tif_read.c 53 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655
  1. /*
  2. * Copyright (c) 1988-1997 Sam Leffler
  3. * Copyright (c) 1991-1997 Silicon Graphics, Inc.
  4. *
  5. * Permission to use, copy, modify, distribute, and sell this software and
  6. * its documentation for any purpose is hereby granted without fee, provided
  7. * that (i) the above copyright notices and this permission notice appear in
  8. * all copies of the software and related documentation, and (ii) the names of
  9. * Sam Leffler and Silicon Graphics may not be used in any advertising or
  10. * publicity relating to the software without the specific, prior written
  11. * permission of Sam Leffler and Silicon Graphics.
  12. *
  13. * THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND,
  14. * EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY
  15. * WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
  16. *
  17. * IN NO EVENT SHALL SAM LEFFLER OR SILICON GRAPHICS BE LIABLE FOR
  18. * ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND,
  19. * OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
  20. * WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF
  21. * LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
  22. * OF THIS SOFTWARE.
  23. */
  24. /*
  25. * TIFF Library.
  26. * Scanline-oriented Read Support
  27. */
  28. #include "tiffiop.h"
  29. #include <stdio.h>
  30. int TIFFFillStrip(TIFF* tif, uint32 strip);
  31. int TIFFFillTile(TIFF* tif, uint32 tile);
  32. static int TIFFStartStrip(TIFF* tif, uint32 strip);
  33. static int TIFFStartTile(TIFF* tif, uint32 tile);
  34. static int TIFFCheckRead(TIFF*, int);
  35. static tmsize_t
  36. TIFFReadRawStrip1(TIFF* tif, uint32 strip, void* buf, tmsize_t size,const char* module);
  37. static tmsize_t
  38. TIFFReadRawTile1(TIFF* tif, uint32 tile, void* buf, tmsize_t size, const char* module);
  39. #define NOSTRIP ((uint32)(-1)) /* undefined state */
  40. #define NOTILE ((uint32)(-1)) /* undefined state */
  41. #define INITIAL_THRESHOLD (1024 * 1024)
  42. #define THRESHOLD_MULTIPLIER 10
  43. #define MAX_THRESHOLD (THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER * INITIAL_THRESHOLD)
  44. #define TIFF_INT64_MAX ((((int64)0x7FFFFFFF) << 32) | 0xFFFFFFFF)
  45. /* Read 'size' bytes in tif_rawdata buffer starting at offset 'rawdata_offset'
  46. * Returns 1 in case of success, 0 otherwise. */
  47. static int TIFFReadAndRealloc( TIFF* tif, tmsize_t size,
  48. tmsize_t rawdata_offset,
  49. int is_strip, uint32 strip_or_tile,
  50. const char* module )
  51. {
  52. #if SIZEOF_SIZE_T == 8
  53. tmsize_t threshold = INITIAL_THRESHOLD;
  54. #endif
  55. tmsize_t already_read = 0;
  56. #if SIZEOF_SIZE_T != 8
  57. /* On 32 bit processes, if the request is large enough, check against */
  58. /* file size */
  59. if( size > 1000 * 1000 * 1000 )
  60. {
  61. uint64 filesize = TIFFGetFileSize(tif);
  62. if( (uint64)size >= filesize )
  63. {
  64. TIFFErrorExt(tif->tif_clientdata, module,
  65. "Chunk size requested is larger than file size.");
  66. return 0;
  67. }
  68. }
  69. #endif
  70. /* On 64 bit processes, read first a maximum of 1 MB, then 10 MB, etc */
  71. /* so as to avoid allocating too much memory in case the file is too */
  72. /* short. We could ask for the file size, but this might be */
  73. /* expensive with some I/O layers (think of reading a gzipped file) */
  74. /* Restrict to 64 bit processes, so as to avoid reallocs() */
  75. /* on 32 bit processes where virtual memory is scarce. */
  76. while( already_read < size )
  77. {
  78. tmsize_t bytes_read;
  79. tmsize_t to_read = size - already_read;
  80. #if SIZEOF_SIZE_T == 8
  81. if( to_read >= threshold && threshold < MAX_THRESHOLD &&
  82. already_read + to_read + rawdata_offset > tif->tif_rawdatasize )
  83. {
  84. to_read = threshold;
  85. threshold *= THRESHOLD_MULTIPLIER;
  86. }
  87. #endif
  88. if (already_read + to_read + rawdata_offset > tif->tif_rawdatasize) {
  89. uint8* new_rawdata;
  90. assert((tif->tif_flags & TIFF_MYBUFFER) != 0);
  91. tif->tif_rawdatasize = (tmsize_t)TIFFroundup_64(
  92. (uint64)already_read + to_read + rawdata_offset, 1024);
  93. if (tif->tif_rawdatasize==0) {
  94. TIFFErrorExt(tif->tif_clientdata, module,
  95. "Invalid buffer size");
  96. return 0;
  97. }
  98. new_rawdata = (uint8*) _TIFFrealloc(
  99. tif->tif_rawdata, tif->tif_rawdatasize);
  100. if( new_rawdata == 0 )
  101. {
  102. TIFFErrorExt(tif->tif_clientdata, module,
  103. "No space for data buffer at scanline %lu",
  104. (unsigned long) tif->tif_row);
  105. _TIFFfree(tif->tif_rawdata);
  106. tif->tif_rawdata = 0;
  107. tif->tif_rawdatasize = 0;
  108. return 0;
  109. }
  110. tif->tif_rawdata = new_rawdata;
  111. }
  112. if( tif->tif_rawdata == NULL )
  113. {
  114. /* should not happen in practice but helps CoverityScan */
  115. return 0;
  116. }
  117. bytes_read = TIFFReadFile(tif,
  118. tif->tif_rawdata + rawdata_offset + already_read, to_read);
  119. already_read += bytes_read;
  120. if (bytes_read != to_read) {
  121. memset( tif->tif_rawdata + rawdata_offset + already_read, 0,
  122. tif->tif_rawdatasize - rawdata_offset - already_read );
  123. #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
  124. if( is_strip )
  125. {
  126. TIFFErrorExt(tif->tif_clientdata, module,
  127. "Read error at scanline %lu; got %I64u bytes, "
  128. "expected %I64u",
  129. (unsigned long) tif->tif_row,
  130. (unsigned __int64) already_read,
  131. (unsigned __int64) size);
  132. }
  133. else
  134. {
  135. TIFFErrorExt(tif->tif_clientdata, module,
  136. "Read error at row %lu, col %lu, tile %lu; "
  137. "got %I64u bytes, expected %I64u",
  138. (unsigned long) tif->tif_row,
  139. (unsigned long) tif->tif_col,
  140. (unsigned long) strip_or_tile,
  141. (unsigned __int64) already_read,
  142. (unsigned __int64) size);
  143. }
  144. #else
  145. if( is_strip )
  146. {
  147. TIFFErrorExt(tif->tif_clientdata, module,
  148. "Read error at scanline %lu; got %llu bytes, "
  149. "expected %llu",
  150. (unsigned long) tif->tif_row,
  151. (unsigned long long) already_read,
  152. (unsigned long long) size);
  153. }
  154. else
  155. {
  156. TIFFErrorExt(tif->tif_clientdata, module,
  157. "Read error at row %lu, col %lu, tile %lu; "
  158. "got %llu bytes, expected %llu",
  159. (unsigned long) tif->tif_row,
  160. (unsigned long) tif->tif_col,
  161. (unsigned long) strip_or_tile,
  162. (unsigned long long) already_read,
  163. (unsigned long long) size);
  164. }
  165. #endif
  166. return 0;
  167. }
  168. }
  169. return 1;
  170. }
  171. static int
  172. TIFFFillStripPartial( TIFF *tif, int strip, tmsize_t read_ahead, int restart )
  173. {
  174. static const char module[] = "TIFFFillStripPartial";
  175. register TIFFDirectory *td = &tif->tif_dir;
  176. tmsize_t unused_data;
  177. uint64 read_offset;
  178. tmsize_t to_read;
  179. tmsize_t read_ahead_mod;
  180. /* tmsize_t bytecountm; */
  181. /*
  182. * Expand raw data buffer, if needed, to hold data
  183. * strip coming from file (perhaps should set upper
  184. * bound on the size of a buffer we'll use?).
