You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

788 lines
24KB

  1. /*
  2. * Copyright (c) 2006 Konstantin Shishkov
  3. *
  4. * This file is part of FFmpeg.
  5. *
  6. * FFmpeg is free software; you can redistribute it and/or
  7. * modify it under the terms of the GNU Lesser General Public
  8. * License as published by the Free Software Foundation; either
  9. * version 2.1 of the License, or (at your option) any later version.
  10. *
  11. * FFmpeg is distributed in the hope that it will be useful,
  12. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14. * Lesser General Public License for more details.
  15. *
  16. * You should have received a copy of the GNU Lesser General Public
  17. * License along with FFmpeg; if not, write to the Free Software
  18. * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  19. */
  20. /**
  21. * @file
  22. * TIFF image decoder
  23. * @author Konstantin Shishkov
  24. */
  25. #include "avcodec.h"
  26. #if CONFIG_ZLIB
  27. #include <zlib.h>
  28. #endif
  29. #include "lzw.h"
  30. #include "tiff.h"
  31. #include "faxcompr.h"
  32. #include "libavutil/common.h"
  33. #include "libavutil/intreadwrite.h"
  34. #include "libavutil/imgutils.h"
  35. typedef struct TiffContext {
  36. AVCodecContext *avctx;
  37. AVFrame picture;
  38. int width, height;
  39. unsigned int bpp, bppcount;
  40. uint32_t palette[256];
  41. int palette_is_set;
  42. int le;
  43. enum TiffCompr compr;
  44. int invert;
  45. int fax_opts;
  46. int predictor;
  47. int fill_order;
  48. int strips, rps, sstype;
  49. int sot;
  50. const uint8_t *stripdata;
  51. const uint8_t *stripsizes;
  52. int stripsize, stripoff;
  53. LZWState *lzw;
  54. } TiffContext;
  55. static unsigned tget_short(const uint8_t **p, int le)
  56. {
  57. unsigned v = le ? AV_RL16(*p) : AV_RB16(*p);
  58. *p += 2;
  59. return v;
  60. }
  61. static unsigned tget_long(const uint8_t **p, int le)
  62. {
  63. unsigned v = le ? AV_RL32(*p) : AV_RB32(*p);
  64. *p += 4;
  65. return v;
  66. }
  67. static unsigned tget(const uint8_t **p, int type, int le)
  68. {
  69. switch (type) {
  70. case TIFF_BYTE : return *(*p)++;
  71. case TIFF_SHORT: return tget_short(p, le);
  72. case TIFF_LONG : return tget_long(p, le);
  73. default : return UINT_MAX;
  74. }
  75. }
  76. #if CONFIG_ZLIB
  77. static int tiff_uncompress(uint8_t *dst, unsigned long *len, const uint8_t *src,
  78. int size)
  79. {
  80. z_stream zstream = { 0 };
  81. int zret;
  82. zstream.next_in = src;
  83. zstream.avail_in = size;
  84. zstream.next_out = dst;
  85. zstream.avail_out = *len;
  86. zret = inflateInit(&zstream);
  87. if (zret != Z_OK) {
  88. av_log(NULL, AV_LOG_ERROR, "Inflate init error: %d\n", zret);
  89. return zret;
  90. }
  91. zret = inflate(&zstream, Z_SYNC_FLUSH);
  92. inflateEnd(&zstream);
  93. *len = zstream.total_out;
  94. return zret == Z_STREAM_END ? Z_OK : zret;
  95. }
  96. #endif
  97. static void av_always_inline horizontal_fill(unsigned int bpp, uint8_t* dst,
  98. int usePtr, const uint8_t *src,
  99. uint8_t c, int width, int offset)
  100. {
  101. switch (bpp) {
  102. case 1:
  103. while (--width >= 0) {
  104. dst[(width+offset)*8+7] = (usePtr ? src[width] : c) & 0x1;
