src/SDL2/external/tiff-4.0.3/libtiff/tif_dirread.c

   1 /* $Id: tif_dirread.c,v 1.178 2012-08-19 16:56:34 bfriesen Exp $ */
   2
   3 /*
   4  * Copyright (c) 1988-1997 Sam Leffler
   5  * Copyright (c) 1991-1997 Silicon Graphics, Inc.
   6  *
   7  * Permission to use, copy, modify, distribute, and sell this software and
   8  * its documentation for any purpose is hereby granted without fee, provided
   9  * that (i) the above copyright notices and this permission notice appear in
  10  * all copies of the software and related documentation, and (ii) the names of
  11  * Sam Leffler and Silicon Graphics may not be used in any advertising or
  12  * publicity relating to the software without the specific, prior written
  13  * permission of Sam Leffler and Silicon Graphics.
  14  *
  15  * THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND,
  16  * EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY
  17  * WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
  18  *
  19  * IN NO EVENT SHALL SAM LEFFLER OR SILICON GRAPHICS BE LIABLE FOR
  20  * ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND,
  21  * OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
  22  * WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF
  23  * LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
  24  * OF THIS SOFTWARE.
  25  */
  26
  27 /*
  28  * TIFF Library.
  29  *
  30  * Directory Read Support Routines.
  31  */
  32
  33 /* Suggested pending improvements:
  34  * - add a field 'ignore' to the TIFFDirEntry structure, to flag status,
  35  *   eliminating current use of the IGNORE value, and therefore eliminating
  36  *   current irrational behaviour on tags with tag id code 0
  37  * - add a field 'field_info' to the TIFFDirEntry structure, and set that with
  38  *   the pointer to the appropriate TIFFField structure early on in
  39  *   TIFFReadDirectory, so as to eliminate current possibly repetitive lookup.
  40  */
  41
  42 #include "tiffiop.h"
  43
  44 #define IGNORE 0          /* tag placeholder used below */
  45 #define FAILED_FII    ((uint32) -1)
  46
  47 #ifdef HAVE_IEEEFP
  48 # define TIFFCvtIEEEFloatToNative(tif, n, fp)
  49 # define TIFFCvtIEEEDoubleToNative(tif, n, dp)
  50 #else
  51 extern void TIFFCvtIEEEFloatToNative(TIFF*, uint32, float*);
  52 extern void TIFFCvtIEEEDoubleToNative(TIFF*, uint32, double*);
  53 #endif
  54
  55 enum TIFFReadDirEntryErr {
  56         TIFFReadDirEntryErrOk = 0,
  57         TIFFReadDirEntryErrCount = 1,
  58         TIFFReadDirEntryErrType = 2,
  59         TIFFReadDirEntryErrIo = 3,
  60         TIFFReadDirEntryErrRange = 4,
  61         TIFFReadDirEntryErrPsdif = 5,
  62         TIFFReadDirEntryErrSizesan = 6,
  63         TIFFReadDirEntryErrAlloc = 7,
  64 };
  65
  66 static enum TIFFReadDirEntryErr TIFFReadDirEntryByte(TIFF* tif, TIFFDirEntry* direntry, uint8* value);
  67 static enum TIFFReadDirEntryErr TIFFReadDirEntryShort(TIFF* tif, TIFFDirEntry* direntry, uint16* value);
  68 static enum TIFFReadDirEntryErr TIFFReadDirEntryLong(TIFF* tif, TIFFDirEntry* direntry, uint32* value);
  69 static enum TIFFReadDirEntryErr TIFFReadDirEntryLong8(TIFF* tif, TIFFDirEntry* direntry, uint64* value);
  70 static enum TIFFReadDirEntryErr TIFFReadDirEntryFloat(TIFF* tif, TIFFDirEntry* direntry, float* value);
  71 static enum TIFFReadDirEntryErr TIFFReadDirEntryDouble(TIFF* tif, TIFFDirEntry* direntry, double* value);
  72 static enum TIFFReadDirEntryErr TIFFReadDirEntryIfd8(TIFF* tif, TIFFDirEntry* direntry, uint64* value);
  73
  74 static enum TIFFReadDirEntryErr TIFFReadDirEntryArray(TIFF* tif, TIFFDirEntry* direntry, uint32* count, uint32 desttypesize, void** value);
  75 static enum TIFFReadDirEntryErr TIFFReadDirEntryByteArray(TIFF* tif, TIFFDirEntry* direntry, uint8** value);
  76 static enum TIFFReadDirEntryErr TIFFReadDirEntrySbyteArray(TIFF* tif, TIFFDirEntry* direntry, int8** value);
  77 static enum TIFFReadDirEntryErr TIFFReadDirEntryShortArray(TIFF* tif, TIFFDirEntry* direntry, uint16** value);
  78 static enum TIFFReadDirEntryErr TIFFReadDirEntrySshortArray(TIFF* tif, TIFFDirEntry* direntry, int16** value);
  79 static enum TIFFReadDirEntryErr TIFFReadDirEntryLongArray(TIFF* tif, TIFFDirEntry* direntry, uint32** value);
  80 static enum TIFFReadDirEntryErr TIFFReadDirEntrySlongArray(TIFF* tif, TIFFDirEntry* direntry, int32** value);
  81 static enum TIFFReadDirEntryErr TIFFReadDirEntryLong8Array(TIFF* tif, TIFFDirEntry* direntry, uint64** value);
  82 static enum TIFFReadDirEntryErr TIFFReadDirEntrySlong8Array(TIFF* tif, TIFFDirEntry* direntry, int64** value);
  83 static enum TIFFReadDirEntryErr TIFFReadDirEntryFloatArray(TIFF* tif, TIFFDirEntry* direntry, float** value);
  84 static enum TIFFReadDirEntryErr TIFFReadDirEntryDoubleArray(TIFF* tif, TIFFDirEntry* direntry, double** value);
  85 static enum TIFFReadDirEntryErr TIFFReadDirEntryIfd8Array(TIFF* tif, TIFFDirEntry* direntry, uint64** value);
  86
  87 static enum TIFFReadDirEntryErr TIFFReadDirEntryPersampleShort(TIFF* tif, TIFFDirEntry* direntry, uint16* value);
  88 #if 0
  89 static enum TIFFReadDirEntryErr TIFFReadDirEntryPersampleDouble(TIFF* tif, TIFFDirEntry* direntry, double* value);
  90 #endif
  91
  92 static void TIFFReadDirEntryCheckedByte(TIFF* tif, TIFFDirEntry* direntry, uint8* value);
  93 static void TIFFReadDirEntryCheckedSbyte(TIFF* tif, TIFFDirEntry* direntry, int8* value);
  94 static void TIFFReadDirEntryCheckedShort(TIFF* tif, TIFFDirEntry* direntry, uint16* value);
  95 static void TIFFReadDirEntryCheckedSshort(TIFF* tif, TIFFDirEntry* direntry, int16* value);
  96 static void TIFFReadDirEntryCheckedLong(TIFF* tif, TIFFDirEntry* direntry, uint32* value);
  97 static void TIFFReadDirEntryCheckedSlong(TIFF* tif, TIFFDirEntry* direntry, int32* value);
  98 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedLong8(TIFF* tif, TIFFDirEntry* direntry, uint64* value);
  99 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedSlong8(TIFF* tif, TIFFDirEntry* direntry, int64* value);
 100 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedRational(TIFF* tif, TIFFDirEntry* direntry, double* value);
 101 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedSrational(TIFF* tif, TIFFDirEntry* direntry, double* value);
 102 static void TIFFReadDirEntryCheckedFloat(TIFF* tif, TIFFDirEntry* direntry, float* value);
 103 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedDouble(TIFF* tif, TIFFDirEntry* direntry, double* value);
 104
 105 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSbyte(int8 value);
 106 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteShort(uint16 value);
 107 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSshort(int16 value);
 108 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteLong(uint32 value);
 109 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSlong(int32 value);
 110 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteLong8(uint64 value);
 111 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSlong8(int64 value);
 112
 113 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteByte(uint8 value);
 114 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteShort(uint16 value);
 115 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteSshort(int16 value);
 116 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteLong(uint32 value);
 117 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteSlong(int32 value);
 118 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteLong8(uint64 value);
 119 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteSlong8(int64 value);
 120
 121 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSbyte(int8 value);
 122 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSshort(int16 value);
 123 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortLong(uint32 value);
 124 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSlong(int32 value);
 125 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortLong8(uint64 value);
 126 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSlong8(int64 value);
 127
 128 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortShort(uint16 value);
 129 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortLong(uint32 value);
 130 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortSlong(int32 value);
 131 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortLong8(uint64 value);
 132 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortSlong8(int64 value);
 133
 134 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongSbyte(int8 value);
 135 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongSshort(int16 value);
 136 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongSlong(int32 value);
 137 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongLong8(uint64 value);
 138 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongSlong8(int64 value);
 139
 140 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSlongLong(uint32 value);
 141 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSlongLong8(uint64 value);
 142 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSlongSlong8(int64 value);
 143
 144 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLong8Sbyte(int8 value);
 145 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLong8Sshort(int16 value);
 146 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLong8Slong(int32 value);
 147 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLong8Slong8(int64 value);
 148
 149 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSlong8Long8(uint64 value);
 150
 151 static enum TIFFReadDirEntryErr TIFFReadDirEntryData(TIFF* tif, uint64 offset, tmsize_t size, void* dest);
 152 static void TIFFReadDirEntryOutputErr(TIFF* tif, enum TIFFReadDirEntryErr err, const char* module, const char* tagname, int recover);
 153
 154 static void TIFFReadDirectoryCheckOrder(TIFF* tif, TIFFDirEntry* dir, uint16 dircount);
 155 static TIFFDirEntry* TIFFReadDirectoryFindEntry(TIFF* tif, TIFFDirEntry* dir, uint16 dircount, uint16 tagid);
 156 static void TIFFReadDirectoryFindFieldInfo(TIFF* tif, uint16 tagid, uint32* fii);
 157
 158 static int EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount);
 159 static void MissingRequired(TIFF*, const char*);
 160 static int TIFFCheckDirOffset(TIFF* tif, uint64 diroff);
 161 static int CheckDirCount(TIFF*, TIFFDirEntry*, uint32);
 162 static uint16 TIFFFetchDirectory(TIFF* tif, uint64 diroff, TIFFDirEntry** pdir, uint64* nextdiroff);
 163 static int TIFFFetchNormalTag(TIFF*, TIFFDirEntry*, int recover);
 164 static int TIFFFetchStripThing(TIFF* tif, TIFFDirEntry* dir, uint32 nstrips, uint64** lpp);
 165 static int TIFFFetchSubjectDistance(TIFF*, TIFFDirEntry*);
 166 static void ChopUpSingleUncompressedStrip(TIFF*);
 167 static uint64 TIFFReadUInt64(const uint8 *value);
 168
 169 typedef union _UInt64Aligned_t
 170 {
 171         double d;
 172         uint64 l;
 173         uint32 i[2];
 174         uint16 s[4];
 175         uint8  c[8];
 176 } UInt64Aligned_t;
 177
 178 /*
 179   Unaligned safe copy of a uint64 value from an octet array.
 180 */
 181 static uint64 TIFFReadUInt64(const uint8 *value)
 182 {
 183         UInt64Aligned_t result;
 184
 185         result.c[0]=value[0];
 186         result.c[1]=value[1];
 187         result.c[2]=value[2];
 188         result.c[3]=value[3];
 189         result.c[4]=value[4];
 190         result.c[5]=value[5];
 191         result.c[6]=value[6];
 192         result.c[7]=value[7];
 193
 194         return result.l;
 195 }
 196
 197 static enum TIFFReadDirEntryErr TIFFReadDirEntryByte(TIFF* tif, TIFFDirEntry* direntry, uint8* value)
 198 {
 199         enum TIFFReadDirEntryErr err;
 200         if (direntry->tdir_count!=1)
 201                 return(TIFFReadDirEntryErrCount);
 202         switch (direntry->tdir_type)
 203         {
 204                 case TIFF_BYTE:
 205                         TIFFReadDirEntryCheckedByte(tif,direntry,value);
 206                         return(TIFFReadDirEntryErrOk);
 207                 case TIFF_SBYTE:
 208                         {
 209                                 int8 m;
 210                                 TIFFReadDirEntryCheckedSbyte(tif,direntry,&m);
 211                                 err=TIFFReadDirEntryCheckRangeByteSbyte(m);
 212                                 if (err!=TIFFReadDirEntryErrOk)
 213                                         return(err);
 214                                 *value=(uint8)m;
 215                                 return(TIFFReadDirEntryErrOk);
 216                         }
 217                 case TIFF_SHORT:
 218                         {
 219                                 uint16 m;
 220                                 TIFFReadDirEntryCheckedShort(tif,direntry,&m);
 221                                 err=TIFFReadDirEntryCheckRangeByteShort(m);
 222                                 if (err!=TIFFReadDirEntryErrOk)
 223                                         return(err);
 224                                 *value=(uint8)m;
 225                                 return(TIFFReadDirEntryErrOk);
 226                         }
 227                 case TIFF_SSHORT:
 228                         {
 229                                 int16 m;
 230                                 TIFFReadDirEntryCheckedSshort(tif,direntry,&m);
 231                                 err=TIFFReadDirEntryCheckRangeByteSshort(m);
 232                                 if (err!=TIFFReadDirEntryErrOk)
 233                                         return(err);
 234                                 *value=(uint8)m;
 235                                 return(TIFFReadDirEntryErrOk);
 236                         }
 237                 case TIFF_LONG:
 238                         {
 239                                 uint32 m;
 240                                 TIFFReadDirEntryCheckedLong(tif,direntry,&m);
 241                                 err=TIFFReadDirEntryCheckRangeByteLong(m);
 242                                 if (err!=TIFFReadDirEntryErrOk)
 243                                         return(err);
 244                                 *value=(uint8)m;
 245                                 return(TIFFReadDirEntryErrOk);
 246                         }
 247                 case TIFF_SLONG:
 248                         {
 249                                 int32 m;
 250                                 TIFFReadDirEntryCheckedSlong(tif,direntry,&m);
 251                                 err=TIFFReadDirEntryCheckRangeByteSlong(m);
 252                                 if (err!=TIFFReadDirEntryErrOk)
 253                                         return(err);
 254                                 *value=(uint8)m;
 255                                 return(TIFFReadDirEntryErrOk);
 256                         }
 257                 case TIFF_LONG8:
 258                         {
 259                                 uint64 m;
 260                                 err=TIFFReadDirEntryCheckedLong8(tif,direntry,&m);
 261                                 if (err!=TIFFReadDirEntryErrOk)
 262                                         return(err);
 263                                 err=TIFFReadDirEntryCheckRangeByteLong8(m);
 264                                 if (err!=TIFFReadDirEntryErrOk)
 265                                         return(err);
 266                                 *value=(uint8)m;
 267                                 return(TIFFReadDirEntryErrOk);
 268                         }
 269                 case TIFF_SLONG8:
 270                         {
 271                                 int64 m;
 272                                 err=TIFFReadDirEntryCheckedSlong8(tif,direntry,&m);
 273                                 if (err!=TIFFReadDirEntryErrOk)
 274                                         return(err);
 275                                 err=TIFFReadDirEntryCheckRangeByteSlong8(m);
 276                                 if (err!=TIFFReadDirEntryErrOk)
 277                                         return(err);
 278                                 *value=(uint8)m;
 279                                 return(TIFFReadDirEntryErrOk);
 280                         }
 281                 default:
 282                         return(TIFFReadDirEntryErrType);
 283         }
 284 }
 285
 286 static enum TIFFReadDirEntryErr TIFFReadDirEntryShort(TIFF* tif, TIFFDirEntry* direntry, uint16* value)
 287 {
 288         enum TIFFReadDirEntryErr err;
 289         if (direntry->tdir_count!=1)
 290                 return(TIFFReadDirEntryErrCount);
 291         switch (direntry->tdir_type)
 292         {
 293                 case TIFF_BYTE:
 294                         {
 295                                 uint8 m;
 296                                 TIFFReadDirEntryCheckedByte(tif,direntry,&m);
 297                                 *value=(uint16)m;
 298                                 return(TIFFReadDirEntryErrOk);
 299                         }
 300                 case TIFF_SBYTE:
 301                         {
 302                                 int8 m;
 303                                 TIFFReadDirEntryCheckedSbyte(tif,direntry,&m);
 304                                 err=TIFFReadDirEntryCheckRangeShortSbyte(m);
 305                                 if (err!=TIFFReadDirEntryErrOk)
 306                                         return(err);
 307                                 *value=(uint16)m;
 308                                 return(TIFFReadDirEntryErrOk);
 309                         }
 310                 case TIFF_SHORT:
 311                         TIFFReadDirEntryCheckedShort(tif,direntry,value);
 312                         return(TIFFReadDirEntryErrOk);
 313                 case TIFF_SSHORT:
 314                         {
 315                                 int16 m;
 316                                 TIFFReadDirEntryCheckedSshort(tif,direntry,&m);
 317                                 err=TIFFReadDirEntryCheckRangeShortSshort(m);
 318                                 if (err!=TIFFReadDirEntryErrOk)
 319                                         return(err);
 320                                 *value=(uint16)m;
 321                                 return(TIFFReadDirEntryErrOk);
 322                         }
 323                 case TIFF_LONG:
 324                         {
 325                                 uint32 m;
 326                                 TIFFReadDirEntryCheckedLong(tif,direntry,&m);
 327                                 err=TIFFReadDirEntryCheckRangeShortLong(m);
 328                                 if (err!=TIFFReadDirEntryErrOk)
 329                                         return(err);
 330                                 *value=(uint16)m;
 331                                 return(TIFFReadDirEntryErrOk);
 332                         }
 333                 case TIFF_SLONG:
 334                         {
 335                                 int32 m;
 336                                 TIFFReadDirEntryCheckedSlong(tif,direntry,&m);
 337                                 err=TIFFReadDirEntryCheckRangeShortSlong(m);
 338                                 if (err!=TIFFReadDirEntryErrOk)
 339                                         return(err);
 340                                 *value=(uint16)m;
 341                                 return(TIFFReadDirEntryErrOk);
 342                         }
 343                 case TIFF_LONG8:
 344                         {
 345                                 uint64 m;
 346                                 err=TIFFReadDirEntryCheckedLong8(tif,direntry,&m);
 347                                 if (err!=TIFFReadDirEntryErrOk)
 348                                         return(err);
 349                                 err=TIFFReadDirEntryCheckRangeShortLong8(m);
 350                                 if (err!=TIFFReadDirEntryErrOk)
 351                                         return(err);
 352                                 *value=(uint16)m;
 353                                 return(TIFFReadDirEntryErrOk);
 354                         }
 355                 case TIFF_SLONG8:
 356                         {
 357                                 int64 m;
 358                                 err=TIFFReadDirEntryCheckedSlong8(tif,direntry,&m);
 359                                 if (err!=TIFFReadDirEntryErrOk)
 360                                         return(err);
 361                                 err=TIFFReadDirEntryCheckRangeShortSlong8(m);
 362                                 if (err!=TIFFReadDirEntryErrOk)
 363                                         return(err);
 364                                 *value=(uint16)m;
 365                                 return(TIFFReadDirEntryErrOk);
 366                         }
 367                 default:
 368                         return(TIFFReadDirEntryErrType);
 369         }
 370 }
 371
 372 static enum TIFFReadDirEntryErr TIFFReadDirEntryLong(TIFF* tif, TIFFDirEntry* direntry, uint32* value)
 373 {
 374         enum TIFFReadDirEntryErr err;
 375         if (direntry->tdir_count!=1)
 376                 return(TIFFReadDirEntryErrCount);
 377         switch (direntry->tdir_type)
 378         {
 379                 case TIFF_BYTE:
 380                         {
 381                                 uint8 m;
 382                                 TIFFReadDirEntryCheckedByte(tif,direntry,&m);
 383                                 *value=(uint32)m;
 384                                 return(TIFFReadDirEntryErrOk);
 385                         }
 386                 case TIFF_SBYTE:
 387                         {
 388                                 int8 m;
 389                                 TIFFReadDirEntryCheckedSbyte(tif,direntry,&m);
 390                                 err=TIFFReadDirEntryCheckRangeLongSbyte(m);
 391                                 if (err!=TIFFReadDirEntryErrOk)
 392                                         return(err);
 393                                 *value=(uint32)m;
 394                                 return(TIFFReadDirEntryErrOk);
 395                         }
 396                 case TIFF_SHORT:
 397                         {
 398                                 uint16 m;
 399                                 TIFFReadDirEntryCheckedShort(tif,direntry,&m);
 400                                 *value=(uint32)m;
 401                                 return(TIFFReadDirEntryErrOk);
 402                         }
 403                 case TIFF_SSHORT:
 404                         {
 405                                 int16 m;
 406                                 TIFFReadDirEntryCheckedSshort(tif,direntry,&m);
 407                                 err=TIFFReadDirEntryCheckRangeLongSshort(m);
 408                                 if (err!=TIFFReadDirEntryErrOk)
 409                                         return(err);
 410                                 *value=(uint32)m;
 411                                 return(TIFFReadDirEntryErrOk);
 412                         }
 413                 case TIFF_LONG:
 414                         TIFFReadDirEntryCheckedLong(tif,direntry,value);
 415                         return(TIFFReadDirEntryErrOk);
 416                 case TIFF_SLONG:
 417                         {
 418                                 int32 m;
 419                                 TIFFReadDirEntryCheckedSlong(tif,direntry,&m);
 420                                 err=TIFFReadDirEntryCheckRangeLongSlong(m);
 421                                 if (err!=TIFFReadDirEntryErrOk)
 422                                         return(err);
 423                                 *value=(uint32)m;
 424                                 return(TIFFReadDirEntryErrOk);
 425                         }
 426                 case TIFF_LONG8:
 427                         {
 428                                 uint64 m;
 429                                 err=TIFFReadDirEntryCheckedLong8(tif,direntry,&m);
 430                                 if (err!=TIFFReadDirEntryErrOk)
 431                                         return(err);
 432                                 err=TIFFReadDirEntryCheckRangeLongLong8(m);
 433                                 if (err!=TIFFReadDirEntryErrOk)
 434                                         return(err);
 435                                 *value=(uint32)m;
 436                                 return(TIFFReadDirEntryErrOk);
 437                         }
 438                 case TIFF_SLONG8:
 439                         {
 440                                 int64 m;
 441                                 err=TIFFReadDirEntryCheckedSlong8(tif,direntry,&m);
 442                                 if (err!=TIFFReadDirEntryErrOk)
 443                                         return(err);
 444                                 err=TIFFReadDirEntryCheckRangeLongSlong8(m);
 445                                 if (err!=TIFFReadDirEntryErrOk)
 446                                         return(err);
 447                                 *value=(uint32)m;
 448                                 return(TIFFReadDirEntryErrOk);
 449                         }
 450                 default:
 451                         return(TIFFReadDirEntryErrType);
 452         }
 453 }
 454
 455 static enum TIFFReadDirEntryErr TIFFReadDirEntryLong8(TIFF* tif, TIFFDirEntry* direntry, uint64* value)
 456 {
 457         enum TIFFReadDirEntryErr err;
 458         if (direntry->tdir_count!=1)
 459                 return(TIFFReadDirEntryErrCount);
 460         switch (direntry->tdir_type)
 461         {
 462                 case TIFF_BYTE:
 463                         {
 464                                 uint8 m;
 465                                 TIFFReadDirEntryCheckedByte(tif,direntry,&m);
 466                                 *value=(uint64)m;
 467                                 return(TIFFReadDirEntryErrOk);
 468                         }
 469                 case TIFF_SBYTE:
 470                         {
 471                                 int8 m;
 472                                 TIFFReadDirEntryCheckedSbyte(tif,direntry,&m);
 473                                 err=TIFFReadDirEntryCheckRangeLong8Sbyte(m);
 474                                 if (err!=TIFFReadDirEntryErrOk)
 475                                         return(err);
 476                                 *value=(uint64)m;
 477                                 return(TIFFReadDirEntryErrOk);
 478                         }
 479                 case TIFF_SHORT:
 480                         {
 481                                 uint16 m;
 482                                 TIFFReadDirEntryCheckedShort(tif,direntry,&m);
 483                                 *value=(uint64)m;
 484                                 return(TIFFReadDirEntryErrOk);
 485                         }
 486                 case TIFF_SSHORT:
 487                         {
 488                                 int16 m;
 489                                 TIFFReadDirEntryCheckedSshort(tif,direntry,&m);
 490                                 err=TIFFReadDirEntryCheckRangeLong8Sshort(m);
 491                                 if (err!=TIFFReadDirEntryErrOk)
 492                                         return(err);
 493                                 *value=(uint64)m;
 494                                 return(TIFFReadDirEntryErrOk);
 495                         }
 496                 case TIFF_LONG:
 497                         {
 498                                 uint32 m;
 499                                 TIFFReadDirEntryCheckedLong(tif,direntry,&m);
 500                                 *value=(uint64)m;
 501                                 return(TIFFReadDirEntryErrOk);
 502                         }
 503                 case TIFF_SLONG:
 504                         {
 505                                 int32 m;
 506                                 TIFFReadDirEntryCheckedSlong(tif,direntry,&m);
 507                                 err=TIFFReadDirEntryCheckRangeLong8Slong(m);
 508                                 if (err!=TIFFReadDirEntryErrOk)
 509                                         return(err);
 510                                 *value=(uint64)m;
 511                                 return(TIFFReadDirEntryErrOk);
 512                         }
 513                 case TIFF_LONG8:
 514                         err=TIFFReadDirEntryCheckedLong8(tif,direntry,value);
 515                         return(err);
 516                 case TIFF_SLONG8:
 517                         {
 518                                 int64 m;
 519                                 err=TIFFReadDirEntryCheckedSlong8(tif,direntry,&m);
 520                                 if (err!=TIFFReadDirEntryErrOk)
 521                                         return(err);
 522                                 err=TIFFReadDirEntryCheckRangeLong8Slong8(m);
 523                                 if (err!=TIFFReadDirEntryErrOk)
 524                                         return(err);
 525                                 *value=(uint64)m;
 526                                 return(TIFFReadDirEntryErrOk);
 527                         }
 528                 default:
 529                         return(TIFFReadDirEntryErrType);
 530         }
 531 }
 532
 533 static enum TIFFReadDirEntryErr TIFFReadDirEntryFloat(TIFF* tif, TIFFDirEntry* direntry, float* value)
 534 {
 535         enum TIFFReadDirEntryErr err;
 536         if (direntry->tdir_count!=1)
 537                 return(TIFFReadDirEntryErrCount);
 538         switch (direntry->tdir_type)
 539         {
 540                 case TIFF_BYTE:
 541                         {
 542                                 uint8 m;
 543                                 TIFFReadDirEntryCheckedByte(tif,direntry,&m);
 544                                 *value=(float)m;
 545                                 return(TIFFReadDirEntryErrOk);
 546                         }
 547                 case TIFF_SBYTE:
 548                         {
 549                                 int8 m;
 550                                 TIFFReadDirEntryCheckedSbyte(tif,direntry,&m);
 551                                 *value=(float)m;
 552                                 return(TIFFReadDirEntryErrOk);
 553                         }
 554                 case TIFF_SHORT:
 555                         {
 556                                 uint16 m;
 557                                 TIFFReadDirEntryCheckedShort(tif,direntry,&m);
 558                                 *value=(float)m;
 559                                 return(TIFFReadDirEntryErrOk);
 560                         }
 561                 case TIFF_SSHORT:
 562                         {
 563                                 int16 m;
 564                                 TIFFReadDirEntryCheckedSshort(tif,direntry,&m);
 565                                 *value=(float)m;
 566                                 return(TIFFReadDirEntryErrOk);
 567                         }
 568                 case TIFF_LONG:
 569                         {
 570                                 uint32 m;
 571                                 TIFFReadDirEntryCheckedLong(tif,direntry,&m);
 572                                 *value=(float)m;
 573                                 return(TIFFReadDirEntryErrOk);
 574                         }
 575                 case TIFF_SLONG:
 576                         {
 577                                 int32 m;
 578                                 TIFFReadDirEntryCheckedSlong(tif,direntry,&m);
 579                                 *value=(float)m;
 580                                 return(TIFFReadDirEntryErrOk);
 581                         }
 582                 case TIFF_LONG8:
 583                         {
 584                                 uint64 m;
 585                                 err=TIFFReadDirEntryCheckedLong8(tif,direntry,&m);
 586                                 if (err!=TIFFReadDirEntryErrOk)
 587                                         return(err);
 588 #if defined(__WIN32__) && (_MSC_VER < 1500)
 589                                 /*
 590                                  * XXX: MSVC 6.0 does not support conversion
 591                                  * of 64-bit integers into floating point
 592                                  * values.
