1 /* $Id: tif_dir.c,v 1.131 2017-07-11 21:38:04 erouault Exp $ */
2 
3 /*
4  * Copyright (c) 1988-1997 Sam Leffler
5  * Copyright (c) 1991-1997 Silicon Graphics, Inc.
6  *
7  * Permission to use, copy, modify, distribute, and sell this software and
8  * its documentation for any purpose is hereby granted without fee, provided
9  * that (i) the above copyright notices and this permission notice appear in
10  * all copies of the software and related documentation, and (ii) the names of
11  * Sam Leffler and Silicon Graphics may not be used in any advertising or
12  * publicity relating to the software without the specific, prior written
13  * permission of Sam Leffler and Silicon Graphics.
14  *
15  * THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND,
16  * EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY
17  * WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
18  *
19  * IN NO EVENT SHALL SAM LEFFLER OR SILICON GRAPHICS BE LIABLE FOR
20  * ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND,
21  * OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
22  * WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF
23  * LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
24  * OF THIS SOFTWARE.
25  */
26 
27 /*
28  * TIFF Library.
29  *
30  * Directory Tag Get & Set Routines.
31  * (and also some miscellaneous stuff)
32  */
33 #include "tiffiop.h"
34 #include <float.h>
35 
36 /*
37  * These are used in the backwards compatibility code...
38  */
39 #define DATATYPE_VOID		0       /* !untyped data */
40 #define DATATYPE_INT		1       /* !signed integer data */
41 #define DATATYPE_UINT		2       /* !unsigned integer data */
42 #define DATATYPE_IEEEFP		3       /* !IEEE floating point data */
43 
44 static void
setByteArray(void ** vpp,void * vp,size_t nmemb,size_t elem_size)45 setByteArray(void** vpp, void* vp, size_t nmemb, size_t elem_size)
46 {
47 	if (*vpp) {
48 		_TIFFfree(*vpp);
49 		*vpp = 0;
50 	}
51 	if (vp) {
52 		tmsize_t bytes = (tmsize_t)(nmemb * elem_size);
53 		if (elem_size && bytes / elem_size == nmemb)
54 			*vpp = (void*) _TIFFmalloc(bytes);
55 		if (*vpp)
56 			_TIFFmemcpy(*vpp, vp, bytes);
57 	}
58 }
_TIFFsetByteArray(void ** vpp,void * vp,uint32 n)59 void _TIFFsetByteArray(void** vpp, void* vp, uint32 n)
60     { setByteArray(vpp, vp, n, 1); }
_TIFFsetString(char ** cpp,char * cp)61 void _TIFFsetString(char** cpp, char* cp)
62     { setByteArray((void**) cpp, (void*) cp, strlen(cp)+1, 1); }
_TIFFsetNString(char ** cpp,char * cp,uint32 n)63 static void _TIFFsetNString(char** cpp, char* cp, uint32 n)
64     { setByteArray((void**) cpp, (void*) cp, n, 1); }
_TIFFsetShortArray(uint16 ** wpp,uint16 * wp,uint32 n)65 void _TIFFsetShortArray(uint16** wpp, uint16* wp, uint32 n)
66     { setByteArray((void**) wpp, (void*) wp, n, sizeof (uint16)); }
_TIFFsetLongArray(uint32 ** lpp,uint32 * lp,uint32 n)67 void _TIFFsetLongArray(uint32** lpp, uint32* lp, uint32 n)
68     { setByteArray((void**) lpp, (void*) lp, n, sizeof (uint32)); }
_TIFFsetLong8Array(uint64 ** lpp,uint64 * lp,uint32 n)69 static void _TIFFsetLong8Array(uint64** lpp, uint64* lp, uint32 n)
70     { setByteArray((void**) lpp, (void*) lp, n, sizeof (uint64)); }
_TIFFsetFloatArray(float ** fpp,float * fp,uint32 n)71 void _TIFFsetFloatArray(float** fpp, float* fp, uint32 n)
72     { setByteArray((void**) fpp, (void*) fp, n, sizeof (float)); }
_TIFFsetDoubleArray(double ** dpp,double * dp,uint32 n)73 void _TIFFsetDoubleArray(double** dpp, double* dp, uint32 n)
74     { setByteArray((void**) dpp, (void*) dp, n, sizeof (double)); }
75 
76 static void
setDoubleArrayOneValue(double ** vpp,double value,size_t nmemb)77 setDoubleArrayOneValue(double** vpp, double value, size_t nmemb)
78 {
79 	if (*vpp)
80 		_TIFFfree(*vpp);
81 	*vpp = _TIFFmalloc(nmemb*sizeof(double));
82 	if (*vpp)
83 	{
84 		while (nmemb--)
85 			((double*)*vpp)[nmemb] = value;
86 	}
87 }
88 
89 /*
90  * Install extra samples information.
91  */
92 static int
setExtraSamples(TIFFDirectory * td,va_list ap,uint32 * v)93 setExtraSamples(TIFFDirectory* td, va_list ap, uint32* v)
94 {
95 /* XXX: Unassociated alpha data == 999 is a known Corel Draw bug, see below */
96 #define EXTRASAMPLE_COREL_UNASSALPHA 999
97 
98 	uint16* va;
99 	uint32 i;
100 
101 	*v = (uint16) va_arg(ap, uint16_vap);
102 	if ((uint16) *v > td->td_samplesperpixel)
103 		return 0;
104 	va = va_arg(ap, uint16*);
105 	if (*v > 0 && va == NULL)		/* typically missing param */
106 		return 0;
107 	for (i = 0; i < *v; i++) {
108 		if (va[i] > EXTRASAMPLE_UNASSALPHA) {
109 			/*
110 			 * XXX: Corel Draw is known to produce incorrect
111 			 * ExtraSamples tags which must be patched here if we
112 			 * want to be able to open some of the damaged TIFF
113 			 * files:
114 			 */
115 			if (va[i] == EXTRASAMPLE_COREL_UNASSALPHA)
116 				va[i] = EXTRASAMPLE_UNASSALPHA;
117 			else
118 				return 0;
119 		}
120 	}
121 	td->td_extrasamples = (uint16) *v;
122 	_TIFFsetShortArray(&td->td_sampleinfo, va, td->td_extrasamples);
123 	return 1;
124 
125 #undef EXTRASAMPLE_COREL_UNASSALPHA
126 }
127 
128 /*
129  * Confirm we have "samplesperpixel" ink names separated by \0.  Returns
130  * zero if the ink names are not as expected.
131  */
132 static uint32
checkInkNamesString(TIFF * tif,uint32 slen,const char * s)133 checkInkNamesString(TIFF* tif, uint32 slen, const char* s)
134 {
135 	TIFFDirectory* td = &tif->tif_dir;
136 	uint16 i = td->td_samplesperpixel;
137 
138 	if (slen > 0) {
139 		const char* ep = s+slen;
140 		const char* cp = s;
141 		for (; i > 0; i--) {
142 			for (; cp < ep && *cp != '\0'; cp++) {}
143 			if (cp >= ep)
144 				goto bad;
145 			cp++;				/* skip \0 */
146 		}
147 		return ((uint32)(cp-s));
148 	}
149 bad:
150 	TIFFErrorExt(tif->tif_clientdata, "TIFFSetField",
151 	    "%s: Invalid InkNames value; expecting %d names, found %d",
152 	    tif->tif_name,
153 	    td->td_samplesperpixel,
154 	    td->td_samplesperpixel-i);
155 	return (0);
156 }
157 
TIFFClampDoubleToFloat(double val)158 static float TIFFClampDoubleToFloat( double val )
159 {
160     if( val > FLT_MAX )
161         return FLT_MAX;
162     if( val < -FLT_MAX )
163         return -FLT_MAX;
164     return (float)val;
165 }
166 
167 static int
_TIFFVSetField(TIFF * tif,uint32 tag,va_list ap)168 _TIFFVSetField(TIFF* tif, uint32 tag, va_list ap)
169 {
170 	static const char module[] = "_TIFFVSetField";
171 
172 	TIFFDirectory* td = &tif->tif_dir;
173 	int status = 1;
174 	uint32 v32, i, v;
175     double dblval;
176 	char* s;
177 	const TIFFField *fip = TIFFFindField(tif, tag, TIFF_ANY);
178 	uint32 standard_tag = tag;
179 	if( fip == NULL ) /* cannot happen since OkToChangeTag() already checks it */
180 	    return 0;
181 	/*
182 	 * We want to force the custom code to be used for custom
183 	 * fields even if the tag happens to match a well known
184 	 * one - important for reinterpreted handling of standard
185 	 * tag values in custom directories (i.e. EXIF)
186 	 */
187 	if (fip->field_bit == FIELD_CUSTOM) {
188 		standard_tag = 0;
189 	}
190 
191 	switch (standard_tag) {
192 	case TIFFTAG_SUBFILETYPE:
193 		td->td_subfiletype = (uint32) va_arg(ap, uint32);
194 		break;
195 	case TIFFTAG_IMAGEWIDTH:
196 		td->td_imagewidth = (uint32) va_arg(ap, uint32);
197 		break;
198 	case TIFFTAG_IMAGELENGTH:
199 		td->td_imagelength = (uint32) va_arg(ap, uint32);
200 		break;
201 	case TIFFTAG_BITSPERSAMPLE:
202 		td->td_bitspersample = (uint16) va_arg(ap, uint16_vap);
203 		/*
204 		 * If the data require post-decoding processing to byte-swap
205 		 * samples, set it up here.  Note that since tags are required
206 		 * to be ordered, compression code can override this behaviour
207 		 * in the setup method if it wants to roll the post decoding
208 		 * work in with its normal work.
