--- tiff-3.8.2.orig/debian/libtiffxx0c2.shlibs +++ tiff-3.8.2/debian/libtiffxx0c2.shlibs @@ -0,0 +1 @@ +libtiffxx 0 libtiffxx0c2 --- tiff-3.8.2.orig/debian/libtiffxx0c2.install +++ tiff-3.8.2/debian/libtiffxx0c2.install @@ -0,0 +1 @@ +debian/tmp/usr/lib/libtiffxx.so.* --- tiff-3.8.2.orig/debian/README.Debian +++ tiff-3.8.2/debian/README.Debian @@ -0,0 +1,26 @@ +libtiff for Debian ++----------------+ + +This version of libtiff is installed with a different shared library +soname from the upstream version. This is because an accidental +change to the library's ABI was introduced somewhere between 3.5.7 and +3.6.1. There are no source-level incompatibilities between 3.5.7 and +the current version, so any application that worked with 3.5.7 should +work fine when recompiled with the libtiff4 packages. + +libtiff version 3.7.1 introduced an experimental and minimal C++ +interface. To use it, you must link against -ltiffxx. + +libtiff version 3.8.0 upstream introduced another binary +incompatibility, but it was fixed within a few days of 3.8.0's +release, and the binary incompatible never appeared in any debian +version of the tiff packages. + +Example tiff files are available: + + ftp://ftp.remotesensing.org/pub/libtiff/pics-.tar.gz + +These files may be useful for people testing software to make sure it +can work with a wide variety of tiff files. + + -- Jay Berkenbilt , Tue, 28 Mar 2006 21:39:25 -0500 --- tiff-3.8.2.orig/debian/rules +++ tiff-3.8.2/debian/rules @@ -0,0 +1,38 @@ +#!/usr/bin/make -f + +# Variables used by cdbs +VERSION := $(shell dpkg-parsechangelog | \ + awk '/Version:/ {print $$2}' | cut -d- -f 1) +DEB_TAR_SRCDIR = tiff-$(VERSION) +DEB_COMPRESS_EXCLUDE = html +export CPPFLAGS = -D_REENTRANT + +# Include cdbs rules files. +include /usr/share/cdbs/1/rules/tarball.mk +include /usr/share/cdbs/1/rules/patchsys-quilt.mk +include /usr/share/cdbs/1/rules/debhelper.mk +include /usr/share/cdbs/1/class/autotools.mk + +DEB_CONFIGURE_USER_FLAGS = --with-docdir="\$${prefix}/share/doc/libtiff-doc" + +# As 0.4.21, cdbs creates but doesn't remove debian/compat. It +# creates it conditionally, so this doesn't have a trivial fix. +clean:: + $(RM) debian/compat *.cdbs-config_list + $(RM) debian/*.preinst + +# tiffgt is in libtiff-opengl so libtiff-tools doesn't have to have +# all the X and opengl dependencies. +binary-post-install/libtiff-tools:: + $(RM) debian/libtiff-tools/usr/bin/tiffgt + $(RM) debian/libtiff-tools/usr/share/man/man1/tiffgt.1* + +# Install lintian override files and create preinst +binary-post-install/%:: + if [ -f debian/$*.lintian ]; then \ + mkdir -p debian/$*/usr/share/lintian/overrides && \ + cp -p debian/$*.lintian debian/$*/usr/share/lintian/overrides/$*; \ + fi + if [ "$*" != "libtiff4" ]; then \ + sed -e s/PKG/$*/g < debian/all-preinst > debian/$*.preinst; \ + fi --- tiff-3.8.2.orig/debian/libtiff4-dev.install +++ tiff-3.8.2/debian/libtiff4-dev.install @@ -0,0 +1,5 @@ +debian/tmp/usr/lib/lib*.so +debian/tmp/usr/lib/lib*.a +debian/tmp/usr/lib/lib*.la +debian/tmp/usr/include +debian/tmp/usr/share/man/man3 --- tiff-3.8.2.orig/debian/libtiff-tools.install +++ tiff-3.8.2/debian/libtiff-tools.install @@ -0,0 +1,2 @@ +debian/tmp/usr/bin +debian/tmp/usr/share/man/man1 --- tiff-3.8.2.orig/debian/README.source +++ tiff-3.8.2/debian/README.source @@ -0,0 +1,90 @@ + +INFORMATION SPECIFIC TO THE TIFF PACKAGE +======================================== + +The tiff upstream maintainers have a tendency to make mistakes that +introduce binary incompatibility between one version of tiff and +another. In order to verify binary compatibility, it is strongly +recommended to build a new library and install the new library without +installing the new tools. Then test the tools with the test images +provided by upstream. + +Additionally, when checking the sources to look for ABI changes, you +must check both the public header files (tiff.h and tiffio.h) and the +source file libtiff/tif_dirinfo.c which maps tag names to types. +Changes in the tag name to type mapping also result in binary +incompatibility because of the field setting and getting functions +using variable arguments. + + -- Jay Berkenbilt , Tue Mar 28 21:37:40 2006 + + +EXTRACTING SOURCES +================== + +This package uses tarball-in-tarball packaging. This will be changed +after the next upstream release. In the mean time, to extract the +sources to an unpatched tree, run + +./debian/rules pre-build + +Follow the boiler-plate instructions below for working with patches +with one exception: before running any quilt commands, you must cd to +build-tree/tiff-3.8.2. The