 593                                  */
 594                                 *value = _TIFFUInt64ToFloat(m);
 595 #else
 596                                 *value=(float)m;
 597 #endif
 598                                 return(TIFFReadDirEntryErrOk);
 599                         }
 600                 case TIFF_SLONG8:
 601                         {
 602                                 int64 m;
 603                                 err=TIFFReadDirEntryCheckedSlong8(tif,direntry,&m);
 604                                 if (err!=TIFFReadDirEntryErrOk)
 605                                         return(err);
 606                                 *value=(float)m;
 607                                 return(TIFFReadDirEntryErrOk);
 608                         }
 609                 case TIFF_RATIONAL:
 610                         {
 611                                 double m;
 612                                 err=TIFFReadDirEntryCheckedRational(tif,direntry,&m);
 613                                 if (err!=TIFFReadDirEntryErrOk)
 614                                         return(err);
 615                                 *value=(float)m;
 616                                 return(TIFFReadDirEntryErrOk);
 617                         }
 618                 case TIFF_SRATIONAL:
 619                         {
 620                                 double m;
 621                                 err=TIFFReadDirEntryCheckedSrational(tif,direntry,&m);
 622                                 if (err!=TIFFReadDirEntryErrOk)
 623                                         return(err);
 624                                 *value=(float)m;
 625                                 return(TIFFReadDirEntryErrOk);
 626                         }
 627                 case TIFF_FLOAT:
 628                         TIFFReadDirEntryCheckedFloat(tif,direntry,value);
 629                         return(TIFFReadDirEntryErrOk);
 630                 case TIFF_DOUBLE:
 631                         {
 632                                 double m;
 633                                 err=TIFFReadDirEntryCheckedDouble(tif,direntry,&m);
 634                                 if (err!=TIFFReadDirEntryErrOk)
 635                                         return(err);
 636                                 *value=(float)m;
 637                                 return(TIFFReadDirEntryErrOk);
 638                         }
 639                 default:
 640                         return(TIFFReadDirEntryErrType);
 641         }
 642 }
 643
 644 static enum TIFFReadDirEntryErr TIFFReadDirEntryDouble(TIFF* tif, TIFFDirEntry* direntry, double* value)
 645 {
 646         enum TIFFReadDirEntryErr err;
 647         if (direntry->tdir_count!=1)
 648                 return(TIFFReadDirEntryErrCount);
 649         switch (direntry->tdir_type)
 650         {
 651                 case TIFF_BYTE:
 652                         {
 653                                 uint8 m;
 654                                 TIFFReadDirEntryCheckedByte(tif,direntry,&m);
 655                                 *value=(double)m;
 656                                 return(TIFFReadDirEntryErrOk);
 657                         }
 658                 case TIFF_SBYTE:
 659                         {
 660                                 int8 m;
 661                                 TIFFReadDirEntryCheckedSbyte(tif,direntry,&m);
 662                                 *value=(double)m;
 663                                 return(TIFFReadDirEntryErrOk);
 664                         }
 665                 case TIFF_SHORT:
 666                         {
 667                                 uint16 m;
 668                                 TIFFReadDirEntryCheckedShort(tif,direntry,&m);
 669                                 *value=(double)m;
 670                                 return(TIFFReadDirEntryErrOk);
 671                         }
 672                 case TIFF_SSHORT:
 673                         {
 674                                 int16 m;
 675                                 TIFFReadDirEntryCheckedSshort(tif,direntry,&m);
 676                                 *value=(double)m;
 677                                 return(TIFFReadDirEntryErrOk);
 678                         }
 679                 case TIFF_LONG:
 680                         {
 681                                 uint32 m;
 682                                 TIFFReadDirEntryCheckedLong(tif,direntry,&m);
 683                                 *value=(double)m;
 684                                 return(TIFFReadDirEntryErrOk);
 685                         }
 686                 case TIFF_SLONG:
 687                         {
 688                                 int32 m;
 689                                 TIFFReadDirEntryCheckedSlong(tif,direntry,&m);
 690                                 *value=(double)m;
 691                                 return(TIFFReadDirEntryErrOk);
 692                         }
 693                 case TIFF_LONG8:
 694                         {
 695                                 uint64 m;
 696                                 err=TIFFReadDirEntryCheckedLong8(tif,direntry,&m);
 697                                 if (err!=TIFFReadDirEntryErrOk)
 698                                         return(err);
 699 #if defined(__WIN32__) && (_MSC_VER < 1500)
 700                                 /*
 701                                  * XXX: MSVC 6.0 does not support conversion
 702                                  * of 64-bit integers into floating point
 703                                  * values.
 704                                  */
 705                                 *value = _TIFFUInt64ToDouble(m);
 706 #else
 707                                 *value = (double)m;
 708 #endif
 709                                 return(TIFFReadDirEntryErrOk);
 710                         }
 711                 case TIFF_SLONG8:
 712                         {
 713                                 int64 m;
 714                                 err=TIFFReadDirEntryCheckedSlong8(tif,direntry,&m);
 715                                 if (err!=TIFFReadDirEntryErrOk)
 716                                         return(err);
 717                                 *value=(double)m;
 718                                 return(TIFFReadDirEntryErrOk);
 719                         }
 720                 case TIFF_RATIONAL:
 721                         err=TIFFReadDirEntryCheckedRational(tif,direntry,value);
 722                         return(err);
 723                 case TIFF_SRATIONAL:
 724                         err=TIFFReadDirEntryCheckedSrational(tif,direntry,value);
 725                         return(err);
 726                 case TIFF_FLOAT:
 727                         {
 728                                 float m;
 729                                 TIFFReadDirEntryCheckedFloat(tif,direntry,&m);
 730                                 *value=(double)m;
 731                                 return(TIFFReadDirEntryErrOk);
 732                         }
 733                 case TIFF_DOUBLE:
 734                         err=TIFFReadDirEntryCheckedDouble(tif,direntry,value);
 735                         return(err);
 736                 default:
 737                         return(TIFFReadDirEntryErrType);
 738         }
 739 }
 740
 741 static enum TIFFReadDirEntryErr TIFFReadDirEntryIfd8(TIFF* tif, TIFFDirEntry* direntry, uint64* value)
 742 {
 743         enum TIFFReadDirEntryErr err;
 744         if (direntry->tdir_count!=1)
 745                 return(TIFFReadDirEntryErrCount);
 746         switch (direntry->tdir_type)
 747         {
 748                 case TIFF_LONG:
 749                 case TIFF_IFD:
 750                         {
 751                                 uint32 m;
 752                                 TIFFReadDirEntryCheckedLong(tif,direntry,&m);
 753                                 *value=(uint64)m;
 754                                 return(TIFFReadDirEntryErrOk);
 755                         }
 756                 case TIFF_LONG8:
 757                 case TIFF_IFD8:
 758                         err=TIFFReadDirEntryCheckedLong8(tif,direntry,value);
 759                         return(err);
 760                 default:
 761                         return(TIFFReadDirEntryErrType);
 762         }
 763 }
 764
 765 static enum TIFFReadDirEntryErr TIFFReadDirEntryArray(TIFF* tif, TIFFDirEntry* direntry, uint32* count, uint32 desttypesize, void** value)
 766 {
 767         int typesize;
 768         uint32 datasize;
 769         void* data;
 770         typesize=TIFFDataWidth(direntry->tdir_type);
 771         if ((direntry->tdir_count==0)||(typesize==0))
 772         {
 773                 *value=0;
 774                 return(TIFFReadDirEntryErrOk);
 775         }
 776         (void) desttypesize;
 777
 778         /*
 779          * As a sanity check, make sure we have no more than a 2GB tag array
 780          * in either the current data type or the dest data type.  This also
 781          * avoids problems with overflow of tmsize_t on 32bit systems.
 782          */
 783         if ((uint64)(2147483647/typesize)<direntry->tdir_count)
 784                 return(TIFFReadDirEntryErrSizesan);
 785         if ((uint64)(2147483647/desttypesize)<direntry->tdir_count)
 786                 return(TIFFReadDirEntryErrSizesan);
 787
 788         *count=(uint32)direntry->tdir_count;
 789         datasize=(*count)*typesize;
 790         assert((tmsize_t)datasize>0);
 791         data=_TIFFCheckMalloc(tif, *count, typesize, "ReadDirEntryArray");
 792         if (data==0)
 793                 return(TIFFReadDirEntryErrAlloc);
 794         if (!(tif->tif_flags&TIFF_BIGTIFF))
 795         {
 796                 if (datasize<=4)
 797                         _TIFFmemcpy(data,&direntry->tdir_offset,datasize);
 798                 else
 799                 {
 800                         enum TIFFReadDirEntryErr err;
 801                         uint32 offset = direntry->tdir_offset.toff_long;
 802                         if (tif->tif_flags&TIFF_SWAB)
 803                                 TIFFSwabLong(&offset);
 804                         err=TIFFReadDirEntryData(tif,(uint64)offset,(tmsize_t)datasize,data);
 805                         if (err!=TIFFReadDirEntryErrOk)
 806                         {
 807                                 _TIFFfree(data);
 808                                 return(err);
 809                         }
 810                 }
 811         }
 812         else
 813         {
 814                 if (datasize<=8)
 815                         _TIFFmemcpy(data,&direntry->tdir_offset,datasize);
 816                 else
 817                 {
 818                         enum TIFFReadDirEntryErr err;
 819                         uint64 offset = direntry->tdir_offset.toff_long8;
 820                         if (tif->tif_flags&TIFF_SWAB)
 821                                 TIFFSwabLong8(&offset);
 822                         err=TIFFReadDirEntryData(tif,offset,(tmsize_t)datasize,data);
 823                         if (err!=TIFFReadDirEntryErrOk)
 824                         {
 825                                 _TIFFfree(data);
 826                                 return(err);
 827                         }
 828                 }
 829         }
 830         *value=data;
 831         return(TIFFReadDirEntryErrOk);
 832 }
 833
 834 static enum TIFFReadDirEntryErr TIFFReadDirEntryByteArray(TIFF* tif, TIFFDirEntry* direntry, uint8** value)
 835 {
 836         enum TIFFReadDirEntryErr err;
 837         uint32 count;
 838         void* origdata;
 839         uint8* data;
 840         switch (direntry->tdir_type)
 841         {
 842                 case TIFF_ASCII:
 843                 case TIFF_UNDEFINED:
 844                 case TIFF_BYTE:
 845                 case TIFF_SBYTE:
 846                 case TIFF_SHORT:
 847                 case TIFF_SSHORT:
 848                 case TIFF_LONG:
 849                 case TIFF_SLONG:
 850                 case TIFF_LONG8:
 851                 case TIFF_SLONG8:
 852                         break;
 853                 default:
 854                         return(TIFFReadDirEntryErrType);
 855         }
 856         err=TIFFReadDirEntryArray(tif,direntry,&count,1,&origdata);
 857         if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
 858         {
 859                 *value=0;
 860                 return(err);
 861         }
 862         switch (direntry->tdir_type)
 863         {
 864                 case TIFF_ASCII:
 865                 case TIFF_UNDEFINED:
 866                 case TIFF_BYTE:
 867                         *value=(uint8*)origdata;
 868                         return(TIFFReadDirEntryErrOk);
 869                 case TIFF_SBYTE:
 870                         {
 871                                 int8* m;
 872                                 uint32 n;
 873                                 m=(int8*)origdata;
 874                                 for (n=0; n<count; n++)
 875                                 {
 876                                         err=TIFFReadDirEntryCheckRangeByteSbyte(*m);
 877                                         if (err!=TIFFReadDirEntryErrOk)
 878                                         {
 879                                                 _TIFFfree(origdata);
 880                                                 return(err);
 881                                         }
 882                                         m++;
 883                                 }
 884                                 *value=(uint8*)origdata;
 885                                 return(TIFFReadDirEntryErrOk);
 886                         }
 887         }
 888         data=(uint8*)_TIFFmalloc(count);
 889         if (data==0)
 890         {
 891                 _TIFFfree(origdata);
 892                 return(TIFFReadDirEntryErrAlloc);
 893         }
 894         switch (direntry->tdir_type)
 895         {
 896                 case TIFF_SHORT:
 897                         {
 898                                 uint16* ma;
 899                                 uint8* mb;
 900                                 uint32 n;
 901                                 ma=(uint16*)origdata;
 902                                 mb=data;
 903                                 for (n=0; n<count; n++)
 904                                 {
 905                                         if (tif->tif_flags&TIFF_SWAB)
 906                                                 TIFFSwabShort(ma);
 907                                         err=TIFFReadDirEntryCheckRangeByteShort(*ma);
 908                                         if (err!=TIFFReadDirEntryErrOk)
 909                                                 break;
 910                                         *mb++=(uint8)(*ma++);
 911                                 }
 912                         }
 913                         break;
 914                 case TIFF_SSHORT:
 915                         {
 916                                 int16* ma;
 917                                 uint8* mb;
 918                                 uint32 n;
 919                                 ma=(int16*)origdata;
 920                                 mb=data;
 921                                 for (n=0; n<count; n++)
 922                                 {
 923                                         if (tif->tif_flags&TIFF_SWAB)
 924                                                 TIFFSwabShort((uint16*)ma);
 925                                         err=TIFFReadDirEntryCheckRangeByteSshort(*ma);
 926                                         if (err!=TIFFReadDirEntryErrOk)
 927                                                 break;
 928                                         *mb++=(uint8)(*ma++);
 929                                 }
 930                         }
 931                         break;
 932                 case TIFF_LONG:
 933                         {
 934                                 uint32* ma;
 935                                 uint8* mb;
 936                                 uint32 n;
 937                                 ma=(uint32*)origdata;
 938                                 mb=data;
 939                                 for (n=0; n<count; n++)
 940                                 {
 941                                         if (tif->tif_flags&TIFF_SWAB)
 942                                                 TIFFSwabLong(ma);
 943                                         err=TIFFReadDirEntryCheckRangeByteLong(*ma);
 944                                         if (err!=TIFFReadDirEntryErrOk)
 945                                                 break;
 946                                         *mb++=(uint8)(*ma++);
 947                                 }
 948                         }
 949                         break;
 950                 case TIFF_SLONG:
 951                         {
 952                                 int32* ma;
 953                                 uint8* mb;
 954                                 uint32 n;
 955                                 ma=(int32*)origdata;
 956                                 mb=data;
 957                                 for (n=0; n<count; n++)
 958                                 {
 959                                         if (tif->tif_flags&TIFF_SWAB)
 960                                                 TIFFSwabLong((uint32*)ma);
 961                                         err=TIFFReadDirEntryCheckRangeByteSlong(*ma);
 962                                         if (err!=TIFFReadDirEntryErrOk)
 963                                                 break;
 964                                         *mb++=(uint8)(*ma++);
 965                                 }
 966                         }
 967                         break;
 968                 case TIFF_LONG8:
 969                         {
 970                                 uint64* ma;
 971                                 uint8* mb;
 972                                 uint32 n;
 973                                 ma=(uint64*)origdata;
 974                                 mb=data;
 975                                 for (n=0; n<count; n++)
 976                                 {
 977                                         if (tif->tif_flags&TIFF_SWAB)
 978                                                 TIFFSwabLong8(ma);
 979                                         err=TIFFReadDirEntryCheckRangeByteLong8(*ma);
 980                                         if (err!=TIFFReadDirEntryErrOk)
 981                                                 break;
 982                                         *mb++=(uint8)(*ma++);
 983                                 }
 984                         }
 985                         break;
 986                 case TIFF_SLONG8:
 987                         {
 988                                 int64* ma;
 989                                 uint8* mb;
 990                                 uint32 n;
 991                                 ma=(int64*)origdata;
 992                                 mb=data;
 993                                 for (n=0; n<count; n++)
 994                                 {
 995                                         if (tif->tif_flags&TIFF_SWAB)
 996                                                 TIFFSwabLong8((uint64*)ma);
 997                                         err=TIFFReadDirEntryCheckRangeByteSlong8(*ma);
 998                                         if (err!=TIFFReadDirEntryErrOk)
 999                                                 break;
1000                                         *mb++=(uint8)(*ma++);
1001                                 }
1002                         }
1003                         break;
1004         }
1005         _TIFFfree(origdata);
1006         if (err!=TIFFReadDirEntryErrOk)
1007         {
1008                 _TIFFfree(data);
1009                 return(err);
1010         }
1011         *value=data;
1012         return(TIFFReadDirEntryErrOk);
1013 }
1014
1015 static enum TIFFReadDirEntryErr TIFFReadDirEntrySbyteArray(TIFF* tif, TIFFDirEntry* direntry, int8** value)
1016 {
1017         enum TIFFReadDirEntryErr err;
1018         uint32 count;
1019         void* origdata;
1020         int8* data;
1021         switch (direntry->tdir_type)
1022         {
1023                 case TIFF_UNDEFINED:
1024                 case TIFF_BYTE:
1025                 case TIFF_SBYTE:
1026                 case TIFF_SHORT:
1027                 case TIFF_SSHORT:
1028                 case TIFF_LONG:
1029                 case TIFF_SLONG:
1030                 case TIFF_LONG8:
1031                 case TIFF_SLONG8:
1032                         break;
1033                 default:
1034                         return(TIFFReadDirEntryErrType);
1035         }
1036         err=TIFFReadDirEntryArray(tif,direntry,&count,1,&origdata);
1037         if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
1038         {
1039                 *value=0;
1040                 return(err);
1041         }
1042         switch (direntry->tdir_type)
1043         {
1044                 case TIFF_UNDEFINED:
1045                 case TIFF_BYTE:
1046                         {
1047                                 uint8* m;
1048                                 uint32 n;
1049                                 m=(uint8*)origdata;
1050                                 for (n=0; n<count; n++)
1051                                 {
1052                                         err=TIFFReadDirEntryCheckRangeSbyteByte(*m);
1053                                         if (err!=TIFFReadDirEntryErrOk)
1054                                         {
1055                                                 _TIFFfree(origdata);
1056                                                 return(err);
1057                                         }
1058                                         m++;
1059                                 }
1060                                 *value=(int8*)origdata;
1061                                 return(TIFFReadDirEntryErrOk);
1062                         }
1063                 case TIFF_SBYTE:
1064                         *value=(int8*)origdata;
1065                         return(TIFFReadDirEntryErrOk);
1066         }
1067         data=(int8*)_TIFFmalloc(count);
1068         if (data==0)
1069         {
1070                 _TIFFfree(origdata);
1071                 return(TIFFReadDirEntryErrAlloc);
1072         }
1073         switch (direntry->tdir_type)
1074         {
1075                 case TIFF_SHORT:
1076                         {
1077                                 uint16* ma;
1078                                 int8* mb;
1079                                 uint32 n;
1080                                 ma=(uint16*)origdata;
1081                                 mb=data;
1082                                 for (n=0; n<count; n++)
1083                                 {
1084                                         if (tif->tif_flags&TIFF_SWAB)
1085                                                 TIFFSwabShort(ma);
1086                                         err=TIFFReadDirEntryCheckRangeSbyteShort(*ma);
1087                                         if (err!=TIFFReadDirEntryErrOk)
1088                                                 break;
1089                                         *mb++=(int8)(*ma++);
1090                                 }
1091                         }
1092                         break;
1093                 case TIFF_SSHORT:
1094                         {
1095                                 int16* ma;
1096                                 int8* mb;
1097                                 uint32 n;
1098                                 ma=(int16*)origdata;
1099                                 mb=data;
1100                                 for (n=0; n<count; n++)
1101                                 {
1102                                         if (tif->tif_flags&TIFF_SWAB)
1103                                                 TIFFSwabShort((uint16*)ma);
1104                                         err=TIFFReadDirEntryCheckRangeSbyteSshort(*ma);
1105                                         if (err!=TIFFReadDirEntryErrOk)
1106                                                 break;
1107                                         *mb++=(int8)(*ma++);
1108                                 }
1109                         }
1110                         break;
1111                 case TIFF_LONG:
1112                         {
1113                                 uint32* ma;
1114                                 int8* mb;
1115                                 uint32 n;
1116                                 ma=(uint32*)origdata;
1117                                 mb=data;
1118                                 for (n=0; n<count; n++)
1119                                 {
1120                                         if (tif->tif_flags&TIFF_SWAB)
1121                                                 TIFFSwabLong(ma);
1122                                         err=TIFFReadDirEntryCheckRangeSbyteLong(*ma);
1123                                         if (err!=TIFFReadDirEntryErrOk)
1124                                                 break;
1125                                         *mb++=(int8)(*ma++);
1126                                 }
1127                         }
1128                         break;
1129                 case TIFF_SLONG:
1130                         {
1131                                 int32* ma;
1132                                 int8* mb;
1133                                 uint32 n;
1134                                 ma=(int32*)origdata;
1135                                 mb=data;
1136                                 for (n=0; n<count; n++)
1137                                 {
1138                                         if (tif->tif_flags&TIFF_SWAB)
1139                                                 TIFFSwabLong((uint32*)ma);
1140                                         err=TIFFReadDirEntryCheckRangeSbyteSlong(*ma);
1141                                         if (err!=TIFFReadDirEntryErrOk)
1142                                                 break;
1143                                         *mb++=(int8)(*ma++);
1144                                 }
1145                         }
1146                         break;
1147                 case TIFF_LONG8:
1148                         {
1149                                 uint64* ma;
1150                                 int8* mb;
1151                                 uint32 n;
1152                                 ma=(uint64*)origdata;
1153                                 mb=data;
1154                                 for (n=0; n<count; n++)
1155                                 {
1156                                         if (tif->tif_flags&TIFF_SWAB)
1157                                                 TIFFSwabLong8(ma);
1158                                         err=TIFFReadDirEntryCheckRangeSbyteLong8(*ma);
1159                                         if (err!=TIFFReadDirEntryErrOk)
1160                                                 break;
1161                                         *mb++=(int8)(*ma++);
1162                                 }
1163                         }
1164                         break;
1165                 case TIFF_SLONG8:
1166                         {
1167                                 int64* ma;
1168                                 int8* mb;
1169                                 uint32 n;
1170                                 ma=(int64*)origdata;
1171                                 mb=data;
1172                                 for (n=0; n<count; n++)
1173                                 {
1174                                         if (tif->tif_flags&TIFF_SWAB)
1175                                                 TIFFSwabLong8((uint64*)ma);
1176                                         err=TIFFReadDirEntryCheckRangeSbyteSlong8(*ma);
1177                                         if (err!=TIFFReadDirEntryErrOk)
1178                                                 break;
1179                                         *mb++=(int8)(*ma++);
1180                                 }
1181                         }
1182                         break;
1183         }
1184         _TIFFfree(origdata);
1185         if (err!=TIFFReadDirEntryErrOk)
1186         {
1187                 _TIFFfree(data);
1188                 return(err);
1189         }
1190         *value=data;
1191         return(TIFFReadDirEntryErrOk);
1192 }
1193
1194 static enum TIFFReadDirEntryErr TIFFReadDirEntryShortArray(TIFF* tif, TIFFDirEntry* direntry, uint16** value)
1195 {
1196         enum TIFFReadDirEntryErr err;
1197         uint32 count;
1198         void* origdata;
1199         uint16* data;
1200         switch (direntry->tdir_type)
1201         {
1202                 case TIFF_BYTE:
1203                 case TIFF_SBYTE:
1204                 case TIFF_SHORT:
1205                 case TIFF_SSHORT:
1206                 case TIFF_LONG:
1207                 case TIFF_SLONG:
1208                 case TIFF_LONG8:
1209                 case TIFF_SLONG8:
1210                         break;
1211                 default:
1212                         return(TIFFReadDirEntryErrType);
1213         }
1214         err=TIFFReadDirEntryArray(tif,direntry,&count,2,&origdata);
1215         if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
1216         {
1217                 *value=0;
1218                 return(err);
1219         }
1220         switch (direntry->tdir_type)
1221         {
1222                 case TIFF_SHORT:
1223                         *value=(uint16*)origdata;
1224                         if (tif->tif_flags&TIFF_SWAB)
1225                                 TIFFSwabArrayOfShort(*value,count);
1226                         return(TIFFReadDirEntryErrOk);
1227                 case TIFF_SSHORT:
1228                         {
1229                                 int16* m;
1230                                 uint32 n;
1231                                 m=(int16*)origdata;
1232                                 for (n=0; n<count; n++)
1233                                 {
1234                                         if (tif->tif_flags&TIFF_SWAB)
1235                                                 TIFFSwabShort((uint16*)m);
1236                                         err=TIFFReadDirEntryCheckRangeShortSshort(*m);
1237                                         if (err!=TIFFReadDirEntryErrOk)
1238                                         {
1239                                                 _TIFFfree(origdata);
1240                                                 return(err);
1241                                         }
1242                                         m++;
1243                                 }
1244                                 *value=(uint16*)origdata;
1245                                 return(TIFFReadDirEntryErrOk);
1246                         }
1247         }
1248         data=(uint16*)_TIFFmalloc(count*2);
1249         if (data==0)
1250         {
1251                 _TIFFfree(origdata);
1252                 return(TIFFReadDirEntryErrAlloc);
1253         }
1254         switch (direntry->tdir_type)
1255         {
1256                 case TIFF_BYTE:
1257                         {
1258                                 uint8* ma;
1259                                 uint16* mb;
1260                                 uint32 n;
1261                                 ma=(uint8*)origdata;
1262                                 mb=data;
1263                                 for (n=0; n<count; n++)
1264                                         *mb++=(uint16)(*ma++);
1265                         }
1266                         break;
1267                 case TIFF_SBYTE:
1268                         {
1269                                 int8* ma;
1270                                 uint16* mb;
1271                                 uint32 n;
1272                                 ma=(int8*)origdata;
1273                                 mb=data;
1274                                 for (n=0; n<count; n++)
1275                                 {
1276                                         err=TIFFReadDirEntryCheckRangeShortSbyte(*ma);
1277                                         if (err!=TIFFReadDirEntryErrOk)
1278                                                 break;
1279                                         *mb++=(uint16)(*ma++);
1280                                 }
1281                         }
1282                         break;
1283                 case TIFF_LONG:
1284                         {
1285                                 uint32* ma;
1286                                 uint16* mb;
1287                                 uint32 n;
1288                                 ma=(uint32*)origdata;
1289                                 mb=data;
1290                                 for (n=0; n<count; n++)
1291                                 {
1292                                         if (tif->tif_flags&TIFF_SWAB)
1293                                                 TIFFSwabLong(ma);
1294                                         err=TIFFReadDirEntryCheckRangeShortLong(*ma);
1295                                         if (err!=TIFFReadDirEntryErrOk)
1296                                                 break;
1297                                         *mb++=(uint16)(*ma++);
1298                                 }
1299                         }
1300                         break;
1301                 case TIFF_SLONG:
1302                         {
1303                                 int32* ma;
1304                                 uint16* mb;
1305                                 uint32 n;
1306                                 ma=(int32*)origdata;
1307                                 mb=data;
1308                                 for (n=0; n<count; n++)
1309                                 {
1310                                         if (tif->tif_flags&TIFF_SWAB)
1311                                                 TIFFSwabLong((uint32*)ma);
1312                                         err=TIFFReadDirEntryCheckRangeShortSlong(*ma);
1313                                         if (err!=TIFFReadDirEntryErrOk)
1314                                                 break;
1315                                         *mb++=(uint16)(*ma++);
1316                                 }
1317                         }
1318                         break;
1319                 case TIFF_LONG8:
1320                         {
1321                                 uint64* ma;
1322                                 uint16* mb;
1323                                 uint32 n;
1324                                 ma=(uint64*)origdata;
1325                                 mb=data;
1326                                 for (n=0; n<count; n++)
1327                                 {
1328                                         if (tif->tif_flags&TIFF_SWAB)
1329                                                 TIFFSwabLong8(ma);
1330                                         err=TIFFReadDirEntryCheckRangeShortLong8(*ma);
1331                                         if (err!=TIFFReadDirEntryErrOk)
1332                                                 break;
1333                                         *mb++=(uint16)(*ma++);
1334                                 }
1335                         }
1336                         break;
1337                 case TIFF_SLONG8:
1338                         {
1339                                 int64* ma;
1340                                 uint16* mb;
1341                                 uint32 n;
1342                                 ma=(int64*)origdata;
1343                                 mb=data;
1344                                 for (n=0; n<count; n++)
1345                                 {
1346                                         if (tif->tif_flags&TIFF_SWAB)
1347                                                 TIFFSwabLong8((uint64*)ma);
1348                                         err=TIFFReadDirEntryCheckRangeShortSlong8(*ma);
1349                                         if (err!=TIFFReadDirEntryErrOk)
1350                                                 break;
1351                                         *mb++=(uint16)(*ma++);
1352                                 }
1353                         }
1354                         break;
1355         }
1356         _TIFFfree(origdata);
1357         if (err!=TIFFReadDirEntryErrOk)
1358         {
1359                 _TIFFfree(data);
1360                 return(err);
1361         }
1362         *value=data;
1363         return(TIFFReadDirEntryErrOk);
1364 }
1365
1366 static enum TIFFReadDirEntryErr TIFFReadDirEntrySshortArray(TIFF* tif, TIFFDirEntry* direntry, int16** value)
1367 {
1368         enum TIFFReadDirEntryErr err;
1369         uint32 count;
1370         void* origdata;
1371         int16* data;
1372         switch (direntry->tdir_type)
1373         {
1374                 case TIFF_BYTE:
1375                 case TIFF_SBYTE:
1376                 case TIFF_SHORT:
1377                 case TIFF_SSHORT:
1378                 case TIFF_LONG:
1379                 case TIFF_SLONG:
1380                 case TIFF_LONG8:
1381                 case TIFF_SLONG8:
1382                         break;
1383                 default:
1384                         return(TIFFReadDirEntryErrType);
1385         }
1386         err=TIFFReadDirEntryArray(tif,direntry,&count,2,&origdata);
1387         if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
1388         {
1389                 *value=0;
1390                 return(err);
1391         }
1392         switch (direntry->tdir_type)
1393         {
1394                 case TIFF_SHORT:
1395                         {
1396                                 uint16* m;
1397                                 uint32 n;
1398                                 m=(uint16*)origdata;
1399                                 for (n=0; n<count; n++)
1400                                 {
1401                                         if (tif->tif_flags&TIFF_SWAB)
1402                                                 TIFFSwabShort(m);
1403                                         err=TIFFReadDirEntryCheckRangeSshortShort(*m);
1404                                         if (err!=TIFFReadDirEntryErrOk)
1405                                         {
1406                                                 _TIFFfree(origdata);
1407                                                 return(err);
1408                                         }
1409                                         m++;
1410                                 }
1411                                 *value=(int16*)origdata;
1412                                 return(TIFFReadDirEntryErrOk);
1413                         }
1414                 case TIFF_SSHORT:
1415                         *value=(int16*)origdata;
1416                         if (tif->tif_flags&TIFF_SWAB)
1417                                 TIFFSwabArrayOfShort((uint16*)(*value),count);
1418                         return(TIFFReadDirEntryErrOk);
1419         }
1420         data=(int16*)_TIFFmalloc(count*2);
1421         if (data==0)
1422         {
1423                 _TIFFfree(origdata);
1424                 return(TIFFReadDirEntryErrAlloc);
1425         }
1426         switch (direntry->tdir_type)
1427         {
1428                 case TIFF_BYTE:
1429                         {
1430                                 uint8* ma;
1431                                 int16* mb;
1432                                 uint32 n;
1433                                 ma=(uint8*)origdata;
1434                                 mb=data;
1435                                 for (n=0; n<count; n++)
1436                                         *mb++=(int16)(*ma++);
1437                         }
1438                         break;
1439                 case TIFF_SBYTE:
1440                         {
1441                                 int8* ma;
1442                                 int16* mb;
1443                                 uint32 n;
1444                                 ma=(int8*)origdata;
1445                                 mb=data;
1446                                 for (n=0; n<count; n++)
1447                                         *mb++=(int16)(*ma++);
1448                         }
1449                         break;
1450                 case TIFF_LONG:
1451                         {
1452                                 uint32* ma;
1453                                 int16* mb;
1454                                 uint32 n;
