00001
00002
00003
00004
00005
00006
00007
00008
00009
00010
00011
00012
00013
00014
00015
00016
00017
00018
00019
00020
00021
00028 #include "avcodec.h"
00029 #if CONFIG_ZLIB
00030 #include <zlib.h>
00031 #endif
00032 #include "lzw.h"
00033 #include "tiff.h"
00034 #include "faxcompr.h"
00035 #include "libavutil/common.h"
00036 #include "libavutil/intreadwrite.h"
00037 #include "libavutil/imgutils.h"
00038
00039 typedef struct TiffContext {
00040 AVCodecContext *avctx;
00041 AVFrame picture;
00042
00043 int width, height;
00044 unsigned int bpp, bppcount;
00045 uint32_t palette[256];
00046 int palette_is_set;
00047 int le;
00048 enum TiffCompr compr;
00049 int invert;
00050 int fax_opts;
00051 int predictor;
00052 int fill_order;
00053
00054 int strips, rps, sstype;
00055 int sot;
00056 const uint8_t* stripdata;
00057 const uint8_t* stripsizes;
00058 int stripsize, stripoff;
00059 LZWState *lzw;
00060 } TiffContext;
00061
00062 static int tget_short(const uint8_t **p, int le){
00063 int v = le ? AV_RL16(*p) : AV_RB16(*p);
00064 *p += 2;
00065 return v;
00066 }
00067
00068 static int tget_long(const uint8_t **p, int le){
00069 int v = le ? AV_RL32(*p) : AV_RB32(*p);
00070 *p += 4;
00071 return v;
00072 }
00073
00074 static int tget(const uint8_t **p, int type, int le){
00075 switch(type){
00076 case TIFF_BYTE : return *(*p)++;
00077 case TIFF_SHORT: return tget_short(p, le);
00078 case TIFF_LONG : return tget_long (p, le);
00079 default : return -1;
00080 }
00081 }
00082
00083 #if CONFIG_ZLIB
00084 static int tiff_uncompress(uint8_t *dst, unsigned long *len, const uint8_t *src, int size)
00085 {
00086 z_stream zstream;
00087 int zret;
00088
00089 memset(&zstream, 0, sizeof(zstream));
00090 zstream.next_in = src;
00091 zstream.avail_in = size;
00092 zstream.next_out = dst;
00093 zstream.avail_out = *len;
00094 zret = inflateInit(&zstream);
00095 if (zret != Z_OK) {
00096 av_log(NULL, AV_LOG_ERROR, "Inflate init error: %d\n", zret);
00097 return zret;
00098 }
00099 zret = inflate(&zstream, Z_SYNC_FLUSH);
00100 inflateEnd(&zstream);
00101 *len = zstream.total_out;
00102 return zret == Z_STREAM_END ? Z_OK : zret;
00103 }
00104 #endif
00105
00106 static int tiff_unpack_strip(TiffContext *s, uint8_t* dst, int stride, const uint8_t *src, int size, int lines){
00107 int c, line, pixels, code;
00108 const uint8_t *ssrc = src;
00109 int width = ((s->width * s->bpp) + 7) >> 3;
00110 #if CONFIG_ZLIB
00111 uint8_t *zbuf; unsigned long outlen;
00112
00113 if(s->compr == TIFF_DEFLATE || s->compr == TIFF_ADOBE_DEFLATE){
00114 int ret;
00115 outlen = width * lines;
00116 zbuf = av_malloc(outlen);
00117 ret = tiff_uncompress(zbuf, &outlen, src, size);
00118 if(ret != Z_OK){
00119 av_log(s->avctx, AV_LOG_ERROR, "Uncompressing failed (%lu of %lu) with error %d\n", outlen, (unsigned long)width * lines, ret);
00120 av_free(zbuf);
00121 return -1;
00122 }
00123 src = zbuf;
