Looks like ZLib uncompress() cannot deal with some kinds of TIFF deflated data,
[libav.git] / libavcodec / tiff.c
1 /*
2 * TIFF image decoder
3 * Copyright (c) 2006 Konstantin Shishkov
4 *
5 * This file is part of FFmpeg.
6 *
7 * FFmpeg is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License as published by the Free Software Foundation; either
10 * version 2.1 of the License, or (at your option) any later version.
11 *
12 * FFmpeg is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * Lesser General Public License for more details.
16 *
17 * You should have received a copy of the GNU Lesser General Public
18 * License along with FFmpeg; if not, write to the Free Software
19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
20 */
21
22 /**
23 * TIFF image decoder
24 * @file libavcodec/tiff.c
25 * @author Konstantin Shishkov
26 */
27 #include "avcodec.h"
28 #if CONFIG_ZLIB
29 #include <zlib.h>
30 #endif
31 #include "lzw.h"
32 #include "tiff.h"
33 #include "faxcompr.h"
34
35
36 typedef struct TiffContext {
37 AVCodecContext *avctx;
38 AVFrame picture;
39
40 int width, height;
41 unsigned int bpp;
42 int le;
43 int compr;
44 int invert;
45 int fax_opts;
46 int predictor;
47 int fill_order;
48
49 int strips, rps, sstype;
50 int sot;
51 const uint8_t* stripdata;
52 const uint8_t* stripsizes;
53 int stripsize, stripoff;
54 LZWState *lzw;
55 } TiffContext;
56
57 static int tget_short(const uint8_t **p, int le){
58 int v = le ? AV_RL16(*p) : AV_RB16(*p);
59 *p += 2;
60 return v;
61 }
62
63 static int tget_long(const uint8_t **p, int le){
64 int v = le ? AV_RL32(*p) : AV_RB32(*p);
65 *p += 4;
66 return v;
67 }
68
69 static int tget(const uint8_t **p, int type, int le){
70 switch(type){
71 case TIFF_BYTE : return *(*p)++;
72 case TIFF_SHORT: return tget_short(p, le);
73 case TIFF_LONG : return tget_long (p, le);
74 default : return -1;
75 }
76 }
77
78 static int tiff_uncompress(uint8_t *dst, unsigned long *len, const uint8_t *src, int size)
79 {
80 z_stream zstream;
81 int zret;
82
83 memset(&zstream, 0, sizeof(zstream));
84 zstream.next_in = src;
85 zstream.avail_in = size;
86 zstream.next_out = dst;
87 zstream.avail_out = *len;
88 zret = inflateInit(&zstream);
89 if (zret != Z_OK) {
90 av_log(NULL, AV_LOG_ERROR, "Inflate init error: %d\n", zret);
91 return zret;
92 }
93 zret = inflate(&zstream, Z_SYNC_FLUSH);
94 inflateEnd(&zstream);
95 *len = zstream.total_out;
96 return zret == Z_STREAM_END ? Z_OK : zret;
97 }
98
99 static int tiff_unpack_strip(TiffContext *s, uint8_t* dst, int stride, const uint8_t *src, int size, int lines){
100 int c, line, pixels, code;
101 const uint8_t *ssrc = src;
102 int width = s->width * s->bpp >> 3;
103 #if CONFIG_ZLIB
104 uint8_t *zbuf; unsigned long outlen;
105
106 if(s->compr == TIFF_DEFLATE || s->compr == TIFF_ADOBE_DEFLATE){
107 int ret;
108 outlen = width * lines;
109 zbuf = av_malloc(outlen);
110 ret = tiff_uncompress(zbuf, &outlen, src, size);
111 if(ret != Z_OK){
112 av_log(s->avctx, AV_LOG_ERROR, "Uncompressing failed (%lu of %lu) with error %d\n", outlen, (unsigned long)width * lines, ret);
