XFA: Upgrade to libtiff 4.0.6.

third_party/libtiff/tif_dir.c

-/* $Id: tif_dir.c,v 1.113 2012-06-14 20:32:53 fwarmerdam Exp $ */
+/* $Id: tif_dir.c,v 1.121 2015-05-31 23:11:43 bfriesen Exp $ */
 
 /*
  * Copyright (c) 1988-1997 Sam Leffler
  * Copyright (c) 1991-1997 Silicon Graphics, Inc.
  *
  * Permission to use, copy, modify, distribute, and sell this software and 
  * its documentation for any purpose is hereby granted without fee, provided
  * that (i) the above copyright notices and this permission notice appear in
  * all copies of the software and related documentation, and (ii) the names of
  * Sam Leffler and Silicon Graphics may not be used in any advertising or
@@ skipping 141 matching lines @@
 }
 
 static int
 _TIFFVSetField(TIFF* tif, uint32 tag, va_list ap)
 {
         static const char module[] = "_TIFFVSetField";
 
         TIFFDirectory* td = &tif->tif_dir;
         int status = 1;
         uint32 v32, i, v;
+    double dblval;
         char* s;
         const TIFFField *fip = TIFFFindField(tif, tag, TIFF_ANY);
         uint32 standard_tag = tag;
-
+        if( fip == NULL ) /* cannot happen since OkToChangeTag() already checks it */
+            return 0;
         /*
          * We want to force the custom code to be used for custom
          * fields even if the tag happens to match a well known 
          * one - important for reinterpreted handling of standard
          * tag values in custom directories (ie. EXIF) 
          */
         if (fip->field_bit == FIELD_CUSTOM) {
                 standard_tag = 0;
         }
 
@@ skipping 99 matching lines @@
                 else
                         setDoubleArrayOneValue(&td->td_sminsamplevalue, va_arg(ap, double), td->td_samplesperpixel);
                 break;
         case TIFFTAG_SMAXSAMPLEVALUE:
                 if (tif->tif_flags & TIFF_PERSAMPLE)
                         _TIFFsetDoubleArray(&td->td_smaxsamplevalue, va_arg(ap, double*), td->td_samplesperpixel);
                 else
                         setDoubleArrayOneValue(&td->td_smaxsamplevalue, va_arg(ap, double), td->td_samplesperpixel);
                 break;
         case TIFFTAG_XRESOLUTION:
-                td->td_xresolution = (float) va_arg(ap, double);
+        dblval = va_arg(ap, double);
+        if( dblval < 0 )
+            goto badvaluedouble;
+                td->td_xresolution = (float) dblval;
                 break;
         case TIFFTAG_YRESOLUTION:
-                td->td_yresolution = (float) va_arg(ap, double);
+        dblval = va_arg(ap, double);
+        if( dblval < 0 )
+            goto badvaluedouble;
+                td->td_yresolution = (float) dblval;
                 break;
         case TIFFTAG_PLANARCONFIG:
                 v = (uint16) va_arg(ap, uint16_vap);
                 if (v != PLANARCONFIG_CONTIG && v != PLANARCONFIG_SEPARATE)
                         goto badvalue;
                 td->td_planarconfig = (uint16) v;
                 break;
         case TIFFTAG_XPOSITION:
                 td->td_xposition = (float) va_arg(ap, double);
                 break;
@@ skipping 142 matching lines @@
 
                 /*
                  * This can happen if multiple images are open with different
                  * codecs which have private tags.  The global tag information
                  * table may then have tags that are valid for one file but not
                  * the other. If the client tries to set a tag that is not valid
                  * for the image's codec then we'll arrive here.  This
                  * happens, for example, when tiffcp is used to convert between
                  * compression schemes and codec-specific tags are blindly copied.
                  */
-                if(fip == NULL || fip->field_bit != FIELD_CUSTOM) {
+                if(fip->field_bit != FIELD_CUSTOM) {
                         TIFFErrorExt(tif->tif_clientdata, module,
                             "%s: Invalid %stag \"%s\" (not supported by codec)",
                             tif->tif_name, isPseudoTag(tag) ? "pseudo-" : "",
-                            fip ? fip->field_name : "Unknown");
+                            fip->field_name);
                         status = 0;
                         break;
                 }
 
