LCOV - code coverage report
Current view: top level - frmts/gtiff/libtiff - tif_fax3.c (source / functions) Hit Total Coverage
Test: gdal_filtered.info Lines: 510 745 68.5 %
Date: 2025-01-18 12:42:00 Functions: 29 35 82.9 %

          Line data    Source code
       1             : /*
       2             :  * Copyright (c) 1990-1997 Sam Leffler
       3             :  * Copyright (c) 1991-1997 Silicon Graphics, Inc.
       4             :  *
       5             :  * Permission to use, copy, modify, distribute, and sell this software and
       6             :  * its documentation for any purpose is hereby granted without fee, provided
       7             :  * that (i) the above copyright notices and this permission notice appear in
       8             :  * all copies of the software and related documentation, and (ii) the names of
       9             :  * Sam Leffler and Silicon Graphics may not be used in any advertising or
      10             :  * publicity relating to the software without the specific, prior written
      11             :  * permission of Sam Leffler and Silicon Graphics.
      12             :  *
      13             :  * THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND,
      14             :  * EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY
      15             :  * WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
      16             :  *
      17             :  * IN NO EVENT SHALL SAM LEFFLER OR SILICON GRAPHICS BE LIABLE FOR
      18             :  * ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND,
      19             :  * OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
      20             :  * WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF
      21             :  * LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
      22             :  * OF THIS SOFTWARE.
      23             :  */
      24             : 
      25             : #include "tiffiop.h"
      26             : #ifdef CCITT_SUPPORT
      27             : /*
      28             :  * TIFF Library.
      29             :  *
      30             :  * CCITT Group 3 (T.4) and Group 4 (T.6) Compression Support.
      31             :  *
      32             :  * This file contains support for decoding and encoding TIFF
      33             :  * compression algorithms 2, 3, 4, and 32771.
      34             :  *
      35             :  * Decoder support is derived, with permission, from the code
      36             :  * in Frank Cringle's viewfax program;
      37             :  *      Copyright (C) 1990, 1995  Frank D. Cringle.
      38             :  */
      39             : #include "tif_fax3.h"
      40             : #define G3CODES
      41             : #include "t4.h"
      42             : #include <stdio.h>
      43             : 
      44             : #ifndef EOF_REACHED_COUNT_THRESHOLD
      45             : /* Arbitrary threshold to avoid corrupted single-strip files with extremely
      46             :  * large imageheight to cause apparently endless looping, such as in
      47             :  * https://gitlab.com/libtiff/libtiff/-/issues/583
      48             :  */
      49             : #define EOF_REACHED_COUNT_THRESHOLD 8192
      50             : #endif
      51             : 
      52             : /*
      53             :  * Compression+decompression state blocks are
      54             :  * derived from this ``base state'' block.
      55             :  */
      56             : typedef struct
      57             : {
      58             :     int rw_mode;        /* O_RDONLY for decode, else encode */
      59             :     int mode;           /* operating mode */
      60             :     tmsize_t rowbytes;  /* bytes in a decoded scanline */
      61             :     uint32_t rowpixels; /* pixels in a scanline */
      62             : 
      63             :     uint16_t cleanfaxdata; /* CleanFaxData tag */
      64             :     uint32_t badfaxrun;    /* BadFaxRun tag */
      65             :     uint32_t badfaxlines;  /* BadFaxLines tag */
      66             :     uint32_t groupoptions; /* Group 3/4 options tag */
      67             : 
      68             :     TIFFVGetMethod vgetparent; /* super-class method */
      69             :     TIFFVSetMethod vsetparent; /* super-class method */
      70             :     TIFFPrintMethod printdir;  /* super-class method */
      71             : } Fax3BaseState;
      72             : #define Fax3State(tif) ((Fax3BaseState *)(tif)->tif_data)
      73             : 
      74             : typedef enum
      75             : {
      76             :     G3_1D,
      77             :     G3_2D
      78             : } Ttag;
      79             : typedef struct
      80             : {
      81             :     Fax3BaseState b;
      82             : 
      83             :     /* Decoder state info */
      84             :     const unsigned char *bitmap; /* bit reversal table */
      85             :     uint32_t data;               /* current i/o byte/word */
      86             :     int bit;                     /* current i/o bit in byte */
      87             :     int EOLcnt;                  /* count of EOL codes recognized */
      88             :     int eofReachedCount;         /* number of times decode has been called with
      89             :                                     EOF already reached */
      90             :     TIFFFaxFillFunc fill;        /* fill routine */
      91             :     uint32_t *runs;              /* b&w runs for current/previous row */
      92             :     uint32_t nruns;              /* size of the refruns / curruns arrays */
      93             :     uint32_t *refruns;           /* runs for reference line */
      94             :     uint32_t *curruns;           /* runs for current line */
      95             : 
      96             :     /* Encoder state info */
      97             :     Ttag tag;               /* encoding state */
      98             :     unsigned char *refline; /* reference line for 2d decoding */
      99             :     int k;                  /* #rows left that can be 2d encoded */
     100             :     int maxk;               /* max #rows that can be 2d encoded */
     101             : 
     102             :     int line;
     103             : } Fax3CodecState;
     104             : #define DecoderState(tif) ((Fax3CodecState *)Fax3State(tif))
     105             : #define EncoderState(tif) ((Fax3CodecState *)Fax3State(tif))
     106             : 
     107             : #define is2DEncoding(sp) (sp->b.groupoptions & GROUP3OPT_2DENCODING)
     108             : #define isAligned(p, t) ((((size_t)(p)) & (sizeof(t) - 1)) == 0)
     109             : 
     110             : /*
     111             :  * Group 3 and Group 4 Decoding.
     112             :  */
     113             : 
     114             : /*
     115             :  * These macros glue the TIFF library state to
     116             :  * the state expected by Frank's decoder.
     117             :  */
     118             : #define DECLARE_STATE(tif, sp, mod)                                            \
     119             :     static const char module[] = mod;                                          \
     120             :     Fax3CodecState *sp = DecoderState(tif);                                    \
     121             :     int a0;                                   /* reference element */          \
     122             :     int lastx = sp->b.rowpixels;              /* last element in row */        \
     123             :     uint32_t BitAcc;                          /* bit accumulator */            \
     124             :     int BitsAvail;                            /* # valid bits in BitAcc */     \
     125             :     int RunLength;                            /* length of current run */      \
     126             :     unsigned char *cp;                        /* next byte of input data */    \
     127             :     unsigned char *ep;                        /* end of input data */          \
     128             :     uint32_t *pa;                             /* place to stuff next run */    \
     129             :     uint32_t *thisrun;                        /* current row's run array */    \
     130             :     int EOLcnt;                               /* # EOL codes recognized */     \
     131             :     const unsigned char *bitmap = sp->bitmap; /* input data bit reverser */    \
     132             :     const TIFFFaxTabEnt *TabEnt
     133             : 
     134             : #define DECLARE_STATE_2D(tif, sp, mod)                                         \
     135             :     DECLARE_STATE(tif, sp, mod);                                               \
     136             :     int b1; /* next change on prev line */                                     \
     137             :     uint32_t                                                                   \
     138             :         *pb /* next run in reference line */ /*                                \
     139             :                                               * Load any state that may be     \
     140             :                                               * changed during decoding.       \
     141             :                                               */
     142             : #define CACHE_STATE(tif, sp)                                                   \
     143             :     do                                                                         \
     144             :     {                                                                          \
     145             :         BitAcc = sp->data;                                                     \
     146             :         BitsAvail = sp->bit;                                                   \
     147             :         EOLcnt = sp->EOLcnt;                                                   \
     148             :         cp = (unsigned char *)tif->tif_rawcp;                                  \
     149             :         ep = cp + tif->tif_rawcc;                                              \
     150             :     } while (0)
     151             : /*
     152             :  * Save state possibly changed during decoding.
     153             :  */
     154             : #define UNCACHE_STATE(tif, sp)                                                 \
     155             :     do                                                                         \
     156             :     {                                                                          \
     157             :         sp->bit = BitsAvail;                                                   \
     158             :         sp->data = BitAcc;                                                     \
     159             :         sp->EOLcnt = EOLcnt;                                                   \
     160             :         tif->tif_rawcc -= (tmsize_t)((uint8_t *)cp - tif->tif_rawcp);          \
     161             :         tif->tif_rawcp = (uint8_t *)cp;                                        \
     162             :     } while (0)
     163             : 
     164             : /*
     165             :  * Setup state for decoding a strip.
     166             :  */
     167          13 : static int Fax3PreDecode(TIFF *tif, uint16_t s)
     168             : {
     169          13 :     Fax3CodecState *sp = DecoderState(tif);
     170             : 
     171             :     (void)s;
     172          13 :     assert(sp != NULL);
     173          13 :     sp->bit = 0; /* force initial read */
     174          13 :     sp->data = 0;
     175          13 :     sp->EOLcnt = 0; /* force initial scan for EOL */
     176          13 :     sp->eofReachedCount = 0;
     177             :     /*
     178             :      * Decoder assumes lsb-to-msb bit order.  Note that we select
     179             :      * this here rather than in Fax3SetupState so that viewers can
     180             :      * hold the image open, fiddle with the FillOrder tag value,
     181             :      * and then re-decode the image.  Otherwise they'd need to close
     182             :      * and open the image to get the state reset.
     183             :      */
     184          13 :     sp->bitmap =
     185          13 :         TIFFGetBitRevTable(tif->tif_dir.td_fillorder != FILLORDER_LSB2MSB);
     186          13 :     sp->curruns = sp->runs;
     187          13 :     if (sp->refruns)
     188             :     { /* init reference line to white */
     189          11 :         sp->refruns = sp->runs + sp->nruns;
     190          11 :         sp->refruns[0] = (uint32_t)sp->b.rowpixels;
     191          11 :         sp->refruns[1] = 0;
     192             :     }
     193          13 :     sp->line = 0;
     194          13 :     return (1);
     195             : }
     196             : 
     197             : /*
     198             :  * Routine for handling various errors/conditions.
     199             :  * Note how they are "glued into the decoder" by
     200             :  * overriding the definitions used by the decoder.