113 av_free(zbuf);
114 return -1;
115 }
116 src = zbuf;
117 for(line = 0; line < lines; line++){
118 memcpy(dst, src, width);
119 dst += stride;
120 src += width;
121 }
122 av_free(zbuf);
123 return 0;
124 }
125 #endif
126 if(s->compr == TIFF_LZW){
127 if(ff_lzw_decode_init(s->lzw, 8, src, size, FF_LZW_TIFF) < 0){
128 av_log(s->avctx, AV_LOG_ERROR, "Error initializing LZW decoder\n");
129 return -1;
130 }
131 }
132 if(s->compr == TIFF_CCITT_RLE || s->compr == TIFF_G3 || s->compr == TIFF_G4){
133 int i, ret = 0;
134 uint8_t *src2 = av_malloc(size + FF_INPUT_BUFFER_PADDING_SIZE);
135
136 if(!src2 || (unsigned)size + FF_INPUT_BUFFER_PADDING_SIZE < (unsigned)size){
137 av_log(s->avctx, AV_LOG_ERROR, "Error allocating temporary buffer\n");
138 return -1;
139 }
140 if(!s->fill_order){
141 memcpy(src2, src, size);
142 }else{
143 for(i = 0; i < size; i++)
144 src2[i] = ff_reverse[src[i]];
145 }
146 memset(src2+size, 0, FF_INPUT_BUFFER_PADDING_SIZE);
147 if(s->compr == TIFF_G3 && !(s->fax_opts & 1))
148 s->compr = TIFF_CCITT_RLE;
149 switch(s->compr){
150 case TIFF_CCITT_RLE:
151 case TIFF_G3:
152 case TIFF_G4:
153 ret = ff_ccitt_unpack(s->avctx, src2, size, dst, lines, stride, s->compr);
154 break;
155 }
156 av_free(src2);
157 return ret;
158 }
159 for(line = 0; line < lines; line++){
160 if(src - ssrc > size){
161 av_log(s->avctx, AV_LOG_ERROR, "Source data overread\n");
162 return -1;
163 }
164 switch(s->compr){
165 case TIFF_RAW:
166 memcpy(dst, src, width);
167 src += width;
168 break;
169 case TIFF_PACKBITS:
170 for(pixels = 0; pixels < width;){
171 code = (int8_t)*src++;
172 if(code >= 0){
173 code++;
174 if(pixels + code > width){
175 av_log(s->avctx, AV_LOG_ERROR, "Copy went out of bounds\n");
176 return -1;
177 }
178 memcpy(dst + pixels, src, code);
179 src += code;
180 pixels += code;
181 }else if(code != -128){ // -127..-1
182 code = (-code) + 1;
183 if(pixels + code > width){
184 av_log(s->avctx, AV_LOG_ERROR, "Run went out of bounds\n");
185 return -1;
186 }
187 c = *src++;
188 memset(dst + pixels, c, code);
189 pixels += code;
190 }
191 }
192 break;
193 case TIFF_LZW:
194 pixels = ff_lzw_decode(s->lzw, dst, width);
195 if(pixels < width){
196 av_log(s->avctx, AV_LOG_ERROR, "Decoded only %i bytes of %i\n", pixels, width);
197 return -1;
198 }
199 break;
200 }
201 dst += stride;
202 }
203 return 0;
204 }
205
206
207 static int tiff_decode_tag(TiffContext *s, const uint8_t *start, const uint8_t *buf, const uint8_t *end_buf)
208 {
209 int tag, type, count, off, value = 0;
210 int i, j;
211 uint32_t *pal;
212 const uint8_t *rp, *gp, *bp;
213
214 tag = tget_short(&buf, s->le);
215 type = tget_short(&buf, s->le);
216 count = tget_long(&buf, s->le);
217 off = tget_long(&buf, s->le);
218
219 if(count == 1){
220 switch(type){
221 case TIFF_BYTE:
222 case TIFF_SHORT:
223 buf -= 4;
224 value = tget(&buf, type, s->le);
225 buf = NULL;
226 break;
227 case TIFF_LONG:
228 value = off;
229 buf = NULL;
230 break;