00124 for(line = 0; line < lines; line++){
00125 memcpy(dst, src, width);
00126 dst += stride;
00127 src += width;
00128 }
00129 av_free(zbuf);
00130 return 0;
00131 }
00132 #endif
00133 if(s->compr == TIFF_LZW){
00134 if(ff_lzw_decode_init(s->lzw, 8, src, size, FF_LZW_TIFF) < 0){
00135 av_log(s->avctx, AV_LOG_ERROR, "Error initializing LZW decoder\n");
00136 return -1;
00137 }
00138 }
00139 if(s->compr == TIFF_CCITT_RLE || s->compr == TIFF_G3 || s->compr == TIFF_G4){
00140 int i, ret = 0;
00141 uint8_t *src2 = av_malloc(size + FF_INPUT_BUFFER_PADDING_SIZE);
00142
00143 if(!src2 || (unsigned)size + FF_INPUT_BUFFER_PADDING_SIZE < (unsigned)size){
00144 av_log(s->avctx, AV_LOG_ERROR, "Error allocating temporary buffer\n");
00145 return -1;
00146 }
00147 if(s->fax_opts & 2){
00148 av_log(s->avctx, AV_LOG_ERROR, "Uncompressed fax mode is not supported (yet)\n");
00149 av_free(src2);
00150 return -1;
00151 }
00152 if(!s->fill_order){
00153 memcpy(src2, src, size);
00154 }else{
00155 for(i = 0; i < size; i++)
00156 src2[i] = av_reverse[src[i]];
00157 }
00158 memset(src2+size, 0, FF_INPUT_BUFFER_PADDING_SIZE);
00159 switch(s->compr){
00160 case TIFF_CCITT_RLE:
00161 case TIFF_G3:
00162 case TIFF_G4:
00163 ret = ff_ccitt_unpack(s->avctx, src2, size, dst, lines, stride, s->compr, s->fax_opts);
00164 break;
00165 }
00166 av_free(src2);
00167 return ret;
00168 }
00169 for(line = 0; line < lines; line++){
00170 if(src - ssrc > size){
00171 av_log(s->avctx, AV_LOG_ERROR, "Source data overread\n");
00172 return -1;
00173 }
00174 switch(s->compr){
00175 case TIFF_RAW:
00176 if (ssrc + size - src < width)
00177 return AVERROR_INVALIDDATA;
00178 if (!s->fill_order) {
00179 memcpy(dst, src, width);
00180 } else {
00181 int i;
00182 for (i = 0; i < width; i++)
00183 dst[i] = av_reverse[src[i]];
00184 }
00185 src += width;
00186 break;
00187 case TIFF_PACKBITS:
00188 for(pixels = 0; pixels < width;){
00189 code = (int8_t)*src++;
00190 if(code >= 0){
00191 code++;
00192 if(pixels + code > width){
00193 av_log(s->avctx, AV_LOG_ERROR, "Copy went out of bounds\n");
00194 return -1;
00195 }
00196 memcpy(dst + pixels, src, code);
00197 src += code;
00198 pixels += code;
00199 }else if(code != -128){
00200 code = (-code) + 1;
00201 if(pixels + code > width){
00202 av_log(s->avctx, AV_LOG_ERROR, "Run went out of bounds\n");
00203 return -1;
00204 }
00205 c = *src++;
00206 memset(dst + pixels, c, code);
00207 pixels += code;
00208 }
00209 }
00210 break;
00211 case TIFF_LZW:
00212 pixels = ff_lzw_decode(s->lzw, dst, width);
00213 if(pixels < width){
00214 av_log(s->avctx, AV_LOG_ERROR, "Decoded only %i bytes of %i\n", pixels, width);
00215 return -1;
00216 }
00217 break;
00218 }
00219 dst += stride;
00220 }
00221 return 0;
00222 }
00223
00224 static int init_image(TiffContext *s)
00225 {
00226 int i, ret;
00227 uint32_t *pal;
00228
00229 switch (s->bpp * 10 + s->bppcount) {
