubsampling[1];
337 1591 : return (1);
338 0 : case TIFFTAG_YCBCRPOSITIONING:
339 0 : *va_arg(ap, uint16_t *) = td->td_ycbcrpositioning;
340 0 : return (1);
341 1 : case TIFFTAG_WHITEPOINT:
342 : {
343 : /* TIFF 6.0 specification tells that it is no default
344 : value for the WhitePoint, but AdobePhotoshop TIFF
345 : Technical Note tells that it should be CIE D50. */
346 : static const float whitepoint[] = {
347 : D50_X0 / (D50_X0 + D50_Y0 + D50_Z0),
348 : D50_Y0 / (D50_X0 + D50_Y0 + D50_Z0)};
349 1 : *va_arg(ap, const float **) = whitepoint;
350 1 : return 1;
351 : }
352 2 : case TIFFTAG_TRANSFERFUNCTION:
353 4 : if (!td->td_transferfunction[0] &&
354 2 : !TIFFDefaultTransferFunction(tif, td))
355 : {
356 0 : TIFFErrorExtR(tif, tif->tif_name,
357 : "No space for \"TransferFunction\" tag");
358 0 : return (0);
359 : }
360 2 : *va_arg(ap, const uint16_t **) = td->td_transferfunction[0];
361 2 : if (td->td_samplesperpixel - td->td_extrasamples > 1)
362 : {
363 1 : *va_arg(ap, const uint16_t **) = td->td_transferfunction[1];
364 1 : *va_arg(ap, const uint16_t **) = td->td_transferfunction[2];
365 : }
366 2 : return (1);
367 0 : case TIFFTAG_REFERENCEBLACKWHITE:
368 0 : if (!td->td_refblackwhite && !TIFFDefaultRefBlackWhite(tif, td))
369 0 : return (0);
370 0 : *va_arg(ap, const float **) = td->td_refblackwhite;
371 0 : return (1);
372 : }
373 7 : return 0;
374 : }
375 :
376 : /*
377 : * Like TIFFGetField, but return any default
378 : * value if the tag is not present in the directory.
379 : */
380 11818 : int TIFFGetFieldDefaulted(TIFF *tif, uint32_t tag, ...)
381 : {
382 : int ok;
383 : va_list ap;
384 :
385 11818 : va_start(ap, tag);
386 11818 : ok = TIFFVGetFieldDefaulted(tif, tag, ap);
387 11818 : va_end(ap);
388 11818 : return (ok);
389 : }
390 :
391 262 : float _TIFFClampDoubleToFloat(double val)
392 : {
393 262 : if (val > FLT_MAX)
394 0 : return FLT_MAX;
395 262 : if (val < -FLT_MAX)
396 0 : return -FLT_MAX;
397 262 : return (float)val;
398 : }
399 :
400 0 : uint32_t _TIFFClampDoubleToUInt32(double val)
401 : {
402 0 : if (val < 0)
403 0 : return 0;
404 0 : if (val > 0xFFFFFFFFU || val != val)
405 0 : return 0xFFFFFFFFU;
406 0 : return (uint32_t)val;
407 : }
408 :
409 2441310 : int _TIFFSeekOK(TIFF *tif, toff_t off)
410 : {
411 : /* Huge offsets, especially -1 / UINT64_MAX, can cause issues */
412 : /* See http://bugzilla.maptools.org/show_bug.cgi?id=2726 */
413 2441310 : return off <= (~(uint64_t)0) / 2 && TIFFSeekFile(tif, off, SEEK_SET) == off;
414 : }
|
