[LIBTIFF]

[reactos.git] / reactos / dll / 3rdparty / libtiff / tif_luv.c

diff --git a/reactos/dll/3rdparty/libtiff/tif_luv.c b/reactos/dll/3rdparty/libtiff/tif_luv.c
index df483ad..d90e03e 100644 (file)
--- a/reactos/dll/3rdparty/libtiff/tif_luv.c
+++ b/reactos/dll/3rdparty/libtiff/tif_luv.c
@@ -1,4 +1,4 @@
-/* $Id: tif_luv.c,v 1.35 2011-04-02 20:54:09 bfriesen Exp $ */
+/* $Id: tif_luv.c,v 1.43 2016-09-04 21:32:56 erouault Exp $ */
 
 /*
  * Copyright (c) 1997 Greg Ward Larson
@@ -203,7 +203,11 @@ LogL16Decode(TIFF* tif, uint8* op, tmsize_t occ, uint16 s)
        if (sp->user_datafmt == SGILOGDATAFMT_16BIT)
                tp = (int16*) op;
        else {
-               assert(sp->tbuflen >= npixels);
+               if(sp->tbuflen < npixels) {
+                       TIFFErrorExt(tif->tif_clientdata, module,
+                                                "Translation buffer too short");
+                       return (0);
+               }
                tp = (int16*) sp->tbuf;
        }
        _TIFFmemset((void*) tp, 0, npixels*sizeof (tp[0]));
@@ -212,9 +216,11 @@ LogL16Decode(TIFF* tif, uint8* op, tmsize_t occ, uint16 s)
        cc = tif->tif_rawcc;
        /* get each byte string */
        for (shft = 2*8; (shft -= 8) >= 0; ) {
-               for (i = 0; i < npixels && cc > 0; )
+               for (i = 0; i < npixels && cc > 0; ) {
                        if (*bp >= 128) {               /* run */
-                               rc = *bp++ + (2-128);   /* TODO: potential input buffer overrun when decoding corrupt or truncated data */
+                               if( cc < 2 )
+                                       break;
+                               rc = *bp++ + (2-128);
                                b = (int16)(*bp++ << shft);
                                cc -= 2;
                                while (rc-- && i < npixels)
@@ -224,6 +230,7 @@ LogL16Decode(TIFF* tif, uint8* op, tmsize_t occ, uint16 s)
                                while (--cc && rc-- && i < npixels)
                                        tp[i++] |= (int16)*bp++ << shft;
                        }
+               }
                if (i != npixels) {
 #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
                        TIFFErrorExt(tif->tif_clientdata, module,
@@ -269,13 +276,17 @@ LogLuvDecode24(TIFF* tif, uint8* op, tmsize_t occ, uint16 s)
        if (sp->user_datafmt == SGILOGDATAFMT_RAW)
                tp = (uint32 *)op;
        else {
-               assert(sp->tbuflen >= npixels);
+               if(sp->tbuflen < npixels) {
+                       TIFFErrorExt(tif->tif_clientdata, module,
+                                                "Translation buffer too short");
+                       return (0);
+               }
                tp = (uint32 *) sp->tbuf;
        }
        /* copy to array of uint32 */
        bp = (unsigned char*) tif->tif_rawcp;
        cc = tif->tif_rawcc;
-       for (i = 0; i < npixels && cc > 0; i++) {
+       for (i = 0; i < npixels && cc >= 3; i++) {
                tp[i] = bp[0] << 16 | bp[1] << 8 | bp[2];
                bp += 3;
                cc -= 3;
@@ -326,7 +337,11 @@ LogLuvDecode32(TIFF* tif, uint8* op, tmsize_t occ, uint16 s)
        if (sp->user_datafmt == SGILOGDATAFMT_RAW)
                tp = (uint32*) op;
        else {
-               assert(sp->tbuflen >= npixels);
+               if(sp->tbuflen < npixels) {
+                       TIFFErrorExt(tif->tif_clientdata, module,
+                                                "Translation buffer too short");
+                       return (0);
+               }
                tp = (uint32*) sp->tbuf;
        }
        _TIFFmemset((void*) tp, 0, npixels*sizeof (tp[0]));
@@ -335,11 +350,13 @@ LogLuvDecode32(TIFF* tif, uint8* op, tmsize_t occ, uint16 s)
        cc = tif->tif_rawcc;
        /* get each byte string */
        for (shft = 4*8; (shft -= 8) >= 0; ) {
-               for (i = 0; i < npixels && cc > 0; )
+               for (i = 0; i < npixels && cc > 0; ) {
                        if (*bp >= 128) {               /* run */
+                               if( cc < 2 )
+                                       break;
                                rc = *bp++ + (2-128);
                                b = (uint32)*bp++ << shft;
-                               cc -= 2;                /* TODO: potential input buffer overrun when decoding corrupt or truncated data */
+                               cc -= 2;
                                while (rc-- && i < npixels)
                                        tp[i++] |= b;
                        } else {                        /* non-run */
@@ -347,6 +364,7 @@ LogLuvDecode32(TIFF* tif, uint8* op, tmsize_t occ, uint16 s)
                                while (--cc && rc-- && i < npixels)
                                        tp[i++] |= (uint32)*bp++ << shft;
                        }
+               }
                if (i != npixels) {
 #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
                        TIFFErrorExt(tif->tif_clientdata, module,
@@ -380,9 +398,14 @@ LogLuvDecodeStrip(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
 {
        tmsize_t rowlen = TIFFScanlineSize(tif);
 