     201             :  */
     202             : 
     203           0 : static void Fax3Unexpected(const char *module, TIFF *tif, uint32_t line,
     204             :                            uint32_t a0)
     205             : {
     206           0 :     TIFFErrorExtR(tif, module,
     207             :                   "Bad code word at line %" PRIu32 " of %s %" PRIu32
     208             :                   " (x %" PRIu32 ")",
     209           0 :                   line, isTiled(tif) ? "tile" : "strip",
     210           0 :                   (isTiled(tif) ? tif->tif_curtile : tif->tif_curstrip), a0);
     211           0 : }
     212             : #define unexpected(table, a0) Fax3Unexpected(module, tif, sp->line, a0)
     213             : 
     214           0 : static void Fax3Extension(const char *module, TIFF *tif, uint32_t line,
     215             :                           uint32_t a0)
     216             : {
     217           0 :     TIFFErrorExtR(tif, module,
     218             :                   "Uncompressed data (not supported) at line %" PRIu32
     219             :                   " of %s %" PRIu32 " (x %" PRIu32 ")",
     220           0 :                   line, isTiled(tif) ? "tile" : "strip",
     221           0 :                   (isTiled(tif) ? tif->tif_curtile : tif->tif_curstrip), a0);
     222           0 : }
     223             : #define extension(a0) Fax3Extension(module, tif, sp->line, a0)
     224             : 
     225           0 : static void Fax3BadLength(const char *module, TIFF *tif, uint32_t line,
     226             :                           uint32_t a0, uint32_t lastx)
     227             : {
     228           0 :     TIFFWarningExtR(tif, module,
     229             :                     "%s at line %" PRIu32 " of %s %" PRIu32 " (got %" PRIu32
     230             :                     ", expected %" PRIu32 ")",
     231             :                     a0 < lastx ? "Premature EOL" : "Line length mismatch", line,
     232           0 :                     isTiled(tif) ? "tile" : "strip",
     233           0 :                     (isTiled(tif) ? tif->tif_curtile : tif->tif_curstrip), a0,
     234             :                     lastx);
     235           0 : }
     236             : #define badlength(a0, lastx) Fax3BadLength(module, tif, sp->line, a0, lastx)
     237             : 
     238           0 : static void Fax3PrematureEOF(const char *module, TIFF *tif, uint32_t line,
     239             :                              uint32_t a0)
     240             : {
     241           0 :     TIFFWarningExtR(tif, module,
     242             :                     "Premature EOF at line %" PRIu32 " of %s %" PRIu32
     243             :                     " (x %" PRIu32 ")",
     244           0 :                     line, isTiled(tif) ? "tile" : "strip",
     245           0 :                     (isTiled(tif) ? tif->tif_curtile : tif->tif_curstrip), a0);
     246           0 : }
     247             : #define prematureEOF(a0)                                                       \
     248             :     do                                                                         \
     249             :     {                                                                          \
     250             :         Fax3PrematureEOF(module, tif, sp->line, a0);                           \
     251             :         ++sp->eofReachedCount;                                                 \
     252             :     } while (0)
     253             : 
     254             : #define Nop
     255             : 
     256             : /**
     257             :  * Decode the requested amount of G3 1D-encoded data.
     258             :  * @param buf destination buffer
     259             :  * @param occ available bytes in destination buffer
     260             :  * @param s number of planes (ignored)
     261             :  * @returns 1 for success, -1 in case of error
     262             :  */
     263           1 : static int Fax3Decode1D(TIFF *tif, uint8_t *buf, tmsize_t occ, uint16_t s)
     264             : {
     265           1 :     DECLARE_STATE(tif, sp, "Fax3Decode1D");
     266             :     (void)s;
     267           1 :     if (occ % sp->b.rowbytes)
     268             :     {
     269           0 :         TIFFErrorExtR(tif, module, "Fractional scanlines cannot be read");
     270           0 :         return (-1);
     271             :     }
     272           1 :     if (sp->eofReachedCount >= EOF_REACHED_COUNT_THRESHOLD)
     273             :     {
     274           0 :         TIFFErrorExtR(
     275             :             tif, module,
     276             :             "End of file has already been reached %d times within that strip",
     277             :             sp->eofReachedCount);
     278           0 :         return (-1);
     279             :     }
     280           1 :     CACHE_STATE(tif, sp);
     281           1 :     thisrun = sp->curruns;
     282         100 :     while (occ > 0)
     283             :     {
     284          99 :         a0 = 0;
     285          99 :         RunLength = 0;
     286          99 :         pa = thisrun;
     287             : #ifdef FAX3_DEBUG
     288             :         printf("\nBitAcc=%08" PRIX32 ", BitsAvail = %d\n", BitAcc, BitsAvail);
     289             :         printf("-------------------- %" PRIu32 "\n", tif->tif_row);
     290             :         fflush(stdout);
     291             : #endif
     292         693 :         SYNC_EOL(EOF1D);
     293        1323 :         EXPAND1D(EOF1Da);
     294          99 :         (*sp->fill)(buf, thisrun, pa, lastx);
     295          99 :         buf += sp->b.rowbytes;
     296          99 :         occ -= sp->b.rowbytes;
     297          99 :         sp->line++;
     298          99 :         continue;
     299           0 :     EOF1D: /* premature EOF */
     300           0 :         CLEANUP_RUNS();
     301           0 :     EOF1Da: /* premature EOF */
     302           0 :         (*sp->fill)(buf, thisrun, pa, lastx);
     303           0 :         UNCACHE_STATE(tif, sp);
     304           0 :         return (-1);
     305             :     }
     306           1 :     UNCACHE_STATE(tif, sp);
     307           1 :     return (1);
     308             : }
     309             : 
     310             : #define SWAP(t, a, b)                                                          \
     311             :     {                                                                          \
     312             :         t x;                                                                   \
     313             :         x = (a);                                                               \
     314             :         (a) = (b);                                                             \
     315             :         (b) = x;                                                               \
     316             :     }
     317             : /*
     318             :  * Decode the requested amount of G3 2D-encoded data.
     319             :  */
     320           1 : static int Fax3Decode2D(TIFF *tif, uint8_t *buf, tmsize_t occ, uint16_t s)
     321             : {
     322           1 :     DECLARE_STATE_2D(tif, sp, "Fax3Decode2D");
     323             :     int is1D; /* current line is 1d/2d-encoded */
     324             :     (void)s;
     325           1 :     if (occ % sp->b.rowbytes)
     326             :     {
     327           0 :         TIFFErrorExtR(tif, module, "Fractional scanlines cannot be read");
     328           0 :         return (-1);
     329             :     }
     330           1 :     if (sp->eofReachedCount >= EOF_REACHED_COUNT_THRESHOLD)
     331             :     {
     332           0 :         TIFFErrorExtR(
     333             :             tif, module,
     334             :             "End of file has already been reached %d times within that strip",
     335             :             sp->eofReachedCount);
     336           0 :         return (-1);
     337             :     }
     338           1 :     CACHE_STATE(tif, sp);
     339        1025 :     while (occ > 0)
     340             :     {
     341        1024 :         a0 = 0;
     342        1024 :         RunLength = 0;
     343        1024 :         pa = thisrun = sp->curruns;
     344             : #ifdef FAX3_DEBUG
     345             :         printf("\nBitAcc=%08" PRIX32 ", BitsAvail = %d EOLcnt = %d", BitAcc,
     346             :                BitsAvail, EOLcnt);
     347             : #endif
     348        7168 :         SYNC_EOL(EOF2D);
     349        1024 :         NeedBits8(1, EOF2D);
     350        1024 :         is1D = GetBits(1); /* 1D/2D-encoding tag bit */
     351        1024 :         ClrBits(1);
     352             : #ifdef FAX3_DEBUG
     353             :         printf(" %s\n-------------------- %" PRIu32 "\n", is1D ? "1D" : "2D",
     354             :                tif->tif_row);
     355             :         fflush(stdout);
     356             : #endif
     357        1024 :         pb = sp->refruns;
     358        1024 :         b1 = *pb++;
     359        1024 :         if (is1D)
     360         737 :             EXPAND1D(EOF2Da);
     361             :         else
     362        3072 :             EXPAND2D(EOF2Da);
     363        1024 :         (*sp->fill)(buf, thisrun, pa, lastx);
     364        1024 :         if (pa < thisrun + sp->nruns)
     365             :         {
     366        1024 :             SETVALUE(0); /* imaginary change for reference */
     367             :         }
     368        1024 :         SWAP(uint32_t *, sp->curruns, sp->refruns);
     369        1024 :         buf += sp->b.rowbytes;
     370        1024 :         occ -= sp->b.rowbytes;
     371        1024 :         sp->line++;
     372        1024 :         continue;
     373           0 :     EOF2D: /* premature EOF */
     374           0 :         CLEANUP_RUNS();
     375           0 :     EOF2Da: /* premature EOF */
     376           0 :         (*sp->fill)(buf, thisrun, pa, lastx);
     377           0 :         UNCACHE_STATE(tif, sp);
     378           0 :         return (-1);
     379             :     }
     380           1 :     UNCACHE_STATE(tif, sp);
     381           1 :     return (1);
     382             : }
     383             : #undef SWAP
     384             : 
     385             : #define FILL(n, cp)                                                            \
     386             :     for (int32_t ifill = 0; ifill < (n); ++ifill)                              \
     387             :     {                                                                          \
     388             :         (cp)[ifill] = 0xff;                                                    \
     389             :     }                                                                          \
     390             :     (cp) += (n);
     391             : 
     392             : #define ZERO(n, cp)                                                            \
     393             :     for (int32_t izero = 0; izero < (n); ++izero)                              \
     394             :     {                                                                          \
     395             :         (cp)[izero] = 0;                                                       \
     396             :     }                                                                          \
     397             :     (cp) += (n);
     398             : 
     399             : /*
     400             :  * Bit-fill a row according to the white/black
     401             :  * runs generated during G3/G4 decoding.
     402             :  */
     403       23917 : void _TIFFFax3fillruns(unsigned char *buf, uint32_t *runs, uint32_t *erun,
     404             :                        uint32_t lastx)
     405             : {
     406             :     static const unsigned char _fillmasks[] = {0x00, 0x80, 0xc0, 0xe0, 0xf0,
     407             :                                                0xf8, 0xfc, 0xfe, 0xff};
     408             :     unsigned char *cp;
     409             :     uint32_t x, bx, run;
     410             :     int32_t n, nw;
     411             :     int64_t *lp;
     412             : 
     413       23917 :     if ((erun - runs) & 1)
     414         991 :         *erun++ = 0;
     415       23917 :     x = 0;
     416       84444 :     for (; runs < erun; runs += 2)
     417             :     {
     418       60527 :         run = runs[0];
     419       60527 :         if (x + run > lastx || run > lastx)
     420           0 :             run = runs[0] = (uint32_t)(lastx - x);
     421       60527 :         if (run)
     422             :         {
     423       38491 :             cp = buf + (x >> 3);
     424       38491 :             bx = x & 7;
     425       38491 :             if (run > 8 - bx)
     426             :             {
     427       25749 :                 if (bx)
     428             :                 { /* align to byte boundary */
     429       21848 :                     *cp++ &= 0xff << (8 - bx);
     430       21848 :                     run -= 8 - bx;
     431             :                 }
     432       25749 :                 if ((n = run >> 3) != 0)
     433             :                 { /* multiple bytes to fill */
     434       15572 :                     if ((n / sizeof(int64_t)) > 1)
     435             :                     {
     436             :                         /*
     437             :                          * Align to int64_tword boundary and fill.
