1 /*
2  * Copyright (c) 2006 Konstantin Shishkov
3  *
4  * This file is part of FFmpeg.
5  *
6  * FFmpeg is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU Lesser General Public
8  * License as published by the Free Software Foundation; either
9  * version 2.1 of the License, or (at your option) any later version.
10  *
11  * FFmpeg is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
14  * Lesser General Public License for more details.
15  *
16  * You should have received a copy of the GNU Lesser General Public
17  * License along with FFmpeg; if not, write to the Free Software
18  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
19  */
20 
21 /**
22  * @file
23  * TIFF image decoder
24  * @author Konstantin Shishkov
25  */
26 
27 #include "config.h"
28 #if CONFIG_ZLIB
29 #include <zlib.h>
30 #endif
31 #if CONFIG_LZMA
32 #define LZMA_API_STATIC
33 #include <lzma.h>
34 #endif
35 
36 #include "libavutil/attributes.h"
37 #include "libavutil/avstring.h"
38 #include "libavutil/error.h"
39 #include "libavutil/intreadwrite.h"
40 #include "libavutil/imgutils.h"
41 #include "libavutil/opt.h"
42 #include "libavutil/reverse.h"
43 #include "avcodec.h"
44 #include "bytestream.h"
45 #include "codec_internal.h"
46 #include "faxcompr.h"
47 #include "internal.h"
48 #include "lzw.h"
49 #include "mathops.h"
50 #include "tiff.h"
51 #include "tiff_data.h"
52 #include "mjpegdec.h"
53 #include "thread.h"
54 #include "get_bits.h"
55 
56 typedef struct TiffContext {
57     AVClass *class;
58     AVCodecContext *avctx;
59     GetByteContext gb;
60 
61     /* JPEG decoding for DNG */
62     AVCodecContext *avctx_mjpeg; // wrapper context for MJPEG
63     AVPacket *jpkt;              // encoded JPEG tile
64     AVFrame *jpgframe;           // decoded JPEG tile
65 
66     int get_subimage;
67     uint16_t get_page;
68     int get_thumbnail;
69 
70     enum TiffType tiff_type;
71     int width, height;
72     unsigned int bpp, bppcount;
73     uint32_t palette[256];
74     int palette_is_set;
75     int le;
76     enum TiffCompr compr;
77     enum TiffPhotometric photometric;
78     int planar;
79     int subsampling[2];
80     int fax_opts;
81     int predictor;
82     int fill_order;
83     uint32_t res[4];
84     int is_thumbnail;
85     unsigned last_tag;
86 
87     int is_bayer;
88     uint8_t pattern[4];
89     unsigned black_level;
90     unsigned white_level;
91     uint16_t dng_lut[65536];
92 
93     uint32_t sub_ifd;
94     uint16_t cur_page;
95 
96     int strips, rps, sstype;
97     int sot;
98     int stripsizesoff, stripsize, stripoff, strippos;
99     LZWState *lzw;
100 
101     /* Tile support */
102     int is_tiled;
103     int tile_byte_counts_offset, tile_offsets_offset;
104     int tile_width, tile_length;
105 
106     int is_jpeg;
107 
108     uint8_t *deinvert_buf;
109     int deinvert_buf_size;
110     uint8_t *yuv_line;
111     unsigned int yuv_line_size;
112 
113     int geotag_count;
114     TiffGeoTag *geotags;
115 } TiffContext;
116 
tiff_set_type(TiffContext *s, enum TiffType tiff_type)117 static void tiff_set_type(TiffContext *s, enum TiffType tiff_type) {
118     if (s->tiff_type < tiff_type) // Prioritize higher-valued entries
119         s->tiff_type = tiff_type;
120 }
121 
free_geotags(TiffContext *const s)122 static void free_geotags(TiffContext *const s)
123 {
124     int i;
125     for (i = 0; i < s->geotag_count; i++) {
126         if (s->geotags[i].val)
127             av_freep(&s->geotags[i].val);
128     }
129     av_freep(&s->geotags);
130     s->geotag_count = 0;
131 }
132 
133 #define RET_GEOKEY(TYPE, array, element)\
134     if (key >= TIFF_##TYPE##_KEY_ID_OFFSET &&\
135         key - TIFF_##TYPE##_KEY_ID_OFFSET < FF_ARRAY_ELEMS(tiff_##array##_name_type_map))\
136         return tiff_##array##_name_type_map[key - TIFF_##TYPE##_KEY_ID_OFFSET].element;
137 
get_geokey_name(int key)138 static const char *get_geokey_name(int key)
139 {
140     RET_GEOKEY(VERT, vert, name);
141     RET_GEOKEY(PROJ, proj, name);
142     RET_GEOKEY(GEOG, geog, name);
143     RET_GEOKEY(CONF, conf, name);
144 
145     return NULL;
146 }
147 
get_geokey_type(int key)148 static int get_geokey_type(int key)
149 {
150     RET_GEOKEY(VERT, vert, type);
151     RET_GEOKEY(PROJ, proj, type);
152     RET_GEOKEY(GEOG, geog, type);
153     RET_GEOKEY(CONF, conf, type);
154 
155     return AVERROR_INVALIDDATA;
156 }
157 
cmp_id_key(const void *id, const void *k)158 static int cmp_id_key(const void *id, const void *k)
159 {
160     return *(const int*)id - ((const TiffGeoTagKeyName*)k)->key;
161 }
162 
search_keyval(const TiffGeoTagKeyName *keys, int n, int id)163 static const char *search_keyval(const TiffGeoTagKeyName *keys, int n, int id)
164 {
165     TiffGeoTagKeyName *r = bsearch(&id, keys, n, sizeof(keys[0]), cmp_id_key);
166     if(r)
167         return r->name;
168 
169     return NULL;
170 }
171 
get_geokey_val(int key, int val)172 static char *get_geokey_val(int key, int val)
173 {
174     char *ap;
175 
176     if (val == TIFF_GEO_KEY_UNDEFINED)
177         return av_strdup("undefined");
178     if (val == TIFF_GEO_KEY_USER_DEFINED)
179         return av_strdup("User-Defined");
180 
181 #define RET_GEOKEY_VAL(TYPE, array)\
182     if (val >= TIFF_##TYPE##_OFFSET &&\
183         val - TIFF_##TYPE##_OFFSET < FF_ARRAY_ELEMS(tiff_##array##_codes))\
184         return av_strdup(tiff_##array##_codes[val - TIFF_##TYPE##_OFFSET]);
185 
186     switch (key) {
187     case TIFF_GT_MODEL_TYPE_GEOKEY:
188         RET_GEOKEY_VAL(GT_MODEL_TYPE, gt_model_type);
189         break;
190     case TIFF_GT_RASTER_TYPE_GEOKEY:
191         RET_GEOKEY_VAL(GT_RASTER_TYPE, gt_raster_type);
192         break;
193     case TIFF_GEOG_LINEAR_UNITS_GEOKEY:
194     case TIFF_PROJ_LINEAR_UNITS_GEOKEY:
195     case TIFF_VERTICAL_UNITS_GEOKEY:
196         RET_GEOKEY_VAL(LINEAR_UNIT, linear_unit);
197         break;
198     case TIFF_GEOG_ANGULAR_UNITS_GEOKEY:
199     case TIFF_GEOG_AZIMUTH_UNITS_GEOKEY:
200         RET_GEOKEY_VAL(ANGULAR_UNIT, angular_unit);
201         break;
202     case TIFF_GEOGRAPHIC_TYPE_GEOKEY:
203         RET_GEOKEY_VAL(GCS_TYPE, gcs_type);
204         RET_GEOKEY_VAL(GCSE_TYPE, gcse_type);
205         break;
206     case TIFF_GEOG_GEODETIC_DATUM_GEOKEY:
207         RET_GEOKEY_VAL(GEODETIC_DATUM, geodetic_datum);
208         RET_GEOKEY_VAL(GEODETIC_DATUM_E, geodetic_datum_e);
209         break;
210     case TIFF_GEOG_ELLIPSOID_GEOKEY:
211         RET_GEOKEY_VAL(ELLIPSOID, ellipsoid);
212         break;
213     case TIFF_GEOG_PRIME_MERIDIAN_GEOKEY:
214         RET_GEOKEY_VAL(PRIME_MERIDIAN, prime_meridian);
215         break;
216     case TIFF_PROJECTED_CS_TYPE_GEOKEY:
217         ap = av_strdup(search_keyval(tiff_proj_cs_type_codes, FF_ARRAY_ELEMS(tiff_proj_cs_type_codes), val));
218         if(ap) return ap;
219         break;
220     case TIFF_PROJECTION_GEOKEY:
221         ap = av_strdup(search_keyval(tiff_projection_codes, FF_ARRAY_ELEMS(tiff_projection_codes), val));
222         if(ap) return ap;
223         break;
224     case TIFF_PROJ_COORD_TRANS_GEOKEY:
225         RET_GEOKEY_VAL(COORD_TRANS, coord_trans);
226         break;
227     case TIFF_VERTICAL_CS_TYPE_GEOKEY:
228         RET_GEOKEY_VAL(VERT_CS, vert_cs);
229         RET_GEOKEY_VAL(ORTHO_VERT_CS, ortho_vert_cs);
230         break;
231 
232     }
233 
234     ap = av_malloc(14);
235     if (ap)
236         snprintf(ap, 14, "Unknown-%d", val);
237     return ap;
238 }
239 
doubles2str(double *dp, int count, const char *sep)240 static char *doubles2str(double *dp, int count, const char *sep)
241 {
242     int i;
243     char *ap, *ap0;
244     uint64_t component_len;
245     if (!sep) sep = ", ";
246     component_len = 24LL + strlen(sep);
247     if (count >= (INT_MAX - 1)/component_len)
248         return NULL;
249     ap = av_malloc(component_len * count + 1);
250     if (!ap)
251         return NULL;
252     ap0   = ap;
253     ap[0] = '\0';
254     for (i = 0; i < count; i++) {
255         unsigned l = snprintf(ap, component_len, "%.15g%s", dp[i], sep);
256         if(l >= component_len) {
257             av_free(ap0);
258             return NULL;
259         }
260         ap += l;
261     }
262     ap0[strlen(ap0) - strlen(sep)] = '\0';
263     return ap0;
264 }
265 
add_metadata(int count, int type, const char *name, const char *sep, TiffContext *s, AVFrame *frame)266 static int add_metadata(int count, int type,
267                         const char *name, const char *sep, TiffContext *s, AVFrame *frame)
268 {
269     switch(type) {
270     case TIFF_DOUBLE: return ff_tadd_doubles_metadata(count, name, sep, &s->gb, s->le, &frame->metadata);
271     case TIFF_SHORT : return ff_tadd_shorts_metadata(count, name, sep, &s->gb, s->le, 0, &frame->metadata);
272     case TIFF_STRING: return ff_tadd_string_metadata(count, name, &s->gb, s->le, &frame->metadata);
273     default         : return AVERROR_INVALIDDATA;
274     };
275 }
276 
277 /**
278  * Map stored raw sensor values into linear reference values (see: DNG Specification - Chapter 5)
279  */
dng_process_color16(uint16_t value, const uint16_t *lut, uint16_t black_level, float scale_factor)280 static uint16_t av_always_inline dng_process_color16(uint16_t value,
281                                                      const uint16_t *lut,
282                                                      uint16_t black_level,
283                                                      float scale_factor)
284 {
285     float value_norm;
286 
287     // Lookup table lookup
288     if (lut)
289         value = lut[value];
290 
291     // Black level subtraction
292     value = av_clip_uint16_c((unsigned)value - black_level);
293 
294     // Color scaling
295     value_norm = (float)value * scale_factor;
296 
297     value = av_clip_uint16_c(value_norm * 65535);
298 
299     return value;
300 }
301 
dng_process_color8(uint16_t value, const uint16_t *lut, uint16_t black_level, float scale_factor)302 static uint16_t av_always_inline dng_process_color8(uint16_t value,
303                                                     const uint16_t *lut,
304                                                     uint16_t black_level,
305                                                     float scale_factor)
306 {
307     return dng_process_color16(value, lut, black_level, scale_factor) >> 8;
308 }
309 
dng_blit(TiffContext *s, uint8_t *dst, int dst_stride, const uint8_t *src, int src_stride, int width, int height, int is_single_comp, int is_u16)310 static void av_always_inline dng_blit(TiffContext *s, uint8_t *dst, int dst_stride,
311                                       const uint8_t *src, int src_stride, int width, int height,
312                                       int is_single_comp, int is_u16)
313 {
314     int line, col;
315     float scale_factor;
316 
317     scale_factor = 1.0f / (s->white_level - s->black_level);
318 
319     if (is_single_comp) {
320         if (!is_u16)
321             return; /* <= 8bpp unsupported */
322 
323         /* Image is double the width and half the height we need, each row comprises 2 rows of the output