                 /*
                  * Find the existing entry for this custom value.
                  */
                 tv = NULL;
                 for (iCustom = 0; iCustom < td->td_customValueCount; iCustom++) {
                         if (td->td_customValues[iCustom].info->field_tag == tag) {
@@ skipping 219 matching lines @@
 badvalue32:
         {
                 const TIFFField* fip=TIFFFieldWithTag(tif,tag);
                 TIFFErrorExt(tif->tif_clientdata, module,
                      "%s: Bad value %u for \"%s\" tag",
                      tif->tif_name, v32,
                      fip ? fip->field_name : "Unknown");
                 va_end(ap);
         }
         return (0);
+badvaluedouble:
+        {
+        const TIFFField* fip=TIFFFieldWithTag(tif,tag);
+        TIFFErrorExt(tif->tif_clientdata, module,
+             "%s: Bad value %f for \"%s\" tag",
+             tif->tif_name, dblval,
+             fip ? fip->field_name : "Unknown");
+        va_end(ap);
+        }
+    return (0);
 }
 
 /*
  * Return 1/0 according to whether or not
  * it is permissible to set the tag's value.
  * Note that we allow ImageLength to be changed
  * so that we can append and extend to images.
  * Any other tag may not be altered once writing
  * has commenced, unless its value has no effect
  * on the format of the data that is written.
@@ skipping 96 matching lines @@
             (*tif->tif_tagmethods.vsetfield)(tif, tag, ap) : 0;
 }
 
 static int
 _TIFFVGetField(TIFF* tif, uint32 tag, va_list ap)
 {
         TIFFDirectory* td = &tif->tif_dir;
         int ret_val = 1;
         uint32 standard_tag = tag;
         const TIFFField* fip = TIFFFindField(tif, tag, TIFF_ANY);
+        if( fip == NULL ) /* cannot happen since TIFFGetField() already checks it */
+            return 0;
         
         /*
          * We want to force the custom code to be used for custom
          * fields even if the tag happens to match a well known 
          * one - important for reinterpreted handling of standard
          * tag values in custom directories (ie. EXIF) 
          */
         if (fip->field_bit == FIELD_CUSTOM) {
                 standard_tag = 0;
         }
@@ skipping 177 matching lines @@
 
                                 /*
                                  * This can happen if multiple images are open
                                  * with different codecs which have private
                                  * tags.  The global tag information table may
                                  * then have tags that are valid for one file
                                  * but not the other. If the client tries to
                                  * get a tag that is not valid for the image's
                                  * codec then we'll arrive here.
                                  */
-                                if( fip == NULL || fip->field_bit != FIELD_CUSTOM )
+                                if( fip->field_bit != FIELD_CUSTOM )
                                 {
                                         TIFFErrorExt(tif->tif_clientdata, "_TIFFVGetField",
                                             "%s: Invalid %stag \"%s\" "
                                             "(not supported by codec)",
                                             tif->tif_name,
                                             isPseudoTag(tag) ? "pseudo-" : "",
-                                            fip ? fip->field_name : "Unknown");
+                                            fip->field_name);
                                         ret_val = 0;
                                         break;
                                 }
 
