summaryrefslogtreecommitdiffstats
path: root/src/3rdparty/libtiff/libtiff/tif_dirread.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/3rdparty/libtiff/libtiff/tif_dirread.c')
-rw-r--r--src/3rdparty/libtiff/libtiff/tif_dirread.c64
1 files changed, 49 insertions, 15 deletions
diff --git a/src/3rdparty/libtiff/libtiff/tif_dirread.c b/src/3rdparty/libtiff/libtiff/tif_dirread.c
index a0dc68b..01070f2 100644
--- a/src/3rdparty/libtiff/libtiff/tif_dirread.c
+++ b/src/3rdparty/libtiff/libtiff/tif_dirread.c
@@ -1,4 +1,4 @@
-/* $Id: tif_dirread.c,v 1.191 2015-09-05 20:31:41 bfriesen Exp $ */
+/* $Id: tif_dirread.c,v 1.204 2016-11-16 15:14:15 erouault Exp $ */
/*
* Copyright (c) 1988-1997 Sam Leffler
@@ -166,6 +166,8 @@ static int TIFFFetchSubjectDistance(TIFF*, TIFFDirEntry*);
static void ChopUpSingleUncompressedStrip(TIFF*);
static uint64 TIFFReadUInt64(const uint8 *value);
+static int _TIFFFillStrilesInternal( TIFF *tif, int loadStripByteCount );
+
typedef union _UInt64Aligned_t
{
double d;
@@ -3457,12 +3459,12 @@ TIFFReadDirectory(TIFF* tif)
* the fields to check type and tag information,
* and to extract info required to size data
* structures. A second pass is made afterwards
- * to read in everthing not taken in the first pass.
+ * to read in everything not taken in the first pass.
* But we must process the Compression tag first
* in order to merge in codec-private tag definitions (otherwise
* we may get complaints about unknown tags). However, the
* Compression tag may be dependent on the SamplesPerPixel
- * tag value because older TIFF specs permited Compression
+ * tag value because older TIFF specs permitted Compression
* to be written as a SamplesPerPixel-count tag entry.
* Thus if we don't first figure out the correct SamplesPerPixel
* tag value then we may end up ignoring the Compression tag
@@ -3626,6 +3628,7 @@ TIFFReadDirectory(TIFF* tif)
if (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE)
tif->tif_dir.td_stripsperimage /= tif->tif_dir.td_samplesperpixel;
if (!TIFFFieldSet(tif, FIELD_STRIPOFFSETS)) {
+#ifdef OJPEG_SUPPORT
if ((tif->tif_dir.td_compression==COMPRESSION_OJPEG) &&
(isTiled(tif)==0) &&
(tif->tif_dir.td_nstrips==1)) {
@@ -3638,7 +3641,9 @@ TIFFReadDirectory(TIFF* tif)
* JpegInterchangeFormat stream.
*/
TIFFSetFieldBit(tif, FIELD_STRIPOFFSETS);
- } else {
+ } else
+#endif
+ {
MissingRequired(tif,
isTiled(tif) ? "TileOffsets" : "StripOffsets");
goto bad;
@@ -3663,7 +3668,7 @@ TIFFReadDirectory(TIFF* tif)
* DataType and SampleFormat tags are supposed to be
* written as one value/sample, but some vendors
* incorrectly write one value only -- so we accept
- * that as well (yech). Other vendors write correct
+ * that as well (yuck). Other vendors write correct
* value for NumberOfSamples, but incorrect one for
* BitsPerSample and friends, and we will read this
* too.
@@ -3690,7 +3695,7 @@ TIFFReadDirectory(TIFF* tif)
case TIFFTAG_SMAXSAMPLEVALUE:
{
- double *data;
+ double *data = NULL;
enum TIFFReadDirEntryErr err;
uint32 saved_flags;
int m;
@@ -3741,7 +3746,7 @@ TIFFReadDirectory(TIFF* tif)
uint32 countrequired;
uint32 incrementpersample;
uint16* value=NULL;
- /* It would be dangerous to instanciate those tag values */
+ /* It would be dangerous to instantiate those tag values */
/* since if td_bitspersample has not yet been read (due to */
/* unordered tags), it could be read afterwards with a */
/* values greater than the default one (1), which may cause */
@@ -3754,7 +3759,19 @@ TIFFReadDirectory(TIFF* tif)
fip ? fip->field_name : "unknown tagname");
continue;
}
- countpersample=(1L<<tif->tif_dir.td_bitspersample);
+ /* ColorMap or TransferFunction for high bit */
+ /* depths do not make much sense and could be */
+ /* used as a denial of service vector */
+ if (tif->tif_dir.td_bitspersample > 24)
+ {
+ fip = TIFFFieldWithTag(tif,dp->tdir_tag);
+ TIFFWarningExt(tif->tif_clientdata,module,
+ "Ignoring %s because BitsPerSample=%d>24",
+ fip ? fip->field_name : "unknown tagname",
+ tif->tif_dir.td_bitspersample);
+ continue;
+ }
+ countpersample=(1U<<tif->tif_dir.td_bitspersample);
if ((dp->tdir_tag==TIFFTAG_TRANSFERFUNCTION)&&(dp->tdir_count==(uint64)countpersample))
{
countrequired=countpersample;
@@ -4142,7 +4159,7 @@ TIFFReadDirectoryFindFieldInfo(TIFF* tif, uint16 tagid, uint32* fii)
}
/*
- * Read custom directory from the arbitarry offset.