+        if (rowlen == 0)
+                return 0;
+
        assert(cc%rowlen == 0);
-       while (cc && (*tif->tif_decoderow)(tif, bp, rowlen, s))
-               bp += rowlen, cc -= rowlen;
+       while (cc && (*tif->tif_decoderow)(tif, bp, rowlen, s)) {
+               bp += rowlen;
+               cc -= rowlen;
+       }
        return (cc == 0);
 }
 
@@ -396,9 +419,14 @@ LogLuvDecodeTile(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
 {
        tmsize_t rowlen = TIFFTileRowSize(tif);
 
+        if (rowlen == 0)
+                return 0;
+
        assert(cc%rowlen == 0);
-       while (cc && (*tif->tif_decoderow)(tif, bp, rowlen, s))
-               bp += rowlen, cc -= rowlen;
+       while (cc && (*tif->tif_decoderow)(tif, bp, rowlen, s)) {
+               bp += rowlen;
+               cc -= rowlen;
+       }
        return (cc == 0);
 }
 
@@ -408,6 +436,7 @@ LogLuvDecodeTile(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
 static int
 LogL16Encode(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
 {
+       static const char module[] = "LogL16Encode";
        LogLuvState* sp = EncoderState(tif);
        int shft;
        tmsize_t i;
@@ -428,7 +457,11 @@ LogL16Encode(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
                tp = (int16*) bp;
        else {
                tp = (int16*) sp->tbuf;
-               assert(sp->tbuflen >= npixels);
+               if(sp->tbuflen < npixels) {
+                       TIFFErrorExt(tif->tif_clientdata, module,
+                                                "Translation buffer too short");
+                       return (0);
+               }
                (*sp->tfunc)(sp, bp, npixels);
        }
        /* compress each byte string */
@@ -501,6 +534,7 @@ LogL16Encode(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
 static int
 LogLuvEncode24(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
 {
+       static const char module[] = "LogLuvEncode24";
        LogLuvState* sp = EncoderState(tif);
        tmsize_t i;
        tmsize_t npixels;
@@ -516,7 +550,11 @@ LogLuvEncode24(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
                tp = (uint32*) bp;
        else {
                tp = (uint32*) sp->tbuf;
-               assert(sp->tbuflen >= npixels);
+               if(sp->tbuflen < npixels) {
+                       TIFFErrorExt(tif->tif_clientdata, module,
+                                                "Translation buffer too short");
+                       return (0);
+               }
                (*sp->tfunc)(sp, bp, npixels);
        }
        /* write out encoded pixels */
@@ -548,6 +586,7 @@ LogLuvEncode24(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
 static int
 LogLuvEncode32(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
 {
+       static const char module[] = "LogLuvEncode32";
        LogLuvState* sp = EncoderState(tif);
        int shft;
        tmsize_t i;
@@ -569,7 +608,11 @@ LogLuvEncode32(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
                tp = (uint32*) bp;
        else {
                tp = (uint32*) sp->tbuf;
-               assert(sp->tbuflen >= npixels);
+               if(sp->tbuflen < npixels) {
+                       TIFFErrorExt(tif->tif_clientdata, module,
+                                                "Translation buffer too short");
+                       return (0);
+               }
                (*sp->tfunc)(sp, bp, npixels);
        }
        /* compress each byte string */
@@ -645,9 +688,14 @@ LogLuvEncodeStrip(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
 {
        tmsize_t rowlen = TIFFScanlineSize(tif);
 
