Bug Summary

File:libs/tiff-4.0.2/libtiff/tif_read.c
Location:line 1005, column 12
Description:Division by zero

Annotated Source Code

1/* $Id: tif_read.c,v 1.40 2012-06-01 00:55:09 fwarmerdam Exp $ */
2
3/*
4 * Copyright (c) 1988-1997 Sam Leffler
5 * Copyright (c) 1991-1997 Silicon Graphics, Inc.
6 *
7 * Permission to use, copy, modify, distribute, and sell this software and
8 * its documentation for any purpose is hereby granted without fee, provided
9 * that (i) the above copyright notices and this permission notice appear in
10 * all copies of the software and related documentation, and (ii) the names of
11 * Sam Leffler and Silicon Graphics may not be used in any advertising or
12 * publicity relating to the software without the specific, prior written
13 * permission of Sam Leffler and Silicon Graphics.
14 *
15 * THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND,
16 * EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY
17 * WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
18 *
19 * IN NO EVENT SHALL SAM LEFFLER OR SILICON GRAPHICS BE LIABLE FOR
20 * ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND,
21 * OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
22 * WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF
23 * LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
24 * OF THIS SOFTWARE.
25 */
26
27/*
28 * TIFF Library.
29 * Scanline-oriented Read Support
30 */
31#include "tiffiop.h"
32#include <stdio.h>
33
34int TIFFFillStrip(TIFF* tif, uint32 strip);
35int TIFFFillTile(TIFF* tif, uint32 tile);
36static int TIFFStartStrip(TIFF* tif, uint32 strip);
37static int TIFFStartTile(TIFF* tif, uint32 tile);
38static int TIFFCheckRead(TIFF*, int);
39static tmsize_t
40TIFFReadRawStrip1(TIFF* tif, uint32 strip, void* buf, tmsize_t size,const char* module);
41
42#define NOSTRIP((uint32)(-1)) ((uint32)(-1)) /* undefined state */
43#define NOTILE((uint32)(-1)) ((uint32)(-1)) /* undefined state */
44
45static int
46TIFFFillStripPartial( TIFF *tif, int strip, tmsize_t read_ahead, int restart )
47{
48 static const char module[] = "TIFFFillStripPartial";
49 register TIFFDirectory *td = &tif->tif_dir;
50 uint64 unused_data;
51 uint64 read_offset;
52 tmsize_t cc, to_read;
53 tmsize_t bytecountm;
54
55 if (!_TIFFFillStriles( tif ) || !tif->tif_dir.td_stripbytecount)
56 return 0;
57
58 /*
59 * Expand raw data buffer, if needed, to hold data
60 * strip coming from file (perhaps should set upper
61 * bound on the size of a buffer we'll use?).
62 */
63
64 bytecountm=(tmsize_t) td->td_stripbytecount[strip];
65 if (read_ahead*2 > tif->tif_rawdatasize) {
66 assert( restart )((restart) ? (void) (0) : __assert_fail ("restart", "tif_read.c"
, 66, __PRETTY_FUNCTION__));
67
68 tif->tif_curstrip = NOSTRIP((uint32)(-1));
69 if ((tif->tif_flags & TIFF_MYBUFFER0x00200) == 0) {
70 TIFFErrorExt(tif->tif_clientdata, module,
71 "Data buffer too small to hold part of strip %lu",
72 (unsigned long) strip);
73 return (0);
74 }
75 if (!TIFFReadBufferSetup(tif, 0, read_ahead*2))
76 return (0);
77 }
78
79 if( restart )
80 {
81 tif->tif_rawdataloaded = 0;
82 tif->tif_rawdataoff = 0;
83 }
84
85 /*
86 ** If we are reading more data, move any unused data to the
87 ** start of the buffer.
88 */
89 if( tif->tif_rawdataloaded > 0 )
90 unused_data = tif->tif_rawdataloaded - (tif->tif_rawcp - tif->tif_rawdata);
91 else
92 unused_data = 0;
93
94 if( unused_data > 0 )
95 {
96 assert((tif->tif_flags&TIFF_BUFFERMMAP)==0)(((tif->tif_flags&0x800000)==0) ? (void) (0) : __assert_fail
("(tif->tif_flags&0x800000)==0", "tif_read.c", 96, __PRETTY_FUNCTION__
));
97 memmove( tif->tif_rawdata, tif->tif_rawcp, unused_data );
98 }
99
100 /*
101 ** Seek to the point in the file where more data should be read.
102 */
103 read_offset = td->td_stripoffset[strip]
104 + tif->tif_rawdataoff + tif->tif_rawdataloaded;
105
106 if (!SeekOK(tif, read_offset)(((*((tif))->tif_seekproc)(((tif))->tif_clientdata,((read_offset
)),(0)))==(read_offset))) {
107 TIFFErrorExt(tif->tif_clientdata, module,
108 "Seek error at scanline %lu, strip %lu",
109 (unsigned long) tif->tif_row, (unsigned long) strip);
110 return 0;
111 }
112
113 /*
114 ** How much do we want to read?
