1 /*
2  * Copyright (c) 1988-1997 Sam Leffler
3  * Copyright (c) 1991-1997 Silicon Graphics, Inc.
4  *
5  * Permission to use, copy, modify, distribute, and sell this software and
6  * its documentation for any purpose is hereby granted without fee, provided
7  * that (i) the above copyright notices and this permission notice appear in
8  * all copies of the software and related documentation, and (ii) the names of
9  * Sam Leffler and Silicon Graphics may not be used in any advertising or
10  * publicity relating to the software without the specific, prior written
11  * permission of Sam Leffler and Silicon Graphics.
12  *
13  * THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND,
14  * EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY
15  * WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
16  *
17  * IN NO EVENT SHALL SAM LEFFLER OR SILICON GRAPHICS BE LIABLE FOR
18  * ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND,
19  * OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
20  * WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF
21  * LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
22  * OF THIS SOFTWARE.
23  */
24 
25 #include "tiffiop.h"
26 #ifdef LZW_SUPPORT
27 /*
28  * TIFF Library.
29  * Rev 5.0 Lempel-Ziv & Welch Compression Support
30  *
31  * This code is derived from the compress program whose code is
32  * derived from software contributed to Berkeley by James A. Woods,
33  * derived from original work by Spencer Thomas and Joseph Orost.
34  *
35  * The original Berkeley copyright notice appears below in its entirety.
36  */
37 #include "tif_predict.h"
38 
39 #include <stdio.h>
40 
41 /*
42  * NB: The 5.0 spec describes a different algorithm than Aldus
43  *     implements.  Specifically, Aldus does code length transitions
44  *     one code earlier than should be done (for real LZW).
45  *     Earlier versions of this library implemented the correct
46  *     LZW algorithm, but emitted codes in a bit order opposite
47  *     to the TIFF spec.  Thus, to maintain compatibility w/ Aldus
48  *     we interpret MSB-LSB ordered codes to be images written w/
49  *     old versions of this library, but otherwise adhere to the
50  *     Aldus "off by one" algorithm.
51  *
52  * Future revisions to the TIFF spec are expected to "clarify this issue".
53  */
54 #define LZW_COMPAT              /* include backwards compatibility code */
55 /*
56  * Each strip of data is supposed to be terminated by a CODE_EOI.
57  * If the following #define is included, the decoder will also
58  * check for end-of-strip w/o seeing this code.  This makes the
59  * library more robust, but also slower.
60  */
61 #define LZW_CHECKEOS            /* include checks for strips w/o EOI code */
62 
63 #define MAXCODE(n)	((1L<<(n))-1)
64 /*
65  * The TIFF spec specifies that encoded bit
66  * strings range from 9 to 12 bits.
67  */
68 #define BITS_MIN        9               /* start with 9 bits */
69 #define BITS_MAX        12              /* max of 12 bit strings */
70 /* predefined codes */
71 #define CODE_CLEAR      256             /* code to clear string table */
72 #define CODE_EOI        257             /* end-of-information code */
73 #define CODE_FIRST      258             /* first free code entry */
74 #define CODE_MAX        MAXCODE(BITS_MAX)
75 #define HSIZE           9001L           /* 91% occupancy */
76 #define HSHIFT          (13-8)
77 #ifdef LZW_COMPAT
78 /* NB: +1024 is for compatibility with old files */
79 #define CSIZE           (MAXCODE(BITS_MAX)+1024L)
80 #else
81 #define CSIZE           (MAXCODE(BITS_MAX)+1L)
82 #endif
83 
84 /*
85  * State block for each open TIFF file using LZW
86  * compression/decompression.  Note that the predictor
87  * state block must be first in this data structure.
88  */
89 typedef struct {
90 	TIFFPredictorState predict;     /* predictor super class */
91 
92 	unsigned short  nbits;          /* # of bits/code */
93 	unsigned short  maxcode;        /* maximum code for lzw_nbits */
94 	unsigned short  free_ent;       /* next free entry in hash table */
95 	unsigned long   nextdata;       /* next bits of i/o */
96 	long            nextbits;       /* # of valid bits in lzw_nextdata */
97 
98 	int             rw_mode;        /* preserve rw_mode from init */
99 } LZWBaseState;
100 
101 #define lzw_nbits       base.nbits
102 #define lzw_maxcode     base.maxcode
103 #define lzw_free_ent    base.free_ent
104 #define lzw_nextdata    base.nextdata
105 #define lzw_nextbits    base.nextbits
106 
107 /*
108  * Encoding-specific state.
109  */
110 typedef uint16 hcode_t;			/* codes fit in 16 bits */
111 typedef struct {
112 	long	hash;
113 	hcode_t	code;
114 } hash_t;
115 
116 /*
117  * Decoding-specific state.
118  */
119 typedef struct code_ent {
120 	struct code_ent *next;
121 	unsigned short	length;		/* string len, including this token */
122 	unsigned char	value;		/* data value */
123 	unsigned char	firstchar;	/* first token of string */
124 } code_t;
125 
126 typedef int (*decodeFunc)(TIFF*, uint8*, tmsize_t, uint16);
127 
128 typedef struct {
129 	LZWBaseState base;
130 
131 	/* Decoding specific data */
132 	long    dec_nbitsmask;		/* lzw_nbits 1 bits, right adjusted */
133 	long    dec_restart;		/* restart count */
134 #ifdef LZW_CHECKEOS
135 	uint64  dec_bitsleft;		/* available bits in raw data */
136 #endif
137 	decodeFunc dec_decode;		/* regular or backwards compatible */
138 	code_t* dec_codep;		/* current recognized code */
139 	code_t* dec_oldcodep;		/* previously recognized code */
140 	code_t* dec_free_entp;		/* next free entry */
141 	code_t* dec_maxcodep;		/* max available entry */
142 	code_t* dec_codetab;		/* kept separate for small machines */
143 
144 	/* Encoding specific data */
145 	int     enc_oldcode;		/* last code encountered */
146 	long    enc_checkpoint;		/* point at which to clear table */
147 #define CHECK_GAP	10000		/* enc_ratio check interval */
148 	long    enc_ratio;		/* current compression ratio */
149 	long    enc_incount;		/* (input) data bytes encoded */
150 	long    enc_outcount;		/* encoded (output) bytes */
151 	uint8*  enc_rawlimit;		/* bound on tif_rawdata buffer */
152 	hash_t* enc_hashtab;		/* kept separate for small machines */
153 } LZWCodecState;
154 
155 #define LZWState(tif)		((LZWBaseState*) (tif)->tif_data)
156 #define DecoderState(tif)	((LZWCodecState*) LZWState(tif))
157 #define EncoderState(tif)	((LZWCodecState*) LZWState(tif))
158 
159 static int LZWDecode(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s);
160 #ifdef LZW_COMPAT
161 static int LZWDecodeCompat(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s);
162 #endif
163 static void cl_hash(LZWCodecState*);
164 
165 /*
166  * LZW Decoder.