  185. */
  186. /* bytecountm=(tmsize_t) TIFFGetStrileByteCount(tif, strip); */
  187. /* Not completely sure where the * 2 comes from, but probably for */
  188. /* an exponentional growth strategy of tif_rawdatasize */
  189. if( read_ahead < TIFF_TMSIZE_T_MAX / 2 )
  190. read_ahead_mod = read_ahead * 2;
  191. else
  192. read_ahead_mod = read_ahead;
  193. if (read_ahead_mod > tif->tif_rawdatasize) {
  194. assert( restart );
  195. tif->tif_curstrip = NOSTRIP;
  196. if ((tif->tif_flags & TIFF_MYBUFFER) == 0) {
  197. TIFFErrorExt(tif->tif_clientdata, module,
  198. "Data buffer too small to hold part of strip %lu",
  199. (unsigned long) strip);
  200. return (0);
  201. }
  202. }
  203. if( restart )
  204. {
  205. tif->tif_rawdataloaded = 0;
  206. tif->tif_rawdataoff = 0;
  207. }
  208. /*
  209. ** If we are reading more data, move any unused data to the
  210. ** start of the buffer.
  211. */
  212. if( tif->tif_rawdataloaded > 0 )
  213. unused_data = tif->tif_rawdataloaded - (tif->tif_rawcp - tif->tif_rawdata);
  214. else
  215. unused_data = 0;
  216. if( unused_data > 0 )
  217. {
  218. assert((tif->tif_flags&TIFF_BUFFERMMAP)==0);
  219. memmove( tif->tif_rawdata, tif->tif_rawcp, unused_data );
  220. }
  221. /*
  222. ** Seek to the point in the file where more data should be read.
  223. */
  224. read_offset = TIFFGetStrileOffset(tif, strip)
  225. + tif->tif_rawdataoff + tif->tif_rawdataloaded;
  226. if (!SeekOK(tif, read_offset)) {
  227. TIFFErrorExt(tif->tif_clientdata, module,
  228. "Seek error at scanline %lu, strip %lu",
  229. (unsigned long) tif->tif_row, (unsigned long) strip);
  230. return 0;
  231. }
  232. /*
  233. ** How much do we want to read?
  234. */
  235. if( read_ahead_mod > tif->tif_rawdatasize )
  236. to_read = read_ahead_mod - unused_data;
  237. else
  238. to_read = tif->tif_rawdatasize - unused_data;
  239. if( (uint64) to_read > TIFFGetStrileByteCount(tif, strip)
  240. - tif->tif_rawdataoff - tif->tif_rawdataloaded )
  241. {
  242. to_read = (tmsize_t) TIFFGetStrileByteCount(tif, strip)
  243. - tif->tif_rawdataoff - tif->tif_rawdataloaded;
  244. }
  245. assert((tif->tif_flags&TIFF_BUFFERMMAP)==0);
  246. if( !TIFFReadAndRealloc( tif, to_read, unused_data,
  247. 1, /* is_strip */
  248. 0, /* strip_or_tile */
  249. module) )
  250. {
  251. return 0;
  252. }
  253. tif->tif_rawdataoff = tif->tif_rawdataoff + tif->tif_rawdataloaded - unused_data ;
  254. tif->tif_rawdataloaded = unused_data + to_read;
  255. tif->tif_rawcc = tif->tif_rawdataloaded;
  256. tif->tif_rawcp = tif->tif_rawdata;
  257. if (!isFillOrder(tif, td->td_fillorder) &&
  258. (tif->tif_flags & TIFF_NOBITREV) == 0) {
  259. assert((tif->tif_flags&TIFF_BUFFERMMAP)==0);
  260. TIFFReverseBits(tif->tif_rawdata + unused_data, to_read );
  261. }
  262. /*
  263. ** When starting a strip from the beginning we need to
  264. ** restart the decoder.
  265. */
  266. if( restart )
  267. {
  268. #ifdef JPEG_SUPPORT
  269. /* A bit messy since breaks the codec abstraction. Ultimately */
  270. /* there should be a function pointer for that, but it seems */
  271. /* only JPEG is affected. */
  272. /* For JPEG, if there are multiple scans (can generally be known */
  273. /* with the read_ahead used), we need to read the whole strip */
  274. if( tif->tif_dir.td_compression==COMPRESSION_JPEG &&
  275. (uint64)tif->tif_rawcc < TIFFGetStrileByteCount(tif, strip) )
  276. {
  277. if( TIFFJPEGIsFullStripRequired(tif) )
  278. {
  279. return TIFFFillStrip(tif, strip);
  280. }
  281. }
  282. #endif
  283. return TIFFStartStrip(tif, strip);
  284. }
  285. else
  286. {
  287. return 1;
  288. }
  289. }
  290. /*
  291. * Seek to a random row+sample in a file.
  292. *
  293. * Only used by TIFFReadScanline, and is only used on
  294. * strip organized files. We do some tricky stuff to try
  295. * and avoid reading the whole compressed raw data for big
  296. * strips.
  297. */
  298. static int
  299. TIFFSeek(TIFF* tif, uint32 row, uint16 sample )
  300. {
  301. register TIFFDirectory *td = &tif->tif_dir;
  302. uint32 strip;
  303. int whole_strip;
  304. tmsize_t read_ahead = 0;
  305. /*
  306. ** Establish what strip we are working from.
  307. */
  308. if (row >= td->td_imagelength) { /* out of range */
  309. TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
  310. "%lu: Row out of range, max %lu",
  311. (unsigned long) row,
  312. (unsigned long) td->td_imagelength);
  313. return (0);
  314. }
  315. if (td->td_planarconfig == PLANARCONFIG_SEPARATE) {
  316. if (sample >= td->td_samplesperpixel) {
  317. TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
  318. "%lu: Sample out of range, max %lu",
  319. (unsigned long) sample, (unsigned long) td->td_samplesperpixel);
  320. return (0);
  321. }
  322. strip = (uint32)sample*td->td_stripsperimage + row/td->td_rowsperstrip;
  323. } else
  324. strip = row / td->td_rowsperstrip;
  325. /*
  326. * Do we want to treat this strip as one whole chunk or
  327. * read it a few lines at a time?
  328. */
  329. #if defined(CHUNKY_STRIP_READ_SUPPORT)
  330. whole_strip = TIFFGetStrileByteCount(tif, strip) < 10
  331. || isMapped(tif);
  332. if( td->td_compression == COMPRESSION_LERC ||
  333. td->td_compression == COMPRESSION_JBIG )
  334. {
  335. /* Ideally plugins should have a way to declare they don't support
  336. * chunk strip */
  337. whole_strip = 1;
  338. }
  339. #else
  340. whole_strip = 1;
  341. #endif
  342. if( !whole_strip )
  343. {
  344. /* 16 is for YCbCr mode where we may need to read 16 */
  345. /* lines at a time to get a decompressed line, and 5000 */
  346. /* is some constant value, for example for JPEG tables */
  347. if( tif->tif_scanlinesize < TIFF_TMSIZE_T_MAX / 16 &&
  348. tif->tif_scanlinesize * 16 < TIFF_TMSIZE_T_MAX - 5000 )
  349. {
  350. read_ahead = tif->tif_scanlinesize * 16 + 5000;
  351. }
  352. else
  353. {
  354. read_ahead = tif->tif_scanlinesize;
  355. }
  356. }
  357. /*
  358. * If we haven't loaded this strip, do so now, possibly
  359. * only reading the first part.
  360. */
  361. if (strip != tif->tif_curstrip) { /* different strip, refill */
  362. if( whole_strip )
  363. {
  364. if (!TIFFFillStrip(tif, strip))
  365. return (0);
  366. }
  367. else
  368. {
  369. if( !TIFFFillStripPartial(tif,strip,read_ahead,1) )
  370. return 0;
  371. }
  372. }
  373. /*
  374. ** If we already have some data loaded, do we need to read some more?
  375. */
  376. else if( !whole_strip )
  377. {
  378. if( ((tif->tif_rawdata + tif->tif_rawdataloaded) - tif->tif_rawcp) < read_ahead
  379. && (uint64) tif->tif_rawdataoff+tif->tif_rawdataloaded < TIFFGetStrileByteCount(tif, strip) )
  380. {
  381. if( !TIFFFillStripPartial(tif,strip,read_ahead,0) )
  382. return 0;
  383. }
  384. }
  385. if (row < tif->tif_row) {
  386. /*
  387. * Moving backwards within the same strip: backup
  388. * to the start and then decode forward (below).
  389. *
  390. * NB: If you're planning on lots of random access within a
  391. * strip, it's better to just read and decode the entire
  392. * strip, and then access the decoded data in a random fashion.
