/// <summary>Processes a TIFF IFD.</summary>
/// <remarks>
/// IFD Header:
/// <list type="bullet">
/// <item><b>2 bytes</b> number of tags</item>
/// </list>
/// Tag structure:
/// <list type="bullet">
/// <item><b>2 bytes</b> tag type</item>
/// <item><b>2 bytes</b> format code (values 1 to 12, inclusive)</item>
/// <item><b>4 bytes</b> component count</item>
/// <item><b>4 bytes</b> inline value, or offset pointer if too large to fit in four bytes</item>
/// </list>
/// </remarks>
/// <param name="handler">the <see cref="ITiffHandler"/> that will coordinate processing and accept read values</param>
/// <param name="reader">the <see cref="IndexedReader"/> from which the data should be read</param>
/// <param name="processedGlobalIfdOffsets">the set of visited IFD offsets, to avoid revisiting the same IFD in an endless loop</param>
/// <param name="ifdOffset">the offset within <c>reader</c> at which the IFD data starts</param>
/// <exception cref="System.IO.IOException">an error occurred while accessing the required data</exception>
public static void ProcessIfd(ITiffHandler handler, IndexedReader reader, ICollection <int> processedGlobalIfdOffsets, int ifdOffset)
{
try
{
// Check for directories we've already visited to avoid stack overflows when recursive/cyclic directory structures exist.
// Note that we track these offsets in the global frame, not the reader's local frame.
var globalIfdOffset = reader.ToUnshiftedOffset(ifdOffset);
if (processedGlobalIfdOffsets.Contains(globalIfdOffset))
{
return;
}
// Remember that we've visited this directory so that we don't visit it again later
processedGlobalIfdOffsets.Add(globalIfdOffset);
// Validate IFD offset
if (ifdOffset >= reader.Length || ifdOffset < 0)
{
handler.Error("Ignored IFD marked to start outside data segment");
return;
}
// First two bytes in the IFD are the number of tags in this directory
int dirTagCount = reader.GetUInt16(ifdOffset);
// Some software modifies the byte order of the file, but misses some IFDs (such as makernotes).
// The entire test image repository doesn't contain a single IFD with more than 255 entries.
// Here we detect switched bytes that suggest this problem, and temporarily swap the byte order.
// This was discussed in GitHub issue #136.
if (dirTagCount > 0xFF && (dirTagCount & 0xFF) == 0)
{
dirTagCount >>= 8;
reader = reader.WithByteOrder(!reader.IsMotorolaByteOrder);
}
var dirLength = 2 + 12 * dirTagCount + 4;
if (dirLength + ifdOffset > reader.Length)
{
handler.Error("Illegally sized IFD");
return;
}
//
// Handle each tag in this directory
//
var invalidTiffFormatCodeCount = 0;
for (var tagNumber = 0; tagNumber < dirTagCount; tagNumber++)
{
var tagOffset = CalculateTagOffset(ifdOffset, tagNumber);
// 2 bytes for the tag id
int tagId = reader.GetUInt16(tagOffset);
// 2 bytes for the format code
var formatCode = (TiffDataFormatCode)reader.GetUInt16(tagOffset + 2);
// 4 bytes dictate the number of components in this tag's data
var componentCount = reader.GetUInt32(tagOffset + 4);
var format = TiffDataFormat.FromTiffFormatCode(formatCode);
long byteCount;
if (format == null)
{
if (!handler.TryCustomProcessFormat(tagId, formatCode, componentCount, out byteCount))
{
// This error suggests that we are processing at an incorrect index and will generate
// rubbish until we go out of bounds (which may be a while). Exit now.
handler.Error($"Invalid TIFF tag format code {formatCode} for tag 0x{tagId:X4}");
// TODO specify threshold as a parameter, or provide some other external control over this behaviour
if (++invalidTiffFormatCodeCount > 5)
{
handler.Error("Stopping processing as too many errors seen in TIFF IFD");
return;
}
continue;
}
}
else
{
byteCount = componentCount * format.ComponentSizeBytes;
}
long tagValueOffset;
if (byteCount > 4)
{
// If it's bigger than 4 bytes, the dir entry contains an offset.
tagValueOffset = reader.GetUInt32(tagOffset + 8);
if (tagValueOffset + byteCount > reader.Length)
{
// Bogus pointer offset and / or byteCount value
handler.Error("Illegal TIFF tag pointer offset");
continue;
}
}
else
{
// 4 bytes or less and value is in the dir entry itself.
tagValueOffset = tagOffset + 8;
}
if (tagValueOffset < 0 || tagValueOffset > reader.Length)
{
handler.Error("Illegal TIFF tag pointer offset");
continue;
}
// Check that this tag isn't going to allocate outside the bounds of the data array.