                                 /*
                                  * Do we have a custom value?
                                  */
                                 ret_val = 0;
                                 for (i = 0; i < td->td_customValueCount; i++) {
                                         TIFFTagValue *tv = td->td_customValues + i;
@@ skipping 268 matching lines @@
         td->td_ycbcrsubsampling[0] = 2;
         td->td_ycbcrsubsampling[1] = 2;
         td->td_ycbcrpositioning = YCBCRPOSITION_CENTERED;
         tif->tif_postdecode = _TIFFNoPostDecode;  
         tif->tif_foundfield = NULL;
         tif->tif_tagmethods.vsetfield = _TIFFVSetField;  
         tif->tif_tagmethods.vgetfield = _TIFFVGetField;
         tif->tif_tagmethods.printdir = NULL;
         /*
          *  Give client code a chance to install their own
-         *  tag extensions & methods, prior to compression overloads.
+         *  tag extensions & methods, prior to compression overloads,
+         *  but do some prior cleanup first. (http://trac.osgeo.org/gdal/ticket/5054)
          */
+        if (tif->tif_nfieldscompat > 0) {
+                uint32 i;
+
+                for (i = 0; i < tif->tif_nfieldscompat; i++) {
+                                if (tif->tif_fieldscompat[i].allocated_size)
+                                                _TIFFfree(tif->tif_fieldscompat[i].fields);
+                }
+                _TIFFfree(tif->tif_fieldscompat);
+                tif->tif_nfieldscompat = 0;
+                tif->tif_fieldscompat = NULL;
+        }
         if (_TIFFextender)
                 (*_TIFFextender)(tif);
         (void) TIFFSetField(tif, TIFFTAG_COMPRESSION, COMPRESSION_NONE);
         /*
          * NB: The directory is marked dirty as a result of setting
          * up the default compression scheme.  However, this really
          * isn't correct -- we want TIFF_DIRTYDIRECT to be set only
          * if the user does something.  We could just do the setup
          * by hand, but it seems better to use the normal mechanism
          * (i.e. TIFFSetField).
@@ skipping 20 matching lines @@
                 if (!(tif->tif_flags&TIFF_BIGTIFF))
                 {
                         tmsize_t poffa,poffb,poffc,poffd;
                         uint16 dircount;
                         uint32 nextdir32;
                         poffa=(tmsize_t)poff;
                         poffb=poffa+sizeof(uint16);
                         if (((uint64)poffa!=poff)||(poffb<poffa)||(poffb<(tmsize_t)sizeof(uint16))||(poffb>tif->tif_size))
                         {
                                 TIFFErrorExt(tif->tif_clientdata,module,"Error fetching directory count");
+                                  *nextdir=0;
                                 return(0);
                         }
                         _TIFFmemcpy(&dircount,tif->tif_base+poffa,sizeof(uint16));
                         if (tif->tif_flags&TIFF_SWAB)
                                 TIFFSwabShort(&dircount);
                         poffc=poffb+dircount*12;
                         poffd=poffc+sizeof(uint32);
                         if ((poffc<poffb)||(poffc<dircount*12)||(poffd<poffc)||(poffd<(tmsize_t)sizeof(uint32))||(poffd>tif->tif_size))
                         {
                                 TIFFErrorExt(tif->tif_clientdata,module,"Error fetching directory link");
@@ skipping 89 matching lines @@
                                 return(0);
                         }
                         dircount16 = (uint16)dircount64;
                         if (off != NULL)
                                 *off = TIFFSeekFile(tif,
                                     dircount16*20, SEEK_CUR);
                         else
                                 (void) TIFFSeekFile(tif,
                                     dircount16*20, SEEK_CUR);
                         if (!ReadOK(tif, nextdir, sizeof (uint64))) {
-                                TIFFErrorExt(tif->tif_clientdata, module, "%s: Error fetching directory link",
+                                TIFFErrorExt(tif->tif_clientdata, module,
+                                             "%s: Error fetching directory link",
                                     tif->tif_name);
                                 return (0);
                         }
                         if (tif->tif_flags & TIFF_SWAB)
                                 TIFFSwabLong8(nextdir);
                 }
                 return (1);
         }
 }
 
 /*
  * Count the number of directories in a file.
  */
 uint16
 TIFFNumberOfDirectories(TIFF* tif)
 {
+        static const char module[] = "TIFFNumberOfDirectories";
         uint64 nextdir;
         uint16 n;
         if (!(tif->tif_flags&TIFF_BIGTIFF))
                 nextdir = tif->tif_header.classic.tiff_diroff;
         else
                 nextdir = tif->tif_header.big.tiff_diroff;
         n = 0;
         while (nextdir != 0 && TIFFAdvanceDirectory(tif, &nextdir, NULL))
-                n++;
+        {
+                if (n != 65535) {
+                        ++n;
+                }
+                else
+                {
+                        TIFFErrorExt(tif->tif_clientdata, module,
+                                     "Directory count exceeded 65535 limit,"
+                                     " giving up on counting.");
+                        return (65535);
+                }
+        }
         return (n);
 }
 
 /*
  * Set the n-th directory as the current directory.
  * NB: Directories are numbered starting at 0.
  */
 int
 TIFFSetDirectory(TIFF* tif, uint16 dirn)
 {
@@ skipping 158 matching lines @@
 }
 
 /* vim: set ts=8 sts=8 sw=8 noet: */
 /*
  * Local Variables:
  * mode: c
  * c-basic-offset: 8
  * fill-column: 78
  * End:
  */
-