1 /*
2  * Copyright (c) 1988-1997 Sam Leffler
3  * Copyright (c) 1991-1997 Silicon Graphics, Inc.
4  *
5  * Permission to use, copy, modify, distribute, and sell this software and
6  * its documentation for any purpose is hereby granted without fee, provided
7  * that (i) the above copyright notices and this permission notice appear in
8  * all copies of the software and related documentation, and (ii) the names of
9  * Sam Leffler and Silicon Graphics may not be used in any advertising or
10  * publicity relating to the software without the specific, prior written
11  * permission of Sam Leffler and Silicon Graphics.
12  *
13  * THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND,
14  * EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY
15  * WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
16  *
17  * IN NO EVENT SHALL SAM LEFFLER OR SILICON GRAPHICS BE LIABLE FOR
18  * ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND,
19  * OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
20  * WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF
21  * LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
22  * OF THIS SOFTWARE.
23  */
24 
25 #include "tiffiop.h"
26 #ifdef LZW_SUPPORT
27 /*
28  * TIFF Library.
29  * Rev 5.0 Lempel-Ziv & Welch Compression Support
30  *
31  * This code is derived from the compress program whose code is
32  * derived from software contributed to Berkeley by James A. Woods,
33  * derived from original work by Spencer Thomas and Joseph Orost.
34  *
35  * The original Berkeley copyright notice appears below in its entirety.
36  */
37 #include "tif_predict.h"
38 
39 #include <stdio.h>
40 
41 /*
42  * NB: The 5.0 spec describes a different algorithm than Aldus
43  *     implements.  Specifically, Aldus does code length transitions
44  *     one code earlier than should be done (for real LZW).
45  *     Earlier versions of this library implemented the correct
46  *     LZW algorithm, but emitted codes in a bit order opposite
47  *     to the TIFF spec.  Thus, to maintain compatibility w/ Aldus
48  *     we interpret MSB-LSB ordered codes to be images written w/
49  *     old versions of this library, but otherwise adhere to the
50  *     Aldus "off by one" algorithm.
51  *
52  * Future revisions to the TIFF spec are expected to "clarify this issue".
53  */
54 #define LZW_COMPAT              /* include backwards compatibility code */
55 /*
56  * Each strip of data is supposed to be terminated by a CODE_EOI.
57  * If the following #define is included, the decoder will also
58  * check for end-of-strip w/o seeing this code.  This makes the
59  * library more robust, but also slower.
60  */
61 #define LZW_CHECKEOS            /* include checks for strips w/o EOI code */
62 
63 #define MAXCODE(n)	((1L<<(n))-1)
64 /*
65  * The TIFF spec specifies that encoded bit
66  * strings range from 9 to 12 bits.
67  */
68 #define BITS_MIN        9               /* start with 9 bits */
69 #define BITS_MAX        12              /* max of 12 bit strings */
70 /* predefined codes */
71 #define CODE_CLEAR      256             /* code to clear string table */
72 #define CODE_EOI        257             /* end-of-information code */
73 #define CODE_FIRST      258             /* first free code entry */
74 #define CODE_MAX        MAXCODE(BITS_MAX)
75 #define HSIZE           9001L           /* 91% occupancy */
76 #define HSHIFT          (13-8)
77 #ifdef LZW_COMPAT
78 /* NB: +1024 is for compatibility with old files */
79 #define CSIZE           (MAXCODE(BITS_MAX)+1024L)
80 #else
81 #define CSIZE           (MAXCODE(BITS_MAX)+1L)
82 #endif
83 
84 /*
85  * State block for each open TIFF file using LZW
86  * compression/decompression.  Note that the predictor
87  * state block must be first in this data structure.
88  */
89 typedef struct {
90 	TIFFPredictorState predict;     /* predictor super class */
91 
92 	unsigned short  nbits;          /* # of bits/code */
93 	unsigned short  maxcode;        /* maximum code for lzw_nbits */
94 	unsigned short  free_ent;       /* next free entry in hash table */
95 	unsigned long   nextdata;       /* next bits of i/o */
96 	long            nextbits;       /* # of valid bits in lzw_nextdata */
97 
98 	int             rw_mode;        /* preserve rw_mode from init */
99 } LZWBaseState;
100 
101 #define lzw_nbits       base.nbits
102 #define lzw_maxcode     base.maxcode
103 #define lzw_free_ent    base.free_ent
104 #define lzw_nextdata    base.nextdata
105 #define lzw_nextbits    base.nextbits
106 
107 /*
108  * Encoding-specific state.
109  */
110 typedef uint16 hcode_t;			/* codes fit in 16 bits */
111 typedef struct {
112 	long	hash;
113 	hcode_t	code;
114 } hash_t;
115 
116 /*
117  * Decoding-specific state.
118  */
119 typedef struct code_ent {
120 	struct code_ent *next;
121 	unsigned short	length;		/* string len, including this token */
122 	unsigned char	value;		/* data value */
123 	unsigned char	firstchar;	/* first token of string */
124 } code_t;
125 
126 typedef int (*decodeFunc)(TIFF*, uint8*, tmsize_t, uint16);
127 
128 typedef struct {
129 	LZWBaseState base;
130 
131 	/* Decoding specific data */
132 	long    dec_nbitsmask;		/* lzw_nbits 1 bits, right adjusted */
133 	long    dec_restart;		/* restart count */
134 #ifdef LZW_CHECKEOS
135 	uint64  dec_bitsleft;		/* available bits in raw data */
136 	tmsize_t old_tif_rawcc;         /* value of tif_rawcc at the end of the previous TIFLZWDecode() call */
137 #endif
138 	decodeFunc dec_decode;		/* regular or backwards compatible */
139 	code_t* dec_codep;		/* current recognized code */
140 	code_t* dec_oldcodep;		/* previously recognized code */
141 	code_t* dec_free_entp;		/* next free entry */
142 	code_t* dec_maxcodep;		/* max available entry */
143 	code_t* dec_codetab;		/* kept separate for small machines */
144 
145 	/* Encoding specific data */
146 	int     enc_oldcode;		/* last code encountered */
147 	long    enc_checkpoint;		/* point at which to clear table */
148 #define CHECK_GAP	10000		/* enc_ratio check interval */
149 	long    enc_ratio;		/* current compression ratio */
150 	long    enc_incount;		/* (input) data bytes encoded */
151 	long    enc_outcount;		/* encoded (output) bytes */
152 	uint8*  enc_rawlimit;		/* bound on tif_rawdata buffer */
153 	hash_t* enc_hashtab;		/* kept separate for small machines */
154 } LZWCodecState;
155 
156 #define LZWState(tif)		((LZWBaseState*) (tif)->tif_data)
157 #define DecoderState(tif)	((LZWCodecState*) LZWState(tif))
158 #define EncoderState(tif)	((LZWCodecState*) LZWState(tif))
159 
160 static int LZWDecode(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s);
161 #ifdef LZW_COMPAT
162 static int LZWDecodeCompat(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s);
163 #endif
164 static void cl_hash(LZWCodecState*);
165 
166 /*
167  * LZW Decoder.