231 case TIFF_STRING:
232 if(count <= 4){
233 buf -= 4;
234 break;
235 }
236 default:
237 value = -1;
238 buf = start + off;
239 }
240 }else if(type_sizes[type] * count <= 4){
241 buf -= 4;
242 }else{
243 buf = start + off;
244 }
245
246 if(buf && (buf < start || buf > end_buf)){
247 av_log(s->avctx, AV_LOG_ERROR, "Tag referencing position outside the image\n");
248 return -1;
249 }
250
251 switch(tag){
252 case TIFF_WIDTH:
253 s->width = value;
254 break;
255 case TIFF_HEIGHT:
256 s->height = value;
257 break;
258 case TIFF_BPP:
259 if(count == 1) s->bpp = value;
260 else{
261 switch(type){
262 case TIFF_BYTE:
263 s->bpp = (off & 0xFF) + ((off >> 8) & 0xFF) + ((off >> 16) & 0xFF) + ((off >> 24) & 0xFF);
264 break;
265 case TIFF_SHORT:
266 case TIFF_LONG:
267 s->bpp = 0;
268 for(i = 0; i < count; i++) s->bpp += tget(&buf, type, s->le);
269 break;
270 default:
271 s->bpp = -1;
272 }
273 }
274 if(count > 4){
275 av_log(s->avctx, AV_LOG_ERROR, "This format is not supported (bpp=%d, %d components)\n", s->bpp, count);
276 return -1;
277 }
278 switch(s->bpp*10 + count){
279 case 11:
280 s->avctx->pix_fmt = PIX_FMT_MONOBLACK;
281 break;
282 case 81:
283 s->avctx->pix_fmt = PIX_FMT_PAL8;
284 break;
285 case 243:
286 s->avctx->pix_fmt = PIX_FMT_RGB24;
287 break;
288 case 161:
289 s->avctx->pix_fmt = PIX_FMT_GRAY16BE;
290 break;
291 case 324:
292 s->avctx->pix_fmt = PIX_FMT_RGBA;
293 break;
294 case 483:
295 s->avctx->pix_fmt = s->le ? PIX_FMT_RGB48LE : PIX_FMT_RGB48BE;
296 break;
297 default:
298 av_log(s->avctx, AV_LOG_ERROR, "This format is not supported (bpp=%d, %d components)\n", s->bpp, count);
299 return -1;
300 }
301 if(s->width != s->avctx->width || s->height != s->avctx->height){
302 if(avcodec_check_dimensions(s->avctx, s->width, s->height))
303 return -1;
304 avcodec_set_dimensions(s->avctx, s->width, s->height);
305 }
306 if(s->picture.data[0])
307 s->avctx->release_buffer(s->avctx, &s->picture);
308 if(s->avctx->get_buffer(s->avctx, &s->picture) < 0){
309 av_log(s->avctx, AV_LOG_ERROR, "get_buffer() failed\n");
310 return -1;
311 }
312 if(s->bpp == 8){
313 /* make default grayscale pal */
314 pal = (uint32_t *) s->picture.data[1];
315 for(i = 0; i < 256; i++)
316 pal[i] = i * 0x010101;
317 }
318 break;
319 case TIFF_COMPR:
320 s->compr = value;
321 s->predictor = 0;
322 switch(s->compr){
323 case TIFF_RAW:
324 case TIFF_PACKBITS:
325 case TIFF_LZW:
326 case TIFF_CCITT_RLE:
327 break;
328 case TIFF_G3:
329 case TIFF_G4:
330 s->fax_opts = 0;
331 break;
332 case TIFF_DEFLATE:
333 case TIFF_ADOBE_DEFLATE:
334 #if CONFIG_ZLIB
335 break;
336 #else
337 av_log(s->avctx, AV_LOG_ERROR, "Deflate: ZLib not compiled in\n");
338 return -1;
339 #endif
340 case TIFF_JPEG:
341 case TIFF_NEWJPEG:
342 av_log(s->avctx, AV_LOG_ERROR, "JPEG compression is not supported\n");
343 return -1;
344 default:
345 av_log(s->avctx, AV_LOG_ERROR, "Unknown compression method %i\n", s->compr);
346 return -1;
347 }
348 break;
349 case TIFF_ROWSPERSTRIP:
350 if(type == TIFF_LONG && value == -1)