// This addresses an uncommon OutOfMemoryError.
if (byteCount < 0 || tagValueOffset + byteCount > reader.Length)
{
handler.Error("Illegal number of bytes for TIFF tag data: " + byteCount);
continue;
}
// Some tags point to one or more additional IFDs to process
var isIfdPointer = false;
if (byteCount == checked (4L * componentCount))
{
for (var i = 0; i < componentCount; i++)
{
if (handler.TryEnterSubIfd(tagId))
{
isIfdPointer = true;
var subDirOffset = reader.GetUInt32((int)(tagValueOffset + i * 4));
ProcessIfd(handler, reader, processedGlobalIfdOffsets, (int)subDirOffset);
}
}
}
// If it wasn't an IFD pointer, allow custom tag processing to occur
if (!isIfdPointer && !handler.CustomProcessTag((int)tagValueOffset, processedGlobalIfdOffsets, reader, tagId, (int)byteCount))
{
// If no custom processing occurred, process the tag in the standard fashion
ProcessTag(handler, tagId, (int)tagValueOffset, (int)componentCount, formatCode, reader);
}
}
// at the end of each IFD is an optional link to the next IFD
var finalTagOffset = CalculateTagOffset(ifdOffset, dirTagCount);
var nextIfdOffset = reader.GetInt32(finalTagOffset);
if (nextIfdOffset != 0)
{
if (nextIfdOffset >= reader.Length)
{
// Last 4 bytes of IFD reference another IFD with an address that is out of bounds
return;
}
else if (nextIfdOffset < ifdOffset)
{
// TODO is this a valid restriction?
// Last 4 bytes of IFD reference another IFD with an address that is before the start of this directory
return;
}
if (handler.HasFollowerIfd())
{
ProcessIfd(handler, reader, processedGlobalIfdOffsets, nextIfdOffset);
}
}
}
finally
{
handler.EndingIfd();
}
}
/// <summary>Processes a TIFF IFD.</summary>
/// <remarks>
/// IFD Header:
/// <list type="bullet">
/// <item><b>2 bytes</b> number of tags</item>
/// </list>
/// Tag structure:
/// <list type="bullet">
/// <item><b>2 bytes</b> tag type</item>
/// <item><b>2 bytes</b> format code (values 1 to 12, inclusive)</item>
/// <item><b>4 bytes</b> component count</item>
/// <item><b>4 bytes</b> inline value, or offset pointer if too large to fit in four bytes</item>
/// </list>
/// </remarks>
/// <param name="handler">the <see cref="ITiffHandler"/> that will coordinate processing and accept read values</param>
/// <param name="reader">the <see cref="IndexedReader"/> from which the data should be read</param>
/// <param name="processedIfdOffsets">the set of visited IFD offsets, to avoid revisiting the same IFD in an endless loop</param>
/// <param name="ifdOffset">the offset within <c>reader</c> at which the IFD data starts</param>
/// <param name="tiffHeaderOffset">the offset within <c>reader</c> at which the TIFF header starts</param>
/// <exception cref="System.IO.IOException">an error occurred while accessing the required data</exception>
public static void ProcessIfd([NotNull] ITiffHandler handler, [NotNull] IndexedReader reader, [NotNull] ICollection <int> processedIfdOffsets, int ifdOffset, int tiffHeaderOffset)
{
try
{
// check for directories we've already visited to avoid stack overflows when recursive/cyclic directory structures exist
if (processedIfdOffsets.Contains(ifdOffset))
{
return;
}
// remember that we've visited this directory so that we don't visit it again later
processedIfdOffsets.Add(ifdOffset);
if (ifdOffset >= reader.Length || ifdOffset < 0)
{
handler.Error("Ignored IFD marked to start outside data segment");
return;
}
// First two bytes in the IFD are the number of tags in this directory
int dirTagCount = reader.GetUInt16(ifdOffset);
var dirLength = (2 + (12 * dirTagCount) + 4);
if (dirLength + ifdOffset > reader.Length)
{
handler.Error("Illegally sized IFD");
return;
}
//
// Handle each tag in this directory
//
var invalidTiffFormatCodeCount = 0;
for (var tagNumber = 0; tagNumber < dirTagCount; tagNumber++)
{
var tagOffset = CalculateTagOffset(ifdOffset, tagNumber);
// 2 bytes for the tag id
int tagId = reader.GetUInt16(tagOffset);
// 2 bytes for the format code
var formatCode = (TiffDataFormatCode)reader.GetUInt16(tagOffset + 2);
var format = TiffDataFormat.FromTiffFormatCode(formatCode);
if (format == null)
{
// This error suggests that we are processing at an incorrect index and will generate
// rubbish until we go out of bounds (which may be a while). Exit now.