1455                                 ma=(uint32*)origdata;
1456                                 mb=data;
1457                                 for (n=0; n<count; n++)
1458                                 {
1459                                         if (tif->tif_flags&TIFF_SWAB)
1460                                                 TIFFSwabLong(ma);
1461                                         err=TIFFReadDirEntryCheckRangeSshortLong(*ma);
1462                                         if (err!=TIFFReadDirEntryErrOk)
1463                                                 break;
1464                                         *mb++=(int16)(*ma++);
1465                                 }
1466                         }
1467                         break;
1468                 case TIFF_SLONG:
1469                         {
1470                                 int32* ma;
1471                                 int16* mb;
1472                                 uint32 n;
1473                                 ma=(int32*)origdata;
1474                                 mb=data;
1475                                 for (n=0; n<count; n++)
1476                                 {
1477                                         if (tif->tif_flags&TIFF_SWAB)
1478                                                 TIFFSwabLong((uint32*)ma);
1479                                         err=TIFFReadDirEntryCheckRangeSshortSlong(*ma);
1480                                         if (err!=TIFFReadDirEntryErrOk)
1481                                                 break;
1482                                         *mb++=(int16)(*ma++);
1483                                 }
1484                         }
1485                         break;
1486                 case TIFF_LONG8:
1487                         {
1488                                 uint64* ma;
1489                                 int16* mb;
1490                                 uint32 n;
1491                                 ma=(uint64*)origdata;
1492                                 mb=data;
1493                                 for (n=0; n<count; n++)
1494                                 {
1495                                         if (tif->tif_flags&TIFF_SWAB)
1496                                                 TIFFSwabLong8(ma);
1497                                         err=TIFFReadDirEntryCheckRangeSshortLong8(*ma);
1498                                         if (err!=TIFFReadDirEntryErrOk)
1499                                                 break;
1500                                         *mb++=(int16)(*ma++);
1501                                 }
1502                         }
1503                         break;
1504                 case TIFF_SLONG8:
1505                         {
1506                                 int64* ma;
1507                                 int16* mb;
1508                                 uint32 n;
1509                                 ma=(int64*)origdata;
1510                                 mb=data;
1511                                 for (n=0; n<count; n++)
1512                                 {
1513                                         if (tif->tif_flags&TIFF_SWAB)
1514                                                 TIFFSwabLong8((uint64*)ma);
1515                                         err=TIFFReadDirEntryCheckRangeSshortSlong8(*ma);
1516                                         if (err!=TIFFReadDirEntryErrOk)
1517                                                 break;
1518                                         *mb++=(int16)(*ma++);
1519                                 }
1520                         }
1521                         break;
1522         }
1523         _TIFFfree(origdata);
1524         if (err!=TIFFReadDirEntryErrOk)
1525         {
1526                 _TIFFfree(data);
1527                 return(err);
1528         }
1529         *value=data;
1530         return(TIFFReadDirEntryErrOk);
1531 }
1532
1533 static enum TIFFReadDirEntryErr TIFFReadDirEntryLongArray(TIFF* tif, TIFFDirEntry* direntry, uint32** value)
1534 {
1535         enum TIFFReadDirEntryErr err;
1536         uint32 count;
1537         void* origdata;
1538         uint32* data;
1539         switch (direntry->tdir_type)
1540         {
1541                 case TIFF_BYTE:
1542                 case TIFF_SBYTE:
1543                 case TIFF_SHORT:
1544                 case TIFF_SSHORT:
1545                 case TIFF_LONG:
1546                 case TIFF_SLONG:
1547                 case TIFF_LONG8:
1548                 case TIFF_SLONG8:
1549                         break;
1550                 default:
1551                         return(TIFFReadDirEntryErrType);
1552         }
1553         err=TIFFReadDirEntryArray(tif,direntry,&count,4,&origdata);
1554         if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
1555         {
1556                 *value=0;
1557                 return(err);
1558         }
1559         switch (direntry->tdir_type)
1560         {
1561                 case TIFF_LONG:
1562                         *value=(uint32*)origdata;
1563                         if (tif->tif_flags&TIFF_SWAB)
1564                                 TIFFSwabArrayOfLong(*value,count);
1565                         return(TIFFReadDirEntryErrOk);
1566                 case TIFF_SLONG:
1567                         {
1568                                 int32* m;
1569                                 uint32 n;
1570                                 m=(int32*)origdata;
1571                                 for (n=0; n<count; n++)
1572                                 {
1573                                         if (tif->tif_flags&TIFF_SWAB)
1574                                                 TIFFSwabLong((uint32*)m);
1575                                         err=TIFFReadDirEntryCheckRangeLongSlong(*m);
1576                                         if (err!=TIFFReadDirEntryErrOk)
1577                                         {
1578                                                 _TIFFfree(origdata);
1579                                                 return(err);
1580                                         }
1581                                         m++;
1582                                 }
1583                                 *value=(uint32*)origdata;
1584                                 return(TIFFReadDirEntryErrOk);
1585                         }
1586         }
1587         data=(uint32*)_TIFFmalloc(count*4);
1588         if (data==0)
1589         {
1590                 _TIFFfree(origdata);
1591                 return(TIFFReadDirEntryErrAlloc);
1592         }
1593         switch (direntry->tdir_type)
1594         {
1595                 case TIFF_BYTE:
1596                         {
1597                                 uint8* ma;
1598                                 uint32* mb;
1599                                 uint32 n;
1600                                 ma=(uint8*)origdata;
1601                                 mb=data;
1602                                 for (n=0; n<count; n++)
1603                                         *mb++=(uint32)(*ma++);
1604                         }
1605                         break;
1606                 case TIFF_SBYTE:
1607                         {
1608                                 int8* ma;
1609                                 uint32* mb;
1610                                 uint32 n;
1611                                 ma=(int8*)origdata;
1612                                 mb=data;
1613                                 for (n=0; n<count; n++)
1614                                 {
1615                                         err=TIFFReadDirEntryCheckRangeLongSbyte(*ma);
1616                                         if (err!=TIFFReadDirEntryErrOk)
1617                                                 break;
1618                                         *mb++=(uint32)(*ma++);
1619                                 }
1620                         }
1621                         break;
1622                 case TIFF_SHORT:
1623                         {
1624                                 uint16* ma;
1625                                 uint32* mb;
1626                                 uint32 n;
1627                                 ma=(uint16*)origdata;
1628                                 mb=data;
1629                                 for (n=0; n<count; n++)
1630                                 {
1631                                         if (tif->tif_flags&TIFF_SWAB)
1632                                                 TIFFSwabShort(ma);
1633                                         *mb++=(uint32)(*ma++);
1634                                 }
1635                         }
1636                         break;
1637                 case TIFF_SSHORT:
1638                         {
1639                                 int16* ma;
1640                                 uint32* mb;
1641                                 uint32 n;
1642                                 ma=(int16*)origdata;
1643                                 mb=data;
1644                                 for (n=0; n<count; n++)
1645                                 {
1646                                         if (tif->tif_flags&TIFF_SWAB)
1647                                                 TIFFSwabShort((uint16*)ma);
1648                                         err=TIFFReadDirEntryCheckRangeLongSshort(*ma);
1649                                         if (err!=TIFFReadDirEntryErrOk)
1650                                                 break;
1651                                         *mb++=(uint32)(*ma++);
1652                                 }
1653                         }
1654                         break;
1655                 case TIFF_LONG8:
1656                         {
1657                                 uint64* ma;
1658                                 uint32* mb;
1659                                 uint32 n;
1660                                 ma=(uint64*)origdata;
1661                                 mb=data;
1662                                 for (n=0; n<count; n++)
1663                                 {
1664                                         if (tif->tif_flags&TIFF_SWAB)
1665                                                 TIFFSwabLong8(ma);
1666                                         err=TIFFReadDirEntryCheckRangeLongLong8(*ma);
1667                                         if (err!=TIFFReadDirEntryErrOk)
1668                                                 break;
1669                                         *mb++=(uint32)(*ma++);
1670                                 }
1671                         }
1672                         break;
1673                 case TIFF_SLONG8:
1674                         {
1675                                 int64* ma;
1676                                 uint32* mb;
1677                                 uint32 n;
1678                                 ma=(int64*)origdata;
1679                                 mb=data;
1680                                 for (n=0; n<count; n++)
1681                                 {
1682                                         if (tif->tif_flags&TIFF_SWAB)
1683                                                 TIFFSwabLong8((uint64*)ma);
1684                                         err=TIFFReadDirEntryCheckRangeLongSlong8(*ma);
1685                                         if (err!=TIFFReadDirEntryErrOk)
1686                                                 break;
1687                                         *mb++=(uint32)(*ma++);
1688                                 }
1689                         }
1690                         break;
1691         }
1692         _TIFFfree(origdata);
1693         if (err!=TIFFReadDirEntryErrOk)
1694         {
1695                 _TIFFfree(data);
1696                 return(err);
1697         }
1698         *value=data;
1699         return(TIFFReadDirEntryErrOk);
1700 }
1701
1702 static enum TIFFReadDirEntryErr TIFFReadDirEntrySlongArray(TIFF* tif, TIFFDirEntry* direntry, int32** value)
1703 {
1704         enum TIFFReadDirEntryErr err;
1705         uint32 count;
1706         void* origdata;
1707         int32* data;
1708         switch (direntry->tdir_type)
1709         {
1710                 case TIFF_BYTE:
1711                 case TIFF_SBYTE:
1712                 case TIFF_SHORT:
1713                 case TIFF_SSHORT:
1714                 case TIFF_LONG:
1715                 case TIFF_SLONG:
1716                 case TIFF_LONG8:
1717                 case TIFF_SLONG8:
1718                         break;
1719                 default:
1720                         return(TIFFReadDirEntryErrType);
1721         }
1722         err=TIFFReadDirEntryArray(tif,direntry,&count,4,&origdata);
1723         if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
1724         {
1725                 *value=0;
1726                 return(err);
1727         }
1728         switch (direntry->tdir_type)
1729         {
1730                 case TIFF_LONG:
1731                         {
1732                                 uint32* m;
1733                                 uint32 n;
1734                                 m=(uint32*)origdata;
1735                                 for (n=0; n<count; n++)
1736                                 {
1737                                         if (tif->tif_flags&TIFF_SWAB)
1738                                                 TIFFSwabLong((uint32*)m);
1739                                         err=TIFFReadDirEntryCheckRangeSlongLong(*m);
1740                                         if (err!=TIFFReadDirEntryErrOk)
1741                                         {
1742                                                 _TIFFfree(origdata);
1743                                                 return(err);
1744                                         }
1745                                         m++;
1746                                 }
1747                                 *value=(int32*)origdata;
1748                                 return(TIFFReadDirEntryErrOk);
1749                         }
1750                 case TIFF_SLONG:
1751                         *value=(int32*)origdata;
1752                         if (tif->tif_flags&TIFF_SWAB)
1753                                 TIFFSwabArrayOfLong((uint32*)(*value),count);
1754                         return(TIFFReadDirEntryErrOk);
1755         }
1756         data=(int32*)_TIFFmalloc(count*4);
1757         if (data==0)
1758         {
1759                 _TIFFfree(origdata);
1760                 return(TIFFReadDirEntryErrAlloc);
1761         }
1762         switch (direntry->tdir_type)
1763         {
1764                 case TIFF_BYTE:
1765                         {
1766                                 uint8* ma;
1767                                 int32* mb;
1768                                 uint32 n;
1769                                 ma=(uint8*)origdata;
1770                                 mb=data;
1771                                 for (n=0; n<count; n++)
1772                                         *mb++=(int32)(*ma++);
1773                         }
1774                         break;
1775                 case TIFF_SBYTE:
1776                         {
1777                                 int8* ma;
1778                                 int32* mb;
1779                                 uint32 n;
1780                                 ma=(int8*)origdata;
1781                                 mb=data;
1782                                 for (n=0; n<count; n++)
1783                                         *mb++=(int32)(*ma++);
1784                         }
1785                         break;
1786                 case TIFF_SHORT:
1787                         {
1788                                 uint16* ma;
1789                                 int32* mb;
1790                                 uint32 n;
1791                                 ma=(uint16*)origdata;
1792                                 mb=data;
1793                                 for (n=0; n<count; n++)
1794                                 {
1795                                         if (tif->tif_flags&TIFF_SWAB)
1796                                                 TIFFSwabShort(ma);
1797                                         *mb++=(int32)(*ma++);
1798                                 }
1799                         }
1800                         break;
1801                 case TIFF_SSHORT:
1802                         {
1803                                 int16* ma;
1804                                 int32* mb;
1805                                 uint32 n;
1806                                 ma=(int16*)origdata;
1807                                 mb=data;
1808                                 for (n=0; n<count; n++)
1809                                 {
1810                                         if (tif->tif_flags&TIFF_SWAB)
1811                                                 TIFFSwabShort((uint16*)ma);
1812                                         *mb++=(int32)(*ma++);
1813                                 }
1814                         }
1815                         break;
1816                 case TIFF_LONG8:
1817                         {
1818                                 uint64* ma;
1819                                 int32* mb;
1820                                 uint32 n;
1821                                 ma=(uint64*)origdata;
1822                                 mb=data;
1823                                 for (n=0; n<count; n++)
1824                                 {
1825                                         if (tif->tif_flags&TIFF_SWAB)
1826                                                 TIFFSwabLong8(ma);
1827                                         err=TIFFReadDirEntryCheckRangeSlongLong8(*ma);
1828                                         if (err!=TIFFReadDirEntryErrOk)
1829                                                 break;
1830                                         *mb++=(int32)(*ma++);
1831                                 }
1832                         }
1833                         break;
1834                 case TIFF_SLONG8:
1835                         {
1836                                 int64* ma;
1837                                 int32* mb;
1838                                 uint32 n;
1839                                 ma=(int64*)origdata;
1840                                 mb=data;
1841                                 for (n=0; n<count; n++)
1842                                 {
1843                                         if (tif->tif_flags&TIFF_SWAB)
1844                                                 TIFFSwabLong8((uint64*)ma);
1845                                         err=TIFFReadDirEntryCheckRangeSlongSlong8(*ma);
1846                                         if (err!=TIFFReadDirEntryErrOk)
1847                                                 break;
1848                                         *mb++=(int32)(*ma++);
1849                                 }
1850                         }
1851                         break;
1852         }
1853         _TIFFfree(origdata);
1854         if (err!=TIFFReadDirEntryErrOk)
1855         {
1856                 _TIFFfree(data);
1857                 return(err);
1858         }
1859         *value=data;
1860         return(TIFFReadDirEntryErrOk);
1861 }
1862
1863 static enum TIFFReadDirEntryErr TIFFReadDirEntryLong8Array(TIFF* tif, TIFFDirEntry* direntry, uint64** value)
1864 {
1865         enum TIFFReadDirEntryErr err;
1866         uint32 count;
1867         void* origdata;
1868         uint64* data;
1869         switch (direntry->tdir_type)
1870         {
1871                 case TIFF_BYTE:
1872                 case TIFF_SBYTE:
1873                 case TIFF_SHORT:
1874                 case TIFF_SSHORT:
1875                 case TIFF_LONG:
1876                 case TIFF_SLONG:
1877                 case TIFF_LONG8:
1878                 case TIFF_SLONG8:
1879                         break;
1880                 default:
1881                         return(TIFFReadDirEntryErrType);
1882         }
1883         err=TIFFReadDirEntryArray(tif,direntry,&count,8,&origdata);
1884         if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
1885         {
1886                 *value=0;
1887                 return(err);
1888         }
1889         switch (direntry->tdir_type)
1890         {
1891                 case TIFF_LONG8:
1892                         *value=(uint64*)origdata;
1893                         if (tif->tif_flags&TIFF_SWAB)
1894                                 TIFFSwabArrayOfLong8(*value,count);
1895                         return(TIFFReadDirEntryErrOk);
1896                 case TIFF_SLONG8:
1897                         {
1898                                 int64* m;
1899                                 uint32 n;
1900                                 m=(int64*)origdata;
1901                                 for (n=0; n<count; n++)
1902                                 {
1903                                         if (tif->tif_flags&TIFF_SWAB)
1904                                                 TIFFSwabLong8((uint64*)m);
1905                                         err=TIFFReadDirEntryCheckRangeLong8Slong8(*m);
1906                                         if (err!=TIFFReadDirEntryErrOk)
1907                                         {
1908                                                 _TIFFfree(origdata);
1909                                                 return(err);
1910                                         }
1911                                         m++;
1912                                 }
1913                                 *value=(uint64*)origdata;
1914                                 return(TIFFReadDirEntryErrOk);
1915                         }
1916         }
1917         data=(uint64*)_TIFFmalloc(count*8);
1918         if (data==0)
1919         {
1920                 _TIFFfree(origdata);
1921                 return(TIFFReadDirEntryErrAlloc);
1922         }
1923         switch (direntry->tdir_type)
1924         {
1925                 case TIFF_BYTE:
1926                         {
1927                                 uint8* ma;
1928                                 uint64* mb;
1929                                 uint32 n;
1930                                 ma=(uint8*)origdata;
1931                                 mb=data;
1932                                 for (n=0; n<count; n++)
1933                                         *mb++=(uint64)(*ma++);
1934                         }
1935                         break;
1936                 case TIFF_SBYTE:
1937                         {
1938                                 int8* ma;
1939                                 uint64* mb;
1940                                 uint32 n;
1941                                 ma=(int8*)origdata;
1942                                 mb=data;
1943                                 for (n=0; n<count; n++)
1944                                 {
1945                                         err=TIFFReadDirEntryCheckRangeLong8Sbyte(*ma);
1946                                         if (err!=TIFFReadDirEntryErrOk)
1947                                                 break;
1948                                         *mb++=(uint64)(*ma++);
1949                                 }
1950                         }
1951                         break;
1952                 case TIFF_SHORT:
1953                         {
1954                                 uint16* ma;
1955                                 uint64* mb;
1956                                 uint32 n;
1957                                 ma=(uint16*)origdata;
1958                                 mb=data;
1959                                 for (n=0; n<count; n++)
1960                                 {
1961                                         if (tif->tif_flags&TIFF_SWAB)
1962                                                 TIFFSwabShort(ma);
1963                                         *mb++=(uint64)(*ma++);
1964                                 }
1965                         }
1966                         break;
1967                 case TIFF_SSHORT:
1968                         {
1969                                 int16* ma;
1970                                 uint64* mb;
1971                                 uint32 n;
1972                                 ma=(int16*)origdata;
1973                                 mb=data;
1974                                 for (n=0; n<count; n++)
1975                                 {
1976                                         if (tif->tif_flags&TIFF_SWAB)
1977                                                 TIFFSwabShort((uint16*)ma);
1978                                         err=TIFFReadDirEntryCheckRangeLong8Sshort(*ma);
1979                                         if (err!=TIFFReadDirEntryErrOk)
1980                                                 break;
1981                                         *mb++=(uint64)(*ma++);
1982                                 }
1983                         }
1984                         break;
1985                 case TIFF_LONG:
1986                         {
1987                                 uint32* ma;
1988                                 uint64* mb;
1989                                 uint32 n;
1990                                 ma=(uint32*)origdata;
1991                                 mb=data;
1992                                 for (n=0; n<count; n++)
1993                                 {
1994                                         if (tif->tif_flags&TIFF_SWAB)
1995                                                 TIFFSwabLong(ma);
1996                                         *mb++=(uint64)(*ma++);
1997                                 }
1998                         }
1999                         break;
2000                 case TIFF_SLONG:
2001                         {
2002                                 int32* ma;
2003                                 uint64* mb;
2004                                 uint32 n;
2005                                 ma=(int32*)origdata;
2006                                 mb=data;
2007                                 for (n=0; n<count; n++)
2008                                 {
2009                                         if (tif->tif_flags&TIFF_SWAB)
2010                                                 TIFFSwabLong((uint32*)ma);
2011                                         err=TIFFReadDirEntryCheckRangeLong8Slong(*ma);
2012                                         if (err!=TIFFReadDirEntryErrOk)
2013                                                 break;
2014                                         *mb++=(uint64)(*ma++);
2015                                 }
2016                         }
2017                         break;
2018         }
2019         _TIFFfree(origdata);
2020         if (err!=TIFFReadDirEntryErrOk)
2021         {
2022                 _TIFFfree(data);
2023                 return(err);
2024         }
2025         *value=data;
2026         return(TIFFReadDirEntryErrOk);
2027 }
2028
2029 static enum TIFFReadDirEntryErr TIFFReadDirEntrySlong8Array(TIFF* tif, TIFFDirEntry* direntry, int64** value)
2030 {
2031         enum TIFFReadDirEntryErr err;
2032         uint32 count;
2033         void* origdata;
2034         int64* data;
2035         switch (direntry->tdir_type)
2036         {
2037                 case TIFF_BYTE:
2038                 case TIFF_SBYTE:
2039                 case TIFF_SHORT:
2040                 case TIFF_SSHORT:
2041                 case TIFF_LONG:
2042                 case TIFF_SLONG:
2043                 case TIFF_LONG8:
2044                 case TIFF_SLONG8:
2045                         break;
2046                 default:
2047                         return(TIFFReadDirEntryErrType);
2048         }
2049         err=TIFFReadDirEntryArray(tif,direntry,&count,8,&origdata);
2050         if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
2051         {
2052                 *value=0;
2053                 return(err);
2054         }
2055         switch (direntry->tdir_type)
2056         {
2057                 case TIFF_LONG8:
2058                         {
2059                                 uint64* m;
2060                                 uint32 n;
2061                                 m=(uint64*)origdata;
2062                                 for (n=0; n<count; n++)
2063                                 {
2064                                         if (tif->tif_flags&TIFF_SWAB)
2065                                                 TIFFSwabLong8(m);
2066                                         err=TIFFReadDirEntryCheckRangeSlong8Long8(*m);
2067                                         if (err!=TIFFReadDirEntryErrOk)
2068                                         {
2069                                                 _TIFFfree(origdata);
2070                                                 return(err);
2071                                         }
2072                                         m++;
2073                                 }
2074                                 *value=(int64*)origdata;
2075                                 return(TIFFReadDirEntryErrOk);
2076                         }
2077                 case TIFF_SLONG8:
2078                         *value=(int64*)origdata;
2079                         if (tif->tif_flags&TIFF_SWAB)
2080                                 TIFFSwabArrayOfLong8((uint64*)(*value),count);
2081                         return(TIFFReadDirEntryErrOk);
2082         }
2083         data=(int64*)_TIFFmalloc(count*8);
2084         if (data==0)
2085         {
2086                 _TIFFfree(origdata);
2087                 return(TIFFReadDirEntryErrAlloc);
2088         }
2089         switch (direntry->tdir_type)
2090         {
2091                 case TIFF_BYTE:
2092                         {
2093                                 uint8* ma;
2094                                 int64* mb;
2095                                 uint32 n;
2096                                 ma=(uint8*)origdata;
2097                                 mb=data;
2098                                 for (n=0; n<count; n++)
2099                                         *mb++=(int64)(*ma++);
2100                         }
2101                         break;
2102                 case TIFF_SBYTE:
2103                         {
2104                                 int8* ma;
2105                                 int64* mb;
2106                                 uint32 n;
2107                                 ma=(int8*)origdata;
2108                                 mb=data;
2109                                 for (n=0; n<count; n++)
2110                                         *mb++=(int64)(*ma++);
2111                         }
2112                         break;
2113                 case TIFF_SHORT:
2114                         {
2115                                 uint16* ma;
2116                                 int64* mb;
2117                                 uint32 n;
2118                                 ma=(uint16*)origdata;
2119                                 mb=data;
2120                                 for (n=0; n<count; n++)
2121                                 {
2122                                         if (tif->tif_flags&TIFF_SWAB)
2123                                                 TIFFSwabShort(ma);
2124                                         *mb++=(int64)(*ma++);
2125                                 }
2126                         }
2127                         break;
2128                 case TIFF_SSHORT:
2129                         {
2130                                 int16* ma;
2131                                 int64* mb;
2132                                 uint32 n;
2133                                 ma=(int16*)origdata;
2134                                 mb=data;
2135                                 for (n=0; n<count; n++)
2136                                 {
2137                                         if (tif->tif_flags&TIFF_SWAB)
2138                                                 TIFFSwabShort((uint16*)ma);
2139                                         *mb++=(int64)(*ma++);
2140                                 }
2141                         }
2142                         break;
2143                 case TIFF_LONG:
2144                         {
2145                                 uint32* ma;
2146                                 int64* mb;
2147                                 uint32 n;
2148                                 ma=(uint32*)origdata;
2149                                 mb=data;
2150                                 for (n=0; n<count; n++)
2151                                 {
2152                                         if (tif->tif_flags&TIFF_SWAB)
2153                                                 TIFFSwabLong(ma);
2154                                         *mb++=(int64)(*ma++);
2155                                 }
2156                         }
2157                         break;
2158                 case TIFF_SLONG:
2159                         {
2160                                 int32* ma;
2161                                 int64* mb;
2162                                 uint32 n;
2163                                 ma=(int32*)origdata;
2164                                 mb=data;
2165                                 for (n=0; n<count; n++)
2166                                 {
2167                                         if (tif->tif_flags&TIFF_SWAB)
2168                                                 TIFFSwabLong((uint32*)ma);
2169                                         *mb++=(int64)(*ma++);
2170                                 }
2171                         }
2172                         break;
2173         }
2174         _TIFFfree(origdata);
2175         if (err!=TIFFReadDirEntryErrOk)
2176         {
2177                 _TIFFfree(data);
2178                 return(err);
2179         }
2180         *value=data;
2181         return(TIFFReadDirEntryErrOk);
2182 }
2183
2184 static enum TIFFReadDirEntryErr TIFFReadDirEntryFloatArray(TIFF* tif, TIFFDirEntry* direntry, float** value)
2185 {
2186         enum TIFFReadDirEntryErr err;
2187         uint32 count;
2188         void* origdata;
2189         float* data;
2190         switch (direntry->tdir_type)
2191         {
2192                 case TIFF_BYTE:
2193                 case TIFF_SBYTE:
2194                 case TIFF_SHORT:
2195                 case TIFF_SSHORT:
2196                 case TIFF_LONG:
2197                 case TIFF_SLONG:
2198                 case TIFF_LONG8:
2199                 case TIFF_SLONG8:
2200                 case TIFF_RATIONAL:
2201                 case TIFF_SRATIONAL:
2202                 case TIFF_FLOAT:
2203                 case TIFF_DOUBLE:
2204                         break;
2205                 default:
2206                         return(TIFFReadDirEntryErrType);
2207         }
2208         err=TIFFReadDirEntryArray(tif,direntry,&count,4,&origdata);
2209         if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
2210         {
2211                 *value=0;
2212                 return(err);
2213         }
2214         switch (direntry->tdir_type)
2215         {
2216                 case TIFF_FLOAT:
2217                         if (tif->tif_flags&TIFF_SWAB)
2218                                 TIFFSwabArrayOfLong((uint32*)origdata,count);
2219                         TIFFCvtIEEEDoubleToNative(tif,count,(float*)origdata);
2220                         *value=(float*)origdata;
2221                         return(TIFFReadDirEntryErrOk);
2222         }
2223         data=(float*)_TIFFmalloc(count*sizeof(float));
2224         if (data==0)
2225         {
2226                 _TIFFfree(origdata);
2227                 return(TIFFReadDirEntryErrAlloc);
2228         }
2229         switch (direntry->tdir_type)
2230         {
2231                 case TIFF_BYTE:
2232                         {
2233                                 uint8* ma;
2234                                 float* mb;
2235                                 uint32 n;
2236                                 ma=(uint8*)origdata;
2237                                 mb=data;
2238                                 for (n=0; n<count; n++)
2239                                         *mb++=(float)(*ma++);
2240                         }
2241                         break;
2242                 case TIFF_SBYTE:
2243                         {
2244                                 int8* ma;
2245                                 float* mb;
2246                                 uint32 n;
2247                                 ma=(int8*)origdata;
2248                                 mb=data;
2249                                 for (n=0; n<count; n++)
2250                                         *mb++=(float)(*ma++);
2251                         }
2252                         break;
2253                 case TIFF_SHORT:
2254                         {
2255                                 uint16* ma;
2256                                 float* mb;
2257                                 uint32 n;
2258                                 ma=(uint16*)origdata;
2259                                 mb=data;
2260                                 for (n=0; n<count; n++)
2261                                 {
2262                                         if (tif->tif_flags&TIFF_SWAB)
2263                                                 TIFFSwabShort(ma);
2264                                         *mb++=(float)(*ma++);
2265                                 }
2266                         }
2267                         break;
2268                 case TIFF_SSHORT:
2269                         {
2270                                 int16* ma;
2271                                 float* mb;
2272                                 uint32 n;
2273                                 ma=(int16*)origdata;
2274                                 mb=data;
2275                                 for (n=0; n<count; n++)
2276                                 {
2277                                         if (tif->tif_flags&TIFF_SWAB)
2278                                                 TIFFSwabShort((uint16*)ma);
2279                                         *mb++=(float)(*ma++);
2280                                 }
2281                         }
2282                         break;
2283                 case TIFF_LONG:
2284                         {
2285                                 uint32* ma;
2286                                 float* mb;
2287                                 uint32 n;
2288                                 ma=(uint32*)origdata;
2289                                 mb=data;
2290                                 for (n=0; n<count; n++)
2291                                 {
2292                                         if (tif->tif_flags&TIFF_SWAB)
2293                                                 TIFFSwabLong(ma);
2294                                         *mb++=(float)(*ma++);
2295                                 }
2296                         }
2297                         break;
2298                 case TIFF_SLONG:
2299                         {
2300                                 int32* ma;
2301                                 float* mb;
2302                                 uint32 n;
2303                                 ma=(int32*)origdata;
2304                                 mb=data;
2305                                 for (n=0; n<count; n++)
2306                                 {
2307                                         if (tif->tif_flags&TIFF_SWAB)
2308                                                 TIFFSwabLong((uint32*)ma);
2309                                         *mb++=(float)(*ma++);
2310                                 }
2311                         }
2312                         break;
2313                 case TIFF_LONG8:
2314                         {
2315                                 uint64* ma;
2316                                 float* mb;
2317                                 uint32 n;
2318                                 ma=(uint64*)origdata;
2319                                 mb=data;
2320                                 for (n=0; n<count; n++)
2321                                 {
2322                                         if (tif->tif_flags&TIFF_SWAB)
2323                                                 TIFFSwabLong8(ma);
2324 #if defined(__WIN32__) && (_MSC_VER < 1500)
2325                                         /*
2326                                          * XXX: MSVC 6.0 does not support
2327                                          * conversion of 64-bit integers into
2328                                          * floating point values.