324            (split vertically in the middle). */
325         for (line = 0; line < height / 2; line++) {
326             uint16_t *dst_u16 = (uint16_t *)dst;
327             uint16_t *src_u16 = (uint16_t *)src;
328 
329             /* Blit first half of input row row to initial row of output */
330             for (col = 0; col < width; col++)
331                 *dst_u16++ = dng_process_color16(*src_u16++, s->dng_lut, s->black_level, scale_factor);
332 
333             /* Advance the destination pointer by a row (source pointer remains in the same place) */
334             dst += dst_stride * sizeof(uint16_t);
335             dst_u16 = (uint16_t *)dst;
336 
337             /* Blit second half of input row row to next row of output */
338             for (col = 0; col < width; col++)
339                 *dst_u16++ = dng_process_color16(*src_u16++, s->dng_lut, s->black_level, scale_factor);
340 
341             dst += dst_stride * sizeof(uint16_t);
342             src += src_stride * sizeof(uint16_t);
343         }
344     } else {
345         /* Input and output image are the same size and the MJpeg decoder has done per-component
346            deinterleaving, so blitting here is straightforward. */
347         if (is_u16) {
348             for (line = 0; line < height; line++) {
349                 uint16_t *dst_u16 = (uint16_t *)dst;
350                 uint16_t *src_u16 = (uint16_t *)src;
351 
352                 for (col = 0; col < width; col++)
353                     *dst_u16++ = dng_process_color16(*src_u16++, s->dng_lut, s->black_level, scale_factor);
354 
355                 dst += dst_stride * sizeof(uint16_t);
356                 src += src_stride * sizeof(uint16_t);
357             }
358         } else {
359             for (line = 0; line < height; line++) {
360                 uint8_t *dst_u8 = dst;
361                 const uint8_t *src_u8 = src;
362 
363                 for (col = 0; col < width; col++)
364                     *dst_u8++ = dng_process_color8(*src_u8++, s->dng_lut, s->black_level, scale_factor);
365 
366                 dst += dst_stride;
367                 src += src_stride;
368             }
369         }
370     }
371 }
372 
horizontal_fill(TiffContext *s, unsigned int bpp, uint8_t* dst, int usePtr, const uint8_t *src, uint8_t c, int width, int offset)373 static void av_always_inline horizontal_fill(TiffContext *s,
374                                              unsigned int bpp, uint8_t* dst,
375                                              int usePtr, const uint8_t *src,
376                                              uint8_t c, int width, int offset)
377 {
378     switch (bpp) {
379     case 1:
380         while (--width >= 0) {
381             dst[(width+offset)*8+7] = (usePtr ? src[width] : c)      & 0x1;
382             dst[(width+offset)*8+6] = (usePtr ? src[width] : c) >> 1 & 0x1;
383             dst[(width+offset)*8+5] = (usePtr ? src[width] : c) >> 2 & 0x1;
384             dst[(width+offset)*8+4] = (usePtr ? src[width] : c) >> 3 & 0x1;
385             dst[(width+offset)*8+3] = (usePtr ? src[width] : c) >> 4 & 0x1;
386             dst[(width+offset)*8+2] = (usePtr ? src[width] : c) >> 5 & 0x1;
387             dst[(width+offset)*8+1] = (usePtr ? src[width] : c) >> 6 & 0x1;
388             dst[(width+offset)*8+0] = (usePtr ? src[width] : c) >> 7;
389         }
390         break;
391     case 2:
392         while (--width >= 0) {
393             dst[(width+offset)*4+3] = (usePtr ? src[width] : c) & 0x3;
394             dst[(width+offset)*4+2] = (usePtr ? src[width] : c) >> 2 & 0x3;
395             dst[(width+offset)*4+1] = (usePtr ? src[width] : c) >> 4 & 0x3;
396             dst[(width+offset)*4+0] = (usePtr ? src[width] : c) >> 6;
397         }
398         break;
399     case 4:
400         while (--width >= 0) {
401             dst[(width+offset)*2+1] = (usePtr ? src[width] : c) & 0xF;
402             dst[(width+offset)*2+0] = (usePtr ? src[width] : c) >> 4;
403         }
404         break;
405     case 10:
406     case 12:
407     case 14: {
408             uint16_t *dst16 = (uint16_t *)dst;
409             int is_dng = (s->tiff_type == TIFF_TYPE_DNG || s->tiff_type == TIFF_TYPE_CINEMADNG);
410             uint8_t shift = is_dng ? 0 : 16 - bpp;
411             GetBitContext gb;
412 
413             init_get_bits8(&gb, src, width);
414             for (int i = 0; i < s->width; i++) {
415                 dst16[i] = get_bits(&gb, bpp) << shift;
416             }
417         }
418         break;
419     default:
420         if (usePtr) {
421             memcpy(dst + offset, src, width);
422         } else {
423             memset(dst + offset, c, width);
424         }
425     }
426 }
427 
deinvert_buffer(TiffContext *s, const uint8_t *src, int size)428 static int deinvert_buffer(TiffContext *s, const uint8_t *src, int size)
429 {
430     int i;
431 
432     av_fast_padded_malloc(&s->deinvert_buf, &s->deinvert_buf_size, size);
433     if (!s->deinvert_buf)
434         return AVERROR(ENOMEM);
435     for (i = 0; i < size; i++)
436         s->deinvert_buf[i] = ff_reverse[src[i]];
437 
438     return 0;
439 }
440 
unpack_gray(TiffContext *s, AVFrame *p, const uint8_t *src, int lnum, int width, int bpp)441 static void unpack_gray(TiffContext *s, AVFrame *p,
442                        const uint8_t *src, int lnum, int width, int bpp)
443 {
444     GetBitContext gb;
445     uint16_t *dst = (uint16_t *)(p->data[0] + lnum * p->linesize[0]);
446 
447     init_get_bits8(&gb, src, width);
448 
449     for (int i = 0; i < s->width; i++) {
450         dst[i] = get_bits(&gb, bpp);
451     }
452 }
453 
unpack_yuv(TiffContext *s, AVFrame *p, const uint8_t *src, int lnum)454 static void unpack_yuv(TiffContext *s, AVFrame *p,
455                        const uint8_t *src, int lnum)
456 {
457     int i, j, k;
458     int w       = (s->width - 1) / s->subsampling[0] + 1;
459     uint8_t *pu = &p->data[1][lnum / s->subsampling[1] * p->linesize[1]];
460     uint8_t *pv = &p->data[2][lnum / s->subsampling[1] * p->linesize[2]];
461     if (s->width % s->subsampling[0] || s->height % s->subsampling[1]) {
462         for (i = 0; i < w; i++) {
463             for (j = 0; j < s->subsampling[1]; j++)
464                 for (k = 0; k < s->subsampling[0]; k++)
465                     p->data[0][FFMIN(lnum + j, s->height-1) * p->linesize[0] +
466                                FFMIN(i * s->subsampling[0] + k, s->width-1)] = *src++;
467             *pu++ = *src++;
468             *pv++ = *src++;
469         }
470     }else{
471         for (i = 0; i < w; i++) {
472             for (j = 0; j < s->subsampling[1]; j++)
473                 for (k = 0; k < s->subsampling[0]; k++)
474                     p->data[0][(lnum + j) * p->linesize[0] +
475                                i * s->subsampling[0] + k] = *src++;
476             *pu++ = *src++;
477             *pv++ = *src++;
478         }
479     }
480 }
481 
482 #if CONFIG_ZLIB
tiff_uncompress(uint8_t *dst, unsigned long *len, const uint8_t *src, int size)483 static int tiff_uncompress(uint8_t *dst, unsigned long *len, const uint8_t *src,
484                            int size)
485 {
486     z_stream zstream = { 0 };
487     int zret;
488 
489     zstream.next_in   = src;
490     zstream.avail_in  = size;
491     zstream.next_out  = dst;
492     zstream.avail_out = *len;
493     zret              = inflateInit(&zstream);
494     if (zret != Z_OK) {
495         av_log(NULL, AV_LOG_ERROR, "Inflate init error: %d\n", zret);
496         return zret;
497     }
498     zret = inflate(&zstream, Z_SYNC_FLUSH);
499     inflateEnd(&zstream);
500     *len = zstream.total_out;
501     return zret == Z_STREAM_END ? Z_OK : zret;
502 }
503 
tiff_unpack_zlib(TiffContext *s, AVFrame *p, uint8_t *dst, int stride, const uint8_t *src, int size, int width, int lines, int strip_start, int is_yuv)504 static int tiff_unpack_zlib(TiffContext *s, AVFrame *p, uint8_t *dst, int stride,
505                             const uint8_t *src, int size, int width, int lines,
506                             int strip_start, int is_yuv)
507 {
508     uint8_t *zbuf;
509     unsigned long outlen;
510     int ret, line;
511     outlen = width * lines;
512     zbuf   = av_malloc(outlen);
513     if (!zbuf)
514         return AVERROR(ENOMEM);
515     if (s->fill_order) {
516         if ((ret = deinvert_buffer(s, src, size)) < 0) {
517             av_free(zbuf);
518             return ret;
519         }
520         src = s->deinvert_buf;
521     }
522     ret = tiff_uncompress(zbuf, &outlen, src, size);
523     if (ret != Z_OK) {
524         av_log(s->avctx, AV_LOG_ERROR,
525                "Uncompressing failed (%lu of %lu) with error %d\n", outlen,
526                (unsigned long)width * lines, ret);
527         av_free(zbuf);
528         return AVERROR_UNKNOWN;
529     }
530     src = zbuf;
531     for (line = 0; line < lines; line++) {
532         if (s->bpp < 8 && s->avctx->pix_fmt == AV_PIX_FMT_PAL8) {
533             horizontal_fill(s, s->bpp, dst, 1, src, 0, width, 0);
534         } else {
535             memcpy(dst, src, width);
536         }
537         if (is_yuv) {
538             unpack_yuv(s, p, dst, strip_start + line);
539             line += s->subsampling[1] - 1;
540         }
541         dst += stride;
542         src += width;
543     }
544     av_free(zbuf);
545     return 0;
546 }
547 #endif
548 
549 #if CONFIG_LZMA
tiff_uncompress_lzma(uint8_t *dst, uint64_t *len, const uint8_t *src, int size)550 static int tiff_uncompress_lzma(uint8_t *dst, uint64_t *len, const uint8_t *src,
551                                 int size)
552 {
553     lzma_stream stream = LZMA_STREAM_INIT;
554     lzma_ret ret;
555 
556     stream.next_in   = (uint8_t *)src;
557     stream.avail_in  = size;
558     stream.next_out  = dst;
559     stream.avail_out = *len;
560     ret              = lzma_stream_decoder(&stream, UINT64_MAX, 0);
561     if (ret != LZMA_OK) {
562         av_log(NULL, AV_LOG_ERROR, "LZMA init error: %d\n", ret);
563         return ret;
564     }
565     ret = lzma_code(&stream, LZMA_RUN);
566     lzma_end(&stream);
567     *len = stream.total_out;
568     return ret == LZMA_STREAM_END ? LZMA_OK : ret;
569 }
570 
tiff_unpack_lzma(TiffContext *s, AVFrame *p, uint8_t *dst, int stride, const uint8_t *src, int size, int width, int lines, int strip_start, int is_yuv)571 static int tiff_unpack_lzma(TiffContext *s, AVFrame *p, uint8_t *dst, int stride,
572                             const uint8_t *src, int size, int width, int lines,
573                             int strip_start, int is_yuv)
574 {
575     uint64_t outlen = width * (uint64_t)lines;
576     int ret, line;
577     uint8_t *buf = av_malloc(outlen);
578     if (!buf)
579         return AVERROR(ENOMEM);
580     if (s->fill_order) {
581         if ((ret = deinvert_buffer(s, src, size)) < 0) {
582             av_free(buf);
583             return ret;
584         }
585         src = s->deinvert_buf;
586     }
587     ret = tiff_uncompress_lzma(buf, &outlen, src, size);
588     if (ret != LZMA_OK) {