  105. dst[(width+offset)*8+6] = (usePtr ? src[width] : c) >> 1 & 0x1;
  106. dst[(width+offset)*8+5] = (usePtr ? src[width] : c) >> 2 & 0x1;
  107. dst[(width+offset)*8+4] = (usePtr ? src[width] : c) >> 3 & 0x1;
  108. dst[(width+offset)*8+3] = (usePtr ? src[width] : c) >> 4 & 0x1;
  109. dst[(width+offset)*8+2] = (usePtr ? src[width] : c) >> 5 & 0x1;
  110. dst[(width+offset)*8+1] = (usePtr ? src[width] : c) >> 6 & 0x1;
  111. dst[(width+offset)*8+0] = (usePtr ? src[width] : c) >> 7;
  112. }
  113. break;
  114. case 2:
  115. while (--width >= 0) {
  116. dst[(width+offset)*4+3] = (usePtr ? src[width] : c) & 0x3;
  117. dst[(width+offset)*4+2] = (usePtr ? src[width] : c) >> 2 & 0x3;
  118. dst[(width+offset)*4+1] = (usePtr ? src[width] : c) >> 4 & 0x3;
  119. dst[(width+offset)*4+0] = (usePtr ? src[width] : c) >> 6;
  120. }
  121. break;
  122. case 4:
  123. while (--width >= 0) {
  124. dst[(width+offset)*2+1] = (usePtr ? src[width] : c) & 0xF;
  125. dst[(width+offset)*2+0] = (usePtr ? src[width] : c) >> 4;
  126. }
  127. break;
  128. default:
  129. if (usePtr) {
  130. memcpy(dst + offset, src, width);
  131. } else {
  132. memset(dst + offset, c, width);
  133. }
  134. }
  135. }
  136. static int tiff_unpack_strip(TiffContext *s, uint8_t *dst, int stride,
  137. const uint8_t *src, int size, int lines)
  138. {
  139. int c, line, pixels, code;
  140. const uint8_t *ssrc = src;
  141. int width = ((s->width * s->bpp) + 7) >> 3;
  142. if (size <= 0)
  143. return AVERROR_INVALIDDATA;
  144. #if CONFIG_ZLIB
  145. if (s->compr == TIFF_DEFLATE || s->compr == TIFF_ADOBE_DEFLATE) {
  146. uint8_t *zbuf;
  147. unsigned long outlen;
  148. int ret;
  149. outlen = width * lines;
  150. zbuf = av_malloc(outlen);
  151. if (!zbuf)
  152. return AVERROR(ENOMEM);
  153. ret = tiff_uncompress(zbuf, &outlen, src, size);
  154. if (ret != Z_OK) {
  155. av_log(s->avctx, AV_LOG_ERROR,
  156. "Uncompressing failed (%lu of %lu) with error %d\n", outlen,
  157. (unsigned long)width * lines, ret);
  158. av_free(zbuf);
  159. return -1;
  160. }
  161. src = zbuf;
  162. for (line = 0; line < lines; line++) {
  163. if(s->bpp < 8 && s->avctx->pix_fmt == PIX_FMT_PAL8){
  164. horizontal_fill(s->bpp, dst, 1, src, 0, width, 0);
  165. }else{
  166. memcpy(dst, src, width);
  167. }
  168. dst += stride;
  169. src += width;
  170. }
  171. av_free(zbuf);
  172. return 0;
  173. }
  174. #endif
  175. if (s->compr == TIFF_LZW) {
  176. if (ff_lzw_decode_init(s->lzw, 8, src, size, FF_LZW_TIFF) < 0) {
  177. av_log(s->avctx, AV_LOG_ERROR, "Error initializing LZW decoder\n");
  178. return -1;
  179. }
  180. }
  181. if (s->compr == TIFF_CCITT_RLE || s->compr == TIFF_G3
  182. || s->compr == TIFF_G4) {
  183. int i, ret = 0;
  184. uint8_t *src2 = av_malloc((unsigned)size +
  185. FF_INPUT_BUFFER_PADDING_SIZE);
  186. if (!src2) {
  187. av_log(s->avctx, AV_LOG_ERROR,
  188. "Error allocating temporary buffer\n");
  189. return AVERROR(ENOMEM);
  190. }
  191. if (s->fax_opts & 2) {
  192. av_log(s->avctx, AV_LOG_ERROR,
  193. "Uncompressed fax mode is not supported (yet)\n");
  194. av_free(src2);
  195. return -1;
  196. }
  197. if (!s->fill_order) {
  198. memcpy(src2, src, size);
  199. } else {
  200. for (i = 0; i < size; i++)