00230 case 11:
00231 s->avctx->pix_fmt = PIX_FMT_MONOBLACK;
00232 break;
00233 case 81:
00234 s->avctx->pix_fmt = PIX_FMT_PAL8;
00235 break;
00236 case 243:
00237 s->avctx->pix_fmt = PIX_FMT_RGB24;
00238 break;
00239 case 161:
00240 s->avctx->pix_fmt = PIX_FMT_GRAY16BE;
00241 break;
00242 case 324:
00243 s->avctx->pix_fmt = PIX_FMT_RGBA;
00244 break;
00245 case 483:
00246 s->avctx->pix_fmt = s->le ? PIX_FMT_RGB48LE : PIX_FMT_RGB48BE;
00247 break;
00248 default:
00249 av_log(s->avctx, AV_LOG_ERROR,
00250 "This format is not supported (bpp=%d, bppcount=%d)\n",
00251 s->bpp, s->bppcount);
00252 return AVERROR_INVALIDDATA;
00253 }
00254 if (s->width != s->avctx->width || s->height != s->avctx->height) {
00255 if ((ret = av_image_check_size(s->width, s->height, 0, s->avctx)) < 0)
00256 return ret;
00257 avcodec_set_dimensions(s->avctx, s->width, s->height);
00258 }
00259 if (s->picture.data[0])
00260 s->avctx->release_buffer(s->avctx, &s->picture);
00261 if ((ret = s->avctx->get_buffer(s->avctx, &s->picture)) < 0) {
00262 av_log(s->avctx, AV_LOG_ERROR, "get_buffer() failed\n");
00263 return ret;
00264 }
00265 if (s->avctx->pix_fmt == PIX_FMT_PAL8) {
00266 if (s->palette_is_set) {
00267 memcpy(s->picture.data[1], s->palette, sizeof(s->palette));
00268 } else {
00269
00270 pal = (uint32_t *) s->picture.data[1];
00271 for (i = 0; i < 256; i++)
00272 pal[i] = i * 0x010101;
00273 }
00274 }
00275 return 0;
00276 }
00277
00278 static int tiff_decode_tag(TiffContext *s, const uint8_t *start, const uint8_t *buf, const uint8_t *end_buf)
00279 {
00280 int tag, type, count, off, value = 0;
00281 int i, j;
00282 uint32_t *pal;
00283 const uint8_t *rp, *gp, *bp;
00284
00285 if (end_buf - buf < 12)
00286 return -1;
00287 tag = tget_short(&buf, s->le);
00288 type = tget_short(&buf, s->le);
00289 count = tget_long(&buf, s->le);
00290 off = tget_long(&buf, s->le);
00291
00292 if (type == 0 || type >= FF_ARRAY_ELEMS(type_sizes)) {
00293 av_log(s->avctx, AV_LOG_DEBUG, "Unknown tiff type (%u) encountered\n", type);
00294 return 0;
00295 }
00296
00297 if(count == 1){
00298 switch(type){
00299 case TIFF_BYTE:
00300 case TIFF_SHORT:
00301 buf -= 4;
00302 value = tget(&buf, type, s->le);
00303 buf = NULL;
00304 break;
00305 case TIFF_LONG:
00306 value = off;
00307 buf = NULL;
00308 break;
00309 case TIFF_STRING:
00310 if(count <= 4){
00311 buf -= 4;
00312 break;
00313 }
00314 default:
00315 value = -1;
00316 buf = start + off;
00317 }
00318 } else {
00319 if (count <= 4 && type_sizes[type] * count <= 4) {
00320 buf -= 4;
00321 } else {
00322 buf = start + off;
00323 }
00324 }
00325
00326 if(buf && (buf < start || buf > end_buf)){
00327 av_log(s->avctx, AV_LOG_ERROR, "Tag referencing position outside the image\n");
00328 return -1;
00329 }
00330
00331 switch(tag){
00332 case TIFF_WIDTH:
00333 s->width = value;
00334 break;
00335 case TIFF_HEIGHT:
00336 s->height = value;
00337 break;
00338 case TIFF_BPP:
00339 s->bppcount = count;
00340 if(count > 4){
00341 av_log(s->avctx, AV_LOG_ERROR, "This format is not supported (bpp=%d, %d components)\n", s->bpp, count);
00342 return -1;
00343 }
00344 if(count == 1) s->bpp = value;
00345 else{
00346 switch(type){
00347 case TIFF_BYTE:
00348 s->bpp = (off & 0xFF) + ((off >> 8) & 0xFF) + ((off >> 16) & 0xFF) + ((off >> 24) & 0xFF);
00349 break;
00350 case TIFF_SHORT:
00351 case TIFF_LONG:
00352 s->bpp = 0;
00353 for(i = 0; i < count && buf < end_buf; i++) s->bpp += tget(&buf, type, s->le);
00354 break;
00355 default:
00356 s->bpp = -1;
00357 }
00358 }
00359 break;
00360 case TIFF_SAMPLES_PER_PIXEL:
00361 if (count != 1) {
00362 av_log(s->avctx, AV_LOG_ERROR,
00363 "Samples per pixel requires a single value, many provided\n");
00364 return AVERROR_INVALIDDATA;
00365 }
00366 if (s->bppcount == 1)
00367 s->bpp *= value;
00368 s->bppcount = value;
00369 break;
00370 case TIFF_COMPR:
00371 s->compr = value;
00372 s->predictor = 0;
00373 switch(s->compr){
00374 case TIFF_RAW:
00375 case TIFF_PACKBITS:
00376 case TIFF_LZW:
00377 case TIFF_CCITT_RLE:
00378 break;
00379 case TIFF_G3:
00380 case TIFF_G4:
00381 s->fax_opts = 0;
00382 break;
00383 case TIFF_DEFLATE:
00384 case TIFF_ADOBE_DEFLATE:
00385 #if CONFIG_ZLIB
00386 break;
00387 #else
00388 av_log(s->avctx, AV_LOG_ERROR, "Deflate: ZLib not compiled in\n");
00389 return -1;
00390 #endif
00391 case TIFF_JPEG:
00392 case TIFF_NEWJPEG:
00393 av_log(s->avctx, AV_LOG_ERROR, "JPEG compression is not supported\n");
00394 return -1;
00395 default:
00396 av_log(s->avctx, AV_LOG_ERROR, "Unknown compression method %i\n", s->compr);
00397 return -1;
00398 }
00399 break;
00400 case TIFF_ROWSPERSTRIP:
00401 if(type == TIFF_LONG && value == -1)
00402 value = s->avctx->height;
00403 if(value < 1){
00404 av_log(s->avctx, AV_LOG_ERROR, "Incorrect value of rows per strip\n");
00405 return -1;
00406 }
00407 s->rps = value;
00408 break;
00409 case TIFF_STRIP_OFFS:
00410 if(count == 1){
00411 s->stripdata = NULL;
00412 s->stripoff = value;
00413 }else
00414 s->stripdata = start + off;
00415 s->strips = count;
00416 if(s->strips == 1) s->rps = s->height;
00417 s->sot = type;
00418 if(s->stripdata > end_buf){
00419 av_log(s->avctx, AV_LOG_ERROR, "Tag referencing position outside the image\n");
00420 return -1;
00421 }
00422 break;
00423 case TIFF_STRIP_SIZE:
00424 if(count == 1){
00425 s->stripsizes = NULL;
00426 s->stripsize = value;
00427 s->strips = 1;
00428 }else{
00429 s->stripsizes = start + off;
00430 }
00431 s->strips = count;
00432 s->sstype = type;
00433 if(s->stripsizes > end_buf){
00434 av_log(s->avctx, AV_LOG_ERROR, "Tag referencing position outside the image\n");
00435 return -1;
00436 }
00437 break;
00438 case TIFF_PREDICTOR:
00439 s->predictor = value;
00440 break;
00441 case TIFF_INVERT:
00442 switch(value){
00443 case 0:
00444 s->invert = 1;
00445 break;
00446 case 1:
00447 s->invert = 0;
00448 break;
00449 case 2:
00450 case 3:
00451 break;
00452 default:
00453 av_log(s->avctx, AV_LOG_ERROR, "Color mode %d is not supported\n", value);
00454 return -1;
00455 }
00456 break;
00457 case TIFF_FILL_ORDER:
00458 if(value < 1 || value > 2){
00459 av_log(s->avctx, AV_LOG_ERROR, "Unknown FillOrder value %d, trying default one\n", value);
00460 value = 1;
00461 }
00462 s->fill_order = value - 1;
00463 break;
00464 case TIFF_PAL:
00465 pal = (uint32_t *) s->palette;
00466 off = type_sizes[type];
00467 if (count / 3 > 256 || end_buf - buf < count / 3 * off * 3)
00468 return -1;
00469 rp = buf;
00470 gp = buf + count / 3 * off;
00471 bp = buf + count / 3 * off * 2;
00472 off = (type_sizes[type] - 1) << 3;
00473 for(i = 0; i < count / 3; i++){
00474 j = (tget(&rp, type, s->le) >> off) << 16;
00475 j |= (tget(&gp, type, s->le) >> off) << 8;
00476 j |= tget(&bp, type, s->le) >> off;
00477 pal[i] = j;
00478 }
00479 s->palette_is_set = 1;
00480 break;
00481 case TIFF_PLANAR:
00482 if(value == 2){
00483 av_log(s->avctx, AV_LOG_ERROR, "Planar format is not supported\n");
00484 return -1;
00485 }
00486 break;
00487 case TIFF_T4OPTIONS:
00488 if(s->compr == TIFF_G3)
00489 s->fax_opts = value;
00490 break;
00491 case TIFF_T6OPTIONS:
00492 if(s->compr == TIFF_G4)
00493 s->fax_opts = value;
00494 break;
00495 default:
00496 av_log(s->avctx, AV_LOG_DEBUG, "Unknown or unsupported tag %d/0X%0X\n", tag, tag);
00497 }
00498 return 0;
00499 }
00500
00501 static int decode_frame(AVCodecContext *avctx,
00502 void *data, int *data_size,
00503 AVPacket *avpkt)
00504 {
00505 const uint8_t *buf = avpkt->data;
00506 int buf_size = avpkt->size;
00507 TiffContext * const s = avctx->priv_data;
00508 AVFrame *picture = data;
00509 AVFrame * const p= (AVFrame*)&s->picture;
00510 const uint8_t *orig_buf = buf, *end_buf = buf + buf_size;
00511 unsigned off;
00512 int id, le, ret;
00513 int i, j, entries;
00514 int stride;
00515 unsigned soff, ssize;
00516 uint8_t *dst;
00517
00518
00519 if (end_buf - buf < 8)
00520 return AVERROR_INVALIDDATA;
00521 id = AV_RL16(buf); buf += 2;
00522 if(id == 0x4949) le = 1;
00523 else if(id == 0x4D4D) le = 0;
00524 else{
00525 av_log(avctx, AV_LOG_ERROR, "TIFF header not found\n");
00526 return -1;
00527 }
00528 s->le = le;
00529 s->invert = 0;
00530 s->compr = TIFF_RAW;
00531 s->fill_order = 0;
00532
00533
00534 if(tget_short(&buf, le) != 42){
00535 av_log(avctx, AV_LOG_ERROR, "The answer to life, universe and everything is not correct!\n");
00536 return -1;
00537 }
00538
00539 off = tget_long(&buf, le);
00540 if (off >= UINT_MAX - 14 || end_buf - orig_buf < off + 14) {
00541 av_log(avctx, AV_LOG_ERROR, "IFD offset is greater than image size\n");
00542 return AVERROR_INVALIDDATA;
00543 }
00544 buf = orig_buf + off;
00545 entries = tget_short(&buf, le);