115 */
116 to_read = tif->tif_rawdatasize - unused_data;
117 if( (uint64) to_read > td->td_stripbytecount[strip]
118 - tif->tif_rawdataoff - tif->tif_rawdataloaded )
119 {
120 to_read = td->td_stripbytecount[strip]
121 - tif->tif_rawdataoff - tif->tif_rawdataloaded;
122 }
123
124 assert((tif->tif_flags&TIFF_BUFFERMMAP)==0)(((tif->tif_flags&0x800000)==0) ? (void) (0) : __assert_fail
("(tif->tif_flags&0x800000)==0", "tif_read.c", 124, __PRETTY_FUNCTION__
));
125 cc = TIFFReadFile(tif, tif->tif_rawdata + unused_data, to_read)((*(tif)->tif_readproc)((tif)->tif_clientdata,(tif->
tif_rawdata + unused_data),(to_read)));
126
127 if (cc != to_read) {
128#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
129 TIFFErrorExt(tif->tif_clientdata, module,
130 "Read error at scanline %lu; got %I64u bytes, expected %I64u",
131 (unsigned long) tif->tif_row,
132 (unsigned __int64) cc,
133 (unsigned __int64) to_read);
134#else
135 TIFFErrorExt(tif->tif_clientdata, module,
136 "Read error at scanline %lu; got %llu bytes, expected %llu",
137 (unsigned long) tif->tif_row,
138 (unsigned long long) cc,
139 (unsigned long long) to_read);
140#endif
141 return 0;
142 }
143
144 tif->tif_rawdataoff = tif->tif_rawdataoff + tif->tif_rawdataloaded - unused_data ;
145 tif->tif_rawdataloaded = unused_data + to_read;
146
147 tif->tif_rawcp = tif->tif_rawdata;
148
149 if (!isFillOrder(tif, td->td_fillorder)(((tif)->tif_flags & (td->td_fillorder)) != 0) &&
150 (tif->tif_flags & TIFF_NOBITREV0x00100) == 0) {
151 assert((tif->tif_flags&TIFF_BUFFERMMAP)==0)(((tif->tif_flags&0x800000)==0) ? (void) (0) : __assert_fail
("(tif->tif_flags&0x800000)==0", "tif_read.c", 151, __PRETTY_FUNCTION__
));
152 TIFFReverseBits(tif->tif_rawdata + unused_data, to_read );
153 }
154
155 /*
156 ** When starting a strip from the beginning we need to
157 ** restart the decoder.
158 */
159 if( restart )
160 return TIFFStartStrip(tif, strip);
161 else
162 return 1;
163}
164
165/*
166 * Seek to a random row+sample in a file.
167 *
168 * Only used by TIFFReadScanline, and is only used on
169 * strip organized files. We do some tricky stuff to try
170 * and avoid reading the whole compressed raw data for big
171 * strips.
172 */
173static int
174TIFFSeek(TIFF* tif, uint32 row, uint16 sample )
175{
176 register TIFFDirectory *td = &tif->tif_dir;
177 uint32 strip;
178 int whole_strip;
179 tmsize_t read_ahead = 0;
180
181 /*
182 ** Establish what strip we are working from.
183 */
184 if (row >= td->td_imagelength) { /* out of range */
185 TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
186 "%lu: Row out of range, max %lu",
187 (unsigned long) row,
188 (unsigned long) td->td_imagelength);
189 return (0);
190 }
191 if (td->td_planarconfig == PLANARCONFIG_SEPARATE2) {
192 if (sample >= td->td_samplesperpixel) {
193 TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
194 "%lu: Sample out of range, max %lu",
195 (unsigned long) sample, (unsigned long) td->td_samplesperpixel);
196 return (0);
197 }
198 strip = (uint32)sample*td->td_stripsperimage + row/td->td_rowsperstrip;
199 } else
200 strip = row / td->td_rowsperstrip;
201
202 /*
203 * Do we want to treat this strip as one whole chunk or
204 * read it a few lines at a time?
205 */
206#if defined(CHUNKY_STRIP_READ_SUPPORT)
207 if (!_TIFFFillStriles( tif ) || !tif->tif_dir.td_stripbytecount)
208 return 0;
209 whole_strip = tif->tif_dir.td_stripbytecount[strip] < 10
210 || isMapped(tif)(((tif)->tif_flags & 0x00800) != 0);
211#else
212 whole_strip = 1;
213#endif
214
215 if( !whole_strip )
216 {
217 read_ahead = tif->tif_scanlinesize * 16 + 5000;
218 }
219
220 /*
221 * If we haven't loaded this strip, do so now, possibly
222 * only reading the first part.
223 */
224 if (strip != tif->tif_curstrip) { /* different strip, refill */
225
226 if( whole_strip )
227 {
228 if (!TIFFFillStrip(tif, strip))
229 return (0);
230 }
231 else
232 {
233 if( !TIFFFillStripPartial(tif,strip,read_ahead,1) )
234 return 0;
235 }
236 }
237
238 /*
239 ** If we already have some data loaded, do we need to read some more?
240 */
241 else if( !whole_strip )
242 {
243 if( ((tif->tif_rawdata + tif->tif_rawdataloaded) - tif->tif_rawcp) < read_ahead
244 && (uint64) tif->tif_rawdataoff+tif->tif_rawdataloaded < td->td_stripbytecount[strip] )
245 {
246 if( !TIFFFillStripPartial(tif,strip,read_ahead,0) )
247 return 0;
248 }
249 }
250
251 if (row < tif->tif_row) {
252 /*
253 * Moving backwards within the same strip: backup
254 * to the start and then decode forward (below).
255 *
256 * NB: If you're planning on lots of random access within a
257 * strip, it's better to just read and decode the entire
258 * strip, and then access the decoded data in a random fashion.
259 */
260
261 if( tif->tif_rawdataoff != 0 )
262 {
263 if( !TIFFFillStripPartial(tif,strip,read_ahead,1) )
264 return 0;
265 }
266 else
267 {
268 if (!TIFFStartStrip(tif, strip))
269 return (0);
270 }
271 }
272
273 if (row != tif->tif_row) {
274 /*
275 * Seek forward to the desired row.
276 */
277
278 /* TODO: Will this really work with partial buffers? */
279
280 if (!(*tif->tif_seek)(tif, row - tif->tif_row))
281 return (0);
282 tif->tif_row = row;
283 }
284
285 return (1);
286}
287
288int
289TIFFReadScanline(TIFF* tif, void* buf, uint32 row, uint16 sample)
290{
291 int e;
292
293 if (!TIFFCheckRead(tif, 0))
294 return (-1);
295 if( (e = TIFFSeek(tif, row, sample)) != 0) {
296 /*
297 * Decompress desired row into user buffer.
