XFA: Upgrade to libtiff 4.0.6.

third_party/libtiff/tif_dirread.c

-/* $Id: tif_dirread.c,v 1.178 2012-08-19 16:56:34 bfriesen Exp $ */
+/* $Id: tif_dirread.c,v 1.191 2015-09-05 20:31:41 bfriesen Exp $ */
 
 /*
  * Copyright (c) 1988-1997 Sam Leffler
  * Copyright (c) 1991-1997 Silicon Graphics, Inc.
  *
  * Permission to use, copy, modify, distribute, and sell this software and
  * its documentation for any purpose is hereby granted without fee, provided
  * that (i) the above copyright notices and this permission notice appear in
  * all copies of the software and related documentation, and (ii) the names of
  * Sam Leffler and Silicon Graphics may not be used in any advertising or
@@ skipping 19 matching lines @@
  */
 
 /* Suggested pending improvements:
  * - add a field 'ignore' to the TIFFDirEntry structure, to flag status,
  *   eliminating current use of the IGNORE value, and therefore eliminating
  *   current irrational behaviour on tags with tag id code 0
  * - add a field 'field_info' to the TIFFDirEntry structure, and set that with
  *   the pointer to the appropriate TIFFField structure early on in
  *   TIFFReadDirectory, so as to eliminate current possibly repetitive lookup.
  */
- 
+
 #include "tiffiop.h"
 
 #define IGNORE 0          /* tag placeholder used below */
 #define FAILED_FII    ((uint32) -1)
 
 #ifdef HAVE_IEEEFP
 # define TIFFCvtIEEEFloatToNative(tif, n, fp)
 # define TIFFCvtIEEEDoubleToNative(tif, n, dp)
 #else
 extern void TIFFCvtIEEEFloatToNative(TIFF*, uint32, float*);
@@ skipping 2113 matching lines @@
                                 for (n=0; n<count; n++)
                                 {
                                         if (tif->tif_flags&TIFF_SWAB)
                                                 TIFFSwabLong((uint32*)ma);
                                         *mb++=(int64)(*ma++);
                                 }
                         }
                         break;
         }
         _TIFFfree(origdata);
-        if (err!=TIFFReadDirEntryErrOk)
-        {
-                _TIFFfree(data);
-                return(err);
-        }
         *value=data;
         return(TIFFReadDirEntryErrOk);
 }
 
 static enum TIFFReadDirEntryErr TIFFReadDirEntryFloatArray(TIFF* tif, TIFFDirEntry* direntry, float** value)
 {
         enum TIFFReadDirEntryErr err;
         uint32 count;
         void* origdata;
         float* data;
@@ skipping 217 matching lines @@
                                         TIFFSwabArrayOfLong8((uint64*)origdata,count);
                                 TIFFCvtIEEEDoubleToNative(tif,count,(double*)origdata);
                                 ma=(double*)origdata;
                                 mb=data;
                                 for (n=0; n<count; n++)
                                         *mb++=(float)(*ma++);
                         }
                         break;
         }
         _TIFFfree(origdata);
-        if (err!=TIFFReadDirEntryErrOk)
-        {
-                _TIFFfree(data);
-                return(err);
-        }
         *value=data;
         return(TIFFReadDirEntryErrOk);
 }
 
 static enum TIFFReadDirEntryErr
 TIFFReadDirEntryDoubleArray(TIFF* tif, TIFFDirEntry* direntry, double** value)
 {
         enum TIFFReadDirEntryErr err;
         uint32 count;
         void* origdata;
@@ skipping 218 matching lines @@
                                         TIFFSwabArrayOfLong((uint32*)origdata,count);  
                                 TIFFCvtIEEEFloatToNative(tif,count,(float*)origdata);
                                 ma=(float*)origdata;
                                 mb=data;
                                 for (n=0; n<count; n++)
                                         *mb++=(double)(*ma++);
                         }
                         break;
         }
         _TIFFfree(origdata);
-        if (err!=TIFFReadDirEntryErrOk)
-        {
-                _TIFFfree(data);
-                return(err);
-        }
         *value=data;
         return(TIFFReadDirEntryErrOk);
 }
 