00546 for(i = 0; i < entries; i++){
00547 if(tiff_decode_tag(s, orig_buf, buf, end_buf) < 0)
00548 return -1;
00549 buf += 12;
00550 }
00551 if(!s->stripdata && !s->stripoff){
00552 av_log(avctx, AV_LOG_ERROR, "Image data is missing\n");
00553 return -1;
00554 }
00555
00556 if ((ret = init_image(s)) < 0)
00557 return ret;
00558
00559 if(s->strips == 1 && !s->stripsize){
00560 av_log(avctx, AV_LOG_WARNING, "Image data size missing\n");
00561 s->stripsize = buf_size - s->stripoff;
00562 }
00563 stride = p->linesize[0];
00564 dst = p->data[0];
00565 for(i = 0; i < s->height; i += s->rps){
00566 if(s->stripsizes) {
00567 if (s->stripsizes >= end_buf)
00568 return AVERROR_INVALIDDATA;
00569 ssize = tget(&s->stripsizes, s->sstype, s->le);
00570 } else
00571 ssize = s->stripsize;
00572
00573 if(s->stripdata){
00574 if (s->stripdata >= end_buf)
00575 return AVERROR_INVALIDDATA;
00576 soff = tget(&s->stripdata, s->sot, s->le);
00577 }else
00578 soff = s->stripoff;
00579
00580 if (soff > buf_size || ssize > buf_size - soff) {
00581 av_log(avctx, AV_LOG_ERROR, "Invalid strip size/offset\n");
00582 return -1;
00583 }
00584 if(tiff_unpack_strip(s, dst, stride, orig_buf + soff, ssize, FFMIN(s->rps, s->height - i)) < 0)
00585 break;
00586 dst += s->rps * stride;
00587 }
00588 if(s->predictor == 2){
00589 dst = p->data[0];
00590 soff = s->bpp >> 3;
00591 ssize = s->width * soff;
00592 for(i = 0; i < s->height; i++) {
00593 for(j = soff; j < ssize; j++)
00594 dst[j] += dst[j - soff];
00595 dst += stride;
00596 }
00597 }
00598
00599 if(s->invert){
00600 uint8_t *src;
00601 int j;
00602
00603 src = s->picture.data[0];
00604 for(j = 0; j < s->height; j++){
00605 for(i = 0; i < s->picture.linesize[0]; i++)
00606 src[i] = 255 - src[i];
00607 src += s->picture.linesize[0];
00608 }
00609 }
00610 *picture= *(AVFrame*)&s->picture;
00611 *data_size = sizeof(AVPicture);
00612
00613 return buf_size;
00614 }
00615
00616 static av_cold int tiff_init(AVCodecContext *avctx){
00617 TiffContext *s = avctx->priv_data;
00618
00619 s->width = 0;
00620 s->height = 0;
00621 s->avctx = avctx;
00622 avcodec_get_frame_defaults((AVFrame*)&s->picture);
00623 avctx->coded_frame= (AVFrame*)&s->picture;
00624 ff_lzw_decode_open(&s->lzw);
00625 ff_ccitt_unpack_init();
00626
00627 return 0;
00628 }
00629
00630 static av_cold int tiff_end(AVCodecContext *avctx)
00631 {
00632 TiffContext * const s = avctx->priv_data;
00633
00634 ff_lzw_decode_close(&s->lzw);
00635 if(s->picture.data[0])
00636 avctx->release_buffer(avctx, &s->picture);
00637 return 0;
00638 }
00639
00640 AVCodec ff_tiff_decoder = {
00641 .name = "tiff",
00642 .type = AVMEDIA_TYPE_VIDEO,
00643 .id = CODEC_ID_TIFF,
00644 .priv_data_size = sizeof(TiffContext),
00645 .init = tiff_init,
00646 .close = tiff_end,
00647 .decode = decode_frame,
00648 .capabilities = CODEC_CAP_DR1,
00649 .long_name = NULL_IF_CONFIG_SMALL("TIFF image"),
00650 };