A few little tidyups and the eliminate of a potential crash if the T.85

decoder encounters certain kinds of messed up T.85 images.

diff --git a/libs/spandsp/src/t30.c b/libs/spandsp/src/t30.c
index 897ac4a449d8b8ec4f849302ef8e769b2442a7fb..fe909748e01b6df55e0fc7bdd29bd60f154e76f9 100644 (file)
--- a/libs/spandsp/src/t30.c
+++ b/libs/spandsp/src/t30.c
@@ -2967,7 +2967,7 @@ static int process_rx_pps(t30_state_t *s, const uint8_t *msg, int len)
         span_log(&s->logging, SPAN_LOG_FLOW, "Partial page OK - committing block %d, %d frames\n", s->ecm_block, s->ecm_frames);
         for (i = 0;  i < s->ecm_frames;  i++)
         {
-            if (t4_rx_put(&s->t4.rx, s->ecm_data[i], s->ecm_len[i]))
+            if (t4_rx_put(&s->t4.rx, s->ecm_data[i], s->ecm_len[i]) != T4_DECODE_MORE_DATA)
             {
                 /* This is the end of the document */
                 break;
@@ -5831,7 +5831,7 @@ SPAN_DECLARE_NONSTD(void) t30_non_ecm_put_bit(void *user_data, int bit)
         break;
     case T30_STATE_F_DOC_NON_ECM:
         /* Document transfer */
-        if (t4_rx_put_bit(&s->t4.rx, bit) == T4_DECODE_OK)
+        if (t4_rx_put_bit(&s->t4.rx, bit) != T4_DECODE_MORE_DATA)
         {
             /* That is the end of the document */
             set_state(s, T30_STATE_F_POST_DOC_NON_ECM);
@@ -5871,7 +5871,7 @@ SPAN_DECLARE(void) t30_non_ecm_put(void *user_data, const uint8_t buf[], int len
         break;
     case T30_STATE_F_DOC_NON_ECM:
         /* Document transfer */
-        if (t4_rx_put(&s->t4.rx, buf, len))
+        if (t4_rx_put(&s->t4.rx, buf, len) != T4_DECODE_MORE_DATA)
         {
             /* That is the end of the document */
             set_state(s, T30_STATE_F_POST_DOC_NON_ECM);

diff --git a/libs/spandsp/src/t4_rx.c b/libs/spandsp/src/t4_rx.c
index ea305098d392e46bed3424c1e7e61f00d77cd24a..69a98193a101ecb97e1d5dbf4712338fcf6d733f 100644 (file)
--- a/libs/spandsp/src/t4_rx.c
+++ b/libs/spandsp/src/t4_rx.c
@@ -90,8 +90,10 @@ typedef struct
 } packer_t;
 
 #if defined(SPANDSP_SUPPORT_TIFF_FX)
+#if TIFFLIB_VERSION >= 20120615
 extern TIFFFieldArray tiff_fx_field_array;
 #endif
+#endif
 
 SPAN_DECLARE(const char *) t4_compression_to_str(int compression)
 {

diff --git a/libs/spandsp/src/t4_tx.c b/libs/spandsp/src/t4_tx.c
index f3739c89db84cc8dcaaedf33be261f9a567636a0..991c807aaff0318ebd304f1cd9a64eaaf194bd1c 100644 (file)
--- a/libs/spandsp/src/t4_tx.c
+++ b/libs/spandsp/src/t4_tx.c
@@ -164,7 +164,7 @@ static const TIFFFieldInfo tiff_fx_tiff_field_info[] =
     {TIFFTAG_IMAGELAYER, 2, 2, TIFF_LONG, FIELD_CUSTOM, false, false, (char *) "ImageLayer"},
 };
 
-#if 1
+#if TIFFLIB_VERSION >= 20120615
 static TIFFField tiff_fx_tiff_fields[] =
 {
     { TIFFTAG_INDEXED, 1, 1, TIFF_SHORT, 0, TIFF_SETGET_UINT16, TIFF_SETGET_UNDEFINED, FIELD_CUSTOM, 1, 0, (char *) "Indexed" },

