thirdparty/libtiff/tif_dirread.c

   1 /* $Id: tif_dirread.c,v 1.191 2015-09-05 20:31:41 bfriesen Exp $ */
   2
   3 /*
   4  * Copyright (c) 1988-1997 Sam Leffler
   5  * Copyright (c) 1991-1997 Silicon Graphics, Inc.
   6  *
   7  * Permission to use, copy, modify, distribute, and sell this software and
   8  * its documentation for any purpose is hereby granted without fee, provided
   9  * that (i) the above copyright notices and this permission notice appear in
  10  * all copies of the software and related documentation, and (ii) the names of
  11  * Sam Leffler and Silicon Graphics may not be used in any advertising or
  12  * publicity relating to the software without the specific, prior written
  13  * permission of Sam Leffler and Silicon Graphics.
  14  *
  15  * THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND,
  16  * EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY
  17  * WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
  18  *
  19  * IN NO EVENT SHALL SAM LEFFLER OR SILICON GRAPHICS BE LIABLE FOR
  20  * ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND,
  21  * OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
  22  * WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF
  23  * LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
  24  * OF THIS SOFTWARE.
  25  */
  26
  27 /*
  28  * TIFF Library.
  29  *
  30  * Directory Read Support Routines.
  31  */
  32
  33 /* Suggested pending improvements:
  34  * - add a field 'ignore' to the TIFFDirEntry structure, to flag status,
  35  *   eliminating current use of the IGNORE value, and therefore eliminating
  36  *   current irrational behaviour on tags with tag id code 0
  37  * - add a field 'field_info' to the TIFFDirEntry structure, and set that with
  38  *   the pointer to the appropriate TIFFField structure early on in
  39  *   TIFFReadDirectory, so as to eliminate current possibly repetitive lookup.
  40  */
  41
  42 #include "tiffiop.h"
  43
  44 #define IGNORE 0          /* tag placeholder used below */
  45 #define FAILED_FII    ((uint32) -1)
  46
  47 #ifdef HAVE_IEEEFP
  48 # define TIFFCvtIEEEFloatToNative(tif, n, fp)
  49 # define TIFFCvtIEEEDoubleToNative(tif, n, dp)
  50 #else
  51 extern void TIFFCvtIEEEFloatToNative(TIFF*, uint32, float*);
  52 extern void TIFFCvtIEEEDoubleToNative(TIFF*, uint32, double*);
  53 #endif
  54
  55 enum TIFFReadDirEntryErr {
  56         TIFFReadDirEntryErrOk = 0,
  57         TIFFReadDirEntryErrCount = 1,
  58         TIFFReadDirEntryErrType = 2,
  59         TIFFReadDirEntryErrIo = 3,
  60         TIFFReadDirEntryErrRange = 4,
  61         TIFFReadDirEntryErrPsdif = 5,
  62         TIFFReadDirEntryErrSizesan = 6,
  63         TIFFReadDirEntryErrAlloc = 7,
  64 };
  65
  66 static enum TIFFReadDirEntryErr TIFFReadDirEntryByte(TIFF* tif, TIFFDirEntry* direntry, uint8* value);
  67 static enum TIFFReadDirEntryErr TIFFReadDirEntryShort(TIFF* tif, TIFFDirEntry* direntry, uint16* value);
  68 static enum TIFFReadDirEntryErr TIFFReadDirEntryLong(TIFF* tif, TIFFDirEntry* direntry, uint32* value);
  69 static enum TIFFReadDirEntryErr TIFFReadDirEntryLong8(TIFF* tif, TIFFDirEntry* direntry, uint64* value);
  70 static enum TIFFReadDirEntryErr TIFFReadDirEntryFloat(TIFF* tif, TIFFDirEntry* direntry, float* value);
  71 static enum TIFFReadDirEntryErr TIFFReadDirEntryDouble(TIFF* tif, TIFFDirEntry* direntry, double* value);
  72 static enum TIFFReadDirEntryErr TIFFReadDirEntryIfd8(TIFF* tif, TIFFDirEntry* direntry, uint64* value);
  73
  74 static enum TIFFReadDirEntryErr TIFFReadDirEntryArray(TIFF* tif, TIFFDirEntry* direntry, uint32* count, uint32 desttypesize, void** value);
  75 static enum TIFFReadDirEntryErr TIFFReadDirEntryByteArray(TIFF* tif, TIFFDirEntry* direntry, uint8** value);
  76 static enum TIFFReadDirEntryErr TIFFReadDirEntrySbyteArray(TIFF* tif, TIFFDirEntry* direntry, int8** value);
  77 static enum TIFFReadDirEntryErr TIFFReadDirEntryShortArray(TIFF* tif, TIFFDirEntry* direntry, uint16** value);
  78 static enum TIFFReadDirEntryErr TIFFReadDirEntrySshortArray(TIFF* tif, TIFFDirEntry* direntry, int16** value);
  79 static enum TIFFReadDirEntryErr TIFFReadDirEntryLongArray(TIFF* tif, TIFFDirEntry* direntry, uint32** value);
  80 static enum TIFFReadDirEntryErr TIFFReadDirEntrySlongArray(TIFF* tif, TIFFDirEntry* direntry, int32** value);
  81 static enum TIFFReadDirEntryErr TIFFReadDirEntryLong8Array(TIFF* tif, TIFFDirEntry* direntry, uint64** value);
  82 static enum TIFFReadDirEntryErr TIFFReadDirEntrySlong8Array(TIFF* tif, TIFFDirEntry* direntry, int64** value);
  83 static enum TIFFReadDirEntryErr TIFFReadDirEntryFloatArray(TIFF* tif, TIFFDirEntry* direntry, float** value);
  84 static enum TIFFReadDirEntryErr TIFFReadDirEntryDoubleArray(TIFF* tif, TIFFDirEntry* direntry, double** value);
  85 static enum TIFFReadDirEntryErr TIFFReadDirEntryIfd8Array(TIFF* tif, TIFFDirEntry* direntry, uint64** value);
  86
  87 static enum TIFFReadDirEntryErr TIFFReadDirEntryPersampleShort(TIFF* tif, TIFFDirEntry* direntry, uint16* value);
  88 #if 0
  89 static enum TIFFReadDirEntryErr TIFFReadDirEntryPersampleDouble(TIFF* tif, TIFFDirEntry* direntry, double* value);
  90 #endif
  91
  92 static void TIFFReadDirEntryCheckedByte(TIFF* tif, TIFFDirEntry* direntry, uint8* value);
  93 static void TIFFReadDirEntryCheckedSbyte(TIFF* tif, TIFFDirEntry* direntry, int8* value);
  94 static void TIFFReadDirEntryCheckedShort(TIFF* tif, TIFFDirEntry* direntry, uint16* value);
  95 static void TIFFReadDirEntryCheckedSshort(TIFF* tif, TIFFDirEntry* direntry, int16* value);
  96 static void TIFFReadDirEntryCheckedLong(TIFF* tif, TIFFDirEntry* direntry, uint32* value);
  97 static void TIFFReadDirEntryCheckedSlong(TIFF* tif, TIFFDirEntry* direntry, int32* value);
  98 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedLong8(TIFF* tif, TIFFDirEntry* direntry, uint64* value);
  99 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedSlong8(TIFF* tif, TIFFDirEntry* direntry, int64* value);
 100 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedRational(TIFF* tif, TIFFDirEntry* direntry, double* value);
 101 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedSrational(TIFF* tif, TIFFDirEntry* direntry, double* value);
 102 static void TIFFReadDirEntryCheckedFloat(TIFF* tif, TIFFDirEntry* direntry, float* value);
 103 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedDouble(TIFF* tif, TIFFDirEntry* direntry, double* value);
 104
 105 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSbyte(int8 value);
 106 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteShort(uint16 value);
 107 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSshort(int16 value);
 108 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteLong(uint32 value);
 109 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSlong(int32 value);
 110 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteLong8(uint64 value);
 111 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSlong8(int64 value);
 112
 113 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteByte(uint8 value);
 114 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteShort(uint16 value);
 115 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteSshort(int16 value);
 116 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteLong(uint32 value);
 117 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteSlong(int32 value);
 118 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteLong8(uint64 value);
 119 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteSlong8(int64 value);
 120
 121 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSbyte(int8 value);
 122 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSshort(int16 value);
 123 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortLong(uint32 value);
 124 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSlong(int32 value);
 125 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortLong8(uint64 value);
 126 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSlong8(int64 value);
 127
 128 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortShort(uint16 value);
 129 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortLong(uint32 value);
 130 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortSlong(int32 value);
 131 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortLong8(uint64 value);
 132 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortSlong8(int64 value);
 133
 134 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongSbyte(int8 value);
 135 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongSshort(int16 value);
 136 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongSlong(int32 value);
 137 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongLong8(uint64 value);
 138 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongSlong8(int64 value);
 139
 140 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSlongLong(uint32 value);
 141 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSlongLong8(uint64 value);
 142 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSlongSlong8(int64 value);
 143
 144 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLong8Sbyte(int8 value);
 145 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLong8Sshort(int16 value);
 146 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLong8Slong(int32 value);
 147 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLong8Slong8(int64 value);
 148
 149 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSlong8Long8(uint64 value);
 150
 151 static enum TIFFReadDirEntryErr TIFFReadDirEntryData(TIFF* tif, uint64 offset, tmsize_t size, void* dest);
 152 static void TIFFReadDirEntryOutputErr(TIFF* tif, enum TIFFReadDirEntryErr err, const char* module, const char* tagname, int recover);
 153
 154 static void TIFFReadDirectoryCheckOrder(TIFF* tif, TIFFDirEntry* dir, uint16 dircount);
 155 static TIFFDirEntry* TIFFReadDirectoryFindEntry(TIFF* tif, TIFFDirEntry* dir, uint16 dircount, uint16 tagid);
 156 static void TIFFReadDirectoryFindFieldInfo(TIFF* tif, uint16 tagid, uint32* fii);
 157
 158 static int EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount);
 159 static void MissingRequired(TIFF*, const char*);
 160 static int TIFFCheckDirOffset(TIFF* tif, uint64 diroff);
 161 static int CheckDirCount(TIFF*, TIFFDirEntry*, uint32);
 162 static uint16 TIFFFetchDirectory(TIFF* tif, uint64 diroff, TIFFDirEntry** pdir, uint64* nextdiroff);
 163 static int TIFFFetchNormalTag(TIFF*, TIFFDirEntry*, int recover);
 164 static int TIFFFetchStripThing(TIFF* tif, TIFFDirEntry* dir, uint32 nstrips, uint64** lpp);
 165 static int TIFFFetchSubjectDistance(TIFF*, TIFFDirEntry*);
 166 static void ChopUpSingleUncompressedStrip(TIFF*);
 167 static uint64 TIFFReadUInt64(const uint8 *value);
 168
 169 typedef union _UInt64Aligned_t
 170 {
 171         double d;
 172         uint64 l;
 173         uint32 i[2];
 174         uint16 s[4];
 175         uint8  c[8];
 176 } UInt64Aligned_t;
 177
 178 /*
 179   Unaligned safe copy of a uint64 value from an octet array.
 180 */
 181 static uint64 TIFFReadUInt64(const uint8 *value)
 182 {
 183         UInt64Aligned_t result;
 184
 185         result.c[0]=value[0];
 186         result.c[1]=value[1];
 187         result.c[2]=value[2];
 188         result.c[3]=value[3];
 189         result.c[4]=value[4];
 190         result.c[5]=value[5];
 191         result.c[6]=value[6];
 192         result.c[7]=value[7];
 193
 194         return result.l;
 195 }
 196
 197 static enum TIFFReadDirEntryErr TIFFReadDirEntryByte(TIFF* tif, TIFFDirEntry* direntry, uint8* value)
 198 {
 199         enum TIFFReadDirEntryErr err;
 200         if (direntry->tdir_count!=1)
 201                 return(TIFFReadDirEntryErrCount);
 202         switch (direntry->tdir_type)
 203         {
 204                 case TIFF_BYTE:
 205                         TIFFReadDirEntryCheckedByte(tif,direntry,value);
 206                         return(TIFFReadDirEntryErrOk);
 207                 case TIFF_SBYTE:
 208                         {
 209                                 int8 m;
 210                                 TIFFReadDirEntryCheckedSbyte(tif,direntry,&m);
 211                                 err=TIFFReadDirEntryCheckRangeByteSbyte(m);
 212                                 if (err!=TIFFReadDirEntryErrOk)
 213                                         return(err);
 214                                 *value=(uint8)m;
 215                                 return(TIFFReadDirEntryErrOk);
 216                         }
 217                 case TIFF_SHORT:
 218                         {
 219                                 uint16 m;
 220                                 TIFFReadDirEntryCheckedShort(tif,direntry,&m);
 221                                 err=TIFFReadDirEntryCheckRangeByteShort(m);
 222                                 if (err!=TIFFReadDirEntryErrOk)
 223                                         return(err);
 224                                 *value=(uint8)m;
 225                                 return(TIFFReadDirEntryErrOk);
 226                         }
 227                 case TIFF_SSHORT:
 228                         {
 229                                 int16 m;
 230                                 TIFFReadDirEntryCheckedSshort(tif,direntry,&m);
 231                                 err=TIFFReadDirEntryCheckRangeByteSshort(m);
 232                                 if (err!=TIFFReadDirEntryErrOk)
 233                                         return(err);
 234                                 *value=(uint8)m;
 235                                 return(TIFFReadDirEntryErrOk);
 236                         }
 237                 case TIFF_LONG:
 238                         {
 239                                 uint32 m;
 240                                 TIFFReadDirEntryCheckedLong(tif,direntry,&m);
 241                                 err=TIFFReadDirEntryCheckRangeByteLong(m);
 242                                 if (err!=TIFFReadDirEntryErrOk)
 243                                         return(err);
 244                                 *value=(uint8)m;
 245                                 return(TIFFReadDirEntryErrOk);
 246                         }
 247                 case TIFF_SLONG:
 248                         {
 249                                 int32 m;
 250                                 TIFFReadDirEntryCheckedSlong(tif,direntry,&m);
 251                                 err=TIFFReadDirEntryCheckRangeByteSlong(m);
 252                                 if (err!=TIFFReadDirEntryErrOk)
 253                                         return(err);
 254                                 *value=(uint8)m;
 255                                 return(TIFFReadDirEntryErrOk);
 256                         }
 257                 case TIFF_LONG8:
 258                         {
 259                                 uint64 m;
 260                                 err=TIFFReadDirEntryCheckedLong8(tif,direntry,&m);
 261                                 if (err!=TIFFReadDirEntryErrOk)
 262                                         return(err);
 263                                 err=TIFFReadDirEntryCheckRangeByteLong8(m);
 264                                 if (err!=TIFFReadDirEntryErrOk)
 265                                         return(err);
 266                                 *value=(uint8)m;
 267                                 return(TIFFReadDirEntryErrOk);
 268                         }
 269                 case TIFF_SLONG8:
 270                         {
 271                                 int64 m;
 272                                 err=TIFFReadDirEntryCheckedSlong8(tif,direntry,&m);
 273                                 if (err!=TIFFReadDirEntryErrOk)
 274                                         return(err);
 275                                 err=TIFFReadDirEntryCheckRangeByteSlong8(m);
 276                                 if (err!=TIFFReadDirEntryErrOk)
 277                                         return(err);
 278                                 *value=(uint8)m;
 279                                 return(TIFFReadDirEntryErrOk);
 280                         }
 281                 default:
 282                         return(TIFFReadDirEntryErrType);
 283         }
 284 }
 285
 286 static enum TIFFReadDirEntryErr TIFFReadDirEntryShort(TIFF* tif, TIFFDirEntry* direntry, uint16* value)
 287 {
 288         enum TIFFReadDirEntryErr err;
 289         if (direntry->tdir_count!=1)
 290                 return(TIFFReadDirEntryErrCount);
 291         switch (direntry->tdir_type)
 292         {
 293                 case TIFF_BYTE:
 294                         {
 295                                 uint8 m;
 296                                 TIFFReadDirEntryCheckedByte(tif,direntry,&m);
 297                                 *value=(uint16)m;
 298                                 return(TIFFReadDirEntryErrOk);
 299                         }
 300                 case TIFF_SBYTE:
 301                         {
 302                                 int8 m;
 303                                 TIFFReadDirEntryCheckedSbyte(tif,direntry,&m);
 304                                 err=TIFFReadDirEntryCheckRangeShortSbyte(m);
 305                                 if (err!=TIFFReadDirEntryErrOk)
 306                                         return(err);
 307                                 *value=(uint16)m;
 308                                 return(TIFFReadDirEntryErrOk);
 309                         }
 310                 case TIFF_SHORT:
 311                         TIFFReadDirEntryCheckedShort(tif,direntry,value);
 312                         return(TIFFReadDirEntryErrOk);
 313                 case TIFF_SSHORT:
 314                         {
 315                                 int16 m;
 316                                 TIFFReadDirEntryCheckedSshort(tif,direntry,&m);
 317                                 err=TIFFReadDirEntryCheckRangeShortSshort(m);
 318                                 if (err!=TIFFReadDirEntryErrOk)
 319                                         return(err);
 320                                 *value=(uint16)m;
 321                                 return(TIFFReadDirEntryErrOk);
 322                         }
 323                 case TIFF_LONG:
 324                         {
 325                                 uint32 m;
 326                                 TIFFReadDirEntryCheckedLong(tif,direntry,&m);
 327                                 err=TIFFReadDirEntryCheckRangeShortLong(m);
 328                                 if (err!=TIFFReadDirEntryErrOk)
 329                                         return(err);
 330                                 *value=(uint16)m;
 331                                 return(TIFFReadDirEntryErrOk);
 332                         }
 333                 case TIFF_SLONG:
 334                         {
 335                                 int32 m;
 336                                 TIFFReadDirEntryCheckedSlong(tif,direntry,&m);
 337                                 err=TIFFReadDirEntryCheckRangeShortSlong(m);
 338                                 if (err!=TIFFReadDirEntryErrOk)
 339                                         return(err);
 340                                 *value=(uint16)m;
 341                                 return(TIFFReadDirEntryErrOk);
 342                         }
 343                 case TIFF_LONG8:
 344                         {
 345                                 uint64 m;
 346                                 err=TIFFReadDirEntryCheckedLong8(tif,direntry,&m);
 347                                 if (err!=TIFFReadDirEntryErrOk)
 348                                         return(err);
 349                                 err=TIFFReadDirEntryCheckRangeShortLong8(m);
 350                                 if (err!=TIFFReadDirEntryErrOk)
 351                                         return(err);
 352                                 *value=(uint16)m;
 353                                 return(TIFFReadDirEntryErrOk);
 354                         }
 355                 case TIFF_SLONG8:
 356                         {
 357                                 int64 m;
 358                                 err=TIFFReadDirEntryCheckedSlong8(tif,direntry,&m);
 359                                 if (err!=TIFFReadDirEntryErrOk)
 360                                         return(err);
 361                                 err=TIFFReadDirEntryCheckRangeShortSlong8(m);
 362                                 if (err!=TIFFReadDirEntryErrOk)
 363                                         return(err);
 364                                 *value=(uint16)m;
 365                                 return(TIFFReadDirEntryErrOk);
 366                         }
 367                 default:
 368                         return(TIFFReadDirEntryErrType);
 369         }
 370 }
 371
 372 static enum TIFFReadDirEntryErr TIFFReadDirEntryLong(TIFF* tif, TIFFDirEntry* direntry, uint32* value)
 373 {
 374         enum TIFFReadDirEntryErr err;
 375         if (direntry->tdir_count!=1)
 376                 return(TIFFReadDirEntryErrCount);
 377         switch (direntry->tdir_type)
 378         {
 379                 case TIFF_BYTE:
 380                         {
 381                                 uint8 m;
 382                                 TIFFReadDirEntryCheckedByte(tif,direntry,&m);
 383                                 *value=(uint32)m;
 384                                 return(TIFFReadDirEntryErrOk);
 385                         }
 386                 case TIFF_SBYTE:
 387                         {
 388                                 int8 m;
 389                                 TIFFReadDirEntryCheckedSbyte(tif,direntry,&m);
 390                                 err=TIFFReadDirEntryCheckRangeLongSbyte(m);
 391                                 if (err!=TIFFReadDirEntryErrOk)
 392                                         return(err);
 393                                 *value=(uint32)m;
 394                                 return(TIFFReadDirEntryErrOk);
 395                         }
 396                 case TIFF_SHORT:
 397                         {
 398                                 uint16 m;
 399                                 TIFFReadDirEntryCheckedShort(tif,direntry,&m);
 400                                 *value=(uint32)m;
 401                                 return(TIFFReadDirEntryErrOk);
 402                         }
 403                 case TIFF_SSHORT:
 404                         {
 405                                 int16 m;
 406                                 TIFFReadDirEntryCheckedSshort(tif,direntry,&m);
 407                                 err=TIFFReadDirEntryCheckRangeLongSshort(m);
 408                                 if (err!=TIFFReadDirEntryErrOk)
 409                                         return(err);
 410                                 *value=(uint32)m;
 411                                 return(TIFFReadDirEntryErrOk);
 412                         }
 413                 case TIFF_LONG:
 414                         TIFFReadDirEntryCheckedLong(tif,direntry,value);
 415                         return(TIFFReadDirEntryErrOk);
 416                 case TIFF_SLONG:
 417                         {
 418                                 int32 m;
 419                                 TIFFReadDirEntryCheckedSlong(tif,direntry,&m);
 420                                 err=TIFFReadDirEntryCheckRangeLongSlong(m);
 421                                 if (err!=TIFFReadDirEntryErrOk)
 422                                         return(err);
 423                                 *value=(uint32)m;
 424                                 return(TIFFReadDirEntryErrOk);
 425                         }
 426                 case TIFF_LONG8:
 427                         {
 428                                 uint64 m;
 429                                 err=TIFFReadDirEntryCheckedLong8(tif,direntry,&m);
 430                                 if (err!=TIFFReadDirEntryErrOk)
 431                                         return(err);
 432                                 err=TIFFReadDirEntryCheckRangeLongLong8(m);
 433                                 if (err!=TIFFReadDirEntryErrOk)
 434                                         return(err);
 435                                 *value=(uint32)m;
 436                                 return(TIFFReadDirEntryErrOk);
 437                         }
 438                 case TIFF_SLONG8:
 439                         {
 440                                 int64 m;
 441                                 err=TIFFReadDirEntryCheckedSlong8(tif,direntry,&m);
 442                                 if (err!=TIFFReadDirEntryErrOk)
 443                                         return(err);
 444                                 err=TIFFReadDirEntryCheckRangeLongSlong8(m);
 445                                 if (err!=TIFFReadDirEntryErrOk)
 446                                         return(err);
 447                                 *value=(uint32)m;
 448                                 return(TIFFReadDirEntryErrOk);
 449                         }
 450                 default:
 451                         return(TIFFReadDirEntryErrType);
 452         }
 453 }
 454
 455 static enum TIFFReadDirEntryErr TIFFReadDirEntryLong8(TIFF* tif, TIFFDirEntry* direntry, uint64* value)
 456 {
 457         enum TIFFReadDirEntryErr err;
 458         if (direntry->tdir_count!=1)
 459                 return(TIFFReadDirEntryErrCount);
 460         switch (direntry->tdir_type)
 461         {
 462                 case TIFF_BYTE:
 463                         {
 464                                 uint8 m;
 465                                 TIFFReadDirEntryCheckedByte(tif,direntry,&m);
 466                                 *value=(uint64)m;
 467                                 return(TIFFReadDirEntryErrOk);
 468                         }
 469                 case TIFF_SBYTE:
 470                         {
 471                                 int8 m;
 472                                 TIFFReadDirEntryCheckedSbyte(tif,direntry,&m);
 473                                 err=TIFFReadDirEntryCheckRangeLong8Sbyte(m);
 474                                 if (err!=TIFFReadDirEntryErrOk)
 475                                         return(err);
 476                                 *value=(uint64)m;
 477                                 return(TIFFReadDirEntryErrOk);
 478                         }
 479                 case TIFF_SHORT:
 480                         {
 481                                 uint16 m;
 482                                 TIFFReadDirEntryCheckedShort(tif,direntry,&m);
 483                                 *value=(uint64)m;
 484                                 return(TIFFReadDirEntryErrOk);
 485                         }
 486                 case TIFF_SSHORT:
 487                         {
 488                                 int16 m;
 489                                 TIFFReadDirEntryCheckedSshort(tif,direntry,&m);
 490                                 err=TIFFReadDirEntryCheckRangeLong8Sshort(m);
 491                                 if (err!=TIFFReadDirEntryErrOk)
 492                                         return(err);
 493                                 *value=(uint64)m;
 494                                 return(TIFFReadDirEntryErrOk);
 495                         }
 496                 case TIFF_LONG:
 497                         {
 498                                 uint32 m;
 499                                 TIFFReadDirEntryCheckedLong(tif,direntry,&m);
 500                                 *value=(uint64)m;
 501                                 return(TIFFReadDirEntryErrOk);
 502                         }
 503                 case TIFF_SLONG:
 504                         {
 505                                 int32 m;
 506                                 TIFFReadDirEntryCheckedSlong(tif,direntry,&m);
 507                                 err=TIFFReadDirEntryCheckRangeLong8Slong(m);
 508                                 if (err!=TIFFReadDirEntryErrOk)
 509                                         return(err);
 510                                 *value=(uint64)m;
 511                                 return(TIFFReadDirEntryErrOk);
 512                         }
 513                 case TIFF_LONG8:
 514                         err=TIFFReadDirEntryCheckedLong8(tif,direntry,value);
 515                         return(err);
 516                 case TIFF_SLONG8:
 517                         {
 518                                 int64 m;
 519                                 err=TIFFReadDirEntryCheckedSlong8(tif,direntry,&m);
 520                                 if (err!=TIFFReadDirEntryErrOk)
 521                                         return(err);
 522                                 err=TIFFReadDirEntryCheckRangeLong8Slong8(m);
 523                                 if (err!=TIFFReadDirEntryErrOk)
 524                                         return(err);
 525                                 *value=(uint64)m;
 526                                 return(TIFFReadDirEntryErrOk);
 527                         }
 528                 default:
 529                         return(TIFFReadDirEntryErrType);
 530         }
 531 }
 532
 533 static enum TIFFReadDirEntryErr TIFFReadDirEntryFloat(TIFF* tif, TIFFDirEntry* direntry, float* value)
 534 {
 535         enum TIFFReadDirEntryErr err;
 536         if (direntry->tdir_count!=1)
 537                 return(TIFFReadDirEntryErrCount);
 538         switch (direntry->tdir_type)
 539         {
 540                 case TIFF_BYTE:
 541                         {
 542                                 uint8 m;
 543                                 TIFFReadDirEntryCheckedByte(tif,direntry,&m);
 544                                 *value=(float)m;
 545                                 return(TIFFReadDirEntryErrOk);
 546                         }
 547                 case TIFF_SBYTE:
 548                         {
 549                                 int8 m;
 550                                 TIFFReadDirEntryCheckedSbyte(tif,direntry,&m);
 551                                 *value=(float)m;
 552                                 return(TIFFReadDirEntryErrOk);
 553                         }
 554                 case TIFF_SHORT:
 555                         {
 556                                 uint16 m;
 557                                 TIFFReadDirEntryCheckedShort(tif,direntry,&m);
 558                                 *value=(float)m;
 559                                 return(TIFFReadDirEntryErrOk);
 560                         }
 561                 case TIFF_SSHORT:
 562                         {
 563                                 int16 m;
 564                                 TIFFReadDirEntryCheckedSshort(tif,direntry,&m);
 565                                 *value=(float)m;
 566                                 return(TIFFReadDirEntryErrOk);
 567                         }
 568                 case TIFF_LONG:
 569                         {
 570                                 uint32 m;
 571                                 TIFFReadDirEntryCheckedLong(tif,direntry,&m);
 572                                 *value=(float)m;
 573                                 return(TIFFReadDirEntryErrOk);
 574                         }
 575                 case TIFF_SLONG:
 576                         {
 577                                 int32 m;
 578                                 TIFFReadDirEntryCheckedSlong(tif,direntry,&m);
 579                                 *value=(float)m;
 580                                 return(TIFFReadDirEntryErrOk);
 581                         }
 582                 case TIFF_LONG8:
 583                         {
 584                                 uint64 m;
 585                                 err=TIFFReadDirEntryCheckedLong8(tif,direntry,&m);
 586                                 if (err!=TIFFReadDirEntryErrOk)
 587                                         return(err);
 588 #if defined(__WIN32__) && (_MSC_VER < 1500)
 589                                 /*
 590                                  * XXX: MSVC 6.0 does not support conversion
 591                                  * of 64-bit integers into floating point
 592                                  * values.