167  */
168 
169 #ifdef LZW_CHECKEOS
170 /*
171  * This check shouldn't be necessary because each
172  * strip is suppose to be terminated with CODE_EOI.
173  */
174 #define	NextCode(_tif, _sp, _bp, _code, _get) {				\
175 	if ((_sp)->dec_bitsleft < (uint64)nbits) {			\
176 		TIFFWarningExt(_tif->tif_clientdata, module,		\
177 		    "LZWDecode: Strip %d not terminated with EOI code", \
178 		    _tif->tif_curstrip);				\
179 		_code = CODE_EOI;					\
180 	} else {							\
181 		_get(_sp,_bp,_code);					\
182 		(_sp)->dec_bitsleft -= nbits;				\
183 	}								\
184 }
185 #else
186 #define	NextCode(tif, sp, bp, code, get) get(sp, bp, code)
187 #endif
188 
189 static int
LZWFixupTags(TIFF * tif)190 LZWFixupTags(TIFF* tif)
191 {
192 	(void) tif;
193 	return (1);
194 }
195 
196 static int
LZWSetupDecode(TIFF * tif)197 LZWSetupDecode(TIFF* tif)
198 {
199 	static const char module[] = "LZWSetupDecode";
200 	LZWCodecState* sp = DecoderState(tif);
201 	int code;
202 
203 	if( sp == NULL )
204 	{
205 		/*
206 		 * Allocate state block so tag methods have storage to record
207 		 * values.
208 		*/
209 		tif->tif_data = (uint8*) _TIFFmalloc(sizeof(LZWCodecState));
210 		if (tif->tif_data == NULL)
211 		{
212 			TIFFErrorExt(tif->tif_clientdata, module, "No space for LZW state block");
213 			return (0);
214 		}
215 
216 		DecoderState(tif)->dec_codetab = NULL;
217 		DecoderState(tif)->dec_decode = NULL;
218 
219 		/*
220 		 * Setup predictor setup.
221 		 */
222 		(void) TIFFPredictorInit(tif);
223 
224 		sp = DecoderState(tif);
225 	}
226 
227 	assert(sp != NULL);
228 
229 	if (sp->dec_codetab == NULL) {
230 		sp->dec_codetab = (code_t*)_TIFFmalloc(CSIZE*sizeof (code_t));
231 		if (sp->dec_codetab == NULL) {
232 			TIFFErrorExt(tif->tif_clientdata, module,
233 				     "No space for LZW code table");
234 			return (0);
235 		}
236 		/*
237 		 * Pre-load the table.
238 		 */
239 		code = 255;
240 		do {
241 			sp->dec_codetab[code].value = (unsigned char)code;
242 			sp->dec_codetab[code].firstchar = (unsigned char)code;
243 			sp->dec_codetab[code].length = 1;
244 			sp->dec_codetab[code].next = NULL;
245 		} while (code--);
246 		/*
247 		 * Zero-out the unused entries
248                  */
249                  _TIFFmemset(&sp->dec_codetab[CODE_CLEAR], 0,
250 			     (CODE_FIRST - CODE_CLEAR) * sizeof (code_t));
251 	}
252 	return (1);
253 }
254 
255 /*
256  * Setup state for decoding a strip.
257  */
258 static int
LZWPreDecode(TIFF * tif,uint16 s)259 LZWPreDecode(TIFF* tif, uint16 s)
260 {
261 	static const char module[] = "LZWPreDecode";
262 	LZWCodecState *sp = DecoderState(tif);
263 
264 	(void) s;
265 	assert(sp != NULL);
266 	if( sp->dec_codetab == NULL )
267         {
268             tif->tif_setupdecode( tif );
269 	    if( sp->dec_codetab == NULL )
270 		return (0);
271         }
272 
273 	/*
274 	 * Check for old bit-reversed codes.
275 	 */
276 	if (tif->tif_rawcc >= 2 &&
277 	    tif->tif_rawdata[0] == 0 && (tif->tif_rawdata[1] & 0x1)) {
278 #ifdef LZW_COMPAT
279 		if (!sp->dec_decode) {
280 			TIFFWarningExt(tif->tif_clientdata, module,
281 			    "Old-style LZW codes, convert file");
282 			/*
283 			 * Override default decoding methods with
284 			 * ones that deal with the old coding.
285 			 * Otherwise the predictor versions set
286 			 * above will call the compatibility routines
287 			 * through the dec_decode method.
288 			 */
289 			tif->tif_decoderow = LZWDecodeCompat;
290 			tif->tif_decodestrip = LZWDecodeCompat;
291 			tif->tif_decodetile = LZWDecodeCompat;
292 			/*
293 			 * If doing horizontal differencing, must
294 			 * re-setup the predictor logic since we
295 			 * switched the basic decoder methods...