298 */
299 e = (*tif->tif_decoderow)
300 (tif, (uint8*) buf, tif->tif_scanlinesize, sample);
301
302 /* we are now poised at the beginning of the next row */
303 tif->tif_row = row + 1;
304
305 if (e)
306 (*tif->tif_postdecode)(tif, (uint8*) buf,
307 tif->tif_scanlinesize);
308 }
309 return (e > 0 ? 1 : -1);
310}
311
312/*
313 * Read a strip of data and decompress the specified
314 * amount into the user-supplied buffer.
315 */
316tmsize_t
317TIFFReadEncodedStrip(TIFF* tif, uint32 strip, void* buf, tmsize_t size)
318{
319 static const char module[] = "TIFFReadEncodedStrip";
320 TIFFDirectory *td = &tif->tif_dir;
321 uint32 rowsperstrip;
322 uint32 stripsperplane;
323 uint32 stripinplane;
324 uint16 plane;
325 uint32 rows;
326 tmsize_t stripsize;
327 if (!TIFFCheckRead(tif,0))
328 return((tmsize_t)(-1));
329 if (strip>=td->td_nstrips)
330 {
331 TIFFErrorExt(tif->tif_clientdata,module,
332 "%lu: Strip out of range, max %lu",(unsigned long)strip,
333 (unsigned long)td->td_nstrips);
334 return((tmsize_t)(-1));
335 }
336 /*
337 * Calculate the strip size according to the number of
338 * rows in the strip (check for truncated last strip on any
339 * of the separations).
340 */
341 rowsperstrip=td->td_rowsperstrip;
342 if (rowsperstrip>td->td_imagelength)
343 rowsperstrip=td->td_imagelength;
344 stripsperplane=((td->td_imagelength+rowsperstrip-1)/rowsperstrip);
345 stripinplane=(strip%stripsperplane);
346 plane=(strip/stripsperplane);
347 rows=td->td_imagelength-stripinplane*rowsperstrip;
348 if (rows>rowsperstrip)
349 rows=rowsperstrip;
350 stripsize=TIFFVStripSize(tif,rows);
351 if (stripsize==0)
352 return((tmsize_t)(-1));
353 if ((size!=(tmsize_t)(-1))&&(size<stripsize))
354 stripsize=size;
355 if (!TIFFFillStrip(tif,strip))
356 return((tmsize_t)(-1));
357 if ((*tif->tif_decodestrip)(tif,buf,stripsize,plane)<=0)
358 return((tmsize_t)(-1));
359 (*tif->tif_postdecode)(tif,buf,stripsize);
360 return(stripsize);
361}
362
363static tmsize_t
364TIFFReadRawStrip1(TIFF* tif, uint32 strip, void* buf, tmsize_t size,
365 const char* module)
366{
367 TIFFDirectory *td = &tif->tif_dir;
368
369 if (!_TIFFFillStriles( tif ))
370 return ((tmsize_t)(-1));
371
372 assert((tif->tif_flags&TIFF_NOREADRAW)==0)(((tif->tif_flags&0x20000)==0) ? (void) (0) : __assert_fail
("(tif->tif_flags&0x20000)==0", "tif_read.c", 372, __PRETTY_FUNCTION__
));
373 if (!isMapped(tif)(((tif)->tif_flags & 0x00800) != 0)) {
374 tmsize_t cc;
375
376 if (!SeekOK(tif, td->td_stripoffset[strip])(((*((tif))->tif_seekproc)(((tif))->tif_clientdata,((td
->td_stripoffset[strip])),(0)))==(td->td_stripoffset[strip
]))) {
377 TIFFErrorExt(tif->tif_clientdata, module,
378 "Seek error at scanline %lu, strip %lu",
379 (unsigned long) tif->tif_row, (unsigned long) strip);
380 return ((tmsize_t)(-1));
381 }
382 cc = TIFFReadFile(tif, buf, size)((*(tif)->tif_readproc)((tif)->tif_clientdata,(buf),(size
)));
383 if (cc != size) {
384#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
385 TIFFErrorExt(tif->tif_clientdata, module,
386 "Read error at scanline %lu; got %I64u bytes, expected %I64u",
387 (unsigned long) tif->tif_row,
388 (unsigned __int64) cc,
389 (unsigned __int64) size);
390#else
391 TIFFErrorExt(tif->tif_clientdata, module,
392 "Read error at scanline %lu; got %llu bytes, expected %llu",
393 (unsigned long) tif->tif_row,
394 (unsigned long long) cc,
395 (unsigned long long) size);
396#endif
397 return ((tmsize_t)(-1));
398 }
399 } else {
400 tmsize_t ma,mb;
401 tmsize_t n;
402 ma=(tmsize_t)td->td_stripoffset[strip];
403 mb=ma+size;
404 if (((uint64)ma!=td->td_stripoffset[strip])||(ma>tif->tif_size))
405 n=0;
406 else if ((mb<ma)||(mb<size)||(mb>tif->tif_size))
407 n=tif->tif_size-ma;
408 else
409 n=size;
410 if (n!=size) {
411#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
412 TIFFErrorExt(tif->tif_clientdata, module,
413 "Read error at scanline %lu, strip %lu; got %I64u bytes, expected %I64u",
414 (unsigned long) tif->tif_row,
415 (unsigned long) strip,
416 (unsigned __int64) n,
417 (unsigned __int64) size);
418#else
419 TIFFErrorExt(tif->tif_clientdata, module,
420 "Read error at scanline %lu, strip %lu; got %llu bytes, expected %llu",
421 (unsigned long) tif->tif_row,
422 (unsigned long) strip,
423 (unsigned long long) n,
424 (unsigned long long) size);
425#endif
426 return ((tmsize_t)(-1));
427 }
428 _TIFFmemcpy(buf, tif->tif_base + ma,
429 size);
430 }
431 return (size);
432}
433
434/*
435 * Read a strip of data from the file.