+        if (rowlen == 0)
+                return 0;
+
        assert(cc%rowlen == 0);
-       while (cc && (*tif->tif_encoderow)(tif, bp, rowlen, s) == 1)
-               bp += rowlen, cc -= rowlen;
+       while (cc && (*tif->tif_encoderow)(tif, bp, rowlen, s) == 1) {
+               bp += rowlen;
+               cc -= rowlen;
+       }
        return (cc == 0);
 }
 
@@ -660,9 +708,14 @@ LogLuvEncodeTile(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
 {
        tmsize_t rowlen = TIFFTileRowSize(tif);
 
+        if (rowlen == 0)
+                return 0;
+
        assert(cc%rowlen == 0);
-       while (cc && (*tif->tif_encoderow)(tif, bp, rowlen, s) == 1)
-               bp += rowlen, cc -= rowlen;
+       while (cc && (*tif->tif_encoderow)(tif, bp, rowlen, s) == 1) {
+               bp += rowlen;
+               cc -= rowlen;
+       }
        return (cc == 0);
 }
 
@@ -684,7 +737,9 @@ LogLuvEncodeTile(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
 #ifndef M_PI
 #define M_PI           3.14159265358979323846
 #endif
+#undef log2 /* Conflict with C'99 function */
 #define log2(x)                ((1./M_LN2)*log(x))
+#undef exp2  /* Conflict with C'99 function */
 #define exp2(x)                exp(M_LN2*(x))
 
 #define itrunc(x,m)    ((m)==SGILOGENCODE_NODITHER ? \
@@ -1230,6 +1285,14 @@ LogL16InitState(TIFF* tif)
        assert(sp != NULL);
        assert(td->td_photometric == PHOTOMETRIC_LOGL);
 
+       if( td->td_samplesperpixel != 1 )
+       {
+               TIFFErrorExt(tif->tif_clientdata, module,
+                            "Sorry, can not handle LogL image with %s=%d",
+                            "Samples/pixel", td->td_samplesperpixel);
+               return 0;
+       }
+
        /* for some reason, we can't do this in TIFFInitLogL16 */
        if (sp->user_datafmt == SGILOGDATAFMT_UNKNOWN)
                sp->user_datafmt = LogL16GuessDataFmt(td);
@@ -1552,17 +1615,21 @@ LogLuvVSetField(TIFF* tif, uint32 tag, va_list ap)
                 */
                switch (sp->user_datafmt) {
                case SGILOGDATAFMT_FLOAT:
-                       bps = 32, fmt = SAMPLEFORMAT_IEEEFP;
+                       bps = 32;
+                       fmt = SAMPLEFORMAT_IEEEFP;
                        break;
                case SGILOGDATAFMT_16BIT:
-                       bps = 16, fmt = SAMPLEFORMAT_INT;
+                       bps = 16;
+                       fmt = SAMPLEFORMAT_INT;
                        break;
                case SGILOGDATAFMT_RAW:
-                       bps = 32, fmt = SAMPLEFORMAT_UINT;
+                       bps = 32;
+                       fmt = SAMPLEFORMAT_UINT;
                        TIFFSetField(tif, TIFFTAG_SAMPLESPERPIXEL, 1);
                        break;
                case SGILOGDATAFMT_8BIT:
-                       bps = 8, fmt = SAMPLEFORMAT_UINT;
+                       bps = 8;
+                       fmt = SAMPLEFORMAT_UINT;
                        break;
                default:
                        TIFFErrorExt(tif->tif_clientdata, tif->tif_name,