 593                                  */
 594                                 *value = _TIFFUInt64ToFloat(m);
 595 #else
 596                                 *value=(float)m;
 597 #endif
 598                                 return(TIFFReadDirEntryErrOk);
 599                         }
 600                 case TIFF_SLONG8:
 601                         {
 602                                 int64 m;
 603                                 err=TIFFReadDirEntryCheckedSlong8(tif,direntry,&m);
 604                                 if (err!=TIFFReadDirEntryErrOk)
 605                                         return(err);
 606                                 *value=(float)m;
 607                                 return(TIFFReadDirEntryErrOk);
 608                         }
 609                 case TIFF_RATIONAL:
 610                         {
 611                                 double m;
 612                                 err=TIFFReadDirEntryCheckedRational(tif,direntry,&m);
 613                                 if (err!=TIFFReadDirEntryErrOk)
 614                                         return(err);
 615                                 *value=(float)m;
 616                                 return(TIFFReadDirEntryErrOk);
 617                         }
 618                 case TIFF_SRATIONAL:
 619                         {
 620                                 double m;
 621                                 err=TIFFReadDirEntryCheckedSrational(tif,direntry,&m);
 622                                 if (err!=TIFFReadDirEntryErrOk)
 623                                         return(err);
 624                                 *value=(float)m;
 625                                 return(TIFFReadDirEntryErrOk);
 626                         }
 627                 case TIFF_FLOAT:
 628                         TIFFReadDirEntryCheckedFloat(tif,direntry,value);
 629                         return(TIFFReadDirEntryErrOk);
 630                 case TIFF_DOUBLE:
 631                         {
 632                                 double m;
 633                                 err=TIFFReadDirEntryCheckedDouble(tif,direntry,&m);
 634                                 if (err!=TIFFReadDirEntryErrOk)
 635                                         return(err);
 636                                 *value=(float)m;
 637                                 return(TIFFReadDirEntryErrOk);
 638                         }
 639                 default:
 640                         return(TIFFReadDirEntryErrType);
 641         }
 642 }
 643
 644 static enum TIFFReadDirEntryErr TIFFReadDirEntryDouble(TIFF* tif, TIFFDirEntry* direntry, double* value)
 645 {
 646         enum TIFFReadDirEntryErr err;
 647         if (direntry->tdir_count!=1)
 648                 return(TIFFReadDirEntryErrCount);
 649         switch (direntry->tdir_type)
 650         {
 651                 case TIFF_BYTE:
 652                         {
 653                                 uint8 m;
 654                                 TIFFReadDirEntryCheckedByte(tif,direntry,&m);
 655                                 *value=(double)m;
 656                                 return(TIFFReadDirEntryErrOk);
 657                         }
 658                 case TIFF_SBYTE:
 659                         {
 660                                 int8 m;
 661                                 TIFFReadDirEntryCheckedSbyte(tif,direntry,&m);
 662                                 *value=(double)m;
 663                                 return(TIFFReadDirEntryErrOk);
 664                         }
 665                 case TIFF_SHORT:
 666                         {
 667                                 uint16 m;
 668                                 TIFFReadDirEntryCheckedShort(tif,direntry,&m);
 669                                 *value=(double)m;
 670                                 return(TIFFReadDirEntryErrOk);
 671                         }
 672                 case TIFF_SSHORT:
 673                         {
 674                                 int16 m;
 675                                 TIFFReadDirEntryCheckedSshort(tif,direntry,&m);
 676                                 *value=(double)m;
 677                                 return(TIFFReadDirEntryErrOk);
 678                         }
 679                 case TIFF_LONG:
 680                         {
 681                                 uint32 m;
 682                                 TIFFReadDirEntryCheckedLong(tif,direntry,&m);
 683                                 *value=(double)m;
 684                                 return(TIFFReadDirEntryErrOk);
 685                         }
 686                 case TIFF_SLONG:
 687                         {
 688                                 int32 m;
 689                                 TIFFReadDirEntryCheckedSlong(tif,direntry,&m);
 690                                 *value=(double)m;
 691                                 return(TIFFReadDirEntryErrOk);
 692                         }
 693                 case TIFF_LONG8:
 694                         {
 695                                 uint64 m;
 696                                 err=TIFFReadDirEntryCheckedLong8(tif,direntry,&m);
 697                                 if (err!=TIFFReadDirEntryErrOk)
 698                                         return(err);
 699 #if defined(__WIN32__) && (_MSC_VER < 1500)
 700                                 /*
 701                                  * XXX: MSVC 6.0 does not support conversion
 702                                  * of 64-bit integers into floating point
 703                                  * values.
 704                                  */
 705                                 *value = _TIFFUInt64ToDouble(m);
 706 #else
 707                                 *value = (double)m;
 708 #endif
 709                                 return(TIFFReadDirEntryErrOk);
 710                         }
 711                 case TIFF_SLONG8:
 712                         {
 713                                 int64 m;
 714                                 err=TIFFReadDirEntryCheckedSlong8(tif,direntry,&m);
 715                                 if (err!=TIFFReadDirEntryErrOk)
 716                                         return(err);
 717                                 *value=(double)m;
 718                                 return(TIFFReadDirEntryErrOk);
 719                         }
 720                 case TIFF_RATIONAL:
 721                         err=TIFFReadDirEntryCheckedRational(tif,direntry,value);
 722                         return(err);
 723                 case TIFF_SRATIONAL:
 724                         err=TIFFReadDirEntryCheckedSrational(tif,direntry,value);
 725                         return(err);
 726                 case TIFF_FLOAT:
 727                         {
 728                                 float m;
 729                                 TIFFReadDirEntryCheckedFloat(tif,direntry,&m);
 730                                 *value=(double)m;
 731                                 return(TIFFReadDirEntryErrOk);
 732                         }
 733                 case TIFF_DOUBLE:
 734                         err=TIFFReadDirEntryCheckedDouble(tif,direntry,value);
 735                         return(err);
 736                 default:
 737                         return(TIFFReadDirEntryErrType);
 738         }
 739 }
 740
 741 static enum TIFFReadDirEntryErr TIFFReadDirEntryIfd8(TIFF* tif, TIFFDirEntry* direntry, uint64* value)
 742 {
 743         enum TIFFReadDirEntryErr err;
 744         if (direntry->tdir_count!=1)
 745                 return(TIFFReadDirEntryErrCount);
 746         switch (direntry->tdir_type)
 747         {
 748                 case TIFF_LONG:
 749                 case TIFF_IFD:
 750                         {
 751                                 uint32 m;
 752                                 TIFFReadDirEntryCheckedLong(tif,direntry,&m);
 753                                 *value=(uint64)m;
 754                                 return(TIFFReadDirEntryErrOk);
 755                         }
 756                 case TIFF_LONG8:
 757                 case TIFF_IFD8:
 758                         err=TIFFReadDirEntryCheckedLong8(tif,direntry,value);
 759                         return(err);
 760                 default:
 761                         return(TIFFReadDirEntryErrType);
 762         }
 763 }
 764
 765 static enum TIFFReadDirEntryErr TIFFReadDirEntryArray(TIFF* tif, TIFFDirEntry* direntry, uint32* count, uint32 desttypesize, void** value)
 766 {
 767         int typesize;
 768         uint32 datasize;
 769         void* data;
 770         typesize=TIFFDataWidth(direntry->tdir_type);
 771         if ((direntry->tdir_count==0)||(typesize==0))
 772         {
 773                 *value=0;
 774                 return(TIFFReadDirEntryErrOk);
 775         }
 776         (void) desttypesize;
 777
 778         /*
 779          * As a sanity check, make sure we have no more than a 2GB tag array
 780          * in either the current data type or the dest data type.  This also
 781          * avoids problems with overflow of tmsize_t on 32bit systems.
 782          */
 783         if ((uint64)(2147483647/typesize)<direntry->tdir_count)
 784                 return(TIFFReadDirEntryErrSizesan);
 785         if ((uint64)(2147483647/desttypesize)<direntry->tdir_count)
 786                 return(TIFFReadDirEntryErrSizesan);
 787
 788         *count=(uint32)direntry->tdir_count;
 789         datasize=(*count)*typesize;
 790         assert((tmsize_t)datasize>0);
 791         data=_TIFFCheckMalloc(tif, *count, typesize, "ReadDirEntryArray");
 792         if (data==0)
 793                 return(TIFFReadDirEntryErrAlloc);
 794         if (!(tif->tif_flags&TIFF_BIGTIFF))
 795         {
 796                 if (datasize<=4)
 797                         _TIFFmemcpy(data,&direntry->tdir_offset,datasize);
 798                 else
 799                 {
 800                         enum TIFFReadDirEntryErr err;
 801                         uint32 offset = direntry->tdir_offset.toff_long;
 802                         if (tif->tif_flags&TIFF_SWAB)
 803                                 TIFFSwabLong(&offset);
 804                         err=TIFFReadDirEntryData(tif,(uint64)offset,(tmsize_t)datasize,data);
 805                         if (err!=TIFFReadDirEntryErrOk)
 806                         {
 807                                 _TIFFfree(data);
 808                                 return(err);
 809                         }
 810                 }
 811         }
 812         else
 813         {
 814                 if (datasize<=8)
 815                         _TIFFmemcpy(data,&direntry->tdir_offset,datasize);
 816                 else
 817                 {
 818                         enum TIFFReadDirEntryErr err;
 819                         uint64 offset = direntry->tdir_offset.toff_long8;
 820                         if (tif->tif_flags&TIFF_SWAB)
 821                                 TIFFSwabLong8(&offset);
 822                         err=TIFFReadDirEntryData(tif,offset,(tmsize_t)datasize,data);
 823                         if (err!=TIFFReadDirEntryErrOk)
 824                         {
 825                                 _TIFFfree(data);
 826                                 return(err);
 827                         }
 828                 }
 829         }
 830         *value=data;
 831         return(TIFFReadDirEntryErrOk);
 832 }
 833
 834 static enum TIFFReadDirEntryErr TIFFReadDirEntryByteArray(TIFF* tif, TIFFDirEntry* direntry, uint8** value)
 835 {
 836         enum TIFFReadDirEntryErr err;
 837         uint32 count;
 838         void* origdata;
 839         uint8* data;
 840         switch (direntry->tdir_type)
 841         {
 842                 case TIFF_ASCII:
 843                 case TIFF_UNDEFINED:
 844                 case TIFF_BYTE:
 845                 case TIFF_SBYTE:
 846                 case TIFF_SHORT:
 847                 case TIFF_SSHORT:
 848                 case TIFF_LONG:
 849                 case TIFF_SLONG:
 850                 case TIFF_LONG8:
 851                 case TIFF_SLONG8:
 852                         break;
 853                 default:
 854                         return(TIFFReadDirEntryErrType);
 855         }
 856         err=TIFFReadDirEntryArray(tif,direntry,&count,1,&origdata);
 857         if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
 858         {
 859                 *value=0;
 860                 return(err);
 861         }
 862         switch (direntry->tdir_type)
 863         {
 864                 case TIFF_ASCII:
 865                 case TIFF_UNDEFINED:
 866                 case TIFF_BYTE:
 867                         *value=(uint8*)origdata;
 868                         return(TIFFReadDirEntryErrOk);
 869                 case TIFF_SBYTE:
 870                         {
 871                                 int8* m;
 872                                 uint32 n;
 873                                 m=(int8*)origdata;
 874                                 for (n=0; n<count; n++)
 875                                 {
 876                                         err=TIFFReadDirEntryCheckRangeByteSbyte(*m);
 877                                         if (err!=TIFFReadDirEntryErrOk)
 878                                         {
 879                                                 _TIFFfree(origdata);
 880                                                 return(err);
 881                                         }
 882                                         m++;
 883                                 }
 884                                 *value=(uint8*)origdata;
 885                                 return(TIFFReadDirEntryErrOk);
 886                         }
 887         }
 888         data=(uint8*)_TIFFmalloc(count);
 889         if (data==0)
 890         {
 891                 _TIFFfree(origdata);
 892                 return(TIFFReadDirEntryErrAlloc);
 893         }
 894         switch (direntry->tdir_type)
 895         {
 896                 case TIFF_SHORT:
 897                         {
 898                                 uint16* ma;
 899                                 uint8* mb;
 900                                 uint32 n;
 901                                 ma=(uint16*)origdata;
 902                                 mb=data;
 903                                 for (n=0; n<count; n++)
 904                                 {
 905                                         if (tif->tif_flags&TIFF_SWAB)
 906                                                 TIFFSwabShort(ma);
 907                                         err=TIFFReadDirEntryCheckRangeByteShort(*ma);
 908                                         if (err!=TIFFReadDirEntryErrOk)
 909                                                 break;
 910                                         *mb++=(uint8)(*ma++);
 911                                 }
 912                         }
 913                         break;
 914                 case TIFF_SSHORT:
 915                         {
 916                                 int16* ma;
 917                                 uint8* mb;
 918                                 uint32 n;
 919                                 ma=(int16*)origdata;
 920                                 mb=data;
 921                                 for (n=0; n<count; n++)
 922                                 {
 923                                         if (tif->tif_flags&TIFF_SWAB)
 924                                                 TIFFSwabShort((uint16*)ma);
 925                                         err=TIFFReadDirEntryCheckRangeByteSshort(*ma);
 926                                         if (err!=TIFFReadDirEntryErrOk)
 927                                                 break;
 928                                         *mb++=(uint8)(*ma++);
 929                                 }
 930                         }
 931                         break;
 932                 case TIFF_LONG:
 933                         {
 934                                 uint32* ma;
 935                                 uint8* mb;
 936                                 uint32 n;
 937                                 ma=(uint32*)origdata;
 938                                 mb=data;
 939                                 for (n=0; n<count; n++)
 940                                 {
 941                                         if (tif->tif_flags&TIFF_SWAB)
 942                                                 TIFFSwabLong(ma);
 943                                         err=TIFFReadDirEntryCheckRangeByteLong(*ma);
 944                                         if (err!=TIFFReadDirEntryErrOk)
 945                                                 break;
 946                                         *mb++=(uint8)(*ma++);
 947                                 }
 948                         }
 949                         break;
 950                 case TIFF_SLONG:
 951                         {
 952                                 int32* ma;
 953                                 uint8* mb;
 954                                 uint32 n;
 955                                 ma=(int32*)origdata;
 956                                 mb=data;
 957                                 for (n=0; n<count; n++)
 958                                 {
 959                                         if (tif->tif_flags&TIFF_SWAB)
 960                                                 TIFFSwabLong((uint32*)ma);
 961                                         err=TIFFReadDirEntryCheckRangeByteSlong(*ma);
 962                                         if (err!=TIFFReadDirEntryErrOk)
 963                                                 break;
 964                                         *mb++=(uint8)(*ma++);
 965                                 }
 966                         }
 967                         break;
 968                 case TIFF_LONG8:
 969                         {
 970                                 uint64* ma;
 971                                 uint8* mb;
 972                                 uint32 n;
 973                                 ma=(uint64*)origdata;
 974                                 mb=data;
 975                                 for (n=0; n<count; n++)
 976                                 {
 977                                         if (tif->tif_flags&TIFF_SWAB)
 978                                                 TIFFSwabLong8(ma);
 979                                         err=TIFFReadDirEntryCheckRangeByteLong8(*ma);
 980                                         if (err!=TIFFReadDirEntryErrOk)
 981                                                 break;
 982                                         *mb++=(uint8)(*ma++);
 983                                 }
 984                         }
 985                         break;
 986                 case TIFF_SLONG8:
 987                         {
 988                                 int64* ma;
 989                                 uint8* mb;
 990                                 uint32 n;
 991                                 ma=(int64*)origdata;
 992                                 mb=data;
 993                                 for (n=0; n<count; n++)
 994                                 {
 995                                         if (tif->tif_flags&TIFF_SWAB)
 996                                                 TIFFSwabLong8((uint64*)ma);
 997                                         err=TIFFReadDirEntryCheckRangeByteSlong8(*ma);
 998                                         if (err!=TIFFReadDirEntryErrOk)
 999                                                 break;
1000                                         *mb++=(uint8)(*ma++);
1001                                 }
1002                         }
1003                         break;
1004         }
1005         _TIFFfree(origdata);
1006         if (err!=TIFFReadDirEntryErrOk)
1007         {
1008                 _TIFFfree(data);
1009                 return(err);
1010         }
1011         *value=data;
1012         return(TIFFReadDirEntryErrOk);
1013 }
1014
1015 static enum TIFFReadDirEntryErr TIFFReadDirEntrySbyteArray(TIFF* tif, TIFFDirEntry* direntry, int8** value)
1016 {
1017         enum TIFFReadDirEntryErr err;
1018         uint32 count;
1019         void* origdata;
1020         int8* data;
1021         switch (direntry->tdir_type)
1022         {
1023                 case TIFF_UNDEFINED:
1024                 case TIFF_BYTE:
1025                 case TIFF_SBYTE:
1026                 case TIFF_SHORT:
1027                 case TIFF_SSHORT:
1028                 case TIFF_LONG:
1029                 case TIFF_SLONG:
1030                 case TIFF_LONG8:
1031                 case TIFF_SLONG8:
1032                         break;
1033                 default:
1034                         return(TIFFReadDirEntryErrType);
1035         }
1036         err=TIFFReadDirEntryArray(tif,direntry,&count,1,&origdata);
1037         if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
1038         {
1039                 *value=0;
1040                 return(err);
1041         }
1042         switch (direntry->tdir_type)
1043         {
1044                 case TIFF_UNDEFINED:
1045                 case TIFF_BYTE:
1046                         {
1047                                 uint8* m;
1048                                 uint32 n;
1049                                 m=(uint8*)origdata;
1050                                 for (n=0; n<count; n++)
1051                                 {
1052                                         err=TIFFReadDirEntryCheckRangeSbyteByte(*m);
1053                                         if (err!=TIFFReadDirEntryErrOk)
1054                                         {
1055                                                 _TIFFfree(origdata);
1056                                                 return(err);
1057                                         }
1058                                         m++;
1059                                 }
1060                                 *value=(int8*)origdata;
1061                                 return(TIFFReadDirEntryErrOk);
1062                         }
1063                 case TIFF_SBYTE:
1064                         *value=(int8*)origdata;
1065                         return(TIFFReadDirEntryErrOk);
1066         }
1067         data=(int8*)_TIFFmalloc(count);
1068         if (data==0)
1069         {
1070                 _TIFFfree(origdata);
1071                 return(TIFFReadDirEntryErrAlloc);
1072         }
1073         switch (direntry->tdir_type)
1074         {
1075                 case TIFF_SHORT:
1076                         {
1077                                 uint16* ma;
1078                                 int8* mb;
1079                                 uint32 n;
1080                                 ma=(uint16*)origdata;
1081                                 mb=data;
1082                                 for (n=0; n<count; n++)
1083                                 {
1084                                         if (tif->tif_flags&TIFF_SWAB)
1085                                                 TIFFSwabShort(ma);
1086                                         err=TIFFReadDirEntryCheckRangeSbyteShort(*ma);
1087                                         if (err!=TIFFReadDirEntryErrOk)
1088                                                 break;
1089                                         *mb++=(int8)(*ma++);
1090                                 }
1091                         }
1092                         break;
1093                 case TIFF_SSHORT:
1094                         {
1095                                 int16* ma;
1096                                 int8* mb;
1097                                 uint32 n;
1098                                 ma=(int16*)origdata;
1099                                 mb=data;
1100                                 for (n=0; n<count; n++)
1101                                 {
1102                                         if (tif->tif_flags&TIFF_SWAB)
1103                                                 TIFFSwabShort((uint16*)ma);
1104                                         err=TIFFReadDirEntryCheckRangeSbyteSshort(*ma);
1105                                         if (err!=TIFFReadDirEntryErrOk)
1106                                                 break;
1107                                         *mb++=(int8)(*ma++);
1108                                 }
1109                         }
1110                         break;
1111                 case TIFF_LONG:
1112                         {
1113                                 uint32* ma;
1114                                 int8* mb;
1115                                 uint32 n;
1116                                 ma=(uint32*)origdata;
1117                                 mb=data;
1118                                 for (n=0; n<count; n++)
1119                                 {
1120                                         if (tif->tif_flags&TIFF_SWAB)
1121                                                 TIFFSwabLong(ma);
1122                                         err=TIFFReadDirEntryCheckRangeSbyteLong(*ma);
1123                                         if (err!=TIFFReadDirEntryErrOk)
1124                                                 break;
1125                                         *mb++=(int8)(*ma++);
1126                                 }
1127                         }
1128                         break;
1129                 case TIFF_SLONG:
1130                         {
1131                                 int32* ma;
1132                                 int8* mb;
1133                                 uint32 n;
1134                                 ma=(int32*)origdata;
1135                                 mb=data;
1136                                 for (n=0; n<count; n++)
1137                                 {
1138                                         if (tif->tif_flags&TIFF_SWAB)
1139                                                 TIFFSwabLong((uint32*)ma);
1140                                         err=TIFFReadDirEntryCheckRangeSbyteSlong(*ma);
1141                                         if (err!=TIFFReadDirEntryErrOk)
1142                                                 break;
1143                                         *mb++=(int8)(*ma++);
1144                                 }
1145                         }
1146                         break;
1147                 case TIFF_LONG8:
1148                         {
1149                                 uint64* ma;
1150                                 int8* mb;
1151                                 uint32 n;
1152                                 ma=(uint64*)origdata;
1153                                 mb=data;
1154                                 for (n=0; n<count; n++)
1155                                 {
1156                                         if (tif->tif_flags&TIFF_SWAB)
1157                                                 TIFFSwabLong8(ma);
1158                                         err=TIFFReadDirEntryCheckRangeSbyteLong8(*ma);
1159                                         if (err!=TIFFReadDirEntryErrOk)
1160                                                 break;
1161                                         *mb++=(int8)(*ma++);
1162                                 }
1163                         }
1164                         break;
1165                 case TIFF_SLONG8:
1166                         {
1167                                 int64* ma;
1168                                 int8* mb;
1169                                 uint32 n;
1170                                 ma=(int64*)origdata;
1171                                 mb=data;
1172                                 for (n=0; n<count; n++)
1173                                 {
1174                                         if (tif->tif_flags&TIFF_SWAB)
1175                                                 TIFFSwabLong8((uint64*)ma);
1176                                         err=TIFFReadDirEntryCheckRangeSbyteSlong8(*ma);
1177                                         if (err!=TIFFReadDirEntryErrOk)
1178                                                 break;
1179                                         *mb++=(int8)(*ma++);
1180                                 }
1181                         }
1182                         break;
1183         }
1184         _TIFFfree(origdata);
1185         if (err!=TIFFReadDirEntryErrOk)
1186         {
1187                 _TIFFfree(data);
1188                 return(err);
1189         }
1190         *value=data;
1191         return(TIFFReadDirEntryErrOk);
1192 }
1193
1194 static enum TIFFReadDirEntryErr TIFFReadDirEntryShortArray(TIFF* tif, TIFFDirEntry* direntry, uint16** value)
1195 {
1196         enum TIFFReadDirEntryErr err;
1197         uint32 count;
1198         void* origdata;
1199         uint16* data;
1200         switch (direntry->tdir_type)
1201         {
1202                 case TIFF_BYTE:
1203                 case TIFF_SBYTE:
1204                 case TIFF_SHORT:
1205                 case TIFF_SSHORT:
1206                 case TIFF_LONG:
1207                 case TIFF_SLONG:
1208                 case TIFF_LONG8:
1209                 case TIFF_SLONG8:
1210                         break;
1211                 default:
1212                         return(TIFFReadDirEntryErrType);
1213         }
1214         err=TIFFReadDirEntryArray(tif,direntry,&count,2,&origdata);
1215         if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
1216         {
1217                 *value=0;
1218                 return(err);
1219         }
1220         switch (direntry->tdir_type)
1221         {
1222                 case TIFF_SHORT:
1223                         *value=(uint16*)origdata;
1224                         if (tif->tif_flags&TIFF_SWAB)
1225                                 TIFFSwabArrayOfShort(*value,count);
1226                         return(TIFFReadDirEntryErrOk);
1227                 case TIFF_SSHORT:
1228                         {
1229                                 int16* m;
1230                                 uint32 n;
1231                                 m=(int16*)origdata;
1232                                 for (n=0; n<count; n++)
1233                                 {
1234                                         if (tif->tif_flags&TIFF_SWAB)
1235                                                 TIFFSwabShort((uint16*)m);
1236                                         err=TIFFReadDirEntryCheckRangeShortSshort(*m);
1237                                         if (err!=TIFFReadDirEntryErrOk)
1238                                         {
1239                                                 _TIFFfree(origdata);
1240                                                 return(err);
1241                                         }
1242                                         m++;
1243                                 }
1244                                 *value=(uint16*)origdata;
1245                                 return(TIFFReadDirEntryErrOk);
1246                         }
1247         }
1248         data=(uint16*)_TIFFmalloc(count*2);
1249         if (data==0)
1250         {
1251                 _TIFFfree(origdata);
1252                 return(TIFFReadDirEntryErrAlloc);
1253         }
1254         switch (direntry->tdir_type)
1255         {
1256                 case TIFF_BYTE:
1257                         {
1258                                 uint8* ma;
1259                                 uint16* mb;
1260                                 uint32 n;
1261                                 ma=(uint8*)origdata;
1262                                 mb=data;
1263                                 for (n=0; n<count; n++)
1264                                         *mb++=(uint16)(*ma++);
1265                         }
1266                         break;
1267                 case TIFF_SBYTE:
1268                         {
1269                                 int8* ma;
1270                                 uint16* mb;
1271                                 uint32 n;
1272                                 ma=(int8*)origdata;
1273                                 mb=data;
1274                                 for (n=0; n<count; n++)
1275                                 {
1276                                         err=TIFFReadDirEntryCheckRangeShortSbyte(*ma);
1277                                         if (err!=TIFFReadDirEntryErrOk)
1278                                                 break;
1279                                         *mb++=(uint16)(*ma++);
1280                                 }
1281                         }
1282                         break;
1283                 case TIFF_LONG:
1284                         {
1285                                 uint32* ma;
1286                                 uint16* mb;
1287                                 uint32 n;
1288                                 ma=(uint32*)origdata;
1289                                 mb=data;
1290                                 for (n=0; n<count; n++)
1291                                 {
1292                                         if (tif->tif_flags&TIFF_SWAB)
1293                                                 TIFFSwabLong(ma);
1294                                         err=TIFFReadDirEntryCheckRangeShortLong(*ma);
1295                                         if (err!=TIFFReadDirEntryErrOk)
1296                                                 break;
1297                                         *mb++=(uint16)(*ma++);
1298                                 }
1299                         }
1300                         break;
1301                 case TIFF_SLONG:
1302                         {
1303                                 int32* ma;
1304                                 uint16* mb;
1305                                 uint32 n;
1306                                 ma=(int32*)origdata;
1307                                 mb=data;
1308                                 for (n=0; n<count; n++)
1309                                 {
1310                                         if (tif->tif_flags&TIFF_SWAB)
1311                                                 TIFFSwabLong((uint32*)ma);
1312                                         err=TIFFReadDirEntryCheckRangeShortSlong(*ma);
1313                                         if (err!=TIFFReadDirEntryErrOk)
1314                                                 break;
1315                                         *mb++=(uint16)(*ma++);
1316                                 }
1317                         }
1318                         break;
1319                 case TIFF_LONG8:
1320                         {
1321                                 uint64* ma;
1322                                 uint16* mb;
1323                                 uint32 n;
1324                                 ma=(uint64*)origdata;
1325                                 mb=data;
1326                                 for (n=0; n<count; n++)
1327                                 {
1328                                         if (tif->tif_flags&TIFF_SWAB)
1329                                                 TIFFSwabLong8(ma);
1330                                         err=TIFFReadDirEntryCheckRangeShortLong8(*ma);
1331                                         if (err!=TIFFReadDirEntryErrOk)
1332                                                 break;
1333                                         *mb++=(uint16)(*ma++);
1334                                 }
1335                         }
1336                         break;
1337                 case TIFF_SLONG8:
1338                         {
1339                                 int64* ma;
1340                                 uint16* mb;
1341                                 uint32 n;
1342                                 ma=(int64*)origdata;
1343                                 mb=data;
1344                                 for (n=0; n<count; n++)
1345                                 {
1346                                         if (tif->tif_flags&TIFF_SWAB)
1347                                                 TIFFSwabLong8((uint64*)ma);
1348                                         err=TIFFReadDirEntryCheckRangeShortSlong8(*ma);
1349                                         if (err!=TIFFReadDirEntryErrOk)
1350                                                 break;
1351                                         *mb++=(uint16)(*ma++);
1352                                 }
1353                         }
1354                         break;
1355         }
1356         _TIFFfree(origdata);
1357         if (err!=TIFFReadDirEntryErrOk)
1358         {
1359                 _TIFFfree(data);
1360                 return(err);
1361         }
1362         *value=data;
1363         return(TIFFReadDirEntryErrOk);
1364 }
1365
1366 static enum TIFFReadDirEntryErr TIFFReadDirEntrySshortArray(TIFF* tif, TIFFDirEntry* direntry, int16** value)
1367 {
1368         enum TIFFReadDirEntryErr err;
1369         uint32 count;
1370         void* origdata;
1371         int16* data;
1372         switch (direntry->tdir_type)
1373         {
1374                 case TIFF_BYTE:
1375                 case TIFF_SBYTE:
1376                 case TIFF_SHORT:
1377                 case TIFF_SSHORT:
1378                 case TIFF_LONG:
1379                 case TIFF_SLONG:
1380                 case TIFF_LONG8:
1381                 case TIFF_SLONG8:
1382                         break;
1383                 default:
1384                         return(TIFFReadDirEntryErrType);
1385         }
1386         err=TIFFReadDirEntryArray(tif,direntry,&count,2,&origdata);
1387         if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
1388         {
1389                 *value=0;
1390                 return(err);
1391         }
1392         switch (direntry->tdir_type)
1393         {
1394                 case TIFF_SHORT:
1395                         {
1396                                 uint16* m;
1397                                 uint32 n;
1398                                 m=(uint16*)origdata;
1399                                 for (n=0; n<count; n++)
1400                                 {
1401                                         if (tif->tif_flags&TIFF_SWAB)
1402                                                 TIFFSwabShort(m);
1403                                         err=TIFFReadDirEntryCheckRangeSshortShort(*m);
1404                                         if (err!=TIFFReadDirEntryErrOk)
1405                                         {
1406                                                 _TIFFfree(origdata);
1407                                                 return(err);
1408                                         }
1409                                         m++;
1410                                 }
1411                                 *value=(int16*)origdata;
1412                                 return(TIFFReadDirEntryErrOk);
1413                         }
1414                 case TIFF_SSHORT:
1415                         *value=(int16*)origdata;
1416                         if (tif->tif_flags&TIFF_SWAB)
1417                                 TIFFSwabArrayOfShort((uint16*)(*value),count);
1418                         return(TIFFReadDirEntryErrOk);
1419         }
1420         data=(int16*)_TIFFmalloc(count*2);
1421         if (data==0)
1422         {
1423                 _TIFFfree(origdata);
1424                 return(TIFFReadDirEntryErrAlloc);
1425         }
1426         switch (direntry->tdir_type)
1427         {
1428                 case TIFF_BYTE:
1429                         {
1430                                 uint8* ma;
1431                                 int16* mb;
1432                                 uint32 n;
1433                                 ma=(uint8*)origdata;
1434                                 mb=data;
1435                                 for (n=0; n<count; n++)
1436                                         *mb++=(int16)(*ma++);
1437                         }
1438                         break;
1439                 case TIFF_SBYTE:
1440                         {
1441                                 int8* ma;
1442                                 int16* mb;
1443                                 uint32 n;
1444                                 ma=(int8*)origdata;
1445                                 mb=data;
1446                                 for (n=0; n<count; n++)
1447                                         *mb++=(int16)(*ma++);
1448                         }
1449                         break;
1450                 case TIFF_LONG:
1451                         {
1452                                 uint32* ma;
