Skip to content

Commit cadff5f

Browse files
szukw000szukw000
committed
These changes repair bugs of uclouvain#871 and uclouvain#872 
1 parent 7113c4e commit cadff5f

1 file changed

Lines changed: 70 additions & 37 deletions

File tree

‎src/bin/jp2/converttif.c‎

Lines changed: 70 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -553,20 +553,18 @@ static void tif_32sto16u(const OPJ_INT32* pSrc, OPJ_UINT16* pDst, OPJ_SIZE_T len
553553

554554
int imagetotif(opj_image_t * image, const char *outfile)
555555
{
556-
int width, height;
557-
int bps,adjust, sgnd;
558-
int tiPhoto;
556+
uint32 width, height, bps, tiPhoto;
557+
int adjust, sgnd;
559558
TIFF *tif;
560559
tdata_t buf;
561-
tsize_t strip_size;
560+
tmsize_t strip_size, rowStride;
562561
OPJ_UINT32 i, numcomps;
563-
OPJ_SIZE_T rowStride;
564562
OPJ_INT32* buffer32s = NULL;
565563
OPJ_INT32 const* planes[4];
566564
convert_32s_PXCX cvtPxToCx = NULL;
567565
convert_32sXXx_C1R cvt32sToTif = NULL;
568566

569-
bps = (int)image->comps[0].prec;
567+
bps = (uint32)image->comps[0].prec;
570568
planes[0] = image->comps[0].data;
571569

572570
numcomps = image->numcomps;
@@ -674,22 +672,22 @@ int imagetotif(opj_image_t * image, const char *outfile)
674672
break;
675673
}
676674
sgnd = (int)image->comps[0].sgnd;
677-
adjust = sgnd ? 1 << (image->comps[0].prec - 1) : 0;
678-
width = (int)image->comps[0].w;
679-
height = (int)image->comps[0].h;
675+
adjust = sgnd ? (int)(1 << (image->comps[0].prec - 1)) : 0;
676+
width = (uint32)image->comps[0].w;
677+
height = (uint32)image->comps[0].h;
680678

681679
TIFFSetField(tif, TIFFTAG_IMAGEWIDTH, width);
682680
TIFFSetField(tif, TIFFTAG_IMAGELENGTH, height);
683-
TIFFSetField(tif, TIFFTAG_SAMPLESPERPIXEL, numcomps);
681+
TIFFSetField(tif, TIFFTAG_SAMPLESPERPIXEL, (uint32)numcomps);
684682
TIFFSetField(tif, TIFFTAG_BITSPERSAMPLE, bps);
685683
TIFFSetField(tif, TIFFTAG_ORIENTATION, ORIENTATION_TOPLEFT);
686684
TIFFSetField(tif, TIFFTAG_PLANARCONFIG, PLANARCONFIG_CONTIG);
687685
TIFFSetField(tif, TIFFTAG_PHOTOMETRIC, tiPhoto);
688686
TIFFSetField(tif, TIFFTAG_ROWSPERSTRIP, 1);
689687

690688
strip_size = TIFFStripSize(tif);
691-
rowStride = ((OPJ_SIZE_T)width * numcomps * (OPJ_SIZE_T)bps + 7U) / 8U;
692-
if (rowStride != (OPJ_SIZE_T)strip_size) {
689+
rowStride = (width * numcomps * bps + 7U) / 8U;
690+
if (rowStride != strip_size) {
693691
fprintf(stderr, "Invalid TIFF strip size\n");
694692
TIFFClose(tif);
695693
return 1;
@@ -699,7 +697,7 @@ int imagetotif(opj_image_t * image, const char *outfile)
699697
TIFFClose(tif);
700698
return 1;
701699
}
702-
buffer32s = (OPJ_INT32 *)malloc((OPJ_SIZE_T)width * numcomps * sizeof(OPJ_INT32));
700+
buffer32s = (OPJ_INT32 *)malloc((OPJ_SIZE_T)(width * numcomps * sizeof(OPJ_INT32)));
703701
if (buffer32s == NULL) {
704702
_TIFFfree(buf);
705703
TIFFClose(tif);
@@ -1211,20 +1209,19 @@ opj_image_t* tiftoimage(const char *filename, opj_cparameters_t *parameters)
12111209
TIFF *tif;
12121210
tdata_t buf;
12131211
tstrip_t strip;
1214-
tsize_t strip_size;
1212+
tmsize_t strip_size;
12151213
int j, currentPlane, numcomps = 0, w, h;
12161214
OPJ_COLOR_SPACE color_space = OPJ_CLRSPC_UNKNOWN;
12171215
opj_image_cmptparm_t cmptparm[4]; /* RGBA */
12181216
opj_image_t *image = NULL;
12191217
int has_alpha = 0;
1220-
unsigned short tiBps, tiPhoto, tiSf, tiSpp, tiPC;
1221-
unsigned int tiWidth, tiHeight;
1218+
uint32 tiBps, tiPhoto, tiSf, tiSpp, tiPC, tiWidth, tiHeight;
12221219
OPJ_BOOL is_cinema = OPJ_IS_CINEMA(parameters->rsiz);
12231220
convert_XXx32s_C1R cvtTifTo32s = NULL;
12241221
convert_32s_CXPX cvtCxToPx = NULL;
12251222
OPJ_INT32* buffer32s = NULL;
12261223
OPJ_INT32* planes[4];
1227-
OPJ_SIZE_T rowStride;
1224+
tmsize_t rowStride;
12281225