436 */
437tmsize_t
438TIFFReadRawStrip(TIFF* tif, uint32 strip, void* buf, tmsize_t size)
439{
440 static const char module[] = "TIFFReadRawStrip";
441 TIFFDirectory *td = &tif->tif_dir;
442 uint64 bytecount;
443 tmsize_t bytecountm;
444
445 if (!TIFFCheckRead(tif, 0))
446 return ((tmsize_t)(-1));
447 if (strip >= td->td_nstrips) {
448 TIFFErrorExt(tif->tif_clientdata, module,
449 "%lu: Strip out of range, max %lu",
450 (unsigned long) strip,
451 (unsigned long) td->td_nstrips);
452 return ((tmsize_t)(-1));
453 }
454 if (tif->tif_flags&TIFF_NOREADRAW0x20000)
455 {
456 TIFFErrorExt(tif->tif_clientdata, module,
457 "Compression scheme does not support access to raw uncompressed data");
458 return ((tmsize_t)(-1));
459 }
460 bytecount = td->td_stripbytecount[strip];
461 if (bytecount <= 0) {
462#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
463 TIFFErrorExt(tif->tif_clientdata, module,
464 "%I64u: Invalid strip byte count, strip %lu",
465 (unsigned __int64) bytecount,
466 (unsigned long) strip);
467#else
468 TIFFErrorExt(tif->tif_clientdata, module,
469 "%llu: Invalid strip byte count, strip %lu",
470 (unsigned long long) bytecount,
471 (unsigned long) strip);
472#endif
473 return ((tmsize_t)(-1));
474 }
475 bytecountm = (tmsize_t)bytecount;
476 if ((uint64)bytecountm!=bytecount) {
477 TIFFErrorExt(tif->tif_clientdata, module, "Integer overflow");
478 return ((tmsize_t)(-1));
479 }
480 if (size != (tmsize_t)(-1) && size < bytecountm)
481 bytecountm = size;
482 return (TIFFReadRawStrip1(tif, strip, buf, bytecountm, module));
483}
484
485/*
486 * Read the specified strip and setup for decoding. The data buffer is
487 * expanded, as necessary, to hold the strip's data.
488 */
489int
490TIFFFillStrip(TIFF* tif, uint32 strip)
491{
492 static const char module[] = "TIFFFillStrip";
493 TIFFDirectory *td = &tif->tif_dir;
494
495 if (!_TIFFFillStriles( tif ) || !tif->tif_dir.td_stripbytecount)
496 return 0;
497
498 if ((tif->tif_flags&TIFF_NOREADRAW0x20000)==0)
499 {
500 uint64 bytecount = td->td_stripbytecount[strip];
501 if (bytecount <= 0) {
502#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
503 TIFFErrorExt(tif->tif_clientdata, module,
504 "Invalid strip byte count %I64u, strip %lu",
505 (unsigned __int64) bytecount,
506 (unsigned long) strip);
507#else
508 TIFFErrorExt(tif->tif_clientdata, module,
509 "Invalid strip byte count %llu, strip %lu",
510 (unsigned long long) bytecount,
511 (unsigned long) strip);
512#endif
513 return (0);
514 }
515 if (isMapped(tif)(((tif)->tif_flags & 0x00800) != 0) &&
516 (isFillOrder(tif, td->td_fillorder)(((tif)->tif_flags & (td->td_fillorder)) != 0)
517 || (tif->tif_flags & TIFF_NOBITREV0x00100))) {
518 /*
519 * The image is mapped into memory and we either don't
520 * need to flip bits or the compression routine is
521 * going to handle this operation itself. In this
522 * case, avoid copying the raw data and instead just
523 * reference the data from the memory mapped file
524 * image. This assumes that the decompression
525 * routines do not modify the contents of the raw data
526 * buffer (if they try to, the application will get a
527 * fault since the file is mapped read-only).
528 */
529 if ((tif->tif_flags & TIFF_MYBUFFER0x00200) && tif->tif_rawdata) {
530 _TIFFfree(tif->tif_rawdata);
531 tif->tif_rawdata = NULL((void*)0);
532 tif->tif_rawdatasize = 0;
533 }
534 tif->tif_flags &= ~TIFF_MYBUFFER0x00200;
535 /*
536 * We must check for overflow, potentially causing
537 * an OOB read. Instead of simple
538 *
539 * td->td_stripoffset[strip]+bytecount > tif->tif_size
540 *
541 * comparison (which can overflow) we do the following
542 * two comparisons:
543 */
544 if (bytecount > (uint64)tif->tif_size ||
545 td->td_stripoffset[strip] > (uint64)tif->tif_size - bytecount) {
546 /*
547 * This error message might seem strange, but
548 * it's what would happen if a read were done
549 * instead.
550 */
551#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
552 TIFFErrorExt(tif->tif_clientdata, module,
553
554 "Read error on strip %lu; "
555 "got %I64u bytes, expected %I64u",
556 (unsigned long) strip,
557 (unsigned __int64) tif->tif_size - td->td_stripoffset[strip],
558 (unsigned __int64) bytecount);
559#else
560 TIFFErrorExt(tif->tif_clientdata, module,
561
562 "Read error on strip %lu; "
563 "got %llu bytes, expected %llu",
564 (unsigned long) strip,
565 (unsigned long long) tif->tif_size - td->td_stripoffset[strip],
566 (unsigned long long) bytecount);
567#endif
568 tif->tif_curstrip = NOSTRIP((uint32)(-1));
569 return (0);
570 }
571 tif->tif_rawdatasize = (tmsize_t)bytecount;
572 tif->tif_rawdata = tif->tif_base + (tmsize_t)td->td_stripoffset[strip];
573 tif->tif_rawdataoff = 0;
574 tif->tif_rawdataloaded = (tmsize_t) bytecount;
575
576 /*
577 * When we have tif_rawdata reference directly into the memory mapped file
578 * we need to be pretty careful about how we use the rawdata. It is not
579 * a general purpose working buffer as it normally otherwise is. So we
580 * keep track of this fact to avoid using it improperly.