handler.Error("Invalid TIFF tag format code: " + formatCode);
// TODO specify threshold as a parameter, or provide some other external control over this behaviour
if (++invalidTiffFormatCodeCount > 5)
{
handler.Error("Stopping processing as too many errors seen in TIFF IFD");
return;
}
continue;
}
// 4 bytes dictate the number of components in this tag's data
var componentCount = reader.GetInt32(tagOffset + 4);
if (componentCount < 0)
{
handler.Error("Negative TIFF tag component count");
continue;
}
var byteCount = componentCount * format.ComponentSizeBytes;
int tagValueOffset;
if (byteCount > 4)
{
// If it's bigger than 4 bytes, the dir entry contains an offset.
var offsetVal = reader.GetInt32(tagOffset + 8);
if (offsetVal + byteCount > reader.Length)
{
// Bogus pointer offset and / or byteCount value
handler.Error("Illegal TIFF tag pointer offset");
continue;
}
tagValueOffset = tiffHeaderOffset + offsetVal;
}
else
{
// 4 bytes or less and value is in the dir entry itself.
tagValueOffset = tagOffset + 8;
}
if (tagValueOffset < 0 || tagValueOffset > reader.Length)
{
handler.Error("Illegal TIFF tag pointer offset");
continue;
}
// Check that this tag isn't going to allocate outside the bounds of the data array.
// This addresses an uncommon OutOfMemoryError.
if (byteCount < 0 || tagValueOffset + byteCount > reader.Length)
{
handler.Error("Illegal number of bytes for TIFF tag data: " + byteCount);
continue;
}
//
// Special handling for tags that point to other IFDs
//
if (byteCount == 4 && handler.IsTagIfdPointer(tagId))
{
var subDirOffset = tiffHeaderOffset + reader.GetInt32(tagValueOffset);
ProcessIfd(handler, reader, processedIfdOffsets, subDirOffset, tiffHeaderOffset);
}
else if (!handler.CustomProcessTag(tagValueOffset, processedIfdOffsets, tiffHeaderOffset, reader, tagId, byteCount))
{
ProcessTag(handler, tagId, tagValueOffset, componentCount, formatCode, reader);
}
}
// at the end of each IFD is an optional link to the next IFD
var finalTagOffset = CalculateTagOffset(ifdOffset, dirTagCount);
var nextIfdOffset = reader.GetInt32(finalTagOffset);
if (nextIfdOffset != 0)
{
nextIfdOffset += tiffHeaderOffset;
if (nextIfdOffset >= reader.Length)
{
// Last 4 bytes of IFD reference another IFD with an address that is out of bounds
// Note this could have been caused by jhead 1.3 cropping too much
return;
}
else if (nextIfdOffset < ifdOffset)
{
// TODO is this a valid restriction?
// Last 4 bytes of IFD reference another IFD with an address that is before the start of this directory
return;
}
if (handler.HasFollowerIfd())
{
ProcessIfd(handler, reader, processedIfdOffsets, nextIfdOffset, tiffHeaderOffset);
}
}
}
finally
{
handler.EndingIfd();
}
}