12291226
tif = TIFFOpen(filename, "r");
12301227

@@ -1243,22 +1240,35 @@ opj_image_t* tiftoimage(const char *filename, opj_cparameters_t *parameters)
12431240
TIFFGetField(tif, TIFFTAG_SAMPLESPERPIXEL, &tiSpp);
12441241
TIFFGetField(tif, TIFFTAG_PHOTOMETRIC, &tiPhoto);
12451242
TIFFGetField(tif, TIFFTAG_PLANARCONFIG, &tiPC);
1246-
w= (int)tiWidth;
1247-
h= (int)tiHeight;
1248-
1249-
if(tiBps > 16U) {
1250-
fprintf(stderr,"tiftoimage: Bits=%d, Only 1 to 16 bits implemented\n",tiBps);
1251-
fprintf(stderr,"\tAborting\n");
1243+
1244+
if(tiSpp == 0 || tiSpp > 4) { /* should be 1 ... 4 */
1245+
fprintf(stderr,"tiftoimage: Bad value for samples per pixel == %hu.\n"
1246+
"\tAborting.\n", tiSpp);
1247+
TIFFClose(tif);
1248+
return NULL;
1249+
}
1250+
if(tiBps > 16U || tiBps == 0) {
1251+
fprintf(stderr,"tiftoimage: Bad values for Bits == %d.\n"
1252+
"\tMax. 16 Bits are allowed here.\n\tAborting.\n",tiBps);
12521253
TIFFClose(tif);
12531254
return NULL;
12541255
}
12551256
if(tiPhoto != PHOTOMETRIC_MINISBLACK && tiPhoto != PHOTOMETRIC_RGB) {
1256-
fprintf(stderr,"tiftoimage: Bad color format %d.\n\tOnly RGB(A) and GRAY(A) has been implemented\n",(int) tiPhoto);
1257+
fprintf(stderr,"tiftoimage: Bad color format %d.\n"
1258+
"\tOnly RGB(A) and GRAY(A) has been implemented\n",(int) tiPhoto);
12571259
fprintf(stderr,"\tAborting\n");
12581260
TIFFClose(tif);
12591261
return NULL;
12601262
}
1261-
1263+
if(tiWidth == 0 || tiHeight == 0) {
1264+
fprintf(stderr,"tiftoimage: Bad values for width(%u) "
1265+
"and/or height(%u)\n\tAborting.\n",tiWidth,tiHeight);
1266+
TIFFClose(tif);
1267+
return NULL;
1268+
}
1269+
w= (int)tiWidth;
1270+
h= (int)tiHeight;
1271+
12621272
switch (tiBps) {
12631273
case 1:
12641274
case 2:
@@ -1312,7 +1322,7 @@ opj_image_t* tiftoimage(const char *filename, opj_cparameters_t *parameters)
13121322

13131323
TIFFGetFieldDefaulted(tif, TIFFTAG_EXTRASAMPLES,
13141324
&extrasamples, &sampleinfo);
1315-
1325+
13161326
if(extrasamples >= 1)
13171327
{
13181328
switch(sampleinfo[0])
@@ -1333,7 +1343,7 @@ opj_image_t* tiftoimage(const char *filename, opj_cparameters_t *parameters)
13331343
else /* extrasamples == 0 */
13341344
if(tiSpp == 4 || tiSpp == 2) has_alpha = 1;
13351345
}
1336-
1346+
13371347
/* initialize image components */
13381348
memset(&cmptparm[0], 0, 4 * sizeof(opj_image_cmptparm_t));
13391349