581 */
582 tif->tif_flags |= TIFF_BUFFERMMAP0x800000;
583 } else {
584 /*
585 * Expand raw data buffer, if needed, to hold data
586 * strip coming from file (perhaps should set upper
587 * bound on the size of a buffer we'll use?).
588 */
589 tmsize_t bytecountm;
590 bytecountm=(tmsize_t)bytecount;
591 if ((uint64)bytecountm!=bytecount)
592 {
593 TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
594 return(0);
595 }
596 if (bytecountm > tif->tif_rawdatasize) {
597 tif->tif_curstrip = NOSTRIP((uint32)(-1));
598 if ((tif->tif_flags & TIFF_MYBUFFER0x00200) == 0) {
599 TIFFErrorExt(tif->tif_clientdata, module,
600 "Data buffer too small to hold strip %lu",
601 (unsigned long) strip);
602 return (0);
603 }
604 if (!TIFFReadBufferSetup(tif, 0, bytecountm))
605 return (0);
606 }
607 if (tif->tif_flags&TIFF_BUFFERMMAP0x800000) {
608 tif->tif_curstrip = NOSTRIP((uint32)(-1));
609 if (!TIFFReadBufferSetup(tif, 0, bytecountm))
610 return (0);
611 }
612 if (TIFFReadRawStrip1(tif, strip, tif->tif_rawdata,
613 bytecountm, module) != bytecountm)
614 return (0);
615
616 tif->tif_rawdataoff = 0;
617 tif->tif_rawdataloaded = bytecountm;
618
619 if (!isFillOrder(tif, td->td_fillorder)(((tif)->tif_flags & (td->td_fillorder)) != 0) &&
620 (tif->tif_flags & TIFF_NOBITREV0x00100) == 0)
621 TIFFReverseBits(tif->tif_rawdata, bytecountm);
622 }
623 }
624 return (TIFFStartStrip(tif, strip));
625}
626
627/*
628 * Tile-oriented Read Support
629 * Contributed by Nancy Cam (Silicon Graphics).
630 */
631
632/*
633 * Read and decompress a tile of data. The
634 * tile is selected by the (x,y,z,s) coordinates.
635 */
636tmsize_t
637TIFFReadTile(TIFF* tif, void* buf, uint32 x, uint32 y, uint32 z, uint16 s)
638{
639 if (!TIFFCheckRead(tif, 1) || !TIFFCheckTile(tif, x, y, z, s))
640 return ((tmsize_t)(-1));
641 return (TIFFReadEncodedTile(tif,
642 TIFFComputeTile(tif, x, y, z, s), buf, (tmsize_t)(-1)));
643}
644
645/*
646 * Read a tile of data and decompress the specified
647 * amount into the user-supplied buffer.
648 */
649tmsize_t
650TIFFReadEncodedTile(TIFF* tif, uint32 tile, void* buf, tmsize_t size)
651{
652 static const char module[] = "TIFFReadEncodedTile";
653 TIFFDirectory *td = &tif->tif_dir;
654 tmsize_t tilesize = tif->tif_tilesize;
655
656 if (!TIFFCheckRead(tif, 1))
657 return ((tmsize_t)(-1));
658 if (tile >= td->td_nstrips) {
659 TIFFErrorExt(tif->tif_clientdata, module,
660 "%lu: Tile out of range, max %lu",
661 (unsigned long) tile, (unsigned long) td->td_nstrips);
662 return ((tmsize_t)(-1));
663 }
664 if (size == (tmsize_t)(-1))
665 size = tilesize;
666 else if (size > tilesize)
667 size = tilesize;
668 if (TIFFFillTile(tif, tile) && (*tif->tif_decodetile)(tif,
669 (uint8*) buf, size, (uint16)(tile/td->td_stripsperimage))) {
670 (*tif->tif_postdecode)(tif, (uint8*) buf, size);
671 return (size);
672 } else
673 return ((tmsize_t)(-1));
674}
675
676static tmsize_t
677TIFFReadRawTile1(TIFF* tif, uint32 tile, void* buf, tmsize_t size, const char* module)
678{
679 TIFFDirectory *td = &tif->tif_dir;
680
681 if (!_TIFFFillStriles( tif ))
682 return ((tmsize_t)(-1));
683
684 assert((tif->tif_flags&TIFF_NOREADRAW)==0)(((tif->tif_flags&0x20000)==0) ? (void) (0) : __assert_fail
("(tif->tif_flags&0x20000)==0", "tif_read.c", 684, __PRETTY_FUNCTION__
));
685 if (!isMapped(tif)(((tif)->tif_flags & 0x00800) != 0)) {
686 tmsize_t cc;
687
688 if (!SeekOK(tif, td->td_stripoffset[tile])(((*((tif))->tif_seekproc)(((tif))->tif_clientdata,((td
->td_stripoffset[tile])),(0)))==(td->td_stripoffset[tile
]))) {
689 TIFFErrorExt(tif->tif_clientdata, module,
690 "Seek error at row %lu, col %lu, tile %lu",
691 (unsigned long) tif->tif_row,
692 (unsigned long) tif->tif_col,
693 (unsigned long) tile);
694 return ((tmsize_t)(-1));
695 }
696 cc = TIFFReadFile(tif, buf, size)((*(tif)->tif_readproc)((tif)->tif_clientdata,(buf),(size
)));
697 if (cc != size) {
698#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
699 TIFFErrorExt(tif->tif_clientdata, module,
700 "Read error at row %lu, col %lu; got %I64u bytes, expected %I64u",
701 (unsigned long) tif->tif_row,
702 (unsigned long) tif->tif_col,
703 (unsigned __int64) cc,