209 		 */
210 		if (tif->tif_flags & TIFF_SWAB) {
211 			if (td->td_bitspersample == 8)
212 				tif->tif_postdecode = _TIFFNoPostDecode;
213 			else if (td->td_bitspersample == 16)
214 				tif->tif_postdecode = _TIFFSwab16BitData;
215 			else if (td->td_bitspersample == 24)
216 				tif->tif_postdecode = _TIFFSwab24BitData;
217 			else if (td->td_bitspersample == 32)
218 				tif->tif_postdecode = _TIFFSwab32BitData;
219 			else if (td->td_bitspersample == 64)
220 				tif->tif_postdecode = _TIFFSwab64BitData;
221 			else if (td->td_bitspersample == 128) /* two 64's */
222 				tif->tif_postdecode = _TIFFSwab64BitData;
223 		}
224 		break;
225 	case TIFFTAG_COMPRESSION:
226 		v = (uint16) va_arg(ap, uint16_vap);
227 		/*
228 		 * If we're changing the compression scheme, the notify the
229 		 * previous module so that it can cleanup any state it's
230 		 * setup.
231 		 */
232 		if (TIFFFieldSet(tif, FIELD_COMPRESSION)) {
233 			if ((uint32)td->td_compression == v)
234 				break;
235 			(*tif->tif_cleanup)(tif);
236 			tif->tif_flags &= ~TIFF_CODERSETUP;
237 		}
238 		/*
239 		 * Setup new compression routine state.
240 		 */
241 		if( (status = TIFFSetCompressionScheme(tif, v)) != 0 )
242 		    td->td_compression = (uint16) v;
243 		else
244 		    status = 0;
245 		break;
246 	case TIFFTAG_PHOTOMETRIC:
247 		td->td_photometric = (uint16) va_arg(ap, uint16_vap);
248 		break;
249 	case TIFFTAG_THRESHHOLDING:
250 		td->td_threshholding = (uint16) va_arg(ap, uint16_vap);
251 		break;
252 	case TIFFTAG_FILLORDER:
253 		v = (uint16) va_arg(ap, uint16_vap);
254 		if (v != FILLORDER_LSB2MSB && v != FILLORDER_MSB2LSB)
255 			goto badvalue;
256 		td->td_fillorder = (uint16) v;
257 		break;
258 	case TIFFTAG_ORIENTATION:
259 		v = (uint16) va_arg(ap, uint16_vap);
260 		if (v < ORIENTATION_TOPLEFT || ORIENTATION_LEFTBOT < v)
261 			goto badvalue;
262 		else
263 			td->td_orientation = (uint16) v;
264 		break;
265 	case TIFFTAG_SAMPLESPERPIXEL:
266 		v = (uint16) va_arg(ap, uint16_vap);
267 		if (v == 0)
268 			goto badvalue;
269         if( v != td->td_samplesperpixel )
270         {
271             /* See http://bugzilla.maptools.org/show_bug.cgi?id=2500 */
272             if( td->td_sminsamplevalue != NULL )
273             {
274                 TIFFWarningExt(tif->tif_clientdata,module,
275                     "SamplesPerPixel tag value is changing, "
276                     "but SMinSampleValue tag was read with a different value. Cancelling it");
277                 TIFFClrFieldBit(tif,FIELD_SMINSAMPLEVALUE);
278                 _TIFFfree(td->td_sminsamplevalue);
279                 td->td_sminsamplevalue = NULL;
280             }
281             if( td->td_smaxsamplevalue != NULL )
282             {
283                 TIFFWarningExt(tif->tif_clientdata,module,
284                     "SamplesPerPixel tag value is changing, "
285                     "but SMaxSampleValue tag was read with a different value. Cancelling it");
286                 TIFFClrFieldBit(tif,FIELD_SMAXSAMPLEVALUE);
287                 _TIFFfree(td->td_smaxsamplevalue);
288                 td->td_smaxsamplevalue = NULL;
289             }
290         }
291 		td->td_samplesperpixel = (uint16) v;
292 		break;
293 	case TIFFTAG_ROWSPERSTRIP:
294 		v32 = (uint32) va_arg(ap, uint32);
295 		if (v32 == 0)
296 			goto badvalue32;
297 		td->td_rowsperstrip = v32;
298 		if (!TIFFFieldSet(tif, FIELD_TILEDIMENSIONS)) {
299 			td->td_tilelength = v32;
300 			td->td_tilewidth = td->td_imagewidth;
301 		}
302 		break;
303 	case TIFFTAG_MINSAMPLEVALUE:
304 		td->td_minsamplevalue = (uint16) va_arg(ap, uint16_vap);
305 		break;
306 	case TIFFTAG_MAXSAMPLEVALUE:
307 		td->td_maxsamplevalue = (uint16) va_arg(ap, uint16_vap);
308 		break;
309 	case TIFFTAG_SMINSAMPLEVALUE:
310 		if (tif->tif_flags & TIFF_PERSAMPLE)
311 			_TIFFsetDoubleArray(&td->td_sminsamplevalue, va_arg(ap, double*), td->td_samplesperpixel);
312 		else
313 			setDoubleArrayOneValue(&td->td_sminsamplevalue, va_arg(ap, double), td->td_samplesperpixel);
314 		break;
315 	case TIFFTAG_SMAXSAMPLEVALUE:
316 		if (tif->tif_flags & TIFF_PERSAMPLE)
317 			_TIFFsetDoubleArray(&td->td_smaxsamplevalue, va_arg(ap, double*), td->td_samplesperpixel);
318 		else
319 			setDoubleArrayOneValue(&td->td_smaxsamplevalue, va_arg(ap, double), td->td_samplesperpixel);
320 		break;
321 	case TIFFTAG_XRESOLUTION:
322         dblval = va_arg(ap, double);
323         if( dblval < 0 )
324             goto badvaluedouble;
325 		td->td_xresolution = TIFFClampDoubleToFloat( dblval );
326 		break;
327 	case TIFFTAG_YRESOLUTION:
328         dblval = va_arg(ap, double);
329         if( dblval < 0 )
330             goto badvaluedouble;
331 		td->td_yresolution = TIFFClampDoubleToFloat( dblval );
332 		break;
333 	case TIFFTAG_PLANARCONFIG:
334 		v = (uint16) va_arg(ap, uint16_vap);
335 		if (v != PLANARCONFIG_CONTIG && v != PLANARCONFIG_SEPARATE)
336 			goto badvalue;
337 		td->td_planarconfig = (uint16) v;
338 		break;
339 	case TIFFTAG_XPOSITION:
340 		td->td_xposition = TIFFClampDoubleToFloat( va_arg(ap, double) );
341 		break;
342 	case TIFFTAG_YPOSITION:
343 		td->td_yposition = TIFFClampDoubleToFloat( va_arg(ap, double) );
344 		break;
345 	case TIFFTAG_RESOLUTIONUNIT:
346 		v = (uint16) va_arg(ap, uint16_vap);
347 		if (v < RESUNIT_NONE || RESUNIT_CENTIMETER < v)
348 			goto badvalue;
349 		td->td_resolutionunit = (uint16) v;
350 		break;
351 	case TIFFTAG_PAGENUMBER:
352 		td->td_pagenumber[0] = (uint16) va_arg(ap, uint16_vap);
353 		td->td_pagenumber[1] = (uint16) va_arg(ap, uint16_vap);
354 		break;
355 	case TIFFTAG_HALFTONEHINTS:
356 		td->td_halftonehints[0] = (uint16) va_arg(ap, uint16_vap);
357 		td->td_halftonehints[1] = (uint16) va_arg(ap, uint16_vap);
358 		break;
359 	case TIFFTAG_COLORMAP:
360 		v32 = (uint32)(1L<<td->td_bitspersample);
361 		_TIFFsetShortArray(&td->td_colormap[0], va_arg(ap, uint16*), v32);
362 		_TIFFsetShortArray(&td->td_colormap[1], va_arg(ap, uint16*), v32);
363 		_TIFFsetShortArray(&td->td_colormap[2], va_arg(ap, uint16*), v32);
364 		break;
365 	case TIFFTAG_EXTRASAMPLES:
366 		if (!setExtraSamples(td, ap, &v))
367 			goto badvalue;
368 		break;
369 	case TIFFTAG_MATTEING:
370 		td->td_extrasamples =  (((uint16) va_arg(ap, uint16_vap)) != 0);
371 		if (td->td_extrasamples) {
372 			uint16 sv = EXTRASAMPLE_ASSOCALPHA;
373 			_TIFFsetShortArray(&td->td_sampleinfo, &sv, 1);
374 		}
375 		break;
376 	case TIFFTAG_TILEWIDTH:
377 		v32 = (uint32) va_arg(ap, uint32);
378 		if (v32 % 16) {
379 			if (tif->tif_mode != O_RDONLY)
380 				goto badvalue32;
381 			TIFFWarningExt(tif->tif_clientdata, tif->tif_name,
382 				"Nonstandard tile width %d, convert file", v32);
383 		}
384 		td->td_tilewidth = v32;
385 		tif->tif_flags |= TIFF_ISTILED;
386 		break;
387 	case TIFFTAG_TILELENGTH:
388 		v32 = (uint32) va_arg(ap, uint32);
389 		if (v32 % 16) {
390 			if (tif->tif_mode != O_RDONLY)
391 				goto badvalue32;
392 			TIFFWarningExt(tif->tif_clientdata, tif->tif_name,
393 			    "Nonstandard tile length %d, convert file", v32);
394 		}
395 		td->td_tilelength = v32;
