1 /* $Id: tif_dir.c,v 1.131 2017-07-11 21:38:04 erouault Exp $ */
2 
3 /*
4  * Copyright (c) 1988-1997 Sam Leffler
5  * Copyright (c) 1991-1997 Silicon Graphics, Inc.
6  *
7  * Permission to use, copy, modify, distribute, and sell this software and
8  * its documentation for any purpose is hereby granted without fee, provided
9  * that (i) the above copyright notices and this permission notice appear in
10  * all copies of the software and related documentation, and (ii) the names of
11  * Sam Leffler and Silicon Graphics may not be used in any advertising or
12  * publicity relating to the software without the specific, prior written
13  * permission of Sam Leffler and Silicon Graphics.
14  *
15  * THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND,
16  * EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY
17  * WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
18  *
19  * IN NO EVENT SHALL SAM LEFFLER OR SILICON GRAPHICS BE LIABLE FOR
20  * ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND,
21  * OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
22  * WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF
23  * LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
24  * OF THIS SOFTWARE.
25  */
26 
27 /*
28  * TIFF Library.
29  *
30  * Directory Tag Get & Set Routines.
31  * (and also some miscellaneous stuff)
32  */
33 #include "tiffiop.h"
34 #include <float.h>
35 
36 /*
37  * These are used in the backwards compatibility code...
38  */
39 #define DATATYPE_VOID		0       /* !untyped data */
40 #define DATATYPE_INT		1       /* !signed integer data */
41 #define DATATYPE_UINT		2       /* !unsigned integer data */
42 #define DATATYPE_IEEEFP		3       /* !IEEE floating point data */
43 
44 static void
setByteArray(void ** vpp,void * vp,size_t nmemb,size_t elem_size)45 setByteArray(void** vpp, void* vp, size_t nmemb, size_t elem_size)
46 {
47 	if (*vpp) {
48 		_TIFFfree(*vpp);
49 		*vpp = 0;
50 	}
51 	if (vp) {
52 		tmsize_t bytes = (tmsize_t)(nmemb * elem_size);
53 		if (elem_size && bytes / elem_size == nmemb)
54 			*vpp = (void*) _TIFFmalloc(bytes);
55 		if (*vpp)
56 			_TIFFmemcpy(*vpp, vp, bytes);
57 	}
58 }
_TIFFsetByteArray(void ** vpp,void * vp,uint32 n)59 void _TIFFsetByteArray(void** vpp, void* vp, uint32 n)
60     { setByteArray(vpp, vp, n, 1); }
_TIFFsetString(char ** cpp,char * cp)61 void _TIFFsetString(char** cpp, char* cp)
62     { setByteArray((void**) cpp, (void*) cp, strlen(cp)+1, 1); }
_TIFFsetNString(char ** cpp,char * cp,uint32 n)63 static void _TIFFsetNString(char** cpp, char* cp, uint32 n)
64     { setByteArray((void**) cpp, (void*) cp, n, 1); }
_TIFFsetShortArray(uint16 ** wpp,uint16 * wp,uint32 n)65 void _TIFFsetShortArray(uint16** wpp, uint16* wp, uint32 n)
66     { setByteArray((void**) wpp, (void*) wp, n, sizeof (uint16)); }
_TIFFsetLongArray(uint32 ** lpp,uint32 * lp,uint32 n)67 void _TIFFsetLongArray(uint32** lpp, uint32* lp, uint32 n)
68     { setByteArray((void**) lpp, (void*) lp, n, sizeof (uint32)); }
_TIFFsetLong8Array(uint64 ** lpp,uint64 * lp,uint32 n)69 static void _TIFFsetLong8Array(uint64** lpp, uint64* lp, uint32 n)
70     { setByteArray((void**) lpp, (void*) lp, n, sizeof (uint64)); }
_TIFFsetFloatArray(float ** fpp,float * fp,uint32 n)71 void _TIFFsetFloatArray(float** fpp, float* fp, uint32 n)
72     { setByteArray((void**) fpp, (void*) fp, n, sizeof (float)); }
_TIFFsetDoubleArray(double ** dpp,double * dp,uint32 n)73 void _TIFFsetDoubleArray(double** dpp, double* dp, uint32 n)
74     { setByteArray((void**) dpp, (void*) dp, n, sizeof (double)); }
75 
76 static void
setDoubleArrayOneValue(double ** vpp,double value,size_t nmemb)77 setDoubleArrayOneValue(double** vpp, double value, size_t nmemb)
78 {
79 	if (*vpp)
80 		_TIFFfree(*vpp);
81 	*vpp = _TIFFmalloc(nmemb*sizeof(double));
82 	if (*vpp)
83 	{
84 		while (nmemb--)
85 			((double*)*vpp)[nmemb] = value;
86 	}
87 }
88 
89 /*
90  * Install extra samples information.
91  */
92 static int
setExtraSamples(TIFFDirectory * td,va_list ap,uint32 * v)93 setExtraSamples(TIFFDirectory* td, va_list ap, uint32* v)
94 {
95 /* XXX: Unassociated alpha data == 999 is a known Corel Draw bug, see below */
96 #define EXTRASAMPLE_COREL_UNASSALPHA 999
97 
98 	uint16* va;
99 	uint32 i;
100 
101 	*v = (uint16) va_arg(ap, uint16_vap);
102 	if ((uint16) *v > td->td_samplesperpixel)
103 		return 0;
104 	va = va_arg(ap, uint16*);
105 	if (*v > 0 && va == NULL)		/* typically missing param */
106 		return 0;
107 	for (i = 0; i < *v; i++) {
108 		if (va[i] > EXTRASAMPLE_UNASSALPHA) {
109 			/*
110 			 * XXX: Corel Draw is known to produce incorrect
111 			 * ExtraSamples tags which must be patched here if we
112 			 * want to be able to open some of the damaged TIFF
113 			 * files:
114 			 */
115 			if (va[i] == EXTRASAMPLE_COREL_UNASSALPHA)
116 				va[i] = EXTRASAMPLE_UNASSALPHA;
117 			else
118 				return 0;
119 		}
120 	}
121 	td->td_extrasamples = (uint16) *v;
122 	_TIFFsetShortArray(&td->td_sampleinfo, va, td->td_extrasamples);
123 	return 1;
124 
125 #undef EXTRASAMPLE_COREL_UNASSALPHA
126 }
127 
128 /*
129  * Confirm we have "samplesperpixel" ink names separated by \0.  Returns
130  * zero if the ink names are not as expected.
131  */
132 static uint32
checkInkNamesString(TIFF * tif,uint32 slen,const char * s)133 checkInkNamesString(TIFF* tif, uint32 slen, const char* s)
134 {
135 	TIFFDirectory* td = &tif->tif_dir;
136 	uint16 i = td->td_samplesperpixel;
137 
138 	if (slen > 0) {
139 		const char* ep = s+slen;
140 		const char* cp = s;
141 		for (; i > 0; i--) {
142 			for (; cp < ep && *cp != '\0'; cp++) {}
143 			if (cp >= ep)
144 				goto bad;
145 			cp++;				/* skip \0 */
146 		}
147 		return ((uint32)(cp-s));
148 	}
149 bad:
150 	TIFFErrorExt(tif->tif_clientdata, "TIFFSetField",
151 	    "%s: Invalid InkNames value; expecting %d names, found %d",
152 	    tif->tif_name,
153 	    td->td_samplesperpixel,
154 	    td->td_samplesperpixel-i);
155 	return (0);
156 }
157 
TIFFClampDoubleToFloat(double val)158 static float TIFFClampDoubleToFloat( double val )
159 {
160     if( val > FLT_MAX )
161         return FLT_MAX;
162     if( val < -FLT_MAX )
163         return -FLT_MAX;
164     return (float)val;
165 }
166 
167 static int
_TIFFVSetField(TIFF * tif,uint32 tag,va_list ap)168 _TIFFVSetField(TIFF* tif, uint32 tag, va_list ap)
169 {
170 	static const char module[] = "_TIFFVSetField";
171 
172 	TIFFDirectory* td = &tif->tif_dir;
173 	int status = 1;
174 	uint32 v32, i, v;
175     double dblval;
176 	char* s;
177 	const TIFFField *fip = TIFFFindField(tif, tag, TIFF_ANY);
178 	uint32 standard_tag = tag;
179 	if( fip == NULL ) /* cannot happen since OkToChangeTag() already checks it */
180 	    return 0;
181 	/*
182 	 * We want to force the custom code to be used for custom
183 	 * fields even if the tag happens to match a well known
184 	 * one - important for reinterpreted handling of standard
185 	 * tag values in custom directories (i.e. EXIF)
186 	 */
187 	if (fip->field_bit == FIELD_CUSTOM) {
188 		standard_tag = 0;
189 	}
190 
191 	switch (standard_tag) {
192 	case TIFFTAG_SUBFILETYPE:
193 		td->td_subfiletype = (uint32) va_arg(ap, uint32);
194 		break;
195 	case TIFFTAG_IMAGEWIDTH:
196 		td->td_imagewidth = (uint32) va_arg(ap, uint32);
197 		break;
198 	case TIFFTAG_IMAGELENGTH:
199 		td->td_imagelength = (uint32) va_arg(ap, uint32);
200 		break;
201 	case TIFFTAG_BITSPERSAMPLE:
202 		td->td_bitspersample = (uint16) va_arg(ap, uint16_vap);
203 		/*
204 		 * If the data require post-decoding processing to byte-swap
205 		 * samples, set it up here.  Note that since tags are required
206 		 * to be ordered, compression code can override this behaviour
207 		 * in the setup method if it wants to roll the post decoding
208 		 * work in with its normal work.