  393. */
  394. if( tif->tif_rawdataoff != 0 )
  395. {
  396. if( !TIFFFillStripPartial(tif,strip,read_ahead,1) )
  397. return 0;
  398. }
  399. else
  400. {
  401. if (!TIFFStartStrip(tif, strip))
  402. return (0);
  403. }
  404. }
  405. if (row != tif->tif_row) {
  406. /*
  407. * Seek forward to the desired row.
  408. */
  409. /* TODO: Will this really work with partial buffers? */
  410. if (!(*tif->tif_seek)(tif, row - tif->tif_row))
  411. return (0);
  412. tif->tif_row = row;
  413. }
  414. return (1);
  415. }
  416. int
  417. TIFFReadScanline(TIFF* tif, void* buf, uint32 row, uint16 sample)
  418. {
  419. int e;
  420. if (!TIFFCheckRead(tif, 0))
  421. return (-1);
  422. if( (e = TIFFSeek(tif, row, sample)) != 0) {
  423. /*
  424. * Decompress desired row into user buffer.
  425. */
  426. e = (*tif->tif_decoderow)
  427. (tif, (uint8*) buf, tif->tif_scanlinesize, sample);
  428. /* we are now poised at the beginning of the next row */
  429. tif->tif_row = row + 1;
  430. if (e)
  431. (*tif->tif_postdecode)(tif, (uint8*) buf,
  432. tif->tif_scanlinesize);
  433. }
  434. return (e > 0 ? 1 : -1);
  435. }
  436. /*
  437. * Calculate the strip size according to the number of
  438. * rows in the strip (check for truncated last strip on any
  439. * of the separations).
  440. */
  441. static tmsize_t TIFFReadEncodedStripGetStripSize(TIFF* tif, uint32 strip, uint16* pplane)
  442. {
  443. static const char module[] = "TIFFReadEncodedStrip";
  444. TIFFDirectory *td = &tif->tif_dir;
  445. uint32 rowsperstrip;
  446. uint32 stripsperplane;
  447. uint32 stripinplane;
  448. uint32 rows;
  449. tmsize_t stripsize;
  450. if (!TIFFCheckRead(tif,0))
  451. return((tmsize_t)(-1));
  452. if (strip>=td->td_nstrips)
  453. {
  454. TIFFErrorExt(tif->tif_clientdata,module,
  455. "%lu: Strip out of range, max %lu",(unsigned long)strip,
  456. (unsigned long)td->td_nstrips);
  457. return((tmsize_t)(-1));
  458. }
  459. rowsperstrip=td->td_rowsperstrip;
  460. if (rowsperstrip>td->td_imagelength)
  461. rowsperstrip=td->td_imagelength;
  462. stripsperplane= TIFFhowmany_32_maxuint_compat(td->td_imagelength, rowsperstrip);
  463. stripinplane=(strip%stripsperplane);
  464. if( pplane ) *pplane=(uint16)(strip/stripsperplane);
  465. rows=td->td_imagelength-stripinplane*rowsperstrip;
  466. if (rows>rowsperstrip)
  467. rows=rowsperstrip;
  468. stripsize=TIFFVStripSize(tif,rows);
  469. if (stripsize==0)
  470. return((tmsize_t)(-1));
  471. return stripsize;
  472. }
  473. /*
  474. * Read a strip of data and decompress the specified
  475. * amount into the user-supplied buffer.
  476. */
  477. tmsize_t
  478. TIFFReadEncodedStrip(TIFF* tif, uint32 strip, void* buf, tmsize_t size)
  479. {
  480. static const char module[] = "TIFFReadEncodedStrip";
  481. TIFFDirectory *td = &tif->tif_dir;
  482. tmsize_t stripsize;
  483. uint16 plane;
  484. stripsize=TIFFReadEncodedStripGetStripSize(tif, strip, &plane);
  485. if (stripsize==((tmsize_t)(-1)))
  486. return((tmsize_t)(-1));
  487. /* shortcut to avoid an extra memcpy() */
  488. if( td->td_compression == COMPRESSION_NONE &&
  489. size!=(tmsize_t)(-1) && size >= stripsize &&
  490. !isMapped(tif) &&
  491. ((tif->tif_flags&TIFF_NOREADRAW)==0) )
  492. {
  493. if (TIFFReadRawStrip1(tif, strip, buf, stripsize, module) != stripsize)
  494. return ((tmsize_t)(-1));
  495. if (!isFillOrder(tif, td->td_fillorder) &&
  496. (tif->tif_flags & TIFF_NOBITREV) == 0)
  497. TIFFReverseBits(buf,stripsize);
  498. (*tif->tif_postdecode)(tif,buf,stripsize);
  499. return (stripsize);
  500. }
  501. if ((size!=(tmsize_t)(-1))&&(size<stripsize))
  502. stripsize=size;
  503. if (!TIFFFillStrip(tif,strip))
  504. return((tmsize_t)(-1));
  505. if ((*tif->tif_decodestrip)(tif,buf,stripsize,plane)<=0)
  506. return((tmsize_t)(-1));
  507. (*tif->tif_postdecode)(tif,buf,stripsize);
  508. return(stripsize);
  509. }
  510. /* Variant of TIFFReadEncodedStrip() that does
  511. * * if *buf == NULL, *buf = _TIFFmalloc(bufsizetoalloc) only after TIFFFillStrip() has
  512. * succeeded. This avoid excessive memory allocation in case of truncated
  513. * file.
  514. * * calls regular TIFFReadEncodedStrip() if *buf != NULL
  515. */
  516. tmsize_t
  517. _TIFFReadEncodedStripAndAllocBuffer(TIFF* tif, uint32 strip,
  518. void **buf, tmsize_t bufsizetoalloc,
  519. tmsize_t size_to_read)
  520. {
  521. tmsize_t this_stripsize;
  522. uint16 plane;
  523. if( *buf != NULL )
  524. {
  525. return TIFFReadEncodedStrip(tif, strip, *buf, size_to_read);
  526. }
  527. this_stripsize=TIFFReadEncodedStripGetStripSize(tif, strip, &plane);
  528. if (this_stripsize==((tmsize_t)(-1)))
  529. return((tmsize_t)(-1));
  530. if ((size_to_read!=(tmsize_t)(-1))&&(size_to_read<this_stripsize))
  531. this_stripsize=size_to_read;
  532. if (!TIFFFillStrip(tif,strip))
  533. return((tmsize_t)(-1));
  534. *buf = _TIFFmalloc(bufsizetoalloc);
  535. if (*buf == NULL) {
  536. TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "No space for strip buffer");
  537. return((tmsize_t)(-1));
  538. }
  539. _TIFFmemset(*buf, 0, bufsizetoalloc);
  540. if ((*tif->tif_decodestrip)(tif,*buf,this_stripsize,plane)<=0)
  541. return((tmsize_t)(-1));
  542. (*tif->tif_postdecode)(tif,*buf,this_stripsize);
  543. return(this_stripsize);
  544. }
  545. static tmsize_t
  546. TIFFReadRawStrip1(TIFF* tif, uint32 strip, void* buf, tmsize_t size,
  547. const char* module)
  548. {
  549. assert((tif->tif_flags&TIFF_NOREADRAW)==0);
  550. if (!isMapped(tif)) {
  551. tmsize_t cc;
  552. if (!SeekOK(tif, TIFFGetStrileOffset(tif, strip))) {
  553. TIFFErrorExt(tif->tif_clientdata, module,
  554. "Seek error at scanline %lu, strip %lu",
  555. (unsigned long) tif->tif_row, (unsigned long) strip);
  556. return ((tmsize_t)(-1));
  557. }
  558. cc = TIFFReadFile(tif, buf, size);
  559. if (cc != size) {
  560. #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
  561. TIFFErrorExt(tif->tif_clientdata, module,
  562. "Read error at scanline %lu; got %I64u bytes, expected %I64u",
  563. (unsigned long) tif->tif_row,
  564. (unsigned __int64) cc,
  565. (unsigned __int64) size);
  566. #else
  567. TIFFErrorExt(tif->tif_clientdata, module,
  568. "Read error at scanline %lu; got %llu bytes, expected %llu",
  569. (unsigned long) tif->tif_row,
  570. (unsigned long long) cc,
  571. (unsigned long long) size);
  572. #endif
  573. return ((tmsize_t)(-1));
  574. }
  575. } else {
  576. tmsize_t ma = 0;
  577. tmsize_t n;
  578. if ((TIFFGetStrileOffset(tif, strip) > (uint64)TIFF_TMSIZE_T_MAX)||
  579. ((ma=(tmsize_t)TIFFGetStrileOffset(tif, strip))>tif->tif_size))
  580. {
  581. n=0;
  582. }
  583. else if( ma > TIFF_TMSIZE_T_MAX - size )
  584. {
  585. n=0;
  586. }
  587. else
  588. {
  589. tmsize_t mb=ma+size;
  590. if (mb>tif->tif_size)
  591. n=tif->tif_size-ma;
  592. else
  593. n=size;
  594. }
  595. if (n!=size) {
  596. #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
  597. TIFFErrorExt(tif->tif_clientdata, module,
  598. "Read error at scanline %lu, strip %lu; got %I64u bytes, expected %I64u",
  599. (unsigned long) tif->tif_row,
  600. (unsigned long) strip,
  601. (unsigned __int64) n,
  602. (unsigned __int64) size);
  603. #else
  604. TIFFErrorExt(tif->tif_clientdata, module,
  605. "Read error at scanline %lu, strip %lu; got %llu bytes, expected %llu",
  606. (unsigned long) tif->tif_row,
  607. (unsigned long) strip,
  608. (unsigned long long) n,
  609. (unsigned long long) size);
  610. #endif
  611. return ((tmsize_t)(-1));
  612. }
  613. _TIFFmemcpy(buf, tif->tif_base + ma,
  614. size);
  615. }
  616. return (size);
  617. }
  618. static tmsize_t
  619. TIFFReadRawStripOrTile2(TIFF* tif, uint32 strip_or_tile, int is_strip,
  620. tmsize_t size, const char* module)
  621. {
  622. assert( !isMapped(tif) );
  623. assert((tif->tif_flags&TIFF_NOREADRAW)==0);
  624. if (!SeekOK(tif, TIFFGetStrileOffset(tif, strip_or_tile))) {
  625. if( is_strip )
  626. {
  627. TIFFErrorExt(tif->tif_clientdata, module,
  628. "Seek error at scanline %lu, strip %lu",
  629. (unsigned long) tif->tif_row,
  630. (unsigned long) strip_or_tile);
  631. }
  632. else
  633. {
  634. TIFFErrorExt(tif->tif_clientdata, module,
  635. "Seek error at row %lu, col %lu, tile %lu",
  636. (unsigned long) tif->tif_row,
  637. (unsigned long) tif->tif_col,
  638. (unsigned long) strip_or_tile);
  639. }
  640. return ((tmsize_t)(-1));
  641. }
  642. if( !TIFFReadAndRealloc( tif, size, 0, is_strip,
  643. strip_or_tile, module ) )
  644. {
  645. return ((tmsize_t)(-1));
  646. }
  647. return (size);
  648. }
  649. /*
  650. * Read a strip of data from the file.