296 			 */
297 			(*tif->tif_setupdecode)(tif);
298 			sp->dec_decode = LZWDecodeCompat;
299 		}
300 		sp->lzw_maxcode = MAXCODE(BITS_MIN);
301 #else /* !LZW_COMPAT */
302 		if (!sp->dec_decode) {
303 			TIFFErrorExt(tif->tif_clientdata, module,
304 			    "Old-style LZW codes not supported");
305 			sp->dec_decode = LZWDecode;
306 		}
307 		return (0);
308 #endif/* !LZW_COMPAT */
309 	} else {
310 		sp->lzw_maxcode = MAXCODE(BITS_MIN)-1;
311 		sp->dec_decode = LZWDecode;
312 	}
313 	sp->lzw_nbits = BITS_MIN;
314 	sp->lzw_nextbits = 0;
315 	sp->lzw_nextdata = 0;
316 
317 	sp->dec_restart = 0;
318 	sp->dec_nbitsmask = MAXCODE(BITS_MIN);
319 #ifdef LZW_CHECKEOS
320 	sp->dec_bitsleft = 0;
321 #endif
322 	sp->dec_free_entp = sp->dec_codetab + CODE_FIRST;
323 	/*
324 	 * Zero entries that are not yet filled in.  We do
325 	 * this to guard against bogus input data that causes
326 	 * us to index into undefined entries.  If you can
327 	 * come up with a way to safely bounds-check input codes
328 	 * while decoding then you can remove this operation.
329 	 */
330 	_TIFFmemset(sp->dec_free_entp, 0, (CSIZE-CODE_FIRST)*sizeof (code_t));
331 	sp->dec_oldcodep = &sp->dec_codetab[-1];
332 	sp->dec_maxcodep = &sp->dec_codetab[sp->dec_nbitsmask-1];
333 	return (1);
334 }
335 
336 /*
337  * Decode a "hunk of data".
338  */
339 #define	GetNextCode(sp, bp, code) {				\
340 	nextdata = (nextdata<<8) | *(bp)++;			\
341 	nextbits += 8;						\
342 	if (nextbits < nbits) {					\
343 		nextdata = (nextdata<<8) | *(bp)++;		\
344 		nextbits += 8;					\
345 	}							\
346 	code = (hcode_t)((nextdata >> (nextbits-nbits)) & nbitsmask);	\
347 	nextbits -= nbits;					\
348 }
349 
350 static void
codeLoop(TIFF * tif,const char * module)351 codeLoop(TIFF* tif, const char* module)
352 {
353 	TIFFErrorExt(tif->tif_clientdata, module,
354 	    "Bogus encoding, loop in the code table; scanline %d",
355 	    tif->tif_row);
356 }
357 
358 static int
LZWDecode(TIFF * tif,uint8 * op0,tmsize_t occ0,uint16 s)359 LZWDecode(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s)
360 {
361 	static const char module[] = "LZWDecode";
362 	LZWCodecState *sp = DecoderState(tif);
363 	char *op = (char*) op0;
364 	long occ = (long) occ0;
365 	char *tp;
366 	unsigned char *bp;
367 	hcode_t code;
368 	int len;
369 	long nbits, nextbits, nbitsmask;
370         unsigned long nextdata;
371 	code_t *codep, *free_entp, *maxcodep, *oldcodep;
372 
373 	(void) s;
374 	assert(sp != NULL);
375         assert(sp->dec_codetab != NULL);
376 
377 	/*
378 	  Fail if value does not fit in long.
379 	*/
380 	if ((tmsize_t) occ != occ0)
381 	        return (0);
382 	/*
383 	 * Restart interrupted output operation.
384 	 */
385 	if (sp->dec_restart) {
386 		long residue;
387 
388 		codep = sp->dec_codep;
389 		residue = codep->length - sp->dec_restart;
390 		if (residue > occ) {
391 			/*
392 			 * Residue from previous decode is sufficient
393 			 * to satisfy decode request.  Skip to the
394 			 * start of the decoded string, place decoded
395 			 * values in the output buffer, and return.
396 			 */
397 			sp->dec_restart += occ;
398 			do {
399 				codep = codep->next;
400 			} while (--residue > occ && codep);
401 			if (codep) {
402 				tp = op + occ;
403 				do {
404 					*--tp = codep->value;
405 					codep = codep->next;
406 				} while (--occ && codep);
407 			}
408 			return (1);
409 		}
410 		/*
411 		 * Residue satisfies only part of the decode request.
412 		 */
413 		op += residue;
414 		occ -= residue;
415 		tp = op;
416 		do {
417 			int t;
418 			--tp;
419 			t = codep->value;
420 			codep = codep->next;
421 			*tp = (char)t;
422 		} while (--residue && codep);
423 		sp->dec_restart = 0;
424 	}
425 
426 	bp = (unsigned char *)tif->tif_rawcp;
427 #ifdef LZW_CHECKEOS
428 	sp->dec_bitsleft = (((uint64)tif->tif_rawcc) << 3);
429 #endif
430 	nbits = sp->lzw_nbits;
431 	nextdata = sp->lzw_nextdata;
432 	nextbits = sp->lzw_nextbits;
433 	nbitsmask = sp->dec_nbitsmask;
434 	oldcodep = sp->dec_oldcodep;
435 	free_entp = sp->dec_free_entp;
436 	maxcodep = sp->dec_maxcodep;
437 
438 	while (occ > 0) {
439 		NextCode(tif, sp, bp, code, GetNextCode);
440 		if (code == CODE_EOI)
441 			break;
442 		if (code == CODE_CLEAR) {
443 			do {
444 				free_entp = sp->dec_codetab + CODE_FIRST;
445 				_TIFFmemset(free_entp, 0,
446 					    (CSIZE - CODE_FIRST) * sizeof (code_t));
447 				nbits = BITS_MIN;
448 				nbitsmask = MAXCODE(BITS_MIN);
449 				maxcodep = sp->dec_codetab + nbitsmask-1;
450 				NextCode(tif, sp, bp, code, GetNextCode);
451 			} while (code == CODE_CLEAR);	/* consecutive CODE_CLEAR codes */
452 			if (code == CODE_EOI)
453 				break;
454 			if (code > CODE_CLEAR) {
455 				TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
456 				"LZWDecode: Corrupted LZW table at scanline %d",
457 					     tif->tif_row);
458 				return (0);
459 			}
460 			*op++ = (char)code;
461 			occ--;
462 			oldcodep = sp->dec_codetab + code;
463 			continue;
464 		}
465 		codep = sp->dec_codetab + code;
466 
467 		/*
468 		 * Add the new entry to the code table.