2329                                          */
2330                                         *mb++ = _TIFFUInt64ToFloat(*ma++);
2331 #else
2332                                         *mb++ = (float)(*ma++);
2333 #endif
2334                                 }
2335                         }
2336                         break;
2337                 case TIFF_SLONG8:
2338                         {
2339                                 int64* ma;
2340                                 float* mb;
2341                                 uint32 n;
2342                                 ma=(int64*)origdata;
2343                                 mb=data;
2344                                 for (n=0; n<count; n++)
2345                                 {
2346                                         if (tif->tif_flags&TIFF_SWAB)
2347                                                 TIFFSwabLong8((uint64*)ma);
2348                                         *mb++=(float)(*ma++);
2349                                 }
2350                         }
2351                         break;
2352                 case TIFF_RATIONAL:
2353                         {
2354                                 uint32* ma;
2355                                 uint32 maa;
2356                                 uint32 mab;
2357                                 float* mb;
2358                                 uint32 n;
2359                                 ma=(uint32*)origdata;
2360                                 mb=data;
2361                                 for (n=0; n<count; n++)
2362                                 {
2363                                         if (tif->tif_flags&TIFF_SWAB)
2364                                                 TIFFSwabLong(ma);
2365                                         maa=*ma++;
2366                                         if (tif->tif_flags&TIFF_SWAB)
2367                                                 TIFFSwabLong(ma);
2368                                         mab=*ma++;
2369                                         if (mab==0)
2370                                                 *mb++=0.0;
2371                                         else
2372                                                 *mb++=(float)maa/(float)mab;
2373                                 }
2374                         }
2375                         break;
2376                 case TIFF_SRATIONAL:
2377                         {
2378                                 uint32* ma;
2379                                 int32 maa;
2380                                 uint32 mab;
2381                                 float* mb;
2382                                 uint32 n;
2383                                 ma=(uint32*)origdata;
2384                                 mb=data;
2385                                 for (n=0; n<count; n++)
2386                                 {
2387                                         if (tif->tif_flags&TIFF_SWAB)
2388                                                 TIFFSwabLong(ma);
2389                                         maa=*(int32*)ma;
2390                                         ma++;
2391                                         if (tif->tif_flags&TIFF_SWAB)
2392                                                 TIFFSwabLong(ma);
2393                                         mab=*ma++;
2394                                         if (mab==0)
2395                                                 *mb++=0.0;
2396                                         else
2397                                                 *mb++=(float)maa/(float)mab;
2398                                 }
2399                         }
2400                         break;
2401                 case TIFF_DOUBLE:
2402                         {
2403                                 double* ma;
2404                                 float* mb;
2405                                 uint32 n;
2406                                 if (tif->tif_flags&TIFF_SWAB)
2407                                         TIFFSwabArrayOfLong8((uint64*)origdata,count);
2408                                 TIFFCvtIEEEDoubleToNative(tif,count,(double*)origdata);
2409                                 ma=(double*)origdata;
2410                                 mb=data;
2411                                 for (n=0; n<count; n++)
2412                                         *mb++=(float)(*ma++);
2413                         }
2414                         break;
2415         }
2416         _TIFFfree(origdata);
2417         if (err!=TIFFReadDirEntryErrOk)
2418         {
2419                 _TIFFfree(data);
2420                 return(err);
2421         }
2422         *value=data;
2423         return(TIFFReadDirEntryErrOk);
2424 }
2425
2426 static enum TIFFReadDirEntryErr
2427 TIFFReadDirEntryDoubleArray(TIFF* tif, TIFFDirEntry* direntry, double** value)
2428 {
2429         enum TIFFReadDirEntryErr err;
2430         uint32 count;
2431         void* origdata;
2432         double* data;
2433         switch (direntry->tdir_type)
2434         {
2435                 case TIFF_BYTE:
2436                 case TIFF_SBYTE:
2437                 case TIFF_SHORT:
2438                 case TIFF_SSHORT:
2439                 case TIFF_LONG:
2440                 case TIFF_SLONG:
2441                 case TIFF_LONG8:
2442                 case TIFF_SLONG8:
2443                 case TIFF_RATIONAL:
2444                 case TIFF_SRATIONAL:
2445                 case TIFF_FLOAT:
2446                 case TIFF_DOUBLE:
2447                         break;
2448                 default:
2449                         return(TIFFReadDirEntryErrType);
2450         }
2451         err=TIFFReadDirEntryArray(tif,direntry,&count,8,&origdata);
2452         if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
2453         {
2454                 *value=0;
2455                 return(err);
2456         }
2457         switch (direntry->tdir_type)
2458         {
2459                 case TIFF_DOUBLE:
2460                         if (tif->tif_flags&TIFF_SWAB)
2461                                 TIFFSwabArrayOfLong8((uint64*)origdata,count);
2462                         TIFFCvtIEEEDoubleToNative(tif,count,(double*)origdata);
2463                         *value=(double*)origdata;
2464                         return(TIFFReadDirEntryErrOk);
2465         }
2466         data=(double*)_TIFFmalloc(count*sizeof(double));
2467         if (data==0)
2468         {
2469                 _TIFFfree(origdata);
2470                 return(TIFFReadDirEntryErrAlloc);
2471         }
2472         switch (direntry->tdir_type)
2473         {
2474                 case TIFF_BYTE:
2475                         {
2476                                 uint8* ma;
2477                                 double* mb;
2478                                 uint32 n;
2479                                 ma=(uint8*)origdata;
2480                                 mb=data;
2481                                 for (n=0; n<count; n++)
2482                                         *mb++=(double)(*ma++);
2483                         }
2484                         break;
2485                 case TIFF_SBYTE:
2486                         {
2487                                 int8* ma;
2488                                 double* mb;
2489                                 uint32 n;
2490                                 ma=(int8*)origdata;
2491                                 mb=data;
2492                                 for (n=0; n<count; n++)
2493                                         *mb++=(double)(*ma++);
2494                         }
2495                         break;
2496                 case TIFF_SHORT:
2497                         {
2498                                 uint16* ma;
2499                                 double* mb;
2500                                 uint32 n;
2501                                 ma=(uint16*)origdata;
2502                                 mb=data;
2503                                 for (n=0; n<count; n++)
2504                                 {
2505                                         if (tif->tif_flags&TIFF_SWAB)
2506                                                 TIFFSwabShort(ma);
2507                                         *mb++=(double)(*ma++);
2508                                 }
2509                         }
2510                         break;
2511                 case TIFF_SSHORT:
2512                         {
2513                                 int16* ma;
2514                                 double* mb;
2515                                 uint32 n;
2516                                 ma=(int16*)origdata;
2517                                 mb=data;
2518                                 for (n=0; n<count; n++)
2519                                 {
2520                                         if (tif->tif_flags&TIFF_SWAB)
2521                                                 TIFFSwabShort((uint16*)ma);
2522                                         *mb++=(double)(*ma++);
2523                                 }
2524                         }
2525                         break;
2526                 case TIFF_LONG:
2527                         {
2528                                 uint32* ma;
2529                                 double* mb;
2530                                 uint32 n;
2531                                 ma=(uint32*)origdata;
2532                                 mb=data;
2533                                 for (n=0; n<count; n++)
2534                                 {
2535                                         if (tif->tif_flags&TIFF_SWAB)
2536                                                 TIFFSwabLong(ma);
2537                                         *mb++=(double)(*ma++);
2538                                 }
2539                         }
2540                         break;
2541                 case TIFF_SLONG:
2542                         {
2543                                 int32* ma;
2544                                 double* mb;
2545                                 uint32 n;
2546                                 ma=(int32*)origdata;
2547                                 mb=data;
2548                                 for (n=0; n<count; n++)
2549                                 {
2550                                         if (tif->tif_flags&TIFF_SWAB)
2551                                                 TIFFSwabLong((uint32*)ma);
2552                                         *mb++=(double)(*ma++);
2553                                 }
2554                         }
2555                         break;
2556                 case TIFF_LONG8:
2557                         {
2558                                 uint64* ma;
2559                                 double* mb;
2560                                 uint32 n;
2561                                 ma=(uint64*)origdata;
2562                                 mb=data;
2563                                 for (n=0; n<count; n++)
2564                                 {
2565                                         if (tif->tif_flags&TIFF_SWAB)
2566                                                 TIFFSwabLong8(ma);
2567 #if defined(__WIN32__) && (_MSC_VER < 1500)
2568                                         /*
2569                                          * XXX: MSVC 6.0 does not support
2570                                          * conversion of 64-bit integers into
2571                                          * floating point values.
2572                                          */
2573                                         *mb++ = _TIFFUInt64ToDouble(*ma++);
2574 #else
2575                                         *mb++ = (double)(*ma++);
2576 #endif
2577                                 }
2578                         }
2579                         break;
2580                 case TIFF_SLONG8:
2581                         {
2582                                 int64* ma;
2583                                 double* mb;
2584                                 uint32 n;
2585                                 ma=(int64*)origdata;
2586                                 mb=data;
2587                                 for (n=0; n<count; n++)
2588                                 {
2589                                         if (tif->tif_flags&TIFF_SWAB)
2590                                                 TIFFSwabLong8((uint64*)ma);
2591                                         *mb++=(double)(*ma++);
2592                                 }
2593                         }
2594                         break;
2595                 case TIFF_RATIONAL:
2596                         {
2597                                 uint32* ma;
2598                                 uint32 maa;
2599                                 uint32 mab;
2600                                 double* mb;
2601                                 uint32 n;
2602                                 ma=(uint32*)origdata;
2603                                 mb=data;
2604                                 for (n=0; n<count; n++)
2605                                 {
2606                                         if (tif->tif_flags&TIFF_SWAB)
2607                                                 TIFFSwabLong(ma);
2608                                         maa=*ma++;
2609                                         if (tif->tif_flags&TIFF_SWAB)
2610                                                 TIFFSwabLong(ma);
2611                                         mab=*ma++;
2612                                         if (mab==0)
2613                                                 *mb++=0.0;
2614                                         else
2615                                                 *mb++=(double)maa/(double)mab;
2616                                 }
2617                         }
2618                         break;
2619                 case TIFF_SRATIONAL:
2620                         {
2621                                 uint32* ma;
2622                                 int32 maa;
2623                                 uint32 mab;
2624                                 double* mb;
2625                                 uint32 n;
2626                                 ma=(uint32*)origdata;
2627                                 mb=data;
2628                                 for (n=0; n<count; n++)
2629                                 {
2630                                         if (tif->tif_flags&TIFF_SWAB)
2631                                                 TIFFSwabLong(ma);
2632                                         maa=*(int32*)ma;
2633                                         ma++;
2634                                         if (tif->tif_flags&TIFF_SWAB)
2635                                                 TIFFSwabLong(ma);
2636                                         mab=*ma++;
2637                                         if (mab==0)
2638                                                 *mb++=0.0;
2639                                         else
2640                                                 *mb++=(double)maa/(double)mab;
2641                                 }
2642                         }
2643                         break;
2644                 case TIFF_FLOAT:
2645                         {
2646                                 float* ma;
2647                                 double* mb;
2648                                 uint32 n;
2649                                 if (tif->tif_flags&TIFF_SWAB)
2650                                         TIFFSwabArrayOfLong((uint32*)origdata,count);
2651                                 TIFFCvtIEEEFloatToNative(tif,count,(float*)origdata);
2652                                 ma=(float*)origdata;
2653                                 mb=data;
2654                                 for (n=0; n<count; n++)
2655                                         *mb++=(double)(*ma++);
2656                         }
2657                         break;
2658         }
2659         _TIFFfree(origdata);
2660         if (err!=TIFFReadDirEntryErrOk)
2661         {
2662                 _TIFFfree(data);
2663                 return(err);
2664         }
2665         *value=data;
2666         return(TIFFReadDirEntryErrOk);
2667 }
2668
2669 static enum TIFFReadDirEntryErr TIFFReadDirEntryIfd8Array(TIFF* tif, TIFFDirEntry* direntry, uint64** value)
2670 {
2671         enum TIFFReadDirEntryErr err;
2672         uint32 count;
2673         void* origdata;
2674         uint64* data;
2675         switch (direntry->tdir_type)
2676         {
2677                 case TIFF_LONG:
2678                 case TIFF_LONG8:
2679                 case TIFF_IFD:
2680                 case TIFF_IFD8:
2681                         break;
2682                 default:
2683                         return(TIFFReadDirEntryErrType);
2684         }
2685         err=TIFFReadDirEntryArray(tif,direntry,&count,8,&origdata);
2686         if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
2687         {
2688                 *value=0;
2689                 return(err);
2690         }
2691         switch (direntry->tdir_type)
2692         {
2693                 case TIFF_LONG8:
2694                 case TIFF_IFD8:
2695                         *value=(uint64*)origdata;
2696                         if (tif->tif_flags&TIFF_SWAB)
2697                                 TIFFSwabArrayOfLong8(*value,count);
2698                         return(TIFFReadDirEntryErrOk);
2699         }
2700         data=(uint64*)_TIFFmalloc(count*8);
2701         if (data==0)
2702         {
2703                 _TIFFfree(origdata);
2704                 return(TIFFReadDirEntryErrAlloc);
2705         }
2706         switch (direntry->tdir_type)
2707         {
2708                 case TIFF_LONG:
2709                 case TIFF_IFD:
2710                         {
2711                                 uint32* ma;
2712                                 uint64* mb;
2713                                 uint32 n;
2714                                 ma=(uint32*)origdata;
2715                                 mb=data;
2716                                 for (n=0; n<count; n++)
2717                                 {
2718                                         if (tif->tif_flags&TIFF_SWAB)
2719                                                 TIFFSwabLong(ma);
2720                                         *mb++=(uint64)(*ma++);
2721                                 }
2722                         }
2723                         break;
2724         }
2725         _TIFFfree(origdata);
2726         if (err!=TIFFReadDirEntryErrOk)
2727         {
2728                 _TIFFfree(data);
2729                 return(err);
2730         }
2731         *value=data;
2732         return(TIFFReadDirEntryErrOk);
2733 }
2734
2735 static enum TIFFReadDirEntryErr TIFFReadDirEntryPersampleShort(TIFF* tif, TIFFDirEntry* direntry, uint16* value)
2736 {
2737         enum TIFFReadDirEntryErr err;
2738         uint16* m;
2739         uint16* na;
2740         uint16 nb;
2741         if (direntry->tdir_count<(uint64)tif->tif_dir.td_samplesperpixel)
2742                 return(TIFFReadDirEntryErrCount);
2743         err=TIFFReadDirEntryShortArray(tif,direntry,&m);
2744         if (err!=TIFFReadDirEntryErrOk)
2745                 return(err);
2746         na=m;
2747         nb=tif->tif_dir.td_samplesperpixel;
2748         *value=*na++;
2749         nb--;
2750         while (nb>0)
2751         {
2752                 if (*na++!=*value)
2753                 {
2754                         err=TIFFReadDirEntryErrPsdif;
2755                         break;
2756                 }
2757                 nb--;
2758         }
2759         _TIFFfree(m);
2760         return(err);
2761 }
2762
2763 #if 0
2764 static enum TIFFReadDirEntryErr TIFFReadDirEntryPersampleDouble(TIFF* tif, TIFFDirEntry* direntry, double* value)
2765 {
2766         enum TIFFReadDirEntryErr err;
2767         double* m;
2768         double* na;
2769         uint16 nb;
2770         if (direntry->tdir_count<(uint64)tif->tif_dir.td_samplesperpixel)
2771                 return(TIFFReadDirEntryErrCount);
2772         err=TIFFReadDirEntryDoubleArray(tif,direntry,&m);
2773         if (err!=TIFFReadDirEntryErrOk)
2774                 return(err);
2775         na=m;
2776         nb=tif->tif_dir.td_samplesperpixel;
2777         *value=*na++;
2778         nb--;
2779         while (nb>0)
2780         {
2781                 if (*na++!=*value)
2782                 {
2783                         err=TIFFReadDirEntryErrPsdif;
2784                         break;
2785                 }
2786                 nb--;
2787         }
2788         _TIFFfree(m);
2789         return(err);
2790 }
2791 #endif
2792
2793 static void TIFFReadDirEntryCheckedByte(TIFF* tif, TIFFDirEntry* direntry, uint8* value)
2794 {
2795         (void) tif;
2796         *value=*(uint8*)(&direntry->tdir_offset);
2797 }
2798
2799 static void TIFFReadDirEntryCheckedSbyte(TIFF* tif, TIFFDirEntry* direntry, int8* value)
2800 {
2801         (void) tif;
2802         *value=*(int8*)(&direntry->tdir_offset);
2803 }
2804
2805 static void TIFFReadDirEntryCheckedShort(TIFF* tif, TIFFDirEntry* direntry, uint16* value)
2806 {
2807         *value = direntry->tdir_offset.toff_short;
2808         /* *value=*(uint16*)(&direntry->tdir_offset); */
2809         if (tif->tif_flags&TIFF_SWAB)
2810                 TIFFSwabShort(value);
2811 }
2812
2813 static void TIFFReadDirEntryCheckedSshort(TIFF* tif, TIFFDirEntry* direntry, int16* value)
2814 {
2815         *value=*(int16*)(&direntry->tdir_offset);
2816         if (tif->tif_flags&TIFF_SWAB)
2817                 TIFFSwabShort((uint16*)value);
2818 }
2819
2820 static void TIFFReadDirEntryCheckedLong(TIFF* tif, TIFFDirEntry* direntry, uint32* value)
2821 {
2822         *value=*(uint32*)(&direntry->tdir_offset);
2823         if (tif->tif_flags&TIFF_SWAB)
2824                 TIFFSwabLong(value);
2825 }
2826
2827 static void TIFFReadDirEntryCheckedSlong(TIFF* tif, TIFFDirEntry* direntry, int32* value)
2828 {
2829         *value=*(int32*)(&direntry->tdir_offset);
2830         if (tif->tif_flags&TIFF_SWAB)
2831                 TIFFSwabLong((uint32*)value);
2832 }
2833
2834 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedLong8(TIFF* tif, TIFFDirEntry* direntry, uint64* value)
2835 {
2836         if (!(tif->tif_flags&TIFF_BIGTIFF))
2837         {
2838                 enum TIFFReadDirEntryErr err;
2839                 uint32 offset = direntry->tdir_offset.toff_long;
2840                 if (tif->tif_flags&TIFF_SWAB)
2841                         TIFFSwabLong(&offset);
2842                 err=TIFFReadDirEntryData(tif,offset,8,value);
2843                 if (err!=TIFFReadDirEntryErrOk)
2844                         return(err);
2845         }
2846         else
2847                 *value = direntry->tdir_offset.toff_long8;
2848         if (tif->tif_flags&TIFF_SWAB)
2849                 TIFFSwabLong8(value);
2850         return(TIFFReadDirEntryErrOk);
2851 }
2852
2853 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedSlong8(TIFF* tif, TIFFDirEntry* direntry, int64* value)
2854 {
2855         if (!(tif->tif_flags&TIFF_BIGTIFF))
2856         {
2857                 enum TIFFReadDirEntryErr err;
2858                 uint32 offset = direntry->tdir_offset.toff_long;
2859                 if (tif->tif_flags&TIFF_SWAB)
2860                         TIFFSwabLong(&offset);
2861                 err=TIFFReadDirEntryData(tif,offset,8,value);
2862                 if (err!=TIFFReadDirEntryErrOk)
2863                         return(err);
2864         }
2865         else
2866                 *value=*(int64*)(&direntry->tdir_offset);
2867         if (tif->tif_flags&TIFF_SWAB)
2868                 TIFFSwabLong8((uint64*)value);
2869         return(TIFFReadDirEntryErrOk);
2870 }
2871
2872 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedRational(TIFF* tif, TIFFDirEntry* direntry, double* value)
2873 {
2874         UInt64Aligned_t m;
2875
2876         assert(sizeof(double)==8);
2877         assert(sizeof(uint64)==8);
2878         assert(sizeof(uint32)==4);
2879         if (!(tif->tif_flags&TIFF_BIGTIFF))
2880         {
2881                 enum TIFFReadDirEntryErr err;
2882                 uint32 offset = direntry->tdir_offset.toff_long;
2883                 if (tif->tif_flags&TIFF_SWAB)
2884                         TIFFSwabLong(&offset);
2885                 err=TIFFReadDirEntryData(tif,offset,8,m.i);
2886                 if (err!=TIFFReadDirEntryErrOk)
2887                         return(err);
2888         }
2889         else
2890                 m.l = direntry->tdir_offset.toff_long8;
2891         if (tif->tif_flags&TIFF_SWAB)
2892                 TIFFSwabArrayOfLong(m.i,2);
2893         if (m.i[0]==0)
2894                 *value=0.0;
2895         else
2896                 *value=(double)m.i[0]/(double)m.i[1];
2897         return(TIFFReadDirEntryErrOk);
2898 }
2899
2900 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedSrational(TIFF* tif, TIFFDirEntry* direntry, double* value)
2901 {
2902         UInt64Aligned_t m;
2903         assert(sizeof(double)==8);
2904         assert(sizeof(uint64)==8);
2905         assert(sizeof(int32)==4);
2906         assert(sizeof(uint32)==4);
2907         if (!(tif->tif_flags&TIFF_BIGTIFF))
2908         {
2909                 enum TIFFReadDirEntryErr err;
2910                 uint32 offset = direntry->tdir_offset.toff_long;
2911                 if (tif->tif_flags&TIFF_SWAB)
2912                         TIFFSwabLong(&offset);
2913                 err=TIFFReadDirEntryData(tif,offset,8,m.i);
2914                 if (err!=TIFFReadDirEntryErrOk)
2915                         return(err);
2916         }
2917         else
2918                 m.l=direntry->tdir_offset.toff_long8;
2919         if (tif->tif_flags&TIFF_SWAB)
2920                 TIFFSwabArrayOfLong(m.i,2);
2921         if ((int32)m.i[0]==0)
2922                 *value=0.0;
2923         else
2924                 *value=(double)((int32)m.i[0])/(double)m.i[1];
2925         return(TIFFReadDirEntryErrOk);
2926 }
2927
2928 static void TIFFReadDirEntryCheckedFloat(TIFF* tif, TIFFDirEntry* direntry, float* value)
2929 {
2930          union
2931          {
2932            float  f;
2933            uint32 i;
2934          } float_union;
2935         assert(sizeof(float)==4);
2936         assert(sizeof(uint32)==4);
2937         assert(sizeof(float_union)==4);
2938         float_union.i=*(uint32*)(&direntry->tdir_offset);
2939         *value=float_union.f;
2940         if (tif->tif_flags&TIFF_SWAB)
2941                 TIFFSwabLong((uint32*)value);
2942 }
2943
2944 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckedDouble(TIFF* tif, TIFFDirEntry* direntry, double* value)
2945 {
2946         assert(sizeof(double)==8);
2947         assert(sizeof(uint64)==8);
2948         assert(sizeof(UInt64Aligned_t)==8);
2949         if (!(tif->tif_flags&TIFF_BIGTIFF))
2950         {
2951                 enum TIFFReadDirEntryErr err;
2952                 uint32 offset = direntry->tdir_offset.toff_long;
2953                 if (tif->tif_flags&TIFF_SWAB)
2954                         TIFFSwabLong(&offset);
2955                 err=TIFFReadDirEntryData(tif,offset,8,value);
2956                 if (err!=TIFFReadDirEntryErrOk)
2957                         return(err);
2958         }
2959         else
2960         {
2961                UInt64Aligned_t uint64_union;
2962                uint64_union.l=direntry->tdir_offset.toff_long8;