396 		tif->tif_flags |= TIFF_ISTILED;
397 		break;
398 	case TIFFTAG_TILEDEPTH:
399 		v32 = (uint32) va_arg(ap, uint32);
400 		if (v32 == 0)
401 			goto badvalue32;
402 		td->td_tiledepth = v32;
403 		break;
404 	case TIFFTAG_DATATYPE:
405 		v = (uint16) va_arg(ap, uint16_vap);
406 		switch (v) {
407 		case DATATYPE_VOID:	v = SAMPLEFORMAT_VOID;	break;
408 		case DATATYPE_INT:	v = SAMPLEFORMAT_INT;	break;
409 		case DATATYPE_UINT:	v = SAMPLEFORMAT_UINT;	break;
410 		case DATATYPE_IEEEFP:	v = SAMPLEFORMAT_IEEEFP;break;
411 		default:		goto badvalue;
412 		}
413 		td->td_sampleformat = (uint16) v;
414 		break;
415 	case TIFFTAG_SAMPLEFORMAT:
416 		v = (uint16) va_arg(ap, uint16_vap);
417 		if (v < SAMPLEFORMAT_UINT || SAMPLEFORMAT_COMPLEXIEEEFP < v)
418 			goto badvalue;
419 		td->td_sampleformat = (uint16) v;
420 
421 		/*  Try to fix up the SWAB function for complex data. */
422 		if( td->td_sampleformat == SAMPLEFORMAT_COMPLEXINT
423 		    && td->td_bitspersample == 32
424 		    && tif->tif_postdecode == _TIFFSwab32BitData )
425 		    tif->tif_postdecode = _TIFFSwab16BitData;
426 		else if( (td->td_sampleformat == SAMPLEFORMAT_COMPLEXINT
427 			  || td->td_sampleformat == SAMPLEFORMAT_COMPLEXIEEEFP)
428 			 && td->td_bitspersample == 64
429 			 && tif->tif_postdecode == _TIFFSwab64BitData )
430 		    tif->tif_postdecode = _TIFFSwab32BitData;
431 		break;
432 	case TIFFTAG_IMAGEDEPTH:
433 		td->td_imagedepth = (uint32) va_arg(ap, uint32);
434 		break;
435 	case TIFFTAG_SUBIFD:
436 		if ((tif->tif_flags & TIFF_INSUBIFD) == 0) {
437 			td->td_nsubifd = (uint16) va_arg(ap, uint16_vap);
438 			_TIFFsetLong8Array(&td->td_subifd, (uint64*) va_arg(ap, uint64*),
439 			    (uint32) td->td_nsubifd);
440 		} else {
441 			TIFFErrorExt(tif->tif_clientdata, module,
442 				     "%s: Sorry, cannot nest SubIFDs",
443 				     tif->tif_name);
444 			status = 0;
445 		}
446 		break;
447 	case TIFFTAG_YCBCRPOSITIONING:
448 		td->td_ycbcrpositioning = (uint16) va_arg(ap, uint16_vap);
449 		break;
450 	case TIFFTAG_YCBCRSUBSAMPLING:
451 		td->td_ycbcrsubsampling[0] = (uint16) va_arg(ap, uint16_vap);
452 		td->td_ycbcrsubsampling[1] = (uint16) va_arg(ap, uint16_vap);
453 		break;
454 	case TIFFTAG_TRANSFERFUNCTION:
455 		v = (td->td_samplesperpixel - td->td_extrasamples) > 1 ? 3 : 1;
456 		for (i = 0; i < v; i++)
457 			_TIFFsetShortArray(&td->td_transferfunction[i],
458 			    va_arg(ap, uint16*), 1U<<td->td_bitspersample);
459 		break;
460 	case TIFFTAG_REFERENCEBLACKWHITE:
461 		/* XXX should check for null range */
462 		_TIFFsetFloatArray(&td->td_refblackwhite, va_arg(ap, float*), 6);
463 		break;
464 	case TIFFTAG_INKNAMES:
465 		v = (uint16) va_arg(ap, uint16_vap);
466 		s = va_arg(ap, char*);
467 		v = checkInkNamesString(tif, v, s);
468 		status = v > 0;
469 		if( v > 0 ) {
470 			_TIFFsetNString(&td->td_inknames, s, v);
471 			td->td_inknameslen = v;
472 		}
473 		break;
474 	case TIFFTAG_PERSAMPLE:
475 		v = (uint16) va_arg(ap, uint16_vap);
476 		if( v == PERSAMPLE_MULTI )
477 			tif->tif_flags |= TIFF_PERSAMPLE;
478 		else
479 			tif->tif_flags &= ~TIFF_PERSAMPLE;
480 		break;
481 	default: {
482 		TIFFTagValue *tv;
483 		int tv_size, iCustom;
484 
485 		/*
486 		 * This can happen if multiple images are open with different
487 		 * codecs which have private tags.  The global tag information
488 		 * table may then have tags that are valid for one file but not
489 		 * the other. If the client tries to set a tag that is not valid
490 		 * for the image's codec then we'll arrive here.  This
491 		 * happens, for example, when tiffcp is used to convert between
492 		 * compression schemes and codec-specific tags are blindly copied.
493 		 */
494 		if(fip->field_bit != FIELD_CUSTOM) {
495 			TIFFErrorExt(tif->tif_clientdata, module,
496 			    "%s: Invalid %stag \"%s\" (not supported by codec)",
497 			    tif->tif_name, isPseudoTag(tag) ? "pseudo-" : "",
498 			    fip->field_name);
499 			status = 0;
500 			break;
501 		}
502 
503 		/*
504 		 * Find the existing entry for this custom value.
505 		 */
506 		tv = NULL;
507 		for (iCustom = 0; iCustom < td->td_customValueCount; iCustom++) {
508 			if (td->td_customValues[iCustom].info->field_tag == tag) {
509 				tv = td->td_customValues + iCustom;
510 				if (tv->value != NULL) {
511 					_TIFFfree(tv->value);
512 					tv->value = NULL;
513 				}
514 				break;
515 			}
516 		}
517 
518 		/*
519 		 * Grow the custom list if the entry was not found.
520 		 */
521 		if(tv == NULL) {
522 			TIFFTagValue *new_customValues;
523 
524 			td->td_customValueCount++;
525 			new_customValues = (TIFFTagValue *)
526 			    _TIFFrealloc(td->td_customValues,
527 			    sizeof(TIFFTagValue) * td->td_customValueCount);
528 			if (!new_customValues) {
529 				TIFFErrorExt(tif->tif_clientdata, module,
530 				    "%s: Failed to allocate space for list of custom values",
531 				    tif->tif_name);
532 				status = 0;
533 				goto end;
534 			}
535 
536 			td->td_customValues = new_customValues;
537 
538 			tv = td->td_customValues + (td->td_customValueCount - 1);
539 			tv->info = fip;
540 			tv->value = NULL;
541 			tv->count = 0;
542 		}
543 
544 		/*
545 		 * Set custom value ... save a copy of the custom tag value.
546 		 */
547 		tv_size = _TIFFDataSize(fip->field_type);
548 		if (tv_size == 0) {
549 			status = 0;
550 			TIFFErrorExt(tif->tif_clientdata, module,
551 			    "%s: Bad field type %d for \"%s\"",
552 			    tif->tif_name, fip->field_type,
553 			    fip->field_name);
554 			goto end;
555 		}
556 
557 		if (fip->field_type == TIFF_ASCII)
558 		{
559 			uint32 ma;
560 			char* mb;
561 			if (fip->field_passcount)
562 			{
563 				assert(fip->field_writecount==TIFF_VARIABLE2);
564 				ma=(uint32)va_arg(ap,uint32);
565 				mb=(char*)va_arg(ap,char*);
566 			}
567 			else
568 			{
569 				mb=(char*)va_arg(ap,char*);
570 				ma=(uint32)(strlen(mb)+1);
571 			}
572 			tv->count=ma;
573 			setByteArray(&tv->value,mb,ma,1);
574 		}
575 		else
576 		{
577 			if (fip->field_passcount) {
578 				if (fip->field_writecount == TIFF_VARIABLE2)
579 					tv->count = (uint32) va_arg(ap, uint32);
580 				else
581 					tv->count = (int) va_arg(ap, int);
582 			} else if (fip->field_writecount == TIFF_VARIABLE
583 			   || fip->field_writecount == TIFF_VARIABLE2)
584 				tv->count = 1;
585 			else if (fip->field_writecount == TIFF_SPP)
586 				tv->count = td->td_samplesperpixel;
587 			else
588 				tv->count = fip->field_writecount;
589 
590 			if (tv->count == 0) {
591 				status = 0;
592 				TIFFErrorExt(tif->tif_clientdata, module,
593 					     "%s: Null count for \"%s\" (type "
594 					     "%d, writecount %d, passcount %d)",
595 					     tif->tif_name,
596 					     fip->field_name,
597 					     fip->field_type,
598 					     fip->field_writecount,
599 					     fip->field_passcount);
600 				goto end;
601 			}
602 
603 			tv->value = _TIFFCheckMalloc(tif, tv->count, tv_size,
604 			    "custom tag binary object");
605 			if (!tv->value) {
606 				status = 0;
607 				goto end;
608 			}
609 
610 			if (fip->field_tag == TIFFTAG_DOTRANGE