QUILT_PATCHES variable must be set +relative to the actual root of the source package as indicated. + + +BOILER-PLATE TEXT +================= + +This package uses quilt to manage all modifications to the upstream +source. Changes are stored in the source package as diffs in +debian/patches and applied during the build. To set up quilt for +working with this package, cd to the root of the extracted source +package and run + + export QUILT_PATCHES=$PWD/debian/patches + +To get the fully patched source after unpacking the source package, cd to +the root level of the source package and run: + + quilt push -a + +The last patch listed in debian/patches/series will become the current +patch. + +To add a new set of changes, first run quilt push -a, and then run: + + quilt new + +where is a descriptive name for the patch, used as the filename in +debian/patches. Then, for every file that will be modified by this patch, +run: + + quilt add + +before editing those files. You must tell quilt with quilt add what files +will be part of the patch before making changes or quilt will not work +properly. After editing the files, run: + + quilt refresh + +to save the results as a patch. + +Alternately, if you already have an external patch and you just want to +add it to the build system, run quilt push -a and then: + + quilt import -P /path/to/patch + quilt push -a + +(add -p 0 to quilt import if needed). as above is the filename to +use in debian/patches. The last quilt push -a will apply the patch to +make sure it works properly. + +To remove an existing patch from the list of patches that will be applied, +run: + + quilt delete + +You may need to run quilt pop -a to unapply patches first before running +this command. --- tiff-3.8.2.orig/debian/libtiff-doc.install +++ tiff-3.8.2/debian/libtiff-doc.install @@ -0,0 +1 @@ +debian/tmp/usr/share/doc/libtiff-doc/html --- tiff-3.8.2.orig/debian/libtiff-tools.lintian +++ tiff-3.8.2/debian/libtiff-tools.lintian @@ -0,0 +1,5 @@ +# +# The synopsis line starts with a capital letter because of the TIFF +# acronym, not because it contains a sentence. +# +libtiff-tools: description-synopsis-starts-with-a-capital-letter --- tiff-3.8.2.orig/debian/libtiff4.lintian +++ tiff-3.8.2/debian/libtiff4.lintian @@ -0,0 +1,5 @@ +# +# The synopsis line starts with a capital letter because of the TIFF +# acronym, not because it contains a sentence. +# +libtiff4: description-synopsis-starts-with-a-capital-letter --- tiff-3.8.2.orig/debian/libtiff-opengl.install +++ tiff-3.8.2/debian/libtiff-opengl.install @@ -0,0 +1,2 @@ +debian/tmp/usr/bin/tiffgt +debian/tmp/usr/share/man/man1/tiffgt.1 --- tiff-3.8.2.orig/debian/libtiff-doc.doc-base +++ tiff-3.8.2/debian/libtiff-doc.doc-base @@ -0,0 +1,9 @@ +Document: libtiff-doc +Title: TIFF Software +Author: Sam Leffler +Abstract: Support for the Tag Image File Format (TIFF) for storing image data. +Section: Graphics + +Format: HTML +Index: /usr/share/doc/libtiff-doc/html/index.html +Files: /usr/share/doc/libtiff-doc/html/*.html --- tiff-3.8.2.orig/debian/changelog +++ tiff-3.8.2/debian/changelog @@ -0,0 +1,597 @@ +tiff (3.8.2-13ubuntu0.4) karmic-security; urgency=low + + * SECURITY UPDATE: denial of service via invalid ReferenceBlackWhite + values + - debian/patches/CVE-2010-2595.patch: validate values in + libtiff/tif_color.c. + - CVE-2010-2595 + * SECURITY UPDATE: denial of service via devide-by-zero (LP: #593067) + - debian/patches/CVE-2010-2597.patch: properly initialize fields in + libtiff/tif_strip.c. + - CVE-2010-2597 + - CVE-2010-2598 + * SECURITY UPDATE: denial of service via out-of-order tags + - debian/patches/CVE-2010-2630.patch: correctly handle order in + libtiff/tif_dirread.c. + - CVE-2010-2630 + * SECURITY UPDATE: denial of service and possible code exection via + YCBCRSUBSAMPLING tag + - debian/patches/CVE-2011-0191.patch: validate td_ycbcrsubsampling in + libtiff/tif_dir.c. + - CVE-2011-0191 + * SECURITY UPDATE: denial of service and possible code execution via + buffer overflow in Fax4Decode + - debian/patches/CVE-2011-0192.patch: check length in + libtiff/tif_fax3.h. + - CVE-2011-0192 + + -- Marc Deslauriers Fri, 04 Mar 2011 10:07:56 -0500 + +tiff (3.8.2-13ubuntu0.3) karmic-security; urgency=low + + * SECURITY UPDATE: arbitrary code execution and crashes via multiple + integer overflows. Backported upstream fixes: + - debian/patches/CVE-2010-1411.patch + - debian/patches/fix-unknown-tags.patch + + -- Kees Cook Thu, 17 Jun 2010 11:01:21 -0700 + +tiff (3.8.2-13) unstable; urgency=high + + * Apply patches to fix CVE-2009-2347, which covers two integer overflow + conditions. + * LZW