  201. src2[i] = av_reverse[src[i]];
  202. }
  203. memset(src2 + size, 0, FF_INPUT_BUFFER_PADDING_SIZE);
  204. switch (s->compr) {
  205. case TIFF_CCITT_RLE:
  206. case TIFF_G3:
  207. case TIFF_G4:
  208. ret = ff_ccitt_unpack(s->avctx, src2, size, dst, lines, stride,
  209. s->compr, s->fax_opts);
  210. break;
  211. }
  212. if (s->bpp < 8 && s->avctx->pix_fmt == PIX_FMT_PAL8)
  213. for (line = 0; line < lines; line++) {
  214. horizontal_fill(s->bpp, dst, 1, dst, 0, width, 0);
  215. dst += stride;
  216. }
  217. av_free(src2);
  218. return ret;
  219. }
  220. for (line = 0; line < lines; line++) {
  221. if (src - ssrc > size) {
  222. av_log(s->avctx, AV_LOG_ERROR, "Source data overread\n");
  223. return -1;
  224. }
  225. switch (s->compr) {
  226. case TIFF_RAW:
  227. if (ssrc + size - src < width)
  228. return AVERROR_INVALIDDATA;
  229. if (!s->fill_order) {
  230. horizontal_fill(s->bpp * (s->avctx->pix_fmt == PIX_FMT_PAL8),
  231. dst, 1, src, 0, width, 0);
  232. } else {
  233. int i;
  234. for (i = 0; i < width; i++)
  235. dst[i] = av_reverse[src[i]];
  236. }
  237. src += width;
  238. break;
  239. case TIFF_PACKBITS:
  240. for (pixels = 0; pixels < width;) {
  241. if (ssrc + size - src < 2) {
  242. av_log(s->avctx, AV_LOG_ERROR, "Read went out of bounds\n");
  243. return AVERROR_INVALIDDATA;
  244. }
  245. code = (int8_t) * src++;
  246. if (code >= 0) {
  247. code++;
  248. if (pixels + code > width) {
  249. av_log(s->avctx, AV_LOG_ERROR,
  250. "Copy went out of bounds\n");
  251. return -1;
  252. }
  253. if (ssrc + size - src < code) {
  254. av_log(s->avctx, AV_LOG_ERROR, "Read went out of bounds\n");
  255. return AVERROR_INVALIDDATA;
  256. }
  257. horizontal_fill(s->bpp * (s->avctx->pix_fmt == PIX_FMT_PAL8),
  258. dst, 1, src, 0, code, pixels);
  259. src += code;
  260. pixels += code;
  261. } else if (code != -128) { // -127..-1
  262. code = (-code) + 1;
  263. if (pixels + code > width) {
  264. av_log(s->avctx, AV_LOG_ERROR,
  265. "Run went out of bounds\n");
  266. return -1;
  267. }
  268. c = *src++;
  269. horizontal_fill(s->bpp * (s->avctx->pix_fmt == PIX_FMT_PAL8),
  270. dst, 0, NULL, c, code, pixels);
  271. pixels += code;
  272. }
  273. }
  274. break;
  275. case TIFF_LZW:
  276. pixels = ff_lzw_decode(s->lzw, dst, width);
  277. if (pixels < width) {
  278. av_log(s->avctx, AV_LOG_ERROR, "Decoded only %i bytes of %i\n",
  279. pixels, width);
  280. return -1;
  281. }
  282. if (s->bpp < 8 && s->avctx->pix_fmt == PIX_FMT_PAL8)
  283. horizontal_fill(s->bpp, dst, 1, dst, 0, width, 0);
  284. break;
  285. }
  286. dst += stride;
  287. }
  288. return 0;
  289. }
  290. static int init_image(TiffContext *s)
  291. {
  292. int i, ret;
  293. uint32_t *pal;
  294. switch (s->bpp * 10 + s->bppcount) {
  295. case 11:
  296. if (!s->palette_is_set) {
  297. s->avctx->pix_fmt = PIX_FMT_MONOBLACK;
  298. break;
  299. }
  300. case 21:
  301. case 41:
  302. case 81:
  303. s->avctx->pix_fmt = PIX_FMT_PAL8;
  304. break;
  305. case 243:
  306. s->avctx->pix_fmt = PIX_FMT_RGB24;
  307. break;
  308. case 161:
  309. s->avctx->pix_fmt = PIX_FMT_GRAY16BE;
  310. break;
  311. case 162:
  312. s->avctx->pix_fmt = PIX_FMT_GRAY8A;
  313. break;
  314. case 324:
  315. s->avctx->pix_fmt = PIX_FMT_RGBA;
  316. break;
  317. case 483:
  318. s->avctx->pix_fmt = s->le ? PIX_FMT_RGB48LE : PIX_FMT_RGB48BE;
  319. break;
  320. case 644:
  321. s->avctx->pix_fmt = s->le ? PIX_FMT_RGBA64LE : PIX_FMT_RGBA64BE;
  322. break;
  323. default:
  324. av_log(s->avctx, AV_LOG_ERROR,
  325. "This format is not supported (bpp=%d, bppcount=%d)\n",
  326. s->bpp, s->bppcount);
  327. return AVERROR_INVALIDDATA;
  328. }
  329. if (s->width != s->avctx->width || s->height != s->avctx->height) {
  330. if ((ret = av_image_check_size(s->width, s->height, 0, s->avctx)) < 0)
  331. return ret;
  332. avcodec_set_dimensions(s->avctx, s->width, s->height);
  333. }
  334. if (s->picture.data[0])
  335. s->avctx->release_buffer(s->avctx, &s->picture);
  336. if ((ret = s->avctx->get_buffer(s->avctx, &s->picture)) < 0) {
  337. av_log(s->avctx, AV_LOG_ERROR, "get_buffer() failed\n");
  338. return ret;
  339. }
  340. if (s->avctx->pix_fmt == PIX_FMT_PAL8) {
  341. if (s->palette_is_set) {
  342. memcpy(s->picture.data[1], s->palette, sizeof(s->palette));
  343. } else {
  344. /* make default grayscale pal */
  345. pal = (uint32_t *) s->picture.data[1];
  346. for (i = 0; i < 1<<s->bpp; i++)
  347. pal[i] = 0xFF << 24 | i * 255 / ((1<<s->bpp) - 1) * 0x010101;
  348. }
  349. }
  350. return 0;
  351. }
  352. static int tiff_decode_tag(TiffContext *s, const uint8_t *start,
  353. const uint8_t *buf, const uint8_t *end_buf)
  354. {
  355. unsigned tag, type, count, off, value = 0;
  356. int i, j;
  357. uint32_t *pal;
  358. const uint8_t *rp, *gp, *bp;
  359. if (end_buf - buf < 12)
  360. return -1;
  361. tag = tget_short(&buf, s->le);
  362. type = tget_short(&buf, s->le);
  363. count = tget_long(&buf, s->le);
  364. off = tget_long(&buf, s->le);
  365. if (type == 0 || type >= FF_ARRAY_ELEMS(type_sizes)) {
  366. av_log(s->avctx, AV_LOG_DEBUG, "Unknown tiff type (%u) encountered\n",
  367. type);
  368. return 0;
  369. }
  370. if (count == 1) {
  371. switch (type) {
  372. case TIFF_BYTE:
  373. case TIFF_SHORT:
  374. buf -= 4;
  375. value = tget(&buf, type, s->le);
  376. buf = NULL;
  377. break;
  378. case TIFF_LONG:
  379. value = off;
  380. buf = NULL;
  381. break;
  382. case TIFF_STRING:
  383. if (count <= 4) {
  384. buf -= 4;
  385. break;
  386. }
  387. default:
  388. value = UINT_MAX;
  389. buf = start + off;
  390. }
  391. } else {
  392. if (count <= 4 && type_sizes[type] * count <= 4) {
  393. buf -= 4;
  394. } else {
  395. buf = start + off;
  396. }
  397. }
  398. if (buf && (buf < start || buf > end_buf)) {
  399. av_log(s->avctx, AV_LOG_ERROR,
  400. "Tag referencing position outside the image\n");
  401. return -1;
  402. }
  403. switch (tag) {
  404. case TIFF_WIDTH:
  405. s->width = value;
  406. break;
  407. case TIFF_HEIGHT:
  408. s->height = value;
  409. break;
  410. case TIFF_BPP:
  411. s->bppcount = count;
  412. if (count > 4) {
  413. av_log(s->avctx, AV_LOG_ERROR,
  414. "This format is not supported (bpp=%d, %d components)\n",
  415. s->bpp, count);
  416. return -1;
  417. }
  418. if (count == 1)
  419. s->bpp = value;
  420. else {
  421. switch (type) {
  422. case TIFF_BYTE:
  423. s->bpp = (off & 0xFF) + ((off >> 8) & 0xFF) +
  424. ((off >> 16) & 0xFF) + ((off >> 24) & 0xFF);