168  */
169 
170 #ifdef LZW_CHECKEOS
171 /*
172  * This check shouldn't be necessary because each
173  * strip is suppose to be terminated with CODE_EOI.
174  */
175 #define	NextCode(_tif, _sp, _bp, _code, _get) {				\
176 	if ((_sp)->dec_bitsleft < (uint64)nbits) {			\
177 		TIFFWarningExt(_tif->tif_clientdata, module,		\
178 		    "LZWDecode: Strip %d not terminated with EOI code", \
179 		    _tif->tif_curstrip);				\
180 		_code = CODE_EOI;					\
181 	} else {							\
182 		_get(_sp,_bp,_code);					\
183 		(_sp)->dec_bitsleft -= nbits;				\
184 	}								\
185 }
186 #else
187 #define	NextCode(tif, sp, bp, code, get) get(sp, bp, code)
188 #endif
189 
190 static int
LZWFixupTags(TIFF * tif)191 LZWFixupTags(TIFF* tif)
192 {
193 	(void) tif;
194 	return (1);
195 }
196 
197 static int
LZWSetupDecode(TIFF * tif)198 LZWSetupDecode(TIFF* tif)
199 {
200 	static const char module[] = "LZWSetupDecode";
201 	LZWCodecState* sp = DecoderState(tif);
202 	int code;
203 
204 	if( sp == NULL )
205 	{
206 		/*
207 		 * Allocate state block so tag methods have storage to record
208 		 * values.
209 		*/
210 		tif->tif_data = (uint8*) _TIFFmalloc(sizeof(LZWCodecState));
211 		if (tif->tif_data == NULL)
212 		{
213 			TIFFErrorExt(tif->tif_clientdata, module, "No space for LZW state block");
214 			return (0);
215 		}
216 
217 		DecoderState(tif)->dec_codetab = NULL;
218 		DecoderState(tif)->dec_decode = NULL;
219 
220 		/*
221 		 * Setup predictor setup.
222 		 */
223 		(void) TIFFPredictorInit(tif);
224 
225 		sp = DecoderState(tif);
226 	}
227 
228 	assert(sp != NULL);
229 
230 	if (sp->dec_codetab == NULL) {
231 		sp->dec_codetab = (code_t*)_TIFFmalloc(CSIZE*sizeof (code_t));
232 		if (sp->dec_codetab == NULL) {
233 			TIFFErrorExt(tif->tif_clientdata, module,
234 				     "No space for LZW code table");
235 			return (0);
236 		}
237 		/*
238 		 * Pre-load the table.
239 		 */
240 		code = 255;
241 		do {
242 			sp->dec_codetab[code].value = (unsigned char)code;
243 			sp->dec_codetab[code].firstchar = (unsigned char)code;
244 			sp->dec_codetab[code].length = 1;
245 			sp->dec_codetab[code].next = NULL;
246 		} while (code--);
247 		/*
248 		 * Zero-out the unused entries
249                  */
250                 /* Silence false positive */
251                 /* coverity[overrun-buffer-arg] */
252                  _TIFFmemset(&sp->dec_codetab[CODE_CLEAR], 0,
253 			     (CODE_FIRST - CODE_CLEAR) * sizeof (code_t));
254 	}
255 	return (1);
256 }
257 
258 /*
259  * Setup state for decoding a strip.
260  */
261 static int
LZWPreDecode(TIFF * tif,uint16 s)262 LZWPreDecode(TIFF* tif, uint16 s)
263 {
264 	static const char module[] = "LZWPreDecode";
265 	LZWCodecState *sp = DecoderState(tif);
266 
267 	(void) s;
268 	assert(sp != NULL);
269 	if( sp->dec_codetab == NULL )
270         {
271             tif->tif_setupdecode( tif );
272 	    if( sp->dec_codetab == NULL )
273 		return (0);
274         }
275 
276 	/*
277 	 * Check for old bit-reversed codes.
278 	 */
279 	if (tif->tif_rawcc >= 2 &&
280 	    tif->tif_rawdata[0] == 0 && (tif->tif_rawdata[1] & 0x1)) {
281 #ifdef LZW_COMPAT
282 		if (!sp->dec_decode) {
283 			TIFFWarningExt(tif->tif_clientdata, module,
284 			    "Old-style LZW codes, convert file");
285 			/*
286 			 * Override default decoding methods with
287 			 * ones that deal with the old coding.
288 			 * Otherwise the predictor versions set
289 			 * above will call the compatibility routines
290 			 * through the dec_decode method.
291 			 */
292 			tif->tif_decoderow = LZWDecodeCompat;
293 			tif->tif_decodestrip = LZWDecodeCompat;
294 			tif->tif_decodetile = LZWDecodeCompat;
295 			/*
296 			 * If doing horizontal differencing, must
297 			 * re-setup the predictor logic since we
298 			 * switched the basic decoder methods...