patch from last update addressed CVE-2009-2285. Renamed the patch + to make this clearer. + + -- Jay Berkenbilt Sun, 12 Jul 2009 18:03:33 -0400 + +tiff (3.8.2-12) unstable; urgency=low + + * Apply patch to fix crash in lzw decoder that can be caused by certain + invalid image files. (Closes: #534137) + * No longer ignore errors in preinst + * Fixed new lintian warnings; updated standards version to 3.8.2. + + -- Jay Berkenbilt Sun, 28 Jun 2009 13:17:44 -0400 + +tiff (3.8.2-11) unstable; urgency=high + + * Apply security patches (CVE-2008-2327) + * Convert patch system to quilt + * Create README.source + * Set standards version to 3.8.0 + + -- Jay Berkenbilt Sun, 17 Aug 2008 13:16:37 -0400 + +tiff (3.8.2-10+lenny1) testing-security; urgency=high + + * Apply patches from Drew Yao of Apple Product Security to fix + CVE-2008-2327, a potential buffer underflow in the LZW decoder + (tif_lzw.c). + + -- Jay Berkenbilt Sun, 17 Aug 2008 11:56:01 -0400 + +tiff (3.8.2-10) unstable; urgency=low + + * Fix segmentation fault on subsequent parts of a file with an invalid + directory tag. (Closes: #475489) + + -- Jay Berkenbilt Mon, 09 Jun 2008 11:02:53 -0400 + +tiff (3.8.2-9) unstable; urgency=low + + * Backported tiff2pdf from 4.0.0 beta 2. This fixes many tiff2pdf bugs, + though unfortunately none of the ones opened in the debian bug + database! + * Added upstream homepage to debian control file. + + -- Jay Berkenbilt Sat, 07 Jun 2008 22:52:27 -0400 + +tiff (3.8.2-8) unstable; urgency=low + + * Accepted tmpfile patch tiff2pdf to fix bug that has been fixed + upstream since upstream release appears stalled. Thanks Jesse Long. + (Closes: #419773) + * Update standards version to 3.7.3; no changes required. + * ${Source-Version} -> ${binary:Version} in control + * Split documentation into separate libtiff-doc package. (Closes: + #472189) + + -- Jay Berkenbilt Sat, 22 Mar 2008 12:30:38 -0400 + +tiff (3.8.2-7+etch1) stable-security; urgency=high + + * Apply patches from Drew Yao of Apple Product Security to fix + CVE-2008-2327, a potential buffer underflow in the LZW decoder + (tif_lzw.c). + + -- Jay Berkenbilt Sun, 17 Aug 2008 11:56:01 -0400 + +tiff (3.8.2-7) unstable; urgency=high + + * Replace empty directories in /usr/share/doc with links during package + upgrade. (Closes: #404631) + + -- Jay Berkenbilt Tue, 2 Jan 2007 15:50:50 -0500 + +tiff (3.8.2-6) unstable; urgency=high + + * Add watch file + * Tavis Ormandy of the Google Security Team discovered several problems + in the TIFF library. The Common Vulnerabilities and Exposures project + identifies the following issues: + - CVE-2006-3459: a stack buffer overflow via TIFFFetchShortPair() in + tif_dirread.c + - CVE-2006-3460: A heap overflow vulnerability was discovered in the + jpeg decoder + - CVE-2006-3461: A heap overflow exists in the PixarLog decoder + - CVE-2006-3462: The NeXT RLE decoder was also vulnerable to a heap + overflow + - CVE-2006-3463: An infinite loop was discovered in + EstimateStripByteCounts() + - CVE-2006-3464: Multiple unchecked arithmetic operations were + uncovered, including a number of the range checking operations + deisgned to ensure the offsets specified in tiff directories are + legitimate. + - A number of codepaths were uncovered where assertions did not hold + true, resulting in the client application calling abort() + - CVE-2006-3465: A flaw was also uncovered in libtiffs custom tag + support + + -- Jay Berkenbilt Mon, 31 Jul 2006 18:14:59 -0400 + +tiff (3.8.2-5) unstable; urgency=low + + * Fix logic error that caused -q flag to be ignored when doing jpeg + compression with tiff2pdf. (Closes: #373102) + + -- Jay Berkenbilt Mon, 19 Jun 2006 18:55:38 -0400 + +tiff (3.8.2-4) unstable; urgency=high + + * SECURITY UPDATE: Arbitrary command execution with crafted TIF files. + Thanks to Martin Pitt. (Closes: #371064) + * Add debian/patches/tiff2pdf-octal-printf.patch: + - tools/tiff2pdf.c: Fix buffer overflow due to wrong printf for octal + signed char (it printed a signed integer, which overflew the buffer and + was wrong anyway). + - CVE-2006-2193 + + -- Jay Berkenbilt Wed, 7 Jun 2006 17:52:12 -0400 + +tiff (3.8.2-3) unstable; urgency=high + + * SECURITY UPDATE: Arbitrary command execution with crafted long file + names. Thanks to Martin Pitt for forwarding this. + Add debian/patches/tiffsplit-fname-overflow.patch: + - tools/tiffsplit.c: Use snprintf instead of strcpy for copying the + user-specified file name into a statically sized buffer. + CVE-2006-2656. (Closes: #369819) + * Update standards version to 3.7.2. No changes required. + * Moved doc-base information