  651. */
  652. tmsize_t
  653. TIFFReadRawStrip(TIFF* tif, uint32 strip, void* buf, tmsize_t size)
  654. {
  655. static const char module[] = "TIFFReadRawStrip";
  656. TIFFDirectory *td = &tif->tif_dir;
  657. uint64 bytecount64;
  658. tmsize_t bytecountm;
  659. if (!TIFFCheckRead(tif, 0))
  660. return ((tmsize_t)(-1));
  661. if (strip >= td->td_nstrips) {
  662. TIFFErrorExt(tif->tif_clientdata, module,
  663. "%lu: Strip out of range, max %lu",
  664. (unsigned long) strip,
  665. (unsigned long) td->td_nstrips);
  666. return ((tmsize_t)(-1));
  667. }
  668. if (tif->tif_flags&TIFF_NOREADRAW)
  669. {
  670. TIFFErrorExt(tif->tif_clientdata, module,
  671. "Compression scheme does not support access to raw uncompressed data");
  672. return ((tmsize_t)(-1));
  673. }
  674. bytecount64 = TIFFGetStrileByteCount(tif, strip);
  675. if (size != (tmsize_t)(-1) && (uint64)size <= bytecount64)
  676. bytecountm = size;
  677. else
  678. bytecountm = _TIFFCastUInt64ToSSize(tif, bytecount64, module);
  679. if( bytecountm == 0 ) {
  680. return ((tmsize_t)(-1));
  681. }
  682. return (TIFFReadRawStrip1(tif, strip, buf, bytecountm, module));
  683. }
  684. TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
  685. static uint64 NoSanitizeSubUInt64(uint64 a, uint64 b)
  686. {
  687. return a - b;
  688. }
  689. /*
  690. * Read the specified strip and setup for decoding. The data buffer is
  691. * expanded, as necessary, to hold the strip's data.
  692. */
  693. int
  694. TIFFFillStrip(TIFF* tif, uint32 strip)
  695. {
  696. static const char module[] = "TIFFFillStrip";
  697. TIFFDirectory *td = &tif->tif_dir;
  698. if ((tif->tif_flags&TIFF_NOREADRAW)==0)
  699. {
  700. uint64 bytecount = TIFFGetStrileByteCount(tif, strip);
  701. if( bytecount == 0 || bytecount > (uint64)TIFF_INT64_MAX ) {
  702. #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
  703. TIFFErrorExt(tif->tif_clientdata, module,
  704. "Invalid strip byte count %I64u, strip %lu",
  705. (unsigned __int64) bytecount,
  706. (unsigned long) strip);
  707. #else
  708. TIFFErrorExt(tif->tif_clientdata, module,
  709. "Invalid strip byte count %llu, strip %lu",
  710. (unsigned long long) bytecount,
  711. (unsigned long) strip);
  712. #endif
  713. return (0);
  714. }
  715. /* To avoid excessive memory allocations: */
  716. /* Byte count should normally not be larger than a number of */
  717. /* times the uncompressed size plus some margin */
  718. if( bytecount > 1024 * 1024 )
  719. {
  720. /* 10 and 4096 are just values that could be adjusted. */
  721. /* Hopefully they are safe enough for all codecs */
  722. tmsize_t stripsize = TIFFStripSize(tif);
  723. if( stripsize != 0 &&
  724. (bytecount - 4096) / 10 > (uint64)stripsize )
  725. {
  726. uint64 newbytecount = (uint64)stripsize * 10 + 4096;
  727. if( newbytecount == 0 || newbytecount > (uint64)TIFF_INT64_MAX )
  728. {
  729. #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
  730. TIFFWarningExt(tif->tif_clientdata, module,
  731. "Too large strip byte count %I64u, strip %lu. Limiting to %I64u",
  732. (unsigned __int64) bytecount,
  733. (unsigned long) strip,
  734. (unsigned __int64) newbytecount);
  735. #else
  736. TIFFErrorExt(tif->tif_clientdata, module,
  737. "Too large strip byte count %llu, strip %lu. Limiting to %llu",
  738. (unsigned long long) bytecount,
  739. (unsigned long) strip,
  740. (unsigned long long) newbytecount);
  741. #endif
  742. bytecount = newbytecount;
  743. }
  744. }
  745. }
  746. if (isMapped(tif)) {
  747. /*
  748. * We must check for overflow, potentially causing
  749. * an OOB read. Instead of simple
  750. *
  751. * TIFFGetStrileOffset(tif, strip)+bytecount > tif->tif_size
  752. *
  753. * comparison (which can overflow) we do the following
  754. * two comparisons:
  755. */
  756. if (bytecount > (uint64)tif->tif_size ||
  757. TIFFGetStrileOffset(tif, strip) > (uint64)tif->tif_size - bytecount) {
  758. /*
  759. * This error message might seem strange, but
  760. * it's what would happen if a read were done
  761. * instead.
  762. */
  763. #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
  764. TIFFErrorExt(tif->tif_clientdata, module,
  765. "Read error on strip %lu; "
  766. "got %I64u bytes, expected %I64u",
  767. (unsigned long) strip,
  768. (unsigned __int64) NoSanitizeSubUInt64(tif->tif_size, TIFFGetStrileOffset(tif, strip)),
  769. (unsigned __int64) bytecount);
  770. #else
  771. TIFFErrorExt(tif->tif_clientdata, module,
  772. "Read error on strip %lu; "
  773. "got %llu bytes, expected %llu",
  774. (unsigned long) strip,
  775. (unsigned long long) NoSanitizeSubUInt64(tif->tif_size, TIFFGetStrileOffset(tif, strip)),
  776. (unsigned long long) bytecount);
  777. #endif
  778. tif->tif_curstrip = NOSTRIP;
  779. return (0);
  780. }
  781. }
  782. if (isMapped(tif) &&
  783. (isFillOrder(tif, td->td_fillorder)
  784. || (tif->tif_flags & TIFF_NOBITREV))) {
  785. /*
  786. * The image is mapped into memory and we either don't
  787. * need to flip bits or the compression routine is
  788. * going to handle this operation itself. In this
  789. * case, avoid copying the raw data and instead just
  790. * reference the data from the memory mapped file
  791. * image. This assumes that the decompression
  792. * routines do not modify the contents of the raw data
  793. * buffer (if they try to, the application will get a
  794. * fault since the file is mapped read-only).