299 			 */
300 			(*tif->tif_setupdecode)(tif);
301 			sp->dec_decode = LZWDecodeCompat;
302 		}
303 		sp->lzw_maxcode = MAXCODE(BITS_MIN);
304 #else /* !LZW_COMPAT */
305 		if (!sp->dec_decode) {
306 			TIFFErrorExt(tif->tif_clientdata, module,
307 			    "Old-style LZW codes not supported");
308 			sp->dec_decode = LZWDecode;
309 		}
310 		return (0);
311 #endif/* !LZW_COMPAT */
312 	} else {
313 		sp->lzw_maxcode = MAXCODE(BITS_MIN)-1;
314 		sp->dec_decode = LZWDecode;
315 	}
316 	sp->lzw_nbits = BITS_MIN;
317 	sp->lzw_nextbits = 0;
318 	sp->lzw_nextdata = 0;
319 
320 	sp->dec_restart = 0;
321 	sp->dec_nbitsmask = MAXCODE(BITS_MIN);
322 #ifdef LZW_CHECKEOS
323 	sp->dec_bitsleft = 0;
324         sp->old_tif_rawcc = 0;
325 #endif
326 	sp->dec_free_entp = sp->dec_codetab + CODE_FIRST;
327 	/*
328 	 * Zero entries that are not yet filled in.  We do
329 	 * this to guard against bogus input data that causes
330 	 * us to index into undefined entries.  If you can
331 	 * come up with a way to safely bounds-check input codes
332 	 * while decoding then you can remove this operation.
333 	 */
334 	_TIFFmemset(sp->dec_free_entp, 0, (CSIZE-CODE_FIRST)*sizeof (code_t));
335 	sp->dec_oldcodep = &sp->dec_codetab[-1];
336 	sp->dec_maxcodep = &sp->dec_codetab[sp->dec_nbitsmask-1];
337 	return (1);
338 }
339 
340 /*
341  * Decode a "hunk of data".
342  */
343 #define	GetNextCode(sp, bp, code) {				\
344 	nextdata = (nextdata<<8) | *(bp)++;			\
345 	nextbits += 8;						\
346 	if (nextbits < nbits) {					\
347 		nextdata = (nextdata<<8) | *(bp)++;		\
348 		nextbits += 8;					\
349 	}							\
350 	code = (hcode_t)((nextdata >> (nextbits-nbits)) & nbitsmask);	\
351 	nextbits -= nbits;					\
352 }
353 
354 static void
codeLoop(TIFF * tif,const char * module)355 codeLoop(TIFF* tif, const char* module)
356 {
357 	TIFFErrorExt(tif->tif_clientdata, module,
358 	    "Bogus encoding, loop in the code table; scanline %d",
359 	    tif->tif_row);
360 }
361 
362 static int
LZWDecode(TIFF * tif,uint8 * op0,tmsize_t occ0,uint16 s)363 LZWDecode(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s)
364 {
365 	static const char module[] = "LZWDecode";
366 	LZWCodecState *sp = DecoderState(tif);
367 	char *op = (char*) op0;
368 	long occ = (long) occ0;
369 	char *tp;
370 	unsigned char *bp;
371 	hcode_t code;
372 	int len;
373 	long nbits, nextbits, nbitsmask;
374         unsigned long nextdata;
375 	code_t *codep, *free_entp, *maxcodep, *oldcodep;
376 
377 	(void) s;
378 	assert(sp != NULL);
379         assert(sp->dec_codetab != NULL);
380 
381 	/*
382 	  Fail if value does not fit in long.
383 	*/
384 	if ((tmsize_t) occ != occ0)
385 	        return (0);
386 	/*
387 	 * Restart interrupted output operation.
388 	 */
389 	if (sp->dec_restart) {
390 		long residue;
391 
392 		codep = sp->dec_codep;
393 		residue = codep->length - sp->dec_restart;
394 		if (residue > occ) {
395 			/*
396 			 * Residue from previous decode is sufficient
397 			 * to satisfy decode request.  Skip to the
398 			 * start of the decoded string, place decoded
399 			 * values in the output buffer, and return.
400 			 */
401 			sp->dec_restart += occ;
402 			do {
403 				codep = codep->next;
404 			} while (--residue > occ && codep);
405 			if (codep) {
406 				tp = op + occ;
407 				do {
408 					*--tp = codep->value;
409 					codep = codep->next;
410 				} while (--occ && codep);
411 			}
412 			return (1);
413 		}
414 		/*
415 		 * Residue satisfies only part of the decode request.
416 		 */
417 		op += residue;
418 		occ -= residue;
419 		tp = op;
420 		do {
421 			int t;
422 			--tp;
423 			t = codep->value;
424 			codep = codep->next;
425 			*tp = (char)t;
426 		} while (--residue && codep);
427 		sp->dec_restart = 0;
428 	}
429 
430 	bp = (unsigned char *)tif->tif_rawcp;
431 #ifdef LZW_CHECKEOS
432 	sp->dec_bitsleft += (((uint64)tif->tif_rawcc - sp->old_tif_rawcc) << 3);
433 #endif
434 	nbits = sp->lzw_nbits;
435 	nextdata = sp->lzw_nextdata;
436 	nextbits = sp->lzw_nextbits;
437 	nbitsmask = sp->dec_nbitsmask;
438 	oldcodep = sp->dec_oldcodep;
439 	free_entp = sp->dec_free_entp;
440 	maxcodep = sp->dec_maxcodep;
441 
442 	while (occ > 0) {
443 		NextCode(tif, sp, bp, code, GetNextCode);
444 		if (code == CODE_EOI)
445 			break;
446 		if (code == CODE_CLEAR) {
447 			do {
448 				free_entp = sp->dec_codetab + CODE_FIRST;
449 				_TIFFmemset(free_entp, 0,
450 					    (CSIZE - CODE_FIRST) * sizeof (code_t));
451 				nbits = BITS_MIN;
452 				nbitsmask = MAXCODE(BITS_MIN);
453 				maxcodep = sp->dec_codetab + nbitsmask-1;
454 				NextCode(tif, sp, bp, code, GetNextCode);
455 			} while (code == CODE_CLEAR);	/* consecutive CODE_CLEAR codes */
456 			if (code == CODE_EOI)
457 				break;
458 			if (code > CODE_CLEAR) {
459 				TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
460 				"LZWDecode: Corrupted LZW table at scanline %d",
461 					     tif->tif_row);
462 				return (0);
463 			}
464 			*op++ = (char)code;
465 			occ--;
466 			oldcodep = sp->dec_codetab + code;
467 			continue;
468 		}
469 		codep = sp->dec_codetab + code;
470 
471 		/*
472 		 * Add the new entry to the code table.