to libtiff4 instead of libtiff4-dev. + + -- Jay Berkenbilt Thu, 1 Jun 2006 21:24:21 -0400 + +tiff (3.8.2-2) unstable; urgency=low + + * Fix build dependencies to get OpenGL utility libraries after new Xorg + packaging. (Closes: #365722) + * Updated standards version to 3.7.0; no changes required to package. + + -- Jay Berkenbilt Tue, 2 May 2006 10:10:45 -0400 + +tiff (3.8.2-1) unstable; urgency=low + + * New upstream release + + -- Jay Berkenbilt Tue, 28 Mar 2006 21:42:33 -0500 + +tiff (3.8.0-3) unstable; urgency=low + + * Switched build dependency from xlibmesa-gl-dev to libgl1-mesa-dev + (incorporating Ubunutu patch) + * Incorporated patch from upstream to fix handling of RGBA tiffs in + tiff2pdf. (Closes: #352849) + + -- Jay Berkenbilt Sun, 26 Feb 2006 13:21:17 -0500 + +tiff (3.8.0-2) unstable; urgency=low + + * Applied fixes from upstream to address a memory access violation + [CVE-2006-0405]. (Closes: #350715, #351223) + + -- Jay Berkenbilt Fri, 3 Feb 2006 21:48:39 -0500 + +tiff (3.8.0-1) unstable; urgency=low + + * New upstream release. (Closes: #349921) + * NOTE: The debian version of 3.8.0 includes a patch to correct a binary + incompatibility in the original 3.8.0 release. This libtiff package + is binary compatible with 3.7.4 and will be binary compatible with the + upcoming 3.8.1 release. + + -- Jay Berkenbilt Fri, 27 Jan 2006 21:38:58 -0500 + +tiff (3.7.4-1) unstable; urgency=low + + * New upstream release + * Fix typos in manual page (Closes: #327921, #327922, #327923, #327924) + + -- Jay Berkenbilt Fri, 7 Oct 2005 10:25:49 -0400 + +tiff (3.7.3-1) unstable; urgency=low + + * New upstream release + * g++ 4.0 transition: libtiffxx0 is now libtiffxx0c2. + + -- Jay Berkenbilt Sat, 9 Jul 2005 12:00:44 -0400 + +tiff (3.7.2-3) unstable; urgency=high + + * Fix for exploitable segmentation fault on files with bad BitsPerSample + values. (Closes: #309739) + [libtiff/tif_dirread.c, CAN-2005-1544] + Thanks to Martin Pitt for the report. + + -- Jay Berkenbilt Thu, 19 May 2005 05:41:28 -0400 + +tiff (3.7.2-2) unstable; urgency=high + + * Fix zero pagesize bug with tiff2ps -a2 and tiff2ps -a3. Thanks to + Patrice Fournier for the patch. (Closes: #303583) + * Note: uploading with urgency=high since this very small fix impacts + tools only (not the library), and we don't want to block tiff's many + reverse dependencies from transitioning to sarge. + + -- Jay Berkenbilt Sun, 10 Apr 2005 10:12:37 -0400 + +tiff (3.7.2-1) unstable; urgency=low + + * New upstream release + + -- Jay Berkenbilt Sat, 19 Mar 2005 14:51:06 -0500 + +tiff (3.7.1-4) unstable; urgency=low + + * Fix from upstream: include a better workaround for tiff files with + invalid strip byte counts. (Closes: #183268) + + -- Jay Berkenbilt Tue, 22 Feb 2005 19:20:14 -0500 + +tiff (3.7.1-3) unstable; urgency=low + + * Disable C++ new experimental interfaces for now; will reappear in a + future version in the separate libtiffxx0 package. + + -- Jay Berkenbilt Sat, 29 Jan 2005 13:32:37 -0500 + +tiff (3.7.1+pre3.7.2-1) experimental; urgency=low + + * New upstream release + * Separate experimental C++ interface into separate libtiffxx library. + + -- Jay Berkenbilt Sat, 29 Jan 2005 13:03:19 -0500 + +tiff (3.7.1-2) unstable; urgency=low + + * Make -dev package depend upon other -dev packages referenced in the + .la file created by libtool. (Closes: #291136) + * tiff2ps: Allow one of -w and -h without the other. (Closes: #244247) + + -- Jay Berkenbilt Wed, 19 Jan 2005 10:45:00 -0500 + +tiff (3.7.1-1) unstable; urgency=low + + * New upstream release + * Correct error in doc-base file (Closes: #285652) + + -- Jay Berkenbilt Wed, 5 Jan 2005 16:54:12 -0500 + +tiff (3.7.0-2) experimental; urgency=low + + * Replace hard-coded libc6-dev dependency with something friendlier to + porters (libc6-dev | libc-dev). (Closes: #179727) + * Fixed upstream: proper netbsdelf*-gnu support in configure. Actually + fixed in 3.7.0-1 but left out of changelog. (Closes: #179728) + * Include opengl support; adds new libtiff-opengl package. (Closes: #219456) + * Fixed upstream: fax2ps now allows access to first page. (Closes: #244251) + + -- Jay Berkenbilt Sat, 11 Dec 2004 09:51:52 -0500 + +tiff (3.7.0-1) experimental; urgency=low + + * New upstream release (Closes: #276996) + * New maintainer (Thanks Joy!) + * Repackage using cdbs and simple-patchsys to fix some errors and + simplify patch management + * Fixed upstream: tiff2pdf ignores -z and -j (Closes: #280682) + * Fixed upstream: Memory leak in TIFFClientOpen (Closes: #256657) + + -- Jay Berkenbilt Fri, 26 Nov 2004 13:50:13 -0500 + +tiff (3.6.1-5) unstable; urgency=high + + * New maintainer (thanks Joy!) + * Applied patch by Dmitry V. Levin to fix a segmentation fault + [tools/tiffdump.c, CAN-2004-1183] + Thanks to Martin Schulze for forwarding the patch. + * Fixed section of -dev package (devel -> libdevel) + + -- Jay Berkenbilt Wed, 5 Jan 2005 16:27:26 -0500 + +tiff (3.6.1-4) unstable; urgency=high + + * Fix heap overflow security bug [CAN-2004-1308]. (Closes: #286815) + + -- Jay Berkenbilt Wed, 22 Dec 2004 10:20:52 -0500 + +tiff (3.6.1-3) unstable; urgency=medium + + * Patches from upstream to fix zero-size tile and integer overflow + problems created by previous security patches, closes: #276783. + * Added Jay Berkenbilt as co-maintainer. Jay thanks Joy for letting him + help and eventually take over maintenance of these packages! + + -- Josip Rodin Mon, 01 Nov 2004 12:28:27 +0100 + +tiff (3.6.1-2) unstable; urgency=low + + * Included security fixes for: + + CAN-2004-0803 + - libtiff/tif_luv.c + - libtiff/tif_next.c + - libtiff/tif_thunder.c + + CAN-2004-0804 (but this one is already applied upstream, it seems) + - libtiff/tif_dirread.c + + CAN-2004-0886 + - libtiff/tif_aux.c + - libtiff/tif_compress.c + - libtiff/tif_dir.c + - libtiff/tif_dirinfo.c + - libtiff/tif_dirread.c + - libtiff/tif_dirwrite.c + - libtiff/tif_extension.c + - libtiff/tif_fax3.c + - libtiff/tiffiop.h + - libtiff/tif_getimage.c + - libtiff/tif_luv.c + - libtiff/tif_pixarlog.c + - libtiff/tif_strip.c + - libtiff/tif_tile.c + - libtiff/tif_write.c + Thanks to Martin Schulze for forwarding the patches. + + -- Josip Rodin Thu, 14 Oct 2004 16:13:11 +0200 + +tiff (3.6.1-1.1) unstable; urgency=medium + + * Non-maintainer upload; thanks to Jay Berkenbilt for + preparing the patches + * Rename shared library and development packages to resolve accidental + upstream ABI change. Closes: #236247 + * Include patch from upstream to fix multistrip g3 fax bug. + Closes: #243405 + * Include LZW support. Closes: #260242, #248490 + * Fix URL in copyright file. Closes: #261357 + * Install missing documentation files. Closes: #261356 + + -- Steve Langasek Sun, 25 Jul 2004 10:28:06 -0400 + +tiff (3.6.1-1) unstable; urgency=low + + * New upstream version, closes: #231977. + * Slightly fixed up the static lib build rules so that the build process + does the normal stuff for the dynamic lib and then does the static with + the same tiffvers.h. + + -- Josip Rodin Mon, 23 Feb 2004 18:23:34 +0100 + +tiff (3.5.7-2) unstable; urgency=high + + * Added back the patch that used -src static/libtiff.a in the install + rule. Wonder how that disappeared... closes: #170914. + * Fake it's a GNU system in order for the configure script to use our + toolchain stuff on the NetBSD port, thanks to Joel Baker, closes: #130636. + + -- Josip Rodin Tue, 10 Dec 2002 17:18:28 +0100 + +tiff (3.5.7-1) unstable; urgency=low + + * New upstream version, closes: #144940. + * A whole new set of patches for the breakage in the build system :) + + -- Josip Rodin Sun, 6 Oct 2002 22:54:08 +0200 + +tiff (3.5.5-6) unstable; urgency=low + + * It appears that the general 64-bit detection code, isn't. + We have to include all of those three conditions, feh. + This really closes: #106706. + + -- Josip Rodin Wed, 8 Aug 2001 23:09:55 +0200 + +tiff (3.5.5-5) unstable; urgency=low + + * Changed two Alpha/Mips-isms into general 64-bit detection code, + patch from John Daily , closes: #106706. + * Patched man/Makefile.in to generate a manual page file for + TIFFClientOpen(3t), as a .so link to TIFFOpen(3t), closes: #99577. + * Used /usr/share/doc in the doc-base file, closes: #74122. + * Changed libtiff3g-dev's section back to devel, since graphics was, + according to elmo, "hysterical raisins". :)) + + -- Josip Rodin Fri, 27 Jul 2001 01:43:04 +0200 + +tiff (3.5.5-4) unstable; urgency=low + + * Updated config.* files, closes: #94696. + * Fixed libtiff3g-dev's section, closes: #85533. + + -- Josip Rodin Wed, 20 Jun 2001 18:29:24 +0200 + +tiff (3.5.5-3) unstable; urgency=low + + * Build shared library on Hurd, too, closes: #72482. + * Upped Standards-Version to 3.5.0. + + -- Josip Rodin Sat, 30 Sep 2000 17:42:13 +0200 + +tiff (3.5.5-2) unstable; urgency=low + + * Make `dynamic shared object' on Linux unconditionally, fixes the problem + with libc.so.6.1 on alpha, thanks Chris C. Chimelis. + + -- Josip Rodin Wed, 13 Sep 2000 21:44:00 +0200 + +tiff (3.5.5-1) unstable; urgency=low + + * New upstream version. + * The upstream build system sucks. There, I said it. Back to work now. :) + * Added a build dependencies on make (>= 3.77) (closes: #67747) and + debhelper. + * Standards-Version: 