  795. */
  796. if ((tif->tif_flags & TIFF_MYBUFFER) && tif->tif_rawdata) {
  797. _TIFFfree(tif->tif_rawdata);
  798. tif->tif_rawdata = NULL;
  799. tif->tif_rawdatasize = 0;
  800. }
  801. tif->tif_flags &= ~TIFF_MYBUFFER;
  802. tif->tif_rawdatasize = (tmsize_t)bytecount;
  803. tif->tif_rawdata = tif->tif_base + (tmsize_t)TIFFGetStrileOffset(tif, strip);
  804. tif->tif_rawdataoff = 0;
  805. tif->tif_rawdataloaded = (tmsize_t) bytecount;
  806. /*
  807. * When we have tif_rawdata reference directly into the memory mapped file
  808. * we need to be pretty careful about how we use the rawdata. It is not
  809. * a general purpose working buffer as it normally otherwise is. So we
  810. * keep track of this fact to avoid using it improperly.
  811. */
  812. tif->tif_flags |= TIFF_BUFFERMMAP;
  813. } else {
  814. /*
  815. * Expand raw data buffer, if needed, to hold data
  816. * strip coming from file (perhaps should set upper
  817. * bound on the size of a buffer we'll use?).
  818. */
  819. tmsize_t bytecountm;
  820. bytecountm=(tmsize_t)bytecount;
  821. if ((uint64)bytecountm!=bytecount)
  822. {
  823. TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
  824. return(0);
  825. }
  826. if (bytecountm > tif->tif_rawdatasize) {
  827. tif->tif_curstrip = NOSTRIP;
  828. if ((tif->tif_flags & TIFF_MYBUFFER) == 0) {
  829. TIFFErrorExt(tif->tif_clientdata, module,
  830. "Data buffer too small to hold strip %lu",
  831. (unsigned long) strip);
  832. return (0);
  833. }
  834. }
  835. if (tif->tif_flags&TIFF_BUFFERMMAP) {
  836. tif->tif_curstrip = NOSTRIP;
  837. tif->tif_rawdata = NULL;
  838. tif->tif_rawdatasize = 0;
  839. tif->tif_flags &= ~TIFF_BUFFERMMAP;
  840. }
  841. if( isMapped(tif) )
  842. {
  843. if (bytecountm > tif->tif_rawdatasize &&
  844. !TIFFReadBufferSetup(tif, 0, bytecountm))
  845. {
  846. return (0);
  847. }
  848. if (TIFFReadRawStrip1(tif, strip, tif->tif_rawdata,
  849. bytecountm, module) != bytecountm)
  850. {
  851. return (0);
  852. }
  853. }
  854. else
  855. {
  856. if (TIFFReadRawStripOrTile2(tif, strip, 1,
  857. bytecountm, module) != bytecountm)
  858. {
  859. return (0);
  860. }
  861. }
  862. tif->tif_rawdataoff = 0;
  863. tif->tif_rawdataloaded = bytecountm;
  864. if (!isFillOrder(tif, td->td_fillorder) &&
  865. (tif->tif_flags & TIFF_NOBITREV) == 0)
  866. TIFFReverseBits(tif->tif_rawdata, bytecountm);
  867. }
  868. }
  869. return (TIFFStartStrip(tif, strip));
  870. }
  871. /*
  872. * Tile-oriented Read Support
  873. * Contributed by Nancy Cam (Silicon Graphics).
  874. */
  875. /*
  876. * Read and decompress a tile of data. The
  877. * tile is selected by the (x,y,z,s) coordinates.
  878. */
  879. tmsize_t
  880. TIFFReadTile(TIFF* tif, void* buf, uint32 x, uint32 y, uint32 z, uint16 s)
  881. {
  882. if (!TIFFCheckRead(tif, 1) || !TIFFCheckTile(tif, x, y, z, s))
  883. return ((tmsize_t)(-1));
  884. return (TIFFReadEncodedTile(tif,
  885. TIFFComputeTile(tif, x, y, z, s), buf, (tmsize_t)(-1)));
  886. }
  887. /*
  888. * Read a tile of data and decompress the specified
  889. * amount into the user-supplied buffer.
  890. */
  891. tmsize_t
  892. TIFFReadEncodedTile(TIFF* tif, uint32 tile, void* buf, tmsize_t size)
  893. {
  894. static const char module[] = "TIFFReadEncodedTile";
  895. TIFFDirectory *td = &tif->tif_dir;
  896. tmsize_t tilesize = tif->tif_tilesize;
  897. if (!TIFFCheckRead(tif, 1))
  898. return ((tmsize_t)(-1));
  899. if (tile >= td->td_nstrips) {
  900. TIFFErrorExt(tif->tif_clientdata, module,
  901. "%lu: Tile out of range, max %lu",
  902. (unsigned long) tile, (unsigned long) td->td_nstrips);
  903. return ((tmsize_t)(-1));
  904. }
  905. /* shortcut to avoid an extra memcpy() */
  906. if( td->td_compression == COMPRESSION_NONE &&
  907. size!=(tmsize_t)(-1) && size >= tilesize &&
  908. !isMapped(tif) &&
  909. ((tif->tif_flags&TIFF_NOREADRAW)==0) )
  910. {
  911. if (TIFFReadRawTile1(tif, tile, buf, tilesize, module) != tilesize)
  912. return ((tmsize_t)(-1));
  913. if (!isFillOrder(tif, td->td_fillorder) &&
  914. (tif->tif_flags & TIFF_NOBITREV) == 0)
  915. TIFFReverseBits(buf,tilesize);
  916. (*tif->tif_postdecode)(tif,buf,tilesize);
  917. return (tilesize);
  918. }
  919. if (size == (tmsize_t)(-1))
  920. size = tilesize;
  921. else if (size > tilesize)
  922. size = tilesize;
  923. if (TIFFFillTile(tif, tile) && (*tif->tif_decodetile)(tif,
  924. (uint8*) buf, size, (uint16)(tile/td->td_stripsperimage))) {
  925. (*tif->tif_postdecode)(tif, (uint8*) buf, size);
  926. return (size);
  927. } else
  928. return ((tmsize_t)(-1));
  929. }
  930. /* Variant of TIFFReadTile() that does
  931. * * if *buf == NULL, *buf = _TIFFmalloc(bufsizetoalloc) only after TIFFFillTile() has
  932. * succeeded. This avoid excessive memory allocation in case of truncated
  933. * file.
  934. * * calls regular TIFFReadEncodedTile() if *buf != NULL
  935. */
  936. tmsize_t
  937. _TIFFReadTileAndAllocBuffer(TIFF* tif,
  938. void **buf, tmsize_t bufsizetoalloc,
  939. uint32 x, uint32 y, uint32 z, uint16 s)
  940. {
  941. if (!TIFFCheckRead(tif, 1) || !TIFFCheckTile(tif, x, y, z, s))
  942. return ((tmsize_t)(-1));
  943. return (_TIFFReadEncodedTileAndAllocBuffer(tif,
  944. TIFFComputeTile(tif, x, y, z, s),
  945. buf, bufsizetoalloc,
  946. (tmsize_t)(-1)));
  947. }
  948. /* Variant of TIFFReadEncodedTile() that does
  949. * * if *buf == NULL, *buf = _TIFFmalloc(bufsizetoalloc) only after TIFFFillTile() has
  950. * succeeded. This avoid excessive memory allocation in case of truncated
  951. * file.