2963                *value=uint64_union.d;
2964         }
2965         if (tif->tif_flags&TIFF_SWAB)
2966                 TIFFSwabLong8((uint64*)value);
2967         return(TIFFReadDirEntryErrOk);
2968 }
2969
2970 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSbyte(int8 value)
2971 {
2972         if (value<0)
2973                 return(TIFFReadDirEntryErrRange);
2974         else
2975                 return(TIFFReadDirEntryErrOk);
2976 }
2977
2978 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteShort(uint16 value)
2979 {
2980         if (value>0xFF)
2981                 return(TIFFReadDirEntryErrRange);
2982         else
2983                 return(TIFFReadDirEntryErrOk);
2984 }
2985
2986 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSshort(int16 value)
2987 {
2988         if ((value<0)||(value>0xFF))
2989                 return(TIFFReadDirEntryErrRange);
2990         else
2991                 return(TIFFReadDirEntryErrOk);
2992 }
2993
2994 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteLong(uint32 value)
2995 {
2996         if (value>0xFF)
2997                 return(TIFFReadDirEntryErrRange);
2998         else
2999                 return(TIFFReadDirEntryErrOk);
3000 }
3001
3002 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSlong(int32 value)
3003 {
3004         if ((value<0)||(value>0xFF))
3005                 return(TIFFReadDirEntryErrRange);
3006         else
3007                 return(TIFFReadDirEntryErrOk);
3008 }
3009
3010 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteLong8(uint64 value)
3011 {
3012         if (value>0xFF)
3013                 return(TIFFReadDirEntryErrRange);
3014         else
3015                 return(TIFFReadDirEntryErrOk);
3016 }
3017
3018 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeByteSlong8(int64 value)
3019 {
3020         if ((value<0)||(value>0xFF))
3021                 return(TIFFReadDirEntryErrRange);
3022         else
3023                 return(TIFFReadDirEntryErrOk);
3024 }
3025
3026 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteByte(uint8 value)
3027 {
3028         if (value>0x7F)
3029                 return(TIFFReadDirEntryErrRange);
3030         else
3031                 return(TIFFReadDirEntryErrOk);
3032 }
3033
3034 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteShort(uint16 value)
3035 {
3036         if (value>0x7F)
3037                 return(TIFFReadDirEntryErrRange);
3038         else
3039                 return(TIFFReadDirEntryErrOk);
3040 }
3041
3042 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteSshort(int16 value)
3043 {
3044         if ((value<-0x80)||(value>0x7F))
3045                 return(TIFFReadDirEntryErrRange);
3046         else
3047                 return(TIFFReadDirEntryErrOk);
3048 }
3049
3050 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteLong(uint32 value)
3051 {
3052         if (value>0x7F)
3053                 return(TIFFReadDirEntryErrRange);
3054         else
3055                 return(TIFFReadDirEntryErrOk);
3056 }
3057
3058 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteSlong(int32 value)
3059 {
3060         if ((value<-0x80)||(value>0x7F))
3061                 return(TIFFReadDirEntryErrRange);
3062         else
3063                 return(TIFFReadDirEntryErrOk);
3064 }
3065
3066 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteLong8(uint64 value)
3067 {
3068         if (value>0x7F)
3069                 return(TIFFReadDirEntryErrRange);
3070         else
3071                 return(TIFFReadDirEntryErrOk);
3072 }
3073
3074 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSbyteSlong8(int64 value)
3075 {
3076         if ((value<-0x80)||(value>0x7F))
3077                 return(TIFFReadDirEntryErrRange);
3078         else
3079                 return(TIFFReadDirEntryErrOk);
3080 }
3081
3082 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSbyte(int8 value)
3083 {
3084         if (value<0)
3085                 return(TIFFReadDirEntryErrRange);
3086         else
3087                 return(TIFFReadDirEntryErrOk);
3088 }
3089
3090 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSshort(int16 value)
3091 {
3092         if (value<0)
3093                 return(TIFFReadDirEntryErrRange);
3094         else
3095                 return(TIFFReadDirEntryErrOk);
3096 }
3097
3098 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortLong(uint32 value)
3099 {
3100         if (value>0xFFFF)
3101                 return(TIFFReadDirEntryErrRange);
3102         else
3103                 return(TIFFReadDirEntryErrOk);
3104 }
3105
3106 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSlong(int32 value)
3107 {
3108         if ((value<0)||(value>0xFFFF))
3109                 return(TIFFReadDirEntryErrRange);
3110         else
3111                 return(TIFFReadDirEntryErrOk);
3112 }
3113
3114 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortLong8(uint64 value)
3115 {
3116         if (value>0xFFFF)
3117                 return(TIFFReadDirEntryErrRange);
3118         else
3119                 return(TIFFReadDirEntryErrOk);
3120 }
3121
3122 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeShortSlong8(int64 value)
3123 {
3124         if ((value<0)||(value>0xFFFF))
3125                 return(TIFFReadDirEntryErrRange);
3126         else
3127                 return(TIFFReadDirEntryErrOk);
3128 }
3129
3130 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortShort(uint16 value)
3131 {
3132         if (value>0x7FFF)
3133                 return(TIFFReadDirEntryErrRange);
3134         else
3135                 return(TIFFReadDirEntryErrOk);
3136 }
3137
3138 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortLong(uint32 value)
3139 {
3140         if (value>0x7FFF)
3141                 return(TIFFReadDirEntryErrRange);
3142         else
3143                 return(TIFFReadDirEntryErrOk);
3144 }
3145
3146 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortSlong(int32 value)
3147 {
3148         if ((value<-0x8000)||(value>0x7FFF))
3149                 return(TIFFReadDirEntryErrRange);
3150         else
3151                 return(TIFFReadDirEntryErrOk);
3152 }
3153
3154 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortLong8(uint64 value)
3155 {
3156         if (value>0x7FFF)
3157                 return(TIFFReadDirEntryErrRange);
3158         else
3159                 return(TIFFReadDirEntryErrOk);
3160 }
3161
3162 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeSshortSlong8(int64 value)
3163 {
3164         if ((value<-0x8000)||(value>0x7FFF))
3165                 return(TIFFReadDirEntryErrRange);
3166         else
3167                 return(TIFFReadDirEntryErrOk);
3168 }
3169
3170 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongSbyte(int8 value)
3171 {
3172         if (value<0)
3173                 return(TIFFReadDirEntryErrRange);
3174         else
3175                 return(TIFFReadDirEntryErrOk);
3176 }
3177
3178 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongSshort(int16 value)
3179 {
3180         if (value<0)
3181                 return(TIFFReadDirEntryErrRange);
3182         else
3183                 return(TIFFReadDirEntryErrOk);
3184 }
3185
3186 static enum TIFFReadDirEntryErr TIFFReadDirEntryCheckRangeLongSlong(int32 value)
3187 {
3188         if (value<0)
3189                 return(TIFFReadDirEntryErrRange);
3190         else
3191                 return(TIFFReadDirEntryErrOk);
3192 }
3193
3194 /*
3195  * Largest 32-bit unsigned integer value.
3196  */
3197 #if defined(__WIN32__) && defined(_MSC_VER)
3198 # define TIFF_UINT32_MAX 0xFFFFFFFFI64
3199 #else
3200 # define TIFF_UINT32_MAX 0xFFFFFFFFLL
3201 #endif
3202
3203 static enum TIFFReadDirEntryErr
3204 TIFFReadDirEntryCheckRangeLongLong8(uint64 value)
3205 {
3206         if (value > TIFF_UINT32_MAX)
3207                 return(TIFFReadDirEntryErrRange);
3208         else
3209                 return(TIFFReadDirEntryErrOk);
3210 }
3211
3212 static enum TIFFReadDirEntryErr
3213 TIFFReadDirEntryCheckRangeLongSlong8(int64 value)
3214 {
3215         if ((value<0) || (value > TIFF_UINT32_MAX))
3216                 return(TIFFReadDirEntryErrRange);
3217         else
3218                 return(TIFFReadDirEntryErrOk);
3219 }
3220
3221 #undef TIFF_UINT32_MAX
3222
3223 static enum TIFFReadDirEntryErr
3224 TIFFReadDirEntryCheckRangeSlongLong(uint32 value)
3225 {
3226         if (value > 0x7FFFFFFFUL)
3227                 return(TIFFReadDirEntryErrRange);
3228         else
3229                 return(TIFFReadDirEntryErrOk);
3230 }
3231
3232 static enum TIFFReadDirEntryErr
3233 TIFFReadDirEntryCheckRangeSlongLong8(uint64 value)
3234 {
3235         if (value > 0x7FFFFFFFUL)
3236                 return(TIFFReadDirEntryErrRange);
3237         else
3238                 return(TIFFReadDirEntryErrOk);
3239 }
3240
3241 static enum TIFFReadDirEntryErr
3242 TIFFReadDirEntryCheckRangeSlongSlong8(int64 value)
3243 {
3244         if ((value < 0L-0x80000000L) || (value > 0x7FFFFFFFL))
3245                 return(TIFFReadDirEntryErrRange);
3246         else
3247                 return(TIFFReadDirEntryErrOk);
3248 }
3249
3250 static enum TIFFReadDirEntryErr
3251 TIFFReadDirEntryCheckRangeLong8Sbyte(int8 value)
3252 {
3253         if (value < 0)
3254                 return(TIFFReadDirEntryErrRange);
3255         else
3256                 return(TIFFReadDirEntryErrOk);
3257 }
3258
3259 static enum TIFFReadDirEntryErr
3260 TIFFReadDirEntryCheckRangeLong8Sshort(int16 value)
3261 {
3262         if (value < 0)
3263                 return(TIFFReadDirEntryErrRange);
3264         else
3265                 return(TIFFReadDirEntryErrOk);
3266 }
3267
3268 static enum TIFFReadDirEntryErr
3269 TIFFReadDirEntryCheckRangeLong8Slong(int32 value)
3270 {
3271         if (value < 0)
3272                 return(TIFFReadDirEntryErrRange);
3273         else
3274                 return(TIFFReadDirEntryErrOk);
3275 }
3276
3277 static enum TIFFReadDirEntryErr
3278 TIFFReadDirEntryCheckRangeLong8Slong8(int64 value)
3279 {
3280         if (value < 0)
3281                 return(TIFFReadDirEntryErrRange);
3282         else
3283                 return(TIFFReadDirEntryErrOk);
3284 }
3285
3286 /*
3287  * Largest 64-bit signed integer value.
3288  */
3289 #if defined(__WIN32__) && defined(_MSC_VER)
3290 # define TIFF_INT64_MAX 0x7FFFFFFFFFFFFFFFI64
3291 #else
3292 # define TIFF_INT64_MAX 0x7FFFFFFFFFFFFFFFLL
3293 #endif
3294
3295 static enum TIFFReadDirEntryErr
3296 TIFFReadDirEntryCheckRangeSlong8Long8(uint64 value)
3297 {
3298         if (value > TIFF_INT64_MAX)
3299                 return(TIFFReadDirEntryErrRange);
3300         else
3301                 return(TIFFReadDirEntryErrOk);
3302 }
3303
3304 #undef TIFF_INT64_MAX
3305
3306 static enum TIFFReadDirEntryErr
3307 TIFFReadDirEntryData(TIFF* tif, uint64 offset, tmsize_t size, void* dest)
3308 {
3309         assert(size>0);
3310         if (!isMapped(tif)) {
3311                 if (!SeekOK(tif,offset))
3312                         return(TIFFReadDirEntryErrIo);
3313                 if (!ReadOK(tif,dest,size))
3314                         return(TIFFReadDirEntryErrIo);
3315         } else {
3316                 size_t ma,mb;
3317                 ma=(size_t)offset;
3318                 mb=ma+size;
3319                 if (((uint64)ma!=offset)
3320                     || (mb < ma)
3321                     || (mb - ma != (size_t) size)
3322                     || (mb < (size_t)size)
3323                     || (mb > (size_t)tif->tif_size)
3324                     )
3325                         return(TIFFReadDirEntryErrIo);
3326                 _TIFFmemcpy(dest,tif->tif_base+ma,size);
3327         }
3328         return(TIFFReadDirEntryErrOk);
3329 }
3330
3331 static void TIFFReadDirEntryOutputErr(TIFF* tif, enum TIFFReadDirEntryErr err, const char* module, const char* tagname, int recover)
3332 {
3333         if (!recover) {
3334                 switch (err) {
3335                         case TIFFReadDirEntryErrCount:
3336                                 TIFFErrorExt(tif->tif_clientdata, module,
3337                                              "Incorrect count for \"%s\"",
3338                                              tagname);
3339                                 break;
3340                         case TIFFReadDirEntryErrType:
3341                                 TIFFErrorExt(tif->tif_clientdata, module,
3342                                              "Incompatible type for \"%s\"",
3343                                              tagname);
3344                                 break;
3345                         case TIFFReadDirEntryErrIo:
3346                                 TIFFErrorExt(tif->tif_clientdata, module,
3347                                              "IO error during reading of \"%s\"",
3348                                              tagname);
3349                                 break;
3350                         case TIFFReadDirEntryErrRange:
3351                                 TIFFErrorExt(tif->tif_clientdata, module,
3352                                              "Incorrect value for \"%s\"",
3353                                              tagname);
3354                                 break;
3355                         case TIFFReadDirEntryErrPsdif:
3356                                 TIFFErrorExt(tif->tif_clientdata, module,
3357                         "Cannot handle different values per sample for \"%s\"",
3358                                              tagname);
3359                                 break;
3360                         case TIFFReadDirEntryErrSizesan:
3361                                 TIFFErrorExt(tif->tif_clientdata, module,
3362                                 "Sanity check on size of \"%s\" value failed",
3363                                              tagname);
3364                                 break;
3365                         case TIFFReadDirEntryErrAlloc:
3366                                 TIFFErrorExt(tif->tif_clientdata, module,
3367                                              "Out of memory reading of \"%s\"",
3368                                              tagname);
3369                                 break;
3370                         default:
3371                                 assert(0);   /* we should never get here */
3372                                 break;
3373                 }
3374         } else {
3375                 switch (err) {
3376                         case TIFFReadDirEntryErrCount:
3377                                 TIFFErrorExt(tif->tif_clientdata, module,
3378                                 "Incorrect count for \"%s\"; tag ignored",
3379                                              tagname);
3380                                 break;
3381                         case TIFFReadDirEntryErrType:
3382                                 TIFFWarningExt(tif->tif_clientdata, module,
3383                                 "Incompatible type for \"%s\"; tag ignored",
3384                                                tagname);
3385                                 break;
3386                         case TIFFReadDirEntryErrIo:
3387                                 TIFFWarningExt(tif->tif_clientdata, module,
3388                         "IO error during reading of \"%s\"; tag ignored",
3389                                                tagname);
3390                                 break;
3391                         case TIFFReadDirEntryErrRange:
3392                                 TIFFWarningExt(tif->tif_clientdata, module,
3393                                 "Incorrect value for \"%s\"; tag ignored",
3394                                                tagname);
3395                                 break;
3396                         case TIFFReadDirEntryErrPsdif:
3397                                 TIFFWarningExt(tif->tif_clientdata, module,
3398         "Cannot handle different values per sample for \"%s\"; tag ignored",
3399                                                tagname);
3400                                 break;
3401                         case TIFFReadDirEntryErrSizesan:
3402                                 TIFFWarningExt(tif->tif_clientdata, module,
3403                 "Sanity check on size of \"%s\" value failed; tag ignored",
3404                                                tagname);
3405                                 break;
3406                         case TIFFReadDirEntryErrAlloc:
3407                                 TIFFWarningExt(tif->tif_clientdata, module,
3408                                 "Out of memory reading of \"%s\"; tag ignored",
3409                                                tagname);
3410                                 break;
3411                         default:
3412                                 assert(0);   /* we should never get here */
3413                                 break;
3414                 }
3415         }
3416 }
3417
3418 /*
3419  * Read the next TIFF directory from a file and convert it to the internal
3420  * format. We read directories sequentially.
3421  */
3422 int
3423 TIFFReadDirectory(TIFF* tif)
3424 {
3425         static const char module[] = "TIFFReadDirectory";
3426         TIFFDirEntry* dir;
3427         uint16 dircount;
3428         TIFFDirEntry* dp;
3429         uint16 di;
3430         const TIFFField* fip;
3431         uint32 fii=FAILED_FII;
3432         toff_t nextdiroff;
3433         tif->tif_diroff=tif->tif_nextdiroff;
3434         if (!TIFFCheckDirOffset(tif,tif->tif_nextdiroff))
3435                 return 0;           /* last offset or bad offset (IFD looping) */
3436         (*tif->tif_cleanup)(tif);   /* cleanup any previous compression state */
3437         tif->tif_curdir++;
3438         nextdiroff = tif->tif_nextdiroff;
3439         dircount=TIFFFetchDirectory(tif,nextdiroff,&dir,&tif->tif_nextdiroff);
3440         if (!dircount)
3441         {
3442                 TIFFErrorExt(tif->tif_clientdata,module,
3443                     "Failed to read directory at offset " TIFF_UINT64_FORMAT,nextdiroff);
3444                 return 0;
3445         }
3446         TIFFReadDirectoryCheckOrder(tif,dir,dircount);
3447
3448         /*
3449          * Mark duplicates of any tag to be ignored (bugzilla 1994)
3450          * to avoid certain pathological problems.
3451          */
3452         {
3453                 TIFFDirEntry* ma;
3454                 uint16 mb;
3455                 for (ma=dir, mb=0; mb<dircount; ma++, mb++)
3456                 {
3457                         TIFFDirEntry* na;
3458                         uint16 nb;
3459                         for (na=ma+1, nb=mb+1; nb<dircount; na++, nb++)
3460                         {
3461                                 if (ma->tdir_tag==na->tdir_tag)
3462                                         na->tdir_tag=IGNORE;
3463                         }
3464                 }
3465         }
3466
3467         tif->tif_flags &= ~TIFF_BEENWRITING;    /* reset before new dir */
3468         tif->tif_flags &= ~TIFF_BUF4WRITE;      /* reset before new dir */
3469         /* free any old stuff and reinit */
3470         TIFFFreeDirectory(tif);
3471         TIFFDefaultDirectory(tif);
3472         /*
3473          * Electronic Arts writes gray-scale TIFF files
3474          * without a PlanarConfiguration directory entry.
3475          * Thus we setup a default value here, even though
3476          * the TIFF spec says there is no default value.
3477          */
3478         TIFFSetField(tif,TIFFTAG_PLANARCONFIG,PLANARCONFIG_CONTIG);
3479         /*
3480          * Setup default value and then make a pass over
3481          * the fields to check type and tag information,
3482          * and to extract info required to size data
3483          * structures.  A second pass is made afterwards
3484          * to read in everthing not taken in the first pass.
3485          * But we must process the Compression tag first
3486          * in order to merge in codec-private tag definitions (otherwise
3487          * we may get complaints about unknown tags).  However, the
3488          * Compression tag may be dependent on the SamplesPerPixel
3489          * tag value because older TIFF specs permited Compression
3490          * to be written as a SamplesPerPixel-count tag entry.
3491          * Thus if we don't first figure out the correct SamplesPerPixel
3492          * tag value then we may end up ignoring the Compression tag
3493          * value because it has an incorrect count value (if the
3494          * true value of SamplesPerPixel is not 1).
3495          */
3496         dp=TIFFReadDirectoryFindEntry(tif,dir,dircount,TIFFTAG_SAMPLESPERPIXEL);
3497         if (dp)
3498         {
3499                 if (!TIFFFetchNormalTag(tif,dp,0))
3500                         goto bad;
3501                 dp->tdir_tag=IGNORE;
3502         }
3503         dp=TIFFReadDirectoryFindEntry(tif,dir,dircount,TIFFTAG_COMPRESSION);
3504         if (dp)
3505         {
3506                 /*
3507                  * The 5.0 spec says the Compression tag has one value, while
3508                  * earlier specs say it has one value per sample.  Because of
3509                  * this, we accept the tag if one value is supplied with either
3510                  * count.
3511                  */
3512                 uint16 value;
3513                 enum TIFFReadDirEntryErr err;
3514                 err=TIFFReadDirEntryShort(tif,dp,&value);
3515                 if (err==TIFFReadDirEntryErrCount)
3516                         err=TIFFReadDirEntryPersampleShort(tif,dp,&value);
3517                 if (err!=TIFFReadDirEntryErrOk)
3518                 {
3519                         TIFFReadDirEntryOutputErr(tif,err,module,"Compression",0);
3520                         goto bad;
3521                 }
3522                 if (!TIFFSetField(tif,TIFFTAG_COMPRESSION,value))
3523                         goto bad;
3524                 dp->tdir_tag=IGNORE;
3525         }
3526         else
3527         {
3528                 if (!TIFFSetField(tif,TIFFTAG_COMPRESSION,COMPRESSION_NONE))
3529                         goto bad;
3530         }
3531         /*
3532          * First real pass over the directory.
3533          */
3534         for (di=0, dp=dir; di<dircount; di++, dp++)
3535         {
3536                 if (dp->tdir_tag!=IGNORE)
3537                 {
3538                         TIFFReadDirectoryFindFieldInfo(tif,dp->tdir_tag,&fii);
3539                         if (fii == FAILED_FII)
3540                         {
3541                                 TIFFWarningExt(tif->tif_clientdata, module,
3542                                     "Unknown field with tag %d (0x%x) encountered",
3543                                     dp->tdir_tag,dp->tdir_tag);
3544                                 /* the following knowingly leaks the
3545                                    anonymous field structure */
3546                                 if (!_TIFFMergeFields(tif,
3547                                         _TIFFCreateAnonField(tif,
3548                                                 dp->tdir_tag,
3549                                                 (TIFFDataType) dp->tdir_type),
3550                                         1)) {
3551                                         TIFFWarningExt(tif->tif_clientdata,
3552                                             module,
3553                                             "Registering anonymous field with tag %d (0x%x) failed",
3554                                             dp->tdir_tag,
3555                                             dp->tdir_tag);
3556                                         dp->tdir_tag=IGNORE;
3557                                 } else {
3558                                         TIFFReadDirectoryFindFieldInfo(tif,dp->tdir_tag,&fii);
3559                                         assert(fii != FAILED_FII);
3560                                 }
3561                         }
3562                 }
3563                 if (dp->tdir_tag!=IGNORE)
3564                 {
3565                         fip=tif->tif_fields[fii];
3566                         if (fip->field_bit==FIELD_IGNORE)
3567                                 dp->tdir_tag=IGNORE;
3568                         else
3569                         {
3570                                 switch (dp->tdir_tag)
3571                                 {
3572                                         case TIFFTAG_STRIPOFFSETS:
3573                                         case TIFFTAG_STRIPBYTECOUNTS:
3574                                         case TIFFTAG_TILEOFFSETS:
3575                                         case TIFFTAG_TILEBYTECOUNTS:
3576                                                 TIFFSetFieldBit(tif,fip->field_bit);
3577                                                 break;
3578                                         case TIFFTAG_IMAGEWIDTH:
3579                                         case TIFFTAG_IMAGELENGTH:
3580                                         case TIFFTAG_IMAGEDEPTH:
3581                                         case TIFFTAG_TILELENGTH:
3582                                         case TIFFTAG_TILEWIDTH:
3583                                         case TIFFTAG_TILEDEPTH:
3584                                         case TIFFTAG_PLANARCONFIG:
3585                                         case TIFFTAG_ROWSPERSTRIP:
3586                                         case TIFFTAG_EXTRASAMPLES:
3587                                                 if (!TIFFFetchNormalTag(tif,dp,0))
3588                                                         goto bad;
3589                                                 dp->tdir_tag=IGNORE;
3590                                                 break;
3591                                 }
3592                         }
3593                 }
3594         }
3595         /*
3596          * XXX: OJPEG hack.
3597          * If a) compression is OJPEG, b) planarconfig tag says it's separate,
3598          * c) strip offsets/bytecounts tag are both present and
3599          * d) both contain exactly one value, then we consistently find
3600          * that the buggy implementation of the buggy compression scheme
3601          * matches contig planarconfig best. So we 'fix-up' the tag here
3602          */
3603         if ((tif->tif_dir.td_compression==COMPRESSION_OJPEG)&&
3604             (tif->tif_dir.td_planarconfig==PLANARCONFIG_SEPARATE))
3605         {
3606         if (!_TIFFFillStriles(tif))
3607             goto bad;
3608                 dp=TIFFReadDirectoryFindEntry(tif,dir,dircount,TIFFTAG_STRIPOFFSETS);
3609                 if ((dp!=0)&&(dp->tdir_count==1))
3610                 {
3611                         dp=TIFFReadDirectoryFindEntry(tif,dir,dircount,
3612                             TIFFTAG_STRIPBYTECOUNTS);
3613                         if ((dp!=0)&&(dp->tdir_count==1))
3614                         {
3615                                 tif->tif_dir.td_planarconfig=PLANARCONFIG_CONTIG;
3616                                 TIFFWarningExt(tif->tif_clientdata,module,
3617                                     "Planarconfig tag value assumed incorrect, "
3618                                     "assuming data is contig instead of chunky");
3619                         }
3620                 }
3621         }
3622         /*
3623          * Allocate directory structure and setup defaults.