3.2.1: + + added DEB_BUILD_OPTIONS checks in debian/rules + + -- Josip Rodin Tue, 29 Aug 2000 14:06:02 +0200 + +tiff (3.5.4-5) frozen unstable; urgency=low + + * Fixed 16-bit/32-bit values bug in fax2ps from libtiff-tools, that + also breaks printing from hylafax, using provided oneliner patch + from Bernd Herd (accepted upstream), closes: #49232 and probably #62235. + + -- Josip Rodin Mon, 27 Mar 2000 17:12:10 +0200 + +tiff (3.5.4-4) frozen unstable; urgency=low + + * Weird dpkg-shlibdeps from dpkg 1.6.8-pre has done it again, this time + with libz.so, making the packages depend on zlib1 (instead of zlib1g). + Closes: #56134, #56137, #56140, #56155. + + -- Josip Rodin Tue, 25 Jan 2000 18:05:28 +0100 + +tiff (3.5.4-3) frozen unstable; urgency=low + + * Included libtiff.so file in libtiff3g-dev, dammit :( My eye hurts, + a lot, but this was easy to fix, thank goodness :) (closes: #55814). + This bugfix deserves to get into frozen because the bug cripples + libtiff3g-dev, a lot. + + -- Josip Rodin Fri, 21 Jan 2000 19:02:22 +0100 + +tiff (3.5.4-2) unstable; urgency=low + + * Fixed upstream build system to use ${DESTDIR}, and with that working, + created install: rule in debian/rules and used it. + * Fixed the way rules file gets the version from upstream sources, + and fixed dist/tiff.alpha, it didn't work. + * Removed README file from libtiff3g binary package, useless. + * Fixed configure script not to emit the wrong warning about + zlib/jpeg dirs not specified (they're in /usr/include, stupid :). + + -- Josip Rodin Thu, 30 Dec 1999 01:17:32 +0100 + +tiff (3.5.4-1) unstable; urgency=low + + * New upstream version, closes: #50338. + * Disabled libc5 build, it wouldn't compile. :( + + -- Josip Rodin Fri, 3 Dec 1999 20:49:25 +0100 + +tiff (3.5.2-4) unstable; urgency=low + + * Castrated the rules file, to make it actually work on !(i386 m68k). + Closes: #49316. + + -- Josip Rodin Sat, 6 Nov 1999 13:22:54 +0100 + +tiff (3.5.2-3) unstable; urgency=low + + * Removed sparc from the libtiff3 arches list, as BenC advised. + + -- Josip Rodin Fri, 29 Oct 1999 23:29:23 +0200 + +tiff (3.5.2-2) unstable; urgency=low + + * Changed Architecture: line for libtiff3 from "any" to "i386 m68k sparc" + as it is actually only built on those. Changed description a little bit. + * Minor fixes to the rules file. + + -- Josip Rodin Thu, 28 Oct 1999 14:00:02 +0200 + +tiff (3.5.2-1) unstable; urgency=low + + * New upstream version. + * Renamed source package to just "tiff", like upstream tarball name. + * New maintainer (thanks Guy!). Renewed packaging, with debhelper, + using Joey's nifty multi2 example, with several adjustments. + * Ditched libtiff3-altdev, nobody's using that and nobody should be + using that. Packaging for it still exists, it's just commented out. + * Uses doc-base for -dev docs now. Uncompressed HTML docs, 100kb space + saved is pointless when you can't use any links between documents. + + -- Josip Rodin Tue, 26 Oct 1999 16:20:46 +0200 + +libtiff3 (3.4beta037-8) unstable; urgency=low + + * Argh, same bug in the prerm, closes: #36990, #36850, #36855, + #36866, #36988. + + -- Guy Maor Sat, 1 May 1999 10:12:23 -0700 + +libtiff3 (3.4beta037-7) unstable; urgency=low + + * Don't error when dhelp is not installed, closes: #36879, #36922. + + -- Guy Maor Thu, 29 Apr 1999 19:17:55 -0700 + +libtiff3 (3.4beta037-6) unstable; urgency=low + + * Only build libc5 packages on appropriate archs, closes: #27083, #32007. + * Apply NMU patch, closes: #26413, #26887. + * Add dhelp support, closes: #35154. + * Recompile removes invalid dependency, closes: #30961. + + -- Guy Maor Sat, 24 Apr 1999 15:17:51 -0700 + +libtiff3 (3.4beta037-5.1) frozen unstable; urgency=low + + * NMU to not use install -s to strip static .a libraries. Fixes: #26413 + * Build with recent libjpeg. Fixes: #26887 + * Add Section: and Priority: headers to debian/control. + + -- Ben Gertzfield Mon, 26 Oct 1998 22:44:33 -0800 + +libtiff3 (3.4beta037-5) unstable; urgency=low + + * Explicit link with -lm (and don't need -lc now), fixes: #19167, #22180. + + -- Guy Maor Tue, 11 Aug 1998 22:27:56 -0700 + +libtiff3 (3.4beta037-4) unstable; urgency=low + + * libtiff3-tools conflicts & replaces with libtiff3-gif (13521,15107). + + -- Guy Maor Sun, 11 Jan 1998 13:09:28 -0800 + +libtiff3 (3.4beta037-3) unstable; urgency=low + + * New libjpegg contains shlibs file, so don't need shlibs.local. + * Compile with -D_REENTRANT. + * Add shlibs for libtiff3g (13423). + + -- Guy Maor Sat, 27 Sep 1997 13:17:45 -0500 + +libtiff3 (3.4beta037-2) unstable; urgency=low + + * Add libjpegg6a to shlibs.local to correct for