     438             :                          */
     439        2335 :                         for (; n && !isAligned(cp, int64_t); n--)
     440        1140 :                             *cp++ = 0x00;
     441        1195 :                         lp = (int64_t *)cp;
     442        1195 :                         nw = (int32_t)(n / sizeof(int64_t));
     443        1195 :                         n -= nw * sizeof(int64_t);
     444             :                         do
     445             :                         {
     446        8396 :                             *lp++ = 0L;
     447        8396 :                         } while (--nw);
     448        1195 :                         cp = (unsigned char *)lp;
     449             :                     }
     450       56634 :                     ZERO(n, cp);
     451       15572 :                     run &= 7;
     452             :                 }
     453       25749 :                 if (run)
     454       23710 :                     cp[0] &= 0xff >> run;
     455             :             }
     456             :             else
     457       12742 :                 cp[0] &= ~(_fillmasks[run] >> bx);
     458       38491 :             x += runs[0];
     459             :         }
     460       60527 :         run = runs[1];
     461       60527 :         if (x + run > lastx || run > lastx)
     462           0 :             run = runs[1] = lastx - x;
     463       60527 :         if (run)
     464             :         {
     465       59536 :             cp = buf + (x >> 3);
     466       59536 :             bx = x & 7;
     467       59536 :             if (run > 8 - bx)
     468             :             {
     469       47609 :                 if (bx)
     470             :                 { /* align to byte boundary */
     471       23602 :                     *cp++ |= 0xff >> bx;
     472       23602 :                     run -= 8 - bx;
     473             :                 }
     474       47609 :                 if ((n = run >> 3) != 0)
     475             :                 { /* multiple bytes to fill */
     476       41944 :                     if ((n / sizeof(int64_t)) > 1)
     477             :                     {
     478             :                         /*
     479             :                          * Align to int64_t boundary and fill.
     480             :                          */
     481       54579 :                         for (; n && !isAligned(cp, int64_t); n--)
     482       26493 :                             *cp++ = 0xff;
     483       28086 :                         lp = (int64_t *)cp;
     484       28086 :                         nw = (int32_t)(n / sizeof(int64_t));
     485       28086 :                         n -= nw * sizeof(int64_t);
     486             :                         do
     487             :                         {
     488      311441 :                             *lp++ = -1L;
     489      311441 :                         } while (--nw);
     490       28086 :                         cp = (unsigned char *)lp;
     491             :                     }
     492      226601 :                     FILL(n, cp);
     493       41944 :                     run &= 7;
     494             :                 }
     495             :                 /* Explicit 0xff masking to make icc -check=conversions happy */
     496       47609 :                 if (run)
     497       22430 :                     cp[0] = (unsigned char)((cp[0] | (0xff00 >> run)) & 0xff);
     498             :             }
     499             :             else
     500       11927 :                 cp[0] |= _fillmasks[run] >> bx;
     501       59536 :             x += runs[1];
     502             :         }
     503             :     }
     504       23917 :     assert(x == lastx);
     505       23917 : }
     506             : #undef ZERO
     507             : #undef FILL
     508             : 
     509          53 : static int Fax3FixupTags(TIFF *tif)
     510             : {
     511             :     (void)tif;
     512          53 :     return (1);
     513             : }
     514             : 
     515             : /*
     516             :  * Setup G3/G4-related compression/decompression state
     517             :  * before data is processed.  This routine is called once
     518             :  * per image -- it sets up different state based on whether
     519             :  * or not decoding or encoding is being done and whether
     520             :  * 1D- or 2D-encoded data is involved.
     521             :  */
     522          22 : static int Fax3SetupState(TIFF *tif)
     523             : {
     524             :     static const char module[] = "Fax3SetupState";
     525          22 :     TIFFDirectory *td = &tif->tif_dir;
     526          22 :     Fax3BaseState *sp = Fax3State(tif);
     527             :     int needsRefLine;
     528          22 :     Fax3CodecState *dsp = (Fax3CodecState *)Fax3State(tif);
     529             :     tmsize_t rowbytes;
     530             :     uint32_t rowpixels;
     531             : 
     532          22 :     if (td->td_bitspersample != 1)
     533             :     {
     534           0 :         TIFFErrorExtR(tif, module,
     535             :                       "Bits/sample must be 1 for Group 3/4 encoding/decoding");
     536           0 :         return (0);
     537             :     }
     538          22 :     if (td->td_samplesperpixel != 1 &&
     539           0 :         td->td_planarconfig != PLANARCONFIG_SEPARATE)
     540             :     {
     541           0 :         TIFFErrorExtR(
     542             :             tif, module,
     543             :             "Samples/pixel shall be 1 for Group 3/4 encoding/decoding, "
     544             :             "or PlanarConfiguration must be set to Separate.");
     545           0 :         return 0;
     546             :     }
     547             :     /*
     548             :      * Calculate the scanline/tile widths.
     549             :      */
     550          22 :     if (isTiled(tif))
     551             :     {
     552           0 :         rowbytes = TIFFTileRowSize(tif);
     553           0 :         rowpixels = td->td_tilewidth;
     554             :     }
     555             :     else
     556             :     {
     557          22 :         rowbytes = TIFFScanlineSize(tif);
     558          22 :         rowpixels = td->td_imagewidth;
     559             :     }
     560          22 :     if ((int64_t)rowbytes < ((int64_t)rowpixels + 7) / 8)
     561             :     {
     562           0 :         TIFFErrorExtR(tif, module,
     563             :                       "Inconsistent number of bytes per row : rowbytes=%" PRId64
     564             :                       " rowpixels=%" PRIu32,
     565             :                       (int64_t)rowbytes, rowpixels);
     566           0 :         return (0);
     567             :     }
     568          22 :     sp->rowbytes = rowbytes;
     569          22 :     sp->rowpixels = rowpixels;
     570             :     /*
     571             :      * Allocate any additional space required for decoding/encoding.
     572             :      */
     573          43 :     needsRefLine = ((sp->groupoptions & GROUP3OPT_2DENCODING) ||
     574          21 :                     td->td_compression == COMPRESSION_CCITTFAX4);
     575             : 
     576             :     /*
     577             :       Assure that allocation computations do not overflow.
     578             : 
     579             :       TIFFroundup and TIFFSafeMultiply return zero on integer overflow
     580             :     */
     581          22 :     if (dsp->runs != NULL)
     582             :     {
     583           0 :         _TIFFfreeExt(tif, dsp->runs);
     584           0 :         dsp->runs = (uint32_t *)NULL;
     585             :     }
     586          22 :     dsp->nruns = TIFFroundup_32(rowpixels + 1, 32);
     587          22 :     if (needsRefLine)
     588             :     {
     589          18 :         dsp->nruns = TIFFSafeMultiply(uint32_t, dsp->nruns, 2);
     590             :     }
     591          22 :     if ((dsp->nruns == 0) || (TIFFSafeMultiply(uint32_t, dsp->nruns, 2) == 0))
     592             :     {
     593           0 :         TIFFErrorExtR(tif, tif->tif_name,
     594             :                       "Row pixels integer overflow (rowpixels %" PRIu32 ")",
     595             :                       rowpixels);
     596           0 :         return (0);
     597             :     }
     598          22 :     dsp->runs = (uint32_t *)_TIFFCheckMalloc(
     599          22 :         tif, TIFFSafeMultiply(uint32_t, dsp->nruns, 2), sizeof(uint32_t),
     600             :         "for Group 3/4 run arrays");
     601          22 :     if (dsp->runs == NULL)
     602           0 :         return (0);
     603           0 :     memset(dsp->runs, 0,
     604          22 :            TIFFSafeMultiply(uint32_t, dsp->nruns, 2) * sizeof(uint32_t));
     605          22 :     dsp->curruns = dsp->runs;
     606          22 :     if (needsRefLine)
     607          18 :         dsp->refruns = dsp->runs + dsp->nruns;
     608             :     else
     609           4 :         dsp->refruns = NULL;
     610          22 :     if (td->td_compression == COMPRESSION_CCITTFAX3 && is2DEncoding(dsp))
     611             :     { /* NB: default is 1D routine */
     612           1 :         tif->tif_decoderow = Fax3Decode2D;
     613           1 :         tif->tif_decodestrip = Fax3Decode2D;
     614           1 :         tif->tif_decodetile = Fax3Decode2D;
     615             :     }
     616             : 
     617          22 :     if (needsRefLine)
     618             :     { /* 2d encoding */
     619          18 :         Fax3CodecState *esp = EncoderState(tif);
     620             :         /*
     621             :          * 2d encoding requires a scanline
     622             :          * buffer for the ``reference line''; the
     623             :          * scanline against which delta encoding
     624             :          * is referenced.  The reference line must
     625             :          * be initialized to be ``white'' (done elsewhere).
     626             :          */
     627          18 :         if (esp->refline != NULL)
     628             :         {
     629           0 :             _TIFFfreeExt(tif, esp->refline);
     630             :         }
     631          18 :         esp->refline = (unsigned char *)_TIFFmallocExt(tif, rowbytes);
     632          18 :         if (esp->refline == NULL)
     633             :         {
     634           0 :             TIFFErrorExtR(tif, module, "No space for Group 3/4 reference line");
     635           0 :             return (0);
     636             :         }
     637             :     }
     638             :     else /* 1d encoding */
     639           4 :         EncoderState(tif)->refline = NULL;
     640             : 
     641          22 :     return (1);
     642             : }
     643             : 
     644             : /*
     645             :  * CCITT Group 3 FAX Encoding.
     646             :  */
     647             : 
     648             : #define Fax3FlushBits(tif, sp)                                                 \
     649             :     {                                                                          \
     650             :         if ((tif)->tif_rawcc >= (tif)->tif_rawdatasize)                        \
     651             :         {                                                                      \
     652             :             if (!TIFFFlushData1(tif))                                          \
     653             :                 return 0;                                                      \
     654             :         }                                                                      \
     655             :         *(tif)->tif_rawcp++ = (uint8_t)(sp)->data;                             \
     656             :         (tif)->tif_rawcc++;                                                    \
     657             :         (sp)->data = 0, (sp)->bit = 8;                                         \
     658             :     }
     659             : #define _FlushBits(tif)                                                        \
     660             :     {                                                                          \
     661             :         if ((tif)->tif_rawcc >= (tif)->tif_rawdatasize)                        \
     662             :         {                                                                      \
     663             :             if (!TIFFFlushData1(tif))                                          \
     664             :                 return 0;                                                      \
     665             :         }                                                                      \
     666             :         *(tif)->tif_rawcp++ = (uint8_t)data;                                   \
     667             :         (tif)->tif_rawcc++;                                                    \
     668             :         data = 0, bit = 8;                                                     \
     669             :     }
     670             : static const int _msbmask[9] = {0x00, 0x01, 0x03, 0x07, 0x0f,
     671             :                                 0x1f, 0x3f, 0x7f, 0xff};
     672             : #define _PutBits(tif, bits, length)                                            \
     673             :     {                                                                          \
     674             :         while (length > bit)                                                   \
     675             :         {                                                                      \
     676             :             data |= bits >> (length - bit);                                    \
     677             :             length -= bit;                                                     \
     678             :             _FlushBits(tif);                                                   \
     679             :         }                                                                      \
     680             :         assert(length < 9);                                                    \
     681             :         data |= (bits & _msbmask[length]) << (bit - length);                   \
     682             :         bit -= length;                                                         \
     683             :         if (bit == 0)                                                          \
     684             :             _FlushBits(tif);                                                   \
     685             :     }
     686             : 
     687             : /*
     688             :  * Write a variable-length bit-value to
     689             :  * the output stream.  Values are
     690             :  * assumed to be at most 16 bits.