473 		 */
474 		if (free_entp < &sp->dec_codetab[0] ||
475 		    free_entp >= &sp->dec_codetab[CSIZE]) {
476 			TIFFErrorExt(tif->tif_clientdata, module,
477 			    "Corrupted LZW table at scanline %d",
478 			    tif->tif_row);
479 			return (0);
480 		}
481 
482 		free_entp->next = oldcodep;
483 		if (free_entp->next < &sp->dec_codetab[0] ||
484 		    free_entp->next >= &sp->dec_codetab[CSIZE]) {
485 			TIFFErrorExt(tif->tif_clientdata, module,
486 			    "Corrupted LZW table at scanline %d",
487 			    tif->tif_row);
488 			return (0);
489 		}
490 		free_entp->firstchar = free_entp->next->firstchar;
491 		free_entp->length = free_entp->next->length+1;
492 		free_entp->value = (codep < free_entp) ?
493 		    codep->firstchar : free_entp->firstchar;
494 		if (++free_entp > maxcodep) {
495 			if (++nbits > BITS_MAX)		/* should not happen */
496 				nbits = BITS_MAX;
497 			nbitsmask = MAXCODE(nbits);
498 			maxcodep = sp->dec_codetab + nbitsmask-1;
499 		}
500 		oldcodep = codep;
501 		if (code >= 256) {
502 			/*
503 			 * Code maps to a string, copy string
504 			 * value to output (written in reverse).
505 			 */
506 			if(codep->length == 0) {
507 				TIFFErrorExt(tif->tif_clientdata, module,
508 				    "Wrong length of decoded string: "
509 				    "data probably corrupted at scanline %d",
510 				    tif->tif_row);
511 				return (0);
512 			}
513 			if (codep->length > occ) {
514 				/*
515 				 * String is too long for decode buffer,
516 				 * locate portion that will fit, copy to
517 				 * the decode buffer, and setup restart
518 				 * logic for the next decoding call.
519 				 */
520 				sp->dec_codep = codep;
521 				do {
522 					codep = codep->next;
523 				} while (codep && codep->length > occ);
524 				if (codep) {
525 					sp->dec_restart = (long)occ;
526 					tp = op + occ;
527 					do  {
528 						*--tp = codep->value;
529 						codep = codep->next;
530 					}  while (--occ && codep);
531 					if (codep)
532 						codeLoop(tif, module);
533 				}
534 				break;
535 			}
536 			len = codep->length;
537 			tp = op + len;
538 			do {
539 				int t;
540 				--tp;
541 				t = codep->value;
542 				codep = codep->next;
543 				*tp = (char)t;
544 			} while (codep && tp > op);
545 			if (codep) {
546 			    codeLoop(tif, module);
547 			    break;
548 			}
549 			assert(occ >= len);
550 			op += len;
551 			occ -= len;
552 		} else {
553 			*op++ = (char)code;
554 			occ--;
555 		}
556 	}
557 
558 	tif->tif_rawcc -= (tmsize_t)( (uint8*) bp - tif->tif_rawcp );
559 	tif->tif_rawcp = (uint8*) bp;
560 #ifdef LZW_CHECKEOS
561 	sp->old_tif_rawcc = tif->tif_rawcc;
562 #endif
563 	sp->lzw_nbits = (unsigned short) nbits;
564 	sp->lzw_nextdata = nextdata;
565 	sp->lzw_nextbits = nextbits;
566 	sp->dec_nbitsmask = nbitsmask;
567 	sp->dec_oldcodep = oldcodep;
568 	sp->dec_free_entp = free_entp;
569 	sp->dec_maxcodep = maxcodep;
570 
571 	if (occ > 0) {
572 #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
573 		TIFFErrorExt(tif->tif_clientdata, module,
574 			"Not enough data at scanline %d (short %I64d bytes)",
575 			     tif->tif_row, (unsigned __int64) occ);
576 #else
577 		TIFFErrorExt(tif->tif_clientdata, module,
578 			"Not enough data at scanline %d (short %llu bytes)",
579 			     tif->tif_row, (unsigned long long) occ);
580 #endif
581 		return (0);
582 	}
583 	return (1);
584 }
585 
586 #ifdef LZW_COMPAT
587 /*
588  * Decode a "hunk of data" for old images.
589  */
590 #define	GetNextCodeCompat(sp, bp, code) {			\
591 	nextdata |= (unsigned long) *(bp)++ << nextbits;	\
592 	nextbits += 8;						\
593 	if (nextbits < nbits) {					\
594 		nextdata |= (unsigned long) *(bp)++ << nextbits;\
595 		nextbits += 8;					\
596 	}							\
597 	code = (hcode_t)(nextdata & nbitsmask);			\
598 	nextdata >>= nbits;					\
599 	nextbits -= nbits;					\
600 }
601 
602 static int
LZWDecodeCompat(TIFF * tif,uint8 * op0,tmsize_t occ0,uint16 s)603 LZWDecodeCompat(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s)
604 {
605 	static const char module[] = "LZWDecodeCompat";
606 	LZWCodecState *sp = DecoderState(tif);
607 	char *op = (char*) op0;
608 	long occ = (long) occ0;
609 	char *tp;
610 	unsigned char *bp;
611 	int code, nbits;
612 	int len;
613 	long nextbits, nextdata, nbitsmask;
614 	code_t *codep, *free_entp, *maxcodep, *oldcodep;
615 
616 	(void) s;
617 	assert(sp != NULL);
618 
619 	/*
620 	  Fail if value does not fit in long.
621 	*/
622 	if ((tmsize_t) occ != occ0)
623 	        return (0);
624 
625 	/*
626 	 * Restart interrupted output operation.