704 (unsigned __int64) size);
705#else
706 TIFFErrorExt(tif->tif_clientdata, module,
707 "Read error at row %lu, col %lu; got %llu bytes, expected %llu",
708 (unsigned long) tif->tif_row,
709 (unsigned long) tif->tif_col,
710 (unsigned long long) cc,
711 (unsigned long long) size);
712#endif
713 return ((tmsize_t)(-1));
714 }
715 } else {
716 tmsize_t ma,mb;
717 tmsize_t n;
718 ma=(tmsize_t)td->td_stripoffset[tile];
719 mb=ma+size;
720 if (((uint64)ma!=td->td_stripoffset[tile])||(ma>tif->tif_size))
721 n=0;
722 else if ((mb<ma)||(mb<size)||(mb>tif->tif_size))
723 n=tif->tif_size-ma;
724 else
725 n=size;
726 if (n!=size) {
727#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
728 TIFFErrorExt(tif->tif_clientdata, module,
729"Read error at row %lu, col %lu, tile %lu; got %I64u bytes, expected %I64u",
730 (unsigned long) tif->tif_row,
731 (unsigned long) tif->tif_col,
732 (unsigned long) tile,
733 (unsigned __int64) n,
734 (unsigned __int64) size);
735#else
736 TIFFErrorExt(tif->tif_clientdata, module,
737"Read error at row %lu, col %lu, tile %lu; got %llu bytes, expected %llu",
738 (unsigned long) tif->tif_row,
739 (unsigned long) tif->tif_col,
740 (unsigned long) tile,
741 (unsigned long long) n,
742 (unsigned long long) size);
743#endif
744 return ((tmsize_t)(-1));
745 }
746 _TIFFmemcpy(buf, tif->tif_base + ma, size);
747 }
748 return (size);
749}
750
751/*
752 * Read a tile of data from the file.
753 */
754tmsize_t
755TIFFReadRawTile(TIFF* tif, uint32 tile, void* buf, tmsize_t size)
756{
757 static const char module[] = "TIFFReadRawTile";
758 TIFFDirectory *td = &tif->tif_dir;
759 uint64 bytecount64;
760 tmsize_t bytecountm;
761
762 if (!TIFFCheckRead(tif, 1))
763 return ((tmsize_t)(-1));
764 if (tile >= td->td_nstrips) {
765 TIFFErrorExt(tif->tif_clientdata, module,
766 "%lu: Tile out of range, max %lu",
767 (unsigned long) tile, (unsigned long) td->td_nstrips);
768 return ((tmsize_t)(-1));
769 }
770 if (tif->tif_flags&TIFF_NOREADRAW0x20000)
771 {
772 TIFFErrorExt(tif->tif_clientdata, module,
773 "Compression scheme does not support access to raw uncompressed data");
774 return ((tmsize_t)(-1));
775 }
776 bytecount64 = td->td_stripbytecount[tile];
777 if (size != (tmsize_t)(-1) && (uint64)size < bytecount64)
778 bytecount64 = (uint64)size;
779 bytecountm = (tmsize_t)bytecount64;
780 if ((uint64)bytecountm!=bytecount64)
781 {
782 TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
783 return ((tmsize_t)(-1));
784 }
785 return (TIFFReadRawTile1(tif, tile, buf, bytecountm, module));
786}
787
788/*
789 * Read the specified tile and setup for decoding. The data buffer is
790 * expanded, as necessary, to hold the tile's data.
791 */
792int
793TIFFFillTile(TIFF* tif, uint32 tile)
794{
795 static const char module[] = "TIFFFillTile";
796 TIFFDirectory *td = &tif->tif_dir;
797
798 if (!_TIFFFillStriles( tif ) || !tif->tif_dir.td_stripbytecount)
799 return 0;
800
801 if ((tif->tif_flags&TIFF_NOREADRAW0x20000)==0)
802 {
803 uint64 bytecount = td->td_stripbytecount[tile];
804 if (bytecount <= 0) {
805#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
806 TIFFErrorExt(tif->tif_clientdata, module,
807 "%I64u: Invalid tile byte count, tile %lu",
808 (unsigned __int64) bytecount,
809 (unsigned long) tile);
810#else
811 TIFFErrorExt(tif->tif_clientdata, module,
812 "%llu: Invalid tile byte count, tile %lu",
813 (unsigned long long) bytecount,
814 (unsigned long) tile);
815#endif
816 return (0);
817 }
818 if (isMapped(tif)(((tif)->tif_flags & 0x00800) != 0) &&
819 (isFillOrder(tif, td->td_fillorder)(((tif)->tif_flags & (td->td_fillorder)) != 0)
820 || (tif->tif_flags & TIFF_NOBITREV0x00100))) {
821 /*
822 * The image is mapped into memory and we either don't
823 * need to flip bits or the compression routine is
824 * going to handle this operation itself. In this
825 * case, avoid copying the raw data and instead just
826 * reference the data from the memory mapped file
827 * image. This assumes that the decompression
828 * routines do not modify the contents of the raw data
829 * buffer (if they try to, the application will get a
830 * fault since the file is mapped read-only).