  952. * * calls regular TIFFReadEncodedTile() if *buf != NULL
  953. */
  954. tmsize_t
  955. _TIFFReadEncodedTileAndAllocBuffer(TIFF* tif, uint32 tile,
  956. void **buf, tmsize_t bufsizetoalloc,
  957. tmsize_t size_to_read)
  958. {
  959. static const char module[] = "_TIFFReadEncodedTileAndAllocBuffer";
  960. TIFFDirectory *td = &tif->tif_dir;
  961. tmsize_t tilesize = tif->tif_tilesize;
  962. if( *buf != NULL )
  963. {
  964. return TIFFReadEncodedTile(tif, tile, *buf, size_to_read);
  965. }
  966. if (!TIFFCheckRead(tif, 1))
  967. return ((tmsize_t)(-1));
  968. if (tile >= td->td_nstrips) {
  969. TIFFErrorExt(tif->tif_clientdata, module,
  970. "%lu: Tile out of range, max %lu",
  971. (unsigned long) tile, (unsigned long) td->td_nstrips);
  972. return ((tmsize_t)(-1));
  973. }
  974. if (!TIFFFillTile(tif,tile))
  975. return((tmsize_t)(-1));
  976. *buf = _TIFFmalloc(bufsizetoalloc);
  977. if (*buf == NULL) {
  978. TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif),
  979. "No space for tile buffer");
  980. return((tmsize_t)(-1));
  981. }
  982. _TIFFmemset(*buf, 0, bufsizetoalloc);
  983. if (size_to_read == (tmsize_t)(-1))
  984. size_to_read = tilesize;
  985. else if (size_to_read > tilesize)
  986. size_to_read = tilesize;
  987. if( (*tif->tif_decodetile)(tif,
  988. (uint8*) *buf, size_to_read, (uint16)(tile/td->td_stripsperimage))) {
  989. (*tif->tif_postdecode)(tif, (uint8*) *buf, size_to_read);
  990. return (size_to_read);
  991. } else
  992. return ((tmsize_t)(-1));
  993. }
  994. static tmsize_t
  995. TIFFReadRawTile1(TIFF* tif, uint32 tile, void* buf, tmsize_t size, const char* module)
  996. {
  997. assert((tif->tif_flags&TIFF_NOREADRAW)==0);
  998. if (!isMapped(tif)) {
  999. tmsize_t cc;
  1000. if (!SeekOK(tif, TIFFGetStrileOffset(tif, tile))) {
  1001. TIFFErrorExt(tif->tif_clientdata, module,
  1002. "Seek error at row %lu, col %lu, tile %lu",
  1003. (unsigned long) tif->tif_row,
  1004. (unsigned long) tif->tif_col,
  1005. (unsigned long) tile);
  1006. return ((tmsize_t)(-1));
  1007. }
  1008. cc = TIFFReadFile(tif, buf, size);
  1009. if (cc != size) {
  1010. #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
  1011. TIFFErrorExt(tif->tif_clientdata, module,
  1012. "Read error at row %lu, col %lu; got %I64u bytes, expected %I64u",
  1013. (unsigned long) tif->tif_row,
  1014. (unsigned long) tif->tif_col,
  1015. (unsigned __int64) cc,
  1016. (unsigned __int64) size);
  1017. #else
  1018. TIFFErrorExt(tif->tif_clientdata, module,
  1019. "Read error at row %lu, col %lu; got %llu bytes, expected %llu",
  1020. (unsigned long) tif->tif_row,
  1021. (unsigned long) tif->tif_col,
  1022. (unsigned long long) cc,
  1023. (unsigned long long) size);
  1024. #endif
  1025. return ((tmsize_t)(-1));
  1026. }
  1027. } else {
  1028. tmsize_t ma,mb;
  1029. tmsize_t n;
  1030. ma=(tmsize_t)TIFFGetStrileOffset(tif, tile);
  1031. mb=ma+size;
  1032. if ((TIFFGetStrileOffset(tif, tile) > (uint64)TIFF_TMSIZE_T_MAX)||(ma>tif->tif_size))
  1033. n=0;
  1034. else if ((mb<ma)||(mb<size)||(mb>tif->tif_size))
  1035. n=tif->tif_size-ma;
  1036. else
  1037. n=size;
  1038. if (n!=size) {
  1039. #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
  1040. TIFFErrorExt(tif->tif_clientdata, module,
  1041. "Read error at row %lu, col %lu, tile %lu; got %I64u bytes, expected %I64u",
  1042. (unsigned long) tif->tif_row,
  1043. (unsigned long) tif->tif_col,
  1044. (unsigned long) tile,
  1045. (unsigned __int64) n,
  1046. (unsigned __int64) size);
  1047. #else
  1048. TIFFErrorExt(tif->tif_clientdata, module,
  1049. "Read error at row %lu, col %lu, tile %lu; got %llu bytes, expected %llu",
  1050. (unsigned long) tif->tif_row,
  1051. (unsigned long) tif->tif_col,
  1052. (unsigned long) tile,
  1053. (unsigned long long) n,
  1054. (unsigned long long) size);
  1055. #endif
  1056. return ((tmsize_t)(-1));
  1057. }
  1058. _TIFFmemcpy(buf, tif->tif_base + ma, size);
  1059. }
  1060. return (size);
  1061. }
  1062. /*
  1063. * Read a tile of data from the file.
  1064. */
  1065. tmsize_t
  1066. TIFFReadRawTile(TIFF* tif, uint32 tile, void* buf, tmsize_t size)
  1067. {
  1068. static const char module[] = "TIFFReadRawTile";
  1069. TIFFDirectory *td = &tif->tif_dir;
  1070. uint64 bytecount64;
  1071. tmsize_t bytecountm;
  1072. if (!TIFFCheckRead(tif, 1))
  1073. return ((tmsize_t)(-1));
  1074. if (tile >= td->td_nstrips) {
  1075. TIFFErrorExt(tif->tif_clientdata, module,
  1076. "%lu: Tile out of range, max %lu",
  1077. (unsigned long) tile, (unsigned long) td->td_nstrips);
  1078. return ((tmsize_t)(-1));
  1079. }
  1080. if (tif->tif_flags&TIFF_NOREADRAW)
  1081. {
  1082. TIFFErrorExt(tif->tif_clientdata, module,
  1083. "Compression scheme does not support access to raw uncompressed data");
  1084. return ((tmsize_t)(-1));
  1085. }
  1086. bytecount64 = TIFFGetStrileByteCount(tif, tile);
  1087. if (size != (tmsize_t)(-1) && (uint64)size <= bytecount64)
  1088. bytecountm = size;
  1089. else
  1090. bytecountm = _TIFFCastUInt64ToSSize(tif, bytecount64, module);
  1091. if( bytecountm == 0 ) {
  1092. return ((tmsize_t)(-1));
  1093. }
  1094. return (TIFFReadRawTile1(tif, tile, buf, bytecountm, module));
  1095. }
  1096. /*
  1097. * Read the specified tile and setup for decoding. The data buffer is
  1098. * expanded, as necessary, to hold the tile's data.
  1099. */
  1100. int
  1101. TIFFFillTile(TIFF* tif, uint32 tile)
  1102. {
  1103. static const char module[] = "TIFFFillTile";
  1104. TIFFDirectory *td = &tif->tif_dir;
  1105. if ((tif->tif_flags&TIFF_NOREADRAW)==0)
  1106. {
  1107. uint64 bytecount = TIFFGetStrileByteCount(tif, tile);
  1108. if( bytecount == 0 || bytecount > (uint64)TIFF_INT64_MAX ) {
  1109. #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
  1110. TIFFErrorExt(tif->tif_clientdata, module,
  1111. "%I64u: Invalid tile byte count, tile %lu",
  1112. (unsigned __int64) bytecount,
  1113. (unsigned long) tile);
  1114. #else
  1115. TIFFErrorExt(tif->tif_clientdata, module,
  1116. "%llu: Invalid tile byte count, tile %lu",
  1117. (unsigned long long) bytecount,
  1118. (unsigned long) tile);
  1119. #endif
  1120. return (0);
  1121. }
  1122. /* To avoid excessive memory allocations: */
  1123. /* Byte count should normally not be larger than a number of */
  1124. /* times the uncompressed size plus some margin */
  1125. if( bytecount > 1024 * 1024 )
  1126. {
  1127. /* 10 and 4096 are just values that could be adjusted. */
  1128. /* Hopefully they are safe enough for all codecs */
  1129. tmsize_t stripsize = TIFFTileSize(tif);
  1130. if( stripsize != 0 &&
  1131. (bytecount - 4096) / 10 > (uint64)stripsize )
  1132. {
  1133. uint64 newbytecount = (uint64)stripsize * 10 + 4096;
  1134. if( newbytecount == 0 || newbytecount > (uint64)TIFF_INT64_MAX )
  1135. {
  1136. #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
  1137. TIFFWarningExt(tif->tif_clientdata, module,
  1138. "Too large tile byte count %I64u, tile %lu. Limiting to %I64u",
  1139. (unsigned __int64) bytecount,
  1140. (unsigned long) tile,
  1141. (unsigned __int64) newbytecount);
  1142. #else
  1143. TIFFErrorExt(tif->tif_clientdata, module,
  1144. "Too large tile byte count %llu, tile %lu. Limiting to %llu",
  1145. (unsigned long long) bytecount,
  1146. (unsigned long) tile,
  1147. (unsigned long long) newbytecount);
  1148. #endif
  1149. bytecount = newbytecount;
  1150. }
  1151. }
  1152. }
  1153. if (isMapped(tif)) {
  1154. /*
  1155. * We must check for overflow, potentially causing
  1156. * an OOB read. Instead of simple
  1157. *
  1158. * TIFFGetStrileOffset(tif, tile)+bytecount > tif->tif_size
  1159. *
  1160. * comparison (which can overflow) we do the following
  1161. * two comparisons:
  1162. */
  1163. if (bytecount > (uint64)tif->tif_size ||
  1164. TIFFGetStrileOffset(tif, tile) > (uint64)tif->tif_size - bytecount) {
  1165. tif->tif_curtile = NOTILE;
  1166. return (0);
  1167. }
  1168. }
  1169. if (isMapped(tif) &&
  1170. (isFillOrder(tif, td->td_fillorder)
  1171. || (tif->tif_flags & TIFF_NOBITREV))) {
  1172. /*
  1173. * The image is mapped into memory and we either don't
  1174. * need to flip bits or the compression routine is
  1175. * going to handle this operation itself. In this
  1176. * case, avoid copying the raw data and instead just
  1177. * reference the data from the memory mapped file
  1178. * image. This assumes that the decompression
  1179. * routines do not modify the contents of the raw data
  1180. * buffer (if they try to, the application will get a
  1181. * fault since the file is mapped read-only).