     691             :  */
     692       43734 : static int Fax3PutBits(TIFF *tif, unsigned int bits, unsigned int length)
     693             : {
     694       43734 :     Fax3CodecState *sp = EncoderState(tif);
     695       43734 :     unsigned int bit = sp->bit;
     696       43734 :     int data = sp->data;
     697             : 
     698       50366 :     _PutBits(tif, bits, length);
     699             : 
     700       43734 :     sp->data = data;
     701       43734 :     sp->bit = bit;
     702       43734 :     return 1;
     703             : }
     704             : 
     705             : /*
     706             :  * Write a code to the output stream.
     707             :  */
     708             : #define putcode(tif, te) Fax3PutBits(tif, (te)->code, (te)->length)
     709             : 
     710             : #ifdef FAX3_DEBUG
     711             : #define DEBUG_COLOR(w) (tab == TIFFFaxWhiteCodes ? w "W" : w "B")
     712             : #define DEBUG_PRINT(what, len)                                                 \
     713             :     {                                                                          \
     714             :         int t;                                                                 \
     715             :         printf("%08" PRIX32 "/%-2d: %s%5d\t", data, bit, DEBUG_COLOR(what),    \
     716             :                len);                                                           \
     717             :         for (t = length - 1; t >= 0; t--)                                      \
     718             :             putchar(code & (1 << t) ? '1' : '0');                              \
     719             :         putchar('\n');                                                         \
     720             :     }
     721             : #endif
     722             : 
     723             : /*
     724             :  * Write the sequence of codes that describes
     725             :  * the specified span of zero's or one's.  The
     726             :  * appropriate table that holds the make-up and
     727             :  * terminating codes is supplied.
     728             :  */
     729       13030 : static int putspan(TIFF *tif, int32_t span, const tableentry *tab)
     730             : {
     731       13030 :     Fax3CodecState *sp = EncoderState(tif);
     732       13030 :     unsigned int bit = sp->bit;
     733       13030 :     int data = sp->data;
     734             :     unsigned int code, length;
     735             : 
     736       13030 :     while (span >= 2624)
     737             :     {
     738           0 :         const tableentry *te = &tab[63 + (2560 >> 6)];
     739           0 :         code = te->code;
     740           0 :         length = te->length;
     741             : #ifdef FAX3_DEBUG
     742             :         DEBUG_PRINT("MakeUp", te->runlen);
     743             : #endif
     744           0 :         _PutBits(tif, code, length);
     745           0 :         span -= te->runlen;
     746             :     }
     747       13030 :     if (span >= 64)
     748             :     {
     749         418 :         const tableentry *te = &tab[63 + (span >> 6)];
     750         418 :         assert(te->runlen == 64 * (span >> 6));
     751         418 :         code = te->code;
     752         418 :         length = te->length;
     753             : #ifdef FAX3_DEBUG
     754             :         DEBUG_PRINT("MakeUp", te->runlen);
     755             : #endif
     756         969 :         _PutBits(tif, code, length);
     757         418 :         span -= te->runlen;
     758             :     }
     759       13030 :     code = tab[span].code;
     760       13030 :     length = tab[span].length;
     761             : #ifdef FAX3_DEBUG
     762             :     DEBUG_PRINT("  Term", tab[span].runlen);
     763             : #endif
     764       19233 :     _PutBits(tif, code, length);
     765             : 
     766       13030 :     sp->data = data;
     767       13030 :     sp->bit = bit;
     768             : 
     769       13030 :     return 1;
     770             : }
     771             : 
     772             : /*
     773             :  * Write an EOL code to the output stream.  The zero-fill
     774             :  * logic for byte-aligning encoded scanlines is handled
     775             :  * here.  We also handle writing the tag bit for the next
     776             :  * scanline when doing 2d encoding.
     777             :  */
     778          99 : static int Fax3PutEOL(TIFF *tif)
     779             : {
     780          99 :     Fax3CodecState *sp = EncoderState(tif);
     781          99 :     unsigned int bit = sp->bit;
     782          99 :     int data = sp->data;
     783             :     unsigned int code, length, tparm;
     784             : 
     785          99 :     if (sp->b.groupoptions & GROUP3OPT_FILLBITS)
     786             :     {
     787             :         /*
     788             :          * Force bit alignment so EOL will terminate on
     789             :          * a byte boundary.  That is, force the bit alignment
     790             :          * to 16-12 = 4 before putting out the EOL code.
     791             :          */
     792           0 :         int align = 8 - 4;
     793           0 :         if (align != sp->bit)
     794             :         {
     795           0 :             if (align > sp->bit)
     796           0 :                 align = sp->bit + (8 - align);
     797             :             else
     798           0 :                 align = sp->bit - align;
     799           0 :             tparm = align;
     800           0 :             _PutBits(tif, 0, tparm);
     801             :         }
     802             :     }
     803          99 :     code = EOL;
     804          99 :     length = 12;
     805          99 :     if (is2DEncoding(sp))
     806             :     {
     807           0 :         code = (code << 1) | (sp->tag == G3_1D);
     808           0 :         length++;
     809             :     }
     810         242 :     _PutBits(tif, code, length);
     811             : 
     812          99 :     sp->data = data;
     813          99 :     sp->bit = bit;
     814             : 
     815          99 :     return 1;
     816             : }
     817             : 
     818             : /*
     819             :  * Reset encoding state at the start of a strip.
     820             :  */
     821           9 : static int Fax3PreEncode(TIFF *tif, uint16_t s)
     822             : {
     823           9 :     Fax3CodecState *sp = EncoderState(tif);
     824             : 
     825             :     (void)s;
     826           9 :     assert(sp != NULL);
     827           9 :     sp->bit = 8;
     828           9 :     sp->data = 0;
     829           9 :     sp->tag = G3_1D;
     830             :     /*
     831             :      * This is necessary for Group 4; otherwise it isn't
     832             :      * needed because the first scanline of each strip ends
     833             :      * up being copied into the refline.
     834             :      */
     835           9 :     if (sp->refline)
     836           7 :         _TIFFmemset(sp->refline, 0x00, sp->b.rowbytes);
     837           9 :     if (is2DEncoding(sp))
     838             :     {
     839           0 :         float res = tif->tif_dir.td_yresolution;
     840             :         /*
     841             :          * The CCITT spec says that when doing 2d encoding, you
     842             :          * should only do it on K consecutive scanlines, where K
     843             :          * depends on the resolution of the image being encoded
     844             :          * (2 for <= 200 lpi, 4 for > 200 lpi).  Since the directory
     845             :          * code initializes td_yresolution to 0, this code will
     846             :          * select a K of 2 unless the YResolution tag is set
     847             :          * appropriately.  (Note also that we fudge a little here
     848             :          * and use 150 lpi to avoid problems with units conversion.)
     849             :          */
     850           0 :         if (tif->tif_dir.td_resolutionunit == RESUNIT_CENTIMETER)
     851           0 :             res *= 2.54f; /* convert to inches */
     852           0 :         sp->maxk = (res > 150 ? 4 : 2);
     853           0 :         sp->k = sp->maxk - 1;
     854             :     }
     855             :     else
     856           9 :         sp->k = sp->maxk = 0;
     857           9 :     sp->line = 0;
     858           9 :     return (1);
     859             : }
     860             : 
     861             : static const unsigned char zeroruns[256] = {
     862             :     8, 7, 6, 6, 5, 5, 5, 5, 4, 4, 4, 4, 4, 4, 4, 4, /* 0x00 - 0x0f */
     863             :     3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, /* 0x10 - 0x1f */
     864             :     2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, /* 0x20 - 0x2f */
     865             :     2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, /* 0x30 - 0x3f */
     866             :     1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, /* 0x40 - 0x4f */
     867             :     1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, /* 0x50 - 0x5f */
     868             :     1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, /* 0x60 - 0x6f */
     869             :     1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, /* 0x70 - 0x7f */
     870             :     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 0x80 - 0x8f */
     871             :     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 0x90 - 0x9f */
     872             :     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 0xa0 - 0xaf */
     873             :     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 0xb0 - 0xbf */
     874             :     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 0xc0 - 0xcf */
     875             :     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 0xd0 - 0xdf */
     876             :     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 0xe0 - 0xef */
     877             :     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 0xf0 - 0xff */
     878             : };
     879             : static const unsigned char oneruns[256] = {
     880             :     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 0x00 - 0x0f */
     881             :     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 0x10 - 0x1f */
     882             :     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 0x20 - 0x2f */
     883             :     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 0x30 - 0x3f */
     884             :     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 0x40 - 0x4f */
     885             :     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 0x50 - 0x5f */
     886             :     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 0x60 - 0x6f */
     887             :     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 0x70 - 0x7f */
     888             :     1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, /* 0x80 - 0x8f */
     889             :     1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, /* 0x90 - 0x9f */
     890             :     1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, /* 0xa0 - 0xaf */
     891             :     1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, /* 0xb0 - 0xbf */
     892             :     2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, /* 0xc0 - 0xcf */
     893             :     2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, /* 0xd0 - 0xdf */
     894             :     3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, /* 0xe0 - 0xef */
     895             :     4, 4, 4, 4, 4, 4, 4, 4, 5, 5, 5, 5, 6, 6, 7, 8, /* 0xf0 - 0xff */
     896             : };
     897             : 
     898             : /*
     899             :  * Find a span of ones or zeros using the supplied
     900             :  * table.  The ``base'' of the bit string is supplied
     901             :  * along with the start+end bit indices.
     902             :  */
     903       69633 : static inline int32_t find0span(unsigned char *bp, int32_t bs, int32_t be)
     904             : {
     905       69633 :     int32_t bits = be - bs;
     906             :     int32_t n, span;
     907             : 
     908       69633 :     bp += bs >> 3;
     909             :     /*
     910             :      * Check partial byte on lhs.
     911             :      */
     912       69633 :     if (bits > 0 && (n = (bs & 7)) != 0)
     913             :     {
     914       53657 :         span = zeroruns[(*bp << n) & 0xff];
     915       53657 :         if (span > 8 - n) /* table value too generous */
     916       29826 :             span = 8 - n;
     917       53657 :         if (span > bits) /* constrain span to bit range */
     918         359 :             span = bits;
     919       53657 :         if (n + span < 8) /* doesn't extend to edge of byte */
     920       24190 :             return (span);
     921       29467 :         bits -= span;
     922       29467 :         bp++;
     923             :     }
     924             :     else
     925       15976 :         span = 0;
     926       45443 :     if (bits >= (int32_t)(2 * 8 * sizeof(int64_t)))
     927             :     {
     928             :         int64_t *lp;
     929             :         /*
     930             :          * Align to int64_t boundary and check int64_t words.