209 		 */
210 		if (tif->tif_flags & TIFF_SWAB) {
211 			if (td->td_bitspersample == 8)
212 				tif->tif_postdecode = _TIFFNoPostDecode;
213 			else if (td->td_bitspersample == 16)
214 				tif->tif_postdecode = _TIFFSwab16BitData;
215 			else if (td->td_bitspersample == 24)
216 				tif->tif_postdecode = _TIFFSwab24BitData;
217 			else if (td->td_bitspersample == 32)
218 				tif->tif_postdecode = _TIFFSwab32BitData;
219 			else if (td->td_bitspersample == 64)
220 				tif->tif_postdecode = _TIFFSwab64BitData;
221 			else if (td->td_bitspersample == 128) /* two 64's */
222 				tif->tif_postdecode = _TIFFSwab64BitData;
223 		}
224 		break;
225 	case TIFFTAG_COMPRESSION:
226 		v = (uint16) va_arg(ap, uint16_vap);
227 		/*
228 		 * If we're changing the compression scheme, the notify the
229 		 * previous module so that it can cleanup any state it's
230 		 * setup.
231 		 */
232 		if (TIFFFieldSet(tif, FIELD_COMPRESSION)) {
233 			if ((uint32)td->td_compression == v)
234 				break;
235 			(*tif->tif_cleanup)(tif);
236 			tif->tif_flags &= ~TIFF_CODERSETUP;
237 		}
238 		/*
239 		 * Setup new compression routine state.
240 		 */
241 		if( (status = TIFFSetCompressionScheme(tif, v)) != 0 )
242 		    td->td_compression = (uint16) v;
243 		else
244 		    status = 0;
245 		break;
246 	case TIFFTAG_PHOTOMETRIC:
247 		td->td_photometric = (uint16) va_arg(ap, uint16_vap);
248 		break;
249 	case TIFFTAG_THRESHHOLDING:
250 		td->td_threshholding = (uint16) va_arg(ap, uint16_vap);
251 		break;
252 	case TIFFTAG_FILLORDER:
253 		v = (uint16) va_arg(ap, uint16_vap);
254 		if (v != FILLORDER_LSB2MSB && v != FILLORDER_MSB2LSB)
255 			goto badvalue;
256 		td->td_fillorder = (uint16) v;
257 		break;
258 	case TIFFTAG_ORIENTATION:
259 		v = (uint16) va_arg(ap, uint16_vap);
260 		if (v < ORIENTATION_TOPLEFT || ORIENTATION_LEFTBOT < v)
261 			goto badvalue;
262 		else
263 			td->td_orientation = (uint16) v;
264 		break;
265 	case TIFFTAG_SAMPLESPERPIXEL:
266 		v = (uint16) va_arg(ap, uint16_vap);
267 		if (v == 0)
268 			goto badvalue;
269         if( v != td->td_samplesperpixel )
270         {
271             /* See http://bugzilla.maptools.org/show_bug.cgi?id=2500 */
272             if( td->td_sminsamplevalue != NULL )
273             {
274                 TIFFWarningExt(tif->tif_clientdata,module,
275                     "SamplesPerPixel tag value is changing, "
276                     "but SMinSampleValue tag was read with a different value. Cancelling it");
277                 TIFFClrFieldBit(tif,FIELD_SMINSAMPLEVALUE);
278                 _TIFFfree(td->td_sminsamplevalue);
279                 td->td_sminsamplevalue = NULL;
280             }
281             if( td->td_smaxsamplevalue != NULL )
282             {
283                 TIFFWarningExt(tif->tif_clientdata,module,
284                     "SamplesPerPixel tag value is changing, "
285                     "but SMaxSampleValue tag was read with a different value. Cancelling it");
286                 TIFFClrFieldBit(tif,FIELD_SMAXSAMPLEVALUE);
287                 _TIFFfree(td->td_smaxsamplevalue);
288                 td->td_smaxsamplevalue = NULL;
289             }
290         }
291 		td->td_samplesperpixel = (uint16) v;
292 		break;
293 	case TIFFTAG_ROWSPERSTRIP:
294 		v32 = (uint32) va_arg(ap, uint32);
295 		if (v32 == 0)
296 			goto badvalue32;
297 		td->td_rowsperstrip = v32;
298 		if (!TIFFFieldSet(tif, FIELD_TILEDIMENSIONS)) {
299 			td->td_tilelength = v32;
300 			td->td_tilewidth = td->td_imagewidth;
301 		}
302 		break;
303 	case TIFFTAG_MINSAMPLEVALUE:
304 		td->td_minsamplevalue = (uint16) va_arg(ap, uint16_vap);
305 		break;
306 	case TIFFTAG_MAXSAMPLEVALUE:
307 		td->td_maxsamplevalue = (uint16) va_arg(ap, uint16_vap);
308 		break;
309 	case TIFFTAG_SMINSAMPLEVALUE:
310 		if (tif->tif_flags & TIFF_PERSAMPLE)
311 			_TIFFsetDoubleArray(&td->td_sminsamplevalue, va_arg(ap, double*), td->td_samplesperpixel);
312 		else
313 			setDoubleArrayOneValue(&td->td_sminsamplevalue, va_arg(ap, double), td->td_samplesperpixel);
314 		break;
315 	case TIFFTAG_SMAXSAMPLEVALUE:
316 		if (tif->tif_flags & TIFF_PERSAMPLE)
317 			_TIFFsetDoubleArray(&td->td_smaxsamplevalue, va_arg(ap, double*), td->td_samplesperpixel);
318 		else
319 			setDoubleArrayOneValue(&td->td_smaxsamplevalue, va_arg(ap, double), td->td_samplesperpixel);
320 		break;
321 	case TIFFTAG_XRESOLUTION:
322         dblval = va_arg(ap, double);
323         if( dblval < 0 )
324             goto badvaluedouble;
325 		td->td_xresolution = TIFFClampDoubleToFloat( dblval );
326 		break;
327 	case TIFFTAG_YRESOLUTION:
328         dblval = va_arg(ap, double);
329         if( dblval < 0 )
330             goto badvaluedouble;
331 		td->td_yresolution = TIFFClampDoubleToFloat( dblval );
332 		break;
333 	case TIFFTAG_PLANARCONFIG:
334 		v = (uint16) va_arg(ap, uint16_vap);
335 		if (v != PLANARCONFIG_CONTIG && v != PLANARCONFIG_SEPARATE)
336 			goto badvalue;
337 		td->td_planarconfig = (uint16) v;
338 		break;
339 	case TIFFTAG_XPOSITION:
340 		td->td_xposition = TIFFClampDoubleToFloat( va_arg(ap, double) );
341 		break;
342 	case TIFFTAG_YPOSITION:
343 		td->td_yposition = TIFFClampDoubleToFloat( va_arg(ap, double) );
344 		break;
345 	case TIFFTAG_RESOLUTIONUNIT:
346 		v = (uint16) va_arg(ap, uint16_vap);
347 		if (v < RESUNIT_NONE || RESUNIT_CENTIMETER < v)
348 			goto badvalue;
349 		td->td_resolutionunit = (uint16) v;
350 		break;
351 	case TIFFTAG_PAGENUMBER:
352 		td->td_pagenumber[0] = (uint16) va_arg(ap, uint16_vap);
353 		td->td_pagenumber[1] = (uint16) va_arg(ap, uint16_vap);
354 		break;
355 	case TIFFTAG_HALFTONEHINTS:
356 		td->td_halftonehints[0] = (uint16) va_arg(ap, uint16_vap);
357 		td->td_halftonehints[1] = (uint16) va_arg(ap, uint16_vap);
358 		break;
359 	case TIFFTAG_COLORMAP:
360 		v32 = (uint32)(1L<<td->td_bitspersample);
361 		_TIFFsetShortArray(&td->td_colormap[0], va_arg(ap, uint16*), v32);
362 		_TIFFsetShortArray(&td->td_colormap[1], va_arg(ap, uint16*), v32);
363 		_TIFFsetShortArray(&td->td_colormap[2], va_arg(ap, uint16*), v32);
364 		break;
365 	case TIFFTAG_EXTRASAMPLES:
366 		if (!setExtraSamples(td, ap, &v))
367 			goto badvalue;
368 		break;
369 	case TIFFTAG_MATTEING:
370 		td->td_extrasamples =  (((uint16) va_arg(ap, uint16_vap)) != 0);
371 		if (td->td_extrasamples) {
372 			uint16 sv = EXTRASAMPLE_ASSOCALPHA;
373 			_TIFFsetShortArray(&td->td_sampleinfo, &sv, 1);
374 		}
375 		break;
376 	case TIFFTAG_TILEWIDTH:
377 		v32 = (uint32) va_arg(ap, uint32);
378 		if (v32 % 16) {
379 			if (tif->tif_mode != O_RDONLY)
380 				goto badvalue32;
381 			TIFFWarningExt(tif->tif_clientdata, tif->tif_name,
382 				"Nonstandard tile width %d, convert file", v32);
383 		}
384 		td->td_tilewidth = v32;
385 		tif->tif_flags |= TIFF_ISTILED;
386 		break;
387 	case TIFFTAG_TILELENGTH:
388 		v32 = (uint32) va_arg(ap, uint32);
389 		if (v32 % 16) {
390 			if (tif->tif_mode != O_RDONLY)
391 				goto badvalue32;
392 			TIFFWarningExt(tif->tif_clientdata, tif->tif_name,
393 			    "Nonstandard tile length %d, convert file", v32);
394 		}
395 		td->td_tilelength = v32;