627 	 */
628 	if (sp->dec_restart) {
629 		long residue;
630 
631 		codep = sp->dec_codep;
632 		residue = codep->length - sp->dec_restart;
633 		if (residue > occ) {
634 			/*
635 			 * Residue from previous decode is sufficient
636 			 * to satisfy decode request.  Skip to the
637 			 * start of the decoded string, place decoded
638 			 * values in the output buffer, and return.
639 			 */
640 			sp->dec_restart += occ;
641 			do {
642 				codep = codep->next;
643 			} while (--residue > occ);
644 			tp = op + occ;
645 			do {
646 				*--tp = codep->value;
647 				codep = codep->next;
648 			} while (--occ);
649 			return (1);
650 		}
651 		/*
652 		 * Residue satisfies only part of the decode request.
653 		 */
654 		op += residue;
655 		occ -= residue;
656 		tp = op;
657 		do {
658 			*--tp = codep->value;
659 			codep = codep->next;
660 		} while (--residue);
661 		sp->dec_restart = 0;
662 	}
663 
664 	bp = (unsigned char *)tif->tif_rawcp;
665 #ifdef LZW_CHECKEOS
666 	sp->dec_bitsleft += (((uint64)tif->tif_rawcc - sp->old_tif_rawcc) << 3);
667 #endif
668 	nbits = sp->lzw_nbits;
669 	nextdata = sp->lzw_nextdata;
670 	nextbits = sp->lzw_nextbits;
671 	nbitsmask = sp->dec_nbitsmask;
672 	oldcodep = sp->dec_oldcodep;
673 	free_entp = sp->dec_free_entp;
674 	maxcodep = sp->dec_maxcodep;
675 
676 	while (occ > 0) {
677 		NextCode(tif, sp, bp, code, GetNextCodeCompat);
678 		if (code == CODE_EOI)
679 			break;
680 		if (code == CODE_CLEAR) {
681 			do {
682 				free_entp = sp->dec_codetab + CODE_FIRST;
683 				_TIFFmemset(free_entp, 0,
684 					    (CSIZE - CODE_FIRST) * sizeof (code_t));
685 				nbits = BITS_MIN;
686 				nbitsmask = MAXCODE(BITS_MIN);
687 				maxcodep = sp->dec_codetab + nbitsmask;
688 				NextCode(tif, sp, bp, code, GetNextCodeCompat);
689 			} while (code == CODE_CLEAR);	/* consecutive CODE_CLEAR codes */
690 			if (code == CODE_EOI)
691 				break;
692 			if (code > CODE_CLEAR) {
693 				TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
694 				"LZWDecode: Corrupted LZW table at scanline %d",
695 					     tif->tif_row);
696 				return (0);
697 			}
698 			*op++ = (char)code;
699 			occ--;
700 			oldcodep = sp->dec_codetab + code;
701 			continue;
702 		}
703 		codep = sp->dec_codetab + code;
704 
705 		/*
706 		 * Add the new entry to the code table.
707 		 */
708 		if (free_entp < &sp->dec_codetab[0] ||
709 		    free_entp >= &sp->dec_codetab[CSIZE]) {
710 			TIFFErrorExt(tif->tif_clientdata, module,
711 			    "Corrupted LZW table at scanline %d", tif->tif_row);
712 			return (0);
713 		}
714 
715 		free_entp->next = oldcodep;
716 		if (free_entp->next < &sp->dec_codetab[0] ||
717 		    free_entp->next >= &sp->dec_codetab[CSIZE]) {
718 			TIFFErrorExt(tif->tif_clientdata, module,
719 			    "Corrupted LZW table at scanline %d", tif->tif_row);
720 			return (0);
721 		}
722 		free_entp->firstchar = free_entp->next->firstchar;
723 		free_entp->length = free_entp->next->length+1;
724 		free_entp->value = (codep < free_entp) ?
725 		    codep->firstchar : free_entp->firstchar;
726 		if (++free_entp > maxcodep) {
727 			if (++nbits > BITS_MAX)		/* should not happen */
728 				nbits = BITS_MAX;
729 			nbitsmask = MAXCODE(nbits);
730 			maxcodep = sp->dec_codetab + nbitsmask;
731 		}
732 		oldcodep = codep;
733 		if (code >= 256) {
734 			/*
735 			 * Code maps to a string, copy string
736 			 * value to output (written in reverse).
737 			 */
738 			if(codep->length == 0) {
739 				TIFFErrorExt(tif->tif_clientdata, module,
740 				    "Wrong length of decoded "
741 				    "string: data probably corrupted at scanline %d",
742 				    tif->tif_row);
743 				return (0);
744 			}
745 			if (codep->length > occ) {
746 				/*
747 				 * String is too long for decode buffer,
748 				 * locate portion that will fit, copy to
749 				 * the decode buffer, and setup restart
750 				 * logic for the next decoding call.