1453                                 int16* mb;
1454                                 uint32 n;
1455                                 ma=(uint32*)origdata;
1456                                 mb=data;
1457                                 for (n=0; n<count; n++)
1458                                 {
1459                                         if (tif->tif_flags&TIFF_SWAB)
1460                                                 TIFFSwabLong(ma);
1461                                         err=TIFFReadDirEntryCheckRangeSshortLong(*ma);
1462                                         if (err!=TIFFReadDirEntryErrOk)
1463                                                 break;
1464                                         *mb++=(int16)(*ma++);
1465                                 }
1466                         }
1467                         break;
1468                 case TIFF_SLONG:
1469                         {
1470                                 int32* ma;
1471                                 int16* mb;
1472                                 uint32 n;
1473                                 ma=(int32*)origdata;
1474                                 mb=data;
1475                                 for (n=0; n<count; n++)
1476                                 {
1477                                         if (tif->tif_flags&TIFF_SWAB)
1478                                                 TIFFSwabLong((uint32*)ma);
1479                                         err=TIFFReadDirEntryCheckRangeSshortSlong(*ma);
1480                                         if (err!=TIFFReadDirEntryErrOk)
1481                                                 break;
1482                                         *mb++=(int16)(*ma++);
1483                                 }
1484                         }
1485                         break;
1486                 case TIFF_LONG8:
1487                         {
1488                                 uint64* ma;
1489                                 int16* mb;
1490                                 uint32 n;
1491                                 ma=(uint64*)origdata;
1492                                 mb=data;
1493                                 for (n=0; n<count; n++)
1494                                 {
1495                                         if (tif->tif_flags&TIFF_SWAB)
1496                                                 TIFFSwabLong8(ma);
1497                                         err=TIFFReadDirEntryCheckRangeSshortLong8(*ma);
1498                                         if (err!=TIFFReadDirEntryErrOk)
1499                                                 break;
1500                                         *mb++=(int16)(*ma++);
1501                                 }
1502                         }
1503                         break;
1504                 case TIFF_SLONG8:
1505                         {
1506                                 int64* ma;
1507                                 int16* mb;
1508                                 uint32 n;
1509                                 ma=(int64*)origdata;
1510                                 mb=data;
1511                                 for (n=0; n<count; n++)
1512                                 {
1513                                         if (tif->tif_flags&TIFF_SWAB)
1514                                                 TIFFSwabLong8((uint64*)ma);
1515                                         err=TIFFReadDirEntryCheckRangeSshortSlong8(*ma);
1516                                         if (err!=TIFFReadDirEntryErrOk)
1517                                                 break;
1518                                         *mb++=(int16)(*ma++);
1519                                 }
1520                         }
1521                         break;
1522         }
1523         _TIFFfree(origdata);
1524         if (err!=TIFFReadDirEntryErrOk)
1525         {
1526                 _TIFFfree(data);
1527                 return(err);
1528         }
1529         *value=data;
1530         return(TIFFReadDirEntryErrOk);
1531 }
1532
1533 static enum TIFFReadDirEntryErr TIFFReadDirEntryLongArray(TIFF* tif, TIFFDirEntry* direntry, uint32** value)
1534 {
1535         enum TIFFReadDirEntryErr err;
1536         uint32 count;
1537         void* origdata;
1538         uint32* data;
1539         switch (direntry->tdir_type)
1540         {
1541                 case TIFF_BYTE:
1542                 case TIFF_SBYTE:
1543                 case TIFF_SHORT:
1544                 case TIFF_SSHORT:
1545                 case TIFF_LONG:
1546                 case TIFF_SLONG:
1547                 case TIFF_LONG8:
1548                 case TIFF_SLONG8:
1549                         break;
1550                 default:
1551                         return(TIFFReadDirEntryErrType);
1552         }
1553         err=TIFFReadDirEntryArray(tif,direntry,&count,4,&origdata);
1554         if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
1555         {
1556                 *value=0;
1557                 return(err);
1558         }
1559         switch (direntry->tdir_type)
1560         {
1561                 case TIFF_LONG:
1562                         *value=(uint32*)origdata;
1563                         if (tif->tif_flags&TIFF_SWAB)
1564                                 TIFFSwabArrayOfLong(*value,count);
1565                         return(TIFFReadDirEntryErrOk);
1566                 case TIFF_SLONG:
1567                         {
1568                                 int32* m;
1569                                 uint32 n;
1570                                 m=(int32*)origdata;
1571                                 for (n=0; n<count; n++)
1572                                 {
1573                                         if (tif->tif_flags&TIFF_SWAB)
1574                                                 TIFFSwabLong((uint32*)m);
1575                                         err=TIFFReadDirEntryCheckRangeLongSlong(*m);
1576                                         if (err!=TIFFReadDirEntryErrOk)
1577                                         {
1578                                                 _TIFFfree(origdata);
1579                                                 return(err);
1580                                         }
1581                                         m++;
1582                                 }
1583                                 *value=(uint32*)origdata;
1584                                 return(TIFFReadDirEntryErrOk);
1585                         }
1586         }
1587         data=(uint32*)_TIFFmalloc(count*4);
1588         if (data==0)
1589         {
1590                 _TIFFfree(origdata);
1591                 return(TIFFReadDirEntryErrAlloc);
1592         }
1593         switch (direntry->tdir_type)
1594         {
1595                 case TIFF_BYTE:
1596                         {
1597                                 uint8* ma;
1598                                 uint32* mb;
1599                                 uint32 n;
1600                                 ma=(uint8*)origdata;
1601                                 mb=data;
1602                                 for (n=0; n<count; n++)
1603                                         *mb++=(uint32)(*ma++);
1604                         }
1605                         break;
1606                 case TIFF_SBYTE:
1607                         {
1608                                 int8* ma;
1609                                 uint32* mb;
1610                                 uint32 n;
1611                                 ma=(int8*)origdata;
1612                                 mb=data;
1613                                 for (n=0; n<count; n++)
1614                                 {
1615                                         err=TIFFReadDirEntryCheckRangeLongSbyte(*ma);
1616                                         if (err!=TIFFReadDirEntryErrOk)
1617                                                 break;
1618                                         *mb++=(uint32)(*ma++);
1619                                 }
1620                         }
1621                         break;
1622                 case TIFF_SHORT:
1623                         {
1624                                 uint16* ma;
1625                                 uint32* mb;
1626                                 uint32 n;
1627                                 ma=(uint16*)origdata;
1628                                 mb=data;
1629                                 for (n=0; n<count; n++)
1630                                 {
1631                                         if (tif->tif_flags&TIFF_SWAB)
1632                                                 TIFFSwabShort(ma);
1633                                         *mb++=(uint32)(*ma++);
1634                                 }
1635                         }
1636                         break;
1637                 case TIFF_SSHORT:
1638                         {
1639                                 int16* ma;
1640                                 uint32* mb;
1641                                 uint32 n;
1642                                 ma=(int16*)origdata;
1643                                 mb=data;
1644                                 for (n=0; n<count; n++)
1645                                 {
1646                                         if (tif->tif_flags&TIFF_SWAB)
1647                                                 TIFFSwabShort((uint16*)ma);
1648                                         err=TIFFReadDirEntryCheckRangeLongSshort(*ma);
1649                                         if (err!=TIFFReadDirEntryErrOk)
1650                                                 break;
1651                                         *mb++=(uint32)(*ma++);
1652                                 }
1653                         }
1654                         break;
1655                 case TIFF_LONG8:
1656                         {
1657                                 uint64* ma;
1658                                 uint32* mb;
1659                                 uint32 n;
1660                                 ma=(uint64*)origdata;
1661                                 mb=data;
1662                                 for (n=0; n<count; n++)
1663                                 {
1664                                         if (tif->tif_flags&TIFF_SWAB)
1665                                                 TIFFSwabLong8(ma);
1666                                         err=TIFFReadDirEntryCheckRangeLongLong8(*ma);
1667                                         if (err!=TIFFReadDirEntryErrOk)
1668                                                 break;
1669                                         *mb++=(uint32)(*ma++);
1670                                 }
1671                         }
1672                         break;
1673                 case TIFF_SLONG8:
1674                         {
1675                                 int64* ma;
1676                                 uint32* mb;
1677                                 uint32 n;
1678                                 ma=(int64*)origdata;
1679                                 mb=data;
1680                                 for (n=0; n<count; n++)
1681                                 {
1682                                         if (tif->tif_flags&TIFF_SWAB)
1683                                                 TIFFSwabLong8((uint64*)ma);
1684                                         err=TIFFReadDirEntryCheckRangeLongSlong8(*ma);
1685                                         if (err!=TIFFReadDirEntryErrOk)
1686                                                 break;
1687                                         *mb++=(uint32)(*ma++);
1688                                 }
1689                         }
1690                         break;
1691         }
1692         _TIFFfree(origdata);
1693         if (err!=TIFFReadDirEntryErrOk)
1694         {
1695                 _TIFFfree(data);
1696                 return(err);
1697         }
1698         *value=data;
1699         return(TIFFReadDirEntryErrOk);
1700 }
1701
1702 static enum TIFFReadDirEntryErr TIFFReadDirEntrySlongArray(TIFF* tif, TIFFDirEntry* direntry, int32** value)
1703 {
1704         enum TIFFReadDirEntryErr err;
1705         uint32 count;
1706         void* origdata;
1707         int32* data;
1708         switch (direntry->tdir_type)
1709         {
1710                 case TIFF_BYTE:
1711                 case TIFF_SBYTE:
1712                 case TIFF_SHORT:
1713                 case TIFF_SSHORT:
1714                 case TIFF_LONG:
1715                 case TIFF_SLONG:
1716                 case TIFF_LONG8:
1717                 case TIFF_SLONG8:
1718                         break;
1719                 default:
1720                         return(TIFFReadDirEntryErrType);
1721         }
1722         err=TIFFReadDirEntryArray(tif,direntry,&count,4,&origdata);
1723         if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
1724         {
1725                 *value=0;
1726                 return(err);
1727         }
1728         switch (direntry->tdir_type)
1729         {
1730                 case TIFF_LONG:
1731                         {
1732                                 uint32* m;
1733                                 uint32 n;
1734                                 m=(uint32*)origdata;
1735                                 for (n=0; n<count; n++)
1736                                 {
1737                                         if (tif->tif_flags&TIFF_SWAB)
1738                                                 TIFFSwabLong((uint32*)m);
1739                                         err=TIFFReadDirEntryCheckRangeSlongLong(*m);
1740                                         if (err!=TIFFReadDirEntryErrOk)
1741                                         {
1742                                                 _TIFFfree(origdata);
1743                                                 return(err);
1744                                         }
1745                                         m++;
1746                                 }
1747                                 *value=(int32*)origdata;
1748                                 return(TIFFReadDirEntryErrOk);
1749                         }
1750                 case TIFF_SLONG:
1751                         *value=(int32*)origdata;
1752                         if (tif->tif_flags&TIFF_SWAB)
1753                                 TIFFSwabArrayOfLong((uint32*)(*value),count);
1754                         return(TIFFReadDirEntryErrOk);
1755         }
1756         data=(int32*)_TIFFmalloc(count*4);
1757         if (data==0)
1758         {
1759                 _TIFFfree(origdata);
1760                 return(TIFFReadDirEntryErrAlloc);
1761         }
1762         switch (direntry->tdir_type)
1763         {
1764                 case TIFF_BYTE:
1765                         {
1766                                 uint8* ma;
1767                                 int32* mb;
1768                                 uint32 n;
1769                                 ma=(uint8*)origdata;
1770                                 mb=data;
1771                                 for (n=0; n<count; n++)
1772                                         *mb++=(int32)(*ma++);
1773                         }
1774                         break;
1775                 case TIFF_SBYTE:
1776                         {
1777                                 int8* ma;
1778                                 int32* mb;
1779                                 uint32 n;
1780                                 ma=(int8*)origdata;
1781                                 mb=data;
1782                                 for (n=0; n<count; n++)
1783                                         *mb++=(int32)(*ma++);
1784                         }
1785                         break;
1786                 case TIFF_SHORT:
1787                         {
1788                                 uint16* ma;
1789                                 int32* mb;
1790                                 uint32 n;
1791                                 ma=(uint16*)origdata;
1792                                 mb=data;
1793                                 for (n=0; n<count; n++)
1794                                 {
1795                                         if (tif->tif_flags&TIFF_SWAB)
1796                                                 TIFFSwabShort(ma);
1797                                         *mb++=(int32)(*ma++);
1798                                 }
1799                         }
1800                         break;
1801                 case TIFF_SSHORT:
1802                         {
1803                                 int16* ma;
1804                                 int32* mb;
1805                                 uint32 n;
1806                                 ma=(int16*)origdata;
1807                                 mb=data;
1808                                 for (n=0; n<count; n++)
1809                                 {
1810                                         if (tif->tif_flags&TIFF_SWAB)
1811                                                 TIFFSwabShort((uint16*)ma);
1812                                         *mb++=(int32)(*ma++);
1813                                 }
1814                         }
1815                         break;
1816                 case TIFF_LONG8:
1817                         {
1818                                 uint64* ma;
1819                                 int32* mb;
1820                                 uint32 n;
1821                                 ma=(uint64*)origdata;
1822                                 mb=data;
1823                                 for (n=0; n<count; n++)
1824                                 {
1825                                         if (tif->tif_flags&TIFF_SWAB)
1826                                                 TIFFSwabLong8(ma);
1827                                         err=TIFFReadDirEntryCheckRangeSlongLong8(*ma);
1828                                         if (err!=TIFFReadDirEntryErrOk)
1829                                                 break;
1830                                         *mb++=(int32)(*ma++);
1831                                 }
1832                         }
1833                         break;
1834                 case TIFF_SLONG8:
1835                         {
1836                                 int64* ma;
1837                                 int32* mb;
1838                                 uint32 n;
1839                                 ma=(int64*)origdata;
1840                                 mb=data;
1841                                 for (n=0; n<count; n++)
1842                                 {
1843                                         if (tif->tif_flags&TIFF_SWAB)
1844                                                 TIFFSwabLong8((uint64*)ma);
1845                                         err=TIFFReadDirEntryCheckRangeSlongSlong8(*ma);
1846                                         if (err!=TIFFReadDirEntryErrOk)
1847                                                 break;
1848                                         *mb++=(int32)(*ma++);
1849                                 }
1850                         }
1851                         break;
1852         }
1853         _TIFFfree(origdata);
1854         if (err!=TIFFReadDirEntryErrOk)
1855         {
1856                 _TIFFfree(data);
1857                 return(err);
1858         }
1859         *value=data;
1860         return(TIFFReadDirEntryErrOk);
1861 }
1862
1863 static enum TIFFReadDirEntryErr TIFFReadDirEntryLong8Array(TIFF* tif, TIFFDirEntry* direntry, uint64** value)
1864 {
1865         enum TIFFReadDirEntryErr err;
1866         uint32 count;
1867         void* origdata;
1868         uint64* data;
1869         switch (direntry->tdir_type)
1870         {
1871                 case TIFF_BYTE:
1872                 case TIFF_SBYTE:
1873                 case TIFF_SHORT:
1874                 case TIFF_SSHORT:
1875                 case TIFF_LONG:
1876                 case TIFF_SLONG:
1877                 case TIFF_LONG8:
1878                 case TIFF_SLONG8:
1879                         break;
1880                 default:
1881                         return(TIFFReadDirEntryErrType);
1882         }
1883         err=TIFFReadDirEntryArray(tif,direntry,&count,8,&origdata);
1884         if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
1885         {
1886                 *value=0;
1887                 return(err);
1888         }
1889         switch (direntry->tdir_type)
1890         {
1891                 case TIFF_LONG8:
1892                         *value=(uint64*)origdata;
1893                         if (tif->tif_flags&TIFF_SWAB)
1894                                 TIFFSwabArrayOfLong8(*value,count);
1895                         return(TIFFReadDirEntryErrOk);
1896                 case TIFF_SLONG8:
1897                         {
1898                                 int64* m;
1899                                 uint32 n;
1900                                 m=(int64*)origdata;
1901                                 for (n=0; n<count; n++)
1902                                 {
1903                                         if (tif->tif_flags&TIFF_SWAB)
1904                                                 TIFFSwabLong8((uint64*)m);
1905                                         err=TIFFReadDirEntryCheckRangeLong8Slong8(*m);
1906                                         if (err!=TIFFReadDirEntryErrOk)
1907                                         {
1908                                                 _TIFFfree(origdata);
1909                                                 return(err);
1910                                         }
1911                                         m++;
1912                                 }
1913                                 *value=(uint64*)origdata;
1914                                 return(TIFFReadDirEntryErrOk);
1915                         }
1916         }
1917         data=(uint64*)_TIFFmalloc(count*8);
1918         if (data==0)
1919         {
1920                 _TIFFfree(origdata);
1921                 return(TIFFReadDirEntryErrAlloc);
1922         }
1923         switch (direntry->tdir_type)
1924         {
1925                 case TIFF_BYTE:
1926                         {
1927                                 uint8* ma;
1928                                 uint64* mb;
1929                                 uint32 n;
1930                                 ma=(uint8*)origdata;
1931                                 mb=data;
1932                                 for (n=0; n<count; n++)
1933                                         *mb++=(uint64)(*ma++);
1934                         }
1935                         break;
1936                 case TIFF_SBYTE:
1937                         {
1938                                 int8* ma;
1939                                 uint64* mb;
1940                                 uint32 n;
1941                                 ma=(int8*)origdata;
1942                                 mb=data;
1943                                 for (n=0; n<count; n++)
1944                                 {
1945                                         err=TIFFReadDirEntryCheckRangeLong8Sbyte(*ma);
1946                                         if (err!=TIFFReadDirEntryErrOk)
1947                                                 break;
1948                                         *mb++=(uint64)(*ma++);
1949                                 }
1950                         }
1951                         break;
1952                 case TIFF_SHORT:
1953                         {
1954                                 uint16* ma;
1955                                 uint64* mb;
1956                                 uint32 n;
1957                                 ma=(uint16*)origdata;
1958                                 mb=data;
1959                                 for (n=0; n<count; n++)
1960                                 {
1961                                         if (tif->tif_flags&TIFF_SWAB)
1962                                                 TIFFSwabShort(ma);
1963                                         *mb++=(uint64)(*ma++);
1964                                 }
1965                         }
1966                         break;
1967                 case TIFF_SSHORT:
1968                         {
1969                                 int16* ma;
1970                                 uint64* mb;
1971                                 uint32 n;
1972                                 ma=(int16*)origdata;
1973                                 mb=data;
1974                                 for (n=0; n<count; n++)
1975                                 {
1976                                         if (tif->tif_flags&TIFF_SWAB)
1977                                                 TIFFSwabShort((uint16*)ma);
1978                                         err=TIFFReadDirEntryCheckRangeLong8Sshort(*ma);
1979                                         if (err!=TIFFReadDirEntryErrOk)
1980                                                 break;
1981                                         *mb++=(uint64)(*ma++);
1982                                 }
1983                         }
1984                         break;
1985                 case TIFF_LONG:
1986                         {
1987                                 uint32* ma;
1988                                 uint64* mb;
1989                                 uint32 n;
1990                                 ma=(uint32*)origdata;
1991                                 mb=data;
1992                                 for (n=0; n<count; n++)
1993                                 {
1994                                         if (tif->tif_flags&TIFF_SWAB)
1995                                                 TIFFSwabLong(ma);
1996                                         *mb++=(uint64)(*ma++);
1997                                 }
1998                         }
1999                         break;
2000                 case TIFF_SLONG:
2001                         {
2002                                 int32* ma;
2003                                 uint64* mb;
2004                                 uint32 n;
2005                                 ma=(int32*)origdata;
2006                                 mb=data;
2007                                 for (n=0; n<count; n++)
2008                                 {
2009                                         if (tif->tif_flags&TIFF_SWAB)
2010                                                 TIFFSwabLong((uint32*)ma);
2011                                         err=TIFFReadDirEntryCheckRangeLong8Slong(*ma);
2012                                         if (err!=TIFFReadDirEntryErrOk)
2013                                                 break;
2014                                         *mb++=(uint64)(*ma++);
2015                                 }
2016                         }
2017                         break;
2018         }
2019         _TIFFfree(origdata);
2020         if (err!=TIFFReadDirEntryErrOk)
2021         {
2022                 _TIFFfree(data);
2023                 return(err);
2024         }
2025         *value=data;
2026         return(TIFFReadDirEntryErrOk);
2027 }
2028
2029 static enum TIFFReadDirEntryErr TIFFReadDirEntrySlong8Array(TIFF* tif, TIFFDirEntry* direntry, int64** value)
2030 {
2031         enum TIFFReadDirEntryErr err;
2032         uint32 count;
2033         void* origdata;
2034         int64* data;
2035         switch (direntry->tdir_type)
2036         {
2037                 case TIFF_BYTE:
2038                 case TIFF_SBYTE:
2039                 case TIFF_SHORT:
2040                 case TIFF_SSHORT:
2041                 case TIFF_LONG:
2042                 case TIFF_SLONG:
2043                 case TIFF_LONG8:
2044                 case TIFF_SLONG8:
2045                         break;
2046                 default:
2047                         return(TIFFReadDirEntryErrType);
2048         }
2049         err=TIFFReadDirEntryArray(tif,direntry,&count,8,&origdata);
2050         if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
2051         {
2052                 *value=0;
2053                 return(err);
2054         }
2055         switch (direntry->tdir_type)
2056         {
2057                 case TIFF_LONG8:
2058                         {
2059                                 uint64* m;
2060                                 uint32 n;
2061                                 m=(uint64*)origdata;
2062                                 for (n=0; n<count; n++)
2063                                 {
2064                                         if (tif->tif_flags&TIFF_SWAB)
2065                                                 TIFFSwabLong8(m);
2066                                         err=TIFFReadDirEntryCheckRangeSlong8Long8(*m);
2067                                         if (err!=TIFFReadDirEntryErrOk)
2068                                         {
2069                                                 _TIFFfree(origdata);
2070                                                 return(err);
2071                                         }
2072                                         m++;
2073                                 }
2074                                 *value=(int64*)origdata;
2075                                 return(TIFFReadDirEntryErrOk);
2076                         }
2077                 case TIFF_SLONG8:
2078                         *value=(int64*)origdata;
2079                         if (tif->tif_flags&TIFF_SWAB)
2080                                 TIFFSwabArrayOfLong8((uint64*)(*value),count);
2081                         return(TIFFReadDirEntryErrOk);
2082         }
2083         data=(int64*)_TIFFmalloc(count*8);
2084         if (data==0)
2085         {
2086                 _TIFFfree(origdata);
2087                 return(TIFFReadDirEntryErrAlloc);
2088         }
2089         switch (direntry->tdir_type)
2090         {
2091                 case TIFF_BYTE:
2092                         {
2093                                 uint8* ma;
2094                                 int64* mb;
2095                                 uint32 n;
2096                                 ma=(uint8*)origdata;
2097                                 mb=data;
2098                                 for (n=0; n<count; n++)
2099                                         *mb++=(int64)(*ma++);
2100                         }
2101                         break;
2102                 case TIFF_SBYTE:
2103                         {
2104                                 int8* ma;
2105                                 int64* mb;
2106                                 uint32 n;
2107                                 ma=(int8*)origdata;
2108                                 mb=data;
2109                                 for (n=0; n<count; n++)
2110                                         *mb++=(int64)(*ma++);
2111                         }
2112                         break;
2113                 case TIFF_SHORT:
2114                         {
2115                                 uint16* ma;
2116                                 int64* mb;
2117                                 uint32 n;
2118                                 ma=(uint16*)origdata;
2119                                 mb=data;
2120                                 for (n=0; n<count; n++)
2121                                 {
2122                                         if (tif->tif_flags&TIFF_SWAB)
2123                                                 TIFFSwabShort(ma);
2124                                         *mb++=(int64)(*ma++);
2125                                 }
2126                         }
2127                         break;
2128                 case TIFF_SSHORT:
2129                         {
2130                                 int16* ma;
2131                                 int64* mb;
2132                                 uint32 n;
2133                                 ma=(int16*)origdata;
2134                                 mb=data;
2135                                 for (n=0; n<count; n++)
2136                                 {
2137                                         if (tif->tif_flags&TIFF_SWAB)
2138                                                 TIFFSwabShort((uint16*)ma);
2139                                         *mb++=(int64)(*ma++);
2140                                 }
2141                         }
2142                         break;
2143                 case TIFF_LONG:
2144                         {
2145                                 uint32* ma;
2146                                 int64* mb;
2147                                 uint32 n;
2148                                 ma=(uint32*)origdata;
2149                                 mb=data;
2150                                 for (n=0; n<count; n++)
2151                                 {
2152                                         if (tif->tif_flags&TIFF_SWAB)
2153                                                 TIFFSwabLong(ma);
2154                                         *mb++=(int64)(*ma++);
2155                                 }
2156                         }
2157                         break;
2158                 case TIFF_SLONG:
2159                         {
2160                                 int32* ma;
2161                                 int64* mb;
2162                                 uint32 n;
2163                                 ma=(int32*)origdata;
2164                                 mb=data;
2165                                 for (n=0; n<count; n++)
2166                                 {
2167                                         if (tif->tif_flags&TIFF_SWAB)
2168                                                 TIFFSwabLong((uint32*)ma);
2169                                         *mb++=(int64)(*ma++);
2170                                 }
2171                         }
2172                         break;
2173         }
2174         _TIFFfree(origdata);
2175         *value=data;
2176         return(TIFFReadDirEntryErrOk);
2177 }
2178
2179 static enum TIFFReadDirEntryErr TIFFReadDirEntryFloatArray(TIFF* tif, TIFFDirEntry* direntry, float** value)
2180 {
2181         enum TIFFReadDirEntryErr err;
2182         uint32 count;
2183         void* origdata;
2184         float* data;
2185         switch (direntry->tdir_type)
2186         {
2187                 case TIFF_BYTE:
2188                 case TIFF_SBYTE:
2189                 case TIFF_SHORT:
2190                 case TIFF_SSHORT:
2191                 case TIFF_LONG:
2192                 case TIFF_SLONG:
2193                 case TIFF_LONG8:
2194                 case TIFF_SLONG8:
2195                 case TIFF_RATIONAL:
2196                 case TIFF_SRATIONAL:
2197                 case TIFF_FLOAT:
2198                 case TIFF_DOUBLE:
2199                         break;
2200                 default:
2201                         return(TIFFReadDirEntryErrType);
2202         }
2203         err=TIFFReadDirEntryArray(tif,direntry,&count,4,&origdata);
2204         if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
2205         {
2206                 *value=0;
2207                 return(err);
2208         }
2209         switch (direntry->tdir_type)
2210         {
2211                 case TIFF_FLOAT:
2212                         if (tif->tif_flags&TIFF_SWAB)
2213                                 TIFFSwabArrayOfLong((uint32*)origdata,count);
2214                         TIFFCvtIEEEDoubleToNative(tif,count,(float*)origdata);
2215                         *value=(float*)origdata;
2216                         return(TIFFReadDirEntryErrOk);
2217         }
2218         data=(float*)_TIFFmalloc(count*sizeof(float));
2219         if (data==0)
2220         {
2221                 _TIFFfree(origdata);
2222                 return(TIFFReadDirEntryErrAlloc);
2223         }
2224         switch (direntry->tdir_type)
2225         {
2226                 case TIFF_BYTE:
2227                         {
2228                                 uint8* ma;
2229                                 float* mb;
2230                                 uint32 n;
2231                                 ma=(uint8*)origdata;
2232                                 mb=data;
2233                                 for (n=0; n<count; n++)
2234                                         *mb++=(float)(*ma++);
2235                         }
2236                         break;
2237                 case TIFF_SBYTE:
2238                         {
2239                                 int8* ma;
2240                                 float* mb;
2241                                 uint32 n;
2242                                 ma=(int8*)origdata;
2243                                 mb=data;
2244                                 for (n=0; n<count; n++)
2245                                         *mb++=(float)(*ma++);
2246                         }
2247                         break;
2248                 case TIFF_SHORT:
2249                         {
2250                                 uint16* ma;
2251                                 float* mb;
2252                                 uint32 n;
2253                                 ma=(uint16*)origdata;
2254                                 mb=data;
2255                                 for (n=0; n<count; n++)
2256                                 {
2257                                         if (tif->tif_flags&TIFF_SWAB)
2258                                                 TIFFSwabShort(ma);
2259                                         *mb++=(float)(*ma++);
2260                                 }
2261                         }
2262                         break;
2263                 case TIFF_SSHORT:
2264                         {
2265                                 int16* ma;
2266                                 float* mb;
2267                                 uint32 n;
2268                                 ma=(int16*)origdata;
2269                                 mb=data;
2270                                 for (n=0; n<count; n++)
2271                                 {
2272                                         if (tif->tif_flags&TIFF_SWAB)
2273                                                 TIFFSwabShort((uint16*)ma);
2274                                         *mb++=(float)(*ma++);
2275                                 }
2276                         }
2277                         break;
2278                 case TIFF_LONG:
2279                         {
2280                                 uint32* ma;
2281                                 float* mb;
2282                                 uint32 n;
2283                                 ma=(uint32*)origdata;
2284                                 mb=data;
2285                                 for (n=0; n<count; n++)
2286                                 {
2287                                         if (tif->tif_flags&TIFF_SWAB)
2288                                                 TIFFSwabLong(ma);
2289                                         *mb++=(float)(*ma++);
2290                                 }
2291                         }
2292                         break;
2293                 case TIFF_SLONG:
2294                         {
2295                                 int32* ma;
2296                                 float* mb;
2297                                 uint32 n;
2298                                 ma=(int32*)origdata;
2299                                 mb=data;
2300                                 for (n=0; n<count; n++)
2301                                 {
2302                                         if (tif->tif_flags&TIFF_SWAB)
2303                                                 TIFFSwabLong((uint32*)ma);
2304                                         *mb++=(float)(*ma++);
2305                                 }
2306                         }
2307                         break;
2308                 case TIFF_LONG8:
2309                         {
2310                                 uint64* ma;
2311                                 float* mb;
2312                                 uint32 n;
2313                                 ma=(uint64*)origdata;
2314                                 mb=data;
2315                                 for (n=0; n<count; n++)
2316                                 {
2317                                         if (tif->tif_flags&TIFF_SWAB)
2318                                                 TIFFSwabLong8(ma);
2319 #if defined(__WIN32__) && (_MSC_VER < 1500)
2320                                         /*
2321                                          * XXX: MSVC 6.0 does not support
2322                                          * conversion of 64-bit integers into
2323                                          * floating point values.