831 */
832 if ((tif->tif_flags & TIFF_MYBUFFER0x00200) && tif->tif_rawdata) {
833 _TIFFfree(tif->tif_rawdata);
834 tif->tif_rawdata = NULL((void*)0);
835 tif->tif_rawdatasize = 0;
836 }
837 tif->tif_flags &= ~TIFF_MYBUFFER0x00200;
838 /*
839 * We must check for overflow, potentially causing
840 * an OOB read. Instead of simple
841 *
842 * td->td_stripoffset[tile]+bytecount > tif->tif_size
843 *
844 * comparison (which can overflow) we do the following
845 * two comparisons:
846 */
847 if (bytecount > (uint64)tif->tif_size ||
848 td->td_stripoffset[tile] > (uint64)tif->tif_size - bytecount) {
849 tif->tif_curtile = NOTILE((uint32)(-1));
850 return (0);
851 }
852 tif->tif_rawdatasize = (tmsize_t)bytecount;
853 tif->tif_rawdata =
854 tif->tif_base + (tmsize_t)td->td_stripoffset[tile];
855 tif->tif_rawdataoff = 0;
856 tif->tif_rawdataloaded = (tmsize_t) bytecount;
857 tif->tif_flags |= TIFF_BUFFERMMAP0x800000;
858 } else {
859 /*
860 * Expand raw data buffer, if needed, to hold data
861 * tile coming from file (perhaps should set upper
862 * bound on the size of a buffer we'll use?).
863 */
864 tmsize_t bytecountm;
865 bytecountm=(tmsize_t)bytecount;
866 if ((uint64)bytecountm!=bytecount)
867 {
868 TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
869 return(0);
870 }
871 if (bytecountm > tif->tif_rawdatasize) {
872 tif->tif_curtile = NOTILE((uint32)(-1));
873 if ((tif->tif_flags & TIFF_MYBUFFER0x00200) == 0) {
874 TIFFErrorExt(tif->tif_clientdata, module,
875 "Data buffer too small to hold tile %lu",
876 (unsigned long) tile);
877 return (0);
878 }
879 if (!TIFFReadBufferSetup(tif, 0, bytecountm))
880 return (0);
881 }
882 if (tif->tif_flags&TIFF_BUFFERMMAP0x800000) {
883 tif->tif_curtile = NOTILE((uint32)(-1));
884 if (!TIFFReadBufferSetup(tif, 0, bytecountm))
885 return (0);
886 }
887
888 if (TIFFReadRawTile1(tif, tile, tif->tif_rawdata,
889 bytecountm, module) != bytecountm)
890 return (0);
891
892 tif->tif_rawdataoff = 0;
893 tif->tif_rawdataloaded = bytecountm;
894
895 if (!isFillOrder(tif, td->td_fillorder)(((tif)->tif_flags & (td->td_fillorder)) != 0) &&
896 (tif->tif_flags & TIFF_NOBITREV0x00100) == 0)
897 TIFFReverseBits(tif->tif_rawdata,
898 tif->tif_rawdataloaded);
899 }
900 }
901 return (TIFFStartTile(tif, tile));
902}
903
904/*
905 * Setup the raw data buffer in preparation for
906 * reading a strip of raw data. If the buffer
907 * is specified as zero, then a buffer of appropriate
908 * size is allocated by the library. Otherwise,
909 * the client must guarantee that the buffer is
910 * large enough to hold any individual strip of
911 * raw data.
912 */
913int
914TIFFReadBufferSetup(TIFF* tif, void* bp, tmsize_t size)
915{
916 static const char module[] = "TIFFReadBufferSetup";
917
918 assert((tif->tif_flags&TIFF_NOREADRAW)==0)(((tif->tif_flags&0x20000)==0) ? (void) (0) : __assert_fail
("(tif->tif_flags&0x20000)==0", "tif_read.c", 918, __PRETTY_FUNCTION__
));
919 tif->tif_flags &= ~TIFF_BUFFERMMAP0x800000;
920
921 if (tif->tif_rawdata) {
922 if (tif->tif_flags & TIFF_MYBUFFER0x00200)
923 _TIFFfree(tif->tif_rawdata);
924 tif->tif_rawdata = NULL((void*)0);
925 tif->tif_rawdatasize = 0;
926 }
927 if (bp) {
928 tif->tif_rawdatasize = size;
929 tif->tif_rawdata = (uint8*) bp;
930 tif->tif_flags &= ~TIFF_MYBUFFER0x00200;
931 } else {
932 tif->tif_rawdatasize = (tmsize_t)TIFFroundup_64((uint64)size, 1024)(((((uint64)((uint64)size))+(((uint64)(1024))-1))/((uint64)(1024
)))*(1024));
933 if (tif->tif_rawdatasize==0)
934 tif->tif_rawdatasize=(tmsize_t)(-1);
935 tif->tif_rawdata = (uint8*) _TIFFmalloc(tif->tif_rawdatasize);
936 tif->tif_flags |= TIFF_MYBUFFER0x00200;
937 }
938 if (tif->tif_rawdata == NULL((void*)0)) {
939 TIFFErrorExt(tif->tif_clientdata, module,
940 "No space for data buffer at scanline %lu",
941 (unsigned long) tif->tif_row);
942 tif->tif_rawdatasize = 0;
943 return (0);
944 }
945 return (1);
946}
947
948/*
949 * Set state to appear as if a
950 * strip has just been read in.