 static enum TIFFReadDirEntryErr TIFFReadDirEntryIfd8Array(TIFF* tif, TIFFDirEntry* direntry, uint64** value)
 {
         enum TIFFReadDirEntryErr err;
         uint32 count;
         void* origdata;
         uint64* data;
@@ skipping 41 matching lines @@
                                 for (n=0; n<count; n++)
                                 {
                                         if (tif->tif_flags&TIFF_SWAB)
                                                 TIFFSwabLong(ma);
                                         *mb++=(uint64)(*ma++);
                                 }
                         }
                         break;
         }
         _TIFFfree(origdata);
-        if (err!=TIFFReadDirEntryErrOk)
-        {
-                _TIFFfree(data);
-                return(err);
-        }
         *value=data;
         return(TIFFReadDirEntryErrOk);
 }
 
 static enum TIFFReadDirEntryErr TIFFReadDirEntryPersampleShort(TIFF* tif, TIFFDirEntry* direntry, uint16* value)
 {
         enum TIFFReadDirEntryErr err;
         uint16* m;
         uint16* na;
         uint16 nb;
@@ skipping 446 matching lines @@
 {
         if (value<0)
                 return(TIFFReadDirEntryErrRange);
         else
                 return(TIFFReadDirEntryErrOk);
 }
 
 /*
  * Largest 32-bit unsigned integer value.
  */
-#if defined(__WIN32__) && defined(_MSC_VER)
-# define TIFF_UINT32_MAX 0xFFFFFFFFI64
-#else
-# define TIFF_UINT32_MAX 0xFFFFFFFFLL
-#endif
+#define TIFF_UINT32_MAX 0xFFFFFFFFU
 
 static enum TIFFReadDirEntryErr
 TIFFReadDirEntryCheckRangeLongLong8(uint64 value)
 {
         if (value > TIFF_UINT32_MAX)
                 return(TIFFReadDirEntryErrRange);
         else
                 return(TIFFReadDirEntryErrOk);
 }
 
 static enum TIFFReadDirEntryErr
 TIFFReadDirEntryCheckRangeLongSlong8(int64 value)
 {
-        if ((value<0) || (value > TIFF_UINT32_MAX))
+        if ((value < 0) || (value > (int64) TIFF_UINT32_MAX))
                 return(TIFFReadDirEntryErrRange);
         else
                 return(TIFFReadDirEntryErrOk);
 }
 
 #undef TIFF_UINT32_MAX
 
 static enum TIFFReadDirEntryErr
 TIFFReadDirEntryCheckRangeSlongLong(uint32 value)
 {
         if (value > 0x7FFFFFFFUL)
                 return(TIFFReadDirEntryErrRange);
         else
                 return(TIFFReadDirEntryErrOk);
 }
 
+/* Check that the 8-byte unsigned value can fit in a 4-byte unsigned range */
 static enum TIFFReadDirEntryErr
 TIFFReadDirEntryCheckRangeSlongLong8(uint64 value)
 {
-        if (value > 0x7FFFFFFFUL)
+        if (value > 0x7FFFFFFF)
                 return(TIFFReadDirEntryErrRange);
         else
                 return(TIFFReadDirEntryErrOk);
 }
 
+/* Check that the 8-byte signed value can fit in a 4-byte signed range */
 static enum TIFFReadDirEntryErr
 TIFFReadDirEntryCheckRangeSlongSlong8(int64 value)
 {
-        if ((value < 0L-0x80000000L) || (value > 0x7FFFFFFFL))
+        if ((value < 0-((int64) 0x7FFFFFFF+1)) || (value > 0x7FFFFFFF))
                 return(TIFFReadDirEntryErrRange);
         else
                 return(TIFFReadDirEntryErrOk);
 }
 
 static enum TIFFReadDirEntryErr
 TIFFReadDirEntryCheckRangeLong8Sbyte(int8 value)
 {
         if (value < 0)
                 return(TIFFReadDirEntryErrRange);
@@ skipping 24 matching lines @@
 {
         if (value < 0)
                 return(TIFFReadDirEntryErrRange);
         else
                 return(TIFFReadDirEntryErrOk);
 }
 
 /*
  * Largest 64-bit signed integer value.
  */
-#if defined(__WIN32__) && defined(_MSC_VER)
-# define TIFF_INT64_MAX 0x7FFFFFFFFFFFFFFFI64
-#else
-# define TIFF_INT64_MAX 0x7FFFFFFFFFFFFFFFLL
-#endif
+#define TIFF_INT64_MAX ((int64)(((uint64) ~0) >> 1))
 
 static enum TIFFReadDirEntryErr
 TIFFReadDirEntryCheckRangeSlong8Long8(uint64 value)
 {
         if (value > TIFF_INT64_MAX)
                 return(TIFFReadDirEntryErrRange);
         else
                 return(TIFFReadDirEntryErrOk);
 }
 