589         av_log(s->avctx, AV_LOG_ERROR,
590                "Uncompressing failed (%"PRIu64" of %"PRIu64") with error %d\n", outlen,
591                (uint64_t)width * lines, ret);
592         av_free(buf);
593         return AVERROR_UNKNOWN;
594     }
595     src = buf;
596     for (line = 0; line < lines; line++) {
597         if (s->bpp < 8 && s->avctx->pix_fmt == AV_PIX_FMT_PAL8) {
598             horizontal_fill(s, s->bpp, dst, 1, src, 0, width, 0);
599         } else {
600             memcpy(dst, src, width);
601         }
602         if (is_yuv) {
603             unpack_yuv(s, p, dst, strip_start + line);
604             line += s->subsampling[1] - 1;
605         }
606         dst += stride;
607         src += width;
608     }
609     av_free(buf);
610     return 0;
611 }
612 #endif
613 
tiff_unpack_fax(TiffContext *s, uint8_t *dst, int stride, const uint8_t *src, int size, int width, int lines)614 static int tiff_unpack_fax(TiffContext *s, uint8_t *dst, int stride,
615                            const uint8_t *src, int size, int width, int lines)
616 {
617     int line;
618     int ret;
619 
620     if (s->fill_order) {
621         if ((ret = deinvert_buffer(s, src, size)) < 0)
622             return ret;
623         src = s->deinvert_buf;
624     }
625     ret = ff_ccitt_unpack(s->avctx, src, size, dst, lines, stride,
626                           s->compr, s->fax_opts);
627     if (s->bpp < 8 && s->avctx->pix_fmt == AV_PIX_FMT_PAL8)
628         for (line = 0; line < lines; line++) {
629             horizontal_fill(s, s->bpp, dst, 1, dst, 0, width, 0);
630             dst += stride;
631         }
632     return ret;
633 }
634 
dng_decode_jpeg(AVCodecContext *avctx, AVFrame *frame, int tile_byte_count, int dst_x, int dst_y, int w, int h)635 static int dng_decode_jpeg(AVCodecContext *avctx, AVFrame *frame,
636                            int tile_byte_count, int dst_x, int dst_y, int w, int h)
637 {
638     TiffContext *s = avctx->priv_data;
639     uint8_t *dst_data, *src_data;
640     uint32_t dst_offset; /* offset from dst buffer in pixels */
641     int is_single_comp, is_u16, pixel_size;
642     int ret;
643 
644     if (tile_byte_count < 0 || tile_byte_count > bytestream2_get_bytes_left(&s->gb))
645         return AVERROR_INVALIDDATA;
646 
647     /* Prepare a packet and send to the MJPEG decoder */
648     av_packet_unref(s->jpkt);
649     s->jpkt->data = (uint8_t*)s->gb.buffer;
650     s->jpkt->size = tile_byte_count;
651 
652     if (s->is_bayer) {
653         MJpegDecodeContext *mjpegdecctx = s->avctx_mjpeg->priv_data;
654         /* We have to set this information here, there is no way to know if a given JPEG is a DNG-embedded
655            image or not from its own data (and we need that information when decoding it). */
656         mjpegdecctx->bayer = 1;
657     }
658 
659     ret = avcodec_send_packet(s->avctx_mjpeg, s->jpkt);
660     if (ret < 0) {
661         av_log(avctx, AV_LOG_ERROR, "Error submitting a packet for decoding\n");
662         return ret;
663     }
664 
665     ret = avcodec_receive_frame(s->avctx_mjpeg, s->jpgframe);
666     if (ret < 0) {
667         av_log(avctx, AV_LOG_ERROR, "JPEG decoding error: %s.\n", av_err2str(ret));
668 
669         /* Normally skip, error if explode */
670         if (avctx->err_recognition & AV_EF_EXPLODE)
671             return AVERROR_INVALIDDATA;
672         else
673             return 0;
674     }
675 
676     is_u16 = (s->bpp > 8);
677 
678     /* Copy the outputted tile's pixels from 'jpgframe' to 'frame' (final buffer) */
679 
680     if (s->jpgframe->width  != s->avctx_mjpeg->width  ||
681         s->jpgframe->height != s->avctx_mjpeg->height ||
682         s->jpgframe->format != s->avctx_mjpeg->pix_fmt)
683         return AVERROR_INVALIDDATA;
684 
685     /* See dng_blit for explanation */
686     if (s->avctx_mjpeg->width  == w * 2 &&
687         s->avctx_mjpeg->height == h / 2 &&
688         s->avctx_mjpeg->pix_fmt == AV_PIX_FMT_GRAY16LE) {
689         is_single_comp = 1;
690     } else if (s->avctx_mjpeg->width  >= w &&
691                s->avctx_mjpeg->height >= h &&
692                s->avctx_mjpeg->pix_fmt == (is_u16 ? AV_PIX_FMT_GRAY16 : AV_PIX_FMT_GRAY8)
693               ) {
694         is_single_comp = 0;
695     } else
696         return AVERROR_INVALIDDATA;
697 
698     pixel_size = (is_u16 ? sizeof(uint16_t) : sizeof(uint8_t));
699 
700     if (is_single_comp && !is_u16) {
701         av_log(s->avctx, AV_LOG_ERROR, "DNGs with bpp <= 8 and 1 component are unsupported\n");
702         av_frame_unref(s->jpgframe);
703         return AVERROR_PATCHWELCOME;
704     }
705 
706     dst_offset = dst_x + frame->linesize[0] * dst_y / pixel_size;
707     dst_data = frame->data[0] + dst_offset * pixel_size;
708     src_data = s->jpgframe->data[0];
709 
710     dng_blit(s,
711              dst_data,
712              frame->linesize[0] / pixel_size,
713              src_data,
714              s->jpgframe->linesize[0] / pixel_size,
715              w,
716              h,
717              is_single_comp,
718              is_u16);
719 
720     av_frame_unref(s->jpgframe);
721 
722     return 0;
723 }
724 
tiff_unpack_strip(TiffContext *s, AVFrame *p, uint8_t *dst, int stride, const uint8_t *src, int size, int strip_start, int lines)725 static int tiff_unpack_strip(TiffContext *s, AVFrame *p, uint8_t *dst, int stride,
726                              const uint8_t *src, int size, int strip_start, int lines)
727 {
728     PutByteContext pb;
729     int c, line, pixels, code, ret;
730     const uint8_t *ssrc = src;
731     int width = ((s->width * s->bpp) + 7) >> 3;
732     const AVPixFmtDescriptor *desc = av_pix_fmt_desc_get(p->format);
733     int is_yuv = !(desc->flags & AV_PIX_FMT_FLAG_RGB) &&
734                  (desc->flags & AV_PIX_FMT_FLAG_PLANAR) &&
735                  desc->nb_components >= 3;
736     int is_dng;
737 
738     if (s->planar)
739         width /= s->bppcount;
740 
741     if (size <= 0)
742         return AVERROR_INVALIDDATA;
743 
744     if (is_yuv) {
745         int bytes_per_row = (((s->width - 1) / s->subsampling[0] + 1) * s->bpp *
746                             s->subsampling[0] * s->subsampling[1] + 7) >> 3;
747         av_fast_padded_malloc(&s->yuv_line, &s->yuv_line_size, bytes_per_row);
748         if (s->yuv_line == NULL) {
749             av_log(s->avctx, AV_LOG_ERROR, "Not enough memory\n");
750             return AVERROR(ENOMEM);
751         }
752         dst = s->yuv_line;
753         stride = 0;
754 
755         width = (s->width - 1) / s->subsampling[0] + 1;
756         width = width * s->subsampling[0] * s->subsampling[1] + 2*width;
757         av_assert0(width <= bytes_per_row);
758         av_assert0(s->bpp == 24);
759     }
760     if (s->is_bayer) {
761         av_assert0(width == (s->bpp * s->width + 7) >> 3);
762     }
763     av_assert0(!(s->is_bayer && is_yuv));
764     if (p->format == AV_PIX_FMT_GRAY12) {
765         av_fast_padded_malloc(&s->yuv_line, &s->yuv_line_size, width);
766         if (s->yuv_line == NULL) {
767             av_log(s->avctx, AV_LOG_ERROR, "Not enough memory\n");
768             return AVERROR(ENOMEM);
769         }
770         dst = s->yuv_line;
771         stride = 0;
772     }
773 
774     if (s->compr == TIFF_DEFLATE || s->compr == TIFF_ADOBE_DEFLATE) {
775 #if CONFIG_ZLIB
776         return tiff_unpack_zlib(s, p, dst, stride, src, size, width, lines,
777                                 strip_start, is_yuv);
778 #else
779         av_log(s->avctx, AV_LOG_ERROR,
780                "zlib support not enabled, "
781                "deflate compression not supported\n");
782         return AVERROR(ENOSYS);
783 #endif
784     }
785     if (s->compr == TIFF_LZMA) {
786 #if CONFIG_LZMA
787         return tiff_unpack_lzma(s, p, dst, stride, src, size, width, lines,
788                                 strip_start, is_yuv);
789 #else
790         av_log(s->avctx, AV_LOG_ERROR,
791                "LZMA support not enabled\n");
792         return AVERROR(ENOSYS);
793 #endif
794     }
795     if (s->compr == TIFF_LZW) {
796         if (s->fill_order) {
797             if ((ret = deinvert_buffer(s, src, size)) < 0)
798                 return ret;
799             ssrc = src = s->deinvert_buf;
800         }
801         if (size > 1 && !src[0] && (src[1]&1)) {
802             av_log(s->avctx, AV_LOG_ERROR, "Old style LZW is unsupported\n");
803         }
804         if ((ret = ff_lzw_decode_init(s->lzw, 8, src, size, FF_LZW_TIFF)) < 0) {
805             av_log(s->avctx, AV_LOG_ERROR, "Error initializing LZW decoder\n");
806             return ret;
807         }
808         for (line = 0; line < lines; line++) {
809             pixels = ff_lzw_decode(s->lzw, dst, width);
810             if (pixels < width) {
811                 av_log(s->avctx, AV_LOG_ERROR, "Decoded only %i bytes of %i\n",
812                        pixels, width);
813                 return AVERROR_INVALIDDATA;
814             }
815             if (s->bpp < 8 && s->avctx->pix_fmt == AV_PIX_FMT_PAL8)
816                 horizontal_fill(s, s->bpp, dst, 1, dst, 0, width, 0);
817             if (is_yuv) {
818                 unpack_yuv(s, p, dst, strip_start + line);
819                 line += s->subsampling[1] - 1;
820             } else if (p->format == AV_PIX_FMT_GRAY12) {
821                 unpack_gray(s, p, dst, strip_start + line, width, s->bpp);
822             }
823             dst += stride;
824         }
825         return 0;
826     }
827     if (s->compr == TIFF_CCITT_RLE ||
828         s->compr == TIFF_G3        ||
829         s->compr == TIFF_G4) {
830         if (is_yuv || p->format == AV_PIX_FMT_GRAY12)
831             return AVERROR_INVALIDDATA;
832 
833         return tiff_unpack_fax(s, dst, stride, src, size, width, lines);
834     }
835 
836     bytestream2_init(&s->gb, src, size);
837     bytestream2_init_writer(&pb, dst, is_yuv ? s->yuv_line_size : (stride * lines));
838 
839     is_dng = (s->tiff_type == TIFF_TYPE_DNG || s->tiff_type == TIFF_TYPE_CINEMADNG);
840 
841     /* Decode JPEG-encoded DNGs with strips */
842     if (s->compr == TIFF_NEWJPEG && is_dng) {
843         if (s->strips > 1) {
844             av_log(s->avctx, AV_LOG_ERROR, "More than one DNG JPEG strips unsupported\n");
845             return AVERROR_PATCHWELCOME;
846         }
847         if (!s->is_bayer)
848             return AVERROR_PATCHWELCOME;
849         if ((ret = dng_decode_jpeg(s->avctx, p, s->stripsize, 0, 0, s->width, s->height)) < 0)
850             return ret;
851         return 0;
852     }
853 
854     if (is_dng && stride == 0)
855         return AVERROR_INVALIDDATA;
856 
857     for (line = 0; line < lines; line++) {
858         if (src - ssrc > size) {
859             av_log(s->avctx, AV_LOG_ERROR, "Source data overread\n");
860             return AVERROR_INVALIDDATA;
861         }
862 
863         if (bytestream2_get_bytes_left(&s->gb) == 0 || bytestream2_get_eof(&pb))
864             break;
865         bytestream2_seek_p(&pb, stride * line, SEEK_SET);
866         switch (s->compr) {
867         case TIFF_RAW:
868             if (ssrc + size - src < width)
869                 return AVERROR_INVALIDDATA;
870 
871             if (!s->fill_order) {
872                 horizontal_fill(s, s->bpp * (s->avctx->pix_fmt == AV_PIX_FMT_PAL8 || s->is_bayer),
873                                 dst, 1, src, 0, width, 0);
874             } else {
875                 int i;
876                 for (i = 0; i < width; i++)
877                     dst[i] = ff_reverse[src[i]];
878             }
879 
880             /* Color processing for DNG images with uncompressed strips (non-tiled) */
881             if (is_dng) {
882                 int is_u16, pixel_size_bytes, pixel_size_bits, elements;
883 
884                 is_u16 = (s->bpp / s->bppcount > 8);
885                 pixel_size_bits = (is_u16 ? 16 : 8);
886                 pixel_size_bytes = (is_u16 ? sizeof(uint16_t) : sizeof(uint8_t));
887 
888                 elements = width / pixel_size_bytes * pixel_size_bits / s->bpp * s->bppcount; // need to account for [1, 16] bpp
889                 av_assert0 (elements * pixel_size_bytes <= FFABS(stride));
890                 dng_blit(s,
891                          dst,
892                          0, // no stride, only 1 line
893                          dst,
894                          0, // no stride, only 1 line
895                          elements,
896                          1,
897                          0, // single-component variation is only preset in JPEG-encoded DNGs
898                          is_u16);
899             }
900 
901             src += width;
902             break;
903         case TIFF_PACKBITS:
904             for (pixels = 0; pixels < width;) {
905                 if (ssrc + size - src < 2) {
906                     av_log(s->avctx, AV_LOG_ERROR, "Read went out of bounds\n");
907                     return AVERROR_INVALIDDATA;
908                 }
909                 code = s->fill_order ? (int8_t) ff_reverse[*src++]: (int8_t) *src++;
910                 if (code >= 0) {
911                     code++;
912                     if (pixels + code > width ||
913                         ssrc + size - src < code) {
914                         av_log(s->avctx, AV_LOG_ERROR,
915                                "Copy went out of bounds\n");
916                         return AVERROR_INVALIDDATA;
917                     }
918                     horizontal_fill(s, s->bpp * (s->avctx->pix_fmt == AV_PIX_FMT_PAL8),
919                                     dst, 1, src, 0, code, pixels);
920                     src    += code;
921                     pixels += code;
922                 } else if (code != -128) { // -127..-1
923                     code = (-code) + 1;
924                     if (pixels + code > width) {
925                         av_log(s->avctx, AV_LOG_ERROR,
926                                "Run went out of bounds\n");
927                         return AVERROR_INVALIDDATA;
928                     }
929                     c = *src++;
930                     horizontal_fill(s, s->bpp * (s->avctx->pix_fmt == AV_PIX_FMT_PAL8),
931                                     dst, 0, NULL, c, code, pixels);
932                     pixels += code;
933                 }
934             }
935             if (s->fill_order) {
936                 int i;
937                 for (i = 0; i < width; i++)
938                     dst[i] = ff_reverse[dst[i]];
939             }
940             break;
941         }
942         if (is_yuv) {
943             unpack_yuv(s, p, dst, strip_start + line);
944             line += s->subsampling[1] - 1;
945         } else if (p->format == AV_PIX_FMT_GRAY12) {
946             unpack_gray(s, p, dst, strip_start + line, width, s->bpp);
947         }
948         dst += stride;
949     }
950     return 0;
951 }
952 
dng_decode_tiles(AVCodecContext *avctx, AVFrame *frame, const AVPacket *avpkt)953 static int dng_decode_tiles(AVCodecContext *avctx, AVFrame *frame,
954                             const AVPacket *avpkt)
955 {
956     TiffContext *s = avctx->priv_data;
957     int tile_idx;
958     int tile_offset_offset, tile_offset;
959     int tile_byte_count_offset, tile_byte_count;
960     int tile_count_x, tile_count_y;
961     int tile_width, tile_length;
962     int has_width_leftover, has_height_leftover;
963     int tile_x = 0, tile_y = 0;
964     int pos_x = 0, pos_y = 0;
965     int ret;
966 
967     if (s->tile_width <= 0 || s->tile_length <= 0)
968         return AVERROR_INVALIDDATA;
969 
970     has_width_leftover = (s->width % s->tile_width != 0);
971     has_height_leftover = (s->height % s->tile_length != 0);
972 
973     /* Calculate tile counts (round up) */
974     tile_count_x = (s->width + s->tile_width - 1) / s->tile_width;
975     tile_count_y = (s->height + s->tile_length - 1) / s->tile_length;
976 
977     /* Iterate over the number of tiles */
978     for (tile_idx = 0; tile_idx < tile_count_x * tile_count_y; tile_idx++) {
979         tile_x = tile_idx % tile_count_x;
980         tile_y = tile_idx / tile_count_x;
981 
982         if (has_width_leftover && tile_x == tile_count_x - 1) // If on the right-most tile
983             tile_width = s->width % s->tile_width;
984         else
985             tile_width = s->tile_width;
986 
987         if (has_height_leftover && tile_y == tile_count_y - 1) // If on the bottom-most tile
988             tile_length = s->height % s->tile_length;
989         else
990             tile_length = s->tile_length;
991 
992         /* Read tile offset */
993         tile_offset_offset = s->tile_offsets_offset + tile_idx * sizeof(int);
994         bytestream2_seek(&s->gb, tile_offset_offset, SEEK_SET);
995         tile_offset = ff_tget_long(&s->gb, s->le);
996 
997         /* Read tile byte size */
998         tile_byte_count_offset = s->tile_byte_counts_offset + tile_idx * sizeof(int);
999         bytestream2_seek(&s->gb, tile_byte_count_offset, SEEK_SET);
1000         tile_byte_count = ff_tget_long(&s->gb, s->le);
1001 
1002         /* Seek to tile data */
1003         bytestream2_seek(&s->gb, tile_offset, SEEK_SET);
1004 
1005         /* Decode JPEG tile and copy it in the reference frame */
1006         ret = dng_decode_jpeg(avctx, frame, tile_byte_count, pos_x, pos_y, tile_width, tile_length);
1007 
1008         if (ret < 0)
1009             return ret;
1010 
1011         /* Advance current positions */
1012         pos_x += tile_width;
1013         if (tile_x == tile_count_x - 1) { // If on the right edge
1014             pos_x = 0;
1015             pos_y += tile_length;
1016         }
1017     }
1018 
1019     /* Frame is ready to be output */
1020     frame->pict_type = AV_PICTURE_TYPE_I;
1021     frame->key_frame = 1;
1022 
1023     return avpkt->size;
1024 }
1025 
init_image(TiffContext *s, AVFrame *frame)1026 static int init_image(TiffContext *s, AVFrame *frame)
1027 {
1028     int ret;
1029     int create_gray_palette = 0;
1030 
1031     // make sure there is no aliasing in the following switch
1032     if (s->bpp >= 100 || s->bppcount >= 10) {
1033         av_log(s->avctx, AV_LOG_ERROR,
1034                "Unsupported image parameters: bpp=%d, bppcount=%d\n",
1035                s->bpp, s->bppcount);
1036         return AVERROR_INVALIDDATA;
1037     }
1038 
1039     switch (s->planar * 1000 + s->bpp * 10 + s->bppcount + s->is_bayer * 10000) {
1040     case 11:
1041         if (!s->palette_is_set) {
1042             s->avctx->pix_fmt = AV_PIX_FMT_MONOBLACK;
1043             break;
1044         }
1045     case 21:
1046     case 41:
1047         s->avctx->pix_fmt = AV_PIX_FMT_PAL8;
1048         if (!s->palette_is_set) {
1049             create_gray_palette = 1;
1050         }
1051         break;
1052     case 81:
1053         s->avctx->pix_fmt = s->palette_is_set ? AV_PIX_FMT_PAL8 : AV_PIX_FMT_GRAY8;
1054         break;
1055     case 121:
1056         s->avctx->pix_fmt = AV_PIX_FMT_GRAY12;
1057         break;
1058     case 10081:
1059         switch (AV_RL32(s->pattern)) {
1060         case 0x02010100:
1061             s->avctx->pix_fmt = AV_PIX_FMT_BAYER_RGGB8;
1062             break;
1063         case 0x00010102:
1064             s->avctx->pix_fmt = AV_PIX_FMT_BAYER_BGGR8;
1065             break;
1066         case 0x01000201:
1067             s->avctx->pix_fmt = AV_PIX_FMT_BAYER_GBRG8;
1068             break;
1069         case 0x01020001:
1070             s->avctx->pix_fmt = AV_PIX_FMT_BAYER_GRBG8;
1071             break;
1072         default:
1073             av_log(s->avctx, AV_LOG_ERROR, "Unsupported Bayer pattern: 0x%X\n",
1074                    AV_RL32(s->pattern));
1075             return AVERROR_PATCHWELCOME;
1076         }
1077         break;
1078     case 10101:
1079     case 10121:
1080     case 10141:
1081     case 10161:
1082         switch (AV_RL32(s->pattern)) {
1083         case 0x02010100:
1084             s->avctx->pix_fmt = AV_PIX_FMT_BAYER_RGGB16;
1085             break;
1086         case 0x00010102:
1087             s->avctx->pix_fmt = AV_PIX_FMT_BAYER_BGGR16;
1088             break;
1089         case 0x01000201:
1090             s->avctx->pix_fmt = AV_PIX_FMT_BAYER_GBRG16;
1091             break;
1092         case 0x01020001:
1093             s->avctx->pix_fmt = AV_PIX_FMT_BAYER_GRBG16;
1094             break;
1095         default:
1096             av_log(s->avctx, AV_LOG_ERROR, "Unsupported Bayer pattern: 0x%X\n",
1097                    AV_RL32(s->pattern));
1098             return AVERROR_PATCHWELCOME;
1099         }
1100         break;
1101     case 243:
1102         if (s->photometric == TIFF_PHOTOMETRIC_YCBCR) {
1103             if (s->subsampling[0] == 1 && s->subsampling[1] == 1) {
1104                 s->avctx->pix_fmt = AV_PIX_FMT_YUV444P;
1105             } else if (s->subsampling[0] == 2 && s->subsampling[1] == 1) {
1106                 s->avctx->pix_fmt = AV_PIX_FMT_YUV422P;
1107             } else if (s->subsampling[0] == 4 && s->subsampling[1] == 1) {
1108                 s->avctx->pix_fmt = AV_PIX_FMT_YUV411P;
1109             } else if (s->subsampling[0] == 1 && s->subsampling[1] == 2) {
1110                 s->avctx->pix_fmt = AV_PIX_FMT_YUV440P;
1111             } else if (s->subsampling[0] == 2 && s->subsampling[1] == 2) {
1112                 s->avctx->pix_fmt = AV_PIX_FMT_YUV420P;
1113             } else if (s->subsampling[0] == 4 && s->subsampling[1] == 4) {
1114                 s->avctx->pix_fmt = AV_PIX_FMT_YUV410P;
1115             } else {
1116                 av_log(s->avctx, AV_LOG_ERROR, "Unsupported YCbCr subsampling\n");
1117                 return AVERROR_PATCHWELCOME;
1118             }
1119         } else
1120             s->avctx->pix_fmt = AV_PIX_FMT_RGB24;
1121         break;
1122     case 161:
1123         s->avctx->pix_fmt = s->le ? AV_PIX_FMT_GRAY16LE : AV_PIX_FMT_GRAY16BE;
1124         break;
1125     case 162:
1126         s->avctx->pix_fmt = AV_PIX_FMT_YA8;
1127         break;
1128     case 322:
1129         s->avctx->pix_fmt = s->le ? AV_PIX_FMT_YA16LE : AV_PIX_FMT_YA16BE;
1130         break;
1131     case 324:
1132         s->avctx->pix_fmt = s->photometric == TIFF_PHOTOMETRIC_SEPARATED ? AV_PIX_FMT_RGB0 : AV_PIX_FMT_RGBA;
1133         break;
1134     case 405:
1135         if (s->photometric == TIFF_PHOTOMETRIC_SEPARATED)
1136             s->avctx->pix_fmt = AV_PIX_FMT_RGBA;
1137         else {
1138             av_log(s->avctx, AV_LOG_ERROR,
1139                 "bpp=40 without PHOTOMETRIC_SEPARATED is unsupported\n");
1140             return AVERROR_PATCHWELCOME;
1141         }
1142         break;
1143     case 483:
1144         s->avctx->pix_fmt = s->le ? AV_PIX_FMT_RGB48LE  : AV_PIX_FMT_RGB48BE;
1145         break;
1146     case 644:
1147         s->avctx->pix_fmt = s->le ? AV_PIX_FMT_RGBA64LE  : AV_PIX_FMT_RGBA64BE;
1148         break;
1149     case 1243:
1150         s->avctx->pix_fmt = AV_PIX_FMT_GBRP;
1151         break;
1152     case 1324:
1153         s->avctx->pix_fmt = AV_PIX_FMT_GBRAP;
1154         break;
1155     case 1483:
1156         s->avctx->pix_fmt = s->le ? AV_PIX_FMT_GBRP16LE : AV_PIX_FMT_GBRP16BE;
1157         break;
1158     case 1644:
1159         s->avctx->pix_fmt = s->le ? AV_PIX_FMT_GBRAP16LE : AV_PIX_FMT_GBRAP16BE;
1160         break;
1161     default:
1162         av_log(s->avctx, AV_LOG_ERROR,
1163                "This format is not supported (bpp=%d, bppcount=%d)\n",
1164                s->bpp, s->bppcount);
1165         return AVERROR_INVALIDDATA;
1166     }
1167 
1168     if (s->photometric == TIFF_PHOTOMETRIC_YCBCR) {
1169         const AVPixFmtDescriptor *desc = av_pix_fmt_desc_get(s->avctx->pix_fmt);
1170         if((desc->flags & AV_PIX_FMT_FLAG_RGB) ||
1171            !(desc->flags & AV_PIX_FMT_FLAG_PLANAR) ||
1172            desc->nb_components < 3) {
1173             av_log(s->avctx, AV_LOG_ERROR, "Unsupported YCbCr variant\n");
1174             return AVERROR_INVALIDDATA;
1175         }
1176     }
1177 
1178     if (s->width != s->avctx->width || s->height != s->avctx->height) {
1179         ret = ff_set_dimensions(s->avctx, s->width, s->height);
1180         if (ret < 0)
1181             return ret;
1182     }
1183     if ((ret = ff_thread_get_buffer(s->avctx, frame, 0)) < 0)
1184         return ret;
1185     if (s->avctx->pix_fmt == AV_PIX_FMT_PAL8) {
1186         if (!create_gray_palette)
1187             memcpy(frame->data[1], s->palette, sizeof(s->palette));
1188         else {
1189             /* make default grayscale pal */
1190             int i;
1191             uint32_t *pal = (uint32_t *)frame->data[1];
1192             for (i = 0; i < 1<<s->bpp; i++)
1193                 pal[i] = 0xFFU << 24 | i * 255 / ((1<<s->bpp) - 1) * 0x010101;
1194         }
1195     }
1196     return 0;
1197 }
1198 
set_sar(TiffContext *s, unsigned tag, unsigned num, unsigned den)1199 static void set_sar(TiffContext *s, unsigned tag, unsigned num, unsigned den)
1200 {
1201     int offset = tag == TIFF_YRES ? 2 : 0;
1202     s->res[offset++] = num;
1203     s->res[offset]   = den;
1204     if (s->res[0] && s->res[1] && s->res[2] && s->res[3]) {
1205         uint64_t num = s->res[2] * (uint64_t)s->res[1];
1206         uint64_t den = s->res[0] * (uint64_t)s->res[3];
1207         if (num > INT64_MAX || den > INT64_MAX) {
1208             num = num >> 1;
1209             den = den >> 1;
1210         }
1211         av_reduce(&s->avctx->sample_aspect_ratio.num, &s->avctx->sample_aspect_ratio.den,
1212                   num, den, INT32_MAX);
1213         if (!s->avctx->sample_aspect_ratio.den)
1214             s->avctx->sample_aspect_ratio = (AVRational) {0, 1};
1215     }
1216 }
1217 
tiff_decode_tag(TiffContext *s, AVFrame *frame)1218 static int tiff_decode_tag(TiffContext *s, AVFrame *frame)
1219 {
1220     AVFrameSideData *sd;
1221     GetByteContext gb_temp;
1222     unsigned tag, type, count, off, value = 0, value2 = 1; // value2 is a denominator so init. to 1
1223     int i, start;
1224     int pos;
1225     int ret;
1226     double *dp;
1227 
1228     ret = ff_tread_tag(&s->gb, s->le, &tag, &type, &count, &start);
1229     if (ret < 0) {
1230         goto end;
1231     }
1232     if (tag <= s->last_tag)
1233         return AVERROR_INVALIDDATA;
1234 
1235     // We ignore TIFF_STRIP_SIZE as it is sometimes in the logic but wrong order around TIFF_STRIP_OFFS
1236     if (tag != TIFF_STRIP_SIZE)
1237         s->last_tag = tag;
1238 
1239     off = bytestream2_tell(&s->gb);
1240     if (count == 1) {
1241         switch (type) {
1242         case TIFF_BYTE:
1243         case TIFF_SHORT:
1244         case TIFF_LONG:
1245             value = ff_tget(&s->gb, type, s->le);
1246             break;
1247         case TIFF_RATIONAL:
1248             value  = ff_tget(&s->gb, TIFF_LONG, s->le);
1249             value2 = ff_tget(&s->gb, TIFF_LONG, s->le);
1250             if (!value2) {
1251                 av_log(s->avctx, AV_LOG_WARNING, "Invalid denominator in rational\n");
1252                 value2 = 1;
1253             }
1254 
1255             break;
1256         case TIFF_STRING:
1257             if (count <= 4) {
1258                 break;
1259             }
1260         default:
1261             value = UINT_MAX;
1262         }
1263     }
1264 
1265     switch (tag) {
1266     case TIFF_SUBFILE:
1267         s->is_thumbnail = (value != 0);
1268         break;
1269     case TIFF_WIDTH:
1270         if (value > INT_MAX)
1271             return AVERROR_INVALIDDATA;
1272         s->width = value;
1273         break;
1274     case TIFF_HEIGHT:
1275         if (value > INT_MAX)
1276             return AVERROR_INVALIDDATA;
1277         s->height = value;
1278         break;
1279     case TIFF_BPP:
1280         if (count > 5 || count <= 0) {
1281             av_log(s->avctx, AV_LOG_ERROR,
1282                    "This format is not supported (bpp=%d, %d components)\n",
1283                    value, count);
1284             return AVERROR_INVALIDDATA;
1285         }
1286         s->bppcount = count;
1287         if (count == 1)
1288             s->bpp = value;
1289         else {
1290             switch (type) {
1291             case TIFF_BYTE:
1292             case TIFF_SHORT:
1293             case TIFF_LONG:
1294                 s->bpp = 0;
1295                 if (bytestream2_get_bytes_left(&s->gb) < type_sizes[type] * count)
1296                     return AVERROR_INVALIDDATA;
1297                 for (i = 0; i < count; i++)
1298                     s->bpp += ff_tget(&s->gb, type, s->le);
1299                 break;
1300             default:
1301                 s->bpp = -1;
1302             }
1303         }
1304         break;
1305     case TIFF_SAMPLES_PER_PIXEL:
1306         if (count != 1) {
1307             av_log(s->avctx, AV_LOG_ERROR,
1308                    "Samples per pixel requires a single value, many provided\n");
1309             return AVERROR_INVALIDDATA;
1310         }
1311         if (value > 5 || value <= 0) {
1312             av_log(s->avctx, AV_LOG_ERROR,
1313                    "Invalid samples per pixel %d\n", value);
1314             return AVERROR_INVALIDDATA;
1315         }
1316         if (s->bppcount == 1)
1317             s->bpp *= value;
1318         s->bppcount = value;
1319         break;
1320     case TIFF_COMPR:
1321         s->compr     = value;
1322         av_log(s->avctx, AV_LOG_DEBUG, "compression: %d\n", s->compr);
1323         s->predictor = 0;
1324         switch (s->compr) {
1325         case TIFF_RAW:
1326         case TIFF_PACKBITS:
1327         case TIFF_LZW:
1328         case TIFF_CCITT_RLE:
1329             break;
1330         case TIFF_G3:
1331         case TIFF_G4:
1332             s->fax_opts = 0;
1333             break;
1334         case TIFF_DEFLATE:
1335         case TIFF_ADOBE_DEFLATE:
1336 #if CONFIG_ZLIB
1337             break;
1338 #else
1339             av_log(s->avctx, AV_LOG_ERROR, "Deflate: ZLib not compiled in\n");
1340             return AVERROR(ENOSYS);
1341 #endif
1342         case TIFF_JPEG:
1343         case TIFF_NEWJPEG:
1344             s->is_jpeg = 1;
1345             break;
1346         case TIFF_LZMA:
1347 #if CONFIG_LZMA
1348             break;
1349 #else
1350             av_log(s->avctx, AV_LOG_ERROR, "LZMA not compiled in\n");
1351             return AVERROR(ENOSYS);
1352 #endif
1353         default:
1354             av_log(s->avctx, AV_LOG_ERROR, "Unknown compression method %i\n",
1355                    s->compr);
1356             return AVERROR_INVALIDDATA;
1357         }
1358         break;
1359     case TIFF_ROWSPERSTRIP:
1360         if (!value || (type == TIFF_LONG && value == UINT_MAX))
1361             value = s->height;
1362         s->rps = FFMIN(value, s->height);
1363         break;
1364     case TIFF_STRIP_OFFS:
1365         if (count == 1) {
1366             if (value > INT_MAX) {
1367                 av_log(s->avctx, AV_LOG_ERROR,
1368                     "strippos %u too large\n", value);
1369                 return AVERROR_INVALIDDATA;
1370             }
1371             s->strippos = 0;
1372             s->stripoff = value;
1373         } else
1374             s->strippos = off;
1375         s->strips = count;
1376         if (s->strips == 1)
1377             s->rps = s->height;
1378         s->sot = type;
1379         break;
1380     case TIFF_STRIP_SIZE:
1381         if (count == 1) {
1382             if (value > INT_MAX) {
1383                 av_log(s->avctx, AV_LOG_ERROR,
1384                     "stripsize %u too large\n", value);
1385                 return AVERROR_INVALIDDATA;
1386             }
1387             s->stripsizesoff = 0;
1388             s->stripsize     = value;
1389             s->strips        = 1;
1390         } else {
1391             s->stripsizesoff = off;
1392         }
1393         s->strips = count;
1394         s->sstype = type;
1395         break;
1396     case TIFF_XRES:
1397     case TIFF_YRES:
1398         set_sar(s, tag, value, value2);
1399         break;
1400     case TIFF_TILE_OFFSETS:
1401         s->tile_offsets_offset = off;
1402         s->is_tiled = 1;
1403         break;
1404     case TIFF_TILE_BYTE_COUNTS:
1405         s->tile_byte_counts_offset = off;
1406         break;
1407     case TIFF_TILE_LENGTH:
1408         if (value > INT_MAX)
1409             return AVERROR_INVALIDDATA;
1410         s->tile_length = value;
1411         break;
1412     case TIFF_TILE_WIDTH:
1413         if (value > INT_MAX)
1414             return AVERROR_INVALIDDATA;
1415         s->tile_width = value;
1416         break;
1417     case TIFF_PREDICTOR:
1418         if (value > INT_MAX)
1419             return AVERROR_INVALIDDATA;
1420         s->predictor = value;
1421         break;
1422     case TIFF_SUB_IFDS:
1423         if (count == 1)
1424             s->sub_ifd = value;
1425         else if (count > 1)
1426             s->sub_ifd = ff_tget(&s->gb, TIFF_LONG, s->le); /** Only get the first SubIFD */
1427         break;
1428     case DNG_LINEARIZATION_TABLE:
1429         if (count < 1 || count > FF_ARRAY_ELEMS(s->dng_lut))
1430             return AVERROR_INVALIDDATA;
1431         for (int i = 0; i < count; i++)
1432             s->dng_lut[i] = ff_tget(&s->gb, type, s->le);
1433         break;
1434     case DNG_BLACK_LEVEL:
1435         if (count > 1) {    /* Use the first value in the pattern (assume they're all the same) */
1436             if (type == TIFF_RATIONAL) {
1437                 value  = ff_tget(&s->gb, TIFF_LONG, s->le);
1438                 value2 = ff_tget(&s->gb, TIFF_LONG, s->le);
1439                 if (!value2) {
1440                     av_log(s->avctx, AV_LOG_WARNING, "Invalid black level denominator\n");
1441                     value2 = 1;
1442                 }
1443 
1444                 s->black_level = value / value2;
1445             } else
1446                 s->black_level = ff_tget(&s->gb, type, s->le);
1447             av_log(s->avctx, AV_LOG_WARNING, "Assuming black level pattern values are identical\n");
1448         } else {
1449             s->black_level = value / value2;
1450         }
1451         break;
1452     case DNG_WHITE_LEVEL:
1453         s->white_level = value;
1454         break;
1455     case TIFF_CFA_PATTERN_DIM:
1456         if (count != 2 || (ff_tget(&s->gb, type, s->le) != 2 &&
1457                            ff_tget(&s->gb, type, s->le) != 2)) {
1458             av_log(s->avctx, AV_LOG_ERROR, "CFA Pattern dimensions are not 2x2\n");
1459             return AVERROR_INVALIDDATA;
1460         }
1461         break;
1462     case TIFF_CFA_PATTERN:
1463         s->is_bayer = 1;
1464         s->pattern[0] = ff_tget(&s->gb, type, s->le);
1465         s->pattern[1] = ff_tget(&s->gb, type, s->le);
1466         s->pattern[2] = ff_tget(&s->gb, type, s->le);
1467         s->pattern[3] = ff_tget(&s->gb, type, s->le);
1468         break;
1469     case TIFF_PHOTOMETRIC:
1470         switch (value) {
1471         case TIFF_PHOTOMETRIC_WHITE_IS_ZERO:
1472         case TIFF_PHOTOMETRIC_BLACK_IS_ZERO:
1473         case TIFF_PHOTOMETRIC_RGB:
1474         case TIFF_PHOTOMETRIC_PALETTE:
1475         case TIFF_PHOTOMETRIC_SEPARATED:
1476         case TIFF_PHOTOMETRIC_YCBCR:
1477         case TIFF_PHOTOMETRIC_CFA:
1478         case TIFF_PHOTOMETRIC_LINEAR_RAW: // Used by DNG images
1479             s->photometric = value;
1480             break;
1481         case TIFF_PHOTOMETRIC_ALPHA_MASK:
1482         case TIFF_PHOTOMETRIC_CIE_LAB:
1483         case TIFF_PHOTOMETRIC_ICC_LAB:
1484         case TIFF_PHOTOMETRIC_ITU_LAB:
1485         case TIFF_PHOTOMETRIC_LOG_L:
1486         case TIFF_PHOTOMETRIC_LOG_LUV:
1487             avpriv_report_missing_feature(s->avctx,
1488                                           "PhotometricInterpretation 0x%04X",
1489                                           value);
1490             return AVERROR_PATCHWELCOME;
1491         default:
1492             av_log(s->avctx, AV_LOG_ERROR, "PhotometricInterpretation %u is "
1493                    "unknown\n", value);
1494             return AVERROR_INVALIDDATA;
1495         }
1496         break;
1497     case TIFF_FILL_ORDER:
1498         if (value < 1 || value > 2) {
1499             av_log(s->avctx, AV_LOG_ERROR,
1500                    "Unknown FillOrder value %d, trying default one\n", value);
1501             value = 1;
1502         }
1503         s->fill_order = value - 1;
1504         break;
1505     case TIFF_PAL: {
1506         GetByteContext pal_gb[3];
1507         off = type_sizes[type];
1508         if (count / 3 > 256 ||
1509             bytestream2_get_bytes_left(&s->gb) < count / 3 * off * 3)
1510             return AVERROR_INVALIDDATA;
1511 
1512         pal_gb[0] = pal_gb[1] = pal_gb[2] = s->gb;
1513         bytestream2_skip(&pal_gb[1], count / 3 * off);
1514         bytestream2_skip(&pal_gb[2], count / 3 * off * 2);
1515 
1516         off = (type_sizes[type] - 1) << 3;
1517         if (off > 31U) {
1518             av_log(s->avctx, AV_LOG_ERROR, "palette shift %d is out of range\n", off);
1519             return AVERROR_INVALIDDATA;
1520         }
1521 
1522         for (i = 0; i < count / 3; i++) {
1523             uint32_t p = 0xFF000000;
1524             p |= (ff_tget(&pal_gb[0], type, s->le) >> off) << 16;
1525             p |= (ff_tget(&pal_gb[1], type, s->le) >> off) << 8;
1526             p |=  ff_tget(&pal_gb[2], type, s->le) >> off;
1527             s->palette[i] = p;
1528         }
1529         s->palette_is_set = 1;
1530         break;
1531     }
1532     case TIFF_PLANAR:
1533         s->planar = value == 2;
1534         break;
1535     case TIFF_YCBCR_SUBSAMPLING:
1536         if (count != 2) {
1537             av_log(s->avctx, AV_LOG_ERROR, "subsample count invalid\n");
1538             return AVERROR_INVALIDDATA;
1539         }
1540         for (i = 0; i < count; i++) {
1541             s->subsampling[i] = ff_tget(&s->gb, type, s->le);
1542             if (s->subsampling[i] <= 0) {
1543                 av_log(s->avctx, AV_LOG_ERROR, "subsampling %d is invalid\n", s->subsampling[i]);
1544                 s->subsampling[i] = 1;
1545                 return AVERROR_INVALIDDATA;
1546             }
1547         }
1548         break;
1549     case TIFF_T4OPTIONS:
1550         if (s->compr == TIFF_G3) {
1551             if (value > INT_MAX)
1552                 return AVERROR_INVALIDDATA;
1553             s->fax_opts = value;
1554         }
1555         break;
1556     case TIFF_T6OPTIONS:
1557         if (s->compr == TIFF_G4) {
1558             if (value > INT_MAX)
1559                 return AVERROR_INVALIDDATA;
1560             s->fax_opts = value;
1561         }
1562         break;
1563 #define ADD_METADATA(count, name, sep)\
1564     if ((ret = add_metadata(count, type, name, sep, s, frame)) < 0) {\
1565         av_log(s->avctx, AV_LOG_ERROR, "Error allocating temporary buffer\n");\
1566         goto end;\
1567     }
1568     case TIFF_MODEL_PIXEL_SCALE:
1569         ADD_METADATA(count, "ModelPixelScaleTag", NULL);
1570         break;
1571     case TIFF_MODEL_TRANSFORMATION:
1572         ADD_METADATA(count, "ModelTransformationTag", NULL);
1573         break;
1574     case TIFF_MODEL_TIEPOINT:
1575         ADD_METADATA(count, "ModelTiepointTag", NULL);
1576         break;
1577     case TIFF_GEO_KEY_DIRECTORY:
1578         if (s->geotag_count) {
1579             avpriv_request_sample(s->avctx, "Multiple geo key directories");
1580             return AVERROR_INVALIDDATA;
1581         }
1582         ADD_METADATA(1, "GeoTIFF_Version", NULL);
1583         ADD_METADATA(2, "GeoTIFF_Key_Revision", ".");
1584         s->geotag_count   = ff_tget_short(&s->gb, s->le);
1585         if (s->geotag_count > count / 4 - 1) {
1586             s->geotag_count = count / 4 - 1;
1587             av_log(s->avctx, AV_LOG_WARNING, "GeoTIFF key directory buffer shorter than specified\n");
1588         }
1589         if (   bytestream2_get_bytes_left(&s->gb) < s->geotag_count * sizeof(int16_t) * 4
1590             || s->geotag_count == 0) {
1591             s->geotag_count = 0;
1592             return -1;
1593         }
1594         s->geotags = av_calloc(s->geotag_count, sizeof(*s->geotags));
1595         if (!s->geotags) {
1596             av_log(s->avctx, AV_LOG_ERROR, "Error allocating temporary buffer\n");
1597             s->geotag_count = 0;
1598             goto end;
1599         }
1600         for (i = 0; i < s->geotag_count; i++) {
1601             s->geotags[i].key    = ff_tget_short(&s->gb, s->le);
1602             s->geotags[i].type   = ff_tget_short(&s->gb, s->le);
1603             s->geotags[i].count  = ff_tget_short(&s->gb, s->le);
1604 
1605             if (!s->geotags[i].type)
1606                 s->geotags[i].val  = get_geokey_val(s->geotags[i].key, ff_tget_short(&s->gb, s->le));
1607             else
1608                 s->geotags[i].offset = ff_tget_short(&s->gb, s->le);
1609         }
1610         break;
1611     case TIFF_GEO_DOUBLE_PARAMS:
1612         if (count >= INT_MAX / sizeof(int64_t))
1613             return AVERROR_INVALIDDATA;
1614         if (bytestream2_get_bytes_left(&s->gb) < count * sizeof(int64_t))
1615             return AVERROR_INVALIDDATA;
1616         dp = av_malloc_array(count, sizeof(double));
1617         if (!dp) {
1618             av_log(s->avctx, AV_LOG_ERROR, "Error allocating temporary buffer\n");
1619             goto end;
1620         }
1621         for (i = 0; i < count; i++)
1622             dp[i] = ff_tget_double(&s->gb, s->le);
1623         for (i = 0; i < s->geotag_count; i++) {
1624             if (s->geotags[i].type == TIFF_GEO_DOUBLE_PARAMS) {
1625                 if (s->geotags[i].count == 0
1626                     || s->geotags[i].offset + s->geotags[i].count > count) {
1627                     av_log(s->avctx, AV_LOG_WARNING, "Invalid GeoTIFF key %d\n", s->geotags[i].key);
1628                 } else if (s->geotags[i].val) {
1629                     av_log(s->avctx, AV_LOG_WARNING, "Duplicate GeoTIFF key %d\n", s->geotags[i].key);
1630                 } else {
1631                     char *ap = doubles2str(&dp[s->geotags[i].offset], s->geotags[i].count, ", ");
1632                     if (!ap) {
1633                         av_log(s->avctx, AV_LOG_ERROR, "Error allocating temporary buffer\n");
1634                         av_freep(&dp);
1635                         return AVERROR(ENOMEM);
1636                     }
1637                     s->geotags[i].val = ap;
1638                 }
1639             }
1640         }
1641         av_freep(&dp);
1642         break;
1643     case TIFF_GEO_ASCII_PARAMS:
1644         pos = bytestream2_tell(&s->gb);
1645         for (i = 0; i < s->geotag_count; i++) {
1646             if (s->geotags[i].type == TIFF_GEO_ASCII_PARAMS) {
1647                 if (s->geotags[i].count == 0
1648                     || s->geotags[i].offset +  s->geotags[i].count > count) {
1649                     av_log(s->avctx, AV_LOG_WARNING, "Invalid GeoTIFF key %d\n", s->geotags[i].key);
1650                 } else {
1651                     char *ap;
1652 
1653                     bytestream2_seek(&s->gb, pos + s->geotags[i].offset, SEEK_SET);
1654                     if (bytestream2_get_bytes_left(&s->gb) < s->geotags[i].count)
1655                         return AVERROR_INVALIDDATA;
1656                     if (s->geotags[i].val)
1657                         return AVERROR_INVALIDDATA;
1658                     ap = av_malloc(s->geotags[i].count);
1659                     if (!ap) {
1660                         av_log(s->avctx, AV_LOG_ERROR, "Error allocating temporary buffer\n");
1661                         return AVERROR(ENOMEM);
1662                     }
1663                     bytestream2_get_bufferu(&s->gb, ap, s->geotags[i].count);
1664                     ap[s->geotags[i].count - 1] = '\0'; //replace the "|" delimiter with a 0 byte
1665                     s->geotags[i].val = ap;
1666                 }
1667             }
1668         }
1669         break;
1670     case TIFF_ICC_PROFILE:
1671         gb_temp = s->gb;
1672         bytestream2_seek(&gb_temp, SEEK_SET, off);
1673 
1674         if (bytestream2_get_bytes_left(&gb_temp) < count)
1675             return AVERROR_INVALIDDATA;
1676 
1677         sd = av_frame_new_side_data(frame, AV_FRAME_DATA_ICC_PROFILE, count);
1678         if (!sd)
1679             return AVERROR(ENOMEM);
1680 