396 		tif->tif_flags |= TIFF_ISTILED;
397 		break;
398 	case TIFFTAG_TILEDEPTH:
399 		v32 = (uint32) va_arg(ap, uint32);
400 		if (v32 == 0)
401 			goto badvalue32;
402 		td->td_tiledepth = v32;
403 		break;
404 	case TIFFTAG_DATATYPE:
405 		v = (uint16) va_arg(ap, uint16_vap);
406 		switch (v) {
407 		case DATATYPE_VOID:	v = SAMPLEFORMAT_VOID;	break;
408 		case DATATYPE_INT:	v = SAMPLEFORMAT_INT;	break;
409 		case DATATYPE_UINT:	v = SAMPLEFORMAT_UINT;	break;
410 		case DATATYPE_IEEEFP:	v = SAMPLEFORMAT_IEEEFP;break;
411 		default:		goto badvalue;
412 		}
413 		td->td_sampleformat = (uint16) v;
414 		break;
415 	case TIFFTAG_SAMPLEFORMAT:
416 		v = (uint16) va_arg(ap, uint16_vap);
417 		if (v < SAMPLEFORMAT_UINT || SAMPLEFORMAT_COMPLEXIEEEFP < v)
418 			goto badvalue;
419 		td->td_sampleformat = (uint16) v;
420 
421 		/*  Try to fix up the SWAB function for complex data. */
422 		if( td->td_sampleformat == SAMPLEFORMAT_COMPLEXINT
423 		    && td->td_bitspersample == 32
424 		    && tif->tif_postdecode == _TIFFSwab32BitData )
425 		    tif->tif_postdecode = _TIFFSwab16BitData;
426 		else if( (td->td_sampleformat == SAMPLEFORMAT_COMPLEXINT
427 			  || td->td_sampleformat == SAMPLEFORMAT_COMPLEXIEEEFP)
428 			 && td->td_bitspersample == 64
429 			 && tif->tif_postdecode == _TIFFSwab64BitData )
430 		    tif->tif_postdecode = _TIFFSwab32BitData;
431 		break;
432 	case TIFFTAG_IMAGEDEPTH:
433 		td->td_imagedepth = (uint32) va_arg(ap, uint32);
434 		break;
435 	case TIFFTAG_SUBIFD:
436 		if ((tif->tif_flags & TIFF_INSUBIFD) == 0) {
437 			td->td_nsubifd = (uint16) va_arg(ap, uint16_vap);
438 			_TIFFsetLong8Array(&td->td_subifd, (uint64*) va_arg(ap, uint64*),
439 			    (uint32) td->td_nsubifd);
440 		} else {
441 			TIFFErrorExt(tif->tif_clientdata, module,
442 				     "%s: Sorry, cannot nest SubIFDs",
443 				     tif->tif_name);
444 			status = 0;
445 		}
446 		break;
447 	case TIFFTAG_YCBCRPOSITIONING:
448 		td->td_ycbcrpositioning = (uint16) va_arg(ap, uint16_vap);
449 		break;
450 	case TIFFTAG_YCBCRSUBSAMPLING:
451 		td->td_ycbcrsubsampling[0] = (uint16) va_arg(ap, uint16_vap);
452 		td->td_ycbcrsubsampling[1] = (uint16) va_arg(ap, uint16_vap);
453 		break;
454 	case TIFFTAG_TRANSFERFUNCTION:
455 		v = (td->td_samplesperpixel - td->td_extrasamples) > 1 ? 3 : 1;
456 		for (i = 0; i < v; i++)
457 			_TIFFsetShortArray(&td->td_transferfunction[i],
458 			    va_arg(ap, uint16*), 1U<<td->td_bitspersample);
459 		break;
460 	case TIFFTAG_REFERENCEBLACKWHITE:
461 		/* XXX should check for null range */
462 		_TIFFsetFloatArray(&td->td_refblackwhite, va_arg(ap, float*), 6);
463 		break;
464 	case TIFFTAG_INKNAMES:
465 		v = (uint16) va_arg(ap, uint16_vap);
466 		s = va_arg(ap, char*);
467 		v = checkInkNamesString(tif, v, s);
468 		status = v > 0;
469 		if( v > 0 ) {
470 			_TIFFsetNString(&td->td_inknames, s, v);
471 			td->td_inknameslen = v;
472 		}
473 		break;
474 	case TIFFTAG_PERSAMPLE:
475 		v = (uint16) va_arg(ap, uint16_vap);
476 		if( v == PERSAMPLE_MULTI )
477 			tif->tif_flags |= TIFF_PERSAMPLE;
478 		else
479 			tif->tif_flags &= ~TIFF_PERSAMPLE;
480 		break;
481 	default: {
482 		TIFFTagValue *tv;
483 		int tv_size, iCustom;
484 
485 		/*
486 		 * This can happen if multiple images are open with different
487 		 * codecs which have private tags.  The global tag information
488 		 * table may then have tags that are valid for one file but not
489 		 * the other. If the client tries to set a tag that is not valid
490 		 * for the image's codec then we'll arrive here.  This
491 		 * happens, for example, when tiffcp is used to convert between
492 		 * compression schemes and codec-specific tags are blindly copied.
493 		 */
494 		if(fip->field_bit != FIELD_CUSTOM) {
495 			TIFFErrorExt(tif->tif_clientdata, module,
496 			    "%s: Invalid %stag \"%s\" (not supported by codec)",
497 			    tif->tif_name, isPseudoTag(tag) ? "pseudo-" : "",
498 			    fip->field_name);
499 			status = 0;
500 			break;
501 		}
502 
503 		/*
504 		 * Find the existing entry for this custom value.
505 		 */
506 		tv = NULL;
507 		for (iCustom = 0; iCustom < td->td_customValueCount; iCustom++) {
508 			if (td->td_customValues[iCustom].info->field_tag == tag) {
509 				tv = td->td_customValues + iCustom;
510 				if (tv->value != NULL) {
511 					_TIFFfree(tv->value);
512 					tv->value = NULL;
513 				}
514 				break;
515 			}
516 		}
517 
518 		/*
519 		 * Grow the custom list if the entry was not found.
520 		 */
521 		if(tv == NULL) {
522 			TIFFTagValue *new_customValues;
523 
524 			td->td_customValueCount++;
525 			new_customValues = (TIFFTagValue *)
526 			    _TIFFrealloc(td->td_customValues,
527 			    sizeof(TIFFTagValue) * td->td_customValueCount);
528 			if (!new_customValues) {
529 				TIFFErrorExt(tif->tif_clientdata, module,
530 				    "%s: Failed to allocate space for list of custom values",
531 				    tif->tif_name);
532 				status = 0;
533 				goto end;
534 			}
535 
536 			td->td_customValues = new_customValues;
537 
538 			tv = td->td_customValues + (td->td_customValueCount - 1);
539 			tv->info = fip;
540 			tv->value = NULL;
541 			tv->count = 0;
542 		}
543 
544 		/*
545 		 * Set custom value ... save a copy of the custom tag value.
546 		 */
547 		tv_size = _TIFFDataSize(fip->field_type);
548 		if (tv_size == 0) {
549 			status = 0;
550 			TIFFErrorExt(tif->tif_clientdata, module,
551 			    "%s: Bad field type %d for \"%s\"",
552 			    tif->tif_name, fip->field_type,
553 			    fip->field_name);
554 			goto end;
555 		}
556 
557 		if (fip->field_type == TIFF_ASCII)
558 		{
559 			uint32 ma;
560 			char* mb;
561 			if (fip->field_passcount)
562 			{
563 				assert(fip->field_writecount==TIFF_VARIABLE2);
564 				ma=(uint32)va_arg(ap,uint32);
565 				mb=(char*)va_arg(ap,char*);
566 			}
567 			else
568 			{
569 				mb=(char*)va_arg(ap,char*);
570 				ma=(uint32)(strlen(mb)+1);
571 			}
572 			tv->count=ma;
573 			setByteArray(&tv->value,mb,ma,1);
574 		}
575 		else
576 		{
577 			if (fip->field_passcount) {
578 				if (fip->field_writecount == TIFF_VARIABLE2)
579 					tv->count = (uint32) va_arg(ap, uint32);
580 				else
581 					tv->count = (int) va_arg(ap, int);
582 			} else if (fip->field_writecount == TIFF_VARIABLE
583 			   || fip->field_writecount == TIFF_VARIABLE2)
584 				tv->count = 1;
585 			else if (fip->field_writecount == TIFF_SPP)
586 				tv->count = td->td_samplesperpixel;
587 			else
588 				tv->count = fip->field_writecount;
589 
590 			if (tv->count == 0) {
591 				status = 0;
592 				TIFFErrorExt(tif->tif_clientdata, module,
593 					     "%s: Null count for \"%s\" (type "
594 					     "%d, writecount %d, passcount %d)",
595 					     tif->tif_name,
596 					     fip->field_name,
597 					     fip->field_type,
598 					     fip->field_writecount,
599 					     fip->field_passcount);
600 				goto end;
601 			}
602 
603 			tv->value = _TIFFCheckMalloc(tif, tv->count, tv_size,
604 			    "custom tag binary object");
605 			if (!tv->value) {
606 				status = 0;
607 				goto end;
608 			}
609 
610 			if (fip->field_tag == TIFFTAG_DOTRANGE