3624          */
3625         if (!TIFFFieldSet(tif,FIELD_IMAGEDIMENSIONS))
3626         {
3627                 MissingRequired(tif,"ImageLength");
3628                 goto bad;
3629         }
3630         /*
3631          * Setup appropriate structures (by strip or by tile)
3632          */
3633         if (!TIFFFieldSet(tif, FIELD_TILEDIMENSIONS)) {
3634                 tif->tif_dir.td_nstrips = TIFFNumberOfStrips(tif);
3635                 tif->tif_dir.td_tilewidth = tif->tif_dir.td_imagewidth;
3636                 tif->tif_dir.td_tilelength = tif->tif_dir.td_rowsperstrip;
3637                 tif->tif_dir.td_tiledepth = tif->tif_dir.td_imagedepth;
3638                 tif->tif_flags &= ~TIFF_ISTILED;
3639         } else {
3640                 tif->tif_dir.td_nstrips = TIFFNumberOfTiles(tif);
3641                 tif->tif_flags |= TIFF_ISTILED;
3642         }
3643         if (!tif->tif_dir.td_nstrips) {
3644                 TIFFErrorExt(tif->tif_clientdata, module,
3645                     "Cannot handle zero number of %s",
3646                     isTiled(tif) ? "tiles" : "strips");
3647                 goto bad;
3648         }
3649         tif->tif_dir.td_stripsperimage = tif->tif_dir.td_nstrips;
3650         if (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE)
3651                 tif->tif_dir.td_stripsperimage /= tif->tif_dir.td_samplesperpixel;
3652         if (!TIFFFieldSet(tif, FIELD_STRIPOFFSETS)) {
3653                 if ((tif->tif_dir.td_compression==COMPRESSION_OJPEG) &&
3654                     (isTiled(tif)==0) &&
3655                     (tif->tif_dir.td_nstrips==1)) {
3656                         /*
3657                          * XXX: OJPEG hack.
3658                          * If a) compression is OJPEG, b) it's not a tiled TIFF,
3659                          * and c) the number of strips is 1,
3660                          * then we tolerate the absence of stripoffsets tag,
3661                          * because, presumably, all required data is in the
3662                          * JpegInterchangeFormat stream.
3663                          */
3664                         TIFFSetFieldBit(tif, FIELD_STRIPOFFSETS);
3665                 } else {
3666                         MissingRequired(tif,
3667                                 isTiled(tif) ? "TileOffsets" : "StripOffsets");
3668                         goto bad;
3669                 }
3670         }
3671         /*
3672          * Second pass: extract other information.
3673          */
3674         for (di=0, dp=dir; di<dircount; di++, dp++)
3675         {
3676                 switch (dp->tdir_tag)
3677                 {
3678                         case IGNORE:
3679                                 break;
3680                         case TIFFTAG_MINSAMPLEVALUE:
3681                         case TIFFTAG_MAXSAMPLEVALUE:
3682                         case TIFFTAG_BITSPERSAMPLE:
3683                         case TIFFTAG_DATATYPE:
3684                         case TIFFTAG_SAMPLEFORMAT:
3685                                 /*
3686                                  * The MinSampleValue, MaxSampleValue, BitsPerSample
3687                                  * DataType and SampleFormat tags are supposed to be
3688                                  * written as one value/sample, but some vendors
3689                                  * incorrectly write one value only -- so we accept
3690                                  * that as well (yech). Other vendors write correct
3691                                  * value for NumberOfSamples, but incorrect one for
3692                                  * BitsPerSample and friends, and we will read this
3693                                  * too.
3694                                  */
3695                                 {
3696                                         uint16 value;
3697                                         enum TIFFReadDirEntryErr err;
3698                                         err=TIFFReadDirEntryShort(tif,dp,&value);
3699                                         if (err==TIFFReadDirEntryErrCount)
3700                                                 err=TIFFReadDirEntryPersampleShort(tif,dp,&value);
3701                                         if (err!=TIFFReadDirEntryErrOk)
3702                                         {
3703                                                 fip = TIFFFieldWithTag(tif,dp->tdir_tag);
3704                                                 TIFFReadDirEntryOutputErr(tif,err,module,fip ? fip->field_name : "unknown tagname",0);
3705                                                 goto bad;
3706                                         }
3707                                         if (!TIFFSetField(tif,dp->tdir_tag,value))
3708                                                 goto bad;
3709                                 }
3710                                 break;
3711                         case TIFFTAG_SMINSAMPLEVALUE:
3712                         case TIFFTAG_SMAXSAMPLEVALUE:
3713                                 {
3714
3715                                         double *data;
3716                                         enum TIFFReadDirEntryErr err;
3717                                         uint32 saved_flags;
3718                                         int m;
3719                                         if (dp->tdir_count != (uint64)tif->tif_dir.td_samplesperpixel)
3720                                                 err = TIFFReadDirEntryErrCount;
3721                                         else
3722                                                 err = TIFFReadDirEntryDoubleArray(tif, dp, &data);
3723                                         if (err!=TIFFReadDirEntryErrOk)
3724                                         {
3725                                                 fip = TIFFFieldWithTag(tif,dp->tdir_tag);
3726                                                 TIFFReadDirEntryOutputErr(tif,err,module,fip ? fip->field_name : "unknown tagname",0);
3727                                                 goto bad;
3728                                         }
3729                                         saved_flags = tif->tif_flags;
3730                                         tif->tif_flags |= TIFF_PERSAMPLE;
3731                                         m = TIFFSetField(tif,dp->tdir_tag,data);
3732                                         tif->tif_flags = saved_flags;
3733                                         _TIFFfree(data);
3734                                         if (!m)
3735                                                 goto bad;
3736                                 }
3737                                 break;
3738                         case TIFFTAG_STRIPOFFSETS:
3739                         case TIFFTAG_TILEOFFSETS:
3740 #if defined(DEFER_STRILE_LOAD)
3741                                 _TIFFmemcpy( &(tif->tif_dir.td_stripoffset_entry),
3742                                              dp, sizeof(TIFFDirEntry) );
3743 #else
3744                                 if (!TIFFFetchStripThing(tif,dp,tif->tif_dir.td_nstrips,&tif->tif_dir.td_stripoffset))
3745                                         goto bad;
3746 #endif
3747                                 break;
3748                         case TIFFTAG_STRIPBYTECOUNTS:
3749                         case TIFFTAG_TILEBYTECOUNTS:
3750 #if defined(DEFER_STRILE_LOAD)
3751                                 _TIFFmemcpy( &(tif->tif_dir.td_stripbytecount_entry),
3752                                              dp, sizeof(TIFFDirEntry) );
3753 #else
3754                                 if (!TIFFFetchStripThing(tif,dp,tif->tif_dir.td_nstrips,&tif->tif_dir.td_stripbytecount))
3755                                         goto bad;
3756 #endif
3757                                 break;
3758                         case TIFFTAG_COLORMAP:
3759                         case TIFFTAG_TRANSFERFUNCTION:
3760                                 {
3761                                         enum TIFFReadDirEntryErr err;
3762                                         uint32 countpersample;
3763                                         uint32 countrequired;
3764                                         uint32 incrementpersample;
3765                                         uint16* value=NULL;
3766                                         countpersample=(1L<<tif->tif_dir.td_bitspersample);
3767                                         if ((dp->tdir_tag==TIFFTAG_TRANSFERFUNCTION)&&(dp->tdir_count==(uint64)countpersample))
3768                                         {
3769                                                 countrequired=countpersample;
3770                                                 incrementpersample=0;
3771                                         }
3772                                         else
3773                                         {
3774                                                 countrequired=3*countpersample;
3775                                                 incrementpersample=countpersample;
3776                                         }
3777                                         if (dp->tdir_count!=(uint64)countrequired)
3778                                                 err=TIFFReadDirEntryErrCount;
3779                                         else
3780                                                 err=TIFFReadDirEntryShortArray(tif,dp,&value);
3781                                         if (err!=TIFFReadDirEntryErrOk)
3782                     {
3783                                                 fip = TIFFFieldWithTag(tif,dp->tdir_tag);
3784                                                 TIFFReadDirEntryOutputErr(tif,err,module,fip ? fip->field_name : "unknown tagname",1);
3785                     }
3786                                         else
3787                                         {
3788                                                 TIFFSetField(tif,dp->tdir_tag,value,value+incrementpersample,value+2*incrementpersample);
3789                                                 _TIFFfree(value);
3790                                         }
3791                                 }
3792                                 break;
3793 /* BEGIN REV 4.0 COMPATIBILITY */
3794                         case TIFFTAG_OSUBFILETYPE:
3795                                 {
3796                                         uint16 valueo;
3797                                         uint32 value;
3798                                         if (TIFFReadDirEntryShort(tif,dp,&valueo)==TIFFReadDirEntryErrOk)
3799                                         {
3800                                                 switch (valueo)
3801                                                 {
3802                                                         case OFILETYPE_REDUCEDIMAGE: value=FILETYPE_REDUCEDIMAGE; break;
3803                                                         case OFILETYPE_PAGE: value=FILETYPE_PAGE; break;
3804                                                         default: value=0; break;
3805                                                 }
3806                                                 if (value!=0)
3807                                                         TIFFSetField(tif,TIFFTAG_SUBFILETYPE,value);
3808                                         }
3809                                 }
3810                                 break;
3811 /* END REV 4.0 COMPATIBILITY */
3812                         default:
3813                                 (void) TIFFFetchNormalTag(tif, dp, TRUE);
3814                                 break;
3815                 }
3816         }
3817         /*
3818          * OJPEG hack:
3819          * - If a) compression is OJPEG, and b) photometric tag is missing,
3820          * then we consistently find that photometric should be YCbCr
3821          * - If a) compression is OJPEG, and b) photometric tag says it's RGB,
3822          * then we consistently find that the buggy implementation of the
3823          * buggy compression scheme matches photometric YCbCr instead.
3824          * - If a) compression is OJPEG, and b) bitspersample tag is missing,
3825          * then we consistently find bitspersample should be 8.
3826          * - If a) compression is OJPEG, b) samplesperpixel tag is missing,
3827          * and c) photometric is RGB or YCbCr, then we consistently find
3828          * samplesperpixel should be 3
3829          * - If a) compression is OJPEG, b) samplesperpixel tag is missing,
3830          * and c) photometric is MINISWHITE or MINISBLACK, then we consistently
3831          * find samplesperpixel should be 3
3832          */
3833         if (tif->tif_dir.td_compression==COMPRESSION_OJPEG)
3834         {
3835                 if (!TIFFFieldSet(tif,FIELD_PHOTOMETRIC))
3836                 {
3837                         TIFFWarningExt(tif->tif_clientdata, module,
3838                             "Photometric tag is missing, assuming data is YCbCr");
3839                         if (!TIFFSetField(tif,TIFFTAG_PHOTOMETRIC,PHOTOMETRIC_YCBCR))
3840                                 goto bad;
3841                 }
3842                 else if (tif->tif_dir.td_photometric==PHOTOMETRIC_RGB)
3843                 {
3844                         tif->tif_dir.td_photometric=PHOTOMETRIC_YCBCR;
3845                         TIFFWarningExt(tif->tif_clientdata, module,
3846                             "Photometric tag value assumed incorrect, "
3847                             "assuming data is YCbCr instead of RGB");
3848                 }
3849                 if (!TIFFFieldSet(tif,FIELD_BITSPERSAMPLE))
3850                 {
3851                         TIFFWarningExt(tif->tif_clientdata,module,
3852                             "BitsPerSample tag is missing, assuming 8 bits per sample");
3853                         if (!TIFFSetField(tif,TIFFTAG_BITSPERSAMPLE,8))
3854                                 goto bad;
3855                 }
3856                 if (!TIFFFieldSet(tif,FIELD_SAMPLESPERPIXEL))
3857                 {
3858                         if (tif->tif_dir.td_photometric==PHOTOMETRIC_RGB)
3859                         {
3860                                 TIFFWarningExt(tif->tif_clientdata,module,
3861                                     "SamplesPerPixel tag is missing, "
3862                                     "assuming correct SamplesPerPixel value is 3");
3863                                 if (!TIFFSetField(tif,TIFFTAG_SAMPLESPERPIXEL,3))
3864                                         goto bad;
3865                         }
3866                         if (tif->tif_dir.td_photometric==PHOTOMETRIC_YCBCR)
3867                         {
3868                                 TIFFWarningExt(tif->tif_clientdata,module,
3869                                     "SamplesPerPixel tag is missing, "
3870                                     "applying correct SamplesPerPixel value of 3");
3871                                 if (!TIFFSetField(tif,TIFFTAG_SAMPLESPERPIXEL,3))
3872                                         goto bad;
3873                         }
3874                         else if ((tif->tif_dir.td_photometric==PHOTOMETRIC_MINISWHITE)
3875                                  || (tif->tif_dir.td_photometric==PHOTOMETRIC_MINISBLACK))
3876                         {
3877                                 /*
3878                                  * SamplesPerPixel tag is missing, but is not required
3879                                  * by spec.  Assume correct SamplesPerPixel value of 1.
3880                                  */
3881                                 if (!TIFFSetField(tif,TIFFTAG_SAMPLESPERPIXEL,1))
3882                                         goto bad;
3883                         }
3884                 }
3885         }
3886         /*
3887          * Verify Palette image has a Colormap.
3888          */
3889         if (tif->tif_dir.td_photometric == PHOTOMETRIC_PALETTE &&
3890             !TIFFFieldSet(tif, FIELD_COLORMAP)) {
3891                 if ( tif->tif_dir.td_bitspersample>=8 && tif->tif_dir.td_samplesperpixel==3)
3892                         tif->tif_dir.td_photometric = PHOTOMETRIC_RGB;
3893                 else if (tif->tif_dir.td_bitspersample>=8)
3894                         tif->tif_dir.td_photometric = PHOTOMETRIC_MINISBLACK;
3895                 else {
3896                         MissingRequired(tif, "Colormap");
3897                         goto bad;
3898                 }
3899         }
3900         /*
3901          * OJPEG hack:
3902          * We do no further messing with strip/tile offsets/bytecounts in OJPEG
3903          * TIFFs
3904          */
3905         if (tif->tif_dir.td_compression!=COMPRESSION_OJPEG)
3906         {
3907                 /*
3908                  * Attempt to deal with a missing StripByteCounts tag.
3909                  */
3910                 if (!TIFFFieldSet(tif, FIELD_STRIPBYTECOUNTS)) {
3911                         /*
3912                          * Some manufacturers violate the spec by not giving
3913                          * the size of the strips.  In this case, assume there
3914                          * is one uncompressed strip of data.
3915                          */
3916                         if ((tif->tif_dir.td_planarconfig == PLANARCONFIG_CONTIG &&
3917                             tif->tif_dir.td_nstrips > 1) ||
3918                             (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE &&
3919                              tif->tif_dir.td_nstrips != (uint32)tif->tif_dir.td_samplesperpixel)) {
3920                             MissingRequired(tif, "StripByteCounts");
3921                             goto bad;
3922                         }
3923                         TIFFWarningExt(tif->tif_clientdata, module,
3924                                 "TIFF directory is missing required "
3925                                 "\"StripByteCounts\" field, calculating from imagelength");
3926                         if (EstimateStripByteCounts(tif, dir, dircount) < 0)
3927                             goto bad;
3928                 /*
3929                  * Assume we have wrong StripByteCount value (in case
3930                  * of single strip) in following cases:
3931                  *   - it is equal to zero along with StripOffset;
3932                  *   - it is larger than file itself (in case of uncompressed
3933                  *     image);
3934                  *   - it is smaller than the size of the bytes per row
3935                  *     multiplied on the number of rows.  The last case should
3936                  *     not be checked in the case of writing new image,
3937                  *     because we may do not know the exact strip size
3938                  *     until the whole image will be written and directory
3939                  *     dumped out.
3940                  */
3941                 #define BYTECOUNTLOOKSBAD \
3942                     ( (tif->tif_dir.td_stripbytecount[0] == 0 && tif->tif_dir.td_stripoffset[0] != 0) || \
3943                       (tif->tif_dir.td_compression == COMPRESSION_NONE && \
3944                        tif->tif_dir.td_stripbytecount[0] > TIFFGetFileSize(tif) - tif->tif_dir.td_stripoffset[0]) || \
3945                       (tif->tif_mode == O_RDONLY && \
3946                        tif->tif_dir.td_compression == COMPRESSION_NONE && \
3947                        tif->tif_dir.td_stripbytecount[0] < TIFFScanlineSize64(tif) * tif->tif_dir.td_imagelength) )
3948
3949                 } else if (tif->tif_dir.td_nstrips == 1
3950                            && _TIFFFillStriles(tif)
3951                            && tif->tif_dir.td_stripoffset[0] != 0
3952                            && BYTECOUNTLOOKSBAD) {
3953                         /*
3954                          * XXX: Plexus (and others) sometimes give a value of
3955                          * zero for a tag when they don't know what the
3956                          * correct value is!  Try and handle the simple case
3957                          * of estimating the size of a one strip image.
3958                          */
3959                         TIFFWarningExt(tif->tif_clientdata, module,
3960                             "Bogus \"StripByteCounts\" field, ignoring and calculating from imagelength");
3961                         if(EstimateStripByteCounts(tif, dir, dircount) < 0)
3962                             goto bad;
3963
3964 #if !defined(DEFER_STRILE_LOAD)
3965                 } else if (tif->tif_dir.td_planarconfig == PLANARCONFIG_CONTIG
3966                            && tif->tif_dir.td_nstrips > 2
3967                            && tif->tif_dir.td_compression == COMPRESSION_NONE
3968                            && tif->tif_dir.td_stripbytecount[0] != tif->tif_dir.td_stripbytecount[1]
3969                            && tif->tif_dir.td_stripbytecount[0] != 0
3970                            && tif->tif_dir.td_stripbytecount[1] != 0 ) {
3971                         /*
3972                          * XXX: Some vendors fill StripByteCount array with
3973                          * absolutely wrong values (it can be equal to
3974                          * StripOffset array, for example). Catch this case
3975                          * here.
3976                          *
3977                          * We avoid this check if deferring strile loading
3978                          * as it would always force us to load the strip/tile
3979                          * information.
3980                          */
3981                         TIFFWarningExt(tif->tif_clientdata, module,
3982                             "Wrong \"StripByteCounts\" field, ignoring and calculating from imagelength");
3983                         if (EstimateStripByteCounts(tif, dir, dircount) < 0)
3984                             goto bad;
3985 #endif /* !defined(DEFER_STRILE_LOAD) */
3986                 }
3987         }
3988         if (dir)
3989         {
3990                 _TIFFfree(dir);
3991                 dir=NULL;
3992         }
3993         if (!TIFFFieldSet(tif, FIELD_MAXSAMPLEVALUE))
3994         {
3995                 if (tif->tif_dir.td_bitspersample>=16)
3996                         tif->tif_dir.td_maxsamplevalue=0xFFFF;
3997                 else
3998                         tif->tif_dir.td_maxsamplevalue = (uint16)((1L<<tif->tif_dir.td_bitspersample)-1);
3999         }
4000         /*
4001          * XXX: We can optimize checking for the strip bounds using the sorted
4002          * bytecounts array. See also comments for TIFFAppendToStrip()
4003          * function in tif_write.c.
4004          */
4005 #if !defined(DEFER_STRILE_LOAD)
4006         if (tif->tif_dir.td_nstrips > 1) {
4007                 uint32 strip;
4008
4009                 tif->tif_dir.td_stripbytecountsorted = 1;
4010                 for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++) {
4011                         if (tif->tif_dir.td_stripoffset[strip - 1] >
4012                             tif->tif_dir.td_stripoffset[strip]) {
4013                                 tif->tif_dir.td_stripbytecountsorted = 0;
4014                                 break;
4015                         }
4016                 }
4017         }
4018 #endif /* !defined(DEFER_STRILE_LOAD) */
4019
4020         /*
4021          * An opportunity for compression mode dependent tag fixup
4022          */
4023         (*tif->tif_fixuptags)(tif);
4024
4025         /*
4026          * Some manufacturers make life difficult by writing
4027          * large amounts of uncompressed data as a single strip.
4028          * This is contrary to the recommendations of the spec.
4029          * The following makes an attempt at breaking such images
4030          * into strips closer to the recommended 8k bytes.  A
4031          * side effect, however, is that the RowsPerStrip tag
4032          * value may be changed.
4033          */
4034         if ((tif->tif_dir.td_planarconfig==PLANARCONFIG_CONTIG)&&
4035             (tif->tif_dir.td_nstrips==1)&&
4036             (tif->tif_dir.td_compression==COMPRESSION_NONE)&&
4037             ((tif->tif_flags&(TIFF_STRIPCHOP|TIFF_ISTILED))==TIFF_STRIPCHOP))
4038     {
4039         if ( !_TIFFFillStriles(tif) || !tif->tif_dir.td_stripbytecount )
4040             return 0;
4041                 ChopUpSingleUncompressedStrip(tif);
4042     }
4043
4044         /*
4045          * Clear the dirty directory flag.
4046          */
4047         tif->tif_flags &= ~TIFF_DIRTYDIRECT;
4048         tif->tif_flags &= ~TIFF_DIRTYSTRIP;
4049
4050         /*
4051          * Reinitialize i/o since we are starting on a new directory.
4052          */
4053         tif->tif_row = (uint32) -1;
4054         tif->tif_curstrip = (uint32) -1;
4055         tif->tif_col = (uint32) -1;
4056         tif->tif_curtile = (uint32) -1;
4057         tif->tif_tilesize = (tmsize_t) -1;
4058
4059         tif->tif_scanlinesize = TIFFScanlineSize(tif);
4060         if (!tif->tif_scanlinesize) {
4061                 TIFFErrorExt(tif->tif_clientdata, module,
4062                     "Cannot handle zero scanline size");
4063                 return (0);
4064         }
4065
4066         if (isTiled(tif)) {
4067                 tif->tif_tilesize = TIFFTileSize(tif);
4068                 if (!tif->tif_tilesize) {
4069                         TIFFErrorExt(tif->tif_clientdata, module,
4070                              "Cannot handle zero tile size");
4071                         return (0);
4072                 }
4073         } else {
4074                 if (!TIFFStripSize(tif)) {
4075                         TIFFErrorExt(tif->tif_clientdata, module,
4076                             "Cannot handle zero strip size");
4077                         return (0);
4078                 }
4079         }
4080         return (1);
4081 bad:
4082         if (dir)
4083                 _TIFFfree(dir);
4084         return (0);
4085 }
4086
4087 static void
4088 TIFFReadDirectoryCheckOrder(TIFF* tif, TIFFDirEntry* dir, uint16 dircount)
4089 {
4090         static const char module[] = "TIFFReadDirectoryCheckOrder";
4091         uint16 m;
4092         uint16 n;
4093         TIFFDirEntry* o;
4094         m=0;
4095         for (n=0, o=dir; n<dircount; n++, o++)
4096         {
4097                 if (o->tdir_tag<m)
4098                 {
4099                         TIFFWarningExt(tif->tif_clientdata,module,
4100                             "Invalid TIFF directory; tags are not sorted in ascending order");
4101                         break;
4102                 }
4103                 m=o->tdir_tag+1;
4104         }
4105 }
4106
4107 static TIFFDirEntry*
4108 TIFFReadDirectoryFindEntry(TIFF* tif, TIFFDirEntry* dir, uint16 dircount, uint16 tagid)
4109 {
4110         TIFFDirEntry* m;
4111         uint16 n;
4112         (void) tif;
4113         for (m=dir, n=0; n<dircount; m++, n++)
4114         {
4115                 if (m->tdir_tag==tagid)
4116                         return(m);
4117         }
4118         return(0);
4119 }
4120
4121 static void
4122 TIFFReadDirectoryFindFieldInfo(TIFF* tif, uint16 tagid, uint32* fii)
4123 {
4124         int32 ma,mb,mc;
4125         ma=-1;
4126         mc=(int32)tif->tif_nfields;
4127         while (1)
4128         {
4129                 if (ma+1==mc)
4130                 {
4131                         *fii = FAILED_FII;
4132                         return;
4133                 }
4134                 mb=(ma+mc)/2;
4135                 if (tif->tif_fields[mb]->field_tag==(uint32)tagid)
4136                         break;
4137                 if (tif->tif_fields[mb]->field_tag<(uint32)tagid)
4138                         ma=mb;
4139                 else
4140                         mc=mb;
4141         }
4142         while (1)
4143         {
4144                 if (mb==0)
4145                         break;
4146                 if (tif->tif_fields[mb-1]->field_tag!=(uint32)tagid)
4147                         break;
4148                 mb--;
4149         }
4150         *fii=mb;
4151 }
4152
4153 /*
4154  * Read custom directory from the arbitarry offset.
4155  * The code is very similar to TIFFReadDirectory().
4156  */
4157 int
4158 TIFFReadCustomDirectory(TIFF* tif, toff_t diroff,
4159                         const TIFFFieldArray* infoarray)
4160 {
4161         static const char module[] = "TIFFReadCustomDirectory";
4162         TIFFDirEntry* dir;
4163         uint16 dircount;
4164         TIFFDirEntry* dp;
4165         uint16 di;
4166         const TIFFField* fip;
4167         uint32 fii;
4168         _TIFFSetupFields(tif, infoarray);
4169         dircount=TIFFFetchDirectory(tif,diroff,&dir,NULL);
4170         if (!dircount)
4171         {
4172                 TIFFErrorExt(tif->tif_clientdata,module,
4173                     "Failed to read custom directory at offset " TIFF_UINT64_FORMAT,diroff);
4174                 return 0;
4175         }
4176         TIFFFreeDirectory(tif);
4177         _TIFFmemset(&tif->tif_dir, 0, sizeof(TIFFDirectory));
4178         TIFFReadDirectoryCheckOrder(tif,dir,dircount);
4179         for (di=0, dp=dir; di<dircount; di++, dp++)
4180         {
4181                 TIFFReadDirectoryFindFieldInfo(tif,dp->tdir_tag,&fii);
4182                 if (fii == FAILED_FII)
4183                 {
4184                         TIFFWarningExt(tif->tif_clientdata, module,
4185                             "Unknown field with tag %d (0x%x) encountered",
4186                             dp->tdir_tag, dp->tdir_tag);
4187                         if (!_TIFFMergeFields(tif, _TIFFCreateAnonField(tif,
4188                                                 dp->tdir_tag,
4189                                                 (TIFFDataType) dp->tdir_type),
4190                                              1)) {
4191                                 TIFFWarningExt(tif->tif_clientdata, module,
4192                                     "Registering anonymous field with tag %d (0x%x) failed",
4193                                     dp->tdir_tag, dp->tdir_tag);
4194                                 dp->tdir_tag=IGNORE;
4195                         } else {
4196                                 TIFFReadDirectoryFindFieldInfo(tif,dp->tdir_tag,&fii);
4197                                 assert( fii != FAILED_FII );
4198                         }
4199                 }
4200                 if (dp->tdir_tag!=IGNORE)
4201                 {
4202                         fip=tif->tif_fields[fii];
4203                         if (fip->field_bit==FIELD_IGNORE)
4204                                 dp->tdir_tag=IGNORE;
4205                         else
4206                         {
4207                                 /* check data type */
4208                                 while ((fip->field_type!=TIFF_ANY)&&(fip->field_type!=dp->tdir_type))
4209                                 {
4210                                         fii++;
4211                                         if ((fii==tif->tif_nfields)||
4212                                             (tif->tif_fields[fii]->field_tag!=(uint32)dp->tdir_tag))
4213                                         {
4214                                                 fii=0xFFFF;
4215                                                 break;
4216                                         }
4217                                         fip=tif->tif_fields[fii];
4218                                 }
4219                                 if (fii==0xFFFF)
4220                                 {
4221                                         TIFFWarningExt(tif->tif_clientdata, module,
4222                                             "Wrong data type %d for \"%s\"; tag ignored",
4223                                             dp->tdir_type,fip->field_name);
4224                                         dp->tdir_tag=IGNORE;
4225                                 }
4226                                 else
4227                                 {
4228                                         /* check count if known in advance */
4229                                         if ((fip->field_readcount!=TIFF_VARIABLE)&&
4230                                             (fip->field_readcount!=TIFF_VARIABLE2))
4231                                         {
4232                                                 uint32 expected;
4233                                                 if (fip->field_readcount==TIFF_SPP)
4234                                                         expected=(uint32)tif->tif_dir.td_samplesperpixel;
4235                                                 else
4236                                                         expected=(uint32)fip->field_readcount;
4237                                                 if (!CheckDirCount(tif,dp,expected))
4238                                                         dp->tdir_tag=IGNORE;
4239                                         }
4240                                 }
4241                         }
4242                         switch (dp->tdir_tag)
4243                         {
4244                                 case IGNORE:
4245                                         break;
4246                                 case EXIFTAG_SUBJECTDISTANCE:
4247                                         (void) TIFFFetchSubjectDistance(tif,dp);
4248                                         break;
4249                                 default:
4250                                         (void) TIFFFetchNormalTag(tif, dp, TRUE);
4251                                         break;
4252                         }
4253                 }
4254         }
4255         if (dir)
4256                 _TIFFfree(dir);
4257         return 1;
4258 }
4259
4260 /*
4261  * EXIF is important special case of custom IFD, so we have a special
4262  * function to read it.