2324                                          */
2325                                         *mb++ = _TIFFUInt64ToFloat(*ma++);
2326 #else
2327                                         *mb++ = (float)(*ma++);
2328 #endif
2329                                 }
2330                         }
2331                         break;
2332                 case TIFF_SLONG8:
2333                         {
2334                                 int64* ma;
2335                                 float* mb;
2336                                 uint32 n;
2337                                 ma=(int64*)origdata;
2338                                 mb=data;
2339                                 for (n=0; n<count; n++)
2340                                 {
2341                                         if (tif->tif_flags&TIFF_SWAB)
2342                                                 TIFFSwabLong8((uint64*)ma);
2343                                         *mb++=(float)(*ma++);
2344                                 }
2345                         }
2346                         break;
2347                 case TIFF_RATIONAL:
2348                         {
2349                                 uint32* ma;
2350                                 uint32 maa;
2351                                 uint32 mab;
2352                                 float* mb;
2353                                 uint32 n;
2354                                 ma=(uint32*)origdata;
2355                                 mb=data;
2356                                 for (n=0; n<count; n++)
2357                                 {
2358                                         if (tif->tif_flags&TIFF_SWAB)
2359                                                 TIFFSwabLong(ma);
2360                                         maa=*ma++;
2361                                         if (tif->tif_flags&TIFF_SWAB)
2362                                                 TIFFSwabLong(ma);
2363                                         mab=*ma++;
2364                                         if (mab==0)
2365                                                 *mb++=0.0;
2366                                         else
2367                                                 *mb++=(float)maa/(float)mab;
2368                                 }
2369                         }
2370                         break;
2371                 case TIFF_SRATIONAL:
2372                         {
2373                                 uint32* ma;
2374                                 int32 maa;
2375                                 uint32 mab;
2376                                 float* mb;
2377                                 uint32 n;
2378                                 ma=(uint32*)origdata;
2379                                 mb=data;
2380                                 for (n=0; n<count; n++)
2381                                 {
2382                                         if (tif->tif_flags&TIFF_SWAB)
2383                                                 TIFFSwabLong(ma);
2384                                         maa=*(int32*)ma;
2385                                         ma++;
2386                                         if (tif->tif_flags&TIFF_SWAB)
2387                                                 TIFFSwabLong(ma);
2388                                         mab=*ma++;
2389                                         if (mab==0)
2390                                                 *mb++=0.0;
2391                                         else
2392                                                 *mb++=(float)maa/(float)mab;
2393                                 }
2394                         }
2395                         break;
2396                 case TIFF_DOUBLE:
2397                         {
2398                                 double* ma;
2399                                 float* mb;
2400                                 uint32 n;
2401                                 if (tif->tif_flags&TIFF_SWAB)
2402                                         TIFFSwabArrayOfLong8((uint64*)origdata,count);
2403                                 TIFFCvtIEEEDoubleToNative(tif,count,(double*)origdata);
2404                                 ma=(double*)origdata;
2405                                 mb=data;
2406                                 for (n=0; n<count; n++)
2407                                         *mb++=(float)(*ma++);
2408                         }
2409                         break;
2410         }
2411         _TIFFfree(origdata);
2412         *value=data;
2413         return(TIFFReadDirEntryErrOk);
2414 }
2415
2416 static enum TIFFReadDirEntryErr
2417 TIFFReadDirEntryDoubleArray(TIFF* tif, TIFFDirEntry* direntry, double** value)
2418 {
2419         enum TIFFReadDirEntryErr err;
2420         uint32 count;
2421         void* origdata;
2422         double* data;
2423         switch (direntry->tdir_type)
2424         {
2425                 case TIFF_BYTE:
2426                 case TIFF_SBYTE:
2427                 case TIFF_SHORT:
2428                 case TIFF_SSHORT:
2429                 case TIFF_LONG:
2430                 case TIFF_SLONG:
2431                 case TIFF_LONG8:
2432                 case TIFF_SLONG8:
2433                 case TIFF_RATIONAL:
2434                 case TIFF_SRATIONAL:
2435                 case TIFF_FLOAT:
2436                 case TIFF_DOUBLE:
2437                         break;
2438                 default:
2439                         return(TIFFReadDirEntryErrType);
2440         }
2441         err=TIFFReadDirEntryArray(tif,direntry,&count,8,&origdata);
2442         if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
2443         {
2444                 *value=0;
2445                 return(err);
2446         }
2447         switch (direntry->tdir_type)
2448         {
2449                 case TIFF_DOUBLE:
2450                         if (tif->tif_flags&TIFF_SWAB)
2451                                 TIFFSwabArrayOfLong8((uint64*)origdata,count);
2452                         TIFFCvtIEEEDoubleToNative(tif,count,(double*)origdata);
2453                         *value=(double*)origdata;
2454                         return(TIFFReadDirEntryErrOk);
2455         }
2456         data=(double*)_TIFFmalloc(count*sizeof(double));
2457         if (data==0)
2458         {
2459                 _TIFFfree(origdata);
2460                 return(TIFFReadDirEntryErrAlloc);
2461         }
2462         switch (direntry->tdir_type)
2463         {
2464                 case TIFF_BYTE:
2465                         {
2466                                 uint8* ma;
2467                                 double* mb;
2468                                 uint32 n;
2469                                 ma=(uint8*)origdata;
2470                                 mb=data;
2471                                 for (n=0; n<count; n++)
2472                                         *mb++=(double)(*ma++);
2473                         }
2474                         break;
2475                 case TIFF_SBYTE:
2476                         {
2477                                 int8* ma;
2478                                 double* mb;
2479                                 uint32 n;
2480                                 ma=(int8*)origdata;
2481                                 mb=data;
2482                                 for (n=0; n<count; n++)
2483                                         *mb++=(double)(*ma++);
2484                         }
2485                         break;
2486                 case TIFF_SHORT:
2487                         {
2488                                 uint16* ma;
2489                                 double* mb;
2490                                 uint32 n;
2491                                 ma=(uint16*)origdata;
2492                                 mb=data;
2493                                 for (n=0; n<count; n++)
2494                                 {
2495                                         if (tif->tif_flags&TIFF_SWAB)
2496                                                 TIFFSwabShort(ma);
2497                                         *mb++=(double)(*ma++);
2498                                 }
2499                         }
2500                         break;
2501                 case TIFF_SSHORT:
2502                         {
2503                                 int16* ma;
2504                                 double* mb;
2505                                 uint32 n;
2506                                 ma=(int16*)origdata;
2507                                 mb=data;
2508                                 for (n=0; n<count; n++)
2509                                 {
2510                                         if (tif->tif_flags&TIFF_SWAB)
2511                                                 TIFFSwabShort((uint16*)ma);
2512                                         *mb++=(double)(*ma++);
2513                                 }
2514                         }
2515                         break;
2516                 case TIFF_LONG:
2517                         {
2518                                 uint32* ma;
2519                                 double* mb;
2520                                 uint32 n;
2521                                 ma=(uint32*)origdata;
2522                                 mb=data;
2523                                 for (n=0; n<count; n++)
2524                                 {
2525                                         if (tif->tif_flags&TIFF_SWAB)
2526                                                 TIFFSwabLong(ma);
2527                                         *mb++=(double)(*ma++);
2528                                 }
2529                         }
2530                         break;
2531                 case TIFF_SLONG:
2532                         {
2533                                 int32* ma;
2534                                 double* mb;
2535                                 uint32 n;
2536                                 ma=(int32*)origdata;
2537                                 mb=data;
2538                                 for (n=0; n<count; n++)
2539                                 {
2540                                         if (tif->tif_flags&TIFF_SWAB)
2541                                                 TIFFSwabLong((uint32*)ma);
2542                                         *mb++=(double)(*ma++);
2543                                 }
2544                         }
2545                         break;
2546                 case TIFF_LONG8:
2547                         {
2548                                 uint64* ma;
2549                                 double* mb;
2550                                 uint32 n;
2551                                 ma=(uint64*)origdata;
2552                                 mb=data;
2553                                 for (n=0; n<count; n++)
2554                                 {
2555                                         if (tif->tif_flags&TIFF_SWAB)
2556                                                 TIFFSwabLong8(ma);
2557 #if defined(__WIN32__) && (_MSC_VER < 1500)
2558                                         /*
2559                                          * XXX: MSVC 6.0 does not support
2560                                          * conversion of 64-bit integers into
2561                                          * floating point values.
2562                                          */
2563                                         *mb++ = _TIFFUInt64ToDouble(*ma++);
2564 #else
2565                                         *mb++ = (double)(*ma++);
2566 #endif
2567                                 }
2568                         }
2569                         break;
2570                 case TIFF_SLONG8:
2571                         {
2572                                 int64* ma;
2573                                 double* mb;
2574                                 uint32 n;
2575                                 ma=(int64*)origdata;
2576                                 mb=data;
2577                                 for (n=0; n<count; n++)
2578                                 {
2579                                         if (tif->tif_flags&TIFF_SWAB)
2580                                                 TIFFSwabLong8((uint64*)ma);
2581                                         *mb++=(double)(*ma++);
2582                                 }
2583                         }
2584                         break;
2585                 case TIFF_RATIONAL:
2586                         {
2587                                 uint32* ma;
2588                                 uint32 maa;
2589                                 uint32 mab;
2590                                 double* mb;
2591                                 uint32 n;
2592                                 ma=(uint32*)origdata;
2593                                 mb=data;
2594                                 for (n=0; n<count; n++)
2595                                 {
2596                                         if (tif->tif_flags&TIFF_SWAB)
2597                                                 TIFFSwabLong(ma);
2598                                         maa=*ma++;
2599                                         if (tif->tif_flags&TIFF_SWAB)
2600                                                 TIFFSwabLong(ma);
2601                                         mab=*ma++;
2602                                         if (mab==0)
2603                                                 *mb++=0.0;
2604                                         else
2605                                                 *mb++=(double)maa/(double)mab;
2606                                 }
2607                         }
2608                         break;
2609                 case TIFF_SRATIONAL:
2610                         {
2611                                 uint32* ma;
2612                                 int32 maa;
2613                                 uint32 mab;
2614                                 double* mb;
2615                                 uint32 n;
2616                                 ma=(uint32*)origdata;
2617                                 mb=data;
2618                                 for (n=0; n<count; n++)
2619                                 {
2620                                         if (tif->tif_flags&TIFF_SWAB)
2621                                                 TIFFSwabLong(ma);
2622                                         maa=*(int32*)ma;
2623                                         ma++;
2624                                         if (tif->tif_flags&TIFF_SWAB)
2625                                                 TIFFSwabLong(ma);
2626                                         mab=*ma++;
2627                                         if (mab==0)
2628                                                 *mb++=0.0;
2629                                         else
2630                                                 *mb++=(double)maa/(double)mab;
2631                                 }
2632                         }
2633                         break;
2634                 case TIFF_FLOAT:
2635                         {
2636                                 float* ma;
2637                                 double* mb;
2638                                 uint32 n;
2639                                 if (tif->tif_flags&TIFF_SWAB)
2640                                         TIFFSwabArrayOfLong((uint32*)origdata,count);
2641                                 TIFFCvtIEEEFloatToNative(tif,count,(float*)origdata);
2642                                 ma=(float*)origdata;
2643                                 mb=data;
2644                                 for (n=0; n<count; n++)
2645                                         *mb++=(double)(*ma++);
2646                         }
2647                         break;
2648         }
2649         _TIFFfree(origdata);
2650         *value=data;
2651         return(TIFFReadDirEntryErrOk);
2652 }
2653
2654 static enum TIFFReadDirEntryErr TIFFReadDirEntryIfd8Array(TIFF* tif, TIFFDirEntry* direntry, uint64** value)
2655 {
2656         enum TIFFReadDirEntryErr err;
2657         uint32 count;
2658         void* origdata;
2659         uint64* data;
2660         switch (direntry->tdir_type)
2661         {
2662                 case TIFF_LONG:
2663                 case TIFF_LONG8:
2664                 case TIFF_IFD:
2665                 case TIFF_IFD8:
2666                         break;
2667                 default:
2668                         return(TIFFReadDirEntryErrType);
2669         }
2670         err=TIFFReadDirEntryArray(tif,direntry,&count,8,&origdata);
2671         if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
2672         {
2673                 *value=0;
2674                 return(err);
2675         }
2676         switch (direntry->tdir_type)
2677         {
2678                 case TIFF_LONG8:
2679                 case TIFF_IFD8:
2680                         *value=(uint64*)origdata;
2681                         if (tif->tif_flags&TIFF_SWAB)
2682                                 TIFFSwabArrayOfLong8(*value,count);
2683                         return(TIFFReadDirEntryErrOk);
2684         }
2685         data=(uint64*)_TIFFmalloc(count*8);
2686         if (data==0)
2687         {
2688                 _TIFFfree(origdata);
2689                 return(TIFFReadDirEntryErrAlloc);
2690         }
2691         switch (direntry->tdir_type)
2692         {
2693                 case TIFF_LONG:
2694                 case TIFF_IFD:
2695                         {
2696                                 uint32* ma;
2697                                 uint64* mb;
2698                                 uint32 n;
2699                                 ma=(uint32*)origdata;
2700                                 mb=data;
2701                                 for (n=0; n<count; n++)
2702                                 {
2703                                         if (tif->tif_flags&TIFF_SWAB)
2704                                                 TIFFSwabLong(ma);
2705                                         *mb++=(uint64)(*ma++);
2706                                 }
2707                         }
2708                         break;
2709         }
2710         _TIFFfree(origdata);
2711         *value=data;
2712         return(TIFFReadDirEntryErrOk);
2713 }
2714
2715 static enum TIFFReadDirEntryErr TIFFReadDirEntryPersampleShort(TIFF* tif, TIFFDirEntry* direntry, uint16* value)
2716 {
2717         enum TIFFReadDirEntryErr err;
2718         uint16* m;
2719         uint16* na;
2720         uint16 nb;
2721         if (direntry->tdir_count<(uint64)tif->tif_dir.td_samplesperpixel)
2722                 return(TIFFReadDirEntryErrCount);
2723         err=TIFFReadDirEntryShortArray(tif,direntry,&m);
2724         if (err!=TIFFReadDirEntryErrOk)
2725                 return(err);
2726         na=m;
2727         nb=tif->tif_dir.td_samplesperpixel;
2728         *value=*na++;
2729         nb--;
2730         while (nb>0)
2731         {
2732                 if (*na++!=*value)
2733                 {
2734                         err=TIFFReadDirEntryErrPsdif;
2735                         break;
2736                 }
2737                 nb--;
2738         }
2739         _TIFFfree(m);
2740         return(err);
2741 }
2742
2743 #if 0
2744 static enum TIFFReadDirEntryErr TIFFReadDirEntryPersampleDouble(TIFF* tif, TIFFDirEntry* direntry, double* value)
2745 {
2746         enum TIFFReadDirEntryErr err;
2747         double* m;
2748         double* na;
2749         uint16 nb;
2750         if (direntry->tdir_count<(uint64)tif->tif_dir.td_samplesperpixel)
2751                 return(TIFFReadDirEntryErrCount);
2752         err=TIFFReadDirEntryDoubleArray(tif,direntry,&m);
2753         if (err!=TIFFReadDirEntryErrOk)
2754                 return(err);
2755         na=m;
2756         nb=tif->tif_dir.td_samplesperpixel;
2757         *value=*na++;
2758         nb--;
2759         while (nb>0)
2760         {
2761                 if (*na++!=*value)
2762                 {
2763                         err=TIFFReadDirEntryErrPsdif;
2764                         break;
2765                 }
2766                 nb--;
2767         }
2768         _TIFFfree(m);
2769         return(err);
2770 }
2771 #endif
2772
2773 static void TIFFReadDirEntryCheckedByte(TIFF* tif, TIFFDirEntry* direntry, uint8* value)
2774 {
2775         (void) tif;
2776         *value=*(uint8*)(&direntry->tdir_offset);
2777 }
2778
2779 static void TIFFReadDirEntryCheckedSbyte(TIFF* tif, TIFFDirEntry* direntry, int8* value)
2780 {
2781         (void) tif;
2782         *value=*(int8*)(&direntry->tdir_offset);
2783 }
2784
2785 static void TIFFReadDirEntryCheckedShort(TIFF* tif, TIFFDirEntry* direntry, uint16* value)
2786 {
2787         *value = direntry->tdir_offset.toff_short;
2788         /* *value=*(uint16*)(&direntry->tdir_offset); */
2789         if (tif->tif_flags&TIFF_SWAB)
2790                 TIFFSwabShort(value);
2791 }
2792
2793 static void TIFFReadDirEntryCheckedSshort(TIFF* tif, TIFFDirEntry* direntry, int16* value)
2794 {
2795         *value=*(int16*)(&direntry->tdir_offset);
2796         if (tif->tif_flags&TIFF_SWAB)
2797                 TIFFSwabShort((uint16*)value);
2798 }
2799
2800 static void TIFFReadDirEntryCheckedLong(TIFF* tif, TIFFDirEntry* direntry, uint32* value)
2801 {
2802         *value=*(uint32*)(&direntry->tdir_offset);
2803         if (tif->tif_flags&TIFF_SWAB)
2804                 TIFFSwabLong(value);
2805 }
2806
2807 static void TIFFReadDirEntryCheckedSlong(TIFF* tif, TIFFDirEntry* direntry, int32* value)
2808 {
2809         *value=*(int32*)(&direntry->tdir_offset);
2810         if (tif->tif_flags&TIFF_SWAB)
2811                 TIFFSwabLong((uint32*)value);
2812 }
2813
2814 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedLong8(TIFF* tif, TIFFDirEntry* direntry, uint64* value)
2815 {
2816         if (!(tif->tif_flags&TIFF_BIGTIFF))
2817         {
2818                 enum TIFFReadDirEntryErr err;
2819                 uint32 offset = direntry->tdir_offset.toff_long;
2820                 if (tif->tif_flags&TIFF_SWAB)
2821                         TIFFSwabLong(&offset);
2822                 err=TIFFReadDirEntryData(tif,offset,8,value);
2823                 if (err!=TIFFReadDirEntryErrOk)
2824                         return(err);
2825         }
2826         else
2827                 *value = direntry->tdir_offset.toff_long8;
2828         if (tif->tif_flags&TIFF_SWAB)
2829                 TIFFSwabLong8(value);
2830         return(TIFFReadDirEntryErrOk);
2831 }
2832
2833 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedSlong8(TIFF* tif, TIFFDirEntry* direntry, int64* value)
2834 {
2835         if (!(tif->tif_flags&TIFF_BIGTIFF))
2836         {
2837                 enum TIFFReadDirEntryErr err;
2838                 uint32 offset = direntry->tdir_offset.toff_long;
2839                 if (tif->tif_flags&TIFF_SWAB)
2840                         TIFFSwabLong(&offset);
2841                 err=TIFFReadDirEntryData(tif,offset,8,value);
2842                 if (err!=TIFFReadDirEntryErrOk)
2843                         return(err);
2844         }
2845         else
2846                 *value=*(int64*)(&direntry->tdir_offset);
2847         if (tif->tif_flags&TIFF_SWAB)
2848                 TIFFSwabLong8((uint64*)value);
2849         return(TIFFReadDirEntryErrOk);
2850 }
2851
2852 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedRational(TIFF* tif, TIFFDirEntry* direntry, double* value)
2853 {
2854         UInt64Aligned_t m;
2855
2856         assert(sizeof(double)==8);
2857         assert(sizeof(uint64)==8);
2858         assert(sizeof(uint32)==4);
2859         if (!(tif->tif_flags&TIFF_BIGTIFF))
2860         {
2861                 enum TIFFReadDirEntryErr err;
2862                 uint32 offset = direntry->tdir_offset.toff_long;
2863                 if (tif->tif_flags&TIFF_SWAB)
2864                         TIFFSwabLong(&offset);
2865                 err=TIFFReadDirEntryData(tif,offset,8,m.i);
2866                 if (err!=TIFFReadDirEntryErrOk)
2867                         return(err);
2868         }
2869         else
2870                 m.l = direntry->tdir_offset.toff_long8;
2871         if (tif->tif_flags&TIFF_SWAB)
2872                 TIFFSwabArrayOfLong(m.i,2);
2873         if (m.i[0]==0)
2874                 *value=0.0;
2875         else
2876                 *value=(double)m.i[0]/(double)m.i[1];
2877         return(TIFFReadDirEntryErrOk);
2878 }
2879
2880 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedSrational(TIFF* tif, TIFFDirEntry* direntry, double* value)
2881 {
2882         UInt64Aligned_t m;
2883         assert(sizeof(double)==8);
2884         assert(sizeof(uint64)==8);
2885         assert(sizeof(int32)==4);
2886         assert(sizeof(uint32)==4);
2887         if (!(tif->tif_flags&TIFF_BIGTIFF))
2888         {
2889                 enum TIFFReadDirEntryErr err;
2890                 uint32 offset = direntry->tdir_offset.toff_long;
2891                 if (tif->tif_flags&TIFF_SWAB)
2892                         TIFFSwabLong(&offset);
2893                 err=TIFFReadDirEntryData(tif,offset,8,m.i);
2894                 if (err!=TIFFReadDirEntryErrOk)
2895                         return(err);
2896         }
2897         else
2898                 m.l=direntry->tdir_offset.toff_long8;
2899         if (tif->tif_flags&TIFF_SWAB)
2900                 TIFFSwabArrayOfLong(m.i,2);
2901         if ((int32)m.i[0]==0)
2902                 *value=0.0;
2903         else
2904                 *value=(double)((int32)m.i[0])/(double)m.i[1];
2905         return(TIFFReadDirEntryErrOk);
2906 }
2907
2908 static void TIFFReadDirEntryCheckedFloat(TIFF* tif, TIFFDirEntry* direntry, float* value)
2909 {
2910          union
2911          {
2912            float  f;
2913            uint32 i;
2914          } float_union;
2915         assert(sizeof(float)==4);
2916         assert(sizeof(uint32)==4);
2917         assert(sizeof(float_union)==4);
2918         float_union.i=*(uint32*)(&direntry->tdir_offset);
2919         *value=float_union.f;
2920         if (tif->tif_flags&TIFF_SWAB)
2921                 TIFFSwabLong((uint32*)value);
2922 }
2923
2924 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedDouble(TIFF* tif, TIFFDirEntry* direntry, double* value)
2925 {
2926         assert(sizeof(double)==8);
2927         assert(sizeof(uint64)==8);
2928         assert(sizeof(UInt64Aligned_t)==8);
2929         if (!(tif->tif_flags&TIFF_BIGTIFF))
2930         {
2931                 enum TIFFReadDirEntryErr err;
2932                 uint32 offset = direntry->tdir_offset.toff_long;
2933                 if (tif->tif_flags&TIFF_SWAB)
2934                         TIFFSwabLong(&offset);
2935                 err=TIFFReadDirEntryData(tif,offset,8,value);
2936                 if (err!=TIFFReadDirEntryErrOk)
2937                         return(err);
2938         }
2939         else
2940         {
2941                UInt64Aligned_t uint64_union;
2942                uint64_union.l=direntry->tdir_offset.toff_long8;
2943                *value=uint64_union.d;
2944         }
2945         if (tif->tif_flags&TIFF_SWAB)
2946                 TIFFSwabLong8((uint64*)value);
2947         return(TIFFReadDirEntryErrOk);
2948 }
2949
2950 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSbyte(int8 value)
2951 {
2952         if (value<0)
2953                 return(TIFFReadDirEntryErrRange);
2954         else
2955                 return(TIFFReadDirEntryErrOk);
2956 }
2957
2958 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteShort(uint16 value)
2959 {
2960         if (value>0xFF)
2961                 return(TIFFReadDirEntryErrRange);
2962         else
2963                 return(TIFFReadDirEntryErrOk);
2964 }
2965
2966 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSshort(int16 value)
2967 {
2968         if ((value<0)||(value>0xFF))
2969                 return(TIFFReadDirEntryErrRange);
2970         else
2971                 return(TIFFReadDirEntryErrOk);
2972 }
2973
2974 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteLong(uint32 value)