611 			    && strcmp(fip->field_name,"DotRange") == 0) {
612 				/* TODO: This is an evil exception and should not have been
613 				   handled this way ... likely best if we move it into
614 				   the directory structure with an explicit field in
615 				   libtiff 4.1 and assign it a FIELD_ value */
616 				uint16 v2[2];
617 				v2[0] = (uint16)va_arg(ap, int);
618 				v2[1] = (uint16)va_arg(ap, int);
619 				_TIFFmemcpy(tv->value, &v2, 4);
620 			}
621 
622 			else if (fip->field_passcount
623 				  || fip->field_writecount == TIFF_VARIABLE
624 				  || fip->field_writecount == TIFF_VARIABLE2
625 				  || fip->field_writecount == TIFF_SPP
626 				  || tv->count > 1) {
627 				_TIFFmemcpy(tv->value, va_arg(ap, void *),
628 				    tv->count * tv_size);
629 			} else {
630 				char *val = (char *)tv->value;
631 				assert( tv->count == 1 );
632 
633 				switch (fip->field_type) {
634 				case TIFF_BYTE:
635 				case TIFF_UNDEFINED:
636 					{
637 						uint8 v2 = (uint8)va_arg(ap, int);
638 						_TIFFmemcpy(val, &v2, tv_size);
639 					}
640 					break;
641 				case TIFF_SBYTE:
642 					{
643 						int8 v2 = (int8)va_arg(ap, int);
644 						_TIFFmemcpy(val, &v2, tv_size);
645 					}
646 					break;
647 				case TIFF_SHORT:
648 					{
649 						uint16 v2 = (uint16)va_arg(ap, int);
650 						_TIFFmemcpy(val, &v2, tv_size);
651 					}
652 					break;
653 				case TIFF_SSHORT:
654 					{
655 						int16 v2 = (int16)va_arg(ap, int);
656 						_TIFFmemcpy(val, &v2, tv_size);
657 					}
658 					break;
659 				case TIFF_LONG:
660 				case TIFF_IFD:
661 					{
662 						uint32 v2 = va_arg(ap, uint32);
663 						_TIFFmemcpy(val, &v2, tv_size);
664 					}
665 					break;
666 				case TIFF_SLONG:
667 					{
668 						int32 v2 = va_arg(ap, int32);
669 						_TIFFmemcpy(val, &v2, tv_size);
670 					}
671 					break;
672 				case TIFF_LONG8:
673 				case TIFF_IFD8:
674 					{
675 						uint64 v2 = va_arg(ap, uint64);
676 						_TIFFmemcpy(val, &v2, tv_size);
677 					}
678 					break;
679 				case TIFF_SLONG8:
680 					{
681 						int64 v2 = va_arg(ap, int64);
682 						_TIFFmemcpy(val, &v2, tv_size);
683 					}
684 					break;
685 				case TIFF_RATIONAL:
686 				case TIFF_SRATIONAL:
687 				case TIFF_FLOAT:
688 					{
689 						float v2 = TIFFClampDoubleToFloat(va_arg(ap, double));
690 						_TIFFmemcpy(val, &v2, tv_size);
691 					}
692 					break;
693 				case TIFF_DOUBLE:
694 					{
695 						double v2 = va_arg(ap, double);
696 						_TIFFmemcpy(val, &v2, tv_size);
697 					}
698 					break;
699 				default:
700 					_TIFFmemset(val, 0, tv_size);
701 					status = 0;
702 					break;
703 				}
704 			}
705 		}
706 	}
707 	}
708 	if (status) {
709 		const TIFFField* fip2=TIFFFieldWithTag(tif,tag);
710 		if (fip2)
711 			TIFFSetFieldBit(tif, fip2->field_bit);
712 		tif->tif_flags |= TIFF_DIRTYDIRECT;
713 	}
714 
715 end:
716 	va_end(ap);
717 	return (status);
718 badvalue:
719         {
720 		const TIFFField* fip2=TIFFFieldWithTag(tif,tag);
721 		TIFFErrorExt(tif->tif_clientdata, module,
722 		     "%s: Bad value %u for \"%s\" tag",
723 		     tif->tif_name, v,
724 		     fip2 ? fip2->field_name : "Unknown");
725 		va_end(ap);
726         }
727 	return (0);
728 badvalue32:
729         {
730 		const TIFFField* fip2=TIFFFieldWithTag(tif,tag);
731 		TIFFErrorExt(tif->tif_clientdata, module,
732 		     "%s: Bad value %u for \"%s\" tag",
733 		     tif->tif_name, v32,
734 		     fip2 ? fip2->field_name : "Unknown");
735 		va_end(ap);
736         }
737 	return (0);
738 badvaluedouble:
739         {
740         const TIFFField* fip2=TIFFFieldWithTag(tif,tag);
741         TIFFErrorExt(tif->tif_clientdata, module,
742              "%s: Bad value %f for \"%s\" tag",
743              tif->tif_name, dblval,
744              fip2 ? fip2->field_name : "Unknown");
745         va_end(ap);
746         }
747     return (0);
748 }
749 
750 /*
751  * Return 1/0 according to whether or not
752  * it is permissible to set the tag's value.
753  * Note that we allow ImageLength to be changed
754  * so that we can append and extend to images.
755  * Any other tag may not be altered once writing
756  * has commenced, unless its value has no effect
757  * on the format of the data that is written.
758  */
759 static int
OkToChangeTag(TIFF * tif,uint32 tag)760 OkToChangeTag(TIFF* tif, uint32 tag)
761 {
762 	const TIFFField* fip = TIFFFindField(tif, tag, TIFF_ANY);
763 	if (!fip) {			/* unknown tag */
764 		TIFFErrorExt(tif->tif_clientdata, "TIFFSetField", "%s: Unknown %stag %u",
765 		    tif->tif_name, isPseudoTag(tag) ? "pseudo-" : "", tag);
766 		return (0);
767 	}
768 	if (tag != TIFFTAG_IMAGELENGTH && (tif->tif_flags & TIFF_BEENWRITING) &&
769 	    !fip->field_oktochange) {
770 		/*
771 		 * Consult info table to see if tag can be changed
772 		 * after we've started writing.  We only allow changes
773 		 * to those tags that don't/shouldn't affect the
774 		 * compression and/or format of the data.
775 		 */
776 		TIFFErrorExt(tif->tif_clientdata, "TIFFSetField",
777 		    "%s: Cannot modify tag \"%s\" while writing",
778 		    tif->tif_name, fip->field_name);
779 		return (0);
780 	}
781 	return (1);
782 }
783 
784 /*
785  * Record the value of a field in the
786  * internal directory structure.  The
787  * field will be written to the file
788  * when/if the directory structure is
789  * updated.
790  */
791 int
TIFFSetField(TIFF * tif,uint32 tag,...)792 TIFFSetField(TIFF* tif, uint32 tag, ...)
793 {
794 	va_list ap;
795 	int status;
796 
797 	va_start(ap, tag);
798 	status = TIFFVSetField(tif, tag, ap);
799 	va_end(ap);
800 	return (status);
801 }
802 
803 /*
804  * Clear the contents of the field in the internal structure.
805  */
806 int
TIFFUnsetField(TIFF * tif,uint32 tag)807 TIFFUnsetField(TIFF* tif, uint32 tag)
808 {
809     const TIFFField *fip =  TIFFFieldWithTag(tif, tag);
810     TIFFDirectory* td = &tif->tif_dir;
811 
812     if( !fip )
813         return 0;
814 
815     if( fip->field_bit != FIELD_CUSTOM )
816         TIFFClrFieldBit(tif, fip->field_bit);
817     else
818     {
819         TIFFTagValue *tv = NULL;
820         int i;
821 
822         for (i = 0; i < td->td_customValueCount; i++) {
823 
824             tv = td->td_customValues + i;
825             if( tv->info->field_tag == tag )
826                 break;
827         }
828 
829         if( i < td->td_customValueCount )
830         {
831             _TIFFfree(tv->value);
832             for( ; i < td->td_customValueCount-1; i++) {
833                 td->td_customValues[i] = td->td_customValues[i+1];
834             }
835             td->td_customValueCount--;
836         }
837     }
838 
839     tif->tif_flags |= TIFF_DIRTYDIRECT;
840 
841     return (1);
842 }
843 
844 /*
845  * Like TIFFSetField, but taking a varargs
846  * parameter list.  This routine is useful
847  * for building higher-level interfaces on
848  * top of the library.
849  */
850 int
TIFFVSetField(TIFF * tif,uint32 tag,va_list ap)851 TIFFVSetField(TIFF* tif, uint32 tag, va_list ap)
852 {
853 	return OkToChangeTag(tif, tag) ?