4263  */
4264 int
4265 TIFFReadEXIFDirectory(TIFF* tif, toff_t diroff)
4266 {
4267         const TIFFFieldArray* exifFieldArray;
4268         exifFieldArray = _TIFFGetExifFields();
4269         return TIFFReadCustomDirectory(tif, diroff, exifFieldArray);
4270 }
4271
4272 static int
4273 EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount)
4274 {
4275         static const char module[] = "EstimateStripByteCounts";
4276
4277         TIFFDirEntry *dp;
4278         TIFFDirectory *td = &tif->tif_dir;
4279         uint32 strip;
4280
4281     _TIFFFillStriles( tif );
4282
4283         if (td->td_stripbytecount)
4284                 _TIFFfree(td->td_stripbytecount);
4285         td->td_stripbytecount = (uint64*)
4286             _TIFFCheckMalloc(tif, td->td_nstrips, sizeof (uint64),
4287                 "for \"StripByteCounts\" array");
4288         if( td->td_stripbytecount == NULL )
4289             return -1;
4290
4291         if (td->td_compression != COMPRESSION_NONE) {
4292                 uint64 space;
4293                 uint64 filesize;
4294                 uint16 n;
4295                 filesize = TIFFGetFileSize(tif);
4296                 if (!(tif->tif_flags&TIFF_BIGTIFF))
4297                         space=sizeof(TIFFHeaderClassic)+2+dircount*12+4;
4298                 else
4299                         space=sizeof(TIFFHeaderBig)+8+dircount*20+8;
4300                 /* calculate amount of space used by indirect values */
4301                 for (dp = dir, n = dircount; n > 0; n--, dp++)
4302                 {
4303                         uint32 typewidth = TIFFDataWidth((TIFFDataType) dp->tdir_type);
4304                         uint64 datasize;
4305                         typewidth = TIFFDataWidth((TIFFDataType) dp->tdir_type);
4306                         if (typewidth == 0) {
4307                                 TIFFErrorExt(tif->tif_clientdata, module,
4308                                     "Cannot determine size of unknown tag type %d",
4309                                     dp->tdir_type);
4310                                 return -1;
4311                         }
4312                         datasize=(uint64)typewidth*dp->tdir_count;
4313                         if (!(tif->tif_flags&TIFF_BIGTIFF))
4314                         {
4315                                 if (datasize<=4)
4316                                         datasize=0;
4317                         }
4318                         else
4319                         {
4320                                 if (datasize<=8)
4321                                         datasize=0;
4322                         }
4323                         space+=datasize;
4324                 }
4325                 space = filesize - space;
4326                 if (td->td_planarconfig == PLANARCONFIG_SEPARATE)
4327                         space /= td->td_samplesperpixel;
4328                 for (strip = 0; strip < td->td_nstrips; strip++)
4329                         td->td_stripbytecount[strip] = space;
4330                 /*
4331                  * This gross hack handles the case were the offset to
4332                  * the last strip is past the place where we think the strip
4333                  * should begin.  Since a strip of data must be contiguous,
4334                  * it's safe to assume that we've overestimated the amount
4335                  * of data in the strip and trim this number back accordingly.
4336                  */
4337                 strip--;
4338                 if (td->td_stripoffset[strip]+td->td_stripbytecount[strip] > filesize)
4339                         td->td_stripbytecount[strip] = filesize - td->td_stripoffset[strip];
4340         } else if (isTiled(tif)) {
4341                 uint64 bytespertile = TIFFTileSize64(tif);
4342
4343                 for (strip = 0; strip < td->td_nstrips; strip++)
4344                     td->td_stripbytecount[strip] = bytespertile;
4345         } else {
4346                 uint64 rowbytes = TIFFScanlineSize64(tif);
4347                 uint32 rowsperstrip = td->td_imagelength/td->td_stripsperimage;
4348                 for (strip = 0; strip < td->td_nstrips; strip++)
4349                         td->td_stripbytecount[strip] = rowbytes * rowsperstrip;
4350         }
4351         TIFFSetFieldBit(tif, FIELD_STRIPBYTECOUNTS);
4352         if (!TIFFFieldSet(tif, FIELD_ROWSPERSTRIP))
4353                 td->td_rowsperstrip = td->td_imagelength;
4354         return 1;
4355 }
4356
4357 static void
4358 MissingRequired(TIFF* tif, const char* tagname)
4359 {
4360         static const char module[] = "MissingRequired";
4361
4362         TIFFErrorExt(tif->tif_clientdata, module,
4363             "TIFF directory is missing required \"%s\" field",
4364             tagname);
4365 }
4366
4367 /*
4368  * Check the directory offset against the list of already seen directory
4369  * offsets. This is a trick to prevent IFD looping. The one can create TIFF
4370  * file with looped directory pointers. We will maintain a list of already
4371  * seen directories and check every IFD offset against that list.
4372  */
4373 static int
4374 TIFFCheckDirOffset(TIFF* tif, uint64 diroff)
4375 {
4376         uint16 n;
4377
4378         if (diroff == 0)                        /* no more directories */
4379                 return 0;
4380
4381         for (n = 0; n < tif->tif_dirnumber && tif->tif_dirlist; n++) {
4382                 if (tif->tif_dirlist[n] == diroff)
4383                         return 0;
4384         }
4385
4386         tif->tif_dirnumber++;
4387
4388         if (tif->tif_dirnumber > tif->tif_dirlistsize) {
4389                 uint64* new_dirlist;
4390
4391                 /*
4392                  * XXX: Reduce memory allocation granularity of the dirlist
4393                  * array.
4394                  */
4395                 new_dirlist = (uint64*)_TIFFCheckRealloc(tif, tif->tif_dirlist,
4396                     tif->tif_dirnumber, 2 * sizeof(uint64), "for IFD list");
4397                 if (!new_dirlist)
4398                         return 0;
4399                 tif->tif_dirlistsize = 2 * tif->tif_dirnumber;
4400                 tif->tif_dirlist = new_dirlist;
4401         }
4402
4403         tif->tif_dirlist[tif->tif_dirnumber - 1] = diroff;
4404
4405         return 1;
4406 }
4407
4408 /*
4409  * Check the count field of a directory entry against a known value.  The
4410  * caller is expected to skip/ignore the tag if there is a mismatch.
4411  */
4412 static int
4413 CheckDirCount(TIFF* tif, TIFFDirEntry* dir, uint32 count)
4414 {
4415         if ((uint64)count > dir->tdir_count) {
4416                 const TIFFField* fip = TIFFFieldWithTag(tif, dir->tdir_tag);
4417                 TIFFWarningExt(tif->tif_clientdata, tif->tif_name,
4418         "incorrect count for field \"%s\" (" TIFF_UINT64_FORMAT ", expecting %u); tag ignored",
4419                     fip ? fip->field_name : "unknown tagname",
4420                     dir->tdir_count, count);
4421                 return (0);
4422         } else if ((uint64)count < dir->tdir_count) {
4423                 const TIFFField* fip = TIFFFieldWithTag(tif, dir->tdir_tag);
4424                 TIFFWarningExt(tif->tif_clientdata, tif->tif_name,
4425         "incorrect count for field \"%s\" (" TIFF_UINT64_FORMAT ", expecting %u); tag trimmed",
4426                     fip ? fip->field_name : "unknown tagname",
4427                     dir->tdir_count, count);
4428                 dir->tdir_count = count;
4429                 return (1);
4430         }
4431         return (1);
4432 }
4433
4434 /*
4435  * Read IFD structure from the specified offset. If the pointer to
4436  * nextdiroff variable has been specified, read it too. Function returns a
4437  * number of fields in the directory or 0 if failed.
4438  */
4439 static uint16
4440 TIFFFetchDirectory(TIFF* tif, uint64 diroff, TIFFDirEntry** pdir,
4441                    uint64 *nextdiroff)
4442 {
4443         static const char module[] = "TIFFFetchDirectory";
4444
4445         void* origdir;
4446         uint16 dircount16;
4447         uint32 dirsize;
4448         TIFFDirEntry* dir;
4449         uint8* ma;
4450         TIFFDirEntry* mb;
4451         uint16 n;
4452
4453         assert(pdir);
4454
4455         tif->tif_diroff = diroff;
4456         if (nextdiroff)
4457                 *nextdiroff = 0;
4458         if (!isMapped(tif)) {
4459                 if (!SeekOK(tif, tif->tif_diroff)) {
4460                         TIFFErrorExt(tif->tif_clientdata, module,
4461                                 "%s: Seek error accessing TIFF directory",
4462                                 tif->tif_name);
4463                         return 0;
4464                 }
4465                 if (!(tif->tif_flags&TIFF_BIGTIFF))
4466                 {
4467                         if (!ReadOK(tif, &dircount16, sizeof (uint16))) {
4468                                 TIFFErrorExt(tif->tif_clientdata, module,
4469                                     "%s: Can not read TIFF directory count",
4470                                     tif->tif_name);
4471                                 return 0;
4472                         }
4473                         if (tif->tif_flags & TIFF_SWAB)
4474                                 TIFFSwabShort(&dircount16);
4475                         if (dircount16>4096)
4476                         {
4477                                 TIFFErrorExt(tif->tif_clientdata, module,
4478                                     "Sanity check on directory count failed, this is probably not a valid IFD offset");
4479                                 return 0;
4480                         }
4481                         dirsize = 12;
4482                 } else {
4483                         uint64 dircount64;
4484                         if (!ReadOK(tif, &dircount64, sizeof (uint64))) {
4485                                 TIFFErrorExt(tif->tif_clientdata, module,
4486                                         "%s: Can not read TIFF directory count",
4487                                         tif->tif_name);
4488                                 return 0;
4489                         }
4490                         if (tif->tif_flags & TIFF_SWAB)
4491                                 TIFFSwabLong8(&dircount64);
4492                         if (dircount64>4096)
4493                         {
4494                                 TIFFErrorExt(tif->tif_clientdata, module,
4495                                     "Sanity check on directory count failed, this is probably not a valid IFD offset");
4496                                 return 0;
4497                         }
4498                         dircount16 = (uint16)dircount64;
4499                         dirsize = 20;
4500                 }
4501                 origdir = _TIFFCheckMalloc(tif, dircount16,
4502                     dirsize, "to read TIFF directory");
4503                 if (origdir == NULL)
4504                         return 0;
4505                 if (!ReadOK(tif, origdir, (tmsize_t)(dircount16*dirsize))) {
4506                         TIFFErrorExt(tif->tif_clientdata, module,
4507                                 "%.100s: Can not read TIFF directory",
4508                                 tif->tif_name);
4509                         _TIFFfree(origdir);
4510                         return 0;
4511                 }
4512                 /*
4513                  * Read offset to next directory for sequential scans if
4514                  * needed.
4515                  */
4516                 if (nextdiroff)
4517                 {
4518                         if (!(tif->tif_flags&TIFF_BIGTIFF))
4519                         {
4520                                 uint32 nextdiroff32;
4521                                 if (!ReadOK(tif, &nextdiroff32, sizeof(uint32)))
4522                                         nextdiroff32 = 0;
4523                                 if (tif->tif_flags&TIFF_SWAB)
4524                                         TIFFSwabLong(&nextdiroff32);
4525                                 *nextdiroff=nextdiroff32;
4526                         } else {
4527                                 if (!ReadOK(tif, nextdiroff, sizeof(uint64)))
4528                                         *nextdiroff = 0;
4529                                 if (tif->tif_flags&TIFF_SWAB)
4530                                         TIFFSwabLong8(nextdiroff);
4531                         }
4532                 }
4533         } else {
4534                 tmsize_t m;
4535                 tmsize_t off = (tmsize_t) tif->tif_diroff;
4536                 if ((uint64)off!=tif->tif_diroff)
4537                 {
4538                         TIFFErrorExt(tif->tif_clientdata,module,"Can not read TIFF directory count");
4539                         return(0);
4540                 }
4541
4542                 /*
4543                  * Check for integer overflow when validating the dir_off,
4544                  * otherwise a very high offset may cause an OOB read and
4545                  * crash the client. Make two comparisons instead of
4546                  *
4547                  *  off + sizeof(uint16) > tif->tif_size
4548                  *
4549                  * to avoid overflow.
4550                  */
4551                 if (!(tif->tif_flags&TIFF_BIGTIFF))
4552                 {
4553                         m=off+sizeof(uint16);
4554                         if ((m<off)||(m<(tmsize_t)sizeof(uint16))||(m>tif->tif_size)) {
4555                                 TIFFErrorExt(tif->tif_clientdata, module,
4556                                         "Can not read TIFF directory count");
4557                                 return 0;
4558                         } else {
4559                                 _TIFFmemcpy(&dircount16, tif->tif_base + off,
4560                                             sizeof(uint16));
4561                         }
4562                         off += sizeof (uint16);
4563                         if (tif->tif_flags & TIFF_SWAB)
4564                                 TIFFSwabShort(&dircount16);
4565                         if (dircount16>4096)
4566                         {
4567                                 TIFFErrorExt(tif->tif_clientdata, module,
4568                                     "Sanity check on directory count failed, this is probably not a valid IFD offset");
4569                                 return 0;
4570                         }
4571                         dirsize = 12;
4572                 }
4573                 else
4574                 {
4575                         tmsize_t m;
4576                         uint64 dircount64;
4577                         m=off+sizeof(uint64);
4578                         if ((m<off)||(m<(tmsize_t)sizeof(uint64))||(m>tif->tif_size)) {
4579                                 TIFFErrorExt(tif->tif_clientdata, module,
4580                                         "Can not read TIFF directory count");
4581                                 return 0;
4582                         } else {
4583                                 _TIFFmemcpy(&dircount64, tif->tif_base + off,
4584                                             sizeof(uint64));
4585                         }
4586                         off += sizeof (uint64);
4587                         if (tif->tif_flags & TIFF_SWAB)
4588                                 TIFFSwabLong8(&dircount64);
4589                         if (dircount64>4096)
4590                         {
4591                                 TIFFErrorExt(tif->tif_clientdata, module,
4592                                     "Sanity check on directory count failed, this is probably not a valid IFD offset");
4593                                 return 0;
4594                         }
4595                         dircount16 = (uint16)dircount64;
4596                         dirsize = 20;
4597                 }
4598                 if (dircount16 == 0 )
4599                 {
4600                         TIFFErrorExt(tif->tif_clientdata, module,
4601                                      "Sanity check on directory count failed, zero tag directories not supported");
4602                         return 0;
4603                 }
4604                 origdir = _TIFFCheckMalloc(tif, dircount16,
4605                                                 dirsize,
4606                                                 "to read TIFF directory");
4607                 if (origdir == NULL)
4608                         return 0;
4609                 m=off+dircount16*dirsize;
4610                 if ((m<off)||(m<(tmsize_t)(dircount16*dirsize))||(m>tif->tif_size)) {
4611                         TIFFErrorExt(tif->tif_clientdata, module,
4612                                      "Can not read TIFF directory");
4613                         _TIFFfree(origdir);
4614                         return 0;
4615                 } else {
4616                         _TIFFmemcpy(origdir, tif->tif_base + off,
4617                                     dircount16 * dirsize);
4618                 }
4619                 if (nextdiroff) {
4620                         off += dircount16 * dirsize;
4621                         if (!(tif->tif_flags&TIFF_BIGTIFF))
4622                         {
4623                                 uint32 nextdiroff32;
4624                                 m=off+sizeof(uint32);
4625                                 if ((m<off)||(m<(tmsize_t)sizeof(uint32))||(m>tif->tif_size))
4626                                         nextdiroff32 = 0;
4627                                 else
4628                                         _TIFFmemcpy(&nextdiroff32, tif->tif_base + off,
4629                                                     sizeof (uint32));
4630                                 if (tif->tif_flags&TIFF_SWAB)
4631                                         TIFFSwabLong(&nextdiroff32);
4632                                 *nextdiroff = nextdiroff32;
4633                         }
4634                         else
4635                         {
4636                                 m=off+sizeof(uint64);
4637                                 if ((m<off)||(m<(tmsize_t)sizeof(uint64))||(m>tif->tif_size))
4638                                         *nextdiroff = 0;
4639                                 else
4640                                         _TIFFmemcpy(nextdiroff, tif->tif_base + off,
4641                                                     sizeof (uint64));
4642                                 if (tif->tif_flags&TIFF_SWAB)
4643                                         TIFFSwabLong8(nextdiroff);
4644                         }
4645                 }
4646         }
4647         dir = (TIFFDirEntry*)_TIFFCheckMalloc(tif, dircount16,
4648                                                 sizeof(TIFFDirEntry),
4649                                                 "to read TIFF directory");
4650         if (dir==0)
4651         {
4652                 _TIFFfree(origdir);
4653                 return 0;
4654         }
4655         ma=(uint8*)origdir;
4656         mb=dir;
4657         for (n=0; n<dircount16; n++)
4658         {
4659                 if (tif->tif_flags&TIFF_SWAB)
4660                         TIFFSwabShort((uint16*)ma);
4661                 mb->tdir_tag=*(uint16*)ma;
4662                 ma+=sizeof(uint16);
4663                 if (tif->tif_flags&TIFF_SWAB)
4664                         TIFFSwabShort((uint16*)ma);
4665                 mb->tdir_type=*(uint16*)ma;
4666                 ma+=sizeof(uint16);
4667                 if (!(tif->tif_flags&TIFF_BIGTIFF))
4668                 {
4669                         if (tif->tif_flags&TIFF_SWAB)
4670                                 TIFFSwabLong((uint32*)ma);
4671                         mb->tdir_count=(uint64)(*(uint32*)ma);
4672                         ma+=sizeof(uint32);
4673                         *(uint32*)(&mb->tdir_offset)=*(uint32*)ma;
4674                         ma+=sizeof(uint32);
4675                 }
4676                 else
4677                 {
4678                         if (tif->tif_flags&TIFF_SWAB)
4679                                 TIFFSwabLong8((uint64*)ma);
4680                         mb->tdir_count=TIFFReadUInt64(ma);
4681                         ma+=sizeof(uint64);
4682                         mb->tdir_offset.toff_long8=TIFFReadUInt64(ma);
4683                         ma+=sizeof(uint64);
4684                 }
4685                 mb++;
4686         }
4687         _TIFFfree(origdir);
4688         *pdir = dir;
4689         return dircount16;
4690 }
4691
4692 /*
4693  * Fetch a tag that is not handled by special case code.
4694  */
4695 static int
4696 TIFFFetchNormalTag(TIFF* tif, TIFFDirEntry* dp, int recover)
4697 {
4698         static const char module[] = "TIFFFetchNormalTag";
4699         enum TIFFReadDirEntryErr err;
4700         uint32 fii;
4701         const TIFFField* fip = NULL;
4702         TIFFReadDirectoryFindFieldInfo(tif,dp->tdir_tag,&fii);
4703         if( fii == FAILED_FII )
4704         {
4705             TIFFErrorExt(tif->tif_clientdata, "TIFFFetchNormalTag",
4706                          "No definition found for tag %d",
4707                          dp->tdir_tag);
4708             return 0;
4709         }
4710         fip=tif->tif_fields[fii];
4711         assert(fip->set_field_type!=TIFF_SETGET_OTHER);  /* if so, we shouldn't arrive here but deal with this in specialized code */
4712         assert(fip->set_field_type!=TIFF_SETGET_INT);    /* if so, we shouldn't arrive here as this is only the case for pseudo-tags */
4713         err=TIFFReadDirEntryErrOk;
4714         switch (fip->set_field_type)
4715         {
4716                 case TIFF_SETGET_UNDEFINED:
4717                         break;
4718                 case TIFF_SETGET_ASCII:
4719                         {
4720                                 uint8* data;
4721                                 assert(fip->field_passcount==0);
4722                                 err=TIFFReadDirEntryByteArray(tif,dp,&data);
4723                                 if (err==TIFFReadDirEntryErrOk)
4724                                 {
4725                                         uint8* ma;
4726                                         uint32 mb;
4727                                         int n;
4728                                         ma=data;
4729                                         mb=0;
4730                                         while (mb<(uint32)dp->tdir_count)
4731                                         {
4732                                                 if (*ma==0)
4733                                                         break;
4734                                                 ma++;
4735                                                 mb++;
4736                                         }
4737                                         if (mb+1<(uint32)dp->tdir_count)
4738                                                 TIFFWarningExt(tif->tif_clientdata,module,"ASCII value for tag \"%s\" contains null byte in value; value incorrectly truncated during reading due to implementation limitations",fip->field_name);
4739                                         else if (mb+1>(uint32)dp->tdir_count)
4740                                         {
4741                                                 uint8* o;
4742                                                 TIFFWarningExt(tif->tif_clientdata,module,"ASCII value for tag \"%s\" does not end in null byte",fip->field_name);
4743                                                 if ((uint32)dp->tdir_count+1!=dp->tdir_count+1)
4744                                                         o=NULL;
4745                                                 else
4746                                                         o=_TIFFmalloc((uint32)dp->tdir_count+1);
4747                                                 if (o==NULL)
4748                                                 {
4749                                                         if (data!=NULL)
4750                                                                 _TIFFfree(data);
4751                                                         return(0);
4752                                                 }
4753                                                 _TIFFmemcpy(o,data,(uint32)dp->tdir_count);
4754                                                 o[(uint32)dp->tdir_count]=0;
4755                                                 if (data!=0)
4756                                                         _TIFFfree(data);
4757                                                 data=o;
4758                                         }
4759                                         n=TIFFSetField(tif,dp->tdir_tag,data);
4760                                         if (data!=0)
4761                                                 _TIFFfree(data);
4762                                         if (!n)
4763                                                 return(0);
4764                                 }
4765                         }
4766                         break;
4767                 case TIFF_SETGET_UINT8:
4768                         {
4769                                 uint8 data=0;
4770                                 assert(fip->field_readcount==1);
4771                                 assert(fip->field_passcount==0);
4772                                 err=TIFFReadDirEntryByte(tif,dp,&data);
4773                                 if (err==TIFFReadDirEntryErrOk)
4774                                 {
4775                                         if (!TIFFSetField(tif,dp->tdir_tag,data))
4776                                                 return(0);
4777                                 }
4778                         }
4779                         break;
4780                 case TIFF_SETGET_UINT16:
4781                         {
4782                                 uint16 data;
4783                                 assert(fip->field_readcount==1);
4784                                 assert(fip->field_passcount==0);
4785                                 err=TIFFReadDirEntryShort(tif,dp,&data);
4786                                 if (err==TIFFReadDirEntryErrOk)
4787                                 {
4788                                         if (!TIFFSetField(tif,dp->tdir_tag,data))
4789                                                 return(0);
4790                                 }
4791                         }
4792                         break;
4793                 case TIFF_SETGET_UINT32:
4794                         {
4795                                 uint32 data;
4796                                 assert(fip->field_readcount==1);
4797                                 assert(fip->field_passcount==0);
4798                                 err=TIFFReadDirEntryLong(tif,dp,&data);
4799                                 if (err==TIFFReadDirEntryErrOk)
4800                                 {
4801                                         if (!TIFFSetField(tif,dp->tdir_tag,data))
4802                                                 return(0);
4803                                 }
4804                         }
4805                         break;
4806                 case TIFF_SETGET_UINT64:
4807                         {
4808                                 uint64 data;
4809                                 assert(fip->field_readcount==1);
4810                                 assert(fip->field_passcount==0);
4811                                 err=TIFFReadDirEntryLong8(tif,dp,&data);
4812                                 if (err==TIFFReadDirEntryErrOk)
4813                                 {
4814                                         if (!TIFFSetField(tif,dp->tdir_tag,data))
4815                                                 return(0);
4816                                 }
4817                         }
4818                         break;
4819                 case TIFF_SETGET_FLOAT:
4820                         {
4821                                 float data;
4822                                 assert(fip->field_readcount==1);
4823                                 assert(fip->field_passcount==0);
4824                                 err=TIFFReadDirEntryFloat(tif,dp,&data);
4825                                 if (err==TIFFReadDirEntryErrOk)
4826                                 {
4827                                         if (!TIFFSetField(tif,dp->tdir_tag,data))
4828                                                 return(0);
4829                                 }
4830                         }
4831                         break;
4832                 case TIFF_SETGET_DOUBLE:
4833                         {
4834                                 double data;
4835                                 assert(fip->field_readcount==1);
4836                                 assert(fip->field_passcount==0);
4837                                 err=TIFFReadDirEntryDouble(tif,dp,&data);
4838                                 if (err==TIFFReadDirEntryErrOk)
4839                                 {
4840                                         if (!TIFFSetField(tif,dp->tdir_tag,data))
4841                                                 return(0);
4842                                 }
4843                         }
4844                         break;
4845                 case TIFF_SETGET_IFD8:
4846                         {
4847                                 uint64 data;
4848                                 assert(fip->field_readcount==1);
4849                                 assert(fip->field_passcount==0);
4850                                 err=TIFFReadDirEntryIfd8(tif,dp,&data);
4851                                 if (err==TIFFReadDirEntryErrOk)
4852                                 {
4853                                         if (!TIFFSetField(tif,dp->tdir_tag,data))
4854                                                 return(0);
4855                                 }
4856                         }
4857                         break;
4858                 case TIFF_SETGET_UINT16_PAIR:
4859                         {
4860                                 uint16* data;
4861                                 assert(fip->field_readcount==2);
4862                                 assert(fip->field_passcount==0);
4863                                 if (dp->tdir_count!=2) {
4864                                         TIFFWarningExt(tif->tif_clientdata,module,
4865                                                        "incorrect count for field \"%s\", expected 2, got %d",
4866                                                        fip->field_name,(int)dp->tdir_count);
4867                                         return(0);
4868                                 }
4869                                 err=TIFFReadDirEntryShortArray(tif,dp,&data);
4870                                 if (err==TIFFReadDirEntryErrOk)
4871                                 {
4872                                         int m;
4873                                         m=TIFFSetField(tif,dp->tdir_tag,data[0],data[1]);
4874                                         _TIFFfree(data);
4875                                         if (!m)
4876                                                 return(0);
4877                                 }
4878                         }
4879                         break;
4880                 case TIFF_SETGET_C0_UINT8:
4881                         {
4882                                 uint8* data;
4883                                 assert(fip->field_readcount>=1);
4884                                 assert(fip->field_passcount==0);
4885                                 if (dp->tdir_count!=(uint64)fip->field_readcount) {
4886                                         TIFFWarningExt(tif->tif_clientdata,module,
4887                                                        "incorrect count for field \"%s\", expected %d, got %d",
4888                                                        fip->field_name,(int) fip->field_readcount, (int)dp->tdir_count);
4889                                         return 0;
4890                                 }
4891                                 else
4892                                 {
4893                                         err=TIFFReadDirEntryByteArray(tif,dp,&data);
4894                                         if (err==TIFFReadDirEntryErrOk)
4895                                         {
4896                                                 int m;
4897                                                 m=TIFFSetField(tif,dp->tdir_tag,data);
4898                                                 if (data!=0)
4899                                                         _TIFFfree(data);
4900                                                 if (!m)
4901                                                         return(0);
4902                                         }
4903                                 }
4904                         }
4905                         break;
4906                 case TIFF_SETGET_C0_UINT16:
4907                         {
4908                                 uint16* data;
4909                                 assert(fip->field_readcount>=1);
4910                                 assert(fip->field_passcount==0);
4911                                 if (dp->tdir_count!=(uint64)fip->field_readcount)
4912                                     /* corrupt file */;
4913                                 else
4914                                 {
4915                                         err=TIFFReadDirEntryShortArray(tif,dp,&data);
4916                                         if (err==TIFFReadDirEntryErrOk)
4917                                         {
4918                                                 int m;
4919                                                 m=TIFFSetField(tif,dp->tdir_tag,data);
4920                                                 if (data!=0)
4921                                                         _TIFFfree(data);
4922                                                 if (!m)
4923                                                         return(0);
4924                                         }
4925                                 }
4926                         }
4927                         break;
4928                 case TIFF_SETGET_C0_UINT32:
4929                         {
4930                                 uint32* data;
4931                                 assert(fip->field_readcount>=1);
4932                                 assert(fip->field_passcount==0);
4933                                 if (dp->tdir_count!=(uint64)fip->field_readcount)
4934                                     /* corrupt file */;
4935                                 else