     931             :          */
     932       54272 :         while (!isAligned(bp, int64_t))
     933             :         {
     934       38361 :             if (*bp != 0x00)
     935       15909 :                 return (span + zeroruns[*bp]);
     936       22452 :             span += 8;
     937       22452 :             bits -= 8;
     938       22452 :             bp++;
     939             :         }
     940       15911 :         lp = (int64_t *)bp;
     941       17290 :         while ((bits >= (int32_t)(8 * sizeof(int64_t))) && (0 == *lp))
     942             :         {
     943        1379 :             span += 8 * sizeof(int64_t);
     944        1379 :             bits -= 8 * sizeof(int64_t);
     945        1379 :             lp++;
     946             :         }
     947       15911 :         bp = (unsigned char *)lp;
     948             :     }
     949             :     /*
     950             :      * Scan full bytes for all 0's.
     951             :      */
     952       50893 :     while (bits >= 8)
     953             :     {
     954       48775 :         if (*bp != 0x00) /* end of run */
     955       27416 :             return (span + zeroruns[*bp]);
     956       21359 :         span += 8;
     957       21359 :         bits -= 8;
     958       21359 :         bp++;
     959             :     }
     960             :     /*
     961             :      * Check partial byte on rhs.
     962             :      */
     963        2118 :     if (bits > 0)
     964             :     {
     965        2002 :         n = zeroruns[*bp];
     966        2002 :         span += (n > bits ? bits : n);
     967             :     }
     968        2118 :     return (span);
     969             : }
     970             : 
     971       83357 : static inline int32_t find1span(unsigned char *bp, int32_t bs, int32_t be)
     972             : {
     973       83357 :     int32_t bits = be - bs;
     974             :     int32_t n, span;
     975             : 
     976       83357 :     bp += bs >> 3;
     977             :     /*
     978             :      * Check partial byte on lhs.
     979             :      */
     980       83357 :     if (bits > 0 && (n = (bs & 7)) != 0)
     981             :     {
     982       53819 :         span = oneruns[(*bp << n) & 0xff];
     983       53819 :         if (span > 8 - n) /* table value too generous */
     984           0 :             span = 8 - n;
     985       53819 :         if (span > bits) /* constrain span to bit range */
     986           0 :             span = bits;
     987       53819 :         if (n + span < 8) /* doesn't extend to edge of byte */
     988       24458 :             return (span);
     989       29361 :         bits -= span;
     990       29361 :         bp++;
     991             :     }
     992             :     else
     993       29538 :         span = 0;
     994       58899 :     if (bits >= (int32_t)(2 * 8 * sizeof(int64_t)))
     995             :     {
     996             :         int64_t *lp;
     997             :         /*
     998             :          * Align to int64_t boundary and check int64_t words.
     999             :          */
    1000       94760 :         while (!isAligned(bp, int64_t))
    1001             :         {
    1002       61078 :             if (*bp != 0xff)
    1003       11996 :                 return (span + oneruns[*bp]);
    1004       49082 :             span += 8;
    1005       49082 :             bits -= 8;
    1006       49082 :             bp++;
    1007             :         }
    1008       33682 :         lp = (int64_t *)bp;
    1009      338421 :         while ((bits >= (int32_t)(8 * sizeof(int64_t))) &&
    1010      317978 :                (~((uint64_t)0) == (uint64_t)*lp))
    1011             :         {
    1012      304739 :             span += 8 * sizeof(int64_t);
    1013      304739 :             bits -= 8 * sizeof(int64_t);
    1014      304739 :             lp++;
    1015             :         }
    1016       33682 :         bp = (unsigned char *)lp;
    1017             :     }
    1018             :     /*
    1019             :      * Scan full bytes for all 1's.
    1020             :      */
    1021      206691 :     while (bits >= 8)
    1022             :     {
    1023      184031 :         if (*bp != 0xff) /* end of run */
    1024       24243 :             return (span + oneruns[*bp]);
    1025      159788 :         span += 8;
    1026      159788 :         bits -= 8;
    1027      159788 :         bp++;
    1028             :     }
    1029             :     /*
    1030             :      * Check partial byte on rhs.
    1031             :      */
    1032       22660 :     if (bits > 0)
    1033             :     {
    1034         888 :         n = oneruns[*bp];
    1035         888 :         span += (n > bits ? bits : n);
    1036             :     }
    1037       22660 :     return (span);
    1038             : }
    1039             : 
    1040             : /*
    1041             :  * Return the offset of the next bit in the range
    1042             :  * [bs..be] that is different from the specified
    1043             :  * color.  The end, be, is returned if no such bit
    1044             :  * exists.
    1045             :  */
    1046             : #define finddiff(_cp, _bs, _be, _color)                                        \
    1047             :     (_bs + (_color ? find1span(_cp, _bs, _be) : find0span(_cp, _bs, _be)))
    1048             : /*
    1049             :  * Like finddiff, but also check the starting bit
    1050             :  * against the end in case start > end.
    1051             :  */
    1052             : #define finddiff2(_cp, _bs, _be, _color)                                       \
    1053             :     (_bs < _be ? finddiff(_cp, _bs, _be, _color) : _be)
    1054             : 
    1055             : /*
    1056             :  * 1d-encode a row of pixels.  The encoding is
    1057             :  * a sequence of all-white or all-black spans
    1058             :  * of pixels encoded with Huffman codes.
    1059             :  */
    1060         198 : static int Fax3Encode1DRow(TIFF *tif, unsigned char *bp, uint32_t bits)
    1061             : {
    1062         198 :     Fax3CodecState *sp = EncoderState(tif);
    1063             :     int32_t span;
    1064         198 :     uint32_t bs = 0;
    1065             : 
    1066             :     for (;;)
    1067             :     {
    1068        2646 :         span = find0span(bp, bs, bits); /* white span */
    1069        2646 :         if (!putspan(tif, span, TIFFFaxWhiteCodes))
    1070           0 :             return 0;
    1071        2646 :         bs += span;
    1072        2646 :         if (bs >= bits)
    1073          52 :             break;
    1074        2594 :         span = find1span(bp, bs, bits); /* black span */
    1075        2594 :         if (!putspan(tif, span, TIFFFaxBlackCodes))
    1076           0 :             return 0;
    1077        2594 :         bs += span;
    1078        2594 :         if (bs >= bits)
    1079         146 :             break;
    1080             :     }
    1081         198 :     if (sp->b.mode & (FAXMODE_BYTEALIGN | FAXMODE_WORDALIGN))
    1082             :     {
    1083          99 :         if (sp->bit != 8) /* byte-align */
    1084          89 :             Fax3FlushBits(tif, sp);
    1085          99 :         if ((sp->b.mode & FAXMODE_WORDALIGN) &&
    1086           0 :             !isAligned(tif->tif_rawcp, uint16_t))
    1087           0 :             Fax3FlushBits(tif, sp);
    1088             :     }
    1089         198 :     return (1);
    1090             : }
    1091             : 
    1092             : static const tableentry horizcode = {3, 0x1, 0}; /* 001 */
    1093             : static const tableentry passcode = {4, 0x1, 0};  /* 0001 */
    1094             : static const tableentry vcodes[7] = {
    1095             :     {7, 0x03, 0}, /* 0000 011 */
    1096             :     {6, 0x03, 0}, /* 0000 11 */
    1097             :     {3, 0x03, 0}, /* 011 */
    1098             :     {1, 0x1, 0},  /* 1 */
    1099             :     {3, 0x2, 0},  /* 010 */
    1100             :     {6, 0x02, 0}, /* 0000 10 */
    1101             :     {7, 0x02, 0}  /* 0000 010 */
    1102             : };
    1103             : 
    1104             : /*
    1105             :  * 2d-encode a row of pixels.  Consult the CCITT
    1106             :  * documentation for the algorithm.
    1107             :  */
    1108        7897 : static int Fax3Encode2DRow(TIFF *tif, unsigned char *bp, unsigned char *rp,
    1109             :                            uint32_t bits)
    1110             : {
    1111             : #define PIXEL(buf, ix) ((((buf)[(ix) >> 3]) >> (7 - ((ix)&7))) & 1)
    1112        7897 :     uint32_t a0 = 0;
    1113        7897 :     uint32_t a1 = (PIXEL(bp, 0) != 0 ? 0 : finddiff(bp, 0, bits, 0));
    1114        7897 :     uint32_t b1 = (PIXEL(rp, 0) != 0 ? 0 : finddiff(rp, 0, bits, 0));
    1115             :     uint32_t a2, b2;
    1116             : 
    1117             :     for (;;)
    1118             :     {
    1119       43720 :         b2 = finddiff2(rp, b1, bits, PIXEL(rp, b1));
    1120       43720 :         if (b2 >= a1)
    1121             :         {
    1122             :             /* Naive computation triggers
    1123             :              * -fsanitize=undefined,unsigned-integer-overflow */
    1124             :             /* although it is correct unless the difference between both is < 31
    1125             :              * bit */
    1126             :             /* int32_t d = b1 - a1; */
    1127       36175 :             int32_t d = (b1 >= a1 && b1 - a1 <= 3U)  ? (int32_t)(b1 - a1)
    1128       86693 :                         : (b1 < a1 && a1 - b1 <= 3U) ? -(int32_t)(a1 - b1)
    1129       13042 :                                                      : 0x7FFFFFFF;
    1130       40956 :             if (!(-3 <= d && d <= 3))
    1131             :             { /* horizontal mode */
    1132        3895 :                 a2 = finddiff2(bp, a1, bits, PIXEL(bp, a1));
    1133        3895 :                 if (!putcode(tif, &horizcode))
    1134           0 :                     return 0;
    1135        3895 :                 if (a0 + a1 == 0 || PIXEL(bp, a0) == 0)
    1136             :                 {
    1137        1950 :                     if (!putspan(tif, a1 - a0, TIFFFaxWhiteCodes))
    1138           0 :                         return 0;
    1139        1950 :                     if (!putspan(tif, a2 - a1, TIFFFaxBlackCodes))
    1140           0 :                         return 0;
    1141             :                 }
    1142             :                 else
    1143             :                 {
    1144        1945 :                     if (!putspan(tif, a1 - a0, TIFFFaxBlackCodes))
    1145           0 :                         return 0;
    1146        1945 :                     if (!putspan(tif, a2 - a1, TIFFFaxWhiteCodes))
    1147           0 :                         return 0;
    1148             :                 }
    1149        3895 :                 a0 = a2;
    1150             :             }
    1151             :             else
    1152             :             { /* vertical mode */
    1153       37061 :                 if (!putcode(tif, &vcodes[d + 3]))
    1154           0 :                     return 0;
    1155       37061 :                 a0 = a1;
    1156             :             }
    1157             :         }
    1158             :         else
    1159             :         { /* pass mode */
    1160        2764 :             if (!putcode(tif, &passcode))
    1161           0 :                 return 0;
    1162        2764 :             a0 = b2;
    1163             :         }
    1164       43720 :         if (a0 >= bits)
    1165        7897 :             break;
    1166       35823 :         a1 = finddiff(bp, a0, bits, PIXEL(bp, a0));
    1167       35823 :         b1 = finddiff(rp, a0, bits, !PIXEL(bp, a0));
    1168       35823 :         b1 = finddiff(rp, b1, bits, PIXEL(bp, a0));
    1169             :     }
    1170        7897 :     return (1);
    1171             : #undef PIXEL
    1172             : }
    1173             : 
    1174             : /*
    1175             :  * Encode a buffer of pixels.
