Update bundled libtiff to version 4.4.0

[ChangeLog][Third-Party Code] Bundled libtiff was updated to version 4.4.0

Pick-to: 6.3 6.2 5.15
Fixes: QTBUG-103337
Task-number: QTBUG-103671
Change-Id: I94a26d2d2186e4ea881588a04b0eafae0432be29
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>

1 files changed, 54 insertions, 7 deletions

diff --git a/src/3rdparty/libtiff/libtiff/tif_dirwrite.c b/src/3rdparty/libtiff/libtiff/tif_dirwrite.c
index 12d67be..2fef6d8 100644
--- a/src/3rdparty/libtiff/libtiff/tif_dirwrite.c
+++ b/src/3rdparty/libtiff/libtiff/tif_dirwrite.c
@@ -300,6 +300,12 @@ TIFFRewriteDirectory( TIFF *tif )
 				return (0);
 			}
 		}
+		else if( tif->tif_diroff > 0xFFFFFFFFU )
+		{
+			TIFFErrorExt(tif->tif_clientdata, module,
+			     "tif->tif_diroff exceeds 32 bit range allowed for Classic TIFF");
+			return (0);
+		}
 		else
 		{
 			uint32_t nextdir;
@@ -337,6 +343,8 @@ TIFFRewriteDirectory( TIFF *tif )
 						return (0);
 					}
 					tif->tif_diroff=0;
+					/* Force a full-traversal to reach the zeroed pointer */
+					tif->tif_lastdiroff=0;
 					break;
 				}
 				nextdir=nextnextdir;
@@ -403,6 +411,8 @@ TIFFRewriteDirectory( TIFF *tif )
 						return (0);
 					}
 					tif->tif_diroff=0;
+					/* Force a full-traversal to reach the zeroed pointer */
+					tif->tif_lastdiroff=0;
 					break;
 				}
 				nextdir=nextnextdir;
@@ -477,6 +487,12 @@ TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64_t* pdiroff)
 		}
 		tif->tif_flags &= ~(TIFF_BEENWRITING|TIFF_BUFFERSETUP);
 	}
+
+	if (TIFFFieldSet(tif,FIELD_COMPRESSION) && (tif->tif_dir.td_compression == COMPRESSION_DEFLATE)) {
+		TIFFWarningExt(tif->tif_clientdata, module,
+	                   "Creating TIFF with legacy Deflate codec identifier, "
+	                   "COMPRESSION_ADOBE_DEFLATE is more widely supported");
+	}
 	dir=NULL;
 	dirmem=NULL;
 	dirsize=0;
@@ -814,7 +830,7 @@ TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64_t* pdiroff)
 					{
 						/*-- Rational2Double: For Rationals evaluate "set_field_type" to determine internal storage size. */
 						int tv_size;
-						tv_size = _TIFFSetGetFieldSize(tif->tif_dir.td_customValues[m].info->set_field_type);
+						tv_size = TIFFFieldSetGetSize(tif->tif_dir.td_customValues[m].info);
 						if (tv_size == 8) {
 							if (!TIFFWriteDirectoryTagRationalDoubleArray(tif,&ndir,dir,tag,count,tif->tif_dir.td_customValues[m].value))
 								goto bad;
@@ -833,7 +849,7 @@ TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64_t* pdiroff)
 					{
 						/*-- Rational2Double: For Rationals evaluate "set_field_type" to determine internal storage size. */
 						int tv_size;
-						tv_size = _TIFFSetGetFieldSize(tif->tif_dir.td_customValues[m].info->set_field_type);
+						tv_size = TIFFFieldSetGetSize(tif->tif_dir.td_customValues[m].info);
 						if (tv_size == 8) {
 							if (!TIFFWriteDirectoryTagSrationalDoubleArray(tif,&ndir,dir,tag,count,tif->tif_dir.td_customValues[m].value))
 								goto bad;
@@ -1774,10 +1790,12 @@ static int _WriteAsType(TIFF* tif, uint64_t strile_size, uint64_t uncompressed_t
     else if ( compression == COMPRESSION_JPEG ||
               compression == COMPRESSION_LZW ||
               compression == COMPRESSION_ADOBE_DEFLATE ||
+              compression == COMPRESSION_DEFLATE ||
               compression == COMPRESSION_LZMA ||
               compression == COMPRESSION_LERC ||