611 			    && strcmp(fip->field_name,"DotRange") == 0) {
612 				/* TODO: This is an evil exception and should not have been
613 				   handled this way ... likely best if we move it into
614 				   the directory structure with an explicit field in
615 				   libtiff 4.1 and assign it a FIELD_ value */
616 				uint16 v2[2];
617 				v2[0] = (uint16)va_arg(ap, int);
618 				v2[1] = (uint16)va_arg(ap, int);
619 				_TIFFmemcpy(tv->value, &v2, 4);
620 			}
621 
622 			else if (fip->field_passcount
623 				  || fip->field_writecount == TIFF_VARIABLE
624 				  || fip->field_writecount == TIFF_VARIABLE2
625 				  || fip->field_writecount == TIFF_SPP
626 				  || tv->count > 1) {
627 				_TIFFmemcpy(tv->value, va_arg(ap, void *),
628 				    tv->count * tv_size);
629 			} else {
630 				char *val = (char *)tv->value;
631 				assert( tv->count == 1 );
632 
633 				switch (fip->field_type) {
634 				case TIFF_BYTE:
635 				case TIFF_UNDEFINED:
636 					{
637 						uint8 v2 = (uint8)va_arg(ap, int);
638 						_TIFFmemcpy(val, &v2, tv_size);
639 					}
640 					break;
641 				case TIFF_SBYTE:
642 					{
643 						int8 v2 = (int8)va_arg(ap, int);
644 						_TIFFmemcpy(val, &v2, tv_size);
645 					}
646 					break;
647 				case TIFF_SHORT:
648 					{
649 						uint16 v2 = (uint16)va_arg(ap, int);
650 						_TIFFmemcpy(val, &v2, tv_size);
651 					}
652 					break;
653 				case TIFF_SSHORT:
654 					{
655 						int16 v2 = (int16)va_arg(ap, int);
656 						_TIFFmemcpy(val, &v2, tv_size);
657 					}
658 					break;
659 				case TIFF_LONG:
660 				case TIFF_IFD:
661 					{
662 						uint32 v2 = va_arg(ap, uint32);
663 						_TIFFmemcpy(val, &v2, tv_size);
664 					}
665 					break;
666 				case TIFF_SLONG:
667 					{
668 						int32 v2 = va_arg(ap, int32);
669 						_TIFFmemcpy(val, &v2, tv_size);
670 					}
671 					break;
672 				case TIFF_LONG8:
673 				case TIFF_IFD8:
674 					{
675 						uint64 v2 = va_arg(ap, uint64);
676 						_TIFFmemcpy(val, &v2, tv_size);
677 					}
678 					break;
679 				case TIFF_SLONG8:
680 					{
681 						int64 v2 = va_arg(ap, int64);
682 						_TIFFmemcpy(val, &v2, tv_size);
683 					}
684 					break;
685 				case TIFF_RATIONAL:
686 				case TIFF_SRATIONAL:
687 				case TIFF_FLOAT:
688 					{
689 						float v2 = TIFFClampDoubleToFloat(va_arg(ap, double));
690 						_TIFFmemcpy(val, &v2, tv_size);
691 					}
692 					break;
693 				case TIFF_DOUBLE:
694 					{
695 						double v2 = va_arg(ap, double);
696 						_TIFFmemcpy(val, &v2, tv_size);
697 					}
698 					break;
699 				default:
700 					_TIFFmemset(val, 0, tv_size);
701 					status = 0;
702 					break;
703 				}
704 			}
705 		}
706 	}
707 	}
708 	if (status) {
709 		const TIFFField* fip2=TIFFFieldWithTag(tif,tag);
710 		if (fip2)
711 			TIFFSetFieldBit(tif, fip2->field_bit);
712 		tif->tif_flags |= TIFF_DIRTYDIRECT;
713 	}
714 
715 end:
716 	va_end(ap);
717 	return (status);
718 badvalue:
719         {
720 		const TIFFField* fip2=TIFFFieldWithTag(tif,tag);
721 		TIFFErrorExt(tif->tif_clientdata, module,
722 		     "%s: Bad value %u for \"%s\" tag",
723 		     tif->tif_name, v,
724 		     fip2 ? fip2->field_name : "Unknown");
725 		va_end(ap);
726         }
727 	return (0);
728 badvalue32:
729         {
730 		const TIFFField* fip2=TIFFFieldWithTag(tif,tag);
731 		TIFFErrorExt(tif->tif_clientdata, module,
732 		     "%s: Bad value %u for \"%s\" tag",
733 		     tif->tif_name, v32,
734 		     fip2 ? fip2->field_name : "Unknown");
735 		va_end(ap);
736         }
737 	return (0);
738 badvaluedouble:
739         {
740         const TIFFField* fip2=TIFFFieldWithTag(tif,tag);
741         TIFFErrorExt(tif->tif_clientdata, module,
742              "%s: Bad value %f for \"%s\" tag",
743              tif->tif_name, dblval,
744              fip2 ? fip2->field_name : "Unknown");
745         va_end(ap);
746         }
747     return (0);
748 }
749 
750 /*
751  * Return 1/0 according to whether or not
752  * it is permissible to set the tag's value.
753  * Note that we allow ImageLength to be changed
754  * so that we can append and extend to images.
755  * Any other tag may not be altered once writing
756  * has commenced, unless its value has no effect
757  * on the format of the data that is written.
758  */
759 static int
OkToChangeTag(TIFF * tif,uint32 tag)760 OkToChangeTag(TIFF* tif, uint32 tag)
761 {
762 	const TIFFField* fip = TIFFFindField(tif, tag, TIFF_ANY);
763 	if (!fip) {			/* unknown tag */
764 		TIFFErrorExt(tif->tif_clientdata, "TIFFSetField", "%s: Unknown %stag %u",
765 		    tif->tif_name, isPseudoTag(tag) ? "pseudo-" : "", tag);
766 		return (0);
767 	}
768 	if (tag != TIFFTAG_IMAGELENGTH && (tif->tif_flags & TIFF_BEENWRITING) &&
769 	    !fip->field_oktochange) {
770 		/*
771 		 * Consult info table to see if tag can be changed
772 		 * after we've started writing.  We only allow changes
773 		 * to those tags that don't/shouldn't affect the
774 		 * compression and/or format of the data.
775 		 */
776 		TIFFErrorExt(tif->tif_clientdata, "TIFFSetField",
777 		    "%s: Cannot modify tag \"%s\" while writing",
778 		    tif->tif_name, fip->field_name);
779 		return (0);
780 	}
781 	return (1);
782 }
783 
784 /*
785  * Record the value of a field in the
786  * internal directory structure.  The
787  * field will be written to the file
788  * when/if the directory structure is
789  * updated.
790  */
791 int
TIFFSetField(TIFF * tif,uint32 tag,...)792 TIFFSetField(TIFF* tif, uint32 tag, ...)
793 {
794 	va_list ap;
795 	int status;
796 
797 	va_start(ap, tag);
798 	status = TIFFVSetField(tif, tag, ap);
799 	va_end(ap);
800 	return (status);
801 }
802 
803 /*
804  * Clear the contents of the field in the internal structure.
805  */
806 int
TIFFUnsetField(TIFF * tif,uint32 tag)807 TIFFUnsetField(TIFF* tif, uint32 tag)
808 {
809     const TIFFField *fip =  TIFFFieldWithTag(tif, tag);
810     TIFFDirectory* td = &tif->tif_dir;
811 
812     if( !fip )
813         return 0;
814 
815     if( fip->field_bit != FIELD_CUSTOM )
816         TIFFClrFieldBit(tif, fip->field_bit);
817     else
818     {
819         TIFFTagValue *tv = NULL;
820         int i;
821 
822         for (i = 0; i < td->td_customValueCount; i++) {
823 
824             tv = td->td_customValues + i;
825             if( tv->info->field_tag == tag )
826                 break;
827         }
828 
829         if( i < td->td_customValueCount )
830         {
831             _TIFFfree(tv->value);
832             for( ; i < td->td_customValueCount-1; i++) {
833                 td->td_customValues[i] = td->td_customValues[i+1];
834             }
835             td->td_customValueCount--;
836         }
837     }
838 
839     tif->tif_flags |= TIFF_DIRTYDIRECT;
840 
841     return (1);
842 }
843 
844 /*
845  * Like TIFFSetField, but taking a varargs
846  * parameter list.  This routine is useful
847  * for building higher-level interfaces on
848  * top of the library.
849  */
850 int
TIFFVSetField(TIFF * tif,uint32 tag,va_list ap)851 TIFFVSetField(TIFF* tif, uint32 tag, va_list ap)
852 {
853 	return OkToChangeTag(tif, tag) ?