854 	    (*tif->tif_tagmethods.vsetfield)(tif, tag, ap) : 0;
855 }
856 
857 static int
_TIFFVGetField(TIFF * tif,uint32 tag,va_list ap)858 _TIFFVGetField(TIFF* tif, uint32 tag, va_list ap)
859 {
860 	TIFFDirectory* td = &tif->tif_dir;
861 	int ret_val = 1;
862 	uint32 standard_tag = tag;
863 	const TIFFField* fip = TIFFFindField(tif, tag, TIFF_ANY);
864 	if( fip == NULL ) /* cannot happen since TIFFGetField() already checks it */
865 	    return 0;
866 
867         if( tag == TIFFTAG_NUMBEROFINKS )
868         {
869             int i;
870             for (i = 0; i < td->td_customValueCount; i++) {
871                 uint16 val;
872                 TIFFTagValue *tv = td->td_customValues + i;
873                 if (tv->info->field_tag != tag)
874                     continue;
875                 if( tv->value == NULL )
876                     return 0;
877                 val = *(uint16 *)tv->value;
878                 /* Truncate to SamplesPerPixel, since the */
879                 /* setting code for INKNAMES assume that there are SamplesPerPixel */
880                 /* inknames. */
881                 /* Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2599 */
882                 if( val > td->td_samplesperpixel )
883                 {
884                     TIFFWarningExt(tif->tif_clientdata,"_TIFFVGetField",
885                                    "Truncating NumberOfInks from %u to %u",
886                                    val, td->td_samplesperpixel);
887                     val = td->td_samplesperpixel;
888                 }
889                 *va_arg(ap, uint16*) = val;
890                 return 1;
891             }
892             return 0;
893         }
894 
895 	/*
896 	 * We want to force the custom code to be used for custom
897 	 * fields even if the tag happens to match a well known
898 	 * one - important for reinterpreted handling of standard
899 	 * tag values in custom directories (i.e. EXIF)
900 	 */
901 	if (fip->field_bit == FIELD_CUSTOM) {
902 		standard_tag = 0;
903 	}
904 
905 	switch (standard_tag) {
906 		case TIFFTAG_SUBFILETYPE:
907 			*va_arg(ap, uint32*) = td->td_subfiletype;
908 			break;
909 		case TIFFTAG_IMAGEWIDTH:
910 			*va_arg(ap, uint32*) = td->td_imagewidth;
911 			break;
912 		case TIFFTAG_IMAGELENGTH:
913 			*va_arg(ap, uint32*) = td->td_imagelength;
914 			break;
915 		case TIFFTAG_BITSPERSAMPLE:
916 			*va_arg(ap, uint16*) = td->td_bitspersample;
917 			break;
918 		case TIFFTAG_COMPRESSION:
919 			*va_arg(ap, uint16*) = td->td_compression;
920 			break;
921 		case TIFFTAG_PHOTOMETRIC:
922 			*va_arg(ap, uint16*) = td->td_photometric;
923 			break;
924 		case TIFFTAG_THRESHHOLDING:
925 			*va_arg(ap, uint16*) = td->td_threshholding;
926 			break;
927 		case TIFFTAG_FILLORDER:
928 			*va_arg(ap, uint16*) = td->td_fillorder;
929 			break;
930 		case TIFFTAG_ORIENTATION:
931 			*va_arg(ap, uint16*) = td->td_orientation;
932 			break;
933 		case TIFFTAG_SAMPLESPERPIXEL:
934 			*va_arg(ap, uint16*) = td->td_samplesperpixel;
935 			break;
936 		case TIFFTAG_ROWSPERSTRIP:
937 			*va_arg(ap, uint32*) = td->td_rowsperstrip;
938 			break;
939 		case TIFFTAG_MINSAMPLEVALUE:
940 			*va_arg(ap, uint16*) = td->td_minsamplevalue;
941 			break;
942 		case TIFFTAG_MAXSAMPLEVALUE:
943 			*va_arg(ap, uint16*) = td->td_maxsamplevalue;
944 			break;
945 		case TIFFTAG_SMINSAMPLEVALUE:
946 			if (tif->tif_flags & TIFF_PERSAMPLE)
947 				*va_arg(ap, double**) = td->td_sminsamplevalue;
948 			else
949 			{
950 				/* libtiff historically treats this as a single value. */
951 				uint16 i;
952 				double v = td->td_sminsamplevalue[0];
953 				for (i=1; i < td->td_samplesperpixel; ++i)
954 					if( td->td_sminsamplevalue[i] < v )
955 						v = td->td_sminsamplevalue[i];
956 				*va_arg(ap, double*) = v;
957 			}
958 			break;
959 		case TIFFTAG_SMAXSAMPLEVALUE:
960 			if (tif->tif_flags & TIFF_PERSAMPLE)
961 				*va_arg(ap, double**) = td->td_smaxsamplevalue;
962 			else
963 			{
964 				/* libtiff historically treats this as a single value. */
965 				uint16 i;
966 				double v = td->td_smaxsamplevalue[0];
967 				for (i=1; i < td->td_samplesperpixel; ++i)
968 					if( td->td_smaxsamplevalue[i] > v )
969 						v = td->td_smaxsamplevalue[i];
970 				*va_arg(ap, double*) = v;
971 			}
972 			break;
973 		case TIFFTAG_XRESOLUTION:
974 			*va_arg(ap, float*) = td->td_xresolution;
975 			break;
976 		case TIFFTAG_YRESOLUTION:
977 			*va_arg(ap, float*) = td->td_yresolution;
978 			break;
979 		case TIFFTAG_PLANARCONFIG:
980 			*va_arg(ap, uint16*) = td->td_planarconfig;
981 			break;
982 		case TIFFTAG_XPOSITION:
983 			*va_arg(ap, float*) = td->td_xposition;
984 			break;
985 		case TIFFTAG_YPOSITION:
986 			*va_arg(ap, float*) = td->td_yposition;
987 			break;
988 		case TIFFTAG_RESOLUTIONUNIT:
989 			*va_arg(ap, uint16*) = td->td_resolutionunit;
990 			break;
991 		case TIFFTAG_PAGENUMBER:
992 			*va_arg(ap, uint16*) = td->td_pagenumber[0];
993 			*va_arg(ap, uint16*) = td->td_pagenumber[1];
994 			break;
995 		case TIFFTAG_HALFTONEHINTS:
996 			*va_arg(ap, uint16*) = td->td_halftonehints[0];
997 			*va_arg(ap, uint16*) = td->td_halftonehints[1];
998 			break;
999 		case TIFFTAG_COLORMAP:
1000 			*va_arg(ap, uint16**) = td->td_colormap[0];
1001 			*va_arg(ap, uint16**) = td->td_colormap[1];
1002 			*va_arg(ap, uint16**) = td->td_colormap[2];
1003 			break;
1004 		case TIFFTAG_STRIPOFFSETS:
1005 		case TIFFTAG_TILEOFFSETS:
1006 			_TIFFFillStriles( tif );
1007 			*va_arg(ap, uint64**) = td->td_stripoffset;
1008 			break;
1009 		case TIFFTAG_STRIPBYTECOUNTS:
1010 		case TIFFTAG_TILEBYTECOUNTS:
1011 			_TIFFFillStriles( tif );
1012 			*va_arg(ap, uint64**) = td->td_stripbytecount;
1013 			break;
1014 		case TIFFTAG_MATTEING:
1015 			*va_arg(ap, uint16*) =
1016 			    (td->td_extrasamples == 1 &&
1017 			    td->td_sampleinfo[0] == EXTRASAMPLE_ASSOCALPHA);
1018 			break;
1019 		case TIFFTAG_EXTRASAMPLES:
1020 			*va_arg(ap, uint16*) = td->td_extrasamples;
1021 			*va_arg(ap, uint16**) = td->td_sampleinfo;
1022 			break;
1023 		case TIFFTAG_TILEWIDTH:
1024 			*va_arg(ap, uint32*) = td->td_tilewidth;
1025 			break;
1026 		case TIFFTAG_TILELENGTH:
1027 			*va_arg(ap, uint32*) = td->td_tilelength;
1028 			break;
1029 		case TIFFTAG_TILEDEPTH:
1030 			*va_arg(ap, uint32*) = td->td_tiledepth;
1031 			break;
1032 		case TIFFTAG_DATATYPE:
1033 			switch (td->td_sampleformat) {
1034 				case SAMPLEFORMAT_UINT:
1035 					*va_arg(ap, uint16*) = DATATYPE_UINT;
1036 					break;
1037 				case SAMPLEFORMAT_INT:
1038 					*va_arg(ap, uint16*) = DATATYPE_INT;
1039 					break;
1040 				case SAMPLEFORMAT_IEEEFP:
1041 					*va_arg(ap, uint16*) = DATATYPE_IEEEFP;
1042 					break;
1043 				case SAMPLEFORMAT_VOID:
1044 					*va_arg(ap, uint16*) = DATATYPE_VOID;
1045 					break;
1046 			}
1047 			break;
1048 		case TIFFTAG_SAMPLEFORMAT:
1049 			*va_arg(ap, uint16*) = td->td_sampleformat;
1050 			break;
1051 		case TIFFTAG_IMAGEDEPTH:
1052 			*va_arg(ap, uint32*) = td->td_imagedepth;
1053 			break;
1054 		case TIFFTAG_SUBIFD:
1055 			*va_arg(ap, uint16*) = td->td_nsubifd;
1056 			*va_arg(ap, uint64**) = td->td_subifd;
1057 			break;
1058 		case TIFFTAG_YCBCRPOSITIONING:
1059 			*va_arg(ap, uint16*) = td->td_ycbcrpositioning;
1060 			break;
1061 		case TIFFTAG_YCBCRSUBSAMPLING:
1062 			*va_arg(ap, uint16*) = td->td_ycbcrsubsampling[0];
1063 			*va_arg(ap, uint16*) = td->td_ycbcrsubsampling[1];
1064 			break;
1065 		case TIFFTAG_TRANSFERFUNCTION:
1066 			*va_arg(ap, uint16**) = td->td_transferfunction[0];
1067 			if (td->td_samplesperpixel - td->td_extrasamples > 1) {
1068 				*va_arg(ap, uint16**) = td->td_transferfunction[1];
1069 				*va_arg(ap, uint16**) = td->td_transferfunction[2];
1070 			}
1071 			break;
1072 		case TIFFTAG_REFERENCEBLACKWHITE:
1073 			*va_arg(ap, float**) = td->td_refblackwhite;
1074 			break;
1075 		case TIFFTAG_INKNAMES:
1076 			*va_arg(ap, char**) = td->td_inknames;
1077 			break;
1078 		default:
1079 			{
1080 				int i;
1081 
1082 				/*
1083 				 * This can happen if multiple images are open
1084 				 * with different codecs which have private
1085 				 * tags.  The global tag information table may
1086 				 * then have tags that are valid for one file
1087 				 * but not the other. If the client tries to
1088 				 * get a tag that is not valid for the image's
1089 				 * codec then we'll arrive here.