351 value = s->avctx->height;
352 if(value < 1){
353 av_log(s->avctx, AV_LOG_ERROR, "Incorrect value of rows per strip\n");
354 return -1;
355 }
356 s->rps = value;
357 break;
358 case TIFF_STRIP_OFFS:
359 if(count == 1){
360 s->stripdata = NULL;
361 s->stripoff = value;
362 }else
363 s->stripdata = start + off;
364 s->strips = count;
365 if(s->strips == 1) s->rps = s->height;
366 s->sot = type;
367 if(s->stripdata > end_buf){
368 av_log(s->avctx, AV_LOG_ERROR, "Tag referencing position outside the image\n");
369 return -1;
370 }
371 break;
372 case TIFF_STRIP_SIZE:
373 if(count == 1){
374 s->stripsizes = NULL;
375 s->stripsize = value;
376 s->strips = 1;
377 }else{
378 s->stripsizes = start + off;
379 }
380 s->strips = count;
381 s->sstype = type;
382 if(s->stripsizes > end_buf){
383 av_log(s->avctx, AV_LOG_ERROR, "Tag referencing position outside the image\n");
384 return -1;
385 }
386 break;
387 case TIFF_PREDICTOR:
388 s->predictor = value;
389 break;
390 case TIFF_INVERT:
391 switch(value){
392 case 0:
393 s->invert = 1;
394 break;
395 case 1:
396 s->invert = 0;
397 break;
398 case 2:
399 case 3:
400 break;
401 default:
402 av_log(s->avctx, AV_LOG_ERROR, "Color mode %d is not supported\n", value);
403 return -1;
404 }
405 break;
406 case TIFF_FILL_ORDER:
407 if(value < 1 || value > 2){
408 av_log(s->avctx, AV_LOG_ERROR, "Unknown FillOrder value %d, trying default one\n", value);
409 value = 1;
410 }
411 s->fill_order = value - 1;
412 break;
413 case TIFF_PAL:
414 if(s->avctx->pix_fmt != PIX_FMT_PAL8){
415 av_log(s->avctx, AV_LOG_ERROR, "Palette met but this is not palettized format\n");
416 return -1;
417 }
418 pal = (uint32_t *) s->picture.data[1];
419 off = type_sizes[type];
420 rp = buf;
421 gp = buf + count / 3 * off;
422 bp = buf + count / 3 * off * 2;
423 off = (type_sizes[type] - 1) << 3;
424 for(i = 0; i < count / 3; i++){
425 j = (tget(&rp, type, s->le) >> off) << 16;
426 j |= (tget(&gp, type, s->le) >> off) << 8;
427 j |= tget(&bp, type, s->le) >> off;
428 pal[i] = j;
429 }
430 break;
431 case TIFF_PLANAR:
432 if(value == 2){
433 av_log(s->avctx, AV_LOG_ERROR, "Planar format is not supported\n");
434 return -1;
435 }
436 break;
437 case TIFF_T4OPTIONS:
438 case TIFF_T6OPTIONS:
439 s->fax_opts = value;
440 break;
441 }
442 return 0;
443 }
444
445 static int decode_frame(AVCodecContext *avctx,
446 void *data, int *data_size,
447 AVPacket *avpkt)
448 {
449 const uint8_t *buf = avpkt->data;
450 int buf_size = avpkt->size;
451 TiffContext * const s = avctx->priv_data;
452 AVFrame *picture = data;
453 AVFrame * const p= (AVFrame*)&s->picture;
454 const uint8_t *orig_buf = buf, *end_buf = buf + buf_size;
455 int id, le, off;
456 int i, j, entries;
457 int stride, soff, ssize;
458 uint8_t *dst;
459
460 //parse image header
461 id = AV_RL16(buf); buf += 2;
462 if(id == 0x4949) le = 1;
463 else if(id == 0x4D4D) le = 0;
464 else{
465 av_log(avctx, AV_LOG_ERROR, "TIFF header not found\n");
466 return -1;
467 }
468 s->le = le;
469 s->invert = 0;
470 s->compr = TIFF_RAW;
471 s->fill_order = 0;
