Skip to content

Commit a04f1e0

Browse files
rouaultrouault
committed
Internal libtiff: resync with upstream
1 parent 1f5f4ed commit a04f1e0

File tree

6 files changed

+57
-59
lines changed

6 files changed

+57
-59
lines changed

‎frmts/gtiff/libtiff/tif_dirread.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8245,15 +8245,15 @@ static int _TIFFPartialReadStripArray(TIFF *tif, TIFFDirEntry *dirent,
82458245
panVals[strile] = 0;
82468246
return 0;
82478247
}
8248-
nOffset = nBaseOffset + sizeofval * strile;
8248+
nOffset = nBaseOffset + (uint64_t)sizeofval * strile;
82498249
nOffsetStartPage = (nOffset / IO_CACHE_PAGE_SIZE) * IO_CACHE_PAGE_SIZE;
82508250
nOffsetEndPage = nOffsetStartPage + IO_CACHE_PAGE_SIZE;
82518251

82528252
if (nOffset + sizeofval > nOffsetEndPage)
82538253
nOffsetEndPage += IO_CACHE_PAGE_SIZE;
82548254
#undef IO_CACHE_PAGE_SIZE
82558255

8256-
nLastStripOffset = nBaseOffset + arraySize * sizeofval;
8256+
nLastStripOffset = nBaseOffset + (uint64_t)arraySize * sizeofval;
82578257
if (nLastStripOffset < nOffsetEndPage)
82588258
nOffsetEndPage = nLastStripOffset;
82598259
if (nOffsetStartPage >= nOffsetEndPage)

‎frmts/gtiff/libtiff/tif_getimage.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -787,7 +787,7 @@ static int gtTileContig(TIFFRGBAImage *img, uint32_t *raster, uint32_t w,
787787
}
788788
else
789789
{
790-
if (tw > ((int64_t)INT_MAX + w))
790+
if (tw > ((int64_t)INT_MAX + w) || w > ((int64_t)INT_MAX + tw))
791791
{
792792
TIFFErrorExtR(tif, TIFFFileName(tif), "%s",
793793
"unsupported tile size (too wide)");
@@ -962,7 +962,7 @@ static int gtTileSeparate(TIFFRGBAImage *img, uint32_t *raster, uint32_t w,
962962
}
963963
else
964964
{
965-
if (tw > ((int64_t)INT_MAX + w))
965+
if (tw > ((int64_t)INT_MAX + w) || w > ((int64_t)INT_MAX + tw))
966966
{
967967
TIFFErrorExtR(tif, TIFFFileName(tif), "%s",
968968
"unsupported tile size (too wide)");

‎frmts/gtiff/libtiff/tif_strip.c‎

Lines changed: 30 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -83,14 +83,24 @@ uint32_t TIFFNumberOfStrips(TIFF *tif)
8383
}
8484

8585
/*
86-
* Compute the # bytes in a variable height, row-aligned strip.
86+
* Compute the # bytes in a variable height, row-aligned strip if isStrip is
87+
* TRUE, or in a tile if isStrip is FALSE
8788
*/
88-
uint64_t TIFFVStripSize64(TIFF *tif, uint32_t nrows)
89+
uint64_t _TIFFStrileSize64(TIFF *tif, uint32_t nrows, int isStrip)
8990
{
90-
static const char module[] = "TIFFVStripSize64";
91+
static const char module[] = "_TIFFStrileSize64";
9192
TIFFDirectory *td = &tif->tif_dir;
92-
if (nrows == (uint32_t)(-1))
93-
nrows = td->td_imagelength;
93+
if (isStrip)
94+
{
95+
if (nrows == (uint32_t)(-1))
96+
nrows = td->td_imagelength;
97+
}
98+
else
99+
{
100+
if (td->td_tilelength == 0 || td->td_tilewidth == 0 ||
101+
td->td_tiledepth == 0)
102+
return (0);
103+
}
94104
if ((td->td_planarconfig == PLANARCONFIG_CONTIG) &&
95105
(td->td_photometric == PHOTOMETRIC_YCBCR) && (!isUpSampled(tif)))
96106
{
@@ -126,8 +136,8 @@ uint64_t TIFFVStripSize64(TIFF *tif, uint32_t nrows)
126136
return 0;
127137
}
128138
samplingblock_samples = ycbcrsubsampling[0] * ycbcrsubsampling[1] + 2;
129-
samplingblocks_hor =
130-
TIFFhowmany_32(td->td_imagewidth, ycbcrsubsampling[0]);
139+
const uint32_t width = isStrip ? td->td_imagewidth : td->td_tilewidth;
140+
samplingblocks_hor = TIFFhowmany_32(width, ycbcrsubsampling[0]);
131141
samplingblocks_ver = TIFFhowmany_32(nrows, ycbcrsubsampling[1]);
132142
samplingrow_samples = _TIFFMultiply64(tif, samplingblocks_hor,
133143
samplingblock_samples, module);
@@ -137,8 +147,20 @@ uint64_t TIFFVStripSize64(TIFF *tif, uint32_t nrows)
137147
_TIFFMultiply64(tif, samplingrow_size, samplingblocks_ver, module));
138148
}
139149
else
140-
return (_TIFFMultiply64(tif, nrows, TIFFScanlineSize64(tif), module));
150+
return (_TIFFMultiply64(tif, nrows,
151+
isStrip ? TIFFScanlineSize64(tif)
152+
: TIFFTileRowSize64(tif),
153+
module));
141154
}
155+
156+
/*
157+
* Compute the # bytes in a variable height, row-aligned strip.
158+
*/
159+
uint64_t TIFFVStripSize64(TIFF *tif, uint32_t nrows)
160+
{
161+
return _TIFFStrileSize64(tif, nrows, /* isStrip = */ TRUE);
162+
}
163+
142164
tmsize_t TIFFVStripSize(TIFF *tif, uint32_t nrows)
143165
{
144166
static const char module[] = "TIFFVStripSize";