1681         bytestream2_get_bufferu(&gb_temp, sd->data, count);
1682         break;
1683     case TIFF_ARTIST:
1684         ADD_METADATA(count, "artist", NULL);
1685         break;
1686     case TIFF_COPYRIGHT:
1687         ADD_METADATA(count, "copyright", NULL);
1688         break;
1689     case TIFF_DATE:
1690         ADD_METADATA(count, "date", NULL);
1691         break;
1692     case TIFF_DOCUMENT_NAME:
1693         ADD_METADATA(count, "document_name", NULL);
1694         break;
1695     case TIFF_HOST_COMPUTER:
1696         ADD_METADATA(count, "computer", NULL);
1697         break;
1698     case TIFF_IMAGE_DESCRIPTION:
1699         ADD_METADATA(count, "description", NULL);
1700         break;
1701     case TIFF_MAKE:
1702         ADD_METADATA(count, "make", NULL);
1703         break;
1704     case TIFF_MODEL:
1705         ADD_METADATA(count, "model", NULL);
1706         break;
1707     case TIFF_PAGE_NAME:
1708         ADD_METADATA(count, "page_name", NULL);
1709         break;
1710     case TIFF_PAGE_NUMBER:
1711         ADD_METADATA(count, "page_number", " / ");
1712         // need to seek back to re-read the page number
1713         bytestream2_seek(&s->gb, -count * sizeof(uint16_t), SEEK_CUR);
1714         // read the page number
1715         s->cur_page = ff_tget(&s->gb, TIFF_SHORT, s->le);
1716         // get back to where we were before the previous seek
1717         bytestream2_seek(&s->gb, count * sizeof(uint16_t) - sizeof(uint16_t), SEEK_CUR);
1718         break;
1719     case TIFF_SOFTWARE_NAME:
1720         ADD_METADATA(count, "software", NULL);
1721         break;
1722     case DNG_VERSION:
1723         if (count == 4) {
1724             unsigned int ver[4];
1725             ver[0] = ff_tget(&s->gb, type, s->le);
1726             ver[1] = ff_tget(&s->gb, type, s->le);
1727             ver[2] = ff_tget(&s->gb, type, s->le);
1728             ver[3] = ff_tget(&s->gb, type, s->le);
1729 
1730             av_log(s->avctx, AV_LOG_DEBUG, "DNG file, version %u.%u.%u.%u\n",
1731                 ver[0], ver[1], ver[2], ver[3]);
1732 
1733             tiff_set_type(s, TIFF_TYPE_DNG);
1734         }
1735         break;
1736     case CINEMADNG_TIME_CODES:
1737     case CINEMADNG_FRAME_RATE:
1738     case CINEMADNG_T_STOP:
1739     case CINEMADNG_REEL_NAME:
1740     case CINEMADNG_CAMERA_LABEL:
1741         tiff_set_type(s, TIFF_TYPE_CINEMADNG);
1742         break;
1743     default:
1744         if (s->avctx->err_recognition & AV_EF_EXPLODE) {
1745             av_log(s->avctx, AV_LOG_ERROR,
1746                    "Unknown or unsupported tag %d/0x%0X\n",
1747                    tag, tag);
1748             return AVERROR_INVALIDDATA;
1749         }
1750     }
1751 end:
1752     if (s->bpp > 64U) {
1753         av_log(s->avctx, AV_LOG_ERROR,
1754                 "This format is not supported (bpp=%d, %d components)\n",
1755                 s->bpp, count);
1756         s->bpp = 0;
1757         return AVERROR_INVALIDDATA;
1758     }
1759     bytestream2_seek(&s->gb, start, SEEK_SET);
1760     return 0;
1761 }
1762 
decode_frame(AVCodecContext *avctx, AVFrame *p, int *got_frame, AVPacket *avpkt)1763 static int decode_frame(AVCodecContext *avctx, AVFrame *p,
1764                         int *got_frame, AVPacket *avpkt)
1765 {
1766     TiffContext *const s = avctx->priv_data;
1767     unsigned off, last_off = 0;
1768     int le, ret, plane, planes;
1769     int i, j, entries, stride;
1770     unsigned soff, ssize;
1771     uint8_t *dst;
1772     GetByteContext stripsizes;
1773     GetByteContext stripdata;
1774     int retry_for_subifd, retry_for_page;
1775     int is_dng;
1776     int has_tile_bits, has_strip_bits;
1777 
1778     bytestream2_init(&s->gb, avpkt->data, avpkt->size);
1779 
1780     // parse image header
1781     if ((ret = ff_tdecode_header(&s->gb, &le, &off))) {
1782         av_log(avctx, AV_LOG_ERROR, "Invalid TIFF header\n");
1783         return ret;
1784     } else if (off >= UINT_MAX - 14 || avpkt->size < off + 14) {
1785         av_log(avctx, AV_LOG_ERROR, "IFD offset is greater than image size\n");
1786         return AVERROR_INVALIDDATA;
1787     }
1788     s->le          = le;
1789     // TIFF_BPP is not a required tag and defaults to 1
1790 
1791     s->tiff_type   = TIFF_TYPE_TIFF;
1792 again:
1793     s->is_thumbnail = 0;
1794     s->bppcount    = s->bpp = 1;
1795     s->photometric = TIFF_PHOTOMETRIC_NONE;
1796     s->compr       = TIFF_RAW;
1797     s->fill_order  = 0;
1798     s->white_level = 0;
1799     s->is_bayer    = 0;
1800     s->is_tiled    = 0;
1801     s->is_jpeg     = 0;
1802     s->cur_page    = 0;
1803     s->last_tag    = 0;
1804 
1805     for (i = 0; i < 65536; i++)
1806         s->dng_lut[i] = i;
1807 
1808     free_geotags(s);
1809 
1810     // Reset these offsets so we can tell if they were set this frame
1811     s->stripsizesoff = s->strippos = 0;
1812     /* parse image file directory */
1813     bytestream2_seek(&s->gb, off, SEEK_SET);
1814     entries = ff_tget_short(&s->gb, le);
1815     if (bytestream2_get_bytes_left(&s->gb) < entries * 12)
1816         return AVERROR_INVALIDDATA;
1817     for (i = 0; i < entries; i++) {
1818         if ((ret = tiff_decode_tag(s, p)) < 0)
1819             return ret;
1820     }
1821 
1822     if (s->get_thumbnail && !s->is_thumbnail) {
1823         av_log(avctx, AV_LOG_INFO, "No embedded thumbnail present\n");
1824         return AVERROR_EOF;
1825     }
1826 
1827     /** whether we should process this IFD's SubIFD */
1828     retry_for_subifd = s->sub_ifd && (s->get_subimage || (!s->get_thumbnail && s->is_thumbnail));
1829     /** whether we should process this multi-page IFD's next page */
1830     retry_for_page = s->get_page && s->cur_page + 1 < s->get_page;  // get_page is 1-indexed
1831 
1832     if (retry_for_page) {
1833         // set offset to the next IFD
1834         off = ff_tget_long(&s->gb, le);
1835     } else if (retry_for_subifd) {
1836         // set offset to the SubIFD
1837         off = s->sub_ifd;
1838     }
1839 
1840     if (retry_for_subifd || retry_for_page) {
1841         if (!off) {
1842             av_log(avctx, AV_LOG_ERROR, "Requested entry not found\n");
1843             return AVERROR_INVALIDDATA;
1844         }
1845         if (off <= last_off) {
1846             avpriv_request_sample(s->avctx, "non increasing IFD offset");
1847             return AVERROR_INVALIDDATA;
1848         }
1849         last_off = off;
1850         if (off >= UINT_MAX - 14 || avpkt->size < off + 14) {
1851             av_log(avctx, AV_LOG_ERROR, "IFD offset is greater than image size\n");
1852             return AVERROR_INVALIDDATA;
1853         }
1854         s->sub_ifd = 0;
1855         goto again;
1856     }
1857 
1858     /* At this point we've decided on which (Sub)IFD to process */
1859 
1860     is_dng = (s->tiff_type == TIFF_TYPE_DNG || s->tiff_type == TIFF_TYPE_CINEMADNG);
1861 
1862     for (i = 0; i<s->geotag_count; i++) {
1863         const char *keyname = get_geokey_name(s->geotags[i].key);
1864         if (!keyname) {
1865             av_log(avctx, AV_LOG_WARNING, "Unknown or unsupported GeoTIFF key %d\n", s->geotags[i].key);
1866             continue;
1867         }
1868         if (get_geokey_type(s->geotags[i].key) != s->geotags[i].type) {
1869             av_log(avctx, AV_LOG_WARNING, "Type of GeoTIFF key %d is wrong\n", s->geotags[i].key);
1870             continue;
1871         }
1872         ret = av_dict_set(&p->metadata, keyname, s->geotags[i].val, 0);
1873         if (ret<0) {
1874             av_log(avctx, AV_LOG_ERROR, "Writing metadata with key '%s' failed\n", keyname);
1875             return ret;
1876         }
1877     }
1878 
1879     if (is_dng) {
1880         int bps;
1881 
1882         if (s->bpp % s->bppcount)
1883             return AVERROR_INVALIDDATA;
1884         bps = s->bpp / s->bppcount;
1885         if (bps < 8 || bps > 32)
1886             return AVERROR_INVALIDDATA;
1887 
1888         if (s->white_level == 0)
1889             s->white_level = (1LL << bps) - 1; /* Default value as per the spec */
1890 
1891         if (s->white_level <= s->black_level) {
1892             av_log(avctx, AV_LOG_ERROR, "BlackLevel (%"PRId32") must be less than WhiteLevel (%"PRId32")\n",
1893                 s->black_level, s->white_level);
1894             return AVERROR_INVALIDDATA;
1895         }
1896 
1897         if (s->planar)
1898             return AVERROR_PATCHWELCOME;
1899     }
1900 
1901     if (!s->is_tiled && !s->strippos && !s->stripoff) {
1902         av_log(avctx, AV_LOG_ERROR, "Image data is missing\n");
1903         return AVERROR_INVALIDDATA;
1904     }
1905 
1906     has_tile_bits  = s->is_tiled || s->tile_byte_counts_offset || s->tile_offsets_offset || s->tile_width || s->tile_length;
1907     has_strip_bits = s->strippos || s->strips || s->stripoff || s->rps || s->sot || s->sstype || s->stripsize || s->stripsizesoff;
1908 
1909     if (has_tile_bits && has_strip_bits) {
1910         int tiled_dng = s->is_tiled && is_dng;
1911         av_log(avctx, tiled_dng ? AV_LOG_WARNING : AV_LOG_ERROR, "Tiled TIFF is not allowed to strip\n");
1912         if (!tiled_dng)
1913             return AVERROR_INVALIDDATA;
1914     }
1915 
1916     /* now we have the data and may start decoding */
1917     if ((ret = init_image(s, p)) < 0)
1918         return ret;
1919 
1920     if (!s->is_tiled || has_strip_bits) {
1921         if (s->strips == 1 && !s->stripsize) {
1922             av_log(avctx, AV_LOG_WARNING, "Image data size missing\n");
1923             s->stripsize = avpkt->size - s->stripoff;
1924         }
1925 
1926         if (s->stripsizesoff) {
1927             if (s->stripsizesoff >= (unsigned)avpkt->size)
1928                 return AVERROR_INVALIDDATA;
1929             bytestream2_init(&stripsizes, avpkt->data + s->stripsizesoff,
1930                             avpkt->size - s->stripsizesoff);
1931         }
1932         if (s->strippos) {
1933             if (s->strippos >= (unsigned)avpkt->size)
1934                 return AVERROR_INVALIDDATA;
1935             bytestream2_init(&stripdata, avpkt->data + s->strippos,
1936                             avpkt->size - s->strippos);
1937         }
1938 
1939         if (s->rps <= 0 || s->rps % s->subsampling[1]) {
1940             av_log(avctx, AV_LOG_ERROR, "rps %d invalid\n", s->rps);
1941             return AVERROR_INVALIDDATA;
1942         }
1943     }
1944 
1945     if (s->photometric == TIFF_PHOTOMETRIC_LINEAR_RAW ||
1946         s->photometric == TIFF_PHOTOMETRIC_CFA) {
1947         p->color_trc = AVCOL_TRC_LINEAR;
1948     } else if (s->photometric == TIFF_PHOTOMETRIC_BLACK_IS_ZERO) {
1949         p->color_trc = AVCOL_TRC_GAMMA22;
1950     }
1951 
1952     /* Handle DNG images with JPEG-compressed tiles */
1953 
1954     if (is_dng && s->is_tiled) {
1955         if (!s->is_jpeg) {
1956             avpriv_report_missing_feature(avctx, "DNG uncompressed tiled images");
1957             return AVERROR_PATCHWELCOME;
1958         } else if (!s->is_bayer) {
1959             avpriv_report_missing_feature(avctx, "DNG JPG-compressed tiled non-bayer-encoded images");