951 */
952static int
953TIFFStartStrip(TIFF* tif, uint32 strip)
954{
955 TIFFDirectory *td = &tif->tif_dir;
956
957 if (!_TIFFFillStriles( tif ) || !tif->tif_dir.td_stripbytecount)
958 return 0;
959
960 if ((tif->tif_flags & TIFF_CODERSETUP0x00020) == 0) {
961 if (!(*tif->tif_setupdecode)(tif))
962 return (0);
963 tif->tif_flags |= TIFF_CODERSETUP0x00020;
964 }
965 tif->tif_curstrip = strip;
966 tif->tif_row = (strip % td->td_stripsperimage) * td->td_rowsperstrip;
967 tif->tif_flags &= ~TIFF_BUF4WRITE0x100000;
968
969 if (tif->tif_flags&TIFF_NOREADRAW0x20000)
970 {
971 tif->tif_rawcp = NULL((void*)0);
972 tif->tif_rawcc = 0;
973 }
974 else
975 {
976 tif->tif_rawcp = tif->tif_rawdata;
977 tif->tif_rawcc = (tmsize_t)td->td_stripbytecount[strip];
978 }
979 return ((*tif->tif_predecode)(tif,
980 (uint16)(strip / td->td_stripsperimage)));
981}
982
983/*
984 * Set state to appear as if a
985 * tile has just been read in.
986 */
987static int
988TIFFStartTile(TIFF* tif, uint32 tile)
989{
990 TIFFDirectory *td = &tif->tif_dir;
991
992 if (!_TIFFFillStriles( tif ) || !tif->tif_dir.td_stripbytecount)
1
Taking false branch
→
993 return 0;
994
995 if ((tif->tif_flags & TIFF_CODERSETUP0x00020) == 0) {
2
←
Taking false branch
→
996 if (!(*tif->tif_setupdecode)(tif))
997 return (0);
998 tif->tif_flags |= TIFF_CODERSETUP0x00020;
999 }
1000 tif->tif_curtile = tile;
1001 tif->tif_row =
1002 (tile % TIFFhowmany_32(td->td_imagewidth, td->td_tilewidth)(((uint32)td->td_imagewidth < (0xffffffff - (uint32)(td
->td_tilewidth-1))) ? ((((uint32)(td->td_imagewidth))+(
((uint32)(td->td_tilewidth))-1))/((uint32)(td->td_tilewidth
))) : 0U)) *
1003 td->td_tilelength;
1004 tif->tif_col =
1005 (tile % TIFFhowmany_32(td->td_imagelength, td->td_tilelength)(((uint32)td->td_imagelength < (0xffffffff - (uint32)(td
->td_tilelength-1))) ? ((((uint32)(td->td_imagelength))
+(((uint32)(td->td_tilelength))-1))/((uint32)(td->td_tilelength
))) : 0U)) *
3
←
Division by zero
1006 td->td_tilewidth;
1007 tif->tif_flags &= ~TIFF_BUF4WRITE0x100000;
1008 if (tif->tif_flags&TIFF_NOREADRAW0x20000)
1009 {
1010 tif->tif_rawcp = NULL((void*)0);
1011 tif->tif_rawcc = 0;
1012 }
1013 else
1014 {
1015 tif->tif_rawcp = tif->tif_rawdata;
1016 tif->tif_rawcc = (tmsize_t)td->td_stripbytecount[tile];
1017 }
1018 return ((*tif->tif_predecode)(tif,
1019 (uint16)(tile/td->td_stripsperimage)));
1020}
1021
1022static int
1023TIFFCheckRead(TIFF* tif, int tiles)
1024{
1025 if (tif->tif_mode == O_WRONLY01) {
1026 TIFFErrorExt(tif->tif_clientdata, tif->tif_name, "File not open for reading");
1027 return (0);
1028 }
1029 if (tiles ^ isTiled(tif)(((tif)->tif_flags & 0x00400) != 0)) {
1030 TIFFErrorExt(tif->tif_clientdata, tif->tif_name, tiles ?
1031 "Can not read tiles from a stripped image" :
1032 "Can not read scanlines from a tiled image");
1033 return (0);
1034 }
1035 return (1);
1036}
1037
1038void
1039_TIFFNoPostDecode(TIFF* tif, uint8* buf, tmsize_t cc)
1040{
1041 (void) tif; (void) buf; (void) cc;
1042}
1043
1044void
1045_TIFFSwab16BitData(TIFF* tif, uint8* buf, tmsize_t cc)
1046{
1047 (void) tif;
1048 assert((cc & 1) == 0)(((cc & 1) == 0) ? (void) (0) : __assert_fail ("(cc & 1) == 0"
, "tif_read.c", 1048, __PRETTY_FUNCTION__));
1049 TIFFSwabArrayOfShort((uint16*) buf, cc/2);
1050}
1051
1052void
1053_TIFFSwab24BitData(TIFF* tif, uint8* buf, tmsize_t cc)
1054{
1055 (void) tif;
1056 assert((cc % 3) == 0)(((cc % 3) == 0) ? (void) (0) : __assert_fail ("(cc % 3) == 0"
, "tif_read.c", 1056, __PRETTY_FUNCTION__));
1057 TIFFSwabArrayOfTriples((uint8*) buf, cc/3);
1058}
1059
1060void
1061_TIFFSwab32BitData(TIFF* tif, uint8* buf, tmsize_t cc)
1062{
1063 (void) tif;
1064 assert((cc & 3) == 0)(((cc & 3) == 0) ? (void) (0) : __assert_fail ("(cc & 3) == 0"
, "tif_read.c", 1064, __PRETTY_FUNCTION__));
1065 TIFFSwabArrayOfLong((uint32*) buf, cc/4);
1066}
1067
1068void
1069_TIFFSwab64BitData(TIFF* tif, uint8* buf, tmsize_t cc)
1070{
1071 (void) tif;
1072 assert((cc & 7) == 0)(((cc & 7) == 0) ? (void) (0) : __assert_fail ("(cc & 7) == 0"
, "tif_read.c", 1072, __PRETTY_FUNCTION__));
1073 TIFFSwabArrayOfDouble((double*) buf, cc/8);
1074}
1075
1076/* vim: set ts=8 sts=8 sw=8 noet: */
1077/*
1078 * Local Variables:
1079 * mode: c
1080 * c-basic-offset: 8
1081 * fill-column: 78
1082 * End:
1083 */