               compression == COMPRESSION_ZSTD ||
-              compression == COMPRESSION_WEBP )
+              compression == COMPRESSION_WEBP ||
+              compression == COMPRESSION_JXL )
     {
         /* For a few select compression types, we assume that in the worst */
         /* case the compressed size will be 10 times the uncompressed size */
@@ -3058,7 +3076,12 @@ TIFFWriteDirectoryTagData(TIFF* tif, uint32_t* ndir, TIFFDirEntry* dir, uint16_t
 			TIFFErrorExt(tif->tif_clientdata,module,"IO error writing tag data");
 			return(0);
 		}
-		assert(datalength<0x80000000UL);
+		if (datalength >= 0x80000000UL)
+		{
+			TIFFErrorExt(tif->tif_clientdata,module,
+			             "libtiff does not allow writing more than 2147483647 bytes in a tag");
+			return(0);
+		}
 		if (!WriteOK(tif,data,(tmsize_t)datalength))
 		{
 			TIFFErrorExt(tif->tif_clientdata,module,"IO error writing tag data");
@@ -3161,6 +3184,7 @@ TIFFLinkDirectory(TIFF* tif)
 			 * First directory, overwrite offset in header.
 			 */
 			tif->tif_header.classic.tiff_diroff = (uint32_t) tif->tif_diroff;
+			tif->tif_lastdiroff = tif->tif_diroff;
 			(void) TIFFSeekFile(tif,4, SEEK_SET);
 			if (!WriteOK(tif, &m, 4)) {
 				TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
@@ -3172,7 +3196,13 @@ TIFFLinkDirectory(TIFF* tif)
 		/*
 		 * Not the first directory, search to the last and append.
 		 */
-		nextdir = tif->tif_header.classic.tiff_diroff;
+		if (tif->tif_lastdiroff != 0) {
+		    nextdir = (uint32_t) tif->tif_lastdiroff;
+		}
+		else {
+		    nextdir = tif->tif_header.classic.tiff_diroff;
+		}
+
 		while(1) {
 			uint16_t dircount;
 			uint32_t nextnextdir;
@@ -3203,6 +3233,7 @@ TIFFLinkDirectory(TIFF* tif)
 					     "Error writing directory link");
 					return (0);
 				}
+				tif->tif_lastdiroff = tif->tif_diroff;
 				break;
 			}
 			nextdir=nextnextdir;
@@ -3220,6 +3251,7 @@ TIFFLinkDirectory(TIFF* tif)
 			 * First directory, overwrite offset in header.
 			 */
 			tif->tif_header.big.tiff_diroff = tif->tif_diroff;
+			tif->tif_lastdiroff = tif->tif_diroff;
 			(void) TIFFSeekFile(tif,8, SEEK_SET);
 			if (!WriteOK(tif, &m, 8)) {
 				TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
@@ -3231,7 +3263,12 @@ TIFFLinkDirectory(TIFF* tif)
 		/*
 		 * Not the first directory, search to the last and append.
 		 */
-		nextdir = tif->tif_header.big.tiff_diroff;
+		if (tif->tif_lastdiroff != 0) {
+		    nextdir = tif->tif_lastdiroff;
+		}
+		else {
+		    nextdir = tif->tif_header.big.tiff_diroff;
+		}
 		while(1) {
 			uint64_t dircount64;
 			uint16_t dircount;
@@ -3270,6 +3307,7 @@ TIFFLinkDirectory(TIFF* tif)
 					     "Error writing directory link");
 					return (0);
 				}
+				tif->tif_lastdiroff = tif->tif_diroff;
 				break;
 			}
 			nextdir=nextnextdir;
@@ -3668,7 +3706,16 @@ _TIFFRewriteField(TIFF* tif, uint16_t tag, TIFFDataType in_datatype,
     }
     else
     {
-        memcpy( &entry_offset, buf_to_write, count*TIFFDataWidth(datatype));
+        if( count*TIFFDataWidth(datatype) == 4 )
+        {
+            uint32_t value;
+            memcpy( &value, buf_to_write, count*TIFFDataWidth(datatype));
+            entry_offset = value;
+        }
+        else
+        {
+            memcpy( &entry_offset, buf_to_write, count*TIFFDataWidth(datatype));
+        }
     }
 
     _TIFFfree( buf_to_write );