854 	    (*tif->tif_tagmethods.vsetfield)(tif, tag, ap) : 0;
855 }
856 
857 static int
_TIFFVGetField(TIFF * tif,uint32 tag,va_list ap)858 _TIFFVGetField(TIFF* tif, uint32 tag, va_list ap)
859 {
860 	TIFFDirectory* td = &tif->tif_dir;
861 	int ret_val = 1;
862 	uint32 standard_tag = tag;
863 	const TIFFField* fip = TIFFFindField(tif, tag, TIFF_ANY);
864 	if( fip == NULL ) /* cannot happen since TIFFGetField() already checks it */
865 	    return 0;
866 
867         if( tag == TIFFTAG_NUMBEROFINKS )
868         {
869             int i;
870             for (i = 0; i < td->td_customValueCount; i++) {
871                 uint16 val;
872                 TIFFTagValue *tv = td->td_customValues + i;
873                 if (tv->info->field_tag != tag)
874                     continue;
875                 if( tv->value == NULL )
876                     return 0;
877                 val = *(uint16 *)tv->value;
878                 /* Truncate to SamplesPerPixel, since the */
879                 /* setting code for INKNAMES assume that there are SamplesPerPixel */
880                 /* inknames. */
881                 /* Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2599 */
882                 if( val > td->td_samplesperpixel )
883                 {
884                     TIFFWarningExt(tif->tif_clientdata,"_TIFFVGetField",
885                                    "Truncating NumberOfInks from %u to %u",
886                                    val, td->td_samplesperpixel);
887                     val = td->td_samplesperpixel;
888                 }
889                 *va_arg(ap, uint16*) = val;
890                 return 1;
891             }
892             return 0;
893         }
894 
895 	/*
896 	 * We want to force the custom code to be used for custom
897 	 * fields even if the tag happens to match a well known
898 	 * one - important for reinterpreted handling of standard
899 	 * tag values in custom directories (i.e. EXIF)
900 	 */
901 	if (fip->field_bit == FIELD_CUSTOM) {
902 		standard_tag = 0;
903 	}
904 
905 	switch (standard_tag) {
906 		case TIFFTAG_SUBFILETYPE:
907 			*va_arg(ap, uint32*) = td->td_subfiletype;
908 			break;
909 		case TIFFTAG_IMAGEWIDTH:
910 			*va_arg(ap, uint32*) = td->td_imagewidth;
911 			break;
912 		case TIFFTAG_IMAGELENGTH:
913 			*va_arg(ap, uint32*) = td->td_imagelength;
914 			break;
915 		case TIFFTAG_BITSPERSAMPLE:
916 			*va_arg(ap, uint16*) = td->td_bitspersample;
917 			break;
918 		case TIFFTAG_COMPRESSION:
919 			*va_arg(ap, uint16*) = td->td_compression;
920 			break;
921 		case TIFFTAG_PHOTOMETRIC:
922 			*va_arg(ap, uint16*) = td->td_photometric;
923 			break;
924 		case TIFFTAG_THRESHHOLDING:
925 			*va_arg(ap, uint16*) = td->td_threshholding;
926 			break;
927 		case TIFFTAG_FILLORDER:
928 			*va_arg(ap, uint16*) = td->td_fillorder;
929 			break;
930 		case TIFFTAG_ORIENTATION:
931 			*va_arg(ap, uint16*) = td->td_orientation;
932 			break;
933 		case TIFFTAG_SAMPLESPERPIXEL:
934 			*va_arg(ap, uint16*) = td->td_samplesperpixel;
935 			break;
936 		case TIFFTAG_ROWSPERSTRIP:
937 			*va_arg(ap, uint32*) = td->td_rowsperstrip;
938 			break;
939 		case TIFFTAG_MINSAMPLEVALUE:
940 			*va_arg(ap, uint16*) = td->td_minsamplevalue;
941 			break;
942 		case TIFFTAG_MAXSAMPLEVALUE:
943 			*va_arg(ap, uint16*) = td->td_maxsamplevalue;
944 			break;
945 		case TIFFTAG_SMINSAMPLEVALUE:
946 			if (tif->tif_flags & TIFF_PERSAMPLE)
947 				*va_arg(ap, double**) = td->td_sminsamplevalue;
948 			else
949 			{
950 				/* libtiff historically treats this as a single value. */
951 				uint16 i;
952 				double v = td->td_sminsamplevalue[0];
953 				for (i=1; i < td->td_samplesperpixel; ++i)
954 					if( td->td_sminsamplevalue[i] < v )
955 						v = td->td_sminsamplevalue[i];
956 				*va_arg(ap, double*) = v;
957 			}
958 			break;
959 		case TIFFTAG_SMAXSAMPLEVALUE:
960 			if (tif->tif_flags & TIFF_PERSAMPLE)
961 				*va_arg(ap, double**) = td->td_smaxsamplevalue;
962 			else
963 			{
964 				/* libtiff historically treats this as a single value. */
965 				uint16 i;
966 				double v = td->td_smaxsamplevalue[0];
967 				for (i=1; i < td->td_samplesperpixel; ++i)
968 					if( td->td_smaxsamplevalue[i] > v )
969 						v = td->td_smaxsamplevalue[i];
970 				*va_arg(ap, double*) = v;
971 			}
972 			break;
973 		case TIFFTAG_XRESOLUTION:
974 			*va_arg(ap, float*) = td->td_xresolution;
975 			break;
976 		case TIFFTAG_YRESOLUTION:
977 			*va_arg(ap, float*) = td->td_yresolution;
978 			break;
979 		case TIFFTAG_PLANARCONFIG:
980 			*va_arg(ap, uint16*) = td->td_planarconfig;
981 			break;
982 		case TIFFTAG_XPOSITION:
983 			*va_arg(ap, float*) = td->td_xposition;
984 			break;
985 		case TIFFTAG_YPOSITION:
986 			*va_arg(ap, float*) = td->td_yposition;
987 			break;
988 		case TIFFTAG_RESOLUTIONUNIT:
989 			*va_arg(ap, uint16*) = td->td_resolutionunit;
990 			break;
991 		case TIFFTAG_PAGENUMBER:
992 			*va_arg(ap, uint16*) = td->td_pagenumber[0];
993 			*va_arg(ap, uint16*) = td->td_pagenumber[1];
994 			break;
995 		case TIFFTAG_HALFTONEHINTS:
996 			*va_arg(ap, uint16*) = td->td_halftonehints[0];
997 			*va_arg(ap, uint16*) = td->td_halftonehints[1];
998 			break;
999 		case TIFFTAG_COLORMAP:
1000 			*va_arg(ap, uint16**) = td->td_colormap[0];
1001 			*va_arg(ap, uint16**) = td->td_colormap[1];
1002 			*va_arg(ap, uint16**) = td->td_colormap[2];
1003 			break;
1004 		case TIFFTAG_STRIPOFFSETS:
1005 		case TIFFTAG_TILEOFFSETS:
1006 			_TIFFFillStriles( tif );
1007 			*va_arg(ap, uint64**) = td->td_stripoffset;
1008 			break;
1009 		case TIFFTAG_STRIPBYTECOUNTS:
1010 		case TIFFTAG_TILEBYTECOUNTS:
1011 			_TIFFFillStriles( tif );
1012 			*va_arg(ap, uint64**) = td->td_stripbytecount;
1013 			break;
1014 		case TIFFTAG_MATTEING:
1015 			*va_arg(ap, uint16*) =
1016 			    (td->td_extrasamples == 1 &&
1017 			    td->td_sampleinfo[0] == EXTRASAMPLE_ASSOCALPHA);
1018 			break;
1019 		case TIFFTAG_EXTRASAMPLES:
1020 			*va_arg(ap, uint16*) = td->td_extrasamples;
1021 			*va_arg(ap, uint16**) = td->td_sampleinfo;
1022 			break;
1023 		case TIFFTAG_TILEWIDTH:
1024 			*va_arg(ap, uint32*) = td->td_tilewidth;
1025 			break;
1026 		case TIFFTAG_TILELENGTH:
1027 			*va_arg(ap, uint32*) = td->td_tilelength;
1028 			break;
1029 		case TIFFTAG_TILEDEPTH:
1030 			*va_arg(ap, uint32*) = td->td_tiledepth;
1031 			break;
1032 		case TIFFTAG_DATATYPE:
1033 			switch (td->td_sampleformat) {
1034 				case SAMPLEFORMAT_UINT:
1035 					*va_arg(ap, uint16*) = DATATYPE_UINT;
1036 					break;
1037 				case SAMPLEFORMAT_INT:
1038 					*va_arg(ap, uint16*) = DATATYPE_INT;
1039 					break;
1040 				case SAMPLEFORMAT_IEEEFP:
1041 					*va_arg(ap, uint16*) = DATATYPE_IEEEFP;
1042 					break;
1043 				case SAMPLEFORMAT_VOID:
1044 					*va_arg(ap, uint16*) = DATATYPE_VOID;
1045 					break;
1046 			}
1047 			break;
1048 		case TIFFTAG_SAMPLEFORMAT:
1049 			*va_arg(ap, uint16*) = td->td_sampleformat;
1050 			break;
1051 		case TIFFTAG_IMAGEDEPTH:
1052 			*va_arg(ap, uint32*) = td->td_imagedepth;
1053 			break;
1054 		case TIFFTAG_SUBIFD:
1055 			*va_arg(ap, uint16*) = td->td_nsubifd;
1056 			*va_arg(ap, uint64**) = td->td_subifd;
1057 			break;
1058 		case TIFFTAG_YCBCRPOSITIONING:
1059 			*va_arg(ap, uint16*) = td->td_ycbcrpositioning;
1060 			break;
1061 		case TIFFTAG_YCBCRSUBSAMPLING:
1062 			*va_arg(ap, uint16*) = td->td_ycbcrsubsampling[0];
1063 			*va_arg(ap, uint16*) = td->td_ycbcrsubsampling[1];
1064 			break;
1065 		case TIFFTAG_TRANSFERFUNCTION:
1066 			*va_arg(ap, uint16**) = td->td_transferfunction[0];
1067 			if (td->td_samplesperpixel - td->td_extrasamples > 1) {
1068 				*va_arg(ap, uint16**) = td->td_transferfunction[1];
1069 				*va_arg(ap, uint16**) = td->td_transferfunction[2];
1070 			} else {
1071 				*va_arg(ap, uint16**) = NULL;
1072 				*va_arg(ap, uint16**) = NULL;
1073 			}
1074 			break;
1075 		case TIFFTAG_REFERENCEBLACKWHITE:
1076 			*va_arg(ap, float**) = td->td_refblackwhite;
1077 			break;
1078 		case TIFFTAG_INKNAMES:
1079 			*va_arg(ap, char**) = td->td_inknames;
1080 			break;
1081 		default:
1082 			{
1083 				int i;
1084 
1085 				/*
1086 				 * This can happen if multiple images are open
1087 				 * with different codecs which have private
1088 				 * tags.  The global tag information table may
1089 				 * then have tags that are valid for one file
1090 				 * but not the other. If the client tries to
1091 				 * get a tag that is not valid for the image's
1092 				 * codec then we'll arrive here.