469 		 */
470 		if (free_entp < &sp->dec_codetab[0] ||
471 		    free_entp >= &sp->dec_codetab[CSIZE]) {
472 			TIFFErrorExt(tif->tif_clientdata, module,
473 			    "Corrupted LZW table at scanline %d",
474 			    tif->tif_row);
475 			return (0);
476 		}
477 
478 		free_entp->next = oldcodep;
479 		if (free_entp->next < &sp->dec_codetab[0] ||
480 		    free_entp->next >= &sp->dec_codetab[CSIZE]) {
481 			TIFFErrorExt(tif->tif_clientdata, module,
482 			    "Corrupted LZW table at scanline %d",
483 			    tif->tif_row);
484 			return (0);
485 		}
486 		free_entp->firstchar = free_entp->next->firstchar;
487 		free_entp->length = free_entp->next->length+1;
488 		free_entp->value = (codep < free_entp) ?
489 		    codep->firstchar : free_entp->firstchar;
490 		if (++free_entp > maxcodep) {
491 			if (++nbits > BITS_MAX)		/* should not happen */
492 				nbits = BITS_MAX;
493 			nbitsmask = MAXCODE(nbits);
494 			maxcodep = sp->dec_codetab + nbitsmask-1;
495 		}
496 		oldcodep = codep;
497 		if (code >= 256) {
498 			/*
499 			 * Code maps to a string, copy string
500 			 * value to output (written in reverse).
501 			 */
502 			if(codep->length == 0) {
503 				TIFFErrorExt(tif->tif_clientdata, module,
504 				    "Wrong length of decoded string: "
505 				    "data probably corrupted at scanline %d",
506 				    tif->tif_row);
507 				return (0);
508 			}
509 			if (codep->length > occ) {
510 				/*
511 				 * String is too long for decode buffer,
512 				 * locate portion that will fit, copy to
513 				 * the decode buffer, and setup restart
514 				 * logic for the next decoding call.
515 				 */
516 				sp->dec_codep = codep;
517 				do {
518 					codep = codep->next;
519 				} while (codep && codep->length > occ);
520 				if (codep) {
521 					sp->dec_restart = (long)occ;
522 					tp = op + occ;
523 					do  {
524 						*--tp = codep->value;
525 						codep = codep->next;
526 					}  while (--occ && codep);
527 					if (codep)
528 						codeLoop(tif, module);
529 				}
530 				break;
531 			}
532 			len = codep->length;
533 			tp = op + len;
534 			do {
535 				int t;
536 				--tp;
537 				t = codep->value;
538 				codep = codep->next;
539 				*tp = (char)t;
540 			} while (codep && tp > op);
541 			if (codep) {
542 			    codeLoop(tif, module);
543 			    break;
544 			}
545 			assert(occ >= len);
546 			op += len;
547 			occ -= len;
548 		} else {
549 			*op++ = (char)code;
550 			occ--;
551 		}
552 	}
553 
554 	tif->tif_rawcc -= (tmsize_t)( (uint8*) bp - tif->tif_rawcp );
555 	tif->tif_rawcp = (uint8*) bp;
556 	sp->lzw_nbits = (unsigned short) nbits;
557 	sp->lzw_nextdata = nextdata;
558 	sp->lzw_nextbits = nextbits;
559 	sp->dec_nbitsmask = nbitsmask;
560 	sp->dec_oldcodep = oldcodep;
561 	sp->dec_free_entp = free_entp;
562 	sp->dec_maxcodep = maxcodep;
563 
564 	if (occ > 0) {
565 #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
566 		TIFFErrorExt(tif->tif_clientdata, module,
567 			"Not enough data at scanline %d (short %I64d bytes)",
568 			     tif->tif_row, (unsigned __int64) occ);
569 #else
570 		TIFFErrorExt(tif->tif_clientdata, module,
571 			"Not enough data at scanline %d (short %llu bytes)",
572 			     tif->tif_row, (unsigned long long) occ);
573 #endif
574 		return (0);
575 	}
576 	return (1);
577 }
578 
579 #ifdef LZW_COMPAT
580 /*
581  * Decode a "hunk of data" for old images.
582  */
583 #define	GetNextCodeCompat(sp, bp, code) {			\
584 	nextdata |= (unsigned long) *(bp)++ << nextbits;	\
585 	nextbits += 8;						\
586 	if (nextbits < nbits) {					\
587 		nextdata |= (unsigned long) *(bp)++ << nextbits;\
588 		nextbits += 8;					\
589 	}							\
590 	code = (hcode_t)(nextdata & nbitsmask);			\
591 	nextdata >>= nbits;					\
592 	nextbits -= nbits;					\
593 }
594 
595 static int
LZWDecodeCompat(TIFF * tif,uint8 * op0,tmsize_t occ0,uint16 s)596 LZWDecodeCompat(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s)
597 {
598 	static const char module[] = "LZWDecodeCompat";
599 	LZWCodecState *sp = DecoderState(tif);
600 	char *op = (char*) op0;
601 	long occ = (long) occ0;
602 	char *tp;
603 	unsigned char *bp;
604 	int code, nbits;
605 	int len;
606 	long nextbits, nextdata, nbitsmask;
607 	code_t *codep, *free_entp, *maxcodep, *oldcodep;
608 
609 	(void) s;
610 	assert(sp != NULL);
611 
612 	/*
613 	  Fail if value does not fit in long.
614 	*/
615 	if ((tmsize_t) occ != occ0)
616 	        return (0);
617 
618 	/*
619 	 * Restart interrupted output operation.