diff --git a/libs/spandsp/src/t85_decode.c b/libs/spandsp/src/t85_decode.c
index d7d1210367cb76e153e26b28922cdd2e2adbe464..82bbecf013a4853f833526c68404270c1405c413 100644 (file)
--- a/libs/spandsp/src/t85_decode.c
+++ b/libs/spandsp/src/t85_decode.c
@@ -299,12 +299,14 @@ static int check_bih(t85_decode_state_t *s)
 #endif
     {
         span_log(&s->logging, SPAN_LOG_FLOW, "BIH invalid. Fixed bytes do not contain expected values.\n");
+        s->end_of_data = 2;
         return T4_DECODE_INVALID_DATA;
     }
     /* P - Number of bit planes */
     if (s->buffer[2] < s->min_bit_planes  ||  s->buffer[2] > s->max_bit_planes)
     {
         span_log(&s->logging, SPAN_LOG_FLOW, "BIH invalid. %d bit planes. Should be %d to %d.\n", s->buffer[2], s->min_bit_planes, s->max_bit_planes);
+        s->end_of_data = 2;
         return T4_DECODE_INVALID_DATA;
     }
     s->bit_planes = s->buffer[2];
@@ -315,6 +317,7 @@ static int check_bih(t85_decode_state_t *s)
     if (s->xd == 0  ||  (s->max_xd  &&  s->xd > s->max_xd))
     {
         span_log(&s->logging, SPAN_LOG_FLOW, "BIH invalid. Width is %" PRIu32 "\n", s->xd);
+        s->end_of_data = 2;
         return T4_DECODE_INVALID_DATA;
     }
     /* YD - Vertical image size at layer D */
@@ -322,6 +325,7 @@ static int check_bih(t85_decode_state_t *s)
     if (s->yd == 0  ||  (s->max_yd  &&  s->yd > s->max_yd))
     {
         span_log(&s->logging, SPAN_LOG_FLOW, "BIH invalid. Length is %" PRIu32 "\n", s->yd);
+        s->end_of_data = 2;
         return T4_DECODE_INVALID_DATA;
     }
     /* L0 - Rows per stripe, at the lowest resolution */
@@ -329,6 +333,7 @@ static int check_bih(t85_decode_state_t *s)
     if (s->l0 == 0)
     {
         span_log(&s->logging, SPAN_LOG_FLOW, "BIH invalid. L0 is %" PRIu32 "\n", s->l0);
+        s->end_of_data = 2;
         return T4_DECODE_INVALID_DATA;
     }
     /* MX - Maximum horizontal offset allowed for AT pixel */
@@ -336,6 +341,7 @@ static int check_bih(t85_decode_state_t *s)
     if (s->mx > 127)
     {
         span_log(&s->logging, SPAN_LOG_FLOW, "BIH invalid. MX is %d\n", s->mx);
+        s->end_of_data = 2;
         return T4_DECODE_INVALID_DATA;
     }
     /* Options byte */
@@ -343,6 +349,7 @@ static int check_bih(t85_decode_state_t *s)
     if ((s->options & 0x97))
     {
         span_log(&s->logging, SPAN_LOG_FLOW, "BIH invalid. Options are 0x%X\n", s->options);
+        s->end_of_data = 2;
         return T4_DECODE_INVALID_DATA;
     }
     span_log(&s->logging, SPAN_LOG_FLOW, "BIH is OK. Image is %" PRIu32 "x%" PRIu32 " pixels\n", s->xd, s->yd);
@@ -388,6 +395,8 @@ SPAN_DECLARE(int) t85_decode_put(t85_decode_state_t *s, const uint8_t data[], si
     {
         if (s->y >= s->yd)
             return T4_DECODE_OK;
+        if (s->end_of_data > 0)
+            return T4_DECODE_INVALID_DATA;
         /* This is the end of image condition */
         s->end_of_data = 1;
     }
@@ -502,7 +511,6 @@ SPAN_DECLARE(int) t85_decode_put(t85_decode_state_t *s, const uint8_t data[], si
                    the commonest thing for us to hit here. */
                 decode_pscd(s, s->buffer, 2);
                 s->buf_len = 0;
-
                 if (s->interrupt)
                     return T4_DECODE_INTERRUPT;
                 break;
@@ -533,9 +541,11 @@ SPAN_DECLARE(int) t85_decode_put(t85_decode_state_t *s, const uint8_t data[], si
                     continue;
                 s->buf_needed = 2;
                 s->buf_len = 0;
-
                 if (s->at_moves >= T85_ATMOVES_MAX)
+                {
+                    s->end_of_data = 2;
                     return T4_DECODE_INVALID_DATA;
+                }
                 s->at_row[s->at_moves] = pack_32(&s->buffer[2]);
                 s->at_tx[s->at_moves] = s->buffer[6];
                 if (s->at_tx[s->at_moves] > s->mx
@@ -544,6 +554,7 @@ SPAN_DECLARE(int) t85_decode_put(t85_decode_state_t *s, const uint8_t data[], si
                     ||
                     s->buffer[7] != 0)
                 {
+                    s->end_of_data = 2;
                     return T4_DECODE_INVALID_DATA;
                 }
                 s->at_moves++;
@@ -554,14 +565,19 @@ SPAN_DECLARE(int) t85_decode_put(t85_decode_state_t *s, const uint8_t data[], si
                     continue;
                 s->buf_needed = 2;
                 s->buf_len = 0;
-
                 if (!(s->options & T85_VLENGTH))
+                {
+                    s->end_of_data = 2;
                     return T4_DECODE_INVALID_DATA;
+                }
                 s->options &= ~T85_VLENGTH;
                 y = pack_32(&s->buffer[2]);
                 /* An update to the image length is not allowed to stretch it. */
                 if (y > s->yd)
+                {
+                    s->end_of_data = 2;
                     return T4_DECODE_INVALID_DATA;
+                }
                 s->yd = y;
                 break;
             case T82_SDNORM:
@@ -643,7 +659,10 @@ SPAN_DECLARE(int) t85_decode_put(t85_decode_state_t *s, const uint8_t data[], si
                 y = pack_32(&s->buffer[4]);
                 /* An update to the image length is not allowed to stretch it. */
                 if (y > s->yd)
+                {
+                    s->end_of_data = 2;
                     return T4_DECODE_INVALID_DATA;
+                }
                 /* Things look OK, so accept this new length, and proceed. */
                 s->yd = y;
                 /* Now process the T82_SDNORM or T82_SDRST */
@@ -657,6 +676,7 @@ SPAN_DECLARE(int) t85_decode_put(t85_decode_state_t *s, const uint8_t data[], si
                 break;
             default:
                 s->buf_len = 0;
+                s->end_of_data = 2;
                 return T4_DECODE_INVALID_DATA;
             }
         }
@@ -673,10 +693,12 @@ SPAN_DECLARE(int) t85_decode_put(t85_decode_state_t *s, const uint8_t data[], si
             /* We should only have stopped processing PSCD if
                we ran out of data, or hit a T82_ESC */
             if (cnt < len  &&  data[cnt] != T82_ESC)
+            {
+                s->end_of_data = 2;
                 return T4_DECODE_INVALID_DATA;
+            }
         }
     }
-
     return T4_DECODE_MORE_DATA;
 }
 /*- End of function --------------------------------------------------------*/