1093 				 */
1094 				if( fip->field_bit != FIELD_CUSTOM )
1095 				{
1096 					TIFFErrorExt(tif->tif_clientdata, "_TIFFVGetField",
1097 					    "%s: Invalid %stag \"%s\" "
1098 					    "(not supported by codec)",
1099 					    tif->tif_name,
1100 					    isPseudoTag(tag) ? "pseudo-" : "",
1101 					    fip->field_name);
1102 					ret_val = 0;
1103 					break;
1104 				}
1105 
1106 				/*
1107 				 * Do we have a custom value?
1108 				 */
1109 				ret_val = 0;
1110 				for (i = 0; i < td->td_customValueCount; i++) {
1111 					TIFFTagValue *tv = td->td_customValues + i;
1112 
1113 					if (tv->info->field_tag != tag)
1114 						continue;
1115 
1116 					if (fip->field_passcount) {
1117 						if (fip->field_readcount == TIFF_VARIABLE2)
1118 							*va_arg(ap, uint32*) = (uint32)tv->count;
1119 						else  /* Assume TIFF_VARIABLE */
1120 							*va_arg(ap, uint16*) = (uint16)tv->count;
1121 						*va_arg(ap, void **) = tv->value;
1122 						ret_val = 1;
1123 					} else if (fip->field_tag == TIFFTAG_DOTRANGE
1124 						   && strcmp(fip->field_name,"DotRange") == 0) {
1125 						/* TODO: This is an evil exception and should not have been
1126 						   handled this way ... likely best if we move it into
1127 						   the directory structure with an explicit field in
1128 						   libtiff 4.1 and assign it a FIELD_ value */
1129 						*va_arg(ap, uint16*) = ((uint16 *)tv->value)[0];
1130 						*va_arg(ap, uint16*) = ((uint16 *)tv->value)[1];
1131 						ret_val = 1;
1132 					} else {
1133 						if (fip->field_type == TIFF_ASCII
1134 						    || fip->field_readcount == TIFF_VARIABLE
1135 						    || fip->field_readcount == TIFF_VARIABLE2
1136 						    || fip->field_readcount == TIFF_SPP
1137 						    || tv->count > 1) {
1138 							*va_arg(ap, void **) = tv->value;
1139 							ret_val = 1;
1140 						} else {
1141 							char *val = (char *)tv->value;
1142 							assert( tv->count == 1 );
1143 							switch (fip->field_type) {
1144 							case TIFF_BYTE:
1145 							case TIFF_UNDEFINED:
1146 								*va_arg(ap, uint8*) =
1147 									*(uint8 *)val;
1148 								ret_val = 1;
1149 								break;
1150 							case TIFF_SBYTE:
1151 								*va_arg(ap, int8*) =
1152 									*(int8 *)val;
1153 								ret_val = 1;
1154 								break;
1155 							case TIFF_SHORT:
1156 								*va_arg(ap, uint16*) =
1157 									*(uint16 *)val;
1158 								ret_val = 1;
1159 								break;
1160 							case TIFF_SSHORT:
1161 								*va_arg(ap, int16*) =
1162 									*(int16 *)val;
1163 								ret_val = 1;
1164 								break;
1165 							case TIFF_LONG:
1166 							case TIFF_IFD:
1167 								*va_arg(ap, uint32*) =
1168 									*(uint32 *)val;
1169 								ret_val = 1;
1170 								break;
1171 							case TIFF_SLONG:
1172 								*va_arg(ap, int32*) =
1173 									*(int32 *)val;
1174 								ret_val = 1;
1175 								break;
1176 							case TIFF_LONG8:
1177 							case TIFF_IFD8:
1178 								*va_arg(ap, uint64*) =
1179 									*(uint64 *)val;
1180 								ret_val = 1;
1181 								break;
1182 							case TIFF_SLONG8:
1183 								*va_arg(ap, int64*) =
1184 									*(int64 *)val;
1185 								ret_val = 1;
1186 								break;
1187 							case TIFF_RATIONAL:
1188 							case TIFF_SRATIONAL:
1189 							case TIFF_FLOAT:
1190 								*va_arg(ap, float*) =
1191 									*(float *)val;
1192 								ret_val = 1;
1193 								break;
1194 							case TIFF_DOUBLE:
1195 								*va_arg(ap, double*) =
1196 									*(double *)val;
1197 								ret_val = 1;
1198 								break;
1199 							default:
1200 								ret_val = 0;
1201 								break;
1202 							}
1203 						}
1204 					}
1205 					break;
1206 				}
1207 			}
1208 	}
1209 	return(ret_val);
1210 }
1211 
1212 /*
1213  * Return the value of a field in the
1214  * internal directory structure.
1215  */
1216 int
TIFFGetField(TIFF * tif,uint32 tag,...)1217 TIFFGetField(TIFF* tif, uint32 tag, ...)
1218 {
1219 	int status;
1220 	va_list ap;
1221 
1222 	va_start(ap, tag);
1223 	status = TIFFVGetField(tif, tag, ap);
1224 	va_end(ap);
1225 	return (status);
1226 }
1227 
1228 /*
1229  * Like TIFFGetField, but taking a varargs
1230  * parameter list.  This routine is useful
1231  * for building higher-level interfaces on
1232  * top of the library.
1233  */
1234 int
TIFFVGetField(TIFF * tif,uint32 tag,va_list ap)1235 TIFFVGetField(TIFF* tif, uint32 tag, va_list ap)
1236 {
1237 	const TIFFField* fip = TIFFFindField(tif, tag, TIFF_ANY);
1238 	return (fip && (isPseudoTag(tag) || TIFFFieldSet(tif, fip->field_bit)) ?
1239 	    (*tif->tif_tagmethods.vgetfield)(tif, tag, ap) : 0);
1240 }
1241 
1242 #define	CleanupField(member) {		\
1243     if (td->member) {			\
1244 	_TIFFfree(td->member);		\
1245 	td->member = 0;			\
1246     }					\
1247 }
1248 
1249 /*
1250  * Release storage associated with a directory.
1251  */
1252 void
TIFFFreeDirectory(TIFF * tif)1253 TIFFFreeDirectory(TIFF* tif)
1254 {
1255 	TIFFDirectory *td = &tif->tif_dir;
1256 	int            i;
1257 
1258 	_TIFFmemset(td->td_fieldsset, 0, FIELD_SETLONGS);
1259 	CleanupField(td_sminsamplevalue);
1260 	CleanupField(td_smaxsamplevalue);
1261 	CleanupField(td_colormap[0]);
1262 	CleanupField(td_colormap[1]);
1263 	CleanupField(td_colormap[2]);
1264 	CleanupField(td_sampleinfo);
1265 	CleanupField(td_subifd);
1266 	CleanupField(td_inknames);
1267 	CleanupField(td_refblackwhite);
1268 	CleanupField(td_transferfunction[0]);
1269 	CleanupField(td_transferfunction[1]);
1270 	CleanupField(td_transferfunction[2]);
1271 	CleanupField(td_stripoffset);
1272 	CleanupField(td_stripbytecount);
1273 	TIFFClrFieldBit(tif, FIELD_YCBCRSUBSAMPLING);
1274 	TIFFClrFieldBit(tif, FIELD_YCBCRPOSITIONING);
1275 
1276 	/* Cleanup custom tag values */
1277 	for( i = 0; i < td->td_customValueCount; i++ ) {
1278 		if (td->td_customValues[i].value)
1279 			_TIFFfree(td->td_customValues[i].value);
1280 	}
1281 
1282 	td->td_customValueCount = 0;
1283 	CleanupField(td_customValues);
1284 
1285 #if defined(DEFER_STRILE_LOAD)
1286         _TIFFmemset( &(td->td_stripoffset_entry), 0, sizeof(TIFFDirEntry));
1287         _TIFFmemset( &(td->td_stripbytecount_entry), 0, sizeof(TIFFDirEntry));
1288 #endif
1289 }
1290 #undef CleanupField
1291 
1292 /*
1293  * Client Tag extension support (from Niles Ritter).
1294  */
1295 static TIFFExtendProc _TIFFextender = (TIFFExtendProc) NULL;
1296 
1297 TIFFExtendProc
TIFFSetTagExtender(TIFFExtendProc extender)1298 TIFFSetTagExtender(TIFFExtendProc extender)
1299 {
1300 	TIFFExtendProc prev = _TIFFextender;
1301 	_TIFFextender = extender;
1302 	return (prev);
1303 }
1304 
1305 /*
1306  * Setup for a new directory.  Should we automatically call
1307  * TIFFWriteDirectory() if the current one is dirty?
1308  *
1309  * The newly created directory will not exist on the file till
1310  * TIFFWriteDirectory(), TIFFFlush() or TIFFClose() is called.
1311  */
1312 int
TIFFCreateDirectory(TIFF * tif)1313 TIFFCreateDirectory(TIFF* tif)
1314 {
1315 	TIFFDefaultDirectory(tif);
1316 	tif->tif_diroff = 0;
1317 	tif->tif_nextdiroff = 0;
1318 	tif->tif_curoff = 0;
1319 	tif->tif_row = (uint32) -1;
1320 	tif->tif_curstrip = (uint32) -1;
1321 
1322 	return 0;
1323 }
1324 
1325 int
TIFFCreateCustomDirectory(TIFF * tif,const TIFFFieldArray * infoarray)1326 TIFFCreateCustomDirectory(TIFF* tif, const TIFFFieldArray* infoarray)
1327 {
1328 	TIFFDefaultDirectory(tif);
1329 
1330 	/*
1331 	 * Reset the field definitions to match the application provided list.
1332 	 * Hopefully TIFFDefaultDirectory() won't have done anything irreversable
1333 	 * based on it's assumption this is an image directory.