751 				 */
752 				sp->dec_codep = codep;
753 				do {
754 					codep = codep->next;
755 				} while (codep->length > occ);
756 				sp->dec_restart = occ;
757 				tp = op + occ;
758 				do  {
759 					*--tp = codep->value;
760 					codep = codep->next;
761 				}  while (--occ);
762 				break;
763 			}
764 			len = codep->length;
765 			tp = op + len;
766 			do {
767 				int t;
768 				--tp;
769 				t = codep->value;
770 				codep = codep->next;
771 				*tp = (char)t;
772 			} while (codep && tp > op);
773 			assert(occ >= len);
774 			op += len;
775 			occ -= len;
776 		} else {
777 			*op++ = (char)code;
778 			occ--;
779 		}
780 	}
781 
782 	tif->tif_rawcc -= (tmsize_t)( (uint8*) bp - tif->tif_rawcp );
783 	tif->tif_rawcp = (uint8*) bp;
784 #ifdef LZW_CHECKEOS
785 	sp->old_tif_rawcc = tif->tif_rawcc;
786 #endif
787 	sp->lzw_nbits = (unsigned short)nbits;
788 	sp->lzw_nextdata = nextdata;
789 	sp->lzw_nextbits = nextbits;
790 	sp->dec_nbitsmask = nbitsmask;
791 	sp->dec_oldcodep = oldcodep;
792 	sp->dec_free_entp = free_entp;
793 	sp->dec_maxcodep = maxcodep;
794 
795 	if (occ > 0) {
796 #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
797 		TIFFErrorExt(tif->tif_clientdata, module,
798 			"Not enough data at scanline %d (short %I64d bytes)",
799 			     tif->tif_row, (unsigned __int64) occ);
800 #else
801 		TIFFErrorExt(tif->tif_clientdata, module,
802 			"Not enough data at scanline %d (short %llu bytes)",
803 			     tif->tif_row, (unsigned long long) occ);
804 #endif
805 		return (0);
806 	}
807 	return (1);
808 }
809 #endif /* LZW_COMPAT */
810 
811 /*
812  * LZW Encoding.
813  */
814 
815 static int
LZWSetupEncode(TIFF * tif)816 LZWSetupEncode(TIFF* tif)
817 {
818 	static const char module[] = "LZWSetupEncode";
819 	LZWCodecState* sp = EncoderState(tif);
820 
821 	assert(sp != NULL);
822 	sp->enc_hashtab = (hash_t*) _TIFFmalloc(HSIZE*sizeof (hash_t));
823 	if (sp->enc_hashtab == NULL) {
824 		TIFFErrorExt(tif->tif_clientdata, module,
825 			     "No space for LZW hash table");
826 		return (0);
827 	}
828 	return (1);
829 }
830 
831 /*
832  * Reset encoding state at the start of a strip.
833  */
834 static int
LZWPreEncode(TIFF * tif,uint16 s)835 LZWPreEncode(TIFF* tif, uint16 s)
836 {
837 	LZWCodecState *sp = EncoderState(tif);
838 
839 	(void) s;
840 	assert(sp != NULL);
841 
842 	if( sp->enc_hashtab == NULL )
843         {
844             tif->tif_setupencode( tif );
845         }
846 
847 	sp->lzw_nbits = BITS_MIN;
848 	sp->lzw_maxcode = MAXCODE(BITS_MIN);
849 	sp->lzw_free_ent = CODE_FIRST;
850 	sp->lzw_nextbits = 0;
851 	sp->lzw_nextdata = 0;
852 	sp->enc_checkpoint = CHECK_GAP;
853 	sp->enc_ratio = 0;
854 	sp->enc_incount = 0;
855 	sp->enc_outcount = 0;
856 	/*
857 	 * The 4 here insures there is space for 2 max-sized
858 	 * codes in LZWEncode and LZWPostDecode.
859 	 */
860 	sp->enc_rawlimit = tif->tif_rawdata + tif->tif_rawdatasize-1 - 4;
861 	cl_hash(sp);		/* clear hash table */
862 	sp->enc_oldcode = (hcode_t) -1;	/* generates CODE_CLEAR in LZWEncode */
863 	return (1);
864 }
865 
866 #define	CALCRATIO(sp, rat) {					\
867 	if (incount > 0x007fffff) { /* NB: shift will overflow */\
868 		rat = outcount >> 8;				\
869 		rat = (rat == 0 ? 0x7fffffff : incount/rat);	\
870 	} else							\
871 		rat = (incount<<8) / outcount;			\
872 }
873 
874 /* Explicit 0xff masking to make icc -check=conversions happy */
875 #define	PutNextCode(op, c) {					\
876 	nextdata = (nextdata << nbits) | c;			\
877 	nextbits += nbits;					\
878 	*op++ = (unsigned char)((nextdata >> (nextbits-8))&0xff);		\
879 	nextbits -= 8;						\
880 	if (nextbits >= 8) {					\
881 		*op++ = (unsigned char)((nextdata >> (nextbits-8))&0xff);	\
882 		nextbits -= 8;					\
883 	}							\
884 	outcount += nbits;					\
885 }
886 
887 /*
888  * Encode a chunk of pixels.
889  *
890  * Uses an open addressing double hashing (no chaining) on the
891  * prefix code/next character combination.  We do a variant of
892  * Knuth's algorithm D (vol. 3, sec. 6.4) along with G. Knott's
893  * relatively-prime secondary probe.  Here, the modular division
894  * first probe is gives way to a faster exclusive-or manipulation.
895  * Also do block compression with an adaptive reset, whereby the
896  * code table is cleared when the compression ratio decreases,
897  * but after the table fills.  The variable-length output codes
898  * are re-sized at this point, and a CODE_CLEAR is generated
899  * for the decoder.
900  */
901 static int
LZWEncode(TIFF * tif,uint8 * bp,tmsize_t cc,uint16 s)902 LZWEncode(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
903 {
904 	register LZWCodecState *sp = EncoderState(tif);
905 	register long fcode;
906 	register hash_t *hp;
907 	register int h, c;
908 	hcode_t ent;
909 	long disp;
910 	long incount, outcount, checkpoint;
911 	unsigned long nextdata;
912         long nextbits;
913 	int free_ent, maxcode, nbits;
914 	uint8* op;
915 	uint8* limit;
916 
917 	(void) s;
918 	if (sp == NULL)
919 		return (0);
920 
921         assert(sp->enc_hashtab != NULL);
922 
923 	/*
924 	 * Load local state.