+ * Read custom directory from the arbitrary offset.
* The code is very similar to TIFFReadDirectory().
*/
int
@@ -4269,8 +4286,9 @@ EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount)
TIFFDirectory *td = &tif->tif_dir;
uint32 strip;
- if( !_TIFFFillStriles( tif ) )
- return -1;
+ /* Do not try to load stripbytecount as we will compute it */
+ if( !_TIFFFillStrilesInternal( tif, 0 ) )
+ return -1;
if (td->td_stripbytecount)
_TIFFfree(td->td_stripbytecount);
@@ -4292,7 +4310,7 @@ EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount)
/* calculate amount of space used by indirect values */
for (dp = dir, n = dircount; n > 0; n--, dp++)
{
- uint32 typewidth = TIFFDataWidth((TIFFDataType) dp->tdir_type);
+ uint32 typewidth;
uint64 datasize;
typewidth = TIFFDataWidth((TIFFDataType) dp->tdir_type);
if (typewidth == 0) {
@@ -4382,7 +4400,7 @@ TIFFCheckDirOffset(TIFF* tif, uint64 diroff)
tif->tif_dirnumber++;
- if (tif->tif_dirnumber > tif->tif_dirlistsize) {
+ if (tif->tif_dirlist == NULL || tif->tif_dirnumber > tif->tif_dirlistsize) {
uint64* new_dirlist;
/*
@@ -4572,7 +4590,6 @@ TIFFFetchDirectory(TIFF* tif, uint64 diroff, TIFFDirEntry** pdir,
}
else
{
- tmsize_t m;
uint64 dircount64;
m=off+sizeof(uint64);
if ((m<off)||(m<(tmsize_t)sizeof(uint64))||(m>tif->tif_size)) {
@@ -4983,6 +5000,11 @@ TIFFFetchNormalTag(TIFF* tif, TIFFDirEntry* dp, int recover)
if (err==TIFFReadDirEntryErrOk)
{
int m;
+ if( dp->tdir_count > 0 && data[dp->tdir_count-1] != '\0' )
+ {
+ TIFFWarningExt(tif->tif_clientdata,module,"ASCII value for tag \"%s\" does not end in null byte. Forcing it to be null",fip->field_name);
+ data[dp->tdir_count-1] = '\0';
+ }
m=TIFFSetField(tif,dp->tdir_tag,(uint16)(dp->tdir_count),data);
if (data!=0)
_TIFFfree(data);
@@ -5155,6 +5177,11 @@ TIFFFetchNormalTag(TIFF* tif, TIFFDirEntry* dp, int recover)
if (err==TIFFReadDirEntryErrOk)
{
int m;
+ if( dp->tdir_count > 0 && data[dp->tdir_count-1] != '\0' )
+ {
+ TIFFWarningExt(tif->tif_clientdata,module,"ASCII value for tag \"%s\" does not end in null byte. Forcing it to be null",fip->field_name);
+ data[dp->tdir_count-1] = '\0';
+ }
m=TIFFSetField(tif,dp->tdir_tag,(uint32)(dp->tdir_count),data);
if (data!=0)
_TIFFfree(data);
@@ -5558,6 +5585,11 @@ ChopUpSingleUncompressedStrip(TIFF* tif)
int _TIFFFillStriles( TIFF *tif )
{
+ return _TIFFFillStrilesInternal( tif, 1 );
+}
+
+static int _TIFFFillStrilesInternal( TIFF *tif, int loadStripByteCount )
+{
#if defined(DEFER_STRILE_LOAD)
register TIFFDirectory *td = &tif->tif_dir;
int return_value = 1;
@@ -5574,7 +5606,8 @@ int _TIFFFillStriles( TIFF *tif )
return_value = 0;
}
- if (!TIFFFetchStripThing(tif,&(td->td_stripbytecount_entry),
+ if (loadStripByteCount &&
+ !TIFFFetchStripThing(tif,&(td->td_stripbytecount_entry),
td->td_nstrips,&td->td_stripbytecount))
{
return_value = 0;
@@ -5599,6 +5632,7 @@ int _TIFFFillStriles( TIFF *tif )
return return_value;
#else /* !defined(DEFER_STRILE_LOAD) */
(void) tif;
+ (void) loadStripByteCount;
return 1;
#endif
}
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-08 08:30:05 +0000