broken dependency. + + -- Guy Maor Fri, 26 Sep 1997 11:23:55 -0500 + +libtiff3 (3.4beta037-1) unstable; urgency=low + + * New upstream version, libc6 compile, policy 2.3.0.0 (5136, 7470, 7627, 8166 + 8312, 9479, 9492, 9531, 11700, 11702). + * Fix check for shared lib support (10805). + + -- Guy Maor Tue, 23 Sep 1997 16:55:56 -0500 --- tiff-3.8.2.orig/debian/libtiff4-dev.lintian +++ tiff-3.8.2/debian/libtiff4-dev.lintian @@ -0,0 +1,5 @@ +# +# The synopsis line starts with a capital letter because of the TIFF +# acronym, not because it contains a sentence. +# +libtiff4-dev: description-synopsis-starts-with-a-capital-letter --- tiff-3.8.2.orig/debian/libtiff4.shlibs +++ tiff-3.8.2/debian/libtiff4.shlibs @@ -0,0 +1 @@ +libtiff 4 libtiff4 --- tiff-3.8.2.orig/debian/copyright +++ tiff-3.8.2/debian/copyright @@ -0,0 +1,37 @@ +libtiff was originally debianized by Guy Maor and +later maintained by Josip Rodin . Jay +Berkenbilt repackaged it in conjunction with the +3.7.0 release and is now the primary maintainer. + +Original source can be found at: http://www.remotesensing.org/libtiff/ + +Copyright (C) 1988-1997 Sam Leffler +Copyright (C) 1991-1997 Silicon Graphics, Inc. +Portions Copyright (C) 1985-1987, 1990 Regents of the University of California +Portions Copyright (C) 1990, 1991 Digital Equipment Corporation +Portions Copyright (C) 1990 Sun Microsystems, Inc. +Portions Copyright (C) 1990, 1995 Frank D. Cringle +Portions Copyright (C) 1996 BancTec AB +Portions Copyright (C) 1996 Mike Johnson +Portions Copyright (C) 1996 Pixar +Portions Copyright (C) 1997 Greg Ward Larson +Portions Copyright (C) 2000 Frank Warmerdam + +Permission to use, copy, modify, distribute, and sell this software and +its documentation for any purpose is hereby granted without fee, provided +that (i) the above copyright notices and this permission notice appear in +all copies of the software and related documentation, and (ii) the names of +Sam Leffler and Silicon Graphics may not be used in any advertising or +publicity relating to the software without the specific, prior written +permission of Sam Leffler and Silicon Graphics. + +THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND, +EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY +WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. + +IN NO EVENT SHALL SAM LEFFLER OR SILICON GRAPHICS BE LIABLE FOR +ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND, +OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, +WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF +LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE +OF THIS SOFTWARE. --- tiff-3.8.2.orig/debian/watch +++ tiff-3.8.2/debian/watch @@ -0,0 +1,2 @@ +version=3 +ftp://ftp.remotesensing.org/pub/libtiff/tiff-([\d\.]+).tar.gz --- tiff-3.8.2.orig/debian/control +++ tiff-3.8.2/debian/control @@ -0,0 +1,73 @@ +Source: tiff +Section: libs +Priority: optional +Maintainer: Ubuntu Developers +XSBC-Original-Maintainer: Jay Berkenbilt +Uploaders: Josip Rodin +Build-Depends: cdbs, quilt, debhelper (>= 5), zlib1g-dev, libjpeg62-dev, libxmu-dev, libglu1-mesa-dev, freeglut3-dev, libxi-dev +Standards-Version: 3.8.2 +Homepage: http://libtiff.maptools.org + +Package: libtiff4 +Architecture: any +Depends: ${misc:Depends}, ${shlibs:Depends} +Description: Tag Image File Format (TIFF) library + libtiff is a library providing support for the Tag Image File Format + (TIFF), a widely used format for storing image data. This package + includes the shared library. + +Package: libtiffxx0c2 +Architecture: any +Depends: ${misc:Depends}, ${shlibs:Depends} +Conflicts: libtiffxx0 +Replaces: libtiffxx0 +Description: Tag Image File Format (TIFF) library -- C++ interface + libtiff is a library providing support for the Tag Image File Format + (TIFF), a widely used format for storing image data. This package + includes the shared library for the experimental C++ interfaces. + +Package: libtiff4-dev +Section: libdevel +Architecture: any +Depends: ${misc:Depends}, libtiff4 (= ${binary:Version}), libtiffxx0c2 (= ${binary:Version}), libc6-dev | libc-dev, zlib1g-dev, libjpeg62-dev +Conflicts: libtiff3g-dev, libtiff3-dev, libtiff-dev +Provides: libtiff-dev +Description: Tag Image File Format library (TIFF), development files + libtiff is a library providing support for the Tag Image File Format + (TIFF), a widely used format for storing image data. This package + includes the development files, static library, and header files. + +Package: libtiff-tools +Section: graphics +Architecture: any +Depends: ${misc:Depends}, ${shlibs:Depends} +Suggests: libtiff-opengl +Conflicts: libtiff3 (<< 3.4beta037-1), libtiff3-gif +Replaces: libtiff3-gif +Description: TIFF manipulation and conversion tools + libtiff is a library providing support for the Tag Image File Format + (TIFF), a widely used format for storing image data. This package + includes tools for converting TIFF images to and from other formats + and tools for doing simple manipulations of TIFF images. See also + libtiff-opengl. + +Package: libtiff-opengl +Section: graphics +Architecture: any +Depends: ${misc:Depends}, ${shlibs:Depends} +Replaces: libtiff-tools (<< 3.7.0-2) +Description: TIFF manipulation and conversion tools + libtiff is a library providing support for the Tag Image File Format + (TIFF), a widely used format for storing image data. This package + contains libtiff tools that depend upon opengl. It complements the + libtiff-tools package, which contains the libtiff tools that don't + depend upon opengl. + +Package: libtiff-doc +Section: doc +Depends: ${misc:Depends} +Architecture: all +Description: TIFF manipulation and conversion documentation + libtiff is a library providing support for the Tag Image File Format + (TIFF), a widely used format for storing image data. This package + contains documentation. --- tiff-3.8.2.orig/debian/all-preinst +++ tiff-3.8.2/debian/all-preinst @@ -0,0 +1,6 @@ +#!/bin/sh +set -e +if [ "x$1" = "xupgrade" -a \ + -d /usr/share/doc/PKG -a ! -h /usr/share/doc/PKG ]; then + rm -rf /usr/share/doc/PKG +fi --- tiff-3.8.2.orig/debian/libtiffxx0c2.lintian +++ tiff-3.8.2/debian/libtiffxx0c2.lintian @@ -0,0 +1,5 @@ +# +# The synopsis line starts with a capital letter because of the TIFF +# acronym, not because it contains a sentence. +# +libtiffxx0c2: description-synopsis-starts-with-a-capital-letter --- tiff-3.8.2.orig/debian/libtiff4.install +++ tiff-3.8.2/debian/libtiff4.install @@ -0,0 +1 @@ +debian/tmp/usr/lib/libtiff.so.* --- tiff-3.8.2.orig/debian/libtiff-opengl.lintian +++ tiff-3.8.2/debian/libtiff-opengl.lintian @@ -0,0 +1,5 @@ +# +# The synopsis line starts with a capital letter because of the TIFF +# acronym, not because it contains a sentence. +# +libtiff-opengl: description-synopsis-starts-with-a-capital-letter --- tiff-3.8.2.orig/debian/patches/series +++ tiff-3.8.2/debian/patches/series @@ -0,0 +1,17 @@ +soname.patch +tiff2pdf.patch +tiff2pdf-octal-printf.patch +tif_print.patch +CVE-2008-2327.patch +man-errors.patch +tiffsplit-fname-overflow.patch +CVE-2006-3459-3465.patch +CVE-2009-2285-lzw.patch +CVE-2009-2347.patch +CVE-2010-1411.patch +fix-unknown-tags.patch +CVE-2010-2595.patch +CVE-2010-2597.patch +CVE-2010-2630.patch +CVE-2011-0191.patch +CVE-2011-0192.patch --- tiff-3.8.2.orig/debian/patches/CVE-2008-2327.patch +++ tiff-3.8.2/debian/patches/CVE-2008-2327.patch @@ -0,0 +1,60 @@ +Index: tiff-3.8.2/libtiff/tif_lzw.c +=================================================================== +--- tiff-3.8.2.orig/libtiff/tif_lzw.c 2008-08-17 13:03:49.090994393 -0400 ++++ tiff-3.8.2/libtiff/tif_lzw.c 2008-08-17 13:03:52.354994400 -0400 +@@ -237,6 +237,13 @@ + sp->dec_codetab[code].length = 1; + sp->dec_codetab[code].next = NULL; + } while (code--); ++ /* ++ * Zero-out the unused entries ++ */ ++ _TIFFmemset(&sp->dec_codetab[CODE_CLEAR], 0, ++ (CODE_FIRST-CODE_CLEAR)*sizeof (code_t)); ++ ++ + } + return (1); + } +@@ -408,12 +415,20 @@ + break; + if (code == CODE_CLEAR) { + free_entp = sp->dec_codetab + CODE_FIRST; ++ _TIFFmemset(free_entp, 0, (CSIZE-CODE_FIRST)*sizeof (code_t)); + nbits = BITS_MIN; + nbitsmask = MAXCODE(BITS_MIN); + maxcodep = sp->dec_codetab + nbitsmask-1; + NextCode(tif, sp, bp, code, GetNextCode); + if (code == CODE_EOI) + break; ++ if (code == CODE_CLEAR) { ++ TIFFErrorExt(tif->tif_clientdata, tif->tif_name, ++ "LZWDecode: Corrupted LZW table at scanline %d", ++ tif->tif_row); ++ return (0); ++ } ++ + *op++ = (char)code, occ--; + oldcodep = sp->dec_codetab + code; + continue; +@@ -604,12 +619,20 @@ + break; + if (code == CODE_CLEAR) { + free_entp = sp->dec_codetab + CODE_FIRST; ++ _TIFFmemset(free_entp, 0, (CSIZE-CODE_FIRST)*sizeof (code_t)); + nbits = BITS_MIN; + nbitsmask = MAXCODE(BITS_MIN); + maxcodep = sp->dec_codetab + nbitsmask; + NextCode(tif, sp, bp, code, GetNextCodeCompat); + if (code == CODE_EOI) + break; ++ if (code == CODE_CLEAR) { ++ TIFFErrorExt(tif->tif_clientdata, tif->tif_name, ++ "LZWDecode: Corrupted LZW table at scanline %d", ++ tif->tif_row); ++ return (0); ++ } ++ + *op++ = code, occ--; + oldcodep = sp->dec_codetab + code; + continue; --- tiff-3.8.2.orig/debian/patches/tiffsplit-fname-overflow.patch +++ tiff-3.8.2/debian/patches/tiffsplit-fname-overflow.patch @@ -0,0 +1,