    1176             :  */
    1177           2 : static int Fax3Encode(TIFF *tif, uint8_t *bp, tmsize_t cc, uint16_t s)
    1178             : {
    1179             :     static const char module[] = "Fax3Encode";
    1180           2 :     Fax3CodecState *sp = EncoderState(tif);
    1181             :     (void)s;
    1182           2 :     if (cc % sp->b.rowbytes)
    1183             :     {
    1184           0 :         TIFFErrorExtR(tif, module, "Fractional scanlines cannot be written");
    1185           0 :         return (0);
    1186             :     }
    1187         200 :     while (cc > 0)
    1188             :     {
    1189         198 :         if ((sp->b.mode & FAXMODE_NOEOL) == 0)
    1190             :         {
    1191          99 :             if (!Fax3PutEOL(tif))
    1192           0 :                 return 0;
    1193             :         }
    1194         198 :         if (is2DEncoding(sp))
    1195             :         {
    1196           0 :             if (sp->tag == G3_1D)
    1197             :             {
    1198           0 :                 if (!Fax3Encode1DRow(tif, bp, sp->b.rowpixels))
    1199           0 :                     return (0);
    1200           0 :                 sp->tag = G3_2D;
    1201             :             }
    1202             :             else
    1203             :             {
    1204           0 :                 if (!Fax3Encode2DRow(tif, bp, sp->refline, sp->b.rowpixels))
    1205           0 :                     return (0);
    1206           0 :                 sp->k--;
    1207             :             }
    1208           0 :             if (sp->k == 0)
    1209             :             {
    1210           0 :                 sp->tag = G3_1D;
    1211           0 :                 sp->k = sp->maxk - 1;
    1212             :             }
    1213             :             else
    1214           0 :                 _TIFFmemcpy(sp->refline, bp, sp->b.rowbytes);
    1215             :         }
    1216             :         else
    1217             :         {
    1218         198 :             if (!Fax3Encode1DRow(tif, bp, sp->b.rowpixels))
    1219           0 :                 return (0);
    1220             :         }
    1221         198 :         bp += sp->b.rowbytes;
    1222         198 :         cc -= sp->b.rowbytes;
    1223             :     }
    1224           2 :     return (1);
    1225             : }
    1226             : 
    1227           2 : static int Fax3PostEncode(TIFF *tif)
    1228             : {
    1229           2 :     Fax3CodecState *sp = EncoderState(tif);
    1230             : 
    1231           2 :     if (sp->bit != 8)
    1232           1 :         Fax3FlushBits(tif, sp);
    1233           2 :     return (1);
    1234             : }
    1235             : 
    1236          17 : static int _Fax3Close(TIFF *tif)
    1237             : {
    1238          17 :     if ((Fax3State(tif)->mode & FAXMODE_NORTC) == 0 && tif->tif_rawcp)
    1239             :     {
    1240           0 :         Fax3CodecState *sp = EncoderState(tif);
    1241           0 :         unsigned int code = EOL;
    1242           0 :         unsigned int length = 12;
    1243             :         int i;
    1244             : 
    1245           0 :         if (is2DEncoding(sp))
    1246             :         {
    1247           0 :             code = (code << 1) | (sp->tag == G3_1D);
    1248           0 :             length++;
    1249             :         }
    1250           0 :         for (i = 0; i < 6; i++)
    1251           0 :             Fax3PutBits(tif, code, length);
    1252           0 :         Fax3FlushBits(tif, sp);
    1253             :     }
    1254          17 :     return 1;
    1255             : }
    1256             : 
    1257          17 : static void Fax3Close(TIFF *tif) { _Fax3Close(tif); }
    1258             : 
    1259          70 : static void Fax3Cleanup(TIFF *tif)
    1260             : {
    1261          70 :     Fax3CodecState *sp = DecoderState(tif);
    1262             : 
    1263          70 :     assert(sp != 0);
    1264             : 
    1265          70 :     tif->tif_tagmethods.vgetfield = sp->b.vgetparent;
    1266          70 :     tif->tif_tagmethods.vsetfield = sp->b.vsetparent;
    1267          70 :     tif->tif_tagmethods.printdir = sp->b.printdir;
    1268             : 
    1269          70 :     if (sp->runs)
    1270          22 :         _TIFFfreeExt(tif, sp->runs);
    1271          70 :     if (sp->refline)
    1272          18 :         _TIFFfreeExt(tif, sp->refline);
    1273             : 
    1274          70 :     _TIFFfreeExt(tif, tif->tif_data);
    1275          70 :     tif->tif_data = NULL;
    1276             : 
    1277          70 :     _TIFFSetDefaultCompressionState(tif);
    1278          70 : }
    1279             : 
    1280             : #define FIELD_BADFAXLINES (FIELD_CODEC + 0)
    1281             : #define FIELD_CLEANFAXDATA (FIELD_CODEC + 1)
    1282             : #define FIELD_BADFAXRUN (FIELD_CODEC + 2)
    1283             : 
    1284             : #define FIELD_OPTIONS (FIELD_CODEC + 7)
    1285             : 
    1286             : static const TIFFField faxFields[] = {
    1287             :     {TIFFTAG_FAXMODE, 0, 0, TIFF_ANY, 0, TIFF_SETGET_INT, FIELD_PSEUDO, FALSE,
    1288             :      FALSE, "FaxMode", NULL},
    1289             :     {TIFFTAG_FAXFILLFUNC, 0, 0, TIFF_ANY, 0, TIFF_SETGET_OTHER, FIELD_PSEUDO,
    1290             :      FALSE, FALSE, "FaxFillFunc", NULL},
    1291             :     {TIFFTAG_BADFAXLINES, 1, 1, TIFF_LONG, 0, TIFF_SETGET_UINT32,
    1292             :      FIELD_BADFAXLINES, TRUE, FALSE, "BadFaxLines", NULL},
    1293             :     {TIFFTAG_CLEANFAXDATA, 1, 1, TIFF_SHORT, 0, TIFF_SETGET_UINT16,
    1294             :      FIELD_CLEANFAXDATA, TRUE, FALSE, "CleanFaxData", NULL},
    1295             :     {TIFFTAG_CONSECUTIVEBADFAXLINES, 1, 1, TIFF_LONG, 0, TIFF_SETGET_UINT32,
    1296             :      FIELD_BADFAXRUN, TRUE, FALSE, "ConsecutiveBadFaxLines", NULL}};
    1297             : static const TIFFField fax3Fields[] = {
    1298             :     {TIFFTAG_GROUP3OPTIONS, 1, 1, TIFF_LONG, 0, TIFF_SETGET_UINT32,
    1299             :      FIELD_OPTIONS, FALSE, FALSE, "Group3Options", NULL},
    1300             : };
    1301             : static const TIFFField fax4Fields[] = {
    1302             :     {TIFFTAG_GROUP4OPTIONS, 1, 1, TIFF_LONG, 0, TIFF_SETGET_UINT32,
    1303             :      FIELD_OPTIONS, FALSE, FALSE, "Group4Options", NULL},
    1304             : };
    1305             : 
    1306         616 : static int Fax3VSetField(TIFF *tif, uint32_t tag, va_list ap)
    1307             : {
    1308         616 :     Fax3BaseState *sp = Fax3State(tif);
    1309             :     const TIFFField *fip;
    1310             : 
    1311         616 :     assert(sp != 0);
    1312         616 :     assert(sp->vsetparent != 0);
    1313             : 
    1314         616 :     switch (tag)
    1315             :     {
    1316          70 :         case TIFFTAG_FAXMODE:
    1317          70 :             sp->mode = (int)va_arg(ap, int);
    1318          70 :             return 1; /* NB: pseudo tag */
    1319          70 :         case TIFFTAG_FAXFILLFUNC:
    1320          70 :             DecoderState(tif)->fill = va_arg(ap, TIFFFaxFillFunc);
    1321          70 :             return 1; /* NB: pseudo tag */
    1322           2 :         case TIFFTAG_GROUP3OPTIONS:
    1323             :             /* XXX: avoid reading options if compression mismatches. */
    1324           2 :             if (tif->tif_dir.td_compression == COMPRESSION_CCITTFAX3)
    1325           2 :                 sp->groupoptions = (uint32_t)va_arg(ap, uint32_t);
    1326           2 :             break;
    1327           0 :         case TIFFTAG_GROUP4OPTIONS:
    1328             :             /* XXX: avoid reading options if compression mismatches. */
    1329           0 :             if (tif->tif_dir.td_compression == COMPRESSION_CCITTFAX4)
    1330           0 :                 sp->groupoptions = (uint32_t)va_arg(ap, uint32_t);
    1331           0 :             break;
    1332           0 :         case TIFFTAG_BADFAXLINES:
    1333           0 :             sp->badfaxlines = (uint32_t)va_arg(ap, uint32_t);
    1334           0 :             break;
    1335           0 :         case TIFFTAG_CLEANFAXDATA:
    1336           0 :             sp->cleanfaxdata = (uint16_t)va_arg(ap, uint16_vap);
    1337           0 :             break;
    1338           0 :         case TIFFTAG_CONSECUTIVEBADFAXLINES:
    1339           0 :             sp->badfaxrun = (uint32_t)va_arg(ap, uint32_t);
    1340           0 :             break;
    1341         474 :         default:
    1342         474 :             return (*sp->vsetparent)(tif, tag, ap);
    1343             :     }
    1344             : 
    1345           2 :     if ((fip = TIFFFieldWithTag(tif, tag)) != NULL)
    1346           2 :         TIFFSetFieldBit(tif, fip->field_bit);
    1347             :     else
    1348           0 :         return 0;
    1349             : 
    1350           2 :     tif->tif_flags |= TIFF_DIRTYDIRECT;
    1351           2 :     return 1;
    1352             : }
    1353             : 
    1354         741 : static int Fax3VGetField(TIFF *tif, uint32_t tag, va_list ap)
    1355             : {
    1356         741 :     Fax3BaseState *sp = Fax3State(tif);
    1357             : 
    1358         741 :     assert(sp != 0);
    1359             : 
    1360         741 :     switch (tag)
    1361             :     {
    1362           0 :         case TIFFTAG_FAXMODE:
    1363           0 :             *va_arg(ap, int *) = sp->mode;
    1364           0 :             break;
    1365           0 :         case TIFFTAG_FAXFILLFUNC:
    1366           0 :             *va_arg(ap, TIFFFaxFillFunc *) = DecoderState(tif)->fill;
    1367           0 :             break;
    1368           2 :         case TIFFTAG_GROUP3OPTIONS:
    1369             :         case TIFFTAG_GROUP4OPTIONS:
    1370           2 :             *va_arg(ap, uint32_t *) = sp->groupoptions;
    1371           2 :             break;
    1372           0 :         case TIFFTAG_BADFAXLINES:
    1373           0 :             *va_arg(ap, uint32_t *) = sp->badfaxlines;
    1374           0 :             break;
    1375           0 :         case TIFFTAG_CLEANFAXDATA:
    1376           0 :             *va_arg(ap, uint16_t *) = sp->cleanfaxdata;
    1377           0 :             break;
    1378           0 :         case TIFFTAG_CONSECUTIVEBADFAXLINES:
    1379           0 :             *va_arg(ap, uint32_t *) = sp->badfaxrun;
    1380           0 :             break;
    1381         739 :         default:
    1382         739 :             return (*sp->vgetparent)(tif, tag, ap);
    1383             :     }
    1384           2 :     return (1);
    1385             : }
    1386             : 
    1387           0 : static void Fax3PrintDir(TIFF *tif, FILE *fd, long flags)
    1388             : {
    1389           0 :     Fax3BaseState *sp = Fax3State(tif);
    1390             : 
    1391           0 :     assert(sp != 0);
    1392             : 
    1393             :     (void)flags;
    1394           0 :     if (TIFFFieldSet(tif, FIELD_OPTIONS))
    1395             :     {
    1396           0 :         const char *sep = " ";
    1397           0 :         if (tif->tif_dir.td_compression == COMPRESSION_CCITTFAX4)
    1398             :         {
    1399           0 :             fprintf(fd, "  Group 4 Options:");
    1400           0 :             if (sp->groupoptions & GROUP4OPT_UNCOMPRESSED)
    1401           0 :                 fprintf(fd, "%suncompressed data", sep);
    1402             :         }
    1403             :         else
    1404             :         {
    1405             : 
    1406           0 :             fprintf(fd, "  Group 3 Options:");
    1407           0 :             if (sp->groupoptions & GROUP3OPT_2DENCODING)
    1408             :             {
    1409           0 :                 fprintf(fd, "%s2-d encoding", sep);
    1410           0 :                 sep = "+";
    1411             :             }
    1412           0 :             if (sp->groupoptions & GROUP3OPT_FILLBITS)
    1413             :             {
    1414           0 :                 fprintf(fd, "%sEOL padding", sep);
    1415           0 :                 sep = "+";
    1416             :             }
    1417           0 :             if (sp->groupoptions & GROUP3OPT_UNCOMPRESSED)
    1418           0 :                 fprintf(fd, "%suncompressed data", sep);
    1419             :         }
    1420           0 :         fprintf(fd, " (%" PRIu32 " = 0x%" PRIx32 ")\n", sp->groupoptions,
    1421             :                 sp->groupoptions);
    1422             :     }
    1423           0 :     if (TIFFFieldSet(tif, FIELD_CLEANFAXDATA))
    1424             :     {
    1425           0 :         fprintf(fd, "  Fax Data:");
    1426           0 :         switch (sp->cleanfaxdata)
    1427             :         {
    1428           0 :             case CLEANFAXDATA_CLEAN:
    1429           0 :                 fprintf(fd, " clean");
    1430           0 :                 break;
    1431           0 :             case CLEANFAXDATA_REGENERATED:
    1432           0 :                 fprintf(fd, " receiver regenerated");
    1433           0 :                 break;
    1434           0 :             case CLEANFAXDATA_UNCLEAN:
    1435           0 :                 fprintf(fd, " uncorrected errors");
    1436           0 :                 break;
    1437             :         }
    1438           0 :         fprintf(fd, " (%" PRIu16 " = 0x%" PRIx16 ")\n", sp->cleanfaxdata,
    1439           0 :                 sp->cleanfaxdata);
    1440             :     }
    1441           0 :     if (TIFFFieldSet(tif, FIELD_BADFAXLINES))
    1442           0 :         fprintf(fd, "  Bad Fax Lines: %" PRIu32 "\n", sp->badfaxlines);
    1443           0 :     if (TIFFFieldSet(tif, FIELD_BADFAXRUN))
    1444           0 :         fprintf(fd, "  Consecutive Bad Fax Lines: %" PRIu32 "\n",
    1445             :                 sp->badfaxrun);
    1446           0 :     if (sp->printdir)
    1447           0 :         (*sp->printdir)(tif, fd, flags);
    1448           0 : }
    1449             : 
    1450          70 : static int InitCCITTFax3(TIFF *tif)
    1451             : {
    1452             :     static const char module[] = "InitCCITTFax3";
    1453             :     Fax3BaseState *sp;
    1454             : 
    1455             :     /*
    1456             :      * Merge codec-specific tag information.
    1457             :      */
    1458          70 :     if (!_TIFFMergeFields(tif, faxFields, TIFFArrayCount(faxFields)))
    1459             :     {
    1460           0 :         TIFFErrorExtR(tif, "InitCCITTFax3",
    1461             :                       "Merging common CCITT Fax codec-specific tags failed");
    1462           0 :         return 0;
    1463             :     }
    1464             : 
    1465             :     /*
    1466             :      * Allocate state block so tag methods have storage to record values.
    1467             :      */
    1468          70 :     tif->tif_data = (uint8_t *)_TIFFmallocExt(tif, sizeof(Fax3CodecState));
    1469             : 
    1470          70 :     if (tif->tif_data == NULL)
    1471             :     {
    1472           0 :         TIFFErrorExtR(tif, module, "No space for state block");
    1473           0 :         return (0);
    1474             :     }
    1475          70 :     _TIFFmemset(tif->tif_data, 0, sizeof(Fax3CodecState));
    1476             : 
    1477          70 :     sp = Fax3State(tif);
    1478          70 :     sp->rw_mode = tif->tif_mode;
    1479             : 
    1480             :     /*
    1481             :      * Override parent get/set field methods.
    1482             :      */
    1483          70 :     sp->vgetparent = tif->tif_tagmethods.vgetfield;
    1484          70 :     tif->tif_tagmethods.vgetfield = Fax3VGetField; /* hook for codec tags */
    1485          70 :     sp->vsetparent = tif->tif_tagmethods.vsetfield;
    1486          70 :     tif->tif_tagmethods.vsetfield = Fax3VSetField; /* hook for codec tags */
    1487          70 :     sp->printdir = tif->tif_tagmethods.printdir;
    1488          70 :     tif->tif_tagmethods.printdir = Fax3PrintDir; /* hook for codec tags */
    1489          70 :     sp->groupoptions = 0;
    1490             : 
    1491          70 :     if (sp->rw_mode == O_RDONLY) /* FIXME: improve for in place update */
    1492          25 :         tif->tif_flags |= TIFF_NOBITREV; /* decoder does bit reversal */
    1493          70 :     DecoderState(tif)->runs = NULL;
    1494          70 :     TIFFSetField(tif, TIFFTAG_FAXFILLFUNC, _TIFFFax3fillruns);
    1495          70 :     EncoderState(tif)->refline = NULL;
    1496             : 
    1497             :     /*
    1498             :      * Install codec methods.
    1499             :      */
    1500          70 :     tif->tif_fixuptags = Fax3FixupTags;
    1501          70 :     tif->tif_setupdecode = Fax3SetupState;
    1502          70 :     tif->tif_predecode = Fax3PreDecode;
    1503          70 :     tif->tif_decoderow = Fax3Decode1D;
    1504          70 :     tif->tif_decodestrip = Fax3Decode1D;
    1505          70 :     tif->tif_decodetile = Fax3Decode1D;
    1506          70 :     tif->tif_setupencode = Fax3SetupState;
    1507          70 :     tif->tif_preencode = Fax3PreEncode;
    1508          70 :     tif->tif_postencode = Fax3PostEncode;
    1509          70 :     tif->tif_encoderow = Fax3Encode;
    1510          70 :     tif->tif_encodestrip = Fax3Encode;
    1511          70 :     tif->tif_encodetile = Fax3Encode;
    1512          70 :     tif->tif_close = Fax3Close;
    1513          70 :     tif->tif_cleanup = Fax3Cleanup;
    1514             : 
    1515          70 :     return (1);
    1516             : }
    1517             : 
    1518           9 : int TIFFInitCCITTFax3(TIFF *tif, int scheme)
    1519             : {
    1520             :     (void)scheme;
    1521           9 :     if (InitCCITTFax3(tif))
    1522             :     {
    1523             :         /*
    1524             :          * Merge codec-specific tag information.
    1525             :          */
    1526           9 :         if (!_TIFFMergeFields(tif, fax3Fields, TIFFArrayCount(fax3Fields)))
    1527             :         {
    1528           0 :             TIFFErrorExtR(tif, "TIFFInitCCITTFax3",
    1529             :                           "Merging CCITT Fax 3 codec-specific tags failed");
    1530           0 :             return 0;
    1531             :         }
    1532             : 
    1533             :         /*
    1534             :          * The default format is Class/F-style w/o RTC.
    1535             :          */
    1536           9 :         return TIFFSetField(tif, TIFFTAG_FAXMODE, FAXMODE_CLASSF);
    1537             :     }
    1538             :     else
    1539           0 :         return 01;
    1540             : }
    1541             : 
    1542             : /*
    1543             :  * CCITT Group 4 (T.6) Facsimile-compatible
    1544             :  * Compression Scheme Support.
    1545             :  */
    1546             : 
    1547             : #define SWAP(t, a, b)                                                          \
    1548             :     {                                                                          \
    1549             :         t x;                                                                   \
    1550             :         x = (a);                                                               \
    1551             :         (a) = (b);                                                             \
    1552             :         (b) = x;                                                               \
    1553             :     }
    1554             : /*
    1555             :  * Decode the requested amount of G4-encoded data.