2975 {
2976         if (value>0xFF)
2977                 return(TIFFReadDirEntryErrRange);
2978         else
2979                 return(TIFFReadDirEntryErrOk);
2980 }
2981
2982 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSlong(int32 value)
2983 {
2984         if ((value<0)||(value>0xFF))
2985                 return(TIFFReadDirEntryErrRange);
2986         else
2987                 return(TIFFReadDirEntryErrOk);
2988 }
2989
2990 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteLong8(uint64 value)
2991 {
2992         if (value>0xFF)
2993                 return(TIFFReadDirEntryErrRange);
2994         else
2995                 return(TIFFReadDirEntryErrOk);
2996 }
2997
2998 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSlong8(int64 value)
2999 {
3000         if ((value<0)||(value>0xFF))
3001                 return(TIFFReadDirEntryErrRange);
3002         else
3003                 return(TIFFReadDirEntryErrOk);
3004 }
3005
3006 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteByte(uint8 value)
3007 {
3008         if (value>0x7F)
3009                 return(TIFFReadDirEntryErrRange);
3010         else
3011                 return(TIFFReadDirEntryErrOk);
3012 }
3013
3014 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteShort(uint16 value)
3015 {
3016         if (value>0x7F)
3017                 return(TIFFReadDirEntryErrRange);
3018         else
3019                 return(TIFFReadDirEntryErrOk);
3020 }
3021
3022 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteSshort(int16 value)
3023 {
3024         if ((value<-0x80)||(value>0x7F))
3025                 return(TIFFReadDirEntryErrRange);
3026         else
3027                 return(TIFFReadDirEntryErrOk);
3028 }
3029
3030 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteLong(uint32 value)
3031 {
3032         if (value>0x7F)
3033                 return(TIFFReadDirEntryErrRange);
3034         else
3035                 return(TIFFReadDirEntryErrOk);
3036 }
3037
3038 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteSlong(int32 value)
3039 {
3040         if ((value<-0x80)||(value>0x7F))
3041                 return(TIFFReadDirEntryErrRange);
3042         else
3043                 return(TIFFReadDirEntryErrOk);
3044 }
3045
3046 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteLong8(uint64 value)
3047 {
3048         if (value>0x7F)
3049                 return(TIFFReadDirEntryErrRange);
3050         else
3051                 return(TIFFReadDirEntryErrOk);
3052 }
3053
3054 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteSlong8(int64 value)
3055 {
3056         if ((value<-0x80)||(value>0x7F))
3057                 return(TIFFReadDirEntryErrRange);
3058         else
3059                 return(TIFFReadDirEntryErrOk);
3060 }
3061
3062 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSbyte(int8 value)
3063 {
3064         if (value<0)
3065                 return(TIFFReadDirEntryErrRange);
3066         else
3067                 return(TIFFReadDirEntryErrOk);
3068 }
3069
3070 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSshort(int16 value)
3071 {
3072         if (value<0)
3073                 return(TIFFReadDirEntryErrRange);
3074         else
3075                 return(TIFFReadDirEntryErrOk);
3076 }
3077
3078 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortLong(uint32 value)
3079 {
3080         if (value>0xFFFF)
3081                 return(TIFFReadDirEntryErrRange);
3082         else
3083                 return(TIFFReadDirEntryErrOk);
3084 }
3085
3086 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSlong(int32 value)
3087 {
3088         if ((value<0)||(value>0xFFFF))
3089                 return(TIFFReadDirEntryErrRange);
3090         else
3091                 return(TIFFReadDirEntryErrOk);
3092 }
3093
3094 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortLong8(uint64 value)
3095 {
3096         if (value>0xFFFF)
3097                 return(TIFFReadDirEntryErrRange);
3098         else
3099                 return(TIFFReadDirEntryErrOk);
3100 }
3101
3102 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSlong8(int64 value)
3103 {
3104         if ((value<0)||(value>0xFFFF))
3105                 return(TIFFReadDirEntryErrRange);
3106         else
3107                 return(TIFFReadDirEntryErrOk);
3108 }
3109
3110 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortShort(uint16 value)
3111 {
3112         if (value>0x7FFF)
3113                 return(TIFFReadDirEntryErrRange);
3114         else
3115                 return(TIFFReadDirEntryErrOk);
3116 }
3117
3118 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortLong(uint32 value)
3119 {
3120         if (value>0x7FFF)
3121                 return(TIFFReadDirEntryErrRange);
3122         else
3123                 return(TIFFReadDirEntryErrOk);
3124 }
3125
3126 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortSlong(int32 value)
3127 {
3128         if ((value<-0x8000)||(value>0x7FFF))
3129                 return(TIFFReadDirEntryErrRange);
3130         else
3131                 return(TIFFReadDirEntryErrOk);
3132 }
3133
3134 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortLong8(uint64 value)
3135 {
3136         if (value>0x7FFF)
3137                 return(TIFFReadDirEntryErrRange);
3138         else
3139                 return(TIFFReadDirEntryErrOk);
3140 }
3141
3142 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortSlong8(int64 value)
3143 {
3144         if ((value<-0x8000)||(value>0x7FFF))
3145                 return(TIFFReadDirEntryErrRange);
3146         else
3147                 return(TIFFReadDirEntryErrOk);
3148 }
3149
3150 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongSbyte(int8 value)
3151 {
3152         if (value<0)
3153                 return(TIFFReadDirEntryErrRange);
3154         else
3155                 return(TIFFReadDirEntryErrOk);
3156 }
3157
3158 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongSshort(int16 value)
3159 {
3160         if (value<0)
3161                 return(TIFFReadDirEntryErrRange);
3162         else
3163                 return(TIFFReadDirEntryErrOk);
3164 }
3165
3166 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongSlong(int32 value)
3167 {
3168         if (value<0)
3169                 return(TIFFReadDirEntryErrRange);
3170         else
3171                 return(TIFFReadDirEntryErrOk);
3172 }
3173
3174 /*
3175  * Largest 32-bit unsigned integer value.
3176  */
3177 #define TIFF_UINT32_MAX 0xFFFFFFFFU
3178
3179 static enum TIFFReadDirEntryErr
3180 TIFFReadDirEntryCheckRangeLongLong8(uint64 value)
3181 {
3182         if (value > TIFF_UINT32_MAX)
3183                 return(TIFFReadDirEntryErrRange);
3184         else
3185                 return(TIFFReadDirEntryErrOk);
3186 }
3187
3188 static enum TIFFReadDirEntryErr
3189 TIFFReadDirEntryCheckRangeLongSlong8(int64 value)
3190 {
3191         if ((value < 0) || (value > (int64) TIFF_UINT32_MAX))
3192                 return(TIFFReadDirEntryErrRange);
3193         else
3194                 return(TIFFReadDirEntryErrOk);
3195 }
3196
3197 #undef TIFF_UINT32_MAX
3198
3199 static enum TIFFReadDirEntryErr
3200 TIFFReadDirEntryCheckRangeSlongLong(uint32 value)
3201 {
3202         if (value > 0x7FFFFFFFUL)
3203                 return(TIFFReadDirEntryErrRange);
3204         else
3205                 return(TIFFReadDirEntryErrOk);
3206 }
3207
3208 /* Check that the 8-byte unsigned value can fit in a 4-byte unsigned range */
3209 static enum TIFFReadDirEntryErr
3210 TIFFReadDirEntryCheckRangeSlongLong8(uint64 value)
3211 {
3212         if (value > 0x7FFFFFFF)
3213                 return(TIFFReadDirEntryErrRange);
3214         else
3215                 return(TIFFReadDirEntryErrOk);
3216 }
3217
3218 /* Check that the 8-byte signed value can fit in a 4-byte signed range */
3219 static enum TIFFReadDirEntryErr
3220 TIFFReadDirEntryCheckRangeSlongSlong8(int64 value)
3221 {
3222         if ((value < 0-((int64) 0x7FFFFFFF+1)) || (value > 0x7FFFFFFF))
3223                 return(TIFFReadDirEntryErrRange);
3224         else
3225                 return(TIFFReadDirEntryErrOk);
3226 }
3227
3228 static enum TIFFReadDirEntryErr
3229 TIFFReadDirEntryCheckRangeLong8Sbyte(int8 value)
3230 {
3231         if (value < 0)
3232                 return(TIFFReadDirEntryErrRange);
3233         else
3234                 return(TIFFReadDirEntryErrOk);
3235 }
3236
3237 static enum TIFFReadDirEntryErr
3238 TIFFReadDirEntryCheckRangeLong8Sshort(int16 value)
3239 {
3240         if (value < 0)
3241                 return(TIFFReadDirEntryErrRange);
3242         else
3243                 return(TIFFReadDirEntryErrOk);
3244 }
3245
3246 static enum TIFFReadDirEntryErr
3247 TIFFReadDirEntryCheckRangeLong8Slong(int32 value)
3248 {
3249         if (value < 0)
3250                 return(TIFFReadDirEntryErrRange);
3251         else
3252                 return(TIFFReadDirEntryErrOk);
3253 }
3254
3255 static enum TIFFReadDirEntryErr
3256 TIFFReadDirEntryCheckRangeLong8Slong8(int64 value)
3257 {
3258         if (value < 0)
3259                 return(TIFFReadDirEntryErrRange);
3260         else
3261                 return(TIFFReadDirEntryErrOk);
3262 }
3263
3264 /*
3265  * Largest 64-bit signed integer value.
3266  */
3267 #define TIFF_INT64_MAX ((int64)(((uint64) ~0) >> 1))
3268
3269 static enum TIFFReadDirEntryErr
3270 TIFFReadDirEntryCheckRangeSlong8Long8(uint64 value)
3271 {
3272         if (value > TIFF_INT64_MAX)
3273                 return(TIFFReadDirEntryErrRange);
3274         else
3275                 return(TIFFReadDirEntryErrOk);
3276 }
3277
3278 #undef TIFF_INT64_MAX
3279
3280 static enum TIFFReadDirEntryErr
3281 TIFFReadDirEntryData(TIFF* tif, uint64 offset, tmsize_t size, void* dest)
3282 {
3283         assert(size>0);
3284         if (!isMapped(tif)) {
3285                 if (!SeekOK(tif,offset))
3286                         return(TIFFReadDirEntryErrIo);
3287                 if (!ReadOK(tif,dest,size))
3288                         return(TIFFReadDirEntryErrIo);
3289         } else {
3290                 size_t ma,mb;
3291                 ma=(size_t)offset;
3292                 mb=ma+size;
3293                 if (((uint64)ma!=offset)
3294                     || (mb < ma)
3295                     || (mb - ma != (size_t) size)
3296                     || (mb < (size_t)size)
3297                     || (mb > (size_t)tif->tif_size)
3298                     )
3299                         return(TIFFReadDirEntryErrIo);
3300                 _TIFFmemcpy(dest,tif->tif_base+ma,size);
3301         }
3302         return(TIFFReadDirEntryErrOk);
3303 }
3304
3305 static void TIFFReadDirEntryOutputErr(TIFF* tif, enum TIFFReadDirEntryErr err, const char* module, const char* tagname, int recover)
3306 {
3307         if (!recover) {
3308                 switch (err) {
3309                         case TIFFReadDirEntryErrCount:
3310                                 TIFFErrorExt(tif->tif_clientdata, module,
3311                                              "Incorrect count for \"%s\"",
3312                                              tagname);
3313                                 break;
3314                         case TIFFReadDirEntryErrType:
3315                                 TIFFErrorExt(tif->tif_clientdata, module,
3316                                              "Incompatible type for \"%s\"",
3317                                              tagname);
3318                                 break;
3319                         case TIFFReadDirEntryErrIo:
3320                                 TIFFErrorExt(tif->tif_clientdata, module,
3321                                              "IO error during reading of \"%s\"",
3322                                              tagname);
3323                                 break;
3324                         case TIFFReadDirEntryErrRange:
3325                                 TIFFErrorExt(tif->tif_clientdata, module,
3326                                              "Incorrect value for \"%s\"",
3327                                              tagname);
3328                                 break;
3329                         case TIFFReadDirEntryErrPsdif:
3330                                 TIFFErrorExt(tif->tif_clientdata, module,
3331                         "Cannot handle different values per sample for \"%s\"",
3332                                              tagname);
3333                                 break;
3334                         case TIFFReadDirEntryErrSizesan:
3335                                 TIFFErrorExt(tif->tif_clientdata, module,
3336                                 "Sanity check on size of \"%s\" value failed",
3337                                              tagname);
3338                                 break;
3339                         case TIFFReadDirEntryErrAlloc:
3340                                 TIFFErrorExt(tif->tif_clientdata, module,
3341                                              "Out of memory reading of \"%s\"",
3342                                              tagname);
3343                                 break;
3344                         default:
3345                                 assert(0);   /* we should never get here */
3346                                 break;
3347                 }
3348         } else {
3349                 switch (err) {
3350                         case TIFFReadDirEntryErrCount:
3351                                 TIFFWarningExt(tif->tif_clientdata, module,
3352                                 "Incorrect count for \"%s\"; tag ignored",
3353                                              tagname);
3354                                 break;
3355                         case TIFFReadDirEntryErrType:
3356                                 TIFFWarningExt(tif->tif_clientdata, module,
3357                                 "Incompatible type for \"%s\"; tag ignored",
3358                                                tagname);
3359                                 break;
3360                         case TIFFReadDirEntryErrIo:
3361                                 TIFFWarningExt(tif->tif_clientdata, module,
3362                         "IO error during reading of \"%s\"; tag ignored",
3363                                                tagname);
3364                                 break;
3365                         case TIFFReadDirEntryErrRange:
3366                                 TIFFWarningExt(tif->tif_clientdata, module,
3367                                 "Incorrect value for \"%s\"; tag ignored",
3368                                                tagname);
3369                                 break;
3370                         case TIFFReadDirEntryErrPsdif:
3371                                 TIFFWarningExt(tif->tif_clientdata, module,
3372         "Cannot handle different values per sample for \"%s\"; tag ignored",
3373                                                tagname);
3374                                 break;
3375                         case TIFFReadDirEntryErrSizesan:
3376                                 TIFFWarningExt(tif->tif_clientdata, module,
3377                 "Sanity check on size of \"%s\" value failed; tag ignored",
3378                                                tagname);
3379                                 break;
3380                         case TIFFReadDirEntryErrAlloc:
3381                                 TIFFWarningExt(tif->tif_clientdata, module,
3382                                 "Out of memory reading of \"%s\"; tag ignored",
3383                                                tagname);
3384                                 break;
3385                         default:
3386                                 assert(0);   /* we should never get here */
3387                                 break;
3388                 }
3389         }
3390 }
3391
3392 /*
3393  * Read the next TIFF directory from a file and convert it to the internal
3394  * format. We read directories sequentially.
3395  */
3396 int
3397 TIFFReadDirectory(TIFF* tif)
3398 {
3399         static const char module[] = "TIFFReadDirectory";
3400         TIFFDirEntry* dir;
3401         uint16 dircount;
3402         TIFFDirEntry* dp;
3403         uint16 di;
3404         const TIFFField* fip;
3405         uint32 fii=FAILED_FII;
3406         toff_t nextdiroff;
3407     int bitspersample_read = FALSE;
3408
3409         tif->tif_diroff=tif->tif_nextdiroff;
3410         if (!TIFFCheckDirOffset(tif,tif->tif_nextdiroff))
3411                 return 0;           /* last offset or bad offset (IFD looping) */
3412         (*tif->tif_cleanup)(tif);   /* cleanup any previous compression state */
3413         tif->tif_curdir++;
3414         nextdiroff = tif->tif_nextdiroff;
3415         dircount=TIFFFetchDirectory(tif,nextdiroff,&dir,&tif->tif_nextdiroff);
3416         if (!dircount)
3417         {
3418                 TIFFErrorExt(tif->tif_clientdata,module,
3419                     "Failed to read directory at offset " TIFF_UINT64_FORMAT,nextdiroff);
3420                 return 0;
3421         }
3422         TIFFReadDirectoryCheckOrder(tif,dir,dircount);
3423
3424         /*
3425          * Mark duplicates of any tag to be ignored (bugzilla 1994)
3426          * to avoid certain pathological problems.
3427          */
3428         {
3429                 TIFFDirEntry* ma;
3430                 uint16 mb;
3431                 for (ma=dir, mb=0; mb<dircount; ma++, mb++)
3432                 {
3433                         TIFFDirEntry* na;
3434                         uint16 nb;
3435                         for (na=ma+1, nb=mb+1; nb<dircount; na++, nb++)
3436                         {
3437                                 if (ma->tdir_tag==na->tdir_tag)
3438                                         na->tdir_tag=IGNORE;
3439                         }
3440                 }
3441         }
3442
3443         tif->tif_flags &= ~TIFF_BEENWRITING;    /* reset before new dir */
3444         tif->tif_flags &= ~TIFF_BUF4WRITE;      /* reset before new dir */
3445         /* free any old stuff and reinit */
3446         TIFFFreeDirectory(tif);
3447         TIFFDefaultDirectory(tif);
3448         /*
3449          * Electronic Arts writes gray-scale TIFF files
3450          * without a PlanarConfiguration directory entry.
3451          * Thus we setup a default value here, even though
3452          * the TIFF spec says there is no default value.
3453          */
3454         TIFFSetField(tif,TIFFTAG_PLANARCONFIG,PLANARCONFIG_CONTIG);
3455         /*
3456          * Setup default value and then make a pass over
3457          * the fields to check type and tag information,
3458          * and to extract info required to size data
3459          * structures.  A second pass is made afterwards
3460          * to read in everthing not taken in the first pass.
3461          * But we must process the Compression tag first
3462          * in order to merge in codec-private tag definitions (otherwise
3463          * we may get complaints about unknown tags).  However, the
3464          * Compression tag may be dependent on the SamplesPerPixel
3465          * tag value because older TIFF specs permited Compression
3466          * to be written as a SamplesPerPixel-count tag entry.
3467          * Thus if we don't first figure out the correct SamplesPerPixel
3468          * tag value then we may end up ignoring the Compression tag
3469          * value because it has an incorrect count value (if the
3470          * true value of SamplesPerPixel is not 1).
3471          */
3472         dp=TIFFReadDirectoryFindEntry(tif,dir,dircount,TIFFTAG_SAMPLESPERPIXEL);
3473         if (dp)
3474         {
3475                 if (!TIFFFetchNormalTag(tif,dp,0))
3476                         goto bad;
3477                 dp->tdir_tag=IGNORE;
3478         }
3479         dp=TIFFReadDirectoryFindEntry(tif,dir,dircount,TIFFTAG_COMPRESSION);
3480         if (dp)
3481         {
3482                 /*
3483                  * The 5.0 spec says the Compression tag has one value, while
3484                  * earlier specs say it has one value per sample.  Because of
3485                  * this, we accept the tag if one value is supplied with either
3486                  * count.
3487                  */
3488                 uint16 value;
3489                 enum TIFFReadDirEntryErr err;
3490                 err=TIFFReadDirEntryShort(tif,dp,&value);
3491                 if (err==TIFFReadDirEntryErrCount)
3492                         err=TIFFReadDirEntryPersampleShort(tif,dp,&value);
3493                 if (err!=TIFFReadDirEntryErrOk)
3494                 {
3495                         TIFFReadDirEntryOutputErr(tif,err,module,"Compression",0);
3496                         goto bad;
3497                 }
3498                 if (!TIFFSetField(tif,TIFFTAG_COMPRESSION,value))
3499                         goto bad;
3500                 dp->tdir_tag=IGNORE;
3501         }
3502         else
3503         {
3504                 if (!TIFFSetField(tif,TIFFTAG_COMPRESSION,COMPRESSION_NONE))
3505                         goto bad;
3506         }
3507         /*
3508          * First real pass over the directory.
3509          */
3510         for (di=0, dp=dir; di<dircount; di++, dp++)
3511         {
3512                 if (dp->tdir_tag!=IGNORE)
3513                 {
3514                         TIFFReadDirectoryFindFieldInfo(tif,dp->tdir_tag,&fii);
3515                         if (fii == FAILED_FII)
3516                         {
3517                                 TIFFWarningExt(tif->tif_clientdata, module,
3518                                     "Unknown field with tag %d (0x%x) encountered",
3519                                     dp->tdir_tag,dp->tdir_tag);
3520                                 /* the following knowingly leaks the
3521                                    anonymous field structure */
3522                                 if (!_TIFFMergeFields(tif,
3523                                         _TIFFCreateAnonField(tif,
3524                                                 dp->tdir_tag,
3525                                                 (TIFFDataType) dp->tdir_type),
3526                                         1)) {
3527                                         TIFFWarningExt(tif->tif_clientdata,
3528                                             module,
3529                                             "Registering anonymous field with tag %d (0x%x) failed",
3530                                             dp->tdir_tag,
3531                                             dp->tdir_tag);
3532                                         dp->tdir_tag=IGNORE;
3533                                 } else {
3534                                         TIFFReadDirectoryFindFieldInfo(tif,dp->tdir_tag,&fii);
3535                                         assert(fii != FAILED_FII);
3536                                 }
3537                         }
3538                 }
3539                 if (dp->tdir_tag!=IGNORE)
3540                 {
3541                         fip=tif->tif_fields[fii];
3542                         if (fip->field_bit==FIELD_IGNORE)
3543                                 dp->tdir_tag=IGNORE;
3544                         else
3545                         {
3546                                 switch (dp->tdir_tag)
3547                                 {
3548                                         case TIFFTAG_STRIPOFFSETS:
3549                                         case TIFFTAG_STRIPBYTECOUNTS:
3550                                         case TIFFTAG_TILEOFFSETS:
3551                                         case TIFFTAG_TILEBYTECOUNTS:
3552                                                 TIFFSetFieldBit(tif,fip->field_bit);
3553                                                 break;
3554                                         case TIFFTAG_IMAGEWIDTH:
3555                                         case TIFFTAG_IMAGELENGTH:
3556                                         case TIFFTAG_IMAGEDEPTH:
3557                                         case TIFFTAG_TILELENGTH:
3558                                         case TIFFTAG_TILEWIDTH:
3559                                         case TIFFTAG_TILEDEPTH:
3560                                         case TIFFTAG_PLANARCONFIG:
3561                                         case TIFFTAG_ROWSPERSTRIP:
3562                                         case TIFFTAG_EXTRASAMPLES:
3563                                                 if (!TIFFFetchNormalTag(tif,dp,0))
3564                                                         goto bad;
3565                                                 dp->tdir_tag=IGNORE;
3566                                                 break;
3567                                 }
3568                         }
3569                 }
3570         }
3571         /*
3572          * XXX: OJPEG hack.
3573          * If a) compression is OJPEG, b) planarconfig tag says it's separate,
3574          * c) strip offsets/bytecounts tag are both present and
3575          * d) both contain exactly one value, then we consistently find
3576          * that the buggy implementation of the buggy compression scheme
3577          * matches contig planarconfig best. So we 'fix-up' the tag here
3578          */
3579         if ((tif->tif_dir.td_compression==COMPRESSION_OJPEG)&&
3580             (tif->tif_dir.td_planarconfig==PLANARCONFIG_SEPARATE))
3581         {
3582         if (!_TIFFFillStriles(tif))
3583             goto bad;
3584                 dp=TIFFReadDirectoryFindEntry(tif,dir,dircount,TIFFTAG_STRIPOFFSETS);
3585                 if ((dp!=0)&&(dp->tdir_count==1))
3586                 {
3587                         dp=TIFFReadDirectoryFindEntry(tif,dir,dircount,
3588                             TIFFTAG_STRIPBYTECOUNTS);
3589                         if ((dp!=0)&&(dp->tdir_count==1))
3590                         {
3591                                 tif->tif_dir.td_planarconfig=PLANARCONFIG_CONTIG;
3592                                 TIFFWarningExt(tif->tif_clientdata,module,
3593                                     "Planarconfig tag value assumed incorrect, "
3594                                     "assuming data is contig instead of chunky");
3595                         }
3596                 }
3597         }
3598         /*
3599          * Allocate directory structure and setup defaults.
3600          */
3601         if (!TIFFFieldSet(tif,FIELD_IMAGEDIMENSIONS))
3602         {
3603                 MissingRequired(tif,"ImageLength");
3604                 goto bad;
3605         }
3606         /*
3607          * Setup appropriate structures (by strip or by tile)
3608          */
3609         if (!TIFFFieldSet(tif, FIELD_TILEDIMENSIONS)) {
3610                 tif->tif_dir.td_nstrips = TIFFNumberOfStrips(tif);
3611                 tif->tif_dir.td_tilewidth = tif->tif_dir.td_imagewidth;
3612                 tif->tif_dir.td_tilelength = tif->tif_dir.td_rowsperstrip;
3613                 tif->tif_dir.td_tiledepth = tif->tif_dir.td_imagedepth;
3614                 tif->tif_flags &= ~TIFF_ISTILED;
3615         } else {
3616                 tif->tif_dir.td_nstrips = TIFFNumberOfTiles(tif);
3617                 tif->tif_flags |= TIFF_ISTILED;
3618         }
3619         if (!tif->tif_dir.td_nstrips) {
3620                 TIFFErrorExt(tif->tif_clientdata, module,
3621                     "Cannot handle zero number of %s",
3622                     isTiled(tif) ? "tiles" : "strips");
3623                 goto bad;
3624         }
3625         tif->tif_dir.td_stripsperimage = tif->tif_dir.td_nstrips;
3626         if (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE)
3627                 tif->tif_dir.td_stripsperimage /= tif->tif_dir.td_samplesperpixel;
3628         if (!TIFFFieldSet(tif, FIELD_STRIPOFFSETS)) {
3629                 if ((tif->tif_dir.td_compression==COMPRESSION_OJPEG) &&
3630                     (isTiled(tif)==0) &&
3631                     (tif->tif_dir.td_nstrips==1)) {
3632                         /*
3633                          * XXX: OJPEG hack.