@@ skipping 63 matching lines @@
                                              "Out of memory reading of \"%s\"",
                                              tagname);
                                 break;
                         default:
                                 assert(0);   /* we should never get here */
                                 break;
                 }
         } else {
                 switch (err) {
                         case TIFFReadDirEntryErrCount:
-                                TIFFErrorExt(tif->tif_clientdata, module,
+                                TIFFWarningExt(tif->tif_clientdata, module,
                                 "Incorrect count for \"%s\"; tag ignored",
                                              tagname);
                                 break;
                         case TIFFReadDirEntryErrType:
                                 TIFFWarningExt(tif->tif_clientdata, module,
                                 "Incompatible type for \"%s\"; tag ignored",
                                                tagname);
                                 break;
                         case TIFFReadDirEntryErrIo:
                                 TIFFWarningExt(tif->tif_clientdata, module,
@@ skipping 35 matching lines @@
 TIFFReadDirectory(TIFF* tif)
 {
         static const char module[] = "TIFFReadDirectory";
         TIFFDirEntry* dir;
         uint16 dircount;
         TIFFDirEntry* dp;
         uint16 di;
         const TIFFField* fip;
         uint32 fii=FAILED_FII;
         toff_t nextdiroff;
+    int bitspersample_read = FALSE;
+
         tif->tif_diroff=tif->tif_nextdiroff;
         if (!TIFFCheckDirOffset(tif,tif->tif_nextdiroff))
                 return 0;           /* last offset or bad offset (IFD looping) */
         (*tif->tif_cleanup)(tif);   /* cleanup any previous compression state */
         tif->tif_curdir++;
         nextdiroff = tif->tif_nextdiroff;
         dircount=TIFFFetchDirectory(tif,nextdiroff,&dir,&tif->tif_nextdiroff);
         if (!dircount)
         {
                 TIFFErrorExt(tif->tif_clientdata,module,
@@ skipping 256 matching lines @@
                                         if (err==TIFFReadDirEntryErrCount)
                                                 err=TIFFReadDirEntryPersampleShort(tif,dp,&value);
                                         if (err!=TIFFReadDirEntryErrOk)
                                         {
                                                 fip = TIFFFieldWithTag(tif,dp->tdir_tag);
                                                 TIFFReadDirEntryOutputErr(tif,err,module,fip ? fip->field_name : "unknown tagname",0);
                                                 goto bad;
                                         }
                                         if (!TIFFSetField(tif,dp->tdir_tag,value))
                                                 goto bad;
+                    if( dp->tdir_tag == TIFFTAG_BITSPERSAMPLE )
+                        bitspersample_read = TRUE;
                                 }
                                 break;
                         case TIFFTAG_SMINSAMPLEVALUE:
                         case TIFFTAG_SMAXSAMPLEVALUE:
                                 {
 
                                         double *data;
                                         enum TIFFReadDirEntryErr err;
                                         uint32 saved_flags;
                                         int m;
@@ skipping 37 matching lines @@
 #endif                                
                                 break;
                         case TIFFTAG_COLORMAP:
                         case TIFFTAG_TRANSFERFUNCTION:
                                 {
                                         enum TIFFReadDirEntryErr err;
                                         uint32 countpersample;
                                         uint32 countrequired;
                                         uint32 incrementpersample;
                                         uint16* value=NULL;
+                    /* It would be dangerous to instanciate those tag values */
+                    /* since if td_bitspersample has not yet been read (due to */
+                    /* unordered tags), it could be read afterwards with a */
+                    /* values greater than the default one (1), which may cause */
+                    /* crashes in user code */
+                    if( !bitspersample_read )
+                    {
+                        fip = TIFFFieldWithTag(tif,dp->tdir_tag);
+                        TIFFWarningExt(tif->tif_clientdata,module,
+                                       "Ignoring %s since BitsPerSample tag not found",
+                                       fip ? fip->field_name : "unknown tagname");
+                        continue;
+                    }
                                         countpersample=(1L<<tif->tif_dir.td_bitspersample);
                                         if ((dp->tdir_tag==TIFFTAG_TRANSFERFUNCTION)&&(dp->tdir_count==(uint64)countpersample))
                                         {
                                                 countrequired=countpersample;
                                                 incrementpersample=0;
                                         }
                                         else
                                         {
                                                 countrequired=3*countpersample;
                                                 incrementpersample=countpersample;
@@ skipping 495 matching lines @@
 
 static int
 EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount)
 {
         static const char module[] = "EstimateStripByteCounts";
 