1334 	 */
1335 	_TIFFSetupFields(tif, infoarray);
1336 
1337 	tif->tif_diroff = 0;
1338 	tif->tif_nextdiroff = 0;
1339 	tif->tif_curoff = 0;
1340 	tif->tif_row = (uint32) -1;
1341 	tif->tif_curstrip = (uint32) -1;
1342 
1343 	return 0;
1344 }
1345 
1346 int
TIFFCreateEXIFDirectory(TIFF * tif)1347 TIFFCreateEXIFDirectory(TIFF* tif)
1348 {
1349 	const TIFFFieldArray* exifFieldArray;
1350 	exifFieldArray = _TIFFGetExifFields();
1351 	return TIFFCreateCustomDirectory(tif, exifFieldArray);
1352 }
1353 
1354 /*
1355  * Setup a default directory structure.
1356  */
1357 int
TIFFDefaultDirectory(TIFF * tif)1358 TIFFDefaultDirectory(TIFF* tif)
1359 {
1360 	register TIFFDirectory* td = &tif->tif_dir;
1361 	const TIFFFieldArray* tiffFieldArray;
1362 
1363 	tiffFieldArray = _TIFFGetFields();
1364 	_TIFFSetupFields(tif, tiffFieldArray);
1365 
1366 	_TIFFmemset(td, 0, sizeof (*td));
1367 	td->td_fillorder = FILLORDER_MSB2LSB;
1368 	td->td_bitspersample = 1;
1369 	td->td_threshholding = THRESHHOLD_BILEVEL;
1370 	td->td_orientation = ORIENTATION_TOPLEFT;
1371 	td->td_samplesperpixel = 1;
1372 	td->td_rowsperstrip = (uint32) -1;
1373 	td->td_tilewidth = 0;
1374 	td->td_tilelength = 0;
1375 	td->td_tiledepth = 1;
1376 	td->td_stripbytecountsorted = 1; /* Our own arrays always sorted. */
1377 	td->td_resolutionunit = RESUNIT_INCH;
1378 	td->td_sampleformat = SAMPLEFORMAT_UINT;
1379 	td->td_imagedepth = 1;
1380 	td->td_ycbcrsubsampling[0] = 2;
1381 	td->td_ycbcrsubsampling[1] = 2;
1382 	td->td_ycbcrpositioning = YCBCRPOSITION_CENTERED;
1383 	tif->tif_postdecode = _TIFFNoPostDecode;
1384 	tif->tif_foundfield = NULL;
1385 	tif->tif_tagmethods.vsetfield = _TIFFVSetField;
1386 	tif->tif_tagmethods.vgetfield = _TIFFVGetField;
1387 	tif->tif_tagmethods.printdir = NULL;
1388 	/*
1389 	 *  Give client code a chance to install their own
1390 	 *  tag extensions & methods, prior to compression overloads,
1391 	 *  but do some prior cleanup first. (http://trac.osgeo.org/gdal/ticket/5054)
1392 	 */
1393 	if (tif->tif_nfieldscompat > 0) {
1394 		uint32 i;
1395 
1396 		for (i = 0; i < tif->tif_nfieldscompat; i++) {
1397 				if (tif->tif_fieldscompat[i].allocated_size)
1398 						_TIFFfree(tif->tif_fieldscompat[i].fields);
1399 		}
1400 		_TIFFfree(tif->tif_fieldscompat);
1401 		tif->tif_nfieldscompat = 0;
1402 		tif->tif_fieldscompat = NULL;
1403 	}
1404 	if (_TIFFextender)
1405 		(*_TIFFextender)(tif);
1406 	(void) TIFFSetField(tif, TIFFTAG_COMPRESSION, COMPRESSION_NONE);
1407 	/*
1408 	 * NB: The directory is marked dirty as a result of setting
1409 	 * up the default compression scheme.  However, this really
1410 	 * isn't correct -- we want TIFF_DIRTYDIRECT to be set only
1411 	 * if the user does something.  We could just do the setup
1412 	 * by hand, but it seems better to use the normal mechanism
1413 	 * (i.e. TIFFSetField).
1414 	 */
1415 	tif->tif_flags &= ~TIFF_DIRTYDIRECT;
1416 
1417 	/*
1418 	 * As per http://bugzilla.remotesensing.org/show_bug.cgi?id=19
1419 	 * we clear the ISTILED flag when setting up a new directory.
1420 	 * Should we also be clearing stuff like INSUBIFD?
1421 	 */
1422 	tif->tif_flags &= ~TIFF_ISTILED;
1423 
1424 	return (1);
1425 }
1426 
1427 static int
TIFFAdvanceDirectory(TIFF * tif,uint64 * nextdir,uint64 * off)1428 TIFFAdvanceDirectory(TIFF* tif, uint64* nextdir, uint64* off)
1429 {
1430 	static const char module[] = "TIFFAdvanceDirectory";
1431 	if (isMapped(tif))
1432 	{
1433 		uint64 poff=*nextdir;
1434 		if (!(tif->tif_flags&TIFF_BIGTIFF))
1435 		{
1436 			tmsize_t poffa,poffb,poffc,poffd;
1437 			uint16 dircount;
1438 			uint32 nextdir32;
1439 			poffa=(tmsize_t)poff;
1440 			poffb=poffa+sizeof(uint16);
1441 			if (((uint64)poffa!=poff)||(poffb<poffa)||(poffb<(tmsize_t)sizeof(uint16))||(poffb>tif->tif_size))
1442 			{
1443 				TIFFErrorExt(tif->tif_clientdata,module,"Error fetching directory count");
1444                                   *nextdir=0;
1445 				return(0);
1446 			}
1447 			_TIFFmemcpy(&dircount,tif->tif_base+poffa,sizeof(uint16));
1448 			if (tif->tif_flags&TIFF_SWAB)
1449 				TIFFSwabShort(&dircount);
1450 			poffc=poffb+dircount*12;
1451 			poffd=poffc+sizeof(uint32);
1452 			if ((poffc<poffb)||(poffc<dircount*12)||(poffd<poffc)||(poffd<(tmsize_t)sizeof(uint32))||(poffd>tif->tif_size))
1453 			{
1454 				TIFFErrorExt(tif->tif_clientdata,module,"Error fetching directory link");
1455 				return(0);
1456 			}
1457 			if (off!=NULL)
1458 				*off=(uint64)poffc;
1459 			_TIFFmemcpy(&nextdir32,tif->tif_base+poffc,sizeof(uint32));
1460 			if (tif->tif_flags&TIFF_SWAB)
1461 				TIFFSwabLong(&nextdir32);
1462 			*nextdir=nextdir32;
1463 		}
1464 		else
1465 		{
1466 			tmsize_t poffa,poffb,poffc,poffd;
1467 			uint64 dircount64;
1468 			uint16 dircount16;
1469 			poffa=(tmsize_t)poff;
1470 			poffb=poffa+sizeof(uint64);
1471 			if (((uint64)poffa!=poff)||(poffb<poffa)||(poffb<(tmsize_t)sizeof(uint64))||(poffb>tif->tif_size))
1472 			{
1473 				TIFFErrorExt(tif->tif_clientdata,module,"Error fetching directory count");
1474 				return(0);
1475 			}
1476 			_TIFFmemcpy(&dircount64,tif->tif_base+poffa,sizeof(uint64));
1477 			if (tif->tif_flags&TIFF_SWAB)
1478 				TIFFSwabLong8(&dircount64);
1479 			if (dircount64>0xFFFF)
1480 			{
1481 				TIFFErrorExt(tif->tif_clientdata,module,"Sanity check on directory count failed");
1482 				return(0);
1483 			}
1484 			dircount16=(uint16)dircount64;
1485 			poffc=poffb+dircount16*20;
1486 			poffd=poffc+sizeof(uint64);
1487 			if ((poffc<poffb)||(poffc<dircount16*20)||(poffd<poffc)||(poffd<(tmsize_t)sizeof(uint64))||(poffd>tif->tif_size))
1488 			{
1489 				TIFFErrorExt(tif->tif_clientdata,module,"Error fetching directory link");
1490 				return(0);
1491 			}
1492 			if (off!=NULL)
1493 				*off=(uint64)poffc;
1494 			_TIFFmemcpy(nextdir,tif->tif_base+poffc,sizeof(uint64));
1495 			if (tif->tif_flags&TIFF_SWAB)
1496 				TIFFSwabLong8(nextdir);
1497 		}
1498 		return(1);
1499 	}
1500 	else
1501 	{
1502 		if (!(tif->tif_flags&TIFF_BIGTIFF))
1503 		{
1504 			uint16 dircount;
1505 			uint32 nextdir32;
1506 			if (!SeekOK(tif, *nextdir) ||
1507 			    !ReadOK(tif, &dircount, sizeof (uint16))) {
1508 				TIFFErrorExt(tif->tif_clientdata, module, "%s: Error fetching directory count",
1509 				    tif->tif_name);
1510 				return (0);
1511 			}
1512 			if (tif->tif_flags & TIFF_SWAB)
1513 				TIFFSwabShort(&dircount);
1514 			if (off != NULL)
1515 				*off = TIFFSeekFile(tif,
1516 				    dircount*12, SEEK_CUR);
1517 			else
1518 				(void) TIFFSeekFile(tif,
1519 				    dircount*12, SEEK_CUR);
1520 			if (!ReadOK(tif, &nextdir32, sizeof (uint32))) {
1521 				TIFFErrorExt(tif->tif_clientdata, module, "%s: Error fetching directory link",
1522 				    tif->tif_name);
1523 				return (0);
1524 			}
1525 			if (tif->tif_flags & TIFF_SWAB)
1526 				TIFFSwabLong(&nextdir32);
1527 			*nextdir=nextdir32;
1528 		}
1529 		else
1530 		{
1531 			uint64 dircount64;
1532 			uint16 dircount16;
1533 			if (!SeekOK(tif, *nextdir) ||
1534 			    !ReadOK(tif, &dircount64, sizeof (uint64))) {
1535 				TIFFErrorExt(tif->tif_clientdata, module, "%s: Error fetching directory count",
1536 				    tif->tif_name);
1537 				return (0);
1538 			}
1539 			if (tif->tif_flags & TIFF_SWAB)
1540 				TIFFSwabLong8(&dircount64);
1541 			if (dircount64>0xFFFF)
1542 			{
1543 				TIFFErrorExt(tif->tif_clientdata, module, "Error fetching directory count");
1544 				return(0);
1545 			}
1546 			dircount16 = (uint16)dircount64;
1547 			if (off != NULL)
1548 				*off = TIFFSeekFile(tif,
1549 				    dircount16*20, SEEK_CUR);
1550 			else
1551 				(void) TIFFSeekFile(tif,
1552 				    dircount16*20, SEEK_CUR);
1553 			if (!ReadOK(tif, nextdir, sizeof (uint64))) {
1554 				TIFFErrorExt(tif->tif_clientdata, module,
1555                                              "%s: Error fetching directory link",
1556 				    tif->tif_name);
1557 				return (0);
1558 			}
1559 			if (tif->tif_flags & TIFF_SWAB)
1560 				TIFFSwabLong8(nextdir);
1561 		}
1562 		return (1);
1563 	}
1564 }
1565 
1566 /*
1567  * Count the number of directories in a file.