620 	 */
621 	if (sp->dec_restart) {
622 		long residue;
623 
624 		codep = sp->dec_codep;
625 		residue = codep->length - sp->dec_restart;
626 		if (residue > occ) {
627 			/*
628 			 * Residue from previous decode is sufficient
629 			 * to satisfy decode request.  Skip to the
630 			 * start of the decoded string, place decoded
631 			 * values in the output buffer, and return.
632 			 */
633 			sp->dec_restart += occ;
634 			do {
635 				codep = codep->next;
636 			} while (--residue > occ);
637 			tp = op + occ;
638 			do {
639 				*--tp = codep->value;
640 				codep = codep->next;
641 			} while (--occ);
642 			return (1);
643 		}
644 		/*
645 		 * Residue satisfies only part of the decode request.
646 		 */
647 		op += residue;
648 		occ -= residue;
649 		tp = op;
650 		do {
651 			*--tp = codep->value;
652 			codep = codep->next;
653 		} while (--residue);
654 		sp->dec_restart = 0;
655 	}
656 
657 	bp = (unsigned char *)tif->tif_rawcp;
658 #ifdef LZW_CHECKEOS
659 	sp->dec_bitsleft = (((uint64)tif->tif_rawcc) << 3);
660 #endif
661 	nbits = sp->lzw_nbits;
662 	nextdata = sp->lzw_nextdata;
663 	nextbits = sp->lzw_nextbits;
664 	nbitsmask = sp->dec_nbitsmask;
665 	oldcodep = sp->dec_oldcodep;
666 	free_entp = sp->dec_free_entp;
667 	maxcodep = sp->dec_maxcodep;
668 
669 	while (occ > 0) {
670 		NextCode(tif, sp, bp, code, GetNextCodeCompat);
671 		if (code == CODE_EOI)
672 			break;
673 		if (code == CODE_CLEAR) {
674 			do {
675 				free_entp = sp->dec_codetab + CODE_FIRST;
676 				_TIFFmemset(free_entp, 0,
677 					    (CSIZE - CODE_FIRST) * sizeof (code_t));
678 				nbits = BITS_MIN;
679 				nbitsmask = MAXCODE(BITS_MIN);
680 				maxcodep = sp->dec_codetab + nbitsmask;
681 				NextCode(tif, sp, bp, code, GetNextCodeCompat);
682 			} while (code == CODE_CLEAR);	/* consecutive CODE_CLEAR codes */
683 			if (code == CODE_EOI)
684 				break;
685 			if (code > CODE_CLEAR) {
686 				TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
687 				"LZWDecode: Corrupted LZW table at scanline %d",
688 					     tif->tif_row);
689 				return (0);
690 			}
691 			*op++ = (char)code;
692 			occ--;
693 			oldcodep = sp->dec_codetab + code;
694 			continue;
695 		}
696 		codep = sp->dec_codetab + code;
697 
698 		/*
699 		 * Add the new entry to the code table.
700 		 */
701 		if (free_entp < &sp->dec_codetab[0] ||
702 		    free_entp >= &sp->dec_codetab[CSIZE]) {
703 			TIFFErrorExt(tif->tif_clientdata, module,
704 			    "Corrupted LZW table at scanline %d", tif->tif_row);
705 			return (0);
706 		}
707 
708 		free_entp->next = oldcodep;
709 		if (free_entp->next < &sp->dec_codetab[0] ||
710 		    free_entp->next >= &sp->dec_codetab[CSIZE]) {
711 			TIFFErrorExt(tif->tif_clientdata, module,
712 			    "Corrupted LZW table at scanline %d", tif->tif_row);
713 			return (0);
714 		}
715 		free_entp->firstchar = free_entp->next->firstchar;
716 		free_entp->length = free_entp->next->length+1;
717 		free_entp->value = (codep < free_entp) ?
718 		    codep->firstchar : free_entp->firstchar;
719 		if (++free_entp > maxcodep) {
720 			if (++nbits > BITS_MAX)		/* should not happen */
721 				nbits = BITS_MAX;
722 			nbitsmask = MAXCODE(nbits);
723 			maxcodep = sp->dec_codetab + nbitsmask;
724 		}
725 		oldcodep = codep;
726 		if (code >= 256) {
727 			/*
728 			 * Code maps to a string, copy string
729 			 * value to output (written in reverse).
730 			 */
731 			if(codep->length == 0) {
732 				TIFFErrorExt(tif->tif_clientdata, module,
733 				    "Wrong length of decoded "
734 				    "string: data probably corrupted at scanline %d",
735 				    tif->tif_row);
736 				return (0);
737 			}
738 			if (codep->length > occ) {
739 				/*
740 				 * String is too long for decode buffer,
741 				 * locate portion that will fit, copy to
742 				 * the decode buffer, and setup restart
743 				 * logic for the next decoding call.