  425. break;
  426. case TIFF_SHORT:
  427. case TIFF_LONG:
  428. s->bpp = 0;
  429. for (i = 0; i < count && buf < end_buf; i++)
  430. s->bpp += tget(&buf, type, s->le);
  431. break;
  432. default:
  433. s->bpp = -1;
  434. }
  435. }
  436. break;
  437. case TIFF_SAMPLES_PER_PIXEL:
  438. if (count != 1) {
  439. av_log(s->avctx, AV_LOG_ERROR,
  440. "Samples per pixel requires a single value, many provided\n");
  441. return AVERROR_INVALIDDATA;
  442. }
  443. if (s->bppcount == 1)
  444. s->bpp *= value;
  445. s->bppcount = value;
  446. break;
  447. case TIFF_COMPR:
  448. s->compr = value;
  449. s->predictor = 0;
  450. switch (s->compr) {
  451. case TIFF_RAW:
  452. case TIFF_PACKBITS:
  453. case TIFF_LZW:
  454. case TIFF_CCITT_RLE:
  455. break;
  456. case TIFF_G3:
  457. case TIFF_G4:
  458. s->fax_opts = 0;
  459. break;
  460. case TIFF_DEFLATE:
  461. case TIFF_ADOBE_DEFLATE:
  462. #if CONFIG_ZLIB
  463. break;
  464. #else
  465. av_log(s->avctx, AV_LOG_ERROR, "Deflate: ZLib not compiled in\n");
  466. return -1;
  467. #endif
  468. case TIFF_JPEG:
  469. case TIFF_NEWJPEG:
  470. av_log(s->avctx, AV_LOG_ERROR,
  471. "JPEG compression is not supported\n");
  472. return -1;
  473. default:
  474. av_log(s->avctx, AV_LOG_ERROR, "Unknown compression method %i\n",
  475. s->compr);
  476. return -1;
  477. }
  478. break;
  479. case TIFF_ROWSPERSTRIP:
  480. if (type == TIFF_LONG && value == UINT_MAX)
  481. value = s->avctx->height;
  482. if (value < 1) {
  483. av_log(s->avctx, AV_LOG_ERROR,
  484. "Incorrect value of rows per strip\n");
  485. return -1;
  486. }
  487. s->rps = value;
  488. break;
  489. case TIFF_STRIP_OFFS:
  490. if (count == 1) {
  491. s->stripdata = NULL;
  492. s->stripoff = value;
  493. } else
  494. s->stripdata = start + off;
  495. s->strips = count;
  496. if (s->strips == 1)
  497. s->rps = s->height;
  498. s->sot = type;
  499. if (s->stripdata > end_buf) {
  500. av_log(s->avctx, AV_LOG_ERROR,
  501. "Tag referencing position outside the image\n");
  502. return -1;
  503. }
  504. break;
  505. case TIFF_STRIP_SIZE:
  506. if (count == 1) {
  507. s->stripsizes = NULL;
  508. s->stripsize = value;
  509. s->strips = 1;
  510. } else {
  511. s->stripsizes = start + off;
  512. }
  513. s->strips = count;
  514. s->sstype = type;
  515. if (s->stripsizes > end_buf) {
  516. av_log(s->avctx, AV_LOG_ERROR,
  517. "Tag referencing position outside the image\n");
  518. return -1;
  519. }
  520. break;
  521. case TIFF_TILE_BYTE_COUNTS:
  522. case TIFF_TILE_LENGTH:
  523. case TIFF_TILE_OFFSETS:
  524. case TIFF_TILE_WIDTH:
  525. av_log(s->avctx, AV_LOG_ERROR, "Tiled images are not supported\n");
  526. return AVERROR_PATCHWELCOME;
  527. break;
  528. case TIFF_PREDICTOR:
  529. s->predictor = value;
  530. break;
  531. case TIFF_INVERT:
  532. switch (value) {
  533. case 0:
  534. s->invert = 1;
  535. break;
  536. case 1:
  537. s->invert = 0;
  538. break;
  539. case 2:
  540. case 3:
  541. break;
  542. default:
  543. av_log(s->avctx, AV_LOG_ERROR, "Color mode %d is not supported\n",
  544. value);
  545. return -1;
  546. }
  547. break;
  548. case TIFF_FILL_ORDER:
  549. if (value < 1 || value > 2) {
  550. av_log(s->avctx, AV_LOG_ERROR,