3634                          * If a) compression is OJPEG, b) it's not a tiled TIFF,
3635                          * and c) the number of strips is 1,
3636                          * then we tolerate the absence of stripoffsets tag,
3637                          * because, presumably, all required data is in the
3638                          * JpegInterchangeFormat stream.
3639                          */
3640                         TIFFSetFieldBit(tif, FIELD_STRIPOFFSETS);
3641                 } else {
3642                         MissingRequired(tif,
3643                                 isTiled(tif) ? "TileOffsets" : "StripOffsets");
3644                         goto bad;
3645                 }
3646         }
3647         /*
3648          * Second pass: extract other information.
3649          */
3650         for (di=0, dp=dir; di<dircount; di++, dp++)
3651         {
3652                 switch (dp->tdir_tag)
3653                 {
3654                         case IGNORE:
3655                                 break;
3656                         case TIFFTAG_MINSAMPLEVALUE:
3657                         case TIFFTAG_MAXSAMPLEVALUE:
3658                         case TIFFTAG_BITSPERSAMPLE:
3659                         case TIFFTAG_DATATYPE:
3660                         case TIFFTAG_SAMPLEFORMAT:
3661                                 /*
3662                                  * The MinSampleValue, MaxSampleValue, BitsPerSample
3663                                  * DataType and SampleFormat tags are supposed to be
3664                                  * written as one value/sample, but some vendors
3665                                  * incorrectly write one value only -- so we accept
3666                                  * that as well (yech). Other vendors write correct
3667                                  * value for NumberOfSamples, but incorrect one for
3668                                  * BitsPerSample and friends, and we will read this
3669                                  * too.
3670                                  */
3671                                 {
3672                                         uint16 value;
3673                                         enum TIFFReadDirEntryErr err;
3674                                         err=TIFFReadDirEntryShort(tif,dp,&value);
3675                                         if (err==TIFFReadDirEntryErrCount)
3676                                                 err=TIFFReadDirEntryPersampleShort(tif,dp,&value);
3677                                         if (err!=TIFFReadDirEntryErrOk)
3678                                         {
3679                                                 fip = TIFFFieldWithTag(tif,dp->tdir_tag);
3680                                                 TIFFReadDirEntryOutputErr(tif,err,module,fip ? fip->field_name : "unknown tagname",0);
3681                                                 goto bad;
3682                                         }
3683                                         if (!TIFFSetField(tif,dp->tdir_tag,value))
3684                                                 goto bad;
3685                     if( dp->tdir_tag == TIFFTAG_BITSPERSAMPLE )
3686                         bitspersample_read = TRUE;
3687                                 }
3688                                 break;
3689                         case TIFFTAG_SMINSAMPLEVALUE:
3690                         case TIFFTAG_SMAXSAMPLEVALUE:
3691                                 {
3692
3693                                         double *data;
3694                                         enum TIFFReadDirEntryErr err;
3695                                         uint32 saved_flags;
3696                                         int m;
3697                                         if (dp->tdir_count != (uint64)tif->tif_dir.td_samplesperpixel)
3698                                                 err = TIFFReadDirEntryErrCount;
3699                                         else
3700                                                 err = TIFFReadDirEntryDoubleArray(tif, dp, &data);
3701                                         if (err!=TIFFReadDirEntryErrOk)
3702                                         {
3703                                                 fip = TIFFFieldWithTag(tif,dp->tdir_tag);
3704                                                 TIFFReadDirEntryOutputErr(tif,err,module,fip ? fip->field_name : "unknown tagname",0);
3705                                                 goto bad;
3706                                         }
3707                                         saved_flags = tif->tif_flags;
3708                                         tif->tif_flags |= TIFF_PERSAMPLE;
3709                                         m = TIFFSetField(tif,dp->tdir_tag,data);
3710                                         tif->tif_flags = saved_flags;
3711                                         _TIFFfree(data);
3712                                         if (!m)
3713                                                 goto bad;
3714                                 }
3715                                 break;
3716                         case TIFFTAG_STRIPOFFSETS:
3717                         case TIFFTAG_TILEOFFSETS:
3718 #if defined(DEFER_STRILE_LOAD)
3719                                 _TIFFmemcpy( &(tif->tif_dir.td_stripoffset_entry),
3720                                              dp, sizeof(TIFFDirEntry) );
3721 #else
3722                                 if (!TIFFFetchStripThing(tif,dp,tif->tif_dir.td_nstrips,&tif->tif_dir.td_stripoffset))
3723                                         goto bad;
3724 #endif
3725                                 break;
3726                         case TIFFTAG_STRIPBYTECOUNTS:
3727                         case TIFFTAG_TILEBYTECOUNTS:
3728 #if defined(DEFER_STRILE_LOAD)
3729                                 _TIFFmemcpy( &(tif->tif_dir.td_stripbytecount_entry),
3730                                              dp, sizeof(TIFFDirEntry) );
3731 #else
3732                                 if (!TIFFFetchStripThing(tif,dp,tif->tif_dir.td_nstrips,&tif->tif_dir.td_stripbytecount))
3733                                         goto bad;
3734 #endif
3735                                 break;
3736                         case TIFFTAG_COLORMAP:
3737                         case TIFFTAG_TRANSFERFUNCTION:
3738                                 {
3739                                         enum TIFFReadDirEntryErr err;
3740                                         uint32 countpersample;
3741                                         uint32 countrequired;
3742                                         uint32 incrementpersample;
3743                                         uint16* value=NULL;
3744                     /* It would be dangerous to instanciate those tag values */
3745                     /* since if td_bitspersample has not yet been read (due to */
3746                     /* unordered tags), it could be read afterwards with a */
3747                     /* values greater than the default one (1), which may cause */
3748                     /* crashes in user code */
3749                     if( !bitspersample_read )
3750                     {
3751                         fip = TIFFFieldWithTag(tif,dp->tdir_tag);
3752                         TIFFWarningExt(tif->tif_clientdata,module,
3753                                        "Ignoring %s since BitsPerSample tag not found",
3754                                        fip ? fip->field_name : "unknown tagname");
3755                         continue;
3756                     }
3757                                         countpersample=(1L<<tif->tif_dir.td_bitspersample);
3758                                         if ((dp->tdir_tag==TIFFTAG_TRANSFERFUNCTION)&&(dp->tdir_count==(uint64)countpersample))
3759                                         {
3760                                                 countrequired=countpersample;
3761                                                 incrementpersample=0;
3762                                         }
3763                                         else
3764                                         {
3765                                                 countrequired=3*countpersample;
3766                                                 incrementpersample=countpersample;
3767                                         }
3768                                         if (dp->tdir_count!=(uint64)countrequired)
3769                                                 err=TIFFReadDirEntryErrCount;
3770                                         else
3771                                                 err=TIFFReadDirEntryShortArray(tif,dp,&value);
3772                                         if (err!=TIFFReadDirEntryErrOk)
3773                     {
3774                                                 fip = TIFFFieldWithTag(tif,dp->tdir_tag);
3775                                                 TIFFReadDirEntryOutputErr(tif,err,module,fip ? fip->field_name : "unknown tagname",1);
3776                     }
3777                                         else
3778                                         {
3779                                                 TIFFSetField(tif,dp->tdir_tag,value,value+incrementpersample,value+2*incrementpersample);
3780                                                 _TIFFfree(value);
3781                                         }
3782                                 }
3783                                 break;
3784 /* BEGIN REV 4.0 COMPATIBILITY */
3785                         case TIFFTAG_OSUBFILETYPE:
3786                                 {
3787                                         uint16 valueo;
3788                                         uint32 value;
3789                                         if (TIFFReadDirEntryShort(tif,dp,&valueo)==TIFFReadDirEntryErrOk)
3790                                         {
3791                                                 switch (valueo)
3792                                                 {
3793                                                         case OFILETYPE_REDUCEDIMAGE: value=FILETYPE_REDUCEDIMAGE; break;
3794                                                         case OFILETYPE_PAGE: value=FILETYPE_PAGE; break;
3795                                                         default: value=0; break;
3796                                                 }
3797                                                 if (value!=0)
3798                                                         TIFFSetField(tif,TIFFTAG_SUBFILETYPE,value);
3799                                         }
3800                                 }
3801                                 break;
3802 /* END REV 4.0 COMPATIBILITY */
3803                         default:
3804                                 (void) TIFFFetchNormalTag(tif, dp, TRUE);
3805                                 break;
3806                 }
3807         }
3808         /*
3809          * OJPEG hack:
3810          * - If a) compression is OJPEG, and b) photometric tag is missing,
3811          * then we consistently find that photometric should be YCbCr
3812          * - If a) compression is OJPEG, and b) photometric tag says it's RGB,
3813          * then we consistently find that the buggy implementation of the
3814          * buggy compression scheme matches photometric YCbCr instead.
3815          * - If a) compression is OJPEG, and b) bitspersample tag is missing,
3816          * then we consistently find bitspersample should be 8.
3817          * - If a) compression is OJPEG, b) samplesperpixel tag is missing,
3818          * and c) photometric is RGB or YCbCr, then we consistently find
3819          * samplesperpixel should be 3
3820          * - If a) compression is OJPEG, b) samplesperpixel tag is missing,
3821          * and c) photometric is MINISWHITE or MINISBLACK, then we consistently
3822          * find samplesperpixel should be 3
3823          */
3824         if (tif->tif_dir.td_compression==COMPRESSION_OJPEG)
3825         {
3826                 if (!TIFFFieldSet(tif,FIELD_PHOTOMETRIC))
3827                 {
3828                         TIFFWarningExt(tif->tif_clientdata, module,
3829                             "Photometric tag is missing, assuming data is YCbCr");
3830                         if (!TIFFSetField(tif,TIFFTAG_PHOTOMETRIC,PHOTOMETRIC_YCBCR))
3831                                 goto bad;
3832                 }
3833                 else if (tif->tif_dir.td_photometric==PHOTOMETRIC_RGB)
3834                 {
3835                         tif->tif_dir.td_photometric=PHOTOMETRIC_YCBCR;
3836                         TIFFWarningExt(tif->tif_clientdata, module,
3837                             "Photometric tag value assumed incorrect, "
3838                             "assuming data is YCbCr instead of RGB");
3839                 }
3840                 if (!TIFFFieldSet(tif,FIELD_BITSPERSAMPLE))
3841                 {
3842                         TIFFWarningExt(tif->tif_clientdata,module,
3843                             "BitsPerSample tag is missing, assuming 8 bits per sample");
3844                         if (!TIFFSetField(tif,TIFFTAG_BITSPERSAMPLE,8))
3845                                 goto bad;
3846                 }
3847                 if (!TIFFFieldSet(tif,FIELD_SAMPLESPERPIXEL))
3848                 {
3849                         if (tif->tif_dir.td_photometric==PHOTOMETRIC_RGB)
3850                         {
3851                                 TIFFWarningExt(tif->tif_clientdata,module,
3852                                     "SamplesPerPixel tag is missing, "
3853                                     "assuming correct SamplesPerPixel value is 3");
3854                                 if (!TIFFSetField(tif,TIFFTAG_SAMPLESPERPIXEL,3))
3855                                         goto bad;
3856                         }
3857                         if (tif->tif_dir.td_photometric==PHOTOMETRIC_YCBCR)
3858                         {
3859                                 TIFFWarningExt(tif->tif_clientdata,module,
3860                                     "SamplesPerPixel tag is missing, "
3861                                     "applying correct SamplesPerPixel value of 3");
3862                                 if (!TIFFSetField(tif,TIFFTAG_SAMPLESPERPIXEL,3))
3863                                         goto bad;
3864                         }
3865                         else if ((tif->tif_dir.td_photometric==PHOTOMETRIC_MINISWHITE)
3866                                  || (tif->tif_dir.td_photometric==PHOTOMETRIC_MINISBLACK))
3867                         {
3868                                 /*
3869                                  * SamplesPerPixel tag is missing, but is not required
3870                                  * by spec.  Assume correct SamplesPerPixel value of 1.
3871                                  */
3872                                 if (!TIFFSetField(tif,TIFFTAG_SAMPLESPERPIXEL,1))
3873                                         goto bad;
3874                         }
3875                 }
3876         }
3877         /*
3878          * Verify Palette image has a Colormap.
3879          */
3880         if (tif->tif_dir.td_photometric == PHOTOMETRIC_PALETTE &&
3881             !TIFFFieldSet(tif, FIELD_COLORMAP)) {
3882                 if ( tif->tif_dir.td_bitspersample>=8 && tif->tif_dir.td_samplesperpixel==3)
3883                         tif->tif_dir.td_photometric = PHOTOMETRIC_RGB;
3884                 else if (tif->tif_dir.td_bitspersample>=8)
3885                         tif->tif_dir.td_photometric = PHOTOMETRIC_MINISBLACK;
3886                 else {
3887                         MissingRequired(tif, "Colormap");
3888                         goto bad;
3889                 }
3890         }
3891         /*
3892          * OJPEG hack:
3893          * We do no further messing with strip/tile offsets/bytecounts in OJPEG
3894          * TIFFs
3895          */
3896         if (tif->tif_dir.td_compression!=COMPRESSION_OJPEG)
3897         {
3898                 /*
3899                  * Attempt to deal with a missing StripByteCounts tag.
3900                  */
3901                 if (!TIFFFieldSet(tif, FIELD_STRIPBYTECOUNTS)) {
3902                         /*
3903                          * Some manufacturers violate the spec by not giving
3904                          * the size of the strips.  In this case, assume there
3905                          * is one uncompressed strip of data.
3906                          */
3907                         if ((tif->tif_dir.td_planarconfig == PLANARCONFIG_CONTIG &&
3908                             tif->tif_dir.td_nstrips > 1) ||
3909                             (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE &&
3910                              tif->tif_dir.td_nstrips != (uint32)tif->tif_dir.td_samplesperpixel)) {
3911                             MissingRequired(tif, "StripByteCounts");
3912                             goto bad;
3913                         }
3914                         TIFFWarningExt(tif->tif_clientdata, module,
3915                                 "TIFF directory is missing required "
3916                                 "\"StripByteCounts\" field, calculating from imagelength");
3917                         if (EstimateStripByteCounts(tif, dir, dircount) < 0)
3918                             goto bad;
3919                 /*
3920                  * Assume we have wrong StripByteCount value (in case
3921                  * of single strip) in following cases:
3922                  *   - it is equal to zero along with StripOffset;
3923                  *   - it is larger than file itself (in case of uncompressed
3924                  *     image);
3925                  *   - it is smaller than the size of the bytes per row
3926                  *     multiplied on the number of rows.  The last case should
3927                  *     not be checked in the case of writing new image,
3928                  *     because we may do not know the exact strip size
3929                  *     until the whole image will be written and directory
3930                  *     dumped out.
3931                  */
3932                 #define BYTECOUNTLOOKSBAD \
3933                     ( (tif->tif_dir.td_stripbytecount[0] == 0 && tif->tif_dir.td_stripoffset[0] != 0) || \
3934                       (tif->tif_dir.td_compression == COMPRESSION_NONE && \
3935                        tif->tif_dir.td_stripbytecount[0] > TIFFGetFileSize(tif) - tif->tif_dir.td_stripoffset[0]) || \
3936                       (tif->tif_mode == O_RDONLY && \
3937                        tif->tif_dir.td_compression == COMPRESSION_NONE && \
3938                        tif->tif_dir.td_stripbytecount[0] < TIFFScanlineSize64(tif) * tif->tif_dir.td_imagelength) )
3939
3940                 } else if (tif->tif_dir.td_nstrips == 1
3941                            && _TIFFFillStriles(tif)
3942                            && tif->tif_dir.td_stripoffset[0] != 0
3943                            && BYTECOUNTLOOKSBAD) {
3944                         /*
3945                          * XXX: Plexus (and others) sometimes give a value of
3946                          * zero for a tag when they don't know what the
3947                          * correct value is!  Try and handle the simple case
3948                          * of estimating the size of a one strip image.
3949                          */
3950                         TIFFWarningExt(tif->tif_clientdata, module,
3951                             "Bogus \"StripByteCounts\" field, ignoring and calculating from imagelength");
3952                         if(EstimateStripByteCounts(tif, dir, dircount) < 0)
3953                             goto bad;
3954
3955 #if !defined(DEFER_STRILE_LOAD)
3956                 } else if (tif->tif_dir.td_planarconfig == PLANARCONFIG_CONTIG
3957                            && tif->tif_dir.td_nstrips > 2
3958                            && tif->tif_dir.td_compression == COMPRESSION_NONE
3959                            && tif->tif_dir.td_stripbytecount[0] != tif->tif_dir.td_stripbytecount[1]
3960                            && tif->tif_dir.td_stripbytecount[0] != 0
3961                            && tif->tif_dir.td_stripbytecount[1] != 0 ) {
3962                         /*
3963                          * XXX: Some vendors fill StripByteCount array with
3964                          * absolutely wrong values (it can be equal to
3965                          * StripOffset array, for example). Catch this case
3966                          * here.
3967                          *
3968                          * We avoid this check if deferring strile loading
3969                          * as it would always force us to load the strip/tile
3970                          * information.
3971                          */
3972                         TIFFWarningExt(tif->tif_clientdata, module,
3973                             "Wrong \"StripByteCounts\" field, ignoring and calculating from imagelength");
3974                         if (EstimateStripByteCounts(tif, dir, dircount) < 0)
3975                             goto bad;
3976 #endif /* !defined(DEFER_STRILE_LOAD) */
3977                 }
3978         }
3979         if (dir)
3980         {
3981                 _TIFFfree(dir);
3982                 dir=NULL;
3983         }
3984         if (!TIFFFieldSet(tif, FIELD_MAXSAMPLEVALUE))
3985         {
3986                 if (tif->tif_dir.td_bitspersample>=16)
3987                         tif->tif_dir.td_maxsamplevalue=0xFFFF;
3988                 else
3989                         tif->tif_dir.td_maxsamplevalue = (uint16)((1L<<tif->tif_dir.td_bitspersample)-1);
3990         }
3991         /*
3992          * XXX: We can optimize checking for the strip bounds using the sorted
3993          * bytecounts array. See also comments for TIFFAppendToStrip()
3994          * function in tif_write.c.
3995          */
3996 #if !defined(DEFER_STRILE_LOAD)
3997         if (tif->tif_dir.td_nstrips > 1) {
3998                 uint32 strip;
3999
4000                 tif->tif_dir.td_stripbytecountsorted = 1;
4001                 for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++) {
4002                         if (tif->tif_dir.td_stripoffset[strip - 1] >
4003                             tif->tif_dir.td_stripoffset[strip]) {
4004                                 tif->tif_dir.td_stripbytecountsorted = 0;
4005                                 break;
4006                         }
4007                 }
4008         }
4009 #endif /* !defined(DEFER_STRILE_LOAD) */
4010
4011         /*
4012          * An opportunity for compression mode dependent tag fixup
4013          */
4014         (*tif->tif_fixuptags)(tif);
4015
4016         /*
4017          * Some manufacturers make life difficult by writing
4018          * large amounts of uncompressed data as a single strip.
4019          * This is contrary to the recommendations of the spec.
4020          * The following makes an attempt at breaking such images
4021          * into strips closer to the recommended 8k bytes.  A
4022          * side effect, however, is that the RowsPerStrip tag
4023          * value may be changed.
4024          */
4025         if ((tif->tif_dir.td_planarconfig==PLANARCONFIG_CONTIG)&&
4026             (tif->tif_dir.td_nstrips==1)&&
4027             (tif->tif_dir.td_compression==COMPRESSION_NONE)&&
4028             ((tif->tif_flags&(TIFF_STRIPCHOP|TIFF_ISTILED))==TIFF_STRIPCHOP))
4029     {
4030         if ( !_TIFFFillStriles(tif) || !tif->tif_dir.td_stripbytecount )
4031             return 0;
4032                 ChopUpSingleUncompressedStrip(tif);
4033     }
4034
4035         /*
4036          * Clear the dirty directory flag.
4037          */
4038         tif->tif_flags &= ~TIFF_DIRTYDIRECT;
4039         tif->tif_flags &= ~TIFF_DIRTYSTRIP;
4040
4041         /*
4042          * Reinitialize i/o since we are starting on a new directory.
4043          */
4044         tif->tif_row = (uint32) -1;
4045         tif->tif_curstrip = (uint32) -1;
4046         tif->tif_col = (uint32) -1;
4047         tif->tif_curtile = (uint32) -1;
4048         tif->tif_tilesize = (tmsize_t) -1;
4049
4050         tif->tif_scanlinesize = TIFFScanlineSize(tif);
4051         if (!tif->tif_scanlinesize) {
4052                 TIFFErrorExt(tif->tif_clientdata, module,
4053                     "Cannot handle zero scanline size");
4054                 return (0);
4055         }
4056
4057         if (isTiled(tif)) {
4058                 tif->tif_tilesize = TIFFTileSize(tif);
4059                 if (!tif->tif_tilesize) {
4060                         TIFFErrorExt(tif->tif_clientdata, module,
4061                              "Cannot handle zero tile size");
4062                         return (0);
4063                 }
4064         } else {
4065                 if (!TIFFStripSize(tif)) {
4066                         TIFFErrorExt(tif->tif_clientdata, module,
4067                             "Cannot handle zero strip size");
4068                         return (0);
4069                 }
4070         }
4071         return (1);
4072 bad:
4073         if (dir)
4074                 _TIFFfree(dir);
4075         return (0);
4076 }
4077
4078 static void
4079 TIFFReadDirectoryCheckOrder(TIFF* tif, TIFFDirEntry* dir, uint16 dircount)
4080 {
4081         static const char module[] = "TIFFReadDirectoryCheckOrder";
4082         uint16 m;
4083         uint16 n;
4084         TIFFDirEntry* o;
4085         m=0;
4086         for (n=0, o=dir; n<dircount; n++, o++)
4087         {
4088                 if (o->tdir_tag<m)
4089                 {
4090                         TIFFWarningExt(tif->tif_clientdata,module,
4091                             "Invalid TIFF directory; tags are not sorted in ascending order");
4092                         break;
4093                 }
4094                 m=o->tdir_tag+1;
4095         }
4096 }
4097
4098 static TIFFDirEntry*
4099 TIFFReadDirectoryFindEntry(TIFF* tif, TIFFDirEntry* dir, uint16 dircount, uint16 tagid)
4100 {
4101         TIFFDirEntry* m;
4102         uint16 n;
4103         (void) tif;
4104         for (m=dir, n=0; n<dircount; m++, n++)
4105         {
4106                 if (m->tdir_tag==tagid)
4107                         return(m);
4108         }
4109         return(0);
4110 }
4111
4112 static void
4113 TIFFReadDirectoryFindFieldInfo(TIFF* tif, uint16 tagid, uint32* fii)
4114 {
4115         int32 ma,mb,mc;
4116         ma=-1;
4117         mc=(int32)tif->tif_nfields;
4118         while (1)
4119         {
4120                 if (ma+1==mc)
4121                 {
4122                         *fii = FAILED_FII;
4123                         return;
4124                 }
4125                 mb=(ma+mc)/2;
4126                 if (tif->tif_fields[mb]->field_tag==(uint32)tagid)
4127                         break;
4128                 if (tif->tif_fields[mb]->field_tag<(uint32)tagid)
4129                         ma=mb;
4130                 else
4131                         mc=mb;
4132         }
4133         while (1)
4134         {
4135                 if (mb==0)
4136                         break;
4137                 if (tif->tif_fields[mb-1]->field_tag!=(uint32)tagid)
4138                         break;
4139                 mb--;
4140         }
4141         *fii=mb;
4142 }
4143
4144 /*
4145  * Read custom directory from the arbitarry offset.
4146  * The code is very similar to TIFFReadDirectory().
4147  */
4148 int
4149 TIFFReadCustomDirectory(TIFF* tif, toff_t diroff,
4150                         const TIFFFieldArray* infoarray)
4151 {
4152         static const char module[] = "TIFFReadCustomDirectory";
4153         TIFFDirEntry* dir;
4154         uint16 dircount;
4155         TIFFDirEntry* dp;
4156         uint16 di;
4157         const TIFFField* fip;
4158         uint32 fii;
4159         _TIFFSetupFields(tif, infoarray);
4160         dircount=TIFFFetchDirectory(tif,diroff,&dir,NULL);
4161         if (!dircount)
4162         {
4163                 TIFFErrorExt(tif->tif_clientdata,module,
4164                     "Failed to read custom directory at offset " TIFF_UINT64_FORMAT,diroff);
4165                 return 0;
4166         }
4167         TIFFFreeDirectory(tif);
4168         _TIFFmemset(&tif->tif_dir, 0, sizeof(TIFFDirectory));
4169         TIFFReadDirectoryCheckOrder(tif,dir,dircount);
4170         for (di=0, dp=dir; di<dircount; di++, dp++)
4171         {
4172                 TIFFReadDirectoryFindFieldInfo(tif,dp->tdir_tag,&fii);
4173                 if (fii == FAILED_FII)
4174                 {
4175                         TIFFWarningExt(tif->tif_clientdata, module,
4176                             "Unknown field with tag %d (0x%x) encountered",
4177                             dp->tdir_tag, dp->tdir_tag);
4178                         if (!_TIFFMergeFields(tif, _TIFFCreateAnonField(tif,
4179                                                 dp->tdir_tag,
4180                                                 (TIFFDataType) dp->tdir_type),
4181                                              1)) {
4182                                 TIFFWarningExt(tif->tif_clientdata, module,
4183                                     "Registering anonymous field with tag %d (0x%x) failed",
4184                                     dp->tdir_tag, dp->tdir_tag);
4185                                 dp->tdir_tag=IGNORE;
4186                         } else {
4187                                 TIFFReadDirectoryFindFieldInfo(tif,dp->tdir_tag,&fii);
4188                                 assert( fii != FAILED_FII );
4189                         }
4190                 }
4191                 if (dp->tdir_tag!=IGNORE)
4192                 {
4193                         fip=tif->tif_fields[fii];
4194                         if (fip->field_bit==FIELD_IGNORE)
4195                                 dp->tdir_tag=IGNORE;
4196                         else
4197                         {
4198                                 /* check data type */
4199                                 while ((fip->field_type!=TIFF_ANY)&&(fip->field_type!=dp->tdir_type))
4200                                 {
4201                                         fii++;
4202                                         if ((fii==tif->tif_nfields)||
4203                                             (tif->tif_fields[fii]->field_tag!=(uint32)dp->tdir_tag))
4204                                         {
4205                                                 fii=0xFFFF;
4206                                                 break;
4207                                         }
4208                                         fip=tif->tif_fields[fii];
4209                                 }
4210                                 if (fii==0xFFFF)
4211                                 {
4212                                         TIFFWarningExt(tif->tif_clientdata, module,
4213                                             "Wrong data type %d for \"%s\"; tag ignored",
4214                                             dp->tdir_type,fip->field_name);
4215                                         dp->tdir_tag=IGNORE;
4216                                 }
4217                                 else
4218                                 {
4219                                         /* check count if known in advance */
4220                                         if ((fip->field_readcount!=TIFF_VARIABLE)&&
4221                                             (fip->field_readcount!=TIFF_VARIABLE2))
4222                                         {
4223                                                 uint32 expected;
4224                                                 if (fip->field_readcount==TIFF_SPP)
4225                                                         expected=(uint32)tif->tif_dir.td_samplesperpixel;
4226                                                 else
4227                                                         expected=(uint32)fip->field_readcount;
4228                                                 if (!CheckDirCount(tif,dp,expected))
4229                                                         dp->tdir_tag=IGNORE;
4230                                         }
4231                                 }
4232                         }
4233                         switch (dp->tdir_tag)
4234                         {
4235                                 case IGNORE:
4236                                         break;
4237                                 case EXIFTAG_SUBJECTDISTANCE:
4238                                         (void) TIFFFetchSubjectDistance(tif,dp);
4239                                         break;
4240                                 default:
4241                                         (void) TIFFFetchNormalTag(tif, dp, TRUE);
4242                                         break;
4243                         }
4244                 }
4245         }
4246         if (dir)
4247                 _TIFFfree(dir);
4248         return 1;
4249 }
4250
4251 /*
4252  * EXIF is important special case of custom IFD, so we have a special
4253  * function to read it.