925 	 */
926 	incount = sp->enc_incount;
927 	outcount = sp->enc_outcount;
928 	checkpoint = sp->enc_checkpoint;
929 	nextdata = sp->lzw_nextdata;
930 	nextbits = sp->lzw_nextbits;
931 	free_ent = sp->lzw_free_ent;
932 	maxcode = sp->lzw_maxcode;
933 	nbits = sp->lzw_nbits;
934 	op = tif->tif_rawcp;
935 	limit = sp->enc_rawlimit;
936 	ent = (hcode_t)sp->enc_oldcode;
937 
938 	if (ent == (hcode_t) -1 && cc > 0) {
939 		/*
940 		 * NB: This is safe because it can only happen
941 		 *     at the start of a strip where we know there
942 		 *     is space in the data buffer.
943 		 */
944 		PutNextCode(op, CODE_CLEAR);
945 		ent = *bp++; cc--; incount++;
946 	}
947 	while (cc > 0) {
948 		c = *bp++; cc--; incount++;
949 		fcode = ((long)c << BITS_MAX) + ent;
950 		h = (c << HSHIFT) ^ ent;	/* xor hashing */
951 #ifdef _WINDOWS
952 		/*
953 		 * Check hash index for an overflow.
954 		 */
955 		if (h >= HSIZE)
956 			h -= HSIZE;
957 #endif
958 		hp = &sp->enc_hashtab[h];
959 		if (hp->hash == fcode) {
960 			ent = hp->code;
961 			continue;
962 		}
963 		if (hp->hash >= 0) {
964 			/*
965 			 * Primary hash failed, check secondary hash.
966 			 */
967 			disp = HSIZE - h;
968 			if (h == 0)
969 				disp = 1;
970 			do {
971 				/*
972 				 * Avoid pointer arithmetic because of
973 				 * wraparound problems with segments.
974 				 */
975 				if ((h -= disp) < 0)
976 					h += HSIZE;
977 				hp = &sp->enc_hashtab[h];
978 				if (hp->hash == fcode) {
979 					ent = hp->code;
980 					goto hit;
981 				}
982 			} while (hp->hash >= 0);
983 		}
984 		/*
985 		 * New entry, emit code and add to table.
986 		 */
987 		/*
988 		 * Verify there is space in the buffer for the code
989 		 * and any potential Clear code that might be emitted
990 		 * below.  The value of limit is setup so that there
991 		 * are at least 4 bytes free--room for 2 codes.
992 		 */
993 		if (op > limit) {
994 			tif->tif_rawcc = (tmsize_t)(op - tif->tif_rawdata);
995 			if( !TIFFFlushData1(tif) )
996                             return 0;
997 			op = tif->tif_rawdata;
998 		}
999 		PutNextCode(op, ent);
1000 		ent = (hcode_t)c;
1001 		hp->code = (hcode_t)(free_ent++);
1002 		hp->hash = fcode;
1003 		if (free_ent == CODE_MAX-1) {
1004 			/* table is full, emit clear code and reset */
1005 			cl_hash(sp);
1006 			sp->enc_ratio = 0;
1007 			incount = 0;
1008 			outcount = 0;
1009 			free_ent = CODE_FIRST;
1010 			PutNextCode(op, CODE_CLEAR);
1011 			nbits = BITS_MIN;
1012 			maxcode = MAXCODE(BITS_MIN);
1013 		} else {
1014 			/*
1015 			 * If the next entry is going to be too big for
1016 			 * the code size, then increase it, if possible.
1017 			 */
1018 			if (free_ent > maxcode) {
1019 				nbits++;
1020 				assert(nbits <= BITS_MAX);
1021 				maxcode = (int) MAXCODE(nbits);
1022 			} else if (incount >= checkpoint) {
1023 				long rat;
1024 				/*
1025 				 * Check compression ratio and, if things seem
1026 				 * to be slipping, clear the hash table and
1027 				 * reset state.  The compression ratio is a
1028 				 * 24+8-bit fractional number.
1029 				 */
1030 				checkpoint = incount+CHECK_GAP;
1031 				CALCRATIO(sp, rat);
1032 				if (rat <= sp->enc_ratio) {
1033 					cl_hash(sp);
1034 					sp->enc_ratio = 0;
1035 					incount = 0;
1036 					outcount = 0;
1037 					free_ent = CODE_FIRST;
1038 					PutNextCode(op, CODE_CLEAR);
1039 					nbits = BITS_MIN;
1040 					maxcode = MAXCODE(BITS_MIN);
1041 				} else
1042 					sp->enc_ratio = rat;
1043 			}
1044 		}
1045 	hit:
1046 		;
1047 	}
1048 
1049 	/*
1050 	 * Restore global state.
1051 	 */
1052 	sp->enc_incount = incount;
1053 	sp->enc_outcount = outcount;
1054 	sp->enc_checkpoint = checkpoint;
1055 	sp->enc_oldcode = ent;
1056 	sp->lzw_nextdata = nextdata;
1057 	sp->lzw_nextbits = nextbits;
1058 	sp->lzw_free_ent = (unsigned short)free_ent;
1059 	sp->lzw_maxcode = (unsigned short)maxcode;
1060 	sp->lzw_nbits = (unsigned short)nbits;
1061 	tif->tif_rawcp = op;
1062 	return (1);
1063 }
1064 
1065 /*
1066  * Finish off an encoded strip by flushing the last
1067  * string and tacking on an End Of Information code.
1068  */
1069 static int
LZWPostEncode(TIFF * tif)1070 LZWPostEncode(TIFF* tif)
1071 {
1072 	register LZWCodecState *sp = EncoderState(tif);
1073 	uint8* op = tif->tif_rawcp;
1074 	long nextbits = sp->lzw_nextbits;
1075 	unsigned long nextdata = sp->lzw_nextdata;
1076 	long outcount = sp->enc_outcount;
1077 	int nbits = sp->lzw_nbits;
1078 
1079 	if (op > sp->enc_rawlimit) {
1080 		tif->tif_rawcc = (tmsize_t)(op - tif->tif_rawdata);
1081 		if( !TIFFFlushData1(tif) )
1082                     return 0;
1083 		op = tif->tif_rawdata;
1084 	}
1085 	if (sp->enc_oldcode != (hcode_t) -1) {
1086                 int free_ent = sp->lzw_free_ent;
1087 
1088 		PutNextCode(op, sp->enc_oldcode);
1089 		sp->enc_oldcode = (hcode_t) -1;
1090                 free_ent ++;
1091 
1092                 if (free_ent == CODE_MAX-1) {
1093                         /* table is full, emit clear code and reset */
1094                         outcount = 0;
1095                         PutNextCode(op, CODE_CLEAR);
1096                         nbits = BITS_MIN;
1097                 } else {
1098                         /*
1099                         * If the next entry is going to be too big for
1100                         * the code size, then increase it, if possible.