  1182. */
  1183. if ((tif->tif_flags & TIFF_MYBUFFER) && tif->tif_rawdata) {
  1184. _TIFFfree(tif->tif_rawdata);
  1185. tif->tif_rawdata = NULL;
  1186. tif->tif_rawdatasize = 0;
  1187. }
  1188. tif->tif_flags &= ~TIFF_MYBUFFER;
  1189. tif->tif_rawdatasize = (tmsize_t)bytecount;
  1190. tif->tif_rawdata =
  1191. tif->tif_base + (tmsize_t)TIFFGetStrileOffset(tif, tile);
  1192. tif->tif_rawdataoff = 0;
  1193. tif->tif_rawdataloaded = (tmsize_t) bytecount;
  1194. tif->tif_flags |= TIFF_BUFFERMMAP;
  1195. } else {
  1196. /*
  1197. * Expand raw data buffer, if needed, to hold data
  1198. * tile coming from file (perhaps should set upper
  1199. * bound on the size of a buffer we'll use?).
  1200. */
  1201. tmsize_t bytecountm;
  1202. bytecountm=(tmsize_t)bytecount;
  1203. if ((uint64)bytecountm!=bytecount)
  1204. {
  1205. TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
  1206. return(0);
  1207. }
  1208. if (bytecountm > tif->tif_rawdatasize) {
  1209. tif->tif_curtile = NOTILE;
  1210. if ((tif->tif_flags & TIFF_MYBUFFER) == 0) {
  1211. TIFFErrorExt(tif->tif_clientdata, module,
  1212. "Data buffer too small to hold tile %lu",
  1213. (unsigned long) tile);
  1214. return (0);
  1215. }
  1216. }
  1217. if (tif->tif_flags&TIFF_BUFFERMMAP) {
  1218. tif->tif_curtile = NOTILE;
  1219. tif->tif_rawdata = NULL;
  1220. tif->tif_rawdatasize = 0;
  1221. tif->tif_flags &= ~TIFF_BUFFERMMAP;
  1222. }
  1223. if( isMapped(tif) )
  1224. {
  1225. if (bytecountm > tif->tif_rawdatasize &&
  1226. !TIFFReadBufferSetup(tif, 0, bytecountm))
  1227. {
  1228. return (0);
  1229. }
  1230. if (TIFFReadRawTile1(tif, tile, tif->tif_rawdata,
  1231. bytecountm, module) != bytecountm)
  1232. {
  1233. return (0);
  1234. }
  1235. }
  1236. else
  1237. {
  1238. if (TIFFReadRawStripOrTile2(tif, tile, 0,
  1239. bytecountm, module) != bytecountm)
  1240. {
  1241. return (0);
  1242. }
  1243. }
  1244. tif->tif_rawdataoff = 0;
  1245. tif->tif_rawdataloaded = bytecountm;
  1246. if (tif->tif_rawdata != NULL &&
  1247. !isFillOrder(tif, td->td_fillorder) &&
  1248. (tif->tif_flags & TIFF_NOBITREV) == 0)
  1249. TIFFReverseBits(tif->tif_rawdata,
  1250. tif->tif_rawdataloaded);
  1251. }
  1252. }
  1253. return (TIFFStartTile(tif, tile));
  1254. }
  1255. /*
  1256. * Setup the raw data buffer in preparation for
  1257. * reading a strip of raw data. If the buffer
  1258. * is specified as zero, then a buffer of appropriate
  1259. * size is allocated by the library. Otherwise,
  1260. * the client must guarantee that the buffer is
  1261. * large enough to hold any individual strip of
  1262. * raw data.
  1263. */
  1264. int
  1265. TIFFReadBufferSetup(TIFF* tif, void* bp, tmsize_t size)
  1266. {
  1267. static const char module[] = "TIFFReadBufferSetup";
  1268. assert((tif->tif_flags&TIFF_NOREADRAW)==0);
  1269. tif->tif_flags &= ~TIFF_BUFFERMMAP;
  1270. if (tif->tif_rawdata) {
  1271. if (tif->tif_flags & TIFF_MYBUFFER)
  1272. _TIFFfree(tif->tif_rawdata);
  1273. tif->tif_rawdata = NULL;
  1274. tif->tif_rawdatasize = 0;
  1275. }
  1276. if (bp) {
  1277. tif->tif_rawdatasize = size;
  1278. tif->tif_rawdata = (uint8*) bp;
  1279. tif->tif_flags &= ~TIFF_MYBUFFER;
  1280. } else {
  1281. tif->tif_rawdatasize = (tmsize_t)TIFFroundup_64((uint64)size, 1024);
  1282. if (tif->tif_rawdatasize==0) {
  1283. TIFFErrorExt(tif->tif_clientdata, module,
  1284. "Invalid buffer size");
  1285. return (0);
  1286. }
  1287. /* Initialize to zero to avoid uninitialized buffers in case of */
  1288. /* short reads (http://bugzilla.maptools.org/show_bug.cgi?id=2651) */
  1289. tif->tif_rawdata = (uint8*) _TIFFcalloc(1, tif->tif_rawdatasize);
  1290. tif->tif_flags |= TIFF_MYBUFFER;
  1291. }
  1292. if (tif->tif_rawdata == NULL) {
  1293. TIFFErrorExt(tif->tif_clientdata, module,
  1294. "No space for data buffer at scanline %lu",
  1295. (unsigned long) tif->tif_row);
  1296. tif->tif_rawdatasize = 0;
  1297. return (0);
  1298. }
  1299. return (1);
  1300. }
  1301. /*
  1302. * Set state to appear as if a
  1303. * strip has just been read in.
  1304. */
  1305. static int
  1306. TIFFStartStrip(TIFF* tif, uint32 strip)
  1307. {
  1308. TIFFDirectory *td = &tif->tif_dir;
  1309. if ((tif->tif_flags & TIFF_CODERSETUP) == 0) {
  1310. if (!(*tif->tif_setupdecode)(tif))
  1311. return (0);
  1312. tif->tif_flags |= TIFF_CODERSETUP;
  1313. }
  1314. tif->tif_curstrip = strip;
  1315. tif->tif_row = (strip % td->td_stripsperimage) * td->td_rowsperstrip;
  1316. tif->tif_flags &= ~TIFF_BUF4WRITE;
  1317. if (tif->tif_flags&TIFF_NOREADRAW)
  1318. {
  1319. tif->tif_rawcp = NULL;
  1320. tif->tif_rawcc = 0;
  1321. }
  1322. else
  1323. {
  1324. tif->tif_rawcp = tif->tif_rawdata;
  1325. if( tif->tif_rawdataloaded > 0 )
  1326. tif->tif_rawcc = tif->tif_rawdataloaded;
  1327. else
  1328. tif->tif_rawcc = (tmsize_t)TIFFGetStrileByteCount(tif, strip);
  1329. }
  1330. if ((*tif->tif_predecode)(tif,
  1331. (uint16)(strip / td->td_stripsperimage)) == 0 ) {
  1332. /* Needed for example for scanline access, if tif_predecode */
  1333. /* fails, and we try to read the same strip again. Without invalidating */
  1334. /* tif_curstrip, we'd call tif_decoderow() on a possibly invalid */
  1335. /* codec state. */
  1336. tif->tif_curstrip = NOSTRIP;
  1337. return 0;
  1338. }
  1339. return 1;
  1340. }
  1341. /*
  1342. * Set state to appear as if a
  1343. * tile has just been read in.