4254  */
4255 int
4256 TIFFReadEXIFDirectory(TIFF* tif, toff_t diroff)
4257 {
4258         const TIFFFieldArray* exifFieldArray;
4259         exifFieldArray = _TIFFGetExifFields();
4260         return TIFFReadCustomDirectory(tif, diroff, exifFieldArray);
4261 }
4262
4263 static int
4264 EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount)
4265 {
4266         static const char module[] = "EstimateStripByteCounts";
4267
4268         TIFFDirEntry *dp;
4269         TIFFDirectory *td = &tif->tif_dir;
4270         uint32 strip;
4271
4272     if( !_TIFFFillStriles( tif ) )
4273         return -1;
4274
4275         if (td->td_stripbytecount)
4276                 _TIFFfree(td->td_stripbytecount);
4277         td->td_stripbytecount = (uint64*)
4278             _TIFFCheckMalloc(tif, td->td_nstrips, sizeof (uint64),
4279                 "for \"StripByteCounts\" array");
4280         if( td->td_stripbytecount == NULL )
4281             return -1;
4282
4283         if (td->td_compression != COMPRESSION_NONE) {
4284                 uint64 space;
4285                 uint64 filesize;
4286                 uint16 n;
4287                 filesize = TIFFGetFileSize(tif);
4288                 if (!(tif->tif_flags&TIFF_BIGTIFF))
4289                         space=sizeof(TIFFHeaderClassic)+2+dircount*12+4;
4290                 else
4291                         space=sizeof(TIFFHeaderBig)+8+dircount*20+8;
4292                 /* calculate amount of space used by indirect values */
4293                 for (dp = dir, n = dircount; n > 0; n--, dp++)
4294                 {
4295                         uint32 typewidth = TIFFDataWidth((TIFFDataType) dp->tdir_type);
4296                         uint64 datasize;
4297                         typewidth = TIFFDataWidth((TIFFDataType) dp->tdir_type);
4298                         if (typewidth == 0) {
4299                                 TIFFErrorExt(tif->tif_clientdata, module,
4300                                     "Cannot determine size of unknown tag type %d",
4301                                     dp->tdir_type);
4302                                 return -1;
4303                         }
4304                         datasize=(uint64)typewidth*dp->tdir_count;
4305                         if (!(tif->tif_flags&TIFF_BIGTIFF))
4306                         {
4307                                 if (datasize<=4)
4308                                         datasize=0;
4309                         }
4310                         else
4311                         {
4312                                 if (datasize<=8)
4313                                         datasize=0;
4314                         }
4315                         space+=datasize;
4316                 }
4317                 space = filesize - space;
4318                 if (td->td_planarconfig == PLANARCONFIG_SEPARATE)
4319                         space /= td->td_samplesperpixel;
4320                 for (strip = 0; strip < td->td_nstrips; strip++)
4321                         td->td_stripbytecount[strip] = space;
4322                 /*
4323                  * This gross hack handles the case were the offset to
4324                  * the last strip is past the place where we think the strip
4325                  * should begin.  Since a strip of data must be contiguous,
4326                  * it's safe to assume that we've overestimated the amount
4327                  * of data in the strip and trim this number back accordingly.
4328                  */
4329                 strip--;
4330                 if (td->td_stripoffset[strip]+td->td_stripbytecount[strip] > filesize)
4331                         td->td_stripbytecount[strip] = filesize - td->td_stripoffset[strip];
4332         } else if (isTiled(tif)) {
4333                 uint64 bytespertile = TIFFTileSize64(tif);
4334
4335                 for (strip = 0; strip < td->td_nstrips; strip++)
4336                     td->td_stripbytecount[strip] = bytespertile;
4337         } else {
4338                 uint64 rowbytes = TIFFScanlineSize64(tif);
4339                 uint32 rowsperstrip = td->td_imagelength/td->td_stripsperimage;
4340                 for (strip = 0; strip < td->td_nstrips; strip++)
4341                         td->td_stripbytecount[strip] = rowbytes * rowsperstrip;
4342         }
4343         TIFFSetFieldBit(tif, FIELD_STRIPBYTECOUNTS);
4344         if (!TIFFFieldSet(tif, FIELD_ROWSPERSTRIP))
4345                 td->td_rowsperstrip = td->td_imagelength;
4346         return 1;
4347 }
4348
4349 static void
4350 MissingRequired(TIFF* tif, const char* tagname)
4351 {
4352         static const char module[] = "MissingRequired";
4353
4354         TIFFErrorExt(tif->tif_clientdata, module,
4355             "TIFF directory is missing required \"%s\" field",
4356             tagname);
4357 }
4358
4359 /*
4360  * Check the directory offset against the list of already seen directory
4361  * offsets. This is a trick to prevent IFD looping. The one can create TIFF
4362  * file with looped directory pointers. We will maintain a list of already
4363  * seen directories and check every IFD offset against that list.
4364  */
4365 static int
4366 TIFFCheckDirOffset(TIFF* tif, uint64 diroff)
4367 {
4368         uint16 n;
4369
4370         if (diroff == 0)                        /* no more directories */
4371                 return 0;
4372         if (tif->tif_dirnumber == 65535) {
4373             TIFFErrorExt(tif->tif_clientdata, "TIFFCheckDirOffset",
4374                          "Cannot handle more than 65535 TIFF directories");
4375             return 0;
4376         }
4377
4378         for (n = 0; n < tif->tif_dirnumber && tif->tif_dirlist; n++) {
4379                 if (tif->tif_dirlist[n] == diroff)
4380                         return 0;
4381         }
4382
4383         tif->tif_dirnumber++;
4384
4385         if (tif->tif_dirnumber > tif->tif_dirlistsize) {
4386                 uint64* new_dirlist;
4387
4388                 /*
4389                  * XXX: Reduce memory allocation granularity of the dirlist
4390                  * array.
4391                  */
4392                 new_dirlist = (uint64*)_TIFFCheckRealloc(tif, tif->tif_dirlist,
4393                     tif->tif_dirnumber, 2 * sizeof(uint64), "for IFD list");
4394                 if (!new_dirlist)
4395                         return 0;
4396                 if( tif->tif_dirnumber >= 32768 )
4397                     tif->tif_dirlistsize = 65535;
4398                 else
4399                     tif->tif_dirlistsize = 2 * tif->tif_dirnumber;
4400                 tif->tif_dirlist = new_dirlist;
4401         }
4402
4403         tif->tif_dirlist[tif->tif_dirnumber - 1] = diroff;
4404
4405         return 1;
4406 }
4407
4408 /*
4409  * Check the count field of a directory entry against a known value.  The
4410  * caller is expected to skip/ignore the tag if there is a mismatch.
4411  */
4412 static int
4413 CheckDirCount(TIFF* tif, TIFFDirEntry* dir, uint32 count)
4414 {
4415         if ((uint64)count > dir->tdir_count) {
4416                 const TIFFField* fip = TIFFFieldWithTag(tif, dir->tdir_tag);
4417                 TIFFWarningExt(tif->tif_clientdata, tif->tif_name,
4418         "incorrect count for field \"%s\" (" TIFF_UINT64_FORMAT ", expecting %u); tag ignored",
4419                     fip ? fip->field_name : "unknown tagname",
4420                     dir->tdir_count, count);
4421                 return (0);
4422         } else if ((uint64)count < dir->tdir_count) {
4423                 const TIFFField* fip = TIFFFieldWithTag(tif, dir->tdir_tag);
4424                 TIFFWarningExt(tif->tif_clientdata, tif->tif_name,
4425         "incorrect count for field \"%s\" (" TIFF_UINT64_FORMAT ", expecting %u); tag trimmed",
4426                     fip ? fip->field_name : "unknown tagname",
4427                     dir->tdir_count, count);
4428                 dir->tdir_count = count;
4429                 return (1);
4430         }
4431         return (1);
4432 }
4433
4434 /*
4435  * Read IFD structure from the specified offset. If the pointer to
4436  * nextdiroff variable has been specified, read it too. Function returns a
4437  * number of fields in the directory or 0 if failed.
4438  */
4439 static uint16
4440 TIFFFetchDirectory(TIFF* tif, uint64 diroff, TIFFDirEntry** pdir,
4441                    uint64 *nextdiroff)
4442 {
4443         static const char module[] = "TIFFFetchDirectory";
4444
4445         void* origdir;
4446         uint16 dircount16;
4447         uint32 dirsize;
4448         TIFFDirEntry* dir;
4449         uint8* ma;
4450         TIFFDirEntry* mb;
4451         uint16 n;
4452
4453         assert(pdir);
4454
4455         tif->tif_diroff = diroff;
4456         if (nextdiroff)
4457                 *nextdiroff = 0;
4458         if (!isMapped(tif)) {
4459                 if (!SeekOK(tif, tif->tif_diroff)) {
4460                         TIFFErrorExt(tif->tif_clientdata, module,
4461                                 "%s: Seek error accessing TIFF directory",
4462                                 tif->tif_name);
4463                         return 0;
4464                 }
4465                 if (!(tif->tif_flags&TIFF_BIGTIFF))
4466                 {
4467                         if (!ReadOK(tif, &dircount16, sizeof (uint16))) {
4468                                 TIFFErrorExt(tif->tif_clientdata, module,
4469                                     "%s: Can not read TIFF directory count",
4470                                     tif->tif_name);
4471                                 return 0;
4472                         }
4473                         if (tif->tif_flags & TIFF_SWAB)
4474                                 TIFFSwabShort(&dircount16);
4475                         if (dircount16>4096)
4476                         {
4477                                 TIFFErrorExt(tif->tif_clientdata, module,
4478                                     "Sanity check on directory count failed, this is probably not a valid IFD offset");
4479                                 return 0;
4480                         }
4481                         dirsize = 12;
4482                 } else {
4483                         uint64 dircount64;
4484                         if (!ReadOK(tif, &dircount64, sizeof (uint64))) {
4485                                 TIFFErrorExt(tif->tif_clientdata, module,
4486                                         "%s: Can not read TIFF directory count",
4487                                         tif->tif_name);
4488                                 return 0;
4489                         }
4490                         if (tif->tif_flags & TIFF_SWAB)
4491                                 TIFFSwabLong8(&dircount64);
4492                         if (dircount64>4096)
4493                         {
4494                                 TIFFErrorExt(tif->tif_clientdata, module,
4495                                     "Sanity check on directory count failed, this is probably not a valid IFD offset");
4496                                 return 0;
4497                         }
4498                         dircount16 = (uint16)dircount64;
4499                         dirsize = 20;
4500                 }
4501                 origdir = _TIFFCheckMalloc(tif, dircount16,
4502                     dirsize, "to read TIFF directory");
4503                 if (origdir == NULL)
4504                         return 0;
4505                 if (!ReadOK(tif, origdir, (tmsize_t)(dircount16*dirsize))) {
4506                         TIFFErrorExt(tif->tif_clientdata, module,
4507                                 "%.100s: Can not read TIFF directory",
4508                                 tif->tif_name);
4509                         _TIFFfree(origdir);
4510                         return 0;
4511                 }
4512                 /*
4513                  * Read offset to next directory for sequential scans if
4514                  * needed.
4515                  */
4516                 if (nextdiroff)
4517                 {
4518                         if (!(tif->tif_flags&TIFF_BIGTIFF))
4519                         {
4520                                 uint32 nextdiroff32;
4521                                 if (!ReadOK(tif, &nextdiroff32, sizeof(uint32)))
4522                                         nextdiroff32 = 0;
4523                                 if (tif->tif_flags&TIFF_SWAB)
4524                                         TIFFSwabLong(&nextdiroff32);
4525                                 *nextdiroff=nextdiroff32;
4526                         } else {
4527                                 if (!ReadOK(tif, nextdiroff, sizeof(uint64)))
4528                                         *nextdiroff = 0;
4529                                 if (tif->tif_flags&TIFF_SWAB)
4530                                         TIFFSwabLong8(nextdiroff);
4531                         }
4532                 }
4533         } else {
4534                 tmsize_t m;
4535                 tmsize_t off = (tmsize_t) tif->tif_diroff;
4536                 if ((uint64)off!=tif->tif_diroff)
4537                 {
4538                         TIFFErrorExt(tif->tif_clientdata,module,"Can not read TIFF directory count");
4539                         return(0);
4540                 }
4541
4542                 /*
4543                  * Check for integer overflow when validating the dir_off,
4544                  * otherwise a very high offset may cause an OOB read and
4545                  * crash the client. Make two comparisons instead of
4546                  *
4547                  *  off + sizeof(uint16) > tif->tif_size
4548                  *
4549                  * to avoid overflow.
4550                  */
4551                 if (!(tif->tif_flags&TIFF_BIGTIFF))
4552                 {
4553                         m=off+sizeof(uint16);
4554                         if ((m<off)||(m<(tmsize_t)sizeof(uint16))||(m>tif->tif_size)) {
4555                                 TIFFErrorExt(tif->tif_clientdata, module,
4556                                         "Can not read TIFF directory count");
4557                                 return 0;
4558                         } else {
4559                                 _TIFFmemcpy(&dircount16, tif->tif_base + off,
4560                                             sizeof(uint16));
4561                         }
4562                         off += sizeof (uint16);
4563                         if (tif->tif_flags & TIFF_SWAB)
4564                                 TIFFSwabShort(&dircount16);
4565                         if (dircount16>4096)
4566                         {
4567                                 TIFFErrorExt(tif->tif_clientdata, module,
4568                                     "Sanity check on directory count failed, this is probably not a valid IFD offset");
4569                                 return 0;
4570                         }
4571                         dirsize = 12;
4572                 }
4573                 else
4574                 {
4575                         tmsize_t m;
4576                         uint64 dircount64;
4577                         m=off+sizeof(uint64);
4578                         if ((m<off)||(m<(tmsize_t)sizeof(uint64))||(m>tif->tif_size)) {
4579                                 TIFFErrorExt(tif->tif_clientdata, module,
4580                                         "Can not read TIFF directory count");
4581                                 return 0;
4582                         } else {
4583                                 _TIFFmemcpy(&dircount64, tif->tif_base + off,
4584                                             sizeof(uint64));
4585                         }
4586                         off += sizeof (uint64);
4587                         if (tif->tif_flags & TIFF_SWAB)
4588                                 TIFFSwabLong8(&dircount64);
4589                         if (dircount64>4096)
4590                         {
4591                                 TIFFErrorExt(tif->tif_clientdata, module,
4592                                     "Sanity check on directory count failed, this is probably not a valid IFD offset");
4593                                 return 0;
4594                         }
4595                         dircount16 = (uint16)dircount64;
4596                         dirsize = 20;
4597                 }
4598                 if (dircount16 == 0 )
4599                 {
4600                         TIFFErrorExt(tif->tif_clientdata, module,
4601                                      "Sanity check on directory count failed, zero tag directories not supported");
4602                         return 0;
4603                 }
4604                 origdir = _TIFFCheckMalloc(tif, dircount16,
4605                                                 dirsize,
4606                                                 "to read TIFF directory");
4607                 if (origdir == NULL)
4608                         return 0;
4609                 m=off+dircount16*dirsize;
4610                 if ((m<off)||(m<(tmsize_t)(dircount16*dirsize))||(m>tif->tif_size)) {
4611                         TIFFErrorExt(tif->tif_clientdata, module,
4612                                      "Can not read TIFF directory");
4613                         _TIFFfree(origdir);
4614                         return 0;
4615                 } else {
4616                         _TIFFmemcpy(origdir, tif->tif_base + off,
4617                                     dircount16 * dirsize);
4618                 }
4619                 if (nextdiroff) {
4620                         off += dircount16 * dirsize;
4621                         if (!(tif->tif_flags&TIFF_BIGTIFF))
4622                         {
4623                                 uint32 nextdiroff32;
4624                                 m=off+sizeof(uint32);
4625                                 if ((m<off)||(m<(tmsize_t)sizeof(uint32))||(m>tif->tif_size))
4626                                         nextdiroff32 = 0;
4627                                 else
4628                                         _TIFFmemcpy(&nextdiroff32, tif->tif_base + off,
4629                                                     sizeof (uint32));
4630                                 if (tif->tif_flags&TIFF_SWAB)
4631                                         TIFFSwabLong(&nextdiroff32);
4632                                 *nextdiroff = nextdiroff32;
4633                         }
4634                         else
4635                         {
4636                                 m=off+sizeof(uint64);
4637                                 if ((m<off)||(m<(tmsize_t)sizeof(uint64))||(m>tif->tif_size))
4638                                         *nextdiroff = 0;
4639                                 else
4640                                         _TIFFmemcpy(nextdiroff, tif->tif_base + off,
4641                                                     sizeof (uint64));
4642                                 if (tif->tif_flags&TIFF_SWAB)
4643                                         TIFFSwabLong8(nextdiroff);
4644                         }
4645                 }
4646         }
4647         dir = (TIFFDirEntry*)_TIFFCheckMalloc(tif, dircount16,
4648                                                 sizeof(TIFFDirEntry),
4649                                                 "to read TIFF directory");
4650         if (dir==0)
4651         {
4652                 _TIFFfree(origdir);
4653                 return 0;
4654         }
4655         ma=(uint8*)origdir;
4656         mb=dir;
4657         for (n=0; n<dircount16; n++)
4658         {
4659                 if (tif->tif_flags&TIFF_SWAB)
4660                         TIFFSwabShort((uint16*)ma);
4661                 mb->tdir_tag=*(uint16*)ma;
4662                 ma+=sizeof(uint16);
4663                 if (tif->tif_flags&TIFF_SWAB)
4664                         TIFFSwabShort((uint16*)ma);
4665                 mb->tdir_type=*(uint16*)ma;
4666                 ma+=sizeof(uint16);
4667                 if (!(tif->tif_flags&TIFF_BIGTIFF))
4668                 {
4669                         if (tif->tif_flags&TIFF_SWAB)
4670                                 TIFFSwabLong((uint32*)ma);
4671                         mb->tdir_count=(uint64)(*(uint32*)ma);
4672                         ma+=sizeof(uint32);
4673                         *(uint32*)(&mb->tdir_offset)=*(uint32*)ma;
4674                         ma+=sizeof(uint32);
4675                 }
4676                 else
4677                 {
4678                         if (tif->tif_flags&TIFF_SWAB)
4679                                 TIFFSwabLong8((uint64*)ma);
4680                         mb->tdir_count=TIFFReadUInt64(ma);
4681                         ma+=sizeof(uint64);
4682                         mb->tdir_offset.toff_long8=TIFFReadUInt64(ma);
4683                         ma+=sizeof(uint64);
4684                 }
4685                 mb++;
4686         }
4687         _TIFFfree(origdir);
4688         *pdir = dir;
4689         return dircount16;
4690 }
4691
4692 /*
4693  * Fetch a tag that is not handled by special case code.
4694  */
4695 static int
4696 TIFFFetchNormalTag(TIFF* tif, TIFFDirEntry* dp, int recover)
4697 {
4698         static const char module[] = "TIFFFetchNormalTag";
4699         enum TIFFReadDirEntryErr err;
4700         uint32 fii;
4701         const TIFFField* fip = NULL;
4702         TIFFReadDirectoryFindFieldInfo(tif,dp->tdir_tag,&fii);
4703         if( fii == FAILED_FII )
4704         {
4705             TIFFErrorExt(tif->tif_clientdata, "TIFFFetchNormalTag",
4706                          "No definition found for tag %d",
4707                          dp->tdir_tag);
4708             return 0;
4709         }
4710         fip=tif->tif_fields[fii];
4711         assert(fip != NULL); /* should not happen */
4712         assert(fip->set_field_type!=TIFF_SETGET_OTHER);  /* if so, we shouldn't arrive here but deal with this in specialized code */
4713         assert(fip->set_field_type!=TIFF_SETGET_INT);    /* if so, we shouldn't arrive here as this is only the case for pseudo-tags */
4714         err=TIFFReadDirEntryErrOk;
4715         switch (fip->set_field_type)
4716         {
4717                 case TIFF_SETGET_UNDEFINED:
4718                         break;
4719                 case TIFF_SETGET_ASCII:
4720                         {
4721                                 uint8* data;
4722                                 assert(fip->field_passcount==0);
4723                                 err=TIFFReadDirEntryByteArray(tif,dp,&data);
4724                                 if (err==TIFFReadDirEntryErrOk)
4725                                 {
4726                                         uint8* ma;
4727                                         uint32 mb;
4728                                         int n;
4729                                         ma=data;
4730                                         mb=0;
4731                                         while (mb<(uint32)dp->tdir_count)
4732                                         {
4733                                                 if (*ma==0)
4734                                                         break;
4735                                                 ma++;
4736                                                 mb++;
4737                                         }
4738                                         if (mb+1<(uint32)dp->tdir_count)
4739                                                 TIFFWarningExt(tif->tif_clientdata,module,"ASCII value for tag \"%s\" contains null byte in value; value incorrectly truncated during reading due to implementation limitations",fip->field_name);
4740                                         else if (mb+1>(uint32)dp->tdir_count)
4741                                         {
4742                                                 uint8* o;
4743                                                 TIFFWarningExt(tif->tif_clientdata,module,"ASCII value for tag \"%s\" does not end in null byte",fip->field_name);
4744                                                 if ((uint32)dp->tdir_count+1!=dp->tdir_count+1)
4745                                                         o=NULL;
4746                                                 else
4747                                                         o=_TIFFmalloc((uint32)dp->tdir_count+1);
4748                                                 if (o==NULL)
4749                                                 {
4750                                                         if (data!=NULL)
4751                                                                 _TIFFfree(data);
4752                                                         return(0);
4753                                                 }
4754                                                 _TIFFmemcpy(o,data,(uint32)dp->tdir_count);
4755                                                 o[(uint32)dp->tdir_count]=0;
4756                                                 if (data!=0)
4757                                                         _TIFFfree(data);
4758                                                 data=o;
4759                                         }
4760                                         n=TIFFSetField(tif,dp->tdir_tag,data);
4761                                         if (data!=0)
4762                                                 _TIFFfree(data);
4763                                         if (!n)
4764                                                 return(0);
4765                                 }
4766                         }
4767                         break;
4768                 case TIFF_SETGET_UINT8:
4769                         {
4770                                 uint8 data=0;
4771                                 assert(fip->field_readcount==1);
4772                                 assert(fip->field_passcount==0);
4773                                 err=TIFFReadDirEntryByte(tif,dp,&data);
4774                                 if (err==TIFFReadDirEntryErrOk)
4775                                 {
4776                                         if (!TIFFSetField(tif,dp->tdir_tag,data))
4777                                                 return(0);
4778                                 }
4779                         }
4780                         break;
4781                 case TIFF_SETGET_UINT16:
4782                         {
4783                                 uint16 data;
4784                                 assert(fip->field_readcount==1);
4785                                 assert(fip->field_passcount==0);
4786                                 err=TIFFReadDirEntryShort(tif,dp,&data);
4787                                 if (err==TIFFReadDirEntryErrOk)
4788                                 {
4789                                         if (!TIFFSetField(tif,dp->tdir_tag,data))
4790                                                 return(0);
4791                                 }
4792                         }
4793                         break;
4794                 case TIFF_SETGET_UINT32:
4795                         {
4796                                 uint32 data;
4797                                 assert(fip->field_readcount==1);
4798                                 assert(fip->field_passcount==0);
4799                                 err=TIFFReadDirEntryLong(tif,dp,&data);
4800                                 if (err==TIFFReadDirEntryErrOk)
4801                                 {
4802                                         if (!TIFFSetField(tif,dp->tdir_tag,data))
4803                                                 return(0);
4804                                 }
4805                         }
4806                         break;
4807                 case TIFF_SETGET_UINT64:
4808                         {
4809                                 uint64 data;
4810                                 assert(fip->field_readcount==1);
4811                                 assert(fip->field_passcount==0);
4812                                 err=TIFFReadDirEntryLong8(tif,dp,&data);
4813                                 if (err==TIFFReadDirEntryErrOk)
4814                                 {
4815                                         if (!TIFFSetField(tif,dp->tdir_tag,data))
4816                                                 return(0);
4817                                 }
4818                         }
4819                         break;
4820                 case TIFF_SETGET_FLOAT:
4821                         {
4822                                 float data;
4823                                 assert(fip->field_readcount==1);
4824                                 assert(fip->field_passcount==0);
4825                                 err=TIFFReadDirEntryFloat(tif,dp,&data);
4826                                 if (err==TIFFReadDirEntryErrOk)
4827                                 {
4828                                         if (!TIFFSetField(tif,dp->tdir_tag,data))
4829                                                 return(0);
4830                                 }
4831                         }
4832                         break;
4833                 case TIFF_SETGET_DOUBLE:
4834                         {
4835                                 double data;
4836                                 assert(fip->field_readcount==1);
4837                                 assert(fip->field_passcount==0);
4838                                 err=TIFFReadDirEntryDouble(tif,dp,&data);
4839                                 if (err==TIFFReadDirEntryErrOk)
4840                                 {
4841                                         if (!TIFFSetField(tif,dp->tdir_tag,data))
4842                                                 return(0);
4843                                 }
4844                         }
4845                         break;
4846                 case TIFF_SETGET_IFD8:
4847                         {
4848                                 uint64 data;
4849                                 assert(fip->field_readcount==1);
4850                                 assert(fip->field_passcount==0);
4851                                 err=TIFFReadDirEntryIfd8(tif,dp,&data);
4852                                 if (err==TIFFReadDirEntryErrOk)
4853                                 {
4854                                         if (!TIFFSetField(tif,dp->tdir_tag,data))
4855                                                 return(0);
4856                                 }
4857                         }
4858                         break;
4859                 case TIFF_SETGET_UINT16_PAIR:
4860                         {
4861                                 uint16* data;
4862                                 assert(fip->field_readcount==2);
4863                                 assert(fip->field_passcount==0);
4864                                 if (dp->tdir_count!=2) {
4865                                         TIFFWarningExt(tif->tif_clientdata,module,
4866                                                        "incorrect count for field \"%s\", expected 2, got %d",
4867                                                        fip->field_name,(int)dp->tdir_count);
4868                                         return(0);
4869                                 }
4870                                 err=TIFFReadDirEntryShortArray(tif,dp,&data);
4871                                 if (err==TIFFReadDirEntryErrOk)
4872                                 {
4873                                         int m;
4874                                         m=TIFFSetField(tif,dp->tdir_tag,data[0],data[1]);
4875                                         _TIFFfree(data);
4876                                         if (!m)
4877                                                 return(0);
4878                                 }
4879                         }
4880                         break;
4881                 case TIFF_SETGET_C0_UINT8:
4882                         {
4883                                 uint8* data;
4884                                 assert(fip->field_readcount>=1);
4885                                 assert(fip->field_passcount==0);
4886                                 if (dp->tdir_count!=(uint64)fip->field_readcount) {
4887                                         TIFFWarningExt(tif->tif_clientdata,module,
4888                                                        "incorrect count for field \"%s\", expected %d, got %d",
4889                                                        fip->field_name,(int) fip->field_readcount, (int)dp->tdir_count);
4890                                         return 0;
4891                                 }
4892                                 else
4893                                 {
4894                                         err=TIFFReadDirEntryByteArray(tif,dp,&data);
4895                                         if (err==TIFFReadDirEntryErrOk)
4896                                         {
4897                                                 int m;
4898                                                 m=TIFFSetField(tif,dp->tdir_tag,data);
4899                                                 if (data!=0)
4900                                                         _TIFFfree(data);
4901                                                 if (!m)
4902                                                         return(0);
4903                                         }
4904                                 }
4905                         }
4906                         break;
4907                 case TIFF_SETGET_C0_UINT16:
4908                         {
4909                                 uint16* data;
4910                                 assert(fip->field_readcount>=1);
4911                                 assert(fip->field_passcount==0);
4912                                 if (dp->tdir_count!=(uint64)fip->field_readcount)
4913                                     /* corrupt file */;
4914                                 else
4915                                 {
4916                                         err=TIFFReadDirEntryShortArray(tif,dp,&data);
4917                                         if (err==TIFFReadDirEntryErrOk)
4918                                         {
4919                                                 int m;
4920                                                 m=TIFFSetField(tif,dp->tdir_tag,data);
4921                                                 if (data!=0)
4922                                                         _TIFFfree(data);
4923                                                 if (!m)
4924                                                         return(0);
4925                                         }
4926                                 }
4927                         }
4928                         break;
4929                 case TIFF_SETGET_C0_UINT32:
4930                         {
4931                                 uint32* data;
4932                                 assert(fip->field_readcount>=1);