744 				 */
745 				sp->dec_codep = codep;
746 				do {
747 					codep = codep->next;
748 				} while (codep->length > occ);
749 				sp->dec_restart = occ;
750 				tp = op + occ;
751 				do  {
752 					*--tp = codep->value;
753 					codep = codep->next;
754 				}  while (--occ);
755 				break;
756 			}
757 			len = codep->length;
758 			tp = op + len;
759 			do {
760 				int t;
761 				--tp;
762 				t = codep->value;
763 				codep = codep->next;
764 				*tp = (char)t;
765 			} while (codep && tp > op);
766 			assert(occ >= len);
767 			op += len;
768 			occ -= len;
769 		} else {
770 			*op++ = (char)code;
771 			occ--;
772 		}
773 	}
774 
775 	tif->tif_rawcc -= (tmsize_t)( (uint8*) bp - tif->tif_rawcp );
776 	tif->tif_rawcp = (uint8*) bp;
777 	sp->lzw_nbits = (unsigned short)nbits;
778 	sp->lzw_nextdata = nextdata;
779 	sp->lzw_nextbits = nextbits;
780 	sp->dec_nbitsmask = nbitsmask;
781 	sp->dec_oldcodep = oldcodep;
782 	sp->dec_free_entp = free_entp;
783 	sp->dec_maxcodep = maxcodep;
784 
785 	if (occ > 0) {
786 #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
787 		TIFFErrorExt(tif->tif_clientdata, module,
788 			"Not enough data at scanline %d (short %I64d bytes)",
789 			     tif->tif_row, (unsigned __int64) occ);
790 #else
791 		TIFFErrorExt(tif->tif_clientdata, module,
792 			"Not enough data at scanline %d (short %llu bytes)",
793 			     tif->tif_row, (unsigned long long) occ);
794 #endif
795 		return (0);
796 	}
797 	return (1);
798 }
799 #endif /* LZW_COMPAT */
800 
801 /*
802  * LZW Encoding.
803  */
804 
805 static int
LZWSetupEncode(TIFF * tif)806 LZWSetupEncode(TIFF* tif)
807 {
808 	static const char module[] = "LZWSetupEncode";
809 	LZWCodecState* sp = EncoderState(tif);
810 
811 	assert(sp != NULL);
812 	sp->enc_hashtab = (hash_t*) _TIFFmalloc(HSIZE*sizeof (hash_t));
813 	if (sp->enc_hashtab == NULL) {
814 		TIFFErrorExt(tif->tif_clientdata, module,
815 			     "No space for LZW hash table");
816 		return (0);
817 	}
818 	return (1);
819 }
820 
821 /*
822  * Reset encoding state at the start of a strip.
823  */
824 static int
LZWPreEncode(TIFF * tif,uint16 s)825 LZWPreEncode(TIFF* tif, uint16 s)
826 {
827 	LZWCodecState *sp = EncoderState(tif);
828 
829 	(void) s;
830 	assert(sp != NULL);
831 
832 	if( sp->enc_hashtab == NULL )
833         {
834             tif->tif_setupencode( tif );
835         }
836 
837 	sp->lzw_nbits = BITS_MIN;
838 	sp->lzw_maxcode = MAXCODE(BITS_MIN);
839 	sp->lzw_free_ent = CODE_FIRST;
840 	sp->lzw_nextbits = 0;
841 	sp->lzw_nextdata = 0;
842 	sp->enc_checkpoint = CHECK_GAP;
843 	sp->enc_ratio = 0;
844 	sp->enc_incount = 0;
845 	sp->enc_outcount = 0;
846 	/*
847 	 * The 4 here insures there is space for 2 max-sized
848 	 * codes in LZWEncode and LZWPostDecode.
849 	 */
850 	sp->enc_rawlimit = tif->tif_rawdata + tif->tif_rawdatasize-1 - 4;
851 	cl_hash(sp);		/* clear hash table */
852 	sp->enc_oldcode = (hcode_t) -1;	/* generates CODE_CLEAR in LZWEncode */
853 	return (1);
854 }
855 
856 #define	CALCRATIO(sp, rat) {					\
857 	if (incount > 0x007fffff) { /* NB: shift will overflow */\
858 		rat = outcount >> 8;				\
859 		rat = (rat == 0 ? 0x7fffffff : incount/rat);	\
860 	} else							\
861 		rat = (incount<<8) / outcount;			\
862 }
863 
864 /* Explicit 0xff masking to make icc -check=conversions happy */
865 #define	PutNextCode(op, c) {					\
866 	nextdata = (nextdata << nbits) | c;			\
867 	nextbits += nbits;					\
868 	*op++ = (unsigned char)((nextdata >> (nextbits-8))&0xff);		\
869 	nextbits -= 8;						\
870 	if (nextbits >= 8) {					\
871 		*op++ = (unsigned char)((nextdata >> (nextbits-8))&0xff);	\
872 		nextbits -= 8;					\
873 	}							\
874 	outcount += nbits;					\
875 }
876 
877 /*
878  * Encode a chunk of pixels.
879  *
880  * Uses an open addressing double hashing (no chaining) on the
881  * prefix code/next character combination.  We do a variant of
882  * Knuth's algorithm D (vol. 3, sec. 6.4) along with G. Knott's
883  * relatively-prime secondary probe.  Here, the modular division
884  * first probe is gives way to a faster exclusive-or manipulation.
885  * Also do block compression with an adaptive reset, whereby the
886  * code table is cleared when the compression ratio decreases,
887  * but after the table fills.  The variable-length output codes
888  * are re-sized at this point, and a CODE_CLEAR is generated
889  * for the decoder.
890  */
891 static int
LZWEncode(TIFF * tif,uint8 * bp,tmsize_t cc,uint16 s)892 LZWEncode(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
893 {
894 	register LZWCodecState *sp = EncoderState(tif);
895 	register long fcode;
896 	register hash_t *hp;
897 	register int h, c;
898 	hcode_t ent;
899 	long disp;
900 	long incount, outcount, checkpoint;
901 	unsigned long nextdata;
902         long nextbits;
903 	int free_ent, maxcode, nbits;
904 	uint8* op;
905 	uint8* limit;
906 
907 	(void) s;
908 	if (sp == NULL)
909 		return (0);
910 
911         assert(sp->enc_hashtab != NULL);
912 
913 	/*
914 	 * Load local state.