4936                                 {
4937                                         err=TIFFReadDirEntryLongArray(tif,dp,&data);
4938                                         if (err==TIFFReadDirEntryErrOk)
4939                                         {
4940                                                 int m;
4941                                                 m=TIFFSetField(tif,dp->tdir_tag,data);
4942                                                 if (data!=0)
4943                                                         _TIFFfree(data);
4944                                                 if (!m)
4945                                                         return(0);
4946                                         }
4947                                 }
4948                         }
4949                         break;
4950                 case TIFF_SETGET_C0_FLOAT:
4951                         {
4952                                 float* data;
4953                                 assert(fip->field_readcount>=1);
4954                                 assert(fip->field_passcount==0);
4955                                 if (dp->tdir_count!=(uint64)fip->field_readcount)
4956                                     /* corrupt file */;
4957                                 else
4958                                 {
4959                                         err=TIFFReadDirEntryFloatArray(tif,dp,&data);
4960                                         if (err==TIFFReadDirEntryErrOk)
4961                                         {
4962                                                 int m;
4963                                                 m=TIFFSetField(tif,dp->tdir_tag,data);
4964                                                 if (data!=0)
4965                                                         _TIFFfree(data);
4966                                                 if (!m)
4967                                                         return(0);
4968                                         }
4969                                 }
4970                         }
4971                         break;
4972                 case TIFF_SETGET_C16_ASCII:
4973                         {
4974                                 uint8* data;
4975                                 assert(fip->field_readcount==TIFF_VARIABLE);
4976                                 assert(fip->field_passcount==1);
4977                                 if (dp->tdir_count>0xFFFF)
4978                                         err=TIFFReadDirEntryErrCount;
4979                                 else
4980                                 {
4981                                         err=TIFFReadDirEntryByteArray(tif,dp,&data);
4982                                         if (err==TIFFReadDirEntryErrOk)
4983                                         {
4984                                                 int m;
4985                                                 m=TIFFSetField(tif,dp->tdir_tag,(uint16)(dp->tdir_count),data);
4986                                                 if (data!=0)
4987                                                         _TIFFfree(data);
4988                                                 if (!m)
4989                                                         return(0);
4990                                         }
4991                                 }
4992                         }
4993                         break;
4994                 case TIFF_SETGET_C16_UINT8:
4995                         {
4996                                 uint8* data;
4997                                 assert(fip->field_readcount==TIFF_VARIABLE);
4998                                 assert(fip->field_passcount==1);
4999                                 if (dp->tdir_count>0xFFFF)
5000                                         err=TIFFReadDirEntryErrCount;
5001                                 else
5002                                 {
5003                                         err=TIFFReadDirEntryByteArray(tif,dp,&data);
5004                                         if (err==TIFFReadDirEntryErrOk)
5005                                         {
5006                                                 int m;
5007                                                 m=TIFFSetField(tif,dp->tdir_tag,(uint16)(dp->tdir_count),data);
5008                                                 if (data!=0)
5009                                                         _TIFFfree(data);
5010                                                 if (!m)
5011                                                         return(0);
5012                                         }
5013                                 }
5014                         }
5015                         break;
5016                 case TIFF_SETGET_C16_UINT16:
5017                         {
5018                                 uint16* data;
5019                                 assert(fip->field_readcount==TIFF_VARIABLE);
5020                                 assert(fip->field_passcount==1);
5021                                 if (dp->tdir_count>0xFFFF)
5022                                         err=TIFFReadDirEntryErrCount;
5023                                 else
5024                                 {
5025                                         err=TIFFReadDirEntryShortArray(tif,dp,&data);
5026                                         if (err==TIFFReadDirEntryErrOk)
5027                                         {
5028                                                 int m;
5029                                                 m=TIFFSetField(tif,dp->tdir_tag,(uint16)(dp->tdir_count),data);
5030                                                 if (data!=0)
5031                                                         _TIFFfree(data);
5032                                                 if (!m)
5033                                                         return(0);
5034                                         }
5035                                 }
5036                         }
5037                         break;
5038                 case TIFF_SETGET_C16_UINT32:
5039                         {
5040                                 uint32* data;
5041                                 assert(fip->field_readcount==TIFF_VARIABLE);
5042                                 assert(fip->field_passcount==1);
5043                                 if (dp->tdir_count>0xFFFF)
5044                                         err=TIFFReadDirEntryErrCount;
5045                                 else
5046                                 {
5047                                         err=TIFFReadDirEntryLongArray(tif,dp,&data);
5048                                         if (err==TIFFReadDirEntryErrOk)
5049                                         {
5050                                                 int m;
5051                                                 m=TIFFSetField(tif,dp->tdir_tag,(uint16)(dp->tdir_count),data);
5052                                                 if (data!=0)
5053                                                         _TIFFfree(data);
5054                                                 if (!m)
5055                                                         return(0);
5056                                         }
5057                                 }
5058                         }
5059                         break;
5060                 case TIFF_SETGET_C16_UINT64:
5061                         {
5062                                 uint64* data;
5063                                 assert(fip->field_readcount==TIFF_VARIABLE);
5064                                 assert(fip->field_passcount==1);
5065                                 if (dp->tdir_count>0xFFFF)
5066                                         err=TIFFReadDirEntryErrCount;
5067                                 else
5068                                 {
5069                                         err=TIFFReadDirEntryLong8Array(tif,dp,&data);
5070                                         if (err==TIFFReadDirEntryErrOk)
5071                                         {
5072                                                 int m;
5073                                                 m=TIFFSetField(tif,dp->tdir_tag,(uint16)(dp->tdir_count),data);
5074                                                 if (data!=0)
5075                                                         _TIFFfree(data);
5076                                                 if (!m)
5077                                                         return(0);
5078                                         }
5079                                 }
5080                         }
5081                         break;
5082                 case TIFF_SETGET_C16_FLOAT:
5083                         {
5084                                 float* data;
5085                                 assert(fip->field_readcount==TIFF_VARIABLE);
5086                                 assert(fip->field_passcount==1);
5087                                 if (dp->tdir_count>0xFFFF)
5088                                         err=TIFFReadDirEntryErrCount;
5089                                 else
5090                                 {
5091                                         err=TIFFReadDirEntryFloatArray(tif,dp,&data);
5092                                         if (err==TIFFReadDirEntryErrOk)
5093                                         {
5094                                                 int m;
5095                                                 m=TIFFSetField(tif,dp->tdir_tag,(uint16)(dp->tdir_count),data);
5096                                                 if (data!=0)
5097                                                         _TIFFfree(data);
5098                                                 if (!m)
5099                                                         return(0);
5100                                         }
5101                                 }
5102                         }
5103                         break;
5104                 case TIFF_SETGET_C16_DOUBLE:
5105                         {
5106                                 double* data;
5107                                 assert(fip->field_readcount==TIFF_VARIABLE);
5108                                 assert(fip->field_passcount==1);
5109                                 if (dp->tdir_count>0xFFFF)
5110                                         err=TIFFReadDirEntryErrCount;
5111                                 else
5112                                 {
5113                                         err=TIFFReadDirEntryDoubleArray(tif,dp,&data);
5114                                         if (err==TIFFReadDirEntryErrOk)
5115                                         {
5116                                                 int m;
5117                                                 m=TIFFSetField(tif,dp->tdir_tag,(uint16)(dp->tdir_count),data);
5118                                                 if (data!=0)
5119                                                         _TIFFfree(data);
5120                                                 if (!m)
5121                                                         return(0);
5122                                         }
5123                                 }
5124                         }
5125                         break;
5126                 case TIFF_SETGET_C16_IFD8:
5127                         {
5128                                 uint64* data;
5129                                 assert(fip->field_readcount==TIFF_VARIABLE);
5130                                 assert(fip->field_passcount==1);
5131                                 if (dp->tdir_count>0xFFFF)
5132                                         err=TIFFReadDirEntryErrCount;
5133                                 else
5134                                 {
5135                                         err=TIFFReadDirEntryIfd8Array(tif,dp,&data);
5136                                         if (err==TIFFReadDirEntryErrOk)
5137                                         {
5138                                                 int m;
5139                                                 m=TIFFSetField(tif,dp->tdir_tag,(uint16)(dp->tdir_count),data);
5140                                                 if (data!=0)
5141                                                         _TIFFfree(data);
5142                                                 if (!m)
5143                                                         return(0);
5144                                         }
5145                                 }
5146                         }
5147                         break;
5148                 case TIFF_SETGET_C32_ASCII:
5149                         {
5150                                 uint8* data;
5151                                 assert(fip->field_readcount==TIFF_VARIABLE2);
5152                                 assert(fip->field_passcount==1);
5153                                 err=TIFFReadDirEntryByteArray(tif,dp,&data);
5154                                 if (err==TIFFReadDirEntryErrOk)
5155                                 {
5156                                         int m;
5157                                         m=TIFFSetField(tif,dp->tdir_tag,(uint32)(dp->tdir_count),data);
5158                                         if (data!=0)
5159                                                 _TIFFfree(data);
5160                                         if (!m)
5161                                                 return(0);
5162                                 }
5163                         }
5164                         break;
5165                 case TIFF_SETGET_C32_UINT8:
5166                         {
5167                                 uint8* data;
5168                                 assert(fip->field_readcount==TIFF_VARIABLE2);
5169                                 assert(fip->field_passcount==1);
5170                                 err=TIFFReadDirEntryByteArray(tif,dp,&data);
5171                                 if (err==TIFFReadDirEntryErrOk)
5172                                 {
5173                                         int m;
5174                                         m=TIFFSetField(tif,dp->tdir_tag,(uint32)(dp->tdir_count),data);
5175                                         if (data!=0)
5176                                                 _TIFFfree(data);
5177                                         if (!m)
5178                                                 return(0);
5179                                 }
5180                         }
5181                         break;
5182                 case TIFF_SETGET_C32_SINT8:
5183                         {
5184                                 int8* data = NULL;
5185                                 assert(fip->field_readcount==TIFF_VARIABLE2);
5186                                 assert(fip->field_passcount==1);
5187                                 err=TIFFReadDirEntrySbyteArray(tif,dp,&data);
5188                                 if (err==TIFFReadDirEntryErrOk)
5189                                 {
5190                                         int m;
5191                                         m=TIFFSetField(tif,dp->tdir_tag,(uint32)(dp->tdir_count),data);
5192                                         if (data!=0)
5193                                                 _TIFFfree(data);
5194                                         if (!m)
5195                                                 return(0);
5196                                 }
5197                         }
5198                         break;
5199                 case TIFF_SETGET_C32_UINT16:
5200                         {
5201                                 uint16* data;
5202                                 assert(fip->field_readcount==TIFF_VARIABLE2);
5203                                 assert(fip->field_passcount==1);
5204                                 err=TIFFReadDirEntryShortArray(tif,dp,&data);
5205                                 if (err==TIFFReadDirEntryErrOk)
5206                                 {
5207                                         int m;
5208                                         m=TIFFSetField(tif,dp->tdir_tag,(uint32)(dp->tdir_count),data);
5209                                         if (data!=0)
5210                                                 _TIFFfree(data);
5211                                         if (!m)
5212                                                 return(0);
5213                                 }
5214                         }
5215                         break;
5216                 case TIFF_SETGET_C32_SINT16:
5217                         {
5218                                 int16* data = NULL;
5219                                 assert(fip->field_readcount==TIFF_VARIABLE2);
5220                                 assert(fip->field_passcount==1);
5221                                 err=TIFFReadDirEntrySshortArray(tif,dp,&data);
5222                                 if (err==TIFFReadDirEntryErrOk)
5223                                 {
5224                                         int m;
5225                                         m=TIFFSetField(tif,dp->tdir_tag,(uint32)(dp->tdir_count),data);
5226                                         if (data!=0)
5227                                                 _TIFFfree(data);
5228                                         if (!m)
5229                                                 return(0);
5230                                 }
5231                         }
5232                         break;
5233                 case TIFF_SETGET_C32_UINT32:
5234                         {
5235                                 uint32* data;
5236                                 assert(fip->field_readcount==TIFF_VARIABLE2);
5237                                 assert(fip->field_passcount==1);
5238                                 err=TIFFReadDirEntryLongArray(tif,dp,&data);
5239                                 if (err==TIFFReadDirEntryErrOk)
5240                                 {
5241                                         int m;
5242                                         m=TIFFSetField(tif,dp->tdir_tag,(uint32)(dp->tdir_count),data);
5243                                         if (data!=0)
5244                                                 _TIFFfree(data);
5245                                         if (!m)
5246                                                 return(0);
5247                                 }
5248                         }
5249                         break;
5250                 case TIFF_SETGET_C32_SINT32:
5251                         {
5252                                 int32* data = NULL;
5253                                 assert(fip->field_readcount==TIFF_VARIABLE2);
5254                                 assert(fip->field_passcount==1);
5255                                 err=TIFFReadDirEntrySlongArray(tif,dp,&data);
5256                                 if (err==TIFFReadDirEntryErrOk)
5257                                 {
5258                                         int m;
5259                                         m=TIFFSetField(tif,dp->tdir_tag,(uint32)(dp->tdir_count),data);
5260                                         if (data!=0)
5261                                                 _TIFFfree(data);
5262                                         if (!m)
5263                                                 return(0);
5264                                 }
5265                         }
5266                         break;
5267                 case TIFF_SETGET_C32_UINT64:
5268                         {
5269                                 uint64* data;
5270                                 assert(fip->field_readcount==TIFF_VARIABLE2);
5271                                 assert(fip->field_passcount==1);
5272                                 err=TIFFReadDirEntryLong8Array(tif,dp,&data);
5273                                 if (err==TIFFReadDirEntryErrOk)
5274                                 {
5275                                         int m;
5276                                         m=TIFFSetField(tif,dp->tdir_tag,(uint32)(dp->tdir_count),data);
5277                                         if (data!=0)
5278                                                 _TIFFfree(data);
5279                                         if (!m)
5280                                                 return(0);
5281                                 }
5282                         }
5283                         break;
5284                 case TIFF_SETGET_C32_SINT64:
5285                         {
5286                                 int64* data = NULL;
5287                                 assert(fip->field_readcount==TIFF_VARIABLE2);
5288                                 assert(fip->field_passcount==1);
5289                                 err=TIFFReadDirEntrySlong8Array(tif,dp,&data);
5290                                 if (err==TIFFReadDirEntryErrOk)
5291                                 {
5292                                         int m;
5293                                         m=TIFFSetField(tif,dp->tdir_tag,(uint32)(dp->tdir_count),data);
5294                                         if (data!=0)
5295                                                 _TIFFfree(data);
5296                                         if (!m)
5297                                                 return(0);
5298                                 }
5299                         }
5300                         break;
5301                 case TIFF_SETGET_C32_FLOAT:
5302                         {
5303                                 float* data;
5304                                 assert(fip->field_readcount==TIFF_VARIABLE2);
5305                                 assert(fip->field_passcount==1);
5306                                 err=TIFFReadDirEntryFloatArray(tif,dp,&data);
5307                                 if (err==TIFFReadDirEntryErrOk)
5308                                 {
5309                                         int m;
5310                                         m=TIFFSetField(tif,dp->tdir_tag,(uint32)(dp->tdir_count),data);
5311                                         if (data!=0)
5312                                                 _TIFFfree(data);
5313                                         if (!m)
5314                                                 return(0);
5315                                 }
5316                         }
5317                         break;
5318                 case TIFF_SETGET_C32_DOUBLE:
5319                         {
5320                                 double* data;
5321                                 assert(fip->field_readcount==TIFF_VARIABLE2);
5322                                 assert(fip->field_passcount==1);
5323                                 err=TIFFReadDirEntryDoubleArray(tif,dp,&data);
5324                                 if (err==TIFFReadDirEntryErrOk)
5325                                 {
5326                                         int m;
5327                                         m=TIFFSetField(tif,dp->tdir_tag,(uint32)(dp->tdir_count),data);
5328                                         if (data!=0)
5329                                                 _TIFFfree(data);
5330                                         if (!m)
5331                                                 return(0);
5332                                 }
5333                         }
5334                         break;
5335                 case TIFF_SETGET_C32_IFD8:
5336                         {
5337                                 uint64* data;
5338                                 assert(fip->field_readcount==TIFF_VARIABLE2);
5339                                 assert(fip->field_passcount==1);
5340                                 err=TIFFReadDirEntryIfd8Array(tif,dp,&data);
5341                                 if (err==TIFFReadDirEntryErrOk)
5342                                 {
5343                                         int m;
5344                                         m=TIFFSetField(tif,dp->tdir_tag,(uint32)(dp->tdir_count),data);
5345                                         if (data!=0)
5346                                                 _TIFFfree(data);
5347                                         if (!m)
5348                                                 return(0);
5349                                 }
5350                         }
5351                         break;
5352                 default:
5353                         assert(0);    /* we should never get here */
5354                         break;
5355         }
5356         if (err!=TIFFReadDirEntryErrOk)
5357         {
5358                 TIFFReadDirEntryOutputErr(tif,err,module,fip ? fip->field_name : "unknown tagname",recover);
5359                 return(0);
5360         }
5361         return(1);
5362 }
5363
5364 /*
5365  * Fetch a set of offsets or lengths.
5366  * While this routine says "strips", in fact it's also used for tiles.
5367  */
5368 static int
5369 TIFFFetchStripThing(TIFF* tif, TIFFDirEntry* dir, uint32 nstrips, uint64** lpp)
5370 {
5371         static const char module[] = "TIFFFetchStripThing";
5372         enum TIFFReadDirEntryErr err;
5373         uint64* data;
5374         err=TIFFReadDirEntryLong8Array(tif,dir,&data);
5375         if (err!=TIFFReadDirEntryErrOk)
5376         {
5377                 const TIFFField* fip = TIFFFieldWithTag(tif,dir->tdir_tag);
5378                 TIFFReadDirEntryOutputErr(tif,err,module,fip ? fip->field_name : "unknown tagname",0);
5379                 return(0);
5380         }
5381         if (dir->tdir_count!=(uint64)nstrips)
5382         {
5383                 uint64* resizeddata;
5384                 resizeddata=(uint64*)_TIFFCheckMalloc(tif,nstrips,sizeof(uint64),"for strip array");
5385                 if (resizeddata==0) {
5386                         _TIFFfree(data);
5387                         return(0);
5388                 }
5389                 if (dir->tdir_count<(uint64)nstrips)
5390                 {
5391                         _TIFFmemcpy(resizeddata,data,(uint32)dir->tdir_count*sizeof(uint64));
5392                         _TIFFmemset(resizeddata+(uint32)dir->tdir_count,0,(nstrips-(uint32)dir->tdir_count)*sizeof(uint64));
5393                 }
5394                 else
5395                         _TIFFmemcpy(resizeddata,data,nstrips*sizeof(uint64));
5396                 _TIFFfree(data);
5397                 data=resizeddata;
5398         }
5399         *lpp=data;
5400         return(1);
5401 }
5402
5403 /*
5404  * Fetch and set the SubjectDistance EXIF tag.
5405  */
5406 static int
5407 TIFFFetchSubjectDistance(TIFF* tif, TIFFDirEntry* dir)
5408 {
5409         static const char module[] = "TIFFFetchSubjectDistance";
5410         enum TIFFReadDirEntryErr err;
5411         UInt64Aligned_t m;
5412     m.l=0;
5413         assert(sizeof(double)==8);
5414         assert(sizeof(uint64)==8);
5415         assert(sizeof(uint32)==4);
5416         if (dir->tdir_count!=1)
5417                 err=TIFFReadDirEntryErrCount;
5418         else if (dir->tdir_type!=TIFF_RATIONAL)
5419                 err=TIFFReadDirEntryErrType;
5420         else
5421         {
5422                 if (!(tif->tif_flags&TIFF_BIGTIFF))
5423                 {
5424                         uint32 offset;
5425                         offset=*(uint32*)(&dir->tdir_offset);
5426                         if (tif->tif_flags&TIFF_SWAB)
5427                                 TIFFSwabLong(&offset);
5428                         err=TIFFReadDirEntryData(tif,offset,8,m.i);
5429                 }
5430                 else
5431                 {
5432                         m.l=dir->tdir_offset.toff_long8;
5433                         err=TIFFReadDirEntryErrOk;
5434                 }
5435         }
5436         if (err==TIFFReadDirEntryErrOk)
5437         {
5438                 double n;
5439                 if (tif->tif_flags&TIFF_SWAB)
5440                         TIFFSwabArrayOfLong(m.i,2);
5441                 if (m.i[0]==0)
5442                         n=0.0;
5443                 else if (m.i[0]==0xFFFFFFFF)
5444                         /*
5445                          * XXX: Numerator 0xFFFFFFFF means that we have infinite
5446                          * distance. Indicate that with a negative floating point
5447                          * SubjectDistance value.
5448                          */
5449                         n=-1.0;
5450                 else
5451                         n=(double)m.i[0]/(double)m.i[1];
5452                 return(TIFFSetField(tif,dir->tdir_tag,n));
5453         }
5454         else
5455         {
5456                 TIFFReadDirEntryOutputErr(tif,err,module,"SubjectDistance",TRUE);
5457                 return(0);
5458         }
5459 }
5460
5461 /*
5462  * Replace a single strip (tile) of uncompressed data by multiple strips
5463  * (tiles), each approximately STRIP_SIZE_DEFAULT bytes. This is useful for
5464  * dealing with large images or for dealing with machines with a limited
5465  * amount memory.
5466  */
5467 static void
5468 ChopUpSingleUncompressedStrip(TIFF* tif)
5469 {
5470         register TIFFDirectory *td = &tif->tif_dir;
5471         uint64 bytecount;
5472         uint64 offset;
5473         uint32 rowblock;
5474         uint64 rowblockbytes;
5475         uint64 stripbytes;
5476         uint32 strip;
5477         uint64 nstrips64;
5478         uint32 nstrips32;
5479         uint32 rowsperstrip;
5480         uint64* newcounts;
5481         uint64* newoffsets;
5482
5483         bytecount = td->td_stripbytecount[0];
5484         offset = td->td_stripoffset[0];
5485         assert(td->td_planarconfig == PLANARCONFIG_CONTIG);
5486         if ((td->td_photometric == PHOTOMETRIC_YCBCR)&&
5487             (!isUpSampled(tif)))
5488                 rowblock = td->td_ycbcrsubsampling[1];
5489         else
5490                 rowblock = 1;
5491         rowblockbytes = TIFFVTileSize64(tif, rowblock);
5492         /*
5493          * Make the rows hold at least one scanline, but fill specified amount
5494          * of data if possible.
5495          */
5496         if (rowblockbytes > STRIP_SIZE_DEFAULT) {
5497                 stripbytes = rowblockbytes;
5498                 rowsperstrip = rowblock;
5499         } else if (rowblockbytes > 0 ) {
5500                 uint32 rowblocksperstrip;
5501                 rowblocksperstrip = (uint32) (STRIP_SIZE_DEFAULT / rowblockbytes);
5502                 rowsperstrip = rowblocksperstrip * rowblock;
5503                 stripbytes = rowblocksperstrip * rowblockbytes;
5504         }
5505         else
5506             return;
5507
5508         /*
5509          * never increase the number of strips in an image
5510          */
5511         if (rowsperstrip >= td->td_rowsperstrip)
5512                 return;
5513         nstrips64 = TIFFhowmany_64(bytecount, stripbytes);
5514         if ((nstrips64==0)||(nstrips64>0xFFFFFFFF)) /* something is wonky, do nothing. */
5515             return;
5516         nstrips32 = (uint32)nstrips64;
5517
5518         newcounts = (uint64*) _TIFFCheckMalloc(tif, nstrips32, sizeof (uint64),
5519                                 "for chopped \"StripByteCounts\" array");
5520         newoffsets = (uint64*) _TIFFCheckMalloc(tif, nstrips32, sizeof (uint64),
5521                                 "for chopped \"StripOffsets\" array");
5522         if (newcounts == NULL || newoffsets == NULL) {
5523                 /*
5524                  * Unable to allocate new strip information, give up and use
5525                  * the original one strip information.
5526                  */
5527                 if (newcounts != NULL)
5528                         _TIFFfree(newcounts);
5529                 if (newoffsets != NULL)
5530                         _TIFFfree(newoffsets);
5531                 return;
5532         }
5533         /*
5534          * Fill the strip information arrays with new bytecounts and offsets
5535          * that reflect the broken-up format.
5536          */
5537         for (strip = 0; strip < nstrips32; strip++) {
5538                 if (stripbytes > bytecount)
5539                         stripbytes = bytecount;
5540                 newcounts[strip] = stripbytes;
5541                 newoffsets[strip] = offset;
5542                 offset += stripbytes;
5543                 bytecount -= stripbytes;
5544         }
5545         /*
5546          * Replace old single strip info with multi-strip info.
5547          */
5548         td->td_stripsperimage = td->td_nstrips = nstrips32;
5549         TIFFSetField(tif, TIFFTAG_ROWSPERSTRIP, rowsperstrip);
5550
5551         _TIFFfree(td->td_stripbytecount);
5552         _TIFFfree(td->td_stripoffset);
5553         td->td_stripbytecount = newcounts;
5554         td->td_stripoffset = newoffsets;
5555         td->td_stripbytecountsorted = 1;
5556 }
5557
5558 int _TIFFFillStriles( TIFF *tif )
5559 {
5560 #if defined(DEFER_STRILE_LOAD)
5561         register TIFFDirectory *td = &tif->tif_dir;
5562         int return_value = 1;
5563
5564         if( td->td_stripoffset != NULL )
5565                 return 1;
5566
5567         if( td->td_stripoffset_entry.tdir_count == 0 )
5568                 return 0;
5569
5570         if (!TIFFFetchStripThing(tif,&(td->td_stripoffset_entry),
5571                                  td->td_nstrips,&td->td_stripoffset))
5572         {
5573                 return_value = 0;
5574         }
5575
5576         if (!TIFFFetchStripThing(tif,&(td->td_stripbytecount_entry),
5577                                  td->td_nstrips,&td->td_stripbytecount))
5578         {
5579                 return_value = 0;
5580         }
5581
5582         _TIFFmemset( &(td->td_stripoffset_entry), 0, sizeof(TIFFDirEntry));
5583         _TIFFmemset( &(td->td_stripbytecount_entry), 0, sizeof(TIFFDirEntry));
5584
5585         if (tif->tif_dir.td_nstrips > 1 && return_value == 1 ) {
5586                 uint32 strip;
5587
5588                 tif->tif_dir.td_stripbytecountsorted = 1;
5589                 for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++) {
5590                         if (tif->tif_dir.td_stripoffset[strip - 1] >
5591                             tif->tif_dir.td_stripoffset[strip]) {
5592                                 tif->tif_dir.td_stripbytecountsorted = 0;
5593                                 break;
5594                         }
5595                 }
5596         }
5597
5598         return return_value;
5599 #else /* !defined(DEFER_STRILE_LOAD) */
5600         (void) tif;
5601         return 1;
5602 #endif
5603 }
5604
5605
5606 /* vim: set ts=8 sts=8 sw=8 noet: */
5607 /*
5608  * Local Variables:
5609  * mode: c
5610  * c-basic-offset: 8
5611  * fill-column: 78
5612  * End:
5613  */