4933                                 assert(fip->field_passcount==0);
4934                                 if (dp->tdir_count!=(uint64)fip->field_readcount)
4935                                     /* corrupt file */;
4936                                 else
4937                                 {
4938                                         err=TIFFReadDirEntryLongArray(tif,dp,&data);
4939                                         if (err==TIFFReadDirEntryErrOk)
4940                                         {
4941                                                 int m;
4942                                                 m=TIFFSetField(tif,dp->tdir_tag,data);
4943                                                 if (data!=0)
4944                                                         _TIFFfree(data);
4945                                                 if (!m)
4946                                                         return(0);
4947                                         }
4948                                 }
4949                         }
4950                         break;
4951                 case TIFF_SETGET_C0_FLOAT:
4952                         {
4953                                 float* data;
4954                                 assert(fip->field_readcount>=1);
4955                                 assert(fip->field_passcount==0);
4956                                 if (dp->tdir_count!=(uint64)fip->field_readcount)
4957                                     /* corrupt file */;
4958                                 else
4959                                 {
4960                                         err=TIFFReadDirEntryFloatArray(tif,dp,&data);
4961                                         if (err==TIFFReadDirEntryErrOk)
4962                                         {
4963                                                 int m;
4964                                                 m=TIFFSetField(tif,dp->tdir_tag,data);
4965                                                 if (data!=0)
4966                                                         _TIFFfree(data);
4967                                                 if (!m)
4968                                                         return(0);
4969                                         }
4970                                 }
4971                         }
4972                         break;
4973                 case TIFF_SETGET_C16_ASCII:
4974                         {
4975                                 uint8* data;
4976                                 assert(fip->field_readcount==TIFF_VARIABLE);
4977                                 assert(fip->field_passcount==1);
4978                                 if (dp->tdir_count>0xFFFF)
4979                                         err=TIFFReadDirEntryErrCount;
4980                                 else
4981                                 {
4982                                         err=TIFFReadDirEntryByteArray(tif,dp,&data);
4983                                         if (err==TIFFReadDirEntryErrOk)
4984                                         {
4985                                                 int m;
4986                                                 m=TIFFSetField(tif,dp->tdir_tag,(uint16)(dp->tdir_count),data);
4987                                                 if (data!=0)
4988                                                         _TIFFfree(data);
4989                                                 if (!m)
4990                                                         return(0);
4991                                         }
4992                                 }
4993                         }
4994                         break;
4995                 case TIFF_SETGET_C16_UINT8:
4996                         {
4997                                 uint8* data;
4998                                 assert(fip->field_readcount==TIFF_VARIABLE);
4999                                 assert(fip->field_passcount==1);
5000                                 if (dp->tdir_count>0xFFFF)
5001                                         err=TIFFReadDirEntryErrCount;
5002                                 else
5003                                 {
5004                                         err=TIFFReadDirEntryByteArray(tif,dp,&data);
5005                                         if (err==TIFFReadDirEntryErrOk)
5006                                         {
5007                                                 int m;
5008                                                 m=TIFFSetField(tif,dp->tdir_tag,(uint16)(dp->tdir_count),data);
5009                                                 if (data!=0)
5010                                                         _TIFFfree(data);
5011                                                 if (!m)
5012                                                         return(0);
5013                                         }
5014                                 }
5015                         }
5016                         break;
5017                 case TIFF_SETGET_C16_UINT16:
5018                         {
5019                                 uint16* data;
5020                                 assert(fip->field_readcount==TIFF_VARIABLE);
5021                                 assert(fip->field_passcount==1);
5022                                 if (dp->tdir_count>0xFFFF)
5023                                         err=TIFFReadDirEntryErrCount;
5024                                 else
5025                                 {
5026                                         err=TIFFReadDirEntryShortArray(tif,dp,&data);
5027                                         if (err==TIFFReadDirEntryErrOk)
5028                                         {
5029                                                 int m;
5030                                                 m=TIFFSetField(tif,dp->tdir_tag,(uint16)(dp->tdir_count),data);
5031                                                 if (data!=0)
5032                                                         _TIFFfree(data);
5033                                                 if (!m)
5034                                                         return(0);
5035                                         }
5036                                 }
5037                         }
5038                         break;
5039                 case TIFF_SETGET_C16_UINT32:
5040                         {
5041                                 uint32* data;
5042                                 assert(fip->field_readcount==TIFF_VARIABLE);
5043                                 assert(fip->field_passcount==1);
5044                                 if (dp->tdir_count>0xFFFF)
5045                                         err=TIFFReadDirEntryErrCount;
5046                                 else
5047                                 {
5048                                         err=TIFFReadDirEntryLongArray(tif,dp,&data);
5049                                         if (err==TIFFReadDirEntryErrOk)
5050                                         {
5051                                                 int m;
5052                                                 m=TIFFSetField(tif,dp->tdir_tag,(uint16)(dp->tdir_count),data);
5053                                                 if (data!=0)
5054                                                         _TIFFfree(data);
5055                                                 if (!m)
5056                                                         return(0);
5057                                         }
5058                                 }
5059                         }
5060                         break;
5061                 case TIFF_SETGET_C16_UINT64:
5062                         {
5063                                 uint64* data;
5064                                 assert(fip->field_readcount==TIFF_VARIABLE);
5065                                 assert(fip->field_passcount==1);
5066                                 if (dp->tdir_count>0xFFFF)
5067                                         err=TIFFReadDirEntryErrCount;
5068                                 else
5069                                 {
5070                                         err=TIFFReadDirEntryLong8Array(tif,dp,&data);
5071                                         if (err==TIFFReadDirEntryErrOk)
5072                                         {
5073                                                 int m;
5074                                                 m=TIFFSetField(tif,dp->tdir_tag,(uint16)(dp->tdir_count),data);
5075                                                 if (data!=0)
5076                                                         _TIFFfree(data);
5077                                                 if (!m)
5078                                                         return(0);
5079                                         }
5080                                 }
5081                         }
5082                         break;
5083                 case TIFF_SETGET_C16_FLOAT:
5084                         {
5085                                 float* data;
5086                                 assert(fip->field_readcount==TIFF_VARIABLE);
5087                                 assert(fip->field_passcount==1);
5088                                 if (dp->tdir_count>0xFFFF)
5089                                         err=TIFFReadDirEntryErrCount;
5090                                 else
5091                                 {
5092                                         err=TIFFReadDirEntryFloatArray(tif,dp,&data);
5093                                         if (err==TIFFReadDirEntryErrOk)
5094                                         {
5095                                                 int m;
5096                                                 m=TIFFSetField(tif,dp->tdir_tag,(uint16)(dp->tdir_count),data);
5097                                                 if (data!=0)
5098                                                         _TIFFfree(data);
5099                                                 if (!m)
5100                                                         return(0);
5101                                         }
5102                                 }
5103                         }
5104                         break;
5105                 case TIFF_SETGET_C16_DOUBLE:
5106                         {
5107                                 double* data;
5108                                 assert(fip->field_readcount==TIFF_VARIABLE);
5109                                 assert(fip->field_passcount==1);
5110                                 if (dp->tdir_count>0xFFFF)
5111                                         err=TIFFReadDirEntryErrCount;
5112                                 else
5113                                 {
5114                                         err=TIFFReadDirEntryDoubleArray(tif,dp,&data);
5115                                         if (err==TIFFReadDirEntryErrOk)
5116                                         {
5117                                                 int m;
5118                                                 m=TIFFSetField(tif,dp->tdir_tag,(uint16)(dp->tdir_count),data);
5119                                                 if (data!=0)
5120                                                         _TIFFfree(data);
5121                                                 if (!m)
5122                                                         return(0);
5123                                         }
5124                                 }
5125                         }
5126                         break;
5127                 case TIFF_SETGET_C16_IFD8:
5128                         {
5129                                 uint64* data;
5130                                 assert(fip->field_readcount==TIFF_VARIABLE);
5131                                 assert(fip->field_passcount==1);
5132                                 if (dp->tdir_count>0xFFFF)
5133                                         err=TIFFReadDirEntryErrCount;
5134                                 else
5135                                 {
5136                                         err=TIFFReadDirEntryIfd8Array(tif,dp,&data);
5137                                         if (err==TIFFReadDirEntryErrOk)
5138                                         {
5139                                                 int m;
5140                                                 m=TIFFSetField(tif,dp->tdir_tag,(uint16)(dp->tdir_count),data);
5141                                                 if (data!=0)
5142                                                         _TIFFfree(data);
5143                                                 if (!m)
5144                                                         return(0);
5145                                         }
5146                                 }
5147                         }
5148                         break;
5149                 case TIFF_SETGET_C32_ASCII:
5150                         {
5151                                 uint8* data;
5152                                 assert(fip->field_readcount==TIFF_VARIABLE2);
5153                                 assert(fip->field_passcount==1);
5154                                 err=TIFFReadDirEntryByteArray(tif,dp,&data);
5155                                 if (err==TIFFReadDirEntryErrOk)
5156                                 {
5157                                         int m;
5158                                         m=TIFFSetField(tif,dp->tdir_tag,(uint32)(dp->tdir_count),data);
5159                                         if (data!=0)
5160                                                 _TIFFfree(data);
5161                                         if (!m)
5162                                                 return(0);
5163                                 }
5164                         }
5165                         break;
5166                 case TIFF_SETGET_C32_UINT8:
5167                         {
5168                                 uint8* data;
5169                                 assert(fip->field_readcount==TIFF_VARIABLE2);
5170                                 assert(fip->field_passcount==1);
5171                                 err=TIFFReadDirEntryByteArray(tif,dp,&data);
5172                                 if (err==TIFFReadDirEntryErrOk)
5173                                 {
5174                                         int m;
5175                                         m=TIFFSetField(tif,dp->tdir_tag,(uint32)(dp->tdir_count),data);
5176                                         if (data!=0)
5177                                                 _TIFFfree(data);
5178                                         if (!m)
5179                                                 return(0);
5180                                 }
5181                         }
5182                         break;
5183                 case TIFF_SETGET_C32_SINT8:
5184                         {
5185                                 int8* data = NULL;
5186                                 assert(fip->field_readcount==TIFF_VARIABLE2);
5187                                 assert(fip->field_passcount==1);
5188                                 err=TIFFReadDirEntrySbyteArray(tif,dp,&data);
5189                                 if (err==TIFFReadDirEntryErrOk)
5190                                 {
5191                                         int m;
5192                                         m=TIFFSetField(tif,dp->tdir_tag,(uint32)(dp->tdir_count),data);
5193                                         if (data!=0)
5194                                                 _TIFFfree(data);
5195                                         if (!m)
5196                                                 return(0);
5197                                 }
5198                         }
5199                         break;
5200                 case TIFF_SETGET_C32_UINT16:
5201                         {
5202                                 uint16* data;
5203                                 assert(fip->field_readcount==TIFF_VARIABLE2);
5204                                 assert(fip->field_passcount==1);
5205                                 err=TIFFReadDirEntryShortArray(tif,dp,&data);
5206                                 if (err==TIFFReadDirEntryErrOk)
5207                                 {
5208                                         int m;
5209                                         m=TIFFSetField(tif,dp->tdir_tag,(uint32)(dp->tdir_count),data);
5210                                         if (data!=0)
5211                                                 _TIFFfree(data);
5212                                         if (!m)
5213                                                 return(0);
5214                                 }
5215                         }
5216                         break;
5217                 case TIFF_SETGET_C32_SINT16:
5218                         {
5219                                 int16* data = NULL;
5220                                 assert(fip->field_readcount==TIFF_VARIABLE2);
5221                                 assert(fip->field_passcount==1);
5222                                 err=TIFFReadDirEntrySshortArray(tif,dp,&data);
5223                                 if (err==TIFFReadDirEntryErrOk)
5224                                 {
5225                                         int m;
5226                                         m=TIFFSetField(tif,dp->tdir_tag,(uint32)(dp->tdir_count),data);
5227                                         if (data!=0)
5228                                                 _TIFFfree(data);
5229                                         if (!m)
5230                                                 return(0);
5231                                 }
5232                         }
5233                         break;
5234                 case TIFF_SETGET_C32_UINT32:
5235                         {
5236                                 uint32* data;
5237                                 assert(fip->field_readcount==TIFF_VARIABLE2);
5238                                 assert(fip->field_passcount==1);
5239                                 err=TIFFReadDirEntryLongArray(tif,dp,&data);
5240                                 if (err==TIFFReadDirEntryErrOk)
5241                                 {
5242                                         int m;
5243                                         m=TIFFSetField(tif,dp->tdir_tag,(uint32)(dp->tdir_count),data);
5244                                         if (data!=0)
5245                                                 _TIFFfree(data);
5246                                         if (!m)
5247                                                 return(0);
5248                                 }
5249                         }
5250                         break;
5251                 case TIFF_SETGET_C32_SINT32:
5252                         {
5253                                 int32* data = NULL;
5254                                 assert(fip->field_readcount==TIFF_VARIABLE2);
5255                                 assert(fip->field_passcount==1);
5256                                 err=TIFFReadDirEntrySlongArray(tif,dp,&data);
5257                                 if (err==TIFFReadDirEntryErrOk)
5258                                 {
5259                                         int m;
5260                                         m=TIFFSetField(tif,dp->tdir_tag,(uint32)(dp->tdir_count),data);
5261                                         if (data!=0)
5262                                                 _TIFFfree(data);
5263                                         if (!m)
5264                                                 return(0);
5265                                 }
5266                         }
5267                         break;
5268                 case TIFF_SETGET_C32_UINT64:
5269                         {
5270                                 uint64* data;
5271                                 assert(fip->field_readcount==TIFF_VARIABLE2);
5272                                 assert(fip->field_passcount==1);
5273                                 err=TIFFReadDirEntryLong8Array(tif,dp,&data);
5274                                 if (err==TIFFReadDirEntryErrOk)
5275                                 {
5276                                         int m;
5277                                         m=TIFFSetField(tif,dp->tdir_tag,(uint32)(dp->tdir_count),data);
5278                                         if (data!=0)
5279                                                 _TIFFfree(data);
5280                                         if (!m)
5281                                                 return(0);
5282                                 }
5283                         }
5284                         break;
5285                 case TIFF_SETGET_C32_SINT64:
5286                         {
5287                                 int64* data = NULL;
5288                                 assert(fip->field_readcount==TIFF_VARIABLE2);
5289                                 assert(fip->field_passcount==1);
5290                                 err=TIFFReadDirEntrySlong8Array(tif,dp,&data);
5291                                 if (err==TIFFReadDirEntryErrOk)
5292                                 {
5293                                         int m;
5294                                         m=TIFFSetField(tif,dp->tdir_tag,(uint32)(dp->tdir_count),data);
5295                                         if (data!=0)
5296                                                 _TIFFfree(data);
5297                                         if (!m)
5298                                                 return(0);
5299                                 }
5300                         }
5301                         break;
5302                 case TIFF_SETGET_C32_FLOAT:
5303                         {
5304                                 float* data;
5305                                 assert(fip->field_readcount==TIFF_VARIABLE2);
5306                                 assert(fip->field_passcount==1);
5307                                 err=TIFFReadDirEntryFloatArray(tif,dp,&data);
5308                                 if (err==TIFFReadDirEntryErrOk)
5309                                 {
5310                                         int m;
5311                                         m=TIFFSetField(tif,dp->tdir_tag,(uint32)(dp->tdir_count),data);
5312                                         if (data!=0)
5313                                                 _TIFFfree(data);
5314                                         if (!m)
5315                                                 return(0);
5316                                 }
5317                         }
5318                         break;
5319                 case TIFF_SETGET_C32_DOUBLE:
5320                         {
5321                                 double* data;
5322                                 assert(fip->field_readcount==TIFF_VARIABLE2);
5323                                 assert(fip->field_passcount==1);
5324                                 err=TIFFReadDirEntryDoubleArray(tif,dp,&data);
5325                                 if (err==TIFFReadDirEntryErrOk)
5326                                 {
5327                                         int m;
5328                                         m=TIFFSetField(tif,dp->tdir_tag,(uint32)(dp->tdir_count),data);
5329                                         if (data!=0)
5330                                                 _TIFFfree(data);
5331                                         if (!m)
5332                                                 return(0);
5333                                 }
5334                         }
5335                         break;
5336                 case TIFF_SETGET_C32_IFD8:
5337                         {
5338                                 uint64* data;
5339                                 assert(fip->field_readcount==TIFF_VARIABLE2);
5340                                 assert(fip->field_passcount==1);
5341                                 err=TIFFReadDirEntryIfd8Array(tif,dp,&data);
5342                                 if (err==TIFFReadDirEntryErrOk)
5343                                 {
5344                                         int m;
5345                                         m=TIFFSetField(tif,dp->tdir_tag,(uint32)(dp->tdir_count),data);
5346                                         if (data!=0)
5347                                                 _TIFFfree(data);
5348                                         if (!m)
5349                                                 return(0);
5350                                 }
5351                         }
5352                         break;
5353                 default:
5354                         assert(0);    /* we should never get here */
5355                         break;
5356         }
5357         if (err!=TIFFReadDirEntryErrOk)
5358         {
5359                 TIFFReadDirEntryOutputErr(tif,err,module,fip->field_name,recover);
5360                 return(0);
5361         }
5362         return(1);
5363 }
5364
5365 /*
5366  * Fetch a set of offsets or lengths.
5367  * While this routine says "strips", in fact it's also used for tiles.
5368  */
5369 static int
5370 TIFFFetchStripThing(TIFF* tif, TIFFDirEntry* dir, uint32 nstrips, uint64** lpp)
5371 {
5372         static const char module[] = "TIFFFetchStripThing";
5373         enum TIFFReadDirEntryErr err;
5374         uint64* data;
5375         err=TIFFReadDirEntryLong8Array(tif,dir,&data);
5376         if (err!=TIFFReadDirEntryErrOk)
5377         {
5378                 const TIFFField* fip = TIFFFieldWithTag(tif,dir->tdir_tag);
5379                 TIFFReadDirEntryOutputErr(tif,err,module,fip ? fip->field_name : "unknown tagname",0);
5380                 return(0);
5381         }
5382         if (dir->tdir_count!=(uint64)nstrips)
5383         {
5384                 uint64* resizeddata;
5385                 resizeddata=(uint64*)_TIFFCheckMalloc(tif,nstrips,sizeof(uint64),"for strip array");
5386                 if (resizeddata==0) {
5387                         _TIFFfree(data);
5388                         return(0);
5389                 }
5390                 if (dir->tdir_count<(uint64)nstrips)
5391                 {
5392                         _TIFFmemcpy(resizeddata,data,(uint32)dir->tdir_count*sizeof(uint64));
5393                         _TIFFmemset(resizeddata+(uint32)dir->tdir_count,0,(nstrips-(uint32)dir->tdir_count)*sizeof(uint64));
5394                 }
5395                 else
5396                         _TIFFmemcpy(resizeddata,data,nstrips*sizeof(uint64));
5397                 _TIFFfree(data);
5398                 data=resizeddata;
5399         }
5400         *lpp=data;
5401         return(1);
5402 }
5403
5404 /*
5405  * Fetch and set the SubjectDistance EXIF tag.
5406  */
5407 static int
5408 TIFFFetchSubjectDistance(TIFF* tif, TIFFDirEntry* dir)
5409 {
5410         static const char module[] = "TIFFFetchSubjectDistance";
5411         enum TIFFReadDirEntryErr err;
5412         UInt64Aligned_t m;
5413     m.l=0;
5414         assert(sizeof(double)==8);
5415         assert(sizeof(uint64)==8);
5416         assert(sizeof(uint32)==4);
5417         if (dir->tdir_count!=1)
5418                 err=TIFFReadDirEntryErrCount;
5419         else if (dir->tdir_type!=TIFF_RATIONAL)
5420                 err=TIFFReadDirEntryErrType;
5421         else
5422         {
5423                 if (!(tif->tif_flags&TIFF_BIGTIFF))
5424                 {
5425                         uint32 offset;
5426                         offset=*(uint32*)(&dir->tdir_offset);
5427                         if (tif->tif_flags&TIFF_SWAB)
5428                                 TIFFSwabLong(&offset);
5429                         err=TIFFReadDirEntryData(tif,offset,8,m.i);
5430                 }
5431                 else
5432                 {
5433                         m.l=dir->tdir_offset.toff_long8;
5434                         err=TIFFReadDirEntryErrOk;
5435                 }
5436         }
5437         if (err==TIFFReadDirEntryErrOk)
5438         {
5439                 double n;
5440                 if (tif->tif_flags&TIFF_SWAB)
5441                         TIFFSwabArrayOfLong(m.i,2);
5442                 if (m.i[0]==0)
5443                         n=0.0;
5444                 else if (m.i[0]==0xFFFFFFFF)
5445                         /*
5446                          * XXX: Numerator 0xFFFFFFFF means that we have infinite
5447                          * distance. Indicate that with a negative floating point
5448                          * SubjectDistance value.
5449                          */
5450                         n=-1.0;
5451                 else
5452                         n=(double)m.i[0]/(double)m.i[1];
5453                 return(TIFFSetField(tif,dir->tdir_tag,n));
5454         }
5455         else
5456         {
5457                 TIFFReadDirEntryOutputErr(tif,err,module,"SubjectDistance",TRUE);
5458                 return(0);
5459         }
5460 }
5461
5462 /*
5463  * Replace a single strip (tile) of uncompressed data by multiple strips
5464  * (tiles), each approximately STRIP_SIZE_DEFAULT bytes. This is useful for
5465  * dealing with large images or for dealing with machines with a limited
5466  * amount memory.
5467  */
5468 static void
5469 ChopUpSingleUncompressedStrip(TIFF* tif)
5470 {
5471         register TIFFDirectory *td = &tif->tif_dir;
5472         uint64 bytecount;
5473         uint64 offset;
5474         uint32 rowblock;
5475         uint64 rowblockbytes;
5476         uint64 stripbytes;
5477         uint32 strip;
5478         uint64 nstrips64;
5479         uint32 nstrips32;
5480         uint32 rowsperstrip;
5481         uint64* newcounts;
5482         uint64* newoffsets;
5483
5484         bytecount = td->td_stripbytecount[0];
5485         offset = td->td_stripoffset[0];
5486         assert(td->td_planarconfig == PLANARCONFIG_CONTIG);
5487         if ((td->td_photometric == PHOTOMETRIC_YCBCR)&&
5488             (!isUpSampled(tif)))
5489                 rowblock = td->td_ycbcrsubsampling[1];
5490         else
5491                 rowblock = 1;
5492         rowblockbytes = TIFFVTileSize64(tif, rowblock);
5493         /*
5494          * Make the rows hold at least one scanline, but fill specified amount
5495          * of data if possible.
5496          */
5497         if (rowblockbytes > STRIP_SIZE_DEFAULT) {
5498                 stripbytes = rowblockbytes;
5499                 rowsperstrip = rowblock;
5500         } else if (rowblockbytes > 0 ) {
5501                 uint32 rowblocksperstrip;
5502                 rowblocksperstrip = (uint32) (STRIP_SIZE_DEFAULT / rowblockbytes);
5503                 rowsperstrip = rowblocksperstrip * rowblock;
5504                 stripbytes = rowblocksperstrip * rowblockbytes;
5505         }
5506         else
5507             return;
5508
5509         /*
5510          * never increase the number of strips in an image
5511          */
5512         if (rowsperstrip >= td->td_rowsperstrip)
5513                 return;
5514         nstrips64 = TIFFhowmany_64(bytecount, stripbytes);
5515         if ((nstrips64==0)||(nstrips64>0xFFFFFFFF)) /* something is wonky, do nothing. */
5516             return;
5517         nstrips32 = (uint32)nstrips64;
5518
5519         newcounts = (uint64*) _TIFFCheckMalloc(tif, nstrips32, sizeof (uint64),
5520                                 "for chopped \"StripByteCounts\" array");
5521         newoffsets = (uint64*) _TIFFCheckMalloc(tif, nstrips32, sizeof (uint64),
5522                                 "for chopped \"StripOffsets\" array");
5523         if (newcounts == NULL || newoffsets == NULL) {
5524                 /*
5525                  * Unable to allocate new strip information, give up and use
5526                  * the original one strip information.
5527                  */
5528                 if (newcounts != NULL)
5529                         _TIFFfree(newcounts);
5530                 if (newoffsets != NULL)
5531                         _TIFFfree(newoffsets);
5532                 return;
5533         }
5534         /*
5535          * Fill the strip information arrays with new bytecounts and offsets
5536          * that reflect the broken-up format.
5537          */
5538         for (strip = 0; strip < nstrips32; strip++) {
5539                 if (stripbytes > bytecount)
5540                         stripbytes = bytecount;
5541                 newcounts[strip] = stripbytes;
5542                 newoffsets[strip] = offset;
5543                 offset += stripbytes;
5544                 bytecount -= stripbytes;
5545         }
5546         /*
5547          * Replace old single strip info with multi-strip info.
5548          */
5549         td->td_stripsperimage = td->td_nstrips = nstrips32;
5550         TIFFSetField(tif, TIFFTAG_ROWSPERSTRIP, rowsperstrip);
5551
5552         _TIFFfree(td->td_stripbytecount);
5553         _TIFFfree(td->td_stripoffset);
5554         td->td_stripbytecount = newcounts;
5555         td->td_stripoffset = newoffsets;
5556         td->td_stripbytecountsorted = 1;
5557 }
5558
5559 int _TIFFFillStriles( TIFF *tif )
5560 {
5561 #if defined(DEFER_STRILE_LOAD)
5562         register TIFFDirectory *td = &tif->tif_dir;
5563         int return_value = 1;
5564
5565         if( td->td_stripoffset != NULL )
5566                 return 1;
5567
5568         if( td->td_stripoffset_entry.tdir_count == 0 )
5569                 return 0;
5570
5571         if (!TIFFFetchStripThing(tif,&(td->td_stripoffset_entry),
5572                                  td->td_nstrips,&td->td_stripoffset))
5573         {
5574                 return_value = 0;
5575         }
5576
5577         if (!TIFFFetchStripThing(tif,&(td->td_stripbytecount_entry),
5578                                  td->td_nstrips,&td->td_stripbytecount))
5579         {
5580                 return_value = 0;
5581         }
5582
5583         _TIFFmemset( &(td->td_stripoffset_entry), 0, sizeof(TIFFDirEntry));
5584         _TIFFmemset( &(td->td_stripbytecount_entry), 0, sizeof(TIFFDirEntry));
5585
5586         if (tif->tif_dir.td_nstrips > 1 && return_value == 1 ) {
5587                 uint32 strip;
5588
5589                 tif->tif_dir.td_stripbytecountsorted = 1;
5590                 for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++) {
5591                         if (tif->tif_dir.td_stripoffset[strip - 1] >
5592                             tif->tif_dir.td_stripoffset[strip]) {
5593                                 tif->tif_dir.td_stripbytecountsorted = 0;
5594                                 break;
5595                         }
5596                 }
5597         }
5598
5599         return return_value;
5600 #else /* !defined(DEFER_STRILE_LOAD) */
5601         (void) tif;
5602         return 1;
5603 #endif
5604 }
5605
5606
5607 /* vim: set ts=8 sts=8 sw=8 noet: */
5608 /*
5609  * Local Variables:
5610  * mode: c
5611  * c-basic-offset: 8
5612  * fill-column: 78
5613  * End:
5614  */