915 	 */
916 	incount = sp->enc_incount;
917 	outcount = sp->enc_outcount;
918 	checkpoint = sp->enc_checkpoint;
919 	nextdata = sp->lzw_nextdata;
920 	nextbits = sp->lzw_nextbits;
921 	free_ent = sp->lzw_free_ent;
922 	maxcode = sp->lzw_maxcode;
923 	nbits = sp->lzw_nbits;
924 	op = tif->tif_rawcp;
925 	limit = sp->enc_rawlimit;
926 	ent = (hcode_t)sp->enc_oldcode;
927 
928 	if (ent == (hcode_t) -1 && cc > 0) {
929 		/*
930 		 * NB: This is safe because it can only happen
931 		 *     at the start of a strip where we know there
932 		 *     is space in the data buffer.
933 		 */
934 		PutNextCode(op, CODE_CLEAR);
935 		ent = *bp++; cc--; incount++;
936 	}
937 	while (cc > 0) {
938 		c = *bp++; cc--; incount++;
939 		fcode = ((long)c << BITS_MAX) + ent;
940 		h = (c << HSHIFT) ^ ent;	/* xor hashing */
941 #ifdef _WINDOWS
942 		/*
943 		 * Check hash index for an overflow.
944 		 */
945 		if (h >= HSIZE)
946 			h -= HSIZE;
947 #endif
948 		hp = &sp->enc_hashtab[h];
949 		if (hp->hash == fcode) {
950 			ent = hp->code;
951 			continue;
952 		}
953 		if (hp->hash >= 0) {
954 			/*
955 			 * Primary hash failed, check secondary hash.
956 			 */
957 			disp = HSIZE - h;
958 			if (h == 0)
959 				disp = 1;
960 			do {
961 				/*
962 				 * Avoid pointer arithmetic because of
963 				 * wraparound problems with segments.
964 				 */
965 				if ((h -= disp) < 0)
966 					h += HSIZE;
967 				hp = &sp->enc_hashtab[h];
968 				if (hp->hash == fcode) {
969 					ent = hp->code;
970 					goto hit;
971 				}
972 			} while (hp->hash >= 0);
973 		}
974 		/*
975 		 * New entry, emit code and add to table.
976 		 */
977 		/*
978 		 * Verify there is space in the buffer for the code
979 		 * and any potential Clear code that might be emitted
980 		 * below.  The value of limit is setup so that there
981 		 * are at least 4 bytes free--room for 2 codes.
982 		 */
983 		if (op > limit) {
984 			tif->tif_rawcc = (tmsize_t)(op - tif->tif_rawdata);
985 			if( !TIFFFlushData1(tif) )
986                             return 0;
987 			op = tif->tif_rawdata;
988 		}
989 		PutNextCode(op, ent);
990 		ent = (hcode_t)c;
991 		hp->code = (hcode_t)(free_ent++);
992 		hp->hash = fcode;
993 		if (free_ent == CODE_MAX-1) {
994 			/* table is full, emit clear code and reset */
995 			cl_hash(sp);
996 			sp->enc_ratio = 0;
997 			incount = 0;
998 			outcount = 0;
999 			free_ent = CODE_FIRST;
1000 			PutNextCode(op, CODE_CLEAR);
1001 			nbits = BITS_MIN;
1002 			maxcode = MAXCODE(BITS_MIN);
1003 		} else {
1004 			/*
1005 			 * If the next entry is going to be too big for
1006 			 * the code size, then increase it, if possible.
1007 			 */
1008 			if (free_ent > maxcode) {
1009 				nbits++;
1010 				assert(nbits <= BITS_MAX);
1011 				maxcode = (int) MAXCODE(nbits);
1012 			} else if (incount >= checkpoint) {
1013 				long rat;
1014 				/*
1015 				 * Check compression ratio and, if things seem
1016 				 * to be slipping, clear the hash table and
1017 				 * reset state.  The compression ratio is a
1018 				 * 24+8-bit fractional number.
1019 				 */
1020 				checkpoint = incount+CHECK_GAP;
1021 				CALCRATIO(sp, rat);
1022 				if (rat <= sp->enc_ratio) {
1023 					cl_hash(sp);
1024 					sp->enc_ratio = 0;
1025 					incount = 0;
1026 					outcount = 0;
1027 					free_ent = CODE_FIRST;
1028 					PutNextCode(op, CODE_CLEAR);
1029 					nbits = BITS_MIN;
1030 					maxcode = MAXCODE(BITS_MIN);
1031 				} else
1032 					sp->enc_ratio = rat;
1033 			}
1034 		}
1035 	hit:
1036 		;
1037 	}
1038 
1039 	/*
1040 	 * Restore global state.
1041 	 */
1042 	sp->enc_incount = incount;
1043 	sp->enc_outcount = outcount;
1044 	sp->enc_checkpoint = checkpoint;
1045 	sp->enc_oldcode = ent;
1046 	sp->lzw_nextdata = nextdata;
1047 	sp->lzw_nextbits = nextbits;
1048 	sp->lzw_free_ent = (unsigned short)free_ent;
1049 	sp->lzw_maxcode = (unsigned short)maxcode;
1050 	sp->lzw_nbits = (unsigned short)nbits;
1051 	tif->tif_rawcp = op;
1052 	return (1);
1053 }
1054 
1055 /*
1056  * Finish off an encoded strip by flushing the last
1057  * string and tacking on an End Of Information code.
1058  */
1059 static int
LZWPostEncode(TIFF * tif)1060 LZWPostEncode(TIFF* tif)
1061 {
1062 	register LZWCodecState *sp = EncoderState(tif);
1063 	uint8* op = tif->tif_rawcp;
1064 	long nextbits = sp->lzw_nextbits;
1065 	unsigned long nextdata = sp->lzw_nextdata;
1066 	long outcount = sp->enc_outcount;
1067 	int nbits = sp->lzw_nbits;
1068 
1069 	if (op > sp->enc_rawlimit) {
1070 		tif->tif_rawcc = (tmsize_t)(op - tif->tif_rawdata);
1071 		if( !TIFFFlushData1(tif) )
1072                     return 0;
1073 		op = tif->tif_rawdata;
1074 	}
1075 	if (sp->enc_oldcode != (hcode_t) -1) {
1076                 int free_ent = sp->lzw_free_ent;
1077 
1078 		PutNextCode(op, sp->enc_oldcode);
1079 		sp->enc_oldcode = (hcode_t) -1;
1080                 free_ent ++;
1081 
1082                 if (free_ent == CODE_MAX-1) {
1083                         /* table is full, emit clear code and reset */
1084                         outcount = 0;
1085                         PutNextCode(op, CODE_CLEAR);
1086                         nbits = BITS_MIN;
1087                 } else {
1088                         /*
1089                         * If the next entry is going to be too big for
1090                         * the code size, then increase it, if possible.