472 // As TIFF 6.0 specification puts it "An arbitrary but carefully chosen number
473 // that further identifies the file as a TIFF file"
474 if(tget_short(&buf, le) != 42){
475 av_log(avctx, AV_LOG_ERROR, "The answer to life, universe and everything is not correct!\n");
476 return -1;
477 }
478 /* parse image file directory */
479 off = tget_long(&buf, le);
480 if(orig_buf + off + 14 >= end_buf){
481 av_log(avctx, AV_LOG_ERROR, "IFD offset is greater than image size\n");
482 return -1;
483 }
484 buf = orig_buf + off;
485 entries = tget_short(&buf, le);
486 for(i = 0; i < entries; i++){
487 if(tiff_decode_tag(s, orig_buf, buf, end_buf) < 0)
488 return -1;
489 buf += 12;
490 }
491 if(!s->stripdata && !s->stripoff){
492 av_log(avctx, AV_LOG_ERROR, "Image data is missing\n");
493 return -1;
494 }
495 /* now we have the data and may start decoding */
496 if(!p->data[0]){
497 av_log(s->avctx, AV_LOG_ERROR, "Picture initialization missing\n");
498 return -1;
499 }
500 if(s->strips == 1 && !s->stripsize){
501 av_log(avctx, AV_LOG_WARNING, "Image data size missing\n");
502 s->stripsize = buf_size - s->stripoff;
503 }
504 stride = p->linesize[0];
505 dst = p->data[0];
506 for(i = 0; i < s->height; i += s->rps){
507 if(s->stripsizes)
508 ssize = tget(&s->stripsizes, s->sstype, s->le);
509 else
510 ssize = s->stripsize;
511
512 if(s->stripdata){
513 soff = tget(&s->stripdata, s->sot, s->le);
514 }else
515 soff = s->stripoff;
516 if(tiff_unpack_strip(s, dst, stride, orig_buf + soff, ssize, FFMIN(s->rps, s->height - i)) < 0)
517 break;
518 dst += s->rps * stride;
519 }
520 if(s->predictor == 2){
521 dst = p->data[0];
522 soff = s->bpp >> 3;
523 ssize = s->width * soff;
524 for(i = 0; i < s->height; i++) {
525 for(j = soff; j < ssize; j++)
526 dst[j] += dst[j - soff];
527 dst += stride;
528 }
529 }
530
531 if(s->invert){
532 uint8_t *src;
533 int j;
534
535 src = s->picture.data[0];
536 for(j = 0; j < s->height; j++){
537 for(i = 0; i < s->picture.linesize[0]; i++)
538 src[i] = 255 - src[i];
539 src += s->picture.linesize[0];
540 }
541 }
542 *picture= *(AVFrame*)&s->picture;
543 *data_size = sizeof(AVPicture);
544
545 return buf_size;
546 }
547
548 static av_cold int tiff_init(AVCodecContext *avctx){
549 TiffContext *s = avctx->priv_data;
550
551 s->width = 0;
552 s->height = 0;
553 s->avctx = avctx;
554 avcodec_get_frame_defaults((AVFrame*)&s->picture);
555 avctx->coded_frame= (AVFrame*)&s->picture;
556 ff_lzw_decode_open(&s->lzw);
557 ff_ccitt_unpack_init();
558
559 return 0;
560 }
561
562 static av_cold int tiff_end(AVCodecContext *avctx)
563 {
564 TiffContext * const s = avctx->priv_data;
565
566 ff_lzw_decode_close(&s->lzw);
567 if(s->picture.data[0])
568 avctx->release_buffer(avctx, &s->picture);
569 return 0;
570 }
571
572 AVCodec tiff_decoder = {
573 "tiff",
574 CODEC_TYPE_VIDEO,
575 CODEC_ID_TIFF,
576 sizeof(TiffContext),
577 tiff_init,
578 NULL,
579 tiff_end,
580 decode_frame,
581 CODEC_CAP_DR1,
582 NULL,
583 .long_name = NULL_IF_CONFIG_SMALL("TIFF image"),
584 };