‎frmts/gtiff/libtiff/tif_tile.c‎

Lines changed: 2 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -187,54 +187,9 @@ tmsize_t TIFFTileRowSize(TIFF *tif)
187187
*/
188188
uint64_t TIFFVTileSize64(TIFF *tif, uint32_t nrows)
189189
{
190-
static const char module[] = "TIFFVTileSize64";
191-
TIFFDirectory *td = &tif->tif_dir;
192-
if (td->td_tilelength == 0 || td->td_tilewidth == 0 ||
193-
td->td_tiledepth == 0)
194-
return (0);
195-
if ((td->td_planarconfig == PLANARCONFIG_CONTIG) &&
196-
(td->td_photometric == PHOTOMETRIC_YCBCR) &&
197-
(td->td_samplesperpixel == 3) && (!isUpSampled(tif)))
198-
{
199-
/*
200-
* Packed YCbCr data contain one Cb+Cr for every
201-
* HorizontalSampling*VerticalSampling Y values.
202-
* Must also roundup width and height when calculating
203-
* since images that are not a multiple of the
204-
* horizontal/vertical subsampling area include
205-
* YCbCr data for the extended image.
206-
*/
207-
uint16_t ycbcrsubsampling[2];
208-
uint16_t samplingblock_samples;
209-
uint32_t samplingblocks_hor;
210-
uint32_t samplingblocks_ver;
211-
uint64_t samplingrow_samples;
212-
uint64_t samplingrow_size;
213-
TIFFGetFieldDefaulted(tif, TIFFTAG_YCBCRSUBSAMPLING,
214-
ycbcrsubsampling + 0, ycbcrsubsampling + 1);
215-
if ((ycbcrsubsampling[0] != 1 && ycbcrsubsampling[0] != 2 &&
216-
ycbcrsubsampling[0] != 4) ||
217-
(ycbcrsubsampling[1] != 1 && ycbcrsubsampling[1] != 2 &&
218-
ycbcrsubsampling[1] != 4))
219-
{
220-
TIFFErrorExtR(tif, module, "Invalid YCbCr subsampling (%dx%d)",
221-
ycbcrsubsampling[0], ycbcrsubsampling[1]);
222-
return 0;
223-
}
224-
samplingblock_samples = ycbcrsubsampling[0] * ycbcrsubsampling[1] + 2;
225-
samplingblocks_hor =
226-
TIFFhowmany_32(td->td_tilewidth, ycbcrsubsampling[0]);
227-
samplingblocks_ver = TIFFhowmany_32(nrows, ycbcrsubsampling[1]);
228-
samplingrow_samples = _TIFFMultiply64(tif, samplingblocks_hor,
229-
samplingblock_samples, module);
230-
samplingrow_size = TIFFhowmany8_64(_TIFFMultiply64(
231-
tif, samplingrow_samples, td->td_bitspersample, module));
232-
return (
233-
_TIFFMultiply64(tif, samplingrow_size, samplingblocks_ver, module));
234-
}
235-
else
236-
return (_TIFFMultiply64(tif, nrows, TIFFTileRowSize64(tif), module));
190+
return _TIFFStrileSize64(tif, nrows, /* isStrip = */ FALSE);
237191
}
192+
238193
tmsize_t TIFFVTileSize(TIFF *tif, uint32_t nrows)
239194
{
240195
static const char module[] = "TIFFVTileSize";

‎frmts/gtiff/libtiff/tif_write.c‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,8 @@
3232

3333
#define STRIPINCR 20 /* expansion factor on strip array */
3434

35+
#define NOSTRIP ((uint32_t)(-1)) /* undefined state */
36+
3537
#define WRITECHECKSTRIPS(tif, module) \
3638
(((tif)->tif_flags & TIFF_BEENWRITING) || TIFFWriteCheck((tif), 0, module))
3739
#define WRITECHECKTILES(tif, module) \
@@ -769,6 +771,23 @@ static int TIFFAppendToStrip(TIFF *tif, uint32_t strip, uint8_t *data,
769771
uint64_t m;
770772
int64_t old_byte_count = -1;
771773

774+
/* Some security checks */
775+
if (td->td_stripoffset_p == NULL)
776+
{
777+
TIFFErrorExtR(tif, module, "Strip offset array pointer is NULL");
778+
return (0);
779+
}
780+
if (td->td_stripbytecount_p == NULL)
781+
{
782+
TIFFErrorExtR(tif, module, "Strip bytecount array pointer is NULL");
783+
return (0);
784+
}
785+
if (strip == NOSTRIP)
786+
{
787+
TIFFErrorExtR(tif, module, "Strip number not valid (NOSTRIP)");
788+
return (0);
789+
}
790+
772791
if (tif->tif_curoff == 0)
773792
tif->tif_lastvalidoff = 0;
774793

‎frmts/gtiff/libtiff/tiffiop.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -477,6 +477,8 @@ extern "C"
477477

478478
extern void _TIFFCleanupIFDOffsetAndNumberMaps(TIFF *tif);
479479

480+
extern uint64_t _TIFFStrileSize64(TIFF *tif, uint32_t nrows, int isStrip);
481+
480482
extern tmsize_t _TIFFReadEncodedStripAndAllocBuffer(TIFF *tif,
481483
uint32_t strip,
482484
void **buf,

0 commit comments

Comments
 (0)