1101                         */
1102                         if (free_ent > sp->lzw_maxcode) {
1103                                 nbits++;
1104                                 assert(nbits <= BITS_MAX);
1105                         }
1106                 }
1107 	}
1108 	PutNextCode(op, CODE_EOI);
1109         /* Explicit 0xff masking to make icc -check=conversions happy */
1110 	if (nextbits > 0)
1111 		*op++ = (unsigned char)((nextdata << (8-nextbits))&0xff);
1112 	tif->tif_rawcc = (tmsize_t)(op - tif->tif_rawdata);
1113 	return (1);
1114 }
1115 
1116 /*
1117  * Reset encoding hash table.
1118  */
1119 static void
cl_hash(LZWCodecState * sp)1120 cl_hash(LZWCodecState* sp)
1121 {
1122 	register hash_t *hp = &sp->enc_hashtab[HSIZE-1];
1123 	register long i = HSIZE-8;
1124 
1125 	do {
1126 		i -= 8;
1127 		hp[-7].hash = -1;
1128 		hp[-6].hash = -1;
1129 		hp[-5].hash = -1;
1130 		hp[-4].hash = -1;
1131 		hp[-3].hash = -1;
1132 		hp[-2].hash = -1;
1133 		hp[-1].hash = -1;
1134 		hp[ 0].hash = -1;
1135 		hp -= 8;
1136 	} while (i >= 0);
1137 	for (i += 8; i > 0; i--, hp--)
1138 		hp->hash = -1;
1139 }
1140 
1141 static void
LZWCleanup(TIFF * tif)1142 LZWCleanup(TIFF* tif)
1143 {
1144 	(void)TIFFPredictorCleanup(tif);
1145 
1146 	assert(tif->tif_data != 0);
1147 
1148 	if (DecoderState(tif)->dec_codetab)
1149 		_TIFFfree(DecoderState(tif)->dec_codetab);
1150 
1151 	if (EncoderState(tif)->enc_hashtab)
1152 		_TIFFfree(EncoderState(tif)->enc_hashtab);
1153 
1154 	_TIFFfree(tif->tif_data);
1155 	tif->tif_data = NULL;
1156 
1157 	_TIFFSetDefaultCompressionState(tif);
1158 }
1159 
1160 int
TIFFInitLZW(TIFF * tif,int scheme)1161 TIFFInitLZW(TIFF* tif, int scheme)
1162 {
1163 	static const char module[] = "TIFFInitLZW";
1164 	assert(scheme == COMPRESSION_LZW);
1165 	/*
1166 	 * Allocate state block so tag methods have storage to record values.
1167 	 */
1168 	tif->tif_data = (uint8*) _TIFFmalloc(sizeof (LZWCodecState));
1169 	if (tif->tif_data == NULL)
1170 		goto bad;
1171 	DecoderState(tif)->dec_codetab = NULL;
1172 	DecoderState(tif)->dec_decode = NULL;
1173 	EncoderState(tif)->enc_hashtab = NULL;
1174         LZWState(tif)->rw_mode = tif->tif_mode;
1175 
1176 	/*
1177 	 * Install codec methods.
1178 	 */
1179 	tif->tif_fixuptags = LZWFixupTags;
1180 	tif->tif_setupdecode = LZWSetupDecode;
1181 	tif->tif_predecode = LZWPreDecode;
1182 	tif->tif_decoderow = LZWDecode;
1183 	tif->tif_decodestrip = LZWDecode;
1184 	tif->tif_decodetile = LZWDecode;
1185 	tif->tif_setupencode = LZWSetupEncode;
1186 	tif->tif_preencode = LZWPreEncode;
1187 	tif->tif_postencode = LZWPostEncode;
1188 	tif->tif_encoderow = LZWEncode;
1189 	tif->tif_encodestrip = LZWEncode;
1190 	tif->tif_encodetile = LZWEncode;
1191 	tif->tif_cleanup = LZWCleanup;
1192 	/*
1193 	 * Setup predictor setup.
1194 	 */
1195 	(void) TIFFPredictorInit(tif);
1196 	return (1);
1197 bad:
1198 	TIFFErrorExt(tif->tif_clientdata, module,
1199 		     "No space for LZW state block");
1200 	return (0);
1201 }
1202 
1203 /*
1204  * Copyright (c) 1985, 1986 The Regents of the University of California.
1205  * All rights reserved.
1206  *
1207  * This code is derived from software contributed to Berkeley by
1208  * James A. Woods, derived from original work by Spencer Thomas
1209  * and Joseph Orost.
1210  *
1211  * Redistribution and use in source and binary forms are permitted
1212  * provided that the above copyright notice and this paragraph are
1213  * duplicated in all such forms and that any documentation,
1214  * advertising materials, and other materials related to such
1215  * distribution and use acknowledge that the software was developed
1216  * by the University of California, Berkeley.  The name of the
1217  * University may not be used to endorse or promote products derived
1218  * from this software without specific prior written permission.
1219  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
1220  * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
1221  * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
1222  */
1223 #endif /* LZW_SUPPORT */
1224 
1225 /* vim: set ts=8 sts=8 sw=8 noet: */
1226 /*
1227  * Local Variables:
1228  * mode: c
1229  * c-basic-offset: 8
1230  * fill-column: 78
1231  * End:
1232  */
1233