         TIFFDirEntry *dp;
         TIFFDirectory *td = &tif->tif_dir;
         uint32 strip;
 
-    _TIFFFillStriles( tif );
+    if( !_TIFFFillStriles( tif ) )
+        return -1;
 
         if (td->td_stripbytecount)
                 _TIFFfree(td->td_stripbytecount);
         td->td_stripbytecount = (uint64*)
             _TIFFCheckMalloc(tif, td->td_nstrips, sizeof (uint64),
                 "for \"StripByteCounts\" array");
         if( td->td_stripbytecount == NULL )
             return -1;
 
         if (td->td_compression != COMPRESSION_NONE) {
@@ skipping 78 matching lines @@
  * file with looped directory pointers. We will maintain a list of already
  * seen directories and check every IFD offset against that list.
  */
 static int
 TIFFCheckDirOffset(TIFF* tif, uint64 diroff)
 {
         uint16 n;
 
         if (diroff == 0)                        /* no more directories */
                 return 0;
+        if (tif->tif_dirnumber == 65535) {
+            TIFFErrorExt(tif->tif_clientdata, "TIFFCheckDirOffset",
+                         "Cannot handle more than 65535 TIFF directories");
+            return 0;
+        }
 
         for (n = 0; n < tif->tif_dirnumber && tif->tif_dirlist; n++) {
                 if (tif->tif_dirlist[n] == diroff)
                         return 0;
         }
 
         tif->tif_dirnumber++;
 
         if (tif->tif_dirnumber > tif->tif_dirlistsize) {
                 uint64* new_dirlist;
 
                 /*
                  * XXX: Reduce memory allocation granularity of the dirlist
                  * array.
                  */
                 new_dirlist = (uint64*)_TIFFCheckRealloc(tif, tif->tif_dirlist,
                     tif->tif_dirnumber, 2 * sizeof(uint64), "for IFD list");
                 if (!new_dirlist)
                         return 0;
-                tif->tif_dirlistsize = 2 * tif->tif_dirnumber;
+                if( tif->tif_dirnumber >= 32768 )
+                    tif->tif_dirlistsize = 65535;
+                else
+                    tif->tif_dirlistsize = 2 * tif->tif_dirnumber;
                 tif->tif_dirlist = new_dirlist;
         }
 
         tif->tif_dirlist[tif->tif_dirnumber - 1] = diroff;
 
         return 1;
 }
 
 /*
  * Check the count field of a directory entry against a known value.  The
@@ skipping 291 matching lines @@
         const TIFFField* fip = NULL;
         TIFFReadDirectoryFindFieldInfo(tif,dp->tdir_tag,&fii);
         if( fii == FAILED_FII )
         {
             TIFFErrorExt(tif->tif_clientdata, "TIFFFetchNormalTag",
                          "No definition found for tag %d",
                          dp->tdir_tag);
             return 0;
         }
         fip=tif->tif_fields[fii];
+        assert(fip != NULL); /* should not happen */
         assert(fip->set_field_type!=TIFF_SETGET_OTHER);  /* if so, we shouldn't arrive here but deal with this in specialized code */
         assert(fip->set_field_type!=TIFF_SETGET_INT);    /* if so, we shouldn't arrive here as this is only the case for pseudo-tags */
         err=TIFFReadDirEntryErrOk;
         switch (fip->set_field_type)
         {
                 case TIFF_SETGET_UNDEFINED:
                         break;
                 case TIFF_SETGET_ASCII:
                         {
                                 uint8* data;
@@ skipping 627 matching lines @@
                                                 return(0);
                                 }
                         }
                         break;
                 default:
                         assert(0);    /* we should never get here */
                         break;
         }
         if (err!=TIFFReadDirEntryErrOk)
         {
-                TIFFReadDirEntryOutputErr(tif,err,module,fip ? fip->field_name : "unknown tagname",recover);
+                TIFFReadDirEntryOutputErr(tif,err,module,fip->field_name,recover);
                 return(0);
         }
         return(1);
 }
 
 /*
  * Fetch a set of offsets or lengths.
  * While this routine says "strips", in fact it's also used for tiles.
  */
 static int
@@ skipping 235 matching lines @@
 
 
 /* vim: set ts=8 sts=8 sw=8 noet: */
 /*
  * Local Variables:
  * mode: c
  * c-basic-offset: 8
  * fill-column: 78
  * End:
  */
-