  551. "Unknown FillOrder value %d, trying default one\n", value);
  552. value = 1;
  553. }
  554. s->fill_order = value - 1;
  555. break;
  556. case TIFF_PAL:
  557. pal = (uint32_t *) s->palette;
  558. off = type_sizes[type];
  559. if (count / 3 > 256 || end_buf - buf < count / 3 * off * 3)
  560. return -1;
  561. rp = buf;
  562. gp = buf + count / 3 * off;
  563. bp = buf + count / 3 * off * 2;
  564. off = (type_sizes[type] - 1) << 3;
  565. for (i = 0; i < count / 3; i++) {
  566. j = 0xff << 24;
  567. j |= (tget(&rp, type, s->le) >> off) << 16;
  568. j |= (tget(&gp, type, s->le) >> off) << 8;
  569. j |= tget(&bp, type, s->le) >> off;
  570. pal[i] = j;
  571. }
  572. s->palette_is_set = 1;
  573. break;
  574. case TIFF_PLANAR:
  575. if (value == 2) {
  576. av_log(s->avctx, AV_LOG_ERROR, "Planar format is not supported\n");
  577. return -1;
  578. }
  579. break;
  580. case TIFF_T4OPTIONS:
  581. if (s->compr == TIFF_G3)
  582. s->fax_opts = value;
  583. break;
  584. case TIFF_T6OPTIONS:
  585. if (s->compr == TIFF_G4)
  586. s->fax_opts = value;
  587. break;
  588. default:
  589. av_log(s->avctx, AV_LOG_DEBUG, "Unknown or unsupported tag %d/0X%0X\n",
  590. tag, tag);
  591. }
  592. return 0;
  593. }
  594. static int decode_frame(AVCodecContext *avctx,
  595. void *data, int *data_size, AVPacket *avpkt)
  596. {
  597. const uint8_t *buf = avpkt->data;
  598. int buf_size = avpkt->size;
  599. TiffContext *const s = avctx->priv_data;
  600. AVFrame *picture = data;
  601. AVFrame *const p = &s->picture;
  602. const uint8_t *orig_buf = buf, *end_buf = buf + buf_size;
  603. unsigned off;
  604. int id, le, ret;
  605. int i, j, entries;
  606. int stride;
  607. unsigned soff, ssize;
  608. uint8_t *dst;
  609. //parse image header
  610. if (end_buf - buf < 8)
  611. return AVERROR_INVALIDDATA;
  612. id = AV_RL16(buf);
  613. buf += 2;
  614. if (id == 0x4949)
  615. le = 1;
  616. else if (id == 0x4D4D)
  617. le = 0;
  618. else {
  619. av_log(avctx, AV_LOG_ERROR, "TIFF header not found\n");
  620. return -1;
  621. }
  622. s->le = le;
  623. s->invert = 0;
  624. s->compr = TIFF_RAW;
  625. s->fill_order = 0;
  626. // As TIFF 6.0 specification puts it "An arbitrary but carefully chosen number
  627. // that further identifies the file as a TIFF file"
  628. if (tget_short(&buf, le) != 42) {
  629. av_log(avctx, AV_LOG_ERROR,
  630. "The answer to life, universe and everything is not correct!\n");
  631. return -1;
  632. }
  633. // Reset these pointers so we can tell if they were set this frame
  634. s->stripsizes = s->stripdata = NULL;
  635. /* parse image file directory */
  636. off = tget_long(&buf, le);
  637. if (off >= UINT_MAX - 14 || end_buf - orig_buf < off + 14) {
  638. av_log(avctx, AV_LOG_ERROR, "IFD offset is greater than image size\n");
  639. return AVERROR_INVALIDDATA;
  640. }
  641. buf = orig_buf + off;
  642. entries = tget_short(&buf, le);
  643. for (i = 0; i < entries; i++) {
  644. if (tiff_decode_tag(s, orig_buf, buf, end_buf) < 0)
  645. return -1;
  646. buf += 12;
  647. }
  648. if (!s->stripdata && !s->stripoff) {
  649. av_log(avctx, AV_LOG_ERROR, "Image data is missing\n");
  650. return -1;
  651. }
  652. /* now we have the data and may start decoding */