1960             return AVERROR_PATCHWELCOME;
1961         } else {
1962             if ((ret = dng_decode_tiles(avctx, p, avpkt)) > 0)
1963                 *got_frame = 1;
1964             return ret;
1965         }
1966     }
1967 
1968     /* Handle TIFF images and DNG images with uncompressed strips (non-tiled) */
1969 
1970     planes = s->planar ? s->bppcount : 1;
1971     for (plane = 0; plane < planes; plane++) {
1972         uint8_t *five_planes = NULL;
1973         int remaining = avpkt->size;
1974         int decoded_height;
1975         stride = p->linesize[plane];
1976         dst = p->data[plane];
1977         if (s->photometric == TIFF_PHOTOMETRIC_SEPARATED &&
1978             s->avctx->pix_fmt == AV_PIX_FMT_RGBA) {
1979             stride = stride * 5 / 4;
1980             five_planes =
1981             dst = av_malloc(stride * s->height);
1982             if (!dst)
1983                 return AVERROR(ENOMEM);
1984         }
1985         for (i = 0; i < s->height; i += s->rps) {
1986             if (i)
1987                 dst += s->rps * stride;
1988             if (s->stripsizesoff)
1989                 ssize = ff_tget(&stripsizes, s->sstype, le);
1990             else
1991                 ssize = s->stripsize;
1992 
1993             if (s->strippos)
1994                 soff = ff_tget(&stripdata, s->sot, le);
1995             else
1996                 soff = s->stripoff;
1997 
1998             if (soff > avpkt->size || ssize > avpkt->size - soff || ssize > remaining) {
1999                 av_log(avctx, AV_LOG_ERROR, "Invalid strip size/offset\n");
2000                 av_freep(&five_planes);
2001                 return AVERROR_INVALIDDATA;
2002             }
2003             remaining -= ssize;
2004             if ((ret = tiff_unpack_strip(s, p, dst, stride, avpkt->data + soff, ssize, i,
2005                                          FFMIN(s->rps, s->height - i))) < 0) {
2006                 if (avctx->err_recognition & AV_EF_EXPLODE) {
2007                     av_freep(&five_planes);
2008                     return ret;
2009                 }
2010                 break;
2011             }
2012         }
2013         decoded_height = FFMIN(i, s->height);
2014 
2015         if (s->predictor == 2) {
2016             if (s->photometric == TIFF_PHOTOMETRIC_YCBCR) {
2017                 av_log(s->avctx, AV_LOG_ERROR, "predictor == 2 with YUV is unsupported");
2018                 return AVERROR_PATCHWELCOME;
2019             }
2020             dst   = five_planes ? five_planes : p->data[plane];
2021             soff  = s->bpp >> 3;
2022             if (s->planar)
2023                 soff  = FFMAX(soff / s->bppcount, 1);
2024             ssize = s->width * soff;
2025             if (s->avctx->pix_fmt == AV_PIX_FMT_RGB48LE ||
2026                 s->avctx->pix_fmt == AV_PIX_FMT_RGBA64LE ||
2027                 s->avctx->pix_fmt == AV_PIX_FMT_GRAY16LE ||
2028                 s->avctx->pix_fmt == AV_PIX_FMT_YA16LE ||
2029                 s->avctx->pix_fmt == AV_PIX_FMT_GBRP16LE ||
2030                 s->avctx->pix_fmt == AV_PIX_FMT_GBRAP16LE) {
2031                 for (i = 0; i < decoded_height; i++) {
2032                     for (j = soff; j < ssize; j += 2)
2033                         AV_WL16(dst + j, AV_RL16(dst + j) + AV_RL16(dst + j - soff));
2034                     dst += stride;
2035                 }
2036             } else if (s->avctx->pix_fmt == AV_PIX_FMT_RGB48BE ||
2037                        s->avctx->pix_fmt == AV_PIX_FMT_RGBA64BE ||
2038                        s->avctx->pix_fmt == AV_PIX_FMT_GRAY16BE ||
2039                        s->avctx->pix_fmt == AV_PIX_FMT_YA16BE ||
2040                        s->avctx->pix_fmt == AV_PIX_FMT_GBRP16BE ||
2041                        s->avctx->pix_fmt == AV_PIX_FMT_GBRAP16BE) {
2042                 for (i = 0; i < decoded_height; i++) {
2043                     for (j = soff; j < ssize; j += 2)
2044                         AV_WB16(dst + j, AV_RB16(dst + j) + AV_RB16(dst + j - soff));
2045                     dst += stride;
2046                 }
2047             } else {
2048                 for (i = 0; i < decoded_height; i++) {
2049                     for (j = soff; j < ssize; j++)
2050                         dst[j] += dst[j - soff];
2051                     dst += stride;
2052                 }
2053             }
2054         }
2055 
2056         if (s->photometric == TIFF_PHOTOMETRIC_WHITE_IS_ZERO) {
2057             int c = (s->avctx->pix_fmt == AV_PIX_FMT_PAL8 ? (1<<s->bpp) - 1 : 255);
2058             dst = p->data[plane];
2059             for (i = 0; i < s->height; i++) {
2060                 for (j = 0; j < stride; j++)
2061                     dst[j] = c - dst[j];
2062                 dst += stride;
2063             }
2064         }
2065 
2066         if (s->photometric == TIFF_PHOTOMETRIC_SEPARATED &&
2067             (s->avctx->pix_fmt == AV_PIX_FMT_RGB0 || s->avctx->pix_fmt == AV_PIX_FMT_RGBA)) {
2068             int x = s->avctx->pix_fmt == AV_PIX_FMT_RGB0 ? 4 : 5;
2069             uint8_t *src = five_planes ? five_planes : p->data[plane];
2070             dst = p->data[plane];
2071             for (i = 0; i < s->height; i++) {
2072                 for (j = 0; j < s->width; j++) {
2073                     int k =  255 - src[x * j + 3];
2074                     int r = (255 - src[x * j    ]) * k;
2075                     int g = (255 - src[x * j + 1]) * k;
2076                     int b = (255 - src[x * j + 2]) * k;
2077                     dst[4 * j    ] = r * 257 >> 16;
2078                     dst[4 * j + 1] = g * 257 >> 16;
2079                     dst[4 * j + 2] = b * 257 >> 16;
2080                     dst[4 * j + 3] = s->avctx->pix_fmt == AV_PIX_FMT_RGBA ? src[x * j + 4] : 255;
2081                 }
2082                 src += stride;
2083                 dst += p->linesize[plane];
2084             }
2085             av_freep(&five_planes);
2086         } else if (s->photometric == TIFF_PHOTOMETRIC_SEPARATED &&
2087             s->avctx->pix_fmt == AV_PIX_FMT_RGBA64BE) {
2088             dst = p->data[plane];
2089             for (i = 0; i < s->height; i++) {
2090                 for (j = 0; j < s->width; j++) {
2091                     uint64_t k =  65535 - AV_RB16(dst + 8 * j + 6);
2092                     uint64_t r = (65535 - AV_RB16(dst + 8 * j    )) * k;
2093                     uint64_t g = (65535 - AV_RB16(dst + 8 * j + 2)) * k;
2094                     uint64_t b = (65535 - AV_RB16(dst + 8 * j + 4)) * k;
2095                     AV_WB16(dst + 8 * j    , r * 65537 >> 32);
2096                     AV_WB16(dst + 8 * j + 2, g * 65537 >> 32);
2097                     AV_WB16(dst + 8 * j + 4, b * 65537 >> 32);
2098                     AV_WB16(dst + 8 * j + 6, 65535);
2099                 }
2100                 dst += p->linesize[plane];
2101             }
2102         }
2103     }
2104 
2105     if (s->planar && s->bppcount > 2) {
2106         FFSWAP(uint8_t*, p->data[0],     p->data[2]);
2107         FFSWAP(int,      p->linesize[0], p->linesize[2]);
2108         FFSWAP(uint8_t*, p->data[0],     p->data[1]);
2109         FFSWAP(int,      p->linesize[0], p->linesize[1]);
2110     }
2111 
2112     if (s->is_bayer && s->white_level && s->bpp == 16 && !is_dng) {
2113         uint16_t *dst = (uint16_t *)p->data[0];
2114         for (i = 0; i < s->height; i++) {
2115             for (j = 0; j < s->width; j++)
2116                 dst[j] = FFMIN((dst[j] / (float)s->white_level) * 65535, 65535);
2117             dst += stride / 2;
2118         }
2119     }
2120 
2121     *got_frame = 1;
2122 
2123     return avpkt->size;
2124 }
2125 
tiff_init(AVCodecContext *avctx)2126 static av_cold int tiff_init(AVCodecContext *avctx)
2127 {
2128     TiffContext *s = avctx->priv_data;
2129     const AVCodec *codec;
2130     int ret;
2131 
2132     s->width  = 0;
2133     s->height = 0;
2134     s->subsampling[0] =
2135     s->subsampling[1] = 1;
2136     s->avctx  = avctx;
2137     ff_lzw_decode_open(&s->lzw);
2138     if (!s->lzw)
2139         return AVERROR(ENOMEM);
2140     ff_ccitt_unpack_init();
2141 
2142     /* Allocate JPEG frame */
2143     s->jpgframe = av_frame_alloc();
2144     s->jpkt     = av_packet_alloc();
2145     if (!s->jpgframe || !s->jpkt)
2146         return AVERROR(ENOMEM);
2147 
2148     /* Prepare everything needed for JPEG decoding */
2149     codec = avcodec_find_decoder(AV_CODEC_ID_MJPEG);
2150     if (!codec)
2151         return AVERROR_BUG;
2152     s->avctx_mjpeg = avcodec_alloc_context3(codec);
2153     if (!s->avctx_mjpeg)
2154         return AVERROR(ENOMEM);
2155     s->avctx_mjpeg->flags = avctx->flags;
2156     s->avctx_mjpeg->flags2 = avctx->flags2;
2157     s->avctx_mjpeg->dct_algo = avctx->dct_algo;
2158     s->avctx_mjpeg->idct_algo = avctx->idct_algo;
2159     s->avctx_mjpeg->max_pixels = avctx->max_pixels;
2160     ret = avcodec_open2(s->avctx_mjpeg, codec, NULL);
2161     if (ret < 0) {
2162         return ret;
2163     }
2164 
2165     return 0;
2166 }
2167 
tiff_end(AVCodecContext *avctx)2168 static av_cold int tiff_end(AVCodecContext *avctx)
2169 {
2170     TiffContext *const s = avctx->priv_data;
2171 
2172     free_geotags(s);
2173 
2174     ff_lzw_decode_close(&s->lzw);
2175     av_freep(&s->deinvert_buf);
2176     s->deinvert_buf_size = 0;
2177     av_freep(&s->yuv_line);
2178     s->yuv_line_size = 0;
2179     av_frame_free(&s->jpgframe);
2180     av_packet_free(&s->jpkt);
2181     avcodec_free_context(&s->avctx_mjpeg);
2182     return 0;
2183 }
2184 
2185 #define OFFSET(x) offsetof(TiffContext, x)
2186 static const AVOption tiff_options[] = {
2187     { "subimage", "decode subimage instead if available", OFFSET(get_subimage), AV_OPT_TYPE_BOOL, {.i64=0},  0, 1, AV_OPT_FLAG_DECODING_PARAM | AV_OPT_FLAG_VIDEO_PARAM },
2188     { "thumbnail", "decode embedded thumbnail subimage instead if available", OFFSET(get_thumbnail), AV_OPT_TYPE_BOOL, {.i64=0},  0, 1, AV_OPT_FLAG_DECODING_PARAM | AV_OPT_FLAG_VIDEO_PARAM },
2189     { "page", "page number of multi-page image to decode (starting from 1)", OFFSET(get_page), AV_OPT_TYPE_INT, {.i64=0}, 0, UINT16_MAX, AV_OPT_FLAG_DECODING_PARAM | AV_OPT_FLAG_VIDEO_PARAM },
2190     { NULL },
2191 };
2192 
2193 static const AVClass tiff_decoder_class = {
2194     .class_name = "TIFF decoder",
2195     .item_name  = av_default_item_name,
2196     .option     = tiff_options,
2197     .version    = LIBAVUTIL_VERSION_INT,
2198 };
2199 
2200 const FFCodec ff_tiff_decoder = {
2201     .p.name         = "tiff",
2202     .p.long_name    = NULL_IF_CONFIG_SMALL("TIFF image"),
2203     .p.type         = AVMEDIA_TYPE_VIDEO,
2204     .p.id           = AV_CODEC_ID_TIFF,
2205     .priv_data_size = sizeof(TiffContext),
2206     .init           = tiff_init,
2207     .close          = tiff_end,
2208     FF_CODEC_DECODE_CB(decode_frame),
2209     .p.capabilities = AV_CODEC_CAP_DR1 | AV_CODEC_CAP_FRAME_THREADS,
2210     .caps_internal  = FF_CODEC_CAP_INIT_THREADSAFE | FF_CODEC_CAP_INIT_CLEANUP,
2211     .p.priv_class   = &tiff_decoder_class,
2212 };
2213