  1344. */
  1345. static int
  1346. TIFFStartTile(TIFF* tif, uint32 tile)
  1347. {
  1348. static const char module[] = "TIFFStartTile";
  1349. TIFFDirectory *td = &tif->tif_dir;
  1350. uint32 howmany32;
  1351. if ((tif->tif_flags & TIFF_CODERSETUP) == 0) {
  1352. if (!(*tif->tif_setupdecode)(tif))
  1353. return (0);
  1354. tif->tif_flags |= TIFF_CODERSETUP;
  1355. }
  1356. tif->tif_curtile = tile;
  1357. howmany32=TIFFhowmany_32(td->td_imagewidth, td->td_tilewidth);
  1358. if (howmany32 == 0) {
  1359. TIFFErrorExt(tif->tif_clientdata,module,"Zero tiles");
  1360. return 0;
  1361. }
  1362. tif->tif_row = (tile % howmany32) * td->td_tilelength;
  1363. howmany32=TIFFhowmany_32(td->td_imagelength, td->td_tilelength);
  1364. if (howmany32 == 0) {
  1365. TIFFErrorExt(tif->tif_clientdata,module,"Zero tiles");
  1366. return 0;
  1367. }
  1368. tif->tif_col = (tile % howmany32) * td->td_tilewidth;
  1369. tif->tif_flags &= ~TIFF_BUF4WRITE;
  1370. if (tif->tif_flags&TIFF_NOREADRAW)
  1371. {
  1372. tif->tif_rawcp = NULL;
  1373. tif->tif_rawcc = 0;
  1374. }
  1375. else
  1376. {
  1377. tif->tif_rawcp = tif->tif_rawdata;
  1378. if( tif->tif_rawdataloaded > 0 )
  1379. tif->tif_rawcc = tif->tif_rawdataloaded;
  1380. else
  1381. tif->tif_rawcc = (tmsize_t)TIFFGetStrileByteCount(tif, tile);
  1382. }
  1383. return ((*tif->tif_predecode)(tif,
  1384. (uint16)(tile/td->td_stripsperimage)));
  1385. }
  1386. static int
  1387. TIFFCheckRead(TIFF* tif, int tiles)
  1388. {
  1389. if (tif->tif_mode == O_WRONLY) {
  1390. TIFFErrorExt(tif->tif_clientdata, tif->tif_name, "File not open for reading");
  1391. return (0);
  1392. }
  1393. if (tiles ^ isTiled(tif)) {
  1394. TIFFErrorExt(tif->tif_clientdata, tif->tif_name, tiles ?
  1395. "Can not read tiles from a striped image" :
  1396. "Can not read scanlines from a tiled image");
  1397. return (0);
  1398. }
  1399. return (1);
  1400. }
  1401. /* Use the provided input buffer (inbuf, insize) and decompress it into
  1402. * (outbuf, outsize).
  1403. * This function replaces the use of TIFFReadEncodedStrip()/TIFFReadEncodedTile()
  1404. * when the user can provide the buffer for the input data, for example when
  1405. * he wants to avoid libtiff to read the strile offset/count values from the
  1406. * [Strip|Tile][Offsets/ByteCounts] array.
  1407. * inbuf content must be writable (if bit reversal is needed)
  1408. * Returns 1 in case of success, 0 otherwise.
  1409. */
  1410. int TIFFReadFromUserBuffer(TIFF* tif, uint32 strile,
  1411. void* inbuf, tmsize_t insize,
  1412. void* outbuf, tmsize_t outsize)
  1413. {
  1414. static const char module[] = "TIFFReadFromUserBuffer";
  1415. TIFFDirectory *td = &tif->tif_dir;
  1416. int ret = 1;
  1417. uint32 old_tif_flags = tif->tif_flags;
  1418. tmsize_t old_rawdatasize = tif->tif_rawdatasize;
  1419. void* old_rawdata = tif->tif_rawdata;
  1420. if (tif->tif_mode == O_WRONLY) {
  1421. TIFFErrorExt(tif->tif_clientdata, tif->tif_name, "File not open for reading");
  1422. return 0;
  1423. }
  1424. if (tif->tif_flags&TIFF_NOREADRAW)
  1425. {
  1426. TIFFErrorExt(tif->tif_clientdata, module,
  1427. "Compression scheme does not support access to raw uncompressed data");
  1428. return 0;
  1429. }
  1430. tif->tif_flags &= ~TIFF_MYBUFFER;
  1431. tif->tif_flags |= TIFF_BUFFERMMAP;
  1432. tif->tif_rawdatasize = insize;
  1433. tif->tif_rawdata = inbuf;
  1434. tif->tif_rawdataoff = 0;
  1435. tif->tif_rawdataloaded = insize;
  1436. if (!isFillOrder(tif, td->td_fillorder) &&
  1437. (tif->tif_flags & TIFF_NOBITREV) == 0)
  1438. {
  1439. TIFFReverseBits(inbuf, insize);
  1440. }
  1441. if( TIFFIsTiled(tif) )
  1442. {
  1443. if( !TIFFStartTile(tif, strile) ||
  1444. !(*tif->tif_decodetile)(tif, (uint8*) outbuf, outsize,
  1445. (uint16)(strile/td->td_stripsperimage)) )
  1446. {
  1447. ret = 0;
  1448. }
  1449. }
  1450. else
  1451. {
  1452. uint32 rowsperstrip=td->td_rowsperstrip;
  1453. uint32 stripsperplane;
  1454. if (rowsperstrip>td->td_imagelength)
  1455. rowsperstrip=td->td_imagelength;
  1456. stripsperplane= TIFFhowmany_32_maxuint_compat(td->td_imagelength, rowsperstrip);
  1457. if( !TIFFStartStrip(tif, strile) ||
  1458. !(*tif->tif_decodestrip)(tif, (uint8*) outbuf, outsize,
  1459. (uint16)(strile/stripsperplane)) )
  1460. {
  1461. ret = 0;
  1462. }
  1463. }
  1464. if( ret )
  1465. {
  1466. (*tif->tif_postdecode)(tif, (uint8*) outbuf, outsize);
  1467. }
  1468. if (!isFillOrder(tif, td->td_fillorder) &&
  1469. (tif->tif_flags & TIFF_NOBITREV) == 0)
  1470. {
  1471. TIFFReverseBits(inbuf, insize);
  1472. }
  1473. tif->tif_flags = old_tif_flags;
  1474. tif->tif_rawdatasize = old_rawdatasize;
  1475. tif->tif_rawdata = old_rawdata;
  1476. tif->tif_rawdataoff = 0;
  1477. tif->tif_rawdataloaded = 0;
  1478. return ret;
  1479. }
  1480. void
  1481. _TIFFNoPostDecode(TIFF* tif, uint8* buf, tmsize_t cc)
  1482. {
  1483. (void) tif; (void) buf; (void) cc;
  1484. }
  1485. void
  1486. _TIFFSwab16BitData(TIFF* tif, uint8* buf, tmsize_t cc)
  1487. {
  1488. (void) tif;
  1489. assert((cc & 1) == 0);
  1490. TIFFSwabArrayOfShort((uint16*) buf, cc/2);
  1491. }
  1492. void
  1493. _TIFFSwab24BitData(TIFF* tif, uint8* buf, tmsize_t cc)
  1494. {
  1495. (void) tif;
  1496. assert((cc % 3) == 0);
  1497. TIFFSwabArrayOfTriples((uint8*) buf, cc/3);
  1498. }
  1499. void
  1500. _TIFFSwab32BitData(TIFF* tif, uint8* buf, tmsize_t cc)
  1501. {
  1502. (void) tif;
  1503. assert((cc & 3) == 0);
  1504. TIFFSwabArrayOfLong((uint32*) buf, cc/4);
  1505. }
  1506. void
  1507. _TIFFSwab64BitData(TIFF* tif, uint8* buf, tmsize_t cc)
  1508. {
  1509. (void) tif;
  1510. assert((cc & 7) == 0);
  1511. TIFFSwabArrayOfDouble((double*) buf, cc/8);
  1512. }
  1513. /* vim: set ts=8 sts=8 sw=8 noet: */
  1514. /*
  1515. * Local Variables:
  1516. * mode: c
  1517. * c-basic-offset: 8
  1518. * fill-column: 78
  1519. * End:
  1520. */