  653. if ((ret = init_image(s)) < 0)
  654. return ret;
  655. if (s->strips == 1 && !s->stripsize) {
  656. av_log(avctx, AV_LOG_WARNING, "Image data size missing\n");
  657. s->stripsize = buf_size - s->stripoff;
  658. }
  659. stride = p->linesize[0];
  660. dst = p->data[0];
  661. for (i = 0; i < s->height; i += s->rps) {
  662. if (s->stripsizes) {
  663. if (s->stripsizes >= end_buf)
  664. return AVERROR_INVALIDDATA;
  665. ssize = tget(&s->stripsizes, s->sstype, s->le);
  666. } else
  667. ssize = s->stripsize;
  668. if (s->stripdata) {
  669. if (s->stripdata >= end_buf)
  670. return AVERROR_INVALIDDATA;
  671. soff = tget(&s->stripdata, s->sot, s->le);
  672. } else
  673. soff = s->stripoff;
  674. if (soff > buf_size || ssize > buf_size - soff) {
  675. av_log(avctx, AV_LOG_ERROR, "Invalid strip size/offset\n");
  676. return -1;
  677. }
  678. if (tiff_unpack_strip(s, dst, stride, orig_buf + soff, ssize,
  679. FFMIN(s->rps, s->height - i)) < 0)
  680. break;
  681. dst += s->rps * stride;
  682. }
  683. if (s->predictor == 2) {
  684. dst = p->data[0];
  685. soff = s->bpp >> 3;
  686. ssize = s->width * soff;
  687. if (s->avctx->pix_fmt == PIX_FMT_RGB48LE ||
  688. s->avctx->pix_fmt == PIX_FMT_RGBA64LE) {
  689. for (i = 0; i < s->height; i++) {
  690. for (j = soff; j < ssize; j += 2)
  691. AV_WL16(dst + j, AV_RL16(dst + j) + AV_RL16(dst + j - soff));
  692. dst += stride;
  693. }
  694. } else if (s->avctx->pix_fmt == PIX_FMT_RGB48BE ||
  695. s->avctx->pix_fmt == PIX_FMT_RGBA64BE) {
  696. for (i = 0; i < s->height; i++) {
  697. for (j = soff; j < ssize; j += 2)
  698. AV_WB16(dst + j, AV_RB16(dst + j) + AV_RB16(dst + j - soff));
  699. dst += stride;
  700. }
  701. } else {
  702. for (i = 0; i < s->height; i++) {
  703. for (j = soff; j < ssize; j++)
  704. dst[j] += dst[j - soff];
  705. dst += stride;
  706. }
  707. }
  708. }
  709. if (s->invert) {
  710. dst = s->picture.data[0];
  711. for (i = 0; i < s->height; i++) {
  712. for (j = 0; j < s->picture.linesize[0]; j++)
  713. dst[j] = (s->avctx->pix_fmt == PIX_FMT_PAL8 ? (1<<s->bpp) - 1 : 255) - dst[j];
  714. dst += s->picture.linesize[0];
  715. }
  716. }
  717. *picture = s->picture;
  718. *data_size = sizeof(AVPicture);
  719. return buf_size;
  720. }
  721. static av_cold int tiff_init(AVCodecContext *avctx)
  722. {
  723. TiffContext *s = avctx->priv_data;
  724. s->width = 0;
  725. s->height = 0;
  726. s->avctx = avctx;
  727. avcodec_get_frame_defaults(&s->picture);
  728. avctx->coded_frame = &s->picture;
  729. ff_lzw_decode_open(&s->lzw);
  730. ff_ccitt_unpack_init();
  731. return 0;
  732. }
  733. static av_cold int tiff_end(AVCodecContext *avctx)
  734. {
  735. TiffContext *const s = avctx->priv_data;
  736. ff_lzw_decode_close(&s->lzw);
  737. if (s->picture.data[0])
  738. avctx->release_buffer(avctx, &s->picture);
  739. return 0;
  740. }
  741. AVCodec ff_tiff_decoder = {
  742. .name = "tiff",
  743. .type = AVMEDIA_TYPE_VIDEO,
  744. .id = CODEC_ID_TIFF,
  745. .priv_data_size = sizeof(TiffContext),
  746. .init = tiff_init,
  747. .close = tiff_end,
  748. .decode = decode_frame,
  749. .capabilities = CODEC_CAP_DR1,
  750. .long_name = NULL_IF_CONFIG_SMALL("TIFF image"),
  751. };