    1556             :  */
    1557       21607 : static int Fax4Decode(TIFF *tif, uint8_t *buf, tmsize_t occ, uint16_t s)
    1558             : {
    1559       21607 :     DECLARE_STATE_2D(tif, sp, "Fax4Decode");
    1560             :     (void)s;
    1561       21607 :     if (occ % sp->b.rowbytes)
    1562             :     {
    1563           0 :         TIFFErrorExtR(tif, module, "Fractional scanlines cannot be read");
    1564           0 :         return (-1);
    1565             :     }
    1566       21607 :     if (sp->eofReachedCount >= EOF_REACHED_COUNT_THRESHOLD)
    1567             :     {
    1568           0 :         TIFFErrorExtR(
    1569             :             tif, module,
    1570             :             "End of file has already been reached %d times within that strip",
    1571             :             sp->eofReachedCount);
    1572           0 :         return (-1);
    1573             :     }
    1574       21607 :     CACHE_STATE(tif, sp);
    1575       21607 :     int start = sp->line;
    1576       44302 :     while (occ > 0)
    1577             :     {
    1578       22695 :         a0 = 0;
    1579       22695 :         RunLength = 0;
    1580       22695 :         pa = thisrun = sp->curruns;
    1581       22695 :         pb = sp->refruns;
    1582       22695 :         b1 = *pb++;
    1583             : #ifdef FAX3_DEBUG
    1584             :         printf("\nBitAcc=%08" PRIX32 ", BitsAvail = %d\n", BitAcc, BitsAvail);
    1585             :         printf("-------------------- %d\n", tif->tif_row);
    1586             :         fflush(stdout);
    1587             : #endif
    1588      151277 :         EXPAND2D(EOFG4);
    1589       22695 :         if (EOLcnt)
    1590           0 :             goto EOFG4;
    1591       22695 :         if (((lastx + 7) >> 3) > (int)occ) /* check for buffer overrun */
    1592             :         {
    1593           0 :             TIFFErrorExtR(tif, module,
    1594             :                           "Buffer overrun detected : %" TIFF_SSIZE_FORMAT
    1595             :                           " bytes available, %d bits needed",
    1596             :                           occ, lastx);
    1597           0 :             return -1;
    1598             :         }
    1599       22695 :         (*sp->fill)(buf, thisrun, pa, lastx);
    1600       22695 :         SETVALUE(0); /* imaginary change for reference */
    1601       22695 :         SWAP(uint32_t *, sp->curruns, sp->refruns);
    1602       22695 :         buf += sp->b.rowbytes;
    1603       22695 :         occ -= sp->b.rowbytes;
    1604       22695 :         sp->line++;
    1605       22695 :         continue;
    1606           0 :     EOFG4:
    1607           0 :         NeedBits16(13, BADG4);
    1608           0 :     BADG4:
    1609             : #ifdef FAX3_DEBUG
    1610             :         if (GetBits(13) != 0x1001)
    1611             :             fputs("Bad EOFB\n", stderr);
    1612             : #endif
    1613           0 :         ClrBits(13);
    1614           0 :         if (((lastx + 7) >> 3) > (int)occ) /* check for buffer overrun */
    1615             :         {
    1616           0 :             TIFFErrorExtR(tif, module,
    1617             :                           "Buffer overrun detected : %" TIFF_SSIZE_FORMAT
    1618             :                           " bytes available, %d bits needed",
    1619             :                           occ, lastx);
    1620           0 :             return -1;
    1621             :         }
    1622           0 :         (*sp->fill)(buf, thisrun, pa, lastx);
    1623           0 :         UNCACHE_STATE(tif, sp);
    1624           0 :         return (sp->line != start
    1625             :                     ? 1
    1626           0 :                     : -1); /* don't error on badly-terminated strips */
    1627             :     }
    1628       21607 :     UNCACHE_STATE(tif, sp);
    1629       21607 :     return (1);
    1630             : }
    1631             : #undef SWAP
    1632             : 
    1633             : /*
    1634             :  * Encode the requested amount of data.
    1635             :  */
    1636        7206 : static int Fax4Encode(TIFF *tif, uint8_t *bp, tmsize_t cc, uint16_t s)
    1637             : {
    1638             :     static const char module[] = "Fax4Encode";
    1639        7206 :     Fax3CodecState *sp = EncoderState(tif);
    1640             :     (void)s;
    1641        7206 :     if (cc % sp->b.rowbytes)
    1642             :     {
    1643           0 :         TIFFErrorExtR(tif, module, "Fractional scanlines cannot be written");
    1644           0 :         return (0);
    1645             :     }
    1646       15103 :     while (cc > 0)
    1647             :     {
    1648        7897 :         if (!Fax3Encode2DRow(tif, bp, sp->refline, sp->b.rowpixels))
    1649           0 :             return (0);
    1650        7897 :         _TIFFmemcpy(sp->refline, bp, sp->b.rowbytes);
    1651        7897 :         bp += sp->b.rowbytes;
    1652        7897 :         cc -= sp->b.rowbytes;
    1653             :     }
    1654        7206 :     return (1);
    1655             : }
    1656             : 
    1657           7 : static int Fax4PostEncode(TIFF *tif)
    1658             : {
    1659           7 :     Fax3CodecState *sp = EncoderState(tif);
    1660             : 
    1661             :     /* terminate strip w/ EOFB */
    1662           7 :     Fax3PutBits(tif, EOL, 12);
    1663           7 :     Fax3PutBits(tif, EOL, 12);
    1664           7 :     if (sp->bit != 8)
    1665           7 :         Fax3FlushBits(tif, sp);
    1666           7 :     return (1);
    1667             : }
    1668             : 
    1669          53 : int TIFFInitCCITTFax4(TIFF *tif, int scheme)
    1670             : {
    1671             :     (void)scheme;
    1672          53 :     if (InitCCITTFax3(tif))
    1673             :     { /* reuse G3 support */
    1674             :         /*
    1675             :          * Merge codec-specific tag information.
    1676             :          */
    1677          53 :         if (!_TIFFMergeFields(tif, fax4Fields, TIFFArrayCount(fax4Fields)))
    1678             :         {
    1679           0 :             TIFFErrorExtR(tif, "TIFFInitCCITTFax4",
    1680             :                           "Merging CCITT Fax 4 codec-specific tags failed");
    1681           0 :             return 0;
    1682             :         }
    1683             : 
    1684          53 :         tif->tif_decoderow = Fax4Decode;
    1685          53 :         tif->tif_decodestrip = Fax4Decode;
    1686          53 :         tif->tif_decodetile = Fax4Decode;
    1687          53 :         tif->tif_encoderow = Fax4Encode;
    1688          53 :         tif->tif_encodestrip = Fax4Encode;
    1689          53 :         tif->tif_encodetile = Fax4Encode;
    1690          53 :         tif->tif_postencode = Fax4PostEncode;
    1691             :         /*
    1692             :          * Suppress RTC at the end of each strip.
    1693             :          */
    1694          53 :         return TIFFSetField(tif, TIFFTAG_FAXMODE, FAXMODE_NORTC);
    1695             :     }
    1696             :     else
    1697           0 :         return (0);
    1698             : }
    1699             : 
    1700             : /*
    1701             :  * CCITT Group 3 1-D Modified Huffman RLE Compression Support.
    1702             :  * (Compression algorithms 2 and 32771)
    1703             :  */
    1704             : 
    1705             : /*
    1706             :  * Decode the requested amount of RLE-encoded data.
    1707             :  */
    1708           1 : static int Fax3DecodeRLE(TIFF *tif, uint8_t *buf, tmsize_t occ, uint16_t s)
    1709             : {
    1710           1 :     DECLARE_STATE(tif, sp, "Fax3DecodeRLE");
    1711           1 :     int mode = sp->b.mode;
    1712             :     (void)s;
    1713           1 :     if (occ % sp->b.rowbytes)
    1714             :     {
    1715           0 :         TIFFErrorExtR(tif, module, "Fractional scanlines cannot be read");
    1716           0 :         return (-1);
    1717             :     }
    1718           1 :     CACHE_STATE(tif, sp);
    1719           1 :     thisrun = sp->curruns;
    1720         100 :     while (occ > 0)
    1721             :     {
    1722          99 :         a0 = 0;
    1723          99 :         RunLength = 0;
    1724          99 :         pa = thisrun;
    1725             : #ifdef FAX3_DEBUG
    1726             :         printf("\nBitAcc=%08" PRIX32 ", BitsAvail = %d\n", BitAcc, BitsAvail);
    1727             :         printf("-------------------- %" PRIu32 "\n", tif->tif_row);
    1728             :         fflush(stdout);
    1729             : #endif
    1730        1323 :         EXPAND1D(EOFRLE);
    1731          99 :         (*sp->fill)(buf, thisrun, pa, lastx);
    1732             :         /*
    1733             :          * Cleanup at the end of the row.
    1734             :          */
    1735          99 :         if (mode & FAXMODE_BYTEALIGN)
    1736             :         {
    1737          99 :             int n = BitsAvail - (BitsAvail & ~7);
    1738          99 :             ClrBits(n);
    1739             :         }
    1740           0 :         else if (mode & FAXMODE_WORDALIGN)
    1741             :         {
    1742           0 :             int n = BitsAvail - (BitsAvail & ~15);
    1743           0 :             ClrBits(n);
    1744           0 :             if (BitsAvail == 0 && !isAligned(cp, uint16_t))
    1745           0 :                 cp++;
    1746             :         }
    1747          99 :         buf += sp->b.rowbytes;
    1748          99 :         occ -= sp->b.rowbytes;
    1749          99 :         sp->line++;
    1750          99 :         continue;
    1751           0 :     EOFRLE: /* premature EOF */
    1752           0 :         (*sp->fill)(buf, thisrun, pa, lastx);
    1753           0 :         UNCACHE_STATE(tif, sp);
    1754           0 :         return (-1);
    1755             :     }
    1756           1 :     UNCACHE_STATE(tif, sp);
    1757           1 :     return (1);
    1758             : }
    1759             : 
    1760           8 : int TIFFInitCCITTRLE(TIFF *tif, int scheme)
    1761             : {
    1762             :     (void)scheme;
    1763           8 :     if (InitCCITTFax3(tif))
    1764             :     { /* reuse G3 support */
    1765           8 :         tif->tif_decoderow = Fax3DecodeRLE;
    1766           8 :         tif->tif_decodestrip = Fax3DecodeRLE;
    1767           8 :         tif->tif_decodetile = Fax3DecodeRLE;
    1768             :         /*
    1769             :          * Suppress RTC+EOLs when encoding and byte-align data.
    1770             :          */
    1771           8 :         return TIFFSetField(tif, TIFFTAG_FAXMODE,
    1772             :                             FAXMODE_NORTC | FAXMODE_NOEOL | FAXMODE_BYTEALIGN);
    1773             :     }
    1774             :     else
    1775           0 :         return (0);
    1776             : }
    1777             : 
    1778           0 : int TIFFInitCCITTRLEW(TIFF *tif, int scheme)
    1779             : {
    1780             :     (void)scheme;
    1781           0 :     if (InitCCITTFax3(tif))
    1782             :     { /* reuse G3 support */
    1783           0 :         tif->tif_decoderow = Fax3DecodeRLE;
    1784           0 :         tif->tif_decodestrip = Fax3DecodeRLE;
    1785           0 :         tif->tif_decodetile = Fax3DecodeRLE;
    1786             :         /*
    1787             :          * Suppress RTC+EOLs when encoding and word-align data.
    1788             :          */
    1789           0 :         return TIFFSetField(tif, TIFFTAG_FAXMODE,
    1790             :                             FAXMODE_NORTC | FAXMODE_NOEOL | FAXMODE_WORDALIGN);
    1791             :     }
    1792             :     else
    1793           0 :         return (0);
    1794             : }
    1795             : #endif /* CCITT_SUPPORT */

Generated by: LCOV version 1.14