| 590 | } |
| 591 | |
| 592 | short LibRaw::tiff_sget (unsigned save, uchar *buf, unsigned buf_len, INT64 *tag_offset, |
| 593 | unsigned *tag_id, unsigned *tag_type, INT64 *tag_dataoffset, |
| 594 | unsigned *tag_datalen, int *tag_dataunitlen) { |
| 595 | uchar *pos = buf + *tag_offset; |
| 596 | if ((((*tag_offset) + 12) > buf_len) || (*tag_offset < 0)) { // abnormal, tag buffer overrun |
| 597 | return -1; |
| 598 | } |
| 599 | *tag_id = sget2(pos); pos += 2; |
| 600 | *tag_type = sget2(pos); pos += 2; |
| 601 | *tag_datalen = sget4(pos); pos += 4; |
| 602 | *tag_dataunitlen = tagtype_dataunit_bytes[(*tag_type <= LIBRAW_EXIFTAG_TYPE_IFD8) ? *tag_type : 0]; |
| 603 | if ((*tag_datalen * (*tag_dataunitlen)) > 4) { |
| 604 | *tag_dataoffset = sget4(pos) - save; |
| 605 | if ((*tag_dataoffset + *tag_datalen) > buf_len) { // abnormal, tag data buffer overrun |
| 606 | return -2; |
| 607 | } |
| 608 | } else *tag_dataoffset = *tag_offset + 8; |
| 609 | *tag_offset += 12; |
| 610 | return 0; |
| 611 | } |
| 612 | |
| 613 | #define rICC imgdata.sizes.raw_inset_crops |
| 614 | #define S imgdata.sizes |
no test coverage detected