XFA: Upgrade to libtiff 4.0.6.

third_party/libtiff/tif_pixarlog.c

-/* $Id: tif_pixarlog.c,v 1.38 2012-06-21 01:01:53 fwarmerdam Exp $ */
+/* $Id: tif_pixarlog.c,v 1.39 2012-12-10 17:27:13 tgl Exp $ */
 
 /*
  * Copyright (c) 1996-1997 Sam Leffler
  * Copyright (c) 1996 Pixar
  *
  * Permission to use, copy, modify, distribute, and sell this software and 
  * its documentation for any purpose is hereby granted without fee, provided
  * that (i) the above copyright notices and this permission notice appear in
  * all copies of the software and related documentation, and (ii) the names of
  * Pixar, Sam Leffler and Silicon Graphics may not be used in any advertising or
  * publicity relating to the software without the specific, prior written
  * permission of Pixar, Sam Leffler and Silicon Graphics.
  * 
  * THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND, 
  * EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY 
  * WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.  
  * 
  * IN NO EVENT SHALL PIXAR, SAM LEFFLER OR SILICON GRAPHICS BE LIABLE FOR
  * ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND,
  * OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
  * WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF 
  * LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE 
  * OF THIS SOFTWARE.
  */
+
 #include "tiffiop.h"
 #ifdef PIXARLOG_SUPPORT
 
 /*
  * TIFF Library.
  * PixarLog Compression Support
  *
  * Contributed by Dan McCoy.
  *
  * PixarLog film support uses the TIFF library to store companded
@@ skipping 600 matching lines @@
 multiply_ms(tmsize_t m1, tmsize_t m2)
 {
         tmsize_t bytes = m1 * m2;
 
         if (m1 && bytes / m1 != m2)
                 bytes = 0;
 
         return bytes;
 }
 
+static tmsize_t
+add_ms(tmsize_t m1, tmsize_t m2)
+{
+        tmsize_t bytes = m1 + m2;
+
+        /* if either input is zero, assume overflow already occurred */
+        if (m1 == 0 || m2 == 0)
+                bytes = 0;
+        else if (bytes <= m1 || bytes <= m2)
+                bytes = 0;
+
+        return bytes;
+}
+
 static int
 PixarLogFixupTags(TIFF* tif)
 {
         (void) tif;
         return (1);
 }
 
 static int
 PixarLogSetupDecode(TIFF* tif)
 {
         static const char module[] = "PixarLogSetupDecode";
         TIFFDirectory *td = &tif->tif_dir;
         PixarLogState* sp = DecoderState(tif);
         tmsize_t tbuf_size;
 
         assert(sp != NULL);
 
         /* Make sure no byte swapping happens on the data
          * after decompression. */
         tif->tif_postdecode = _TIFFNoPostDecode;  
 
         /* for some reason, we can't do this in TIFFInitPixarLog */
 
         sp->stride = (td->td_planarconfig == PLANARCONFIG_CONTIG ?
             td->td_samplesperpixel : 1);
         tbuf_size = multiply_ms(multiply_ms(multiply_ms(sp->stride, td->td_imagewidth),
                                       td->td_rowsperstrip), sizeof(uint16));
+        /* add one more stride in case input ends mid-stride */
+        tbuf_size = add_ms(tbuf_size, sizeof(uint16) * sp->stride);
         if (tbuf_size == 0)
                 return (0);   /* TODO: this is an error return without error report through TIFFErrorExt */
-        sp->tbuf = (uint16 *) _TIFFmalloc(tbuf_size+sizeof(uint16)*sp->stride);
+        sp->tbuf = (uint16 *) _TIFFmalloc(tbuf_size);
         if (sp->tbuf == NULL)
                 return (0);
         if (sp->user_datafmt == PIXARLOGDATAFMT_UNKNOWN)
                 sp->user_datafmt = PixarLogGuessDataFmt(td);
         if (sp->user_datafmt == PIXARLOGDATAFMT_UNKNOWN) {
                 TIFFErrorExt(tif->tif_clientdata, module,
                         "PixarLog compression can't handle bits depth/data format combination (depth: %d)", 
                         td->td_bitspersample);
                 return (0);
         }
@@ skipping 212 matching lines @@
         static const char module[] = "PixarLogPreEncode";
         PixarLogState *sp = EncoderState(tif);
 
         (void) s;
         assert(sp != NULL);
         sp->stream.next_out = tif->tif_rawdata;
         assert(sizeof(sp->stream.avail_out)==4);  /* if this assert gets raised,
             we need to simplify this code to reflect a ZLib that is likely updated
             to deal with 8byte memory sizes, though this code will respond
             apropriately even before we simplify it */
-        sp->stream.avail_out = (uInt)tif->tif_rawdatasize;
+        sp->stream.avail_out = tif->tif_rawdatasize;
         if ((tmsize_t)sp->stream.avail_out != tif->tif_rawdatasize)
         {
                 TIFFErrorExt(tif->tif_clientdata, module, "ZLib cannot deal with buffers this size");
                 return (0);
         }
         return (deflateReset(&sp->stream) == Z_OK);
 }
 
 static void
 horizontalDifferenceF(float *ip, int n, int stride, uint16 *wp, uint16 *FromLT2)
@@ skipping 497 matching lines @@
 #endif /* PIXARLOG_SUPPORT */
 
 /* vim: set ts=8 sts=8 sw=8 noet: */
 /*
  * Local Variables:
  * mode: c
  * c-basic-offset: 8
  * fill-column: 78
  * End:
  */
-