@@ -1346,7 +1356,7 @@ opj_image_t* tiftoimage(const char *filename, opj_cparameters_t *parameters)
13461356
} else {
13471357
is_cinema = 0U;
13481358
}
1349-
1359+
13501360
if(tiPhoto == PHOTOMETRIC_RGB) /* RGB(A) */
13511361
{
13521362
numcomps = 3 + has_alpha;
@@ -1384,26 +1394,40 @@ opj_image_t* tiftoimage(const char *filename, opj_cparameters_t *parameters)
13841394
image->x0 = (OPJ_UINT32)parameters->image_offset_x0;
13851395
image->y0 = (OPJ_UINT32)parameters->image_offset_y0;
13861396
image->x1 = !image->x0 ? (OPJ_UINT32)(w - 1) * (OPJ_UINT32)subsampling_dx + 1 :
1387-
image->x0 + (OPJ_UINT32)(w - 1) * (OPJ_UINT32)subsampling_dx + 1;
1397+
image->x0 + (OPJ_UINT32)(w - 1) * (OPJ_UINT32)subsampling_dx + 1;
1398+
if(image->x1 <= image->x0) {
1399+
fprintf(stderr,"tiftoimage: Bad value for image->x1(%d) vs. "
1400+
"image->x0(%d)\n\tAborting.\n",image->x1,image->x0);
1401+
TIFFClose(tif);
1402+
opj_image_destroy(image);
1403+
return NULL;
1404+
}
13881405
image->y1 = !image->y0 ? (OPJ_UINT32)(h - 1) * (OPJ_UINT32)subsampling_dy + 1 :
1389-
image->y0 + (OPJ_UINT32)(h - 1) * (OPJ_UINT32)subsampling_dy + 1;
1390-
1406+
image->y0 + (OPJ_UINT32)(h - 1) * (OPJ_UINT32)subsampling_dy + 1;
1407+
if(image->y1 <= image->y0) {
1408+
fprintf(stderr,"tiftoimage: Bad value for image->y1(%d) vs. "
1409+
"image->y0(%d)\n\tAborting.\n",image->y1,image->y0);
1410+
TIFFClose(tif);
1411+
opj_image_destroy(image);
1412+
return NULL;
1413+
}
1414+
13911415
for(j = 0; j < numcomps; j++)
13921416
{
13931417
planes[j] = image->comps[j].data;
13941418
}
13951419
image->comps[numcomps - 1].alpha = (OPJ_UINT16)(1 - (numcomps & 1));
13961420

13971421
strip_size = TIFFStripSize(tif);
1398-
1422+
13991423
buf = _TIFFmalloc(strip_size);
14001424
if (buf == NULL) {
14011425
TIFFClose(tif);
14021426
opj_image_destroy(image);
14031427
return NULL;
14041428
}
1405-
rowStride = ((OPJ_SIZE_T)w * tiSpp * tiBps + 7U) / 8U;
1406-
buffer32s = (OPJ_INT32 *)malloc((OPJ_SIZE_T)w * tiSpp * sizeof(OPJ_INT32));
1429+
rowStride = (w * tiSpp * tiBps + 7U) / 8U;
1430+
buffer32s = (OPJ_INT32 *)malloc((OPJ_SIZE_T)(w * tiSpp * sizeof(OPJ_INT32)));
14071431
if (buffer32s == NULL) {
14081432
_TIFFfree(buf);
14091433
TIFFClose(tif);
@@ -1421,11 +1445,20 @@ opj_image_t* tiftoimage(const char *filename, opj_cparameters_t *parameters)
14211445
for(; (h > 0) && (strip < TIFFNumberOfStrips(tif)); strip++)
14221446
{
14231447
const OPJ_UINT8 *dat8;
1424-
OPJ_SIZE_T ssize;
1448+
tmsize_t ssize;
14251449

1426-
ssize = (OPJ_SIZE_T)TIFFReadEncodedStrip(tif, strip, buf, strip_size);
1450+
ssize = TIFFReadEncodedStrip(tif, strip, buf, strip_size);
1451+
if(ssize < 1 || ssize > strip_size) {
1452+
fprintf(stderr,"tiftoimage: Bad value for ssize(%ld) "
1453+
"vs. strip_size(%ld).\n\tAborting.\n",ssize,strip_size);
1454+
_TIFFfree(buf);
1455+
_TIFFfree(buffer32s);
1456+
TIFFClose(tif);
1457+
opj_image_destroy(image);
1458+
return NULL;
1459+
}
14271460
dat8 = (const OPJ_UINT8*)buf;
1428-
1461+
14291462
while (ssize >= rowStride) {
14301463
cvtTifTo32s(dat8, buffer32s, (OPJ_SIZE_T)w * tiSpp);
14311464
cvtCxToPx(buffer32s, planes, (OPJ_SIZE_T)w);

0 commit comments

Comments
 (0)