1568  */
1569 uint16
TIFFNumberOfDirectories(TIFF * tif)1570 TIFFNumberOfDirectories(TIFF* tif)
1571 {
1572 	static const char module[] = "TIFFNumberOfDirectories";
1573 	uint64 nextdir;
1574 	uint16 n;
1575 	if (!(tif->tif_flags&TIFF_BIGTIFF))
1576 		nextdir = tif->tif_header.classic.tiff_diroff;
1577 	else
1578 		nextdir = tif->tif_header.big.tiff_diroff;
1579 	n = 0;
1580 	while (nextdir != 0 && TIFFAdvanceDirectory(tif, &nextdir, NULL))
1581         {
1582                 if (n != 65535) {
1583                         ++n;
1584                 }
1585 		else
1586                 {
1587                         TIFFErrorExt(tif->tif_clientdata, module,
1588                                      "Directory count exceeded 65535 limit,"
1589                                      " giving up on counting.");
1590                         return (65535);
1591                 }
1592         }
1593 	return (n);
1594 }
1595 
1596 /*
1597  * Set the n-th directory as the current directory.
1598  * NB: Directories are numbered starting at 0.
1599  */
1600 int
TIFFSetDirectory(TIFF * tif,uint16 dirn)1601 TIFFSetDirectory(TIFF* tif, uint16 dirn)
1602 {
1603 	uint64 nextdir;
1604 	uint16 n;
1605 
1606 	if (!(tif->tif_flags&TIFF_BIGTIFF))
1607 		nextdir = tif->tif_header.classic.tiff_diroff;
1608 	else
1609 		nextdir = tif->tif_header.big.tiff_diroff;
1610 	for (n = dirn; n > 0 && nextdir != 0; n--)
1611 		if (!TIFFAdvanceDirectory(tif, &nextdir, NULL))
1612 			return (0);
1613 	tif->tif_nextdiroff = nextdir;
1614 	/*
1615 	 * Set curdir to the actual directory index.  The
1616 	 * -1 is because TIFFReadDirectory will increment
1617 	 * tif_curdir after successfully reading the directory.
1618 	 */
1619 	tif->tif_curdir = (dirn - n) - 1;
1620 	/*
1621 	 * Reset tif_dirnumber counter and start new list of seen directories.
1622 	 * We need this to prevent IFD loops.
1623 	 */
1624 	tif->tif_dirnumber = 0;
1625 	return (TIFFReadDirectory(tif));
1626 }
1627 
1628 /*
1629  * Set the current directory to be the directory
1630  * located at the specified file offset.  This interface
1631  * is used mainly to access directories linked with
1632  * the SubIFD tag (e.g. thumbnail images).
1633  */
1634 int
TIFFSetSubDirectory(TIFF * tif,uint64 diroff)1635 TIFFSetSubDirectory(TIFF* tif, uint64 diroff)
1636 {
1637 	tif->tif_nextdiroff = diroff;
1638 	/*
1639 	 * Reset tif_dirnumber counter and start new list of seen directories.
1640 	 * We need this to prevent IFD loops.
1641 	 */
1642 	tif->tif_dirnumber = 0;
1643 	return (TIFFReadDirectory(tif));
1644 }
1645 
1646 /*
1647  * Return file offset of the current directory.
1648  */
1649 uint64
TIFFCurrentDirOffset(TIFF * tif)1650 TIFFCurrentDirOffset(TIFF* tif)
1651 {
1652 	return (tif->tif_diroff);
1653 }
1654 
1655 /*
1656  * Return an indication of whether or not we are
1657  * at the last directory in the file.
1658  */
1659 int
TIFFLastDirectory(TIFF * tif)1660 TIFFLastDirectory(TIFF* tif)
1661 {
1662 	return (tif->tif_nextdiroff == 0);
1663 }
1664 
1665 /*
1666  * Unlink the specified directory from the directory chain.
1667  */
1668 int
TIFFUnlinkDirectory(TIFF * tif,uint16 dirn)1669 TIFFUnlinkDirectory(TIFF* tif, uint16 dirn)
1670 {
1671 	static const char module[] = "TIFFUnlinkDirectory";
1672 	uint64 nextdir;
1673 	uint64 off;
1674 	uint16 n;
1675 
1676 	if (tif->tif_mode == O_RDONLY) {
1677 		TIFFErrorExt(tif->tif_clientdata, module,
1678                              "Can not unlink directory in read-only file");
1679 		return (0);
1680 	}
1681 	/*
1682 	 * Go to the directory before the one we want
1683 	 * to unlink and nab the offset of the link
1684 	 * field we'll need to patch.
1685 	 */
1686 	if (!(tif->tif_flags&TIFF_BIGTIFF))
1687 	{
1688 		nextdir = tif->tif_header.classic.tiff_diroff;
1689 		off = 4;
1690 	}
1691 	else
1692 	{
1693 		nextdir = tif->tif_header.big.tiff_diroff;
1694 		off = 8;
1695 	}
1696 	for (n = dirn-1; n > 0; n--) {
1697 		if (nextdir == 0) {
1698 			TIFFErrorExt(tif->tif_clientdata, module, "Directory %d does not exist", dirn);
1699 			return (0);
1700 		}
1701 		if (!TIFFAdvanceDirectory(tif, &nextdir, &off))
1702 			return (0);
1703 	}
1704 	/*
1705 	 * Advance to the directory to be unlinked and fetch
1706 	 * the offset of the directory that follows.
1707 	 */
1708 	if (!TIFFAdvanceDirectory(tif, &nextdir, NULL))
1709 		return (0);
1710 	/*
1711 	 * Go back and patch the link field of the preceding
1712 	 * directory to point to the offset of the directory
1713 	 * that follows.
1714 	 */
1715 	(void) TIFFSeekFile(tif, off, SEEK_SET);
1716 	if (!(tif->tif_flags&TIFF_BIGTIFF))
1717 	{
1718 		uint32 nextdir32;
1719 		nextdir32=(uint32)nextdir;
1720 		assert((uint64)nextdir32==nextdir);
1721 		if (tif->tif_flags & TIFF_SWAB)
1722 			TIFFSwabLong(&nextdir32);
1723 		if (!WriteOK(tif, &nextdir32, sizeof (uint32))) {
1724 			TIFFErrorExt(tif->tif_clientdata, module, "Error writing directory link");
1725 			return (0);
1726 		}
1727 	}
1728 	else
1729 	{
1730 		if (tif->tif_flags & TIFF_SWAB)
1731 			TIFFSwabLong8(&nextdir);
1732 		if (!WriteOK(tif, &nextdir, sizeof (uint64))) {
1733 			TIFFErrorExt(tif->tif_clientdata, module, "Error writing directory link");
1734 			return (0);
1735 		}
1736 	}
1737 	/*
1738 	 * Leave directory state setup safely.  We don't have
1739 	 * facilities for doing inserting and removing directories,
1740 	 * so it's safest to just invalidate everything.  This
1741 	 * means that the caller can only append to the directory
1742 	 * chain.
1743 	 */
1744 	(*tif->tif_cleanup)(tif);
1745 	if ((tif->tif_flags & TIFF_MYBUFFER) && tif->tif_rawdata) {
1746 		_TIFFfree(tif->tif_rawdata);
1747 		tif->tif_rawdata = NULL;
1748 		tif->tif_rawcc = 0;
1749                 tif->tif_rawdataoff = 0;
1750                 tif->tif_rawdataloaded = 0;
1751 	}
1752 	tif->tif_flags &= ~(TIFF_BEENWRITING|TIFF_BUFFERSETUP|TIFF_POSTENCODE|TIFF_BUF4WRITE);
1753 	TIFFFreeDirectory(tif);
1754 	TIFFDefaultDirectory(tif);
1755 	tif->tif_diroff = 0;			/* force link on next write */
1756 	tif->tif_nextdiroff = 0;		/* next write must be at end */
1757 	tif->tif_curoff = 0;
1758 	tif->tif_row = (uint32) -1;
1759 	tif->tif_curstrip = (uint32) -1;
1760 	return (1);
1761 }
1762 
1763 /* vim: set ts=8 sts=8 sw=8 noet: */
1764 /*
1765  * Local Variables:
1766  * mode: c
1767  * c-basic-offset: 8
1768  * fill-column: 78
1769  * End:
1770  */
1771