1091                         */
1092                         if (free_ent > sp->lzw_maxcode) {
1093                                 nbits++;
1094                                 assert(nbits <= BITS_MAX);
1095                         }
1096                 }
1097 	}
1098 	PutNextCode(op, CODE_EOI);
1099         /* Explicit 0xff masking to make icc -check=conversions happy */
1100 	if (nextbits > 0)
1101 		*op++ = (unsigned char)((nextdata << (8-nextbits))&0xff);
1102 	tif->tif_rawcc = (tmsize_t)(op - tif->tif_rawdata);
1103 	return (1);
1104 }
1105 
1106 /*
1107  * Reset encoding hash table.
1108  */
1109 static void
cl_hash(LZWCodecState * sp)1110 cl_hash(LZWCodecState* sp)
1111 {
1112 	register hash_t *hp = &sp->enc_hashtab[HSIZE-1];
1113 	register long i = HSIZE-8;
1114 
1115 	do {
1116 		i -= 8;
1117 		hp[-7].hash = -1;
1118 		hp[-6].hash = -1;
1119 		hp[-5].hash = -1;
1120 		hp[-4].hash = -1;
1121 		hp[-3].hash = -1;
1122 		hp[-2].hash = -1;
1123 		hp[-1].hash = -1;
1124 		hp[ 0].hash = -1;
1125 		hp -= 8;
1126 	} while (i >= 0);
1127 	for (i += 8; i > 0; i--, hp--)
1128 		hp->hash = -1;
1129 }
1130 
1131 static void
LZWCleanup(TIFF * tif)1132 LZWCleanup(TIFF* tif)
1133 {
1134 	(void)TIFFPredictorCleanup(tif);
1135 
1136 	assert(tif->tif_data != 0);
1137 
1138 	if (DecoderState(tif)->dec_codetab)
1139 		_TIFFfree(DecoderState(tif)->dec_codetab);
1140 
1141 	if (EncoderState(tif)->enc_hashtab)
1142 		_TIFFfree(EncoderState(tif)->enc_hashtab);
1143 
1144 	_TIFFfree(tif->tif_data);
1145 	tif->tif_data = NULL;
1146 
1147 	_TIFFSetDefaultCompressionState(tif);
1148 }
1149 
1150 int
TIFFInitLZW(TIFF * tif,int scheme)1151 TIFFInitLZW(TIFF* tif, int scheme)
1152 {
1153 	static const char module[] = "TIFFInitLZW";
1154 	assert(scheme == COMPRESSION_LZW);
1155 	/*
1156 	 * Allocate state block so tag methods have storage to record values.
1157 	 */
1158 	tif->tif_data = (uint8*) _TIFFmalloc(sizeof (LZWCodecState));
1159 	if (tif->tif_data == NULL)
1160 		goto bad;
1161 	DecoderState(tif)->dec_codetab = NULL;
1162 	DecoderState(tif)->dec_decode = NULL;
1163 	EncoderState(tif)->enc_hashtab = NULL;
1164         LZWState(tif)->rw_mode = tif->tif_mode;
1165 
1166 	/*
1167 	 * Install codec methods.
1168 	 */
1169 	tif->tif_fixuptags = LZWFixupTags;
1170 	tif->tif_setupdecode = LZWSetupDecode;
1171 	tif->tif_predecode = LZWPreDecode;
1172 	tif->tif_decoderow = LZWDecode;
1173 	tif->tif_decodestrip = LZWDecode;
1174 	tif->tif_decodetile = LZWDecode;
1175 	tif->tif_setupencode = LZWSetupEncode;
1176 	tif->tif_preencode = LZWPreEncode;
1177 	tif->tif_postencode = LZWPostEncode;
1178 	tif->tif_encoderow = LZWEncode;
1179 	tif->tif_encodestrip = LZWEncode;
1180 	tif->tif_encodetile = LZWEncode;
1181 	tif->tif_cleanup = LZWCleanup;
1182 	/*
1183 	 * Setup predictor setup.
1184 	 */
1185 	(void) TIFFPredictorInit(tif);
1186 	return (1);
1187 bad:
1188 	TIFFErrorExt(tif->tif_clientdata, module,
1189 		     "No space for LZW state block");
1190 	return (0);
1191 }
1192 
1193 /*
1194  * Copyright (c) 1985, 1986 The Regents of the University of California.
1195  * All rights reserved.
1196  *
1197  * This code is derived from software contributed to Berkeley by
1198  * James A. Woods, derived from original work by Spencer Thomas
1199  * and Joseph Orost.
1200  *
1201  * Redistribution and use in source and binary forms are permitted
1202  * provided that the above copyright notice and this paragraph are
1203  * duplicated in all such forms and that any documentation,
1204  * advertising materials, and other materials related to such
1205  * distribution and use acknowledge that the software was developed
1206  * by the University of California, Berkeley.  The name of the
1207  * University may not be used to endorse or promote products derived
1208  * from this software without specific prior written permission.
1209  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
1210  * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
1211  * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
1212  */
1213 #endif /* LZW_SUPPORT */
1214 
1215 /* vim: set ts=8 sts=8 sw=8 noet: */
1216 /*
1217  * Local Variables:
1218  * mode: c
1219  * c-basic-offset: 8
1220  * fill-column: 78
1221  * End:
1222  */
1223