1090 				 */
1091 				if( fip->field_bit != FIELD_CUSTOM )
1092 				{
1093 					TIFFErrorExt(tif->tif_clientdata, "_TIFFVGetField",
1094 					    "%s: Invalid %stag \"%s\" "
1095 					    "(not supported by codec)",
1096 					    tif->tif_name,
1097 					    isPseudoTag(tag) ? "pseudo-" : "",
1098 					    fip->field_name);
1099 					ret_val = 0;
1100 					break;
1101 				}
1102 
1103 				/*
1104 				 * Do we have a custom value?
1105 				 */
1106 				ret_val = 0;
1107 				for (i = 0; i < td->td_customValueCount; i++) {
1108 					TIFFTagValue *tv = td->td_customValues + i;
1109 
1110 					if (tv->info->field_tag != tag)
1111 						continue;
1112 
1113 					if (fip->field_passcount) {
1114 						if (fip->field_readcount == TIFF_VARIABLE2)
1115 							*va_arg(ap, uint32*) = (uint32)tv->count;
1116 						else  /* Assume TIFF_VARIABLE */
1117 							*va_arg(ap, uint16*) = (uint16)tv->count;
1118 						*va_arg(ap, void **) = tv->value;
1119 						ret_val = 1;
1120 					} else if (fip->field_tag == TIFFTAG_DOTRANGE
1121 						   && strcmp(fip->field_name,"DotRange") == 0) {
1122 						/* TODO: This is an evil exception and should not have been
1123 						   handled this way ... likely best if we move it into
1124 						   the directory structure with an explicit field in
1125 						   libtiff 4.1 and assign it a FIELD_ value */
1126 						*va_arg(ap, uint16*) = ((uint16 *)tv->value)[0];
1127 						*va_arg(ap, uint16*) = ((uint16 *)tv->value)[1];
1128 						ret_val = 1;
1129 					} else {
1130 						if (fip->field_type == TIFF_ASCII
1131 						    || fip->field_readcount == TIFF_VARIABLE
1132 						    || fip->field_readcount == TIFF_VARIABLE2
1133 						    || fip->field_readcount == TIFF_SPP
1134 						    || tv->count > 1) {
1135 							*va_arg(ap, void **) = tv->value;
1136 							ret_val = 1;
1137 						} else {
1138 							char *val = (char *)tv->value;
1139 							assert( tv->count == 1 );
1140 							switch (fip->field_type) {
1141 							case TIFF_BYTE:
1142 							case TIFF_UNDEFINED:
1143 								*va_arg(ap, uint8*) =
1144 									*(uint8 *)val;
1145 								ret_val = 1;
1146 								break;
1147 							case TIFF_SBYTE:
1148 								*va_arg(ap, int8*) =
1149 									*(int8 *)val;
1150 								ret_val = 1;
1151 								break;
1152 							case TIFF_SHORT:
1153 								*va_arg(ap, uint16*) =
1154 									*(uint16 *)val;
1155 								ret_val = 1;
1156 								break;
1157 							case TIFF_SSHORT:
1158 								*va_arg(ap, int16*) =
1159 									*(int16 *)val;
1160 								ret_val = 1;
1161 								break;
1162 							case TIFF_LONG:
1163 							case TIFF_IFD:
1164 								*va_arg(ap, uint32*) =
1165 									*(uint32 *)val;
1166 								ret_val = 1;
1167 								break;
1168 							case TIFF_SLONG:
1169 								*va_arg(ap, int32*) =
1170 									*(int32 *)val;
1171 								ret_val = 1;
1172 								break;
1173 							case TIFF_LONG8:
1174 							case TIFF_IFD8:
1175 								*va_arg(ap, uint64*) =
1176 									*(uint64 *)val;
1177 								ret_val = 1;
1178 								break;
1179 							case TIFF_SLONG8:
1180 								*va_arg(ap, int64*) =
1181 									*(int64 *)val;
1182 								ret_val = 1;
1183 								break;
1184 							case TIFF_RATIONAL:
1185 							case TIFF_SRATIONAL:
1186 							case TIFF_FLOAT:
1187 								*va_arg(ap, float*) =
1188 									*(float *)val;
1189 								ret_val = 1;
1190 								break;
1191 							case TIFF_DOUBLE:
1192 								*va_arg(ap, double*) =
1193 									*(double *)val;
1194 								ret_val = 1;
1195 								break;
1196 							default:
1197 								ret_val = 0;
1198 								break;
1199 							}
1200 						}
1201 					}
1202 					break;
1203 				}
1204 			}
1205 	}
1206 	return(ret_val);
1207 }
1208 
1209 /*
1210  * Return the value of a field in the
1211  * internal directory structure.
1212  */
1213 int
TIFFGetField(TIFF * tif,uint32 tag,...)1214 TIFFGetField(TIFF* tif, uint32 tag, ...)
1215 {
1216 	int status;
1217 	va_list ap;
1218 
1219 	va_start(ap, tag);
1220 	status = TIFFVGetField(tif, tag, ap);
1221 	va_end(ap);
1222 	return (status);
1223 }
1224 
1225 /*
1226  * Like TIFFGetField, but taking a varargs
1227  * parameter list.  This routine is useful
1228  * for building higher-level interfaces on
1229  * top of the library.
1230  */
1231 int
TIFFVGetField(TIFF * tif,uint32 tag,va_list ap)1232 TIFFVGetField(TIFF* tif, uint32 tag, va_list ap)
1233 {
1234 	const TIFFField* fip = TIFFFindField(tif, tag, TIFF_ANY);
1235 	return (fip && (isPseudoTag(tag) || TIFFFieldSet(tif, fip->field_bit)) ?
1236 	    (*tif->tif_tagmethods.vgetfield)(tif, tag, ap) : 0);
1237 }
1238 
1239 #define	CleanupField(member) {		\
1240     if (td->member) {			\
1241 	_TIFFfree(td->member);		\
1242 	td->member = 0;			\
1243     }					\
1244 }
1245 
1246 /*
1247  * Release storage associated with a directory.
1248  */
1249 void
TIFFFreeDirectory(TIFF * tif)1250 TIFFFreeDirectory(TIFF* tif)
1251 {
1252 	TIFFDirectory *td = &tif->tif_dir;
1253 	int            i;
1254 
1255 	_TIFFmemset(td->td_fieldsset, 0, FIELD_SETLONGS);
1256 	CleanupField(td_sminsamplevalue);
1257 	CleanupField(td_smaxsamplevalue);
1258 	CleanupField(td_colormap[0]);
1259 	CleanupField(td_colormap[1]);
1260 	CleanupField(td_colormap[2]);
1261 	CleanupField(td_sampleinfo);
1262 	CleanupField(td_subifd);
1263 	CleanupField(td_inknames);
1264 	CleanupField(td_refblackwhite);
1265 	CleanupField(td_transferfunction[0]);
1266 	CleanupField(td_transferfunction[1]);
1267 	CleanupField(td_transferfunction[2]);
1268 	CleanupField(td_stripoffset);
1269 	CleanupField(td_stripbytecount);
1270 	TIFFClrFieldBit(tif, FIELD_YCBCRSUBSAMPLING);
1271 	TIFFClrFieldBit(tif, FIELD_YCBCRPOSITIONING);
1272 
1273 	/* Cleanup custom tag values */
1274 	for( i = 0; i < td->td_customValueCount; i++ ) {
1275 		if (td->td_customValues[i].value)
1276 			_TIFFfree(td->td_customValues[i].value);
1277 	}
1278 
1279 	td->td_customValueCount = 0;
1280 	CleanupField(td_customValues);
1281 
1282 #if defined(DEFER_STRILE_LOAD)
1283         _TIFFmemset( &(td->td_stripoffset_entry), 0, sizeof(TIFFDirEntry));
1284         _TIFFmemset( &(td->td_stripbytecount_entry), 0, sizeof(TIFFDirEntry));
1285 #endif
1286 }
1287 #undef CleanupField
1288 
1289 /*
1290  * Client Tag extension support (from Niles Ritter).
1291  */
1292 static TIFFExtendProc _TIFFextender = (TIFFExtendProc) NULL;
1293 
1294 TIFFExtendProc
TIFFSetTagExtender(TIFFExtendProc extender)1295 TIFFSetTagExtender(TIFFExtendProc extender)
1296 {
1297 	TIFFExtendProc prev = _TIFFextender;
1298 	_TIFFextender = extender;
1299 	return (prev);
1300 }
1301 
1302 /*
1303  * Setup for a new directory.  Should we automatically call
1304  * TIFFWriteDirectory() if the current one is dirty?
1305  *
1306  * The newly created directory will not exist on the file till
1307  * TIFFWriteDirectory(), TIFFFlush() or TIFFClose() is called.
1308  */
1309 int
TIFFCreateDirectory(TIFF * tif)1310 TIFFCreateDirectory(TIFF* tif)
1311 {
1312 	TIFFDefaultDirectory(tif);
1313 	tif->tif_diroff = 0;
1314 	tif->tif_nextdiroff = 0;
1315 	tif->tif_curoff = 0;
1316 	tif->tif_row = (uint32) -1;
1317 	tif->tif_curstrip = (uint32) -1;
1318 
1319 	return 0;
1320 }
1321 
1322 int
TIFFCreateCustomDirectory(TIFF * tif,const TIFFFieldArray * infoarray)1323 TIFFCreateCustomDirectory(TIFF* tif, const TIFFFieldArray* infoarray)
1324 {
1325 	TIFFDefaultDirectory(tif);
1326 
1327 	/*
1328 	 * Reset the field definitions to match the application provided list.
1329 	 * Hopefully TIFFDefaultDirectory() won't have done anything irreversable
1330 	 * based on it's assumption this is an image directory.
1331 	 */
1332 	_TIFFSetupFields(tif, infoarray);
1333 
1334 	tif->tif_diroff = 0;
1335 	tif->tif_nextdiroff = 0;
1336 	tif->tif_curoff = 0;
1337 	tif->tif_row = (uint32) -1;
1338 	tif->tif_curstrip = (uint32) -1;
1339 
1340 	return 0;
1341 }
1342 
1343 int
TIFFCreateEXIFDirectory(TIFF * tif)1344 TIFFCreateEXIFDirectory(TIFF* tif)
1345 {
1346 	const TIFFFieldArray* exifFieldArray;
1347 	exifFieldArray = _TIFFGetExifFields();
1348 	return TIFFCreateCustomDirectory(tif, exifFieldArray);
1349 }
1350 
1351 /*
1352  * Setup a default directory structure.
1353  */
1354 int
TIFFDefaultDirectory(TIFF * tif)1355 TIFFDefaultDirectory(TIFF* tif)
1356 {
1357 	register TIFFDirectory* td = &tif->tif_dir;
1358 	const TIFFFieldArray* tiffFieldArray;
1359 
1360 	tiffFieldArray = _TIFFGetFields();
1361 	_TIFFSetupFields(tif, tiffFieldArray);
1362 
1363 	_TIFFmemset(td, 0, sizeof (*td));
1364 	td->td_fillorder = FILLORDER_MSB2LSB;
1365 	td->td_bitspersample = 1;
1366 	td->td_threshholding = THRESHHOLD_BILEVEL;
1367 	td->td_orientation = ORIENTATION_TOPLEFT;
1368 	td->td_samplesperpixel = 1;
1369 	td->td_rowsperstrip = (uint32) -1;
1370 	td->td_tilewidth = 0;
1371 	td->td_tilelength = 0;
1372 	td->td_tiledepth = 1;
1373 	td->td_stripbytecountsorted = 1; /* Our own arrays always sorted. */
1374 	td->td_resolutionunit = RESUNIT_INCH;
1375 	td->td_sampleformat = SAMPLEFORMAT_UINT;
1376 	td->td_imagedepth = 1;
1377 	td->td_ycbcrsubsampling[0] = 2;
1378 	td->td_ycbcrsubsampling[1] = 2;
1379 	td->td_ycbcrpositioning = YCBCRPOSITION_CENTERED;
1380 	tif->tif_postdecode = _TIFFNoPostDecode;
1381 	tif->tif_foundfield = NULL;
1382 	tif->tif_tagmethods.vsetfield = _TIFFVSetField;
1383 	tif->tif_tagmethods.vgetfield = _TIFFVGetField;
1384 	tif->tif_tagmethods.printdir = NULL;
1385 	/*
1386 	 *  Give client code a chance to install their own
1387 	 *  tag extensions & methods, prior to compression overloads,
1388 	 *  but do some prior cleanup first. (http://trac.osgeo.org/gdal/ticket/5054)
1389 	 */
1390 	if (tif->tif_nfieldscompat > 0) {
1391 		uint32 i;
1392 
1393 		for (i = 0; i < tif->tif_nfieldscompat; i++) {
1394 				if (tif->tif_fieldscompat[i].allocated_size)
1395 						_TIFFfree(tif->tif_fieldscompat[i].fields);
1396 		}
1397 		_TIFFfree(tif->tif_fieldscompat);
1398 		tif->tif_nfieldscompat = 0;
1399 		tif->tif_fieldscompat = NULL;
1400 	}
1401 	if (_TIFFextender)
1402 		(*_TIFFextender)(tif);
1403 	(void) TIFFSetField(tif, TIFFTAG_COMPRESSION, COMPRESSION_NONE);
1404 	/*
1405 	 * NB: The directory is marked dirty as a result of setting
1406 	 * up the default compression scheme.  However, this really
1407 	 * isn't correct -- we want TIFF_DIRTYDIRECT to be set only
1408 	 * if the user does something.  We could just do the setup
1409 	 * by hand, but it seems better to use the normal mechanism
1410 	 * (i.e. TIFFSetField).
1411 	 */
1412 	tif->tif_flags &= ~TIFF_DIRTYDIRECT;
1413 
1414 	/*
1415 	 * As per http://bugzilla.remotesensing.org/show_bug.cgi?id=19
1416 	 * we clear the ISTILED flag when setting up a new directory.
1417 	 * Should we also be clearing stuff like INSUBIFD?
1418 	 */
1419 	tif->tif_flags &= ~TIFF_ISTILED;
1420 
1421 	return (1);
1422 }
1423 
1424 static int
TIFFAdvanceDirectory(TIFF * tif,uint64 * nextdir,uint64 * off)1425 TIFFAdvanceDirectory(TIFF* tif, uint64* nextdir, uint64* off)
1426 {
1427 	static const char module[] = "TIFFAdvanceDirectory";
1428 	if (isMapped(tif))
1429 	{
1430 		uint64 poff=*nextdir;
1431 		if (!(tif->tif_flags&TIFF_BIGTIFF))
1432 		{
1433 			tmsize_t poffa,poffb,poffc,poffd;
1434 			uint16 dircount;
1435 			uint32 nextdir32;
1436 			poffa=(tmsize_t)poff;
1437 			poffb=poffa+sizeof(uint16);
1438 			if (((uint64)poffa!=poff)||(poffb<poffa)||(poffb<(tmsize_t)sizeof(uint16))||(poffb>tif->tif_size))
1439 			{
1440 				TIFFErrorExt(tif->tif_clientdata,module,"Error fetching directory count");
1441                                   *nextdir=0;
1442 				return(0);
1443 			}
1444 			_TIFFmemcpy(&dircount,tif->tif_base+poffa,sizeof(uint16));
1445 			if (tif->tif_flags&TIFF_SWAB)
1446 				TIFFSwabShort(&dircount);
1447 			poffc=poffb+dircount*12;
1448 			poffd=poffc+sizeof(uint32);
1449 			if ((poffc<poffb)||(poffc<dircount*12)||(poffd<poffc)||(poffd<(tmsize_t)sizeof(uint32))||(poffd>tif->tif_size))
1450 			{
1451 				TIFFErrorExt(tif->tif_clientdata,module,"Error fetching directory link");
1452 				return(0);
1453 			}
1454 			if (off!=NULL)
1455 				*off=(uint64)poffc;
1456 			_TIFFmemcpy(&nextdir32,tif->tif_base+poffc,sizeof(uint32));
1457 			if (tif->tif_flags&TIFF_SWAB)
1458 				TIFFSwabLong(&nextdir32);
1459 			*nextdir=nextdir32;
1460 		}
1461 		else
1462 		{
1463 			tmsize_t poffa,poffb,poffc,poffd;
1464 			uint64 dircount64;
1465 			uint16 dircount16;
1466 			poffa=(tmsize_t)poff;
1467 			poffb=poffa+sizeof(uint64);
1468 			if (((uint64)poffa!=poff)||(poffb<poffa)||(poffb<(tmsize_t)sizeof(uint64))||(poffb>tif->tif_size))
1469 			{
1470 				TIFFErrorExt(tif->tif_clientdata,module,"Error fetching directory count");
1471 				return(0);
1472 			}
1473 			_TIFFmemcpy(&dircount64,tif->tif_base+poffa,sizeof(uint64));
1474 			if (tif->tif_flags&TIFF_SWAB)
1475 				TIFFSwabLong8(&dircount64);
1476 			if (dircount64>0xFFFF)
1477 			{
1478 				TIFFErrorExt(tif->tif_clientdata,module,"Sanity check on directory count failed");
1479 				return(0);
1480 			}
1481 			dircount16=(uint16)dircount64;
1482 			poffc=poffb+dircount16*20;
1483 			poffd=poffc+sizeof(uint64);
1484 			if ((poffc<poffb)||(poffc<dircount16*20)||(poffd<poffc)||(poffd<(tmsize_t)sizeof(uint64))||(poffd>tif->tif_size))
1485 			{
1486 				TIFFErrorExt(tif->tif_clientdata,module,"Error fetching directory link");
1487 				return(0);
1488 			}
1489 			if (off!=NULL)
1490 				*off=(uint64)poffc;
1491 			_TIFFmemcpy(nextdir,tif->tif_base+poffc,sizeof(uint64));
1492 			if (tif->tif_flags&TIFF_SWAB)
1493 				TIFFSwabLong8(nextdir);
1494 		}
1495 		return(1);
1496 	}
1497 	else
1498 	{
1499 		if (!(tif->tif_flags&TIFF_BIGTIFF))
1500 		{
1501 			uint16 dircount;
1502 			uint32 nextdir32;
1503 			if (!SeekOK(tif, *nextdir) ||
1504 			    !ReadOK(tif, &dircount, sizeof (uint16))) {
1505 				TIFFErrorExt(tif->tif_clientdata, module, "%s: Error fetching directory count",
1506 				    tif->tif_name);
1507 				return (0);
1508 			}
1509 			if (tif->tif_flags & TIFF_SWAB)
1510 				TIFFSwabShort(&dircount);
1511 			if (off != NULL)
1512 				*off = TIFFSeekFile(tif,
1513 				    dircount*12, SEEK_CUR);
1514 			else
1515 				(void) TIFFSeekFile(tif,
1516 				    dircount*12, SEEK_CUR);
1517 			if (!ReadOK(tif, &nextdir32, sizeof (uint32))) {
1518 				TIFFErrorExt(tif->tif_clientdata, module, "%s: Error fetching directory link",
1519 				    tif->tif_name);
1520 				return (0);
1521 			}
1522 			if (tif->tif_flags & TIFF_SWAB)
1523 				TIFFSwabLong(&nextdir32);
1524 			*nextdir=nextdir32;
1525 		}
1526 		else
1527 		{
1528 			uint64 dircount64;
1529 			uint16 dircount16;
1530 			if (!SeekOK(tif, *nextdir) ||
1531 			    !ReadOK(tif, &dircount64, sizeof (uint64))) {
1532 				TIFFErrorExt(tif->tif_clientdata, module, "%s: Error fetching directory count",
1533 				    tif->tif_name);
1534 				return (0);
1535 			}
1536 			if (tif->tif_flags & TIFF_SWAB)
1537 				TIFFSwabLong8(&dircount64);
1538 			if (dircount64>0xFFFF)
1539 			{
1540 				TIFFErrorExt(tif->tif_clientdata, module, "Error fetching directory count");
1541 				return(0);
1542 			}
1543 			dircount16 = (uint16)dircount64;
1544 			if (off != NULL)
1545 				*off = TIFFSeekFile(tif,
1546 				    dircount16*20, SEEK_CUR);
1547 			else
1548 				(void) TIFFSeekFile(tif,
1549 				    dircount16*20, SEEK_CUR);
1550 			if (!ReadOK(tif, nextdir, sizeof (uint64))) {
1551 				TIFFErrorExt(tif->tif_clientdata, module,
1552                                              "%s: Error fetching directory link",
1553 				    tif->tif_name);
1554 				return (0);
1555 			}
1556 			if (tif->tif_flags & TIFF_SWAB)
1557 				TIFFSwabLong8(nextdir);
1558 		}
1559 		return (1);
1560 	}
1561 }
1562 
1563 /*
1564  * Count the number of directories in a file.
1565  */
1566 uint16
TIFFNumberOfDirectories(TIFF * tif)1567 TIFFNumberOfDirectories(TIFF* tif)
1568 {
1569 	static const char module[] = "TIFFNumberOfDirectories";
1570 	uint64 nextdir;
1571 	uint16 n;
1572 	if (!(tif->tif_flags&TIFF_BIGTIFF))
1573 		nextdir = tif->tif_header.classic.tiff_diroff;
1574 	else
1575 		nextdir = tif->tif_header.big.tiff_diroff;
1576 	n = 0;
1577 	while (nextdir != 0 && TIFFAdvanceDirectory(tif, &nextdir, NULL))
1578         {
1579                 if (n != 65535) {
1580                         ++n;
1581                 }
1582 		else
1583                 {
1584                         TIFFErrorExt(tif->tif_clientdata, module,
1585                                      "Directory count exceeded 65535 limit,"
1586                                      " giving up on counting.");
1587                         return (65535);
1588                 }
1589         }
1590 	return (n);
1591 }
1592 
1593 /*
1594  * Set the n-th directory as the current directory.
1595  * NB: Directories are numbered starting at 0.
1596  */
1597 int
TIFFSetDirectory(TIFF * tif,uint16 dirn)1598 TIFFSetDirectory(TIFF* tif, uint16 dirn)
1599 {
1600 	uint64 nextdir;
1601 	uint16 n;
1602 
1603 	if (!(tif->tif_flags&TIFF_BIGTIFF))
1604 		nextdir = tif->tif_header.classic.tiff_diroff;
1605 	else
1606 		nextdir = tif->tif_header.big.tiff_diroff;
1607 	for (n = dirn; n > 0 && nextdir != 0; n--)
1608 		if (!TIFFAdvanceDirectory(tif, &nextdir, NULL))
1609 			return (0);
1610 	tif->tif_nextdiroff = nextdir;
1611 	/*
1612 	 * Set curdir to the actual directory index.  The
1613 	 * -1 is because TIFFReadDirectory will increment
1614 	 * tif_curdir after successfully reading the directory.
1615 	 */
1616 	tif->tif_curdir = (dirn - n) - 1;
1617 	/*
1618 	 * Reset tif_dirnumber counter and start new list of seen directories.
1619 	 * We need this to prevent IFD loops.
1620 	 */
1621 	tif->tif_dirnumber = 0;
1622 	return (TIFFReadDirectory(tif));
1623 }
1624 
1625 /*
1626  * Set the current directory to be the directory
1627  * located at the specified file offset.  This interface
1628  * is used mainly to access directories linked with
1629  * the SubIFD tag (e.g. thumbnail images).
1630  */
1631 int
TIFFSetSubDirectory(TIFF * tif,uint64 diroff)1632 TIFFSetSubDirectory(TIFF* tif, uint64 diroff)
1633 {
1634 	tif->tif_nextdiroff = diroff;
1635 	/*
1636 	 * Reset tif_dirnumber counter and start new list of seen directories.
1637 	 * We need this to prevent IFD loops.
1638 	 */
1639 	tif->tif_dirnumber = 0;
1640 	return (TIFFReadDirectory(tif));
1641 }
1642 
1643 /*
1644  * Return file offset of the current directory.
1645  */
1646 uint64
TIFFCurrentDirOffset(TIFF * tif)1647 TIFFCurrentDirOffset(TIFF* tif)
1648 {
1649 	return (tif->tif_diroff);
1650 }
1651 
1652 /*
1653  * Return an indication of whether or not we are
1654  * at the last directory in the file.
1655  */
1656 int
TIFFLastDirectory(TIFF * tif)1657 TIFFLastDirectory(TIFF* tif)
1658 {
1659 	return (tif->tif_nextdiroff == 0);
1660 }
1661 
1662 /*
1663  * Unlink the specified directory from the directory chain.
1664  */
1665 int
TIFFUnlinkDirectory(TIFF * tif,uint16 dirn)1666 TIFFUnlinkDirectory(TIFF* tif, uint16 dirn)
1667 {
1668 	static const char module[] = "TIFFUnlinkDirectory";
1669 	uint64 nextdir;
1670 	uint64 off;
1671 	uint16 n;
1672 
1673 	if (tif->tif_mode == O_RDONLY) {
1674 		TIFFErrorExt(tif->tif_clientdata, module,
1675                              "Can not unlink directory in read-only file");
1676 		return (0);
1677 	}
1678 	/*
1679 	 * Go to the directory before the one we want
1680 	 * to unlink and nab the offset of the link
1681 	 * field we'll need to patch.
1682 	 */
1683 	if (!(tif->tif_flags&TIFF_BIGTIFF))
1684 	{
1685 		nextdir = tif->tif_header.classic.tiff_diroff;
1686 		off = 4;
1687 	}
1688 	else
1689 	{
1690 		nextdir = tif->tif_header.big.tiff_diroff;
1691 		off = 8;
1692 	}
1693 	for (n = dirn-1; n > 0; n--) {
1694 		if (nextdir == 0) {
1695 			TIFFErrorExt(tif->tif_clientdata, module, "Directory %d does not exist", dirn);
1696 			return (0);
1697 		}
1698 		if (!TIFFAdvanceDirectory(tif, &nextdir, &off))
1699 			return (0);
1700 	}
1701 	/*
1702 	 * Advance to the directory to be unlinked and fetch
1703 	 * the offset of the directory that follows.
1704 	 */
1705 	if (!TIFFAdvanceDirectory(tif, &nextdir, NULL))
1706 		return (0);
1707 	/*
1708 	 * Go back and patch the link field of the preceding
1709 	 * directory to point to the offset of the directory
1710 	 * that follows.
1711 	 */
1712 	(void) TIFFSeekFile(tif, off, SEEK_SET);
1713 	if (!(tif->tif_flags&TIFF_BIGTIFF))
1714 	{
1715 		uint32 nextdir32;
1716 		nextdir32=(uint32)nextdir;
1717 		assert((uint64)nextdir32==nextdir);
1718 		if (tif->tif_flags & TIFF_SWAB)
1719 			TIFFSwabLong(&nextdir32);
1720 		if (!WriteOK(tif, &nextdir32, sizeof (uint32))) {
1721 			TIFFErrorExt(tif->tif_clientdata, module, "Error writing directory link");
1722 			return (0);
1723 		}
1724 	}
1725 	else
1726 	{
1727 		if (tif->tif_flags & TIFF_SWAB)
1728 			TIFFSwabLong8(&nextdir);
1729 		if (!WriteOK(tif, &nextdir, sizeof (uint64))) {
1730 			TIFFErrorExt(tif->tif_clientdata, module, "Error writing directory link");
1731 			return (0);
1732 		}
1733 	}
1734 	/*
1735 	 * Leave directory state setup safely.  We don't have
1736 	 * facilities for doing inserting and removing directories,
1737 	 * so it's safest to just invalidate everything.  This
1738 	 * means that the caller can only append to the directory
1739 	 * chain.
1740 	 */
1741 	(*tif->tif_cleanup)(tif);
1742 	if ((tif->tif_flags & TIFF_MYBUFFER) && tif->tif_rawdata) {
1743 		_TIFFfree(tif->tif_rawdata);
1744 		tif->tif_rawdata = NULL;
1745 		tif->tif_rawcc = 0;
1746                 tif->tif_rawdataoff = 0;
1747                 tif->tif_rawdataloaded = 0;
1748 	}
1749 	tif->tif_flags &= ~(TIFF_BEENWRITING|TIFF_BUFFERSETUP|TIFF_POSTENCODE|TIFF_BUF4WRITE);
1750 	TIFFFreeDirectory(tif);
1751 	TIFFDefaultDirectory(tif);
1752 	tif->tif_diroff = 0;			/* force link on next write */
1753 	tif->tif_nextdiroff = 0;		/* next write must be at end */
1754 	tif->tif_curoff = 0;
1755 	tif->tif_row = (uint32) -1;
1756 	tif->tif_curstrip = (uint32) -1;
1757 	return (1);
1758 }
1759 
1760 /* vim: set ts=8 sts=8 sw=8 noet: */
1761 /*
1762  * Local Variables:
1763  * mode: c
1764  * c-basic-offset: 8
1765  * fill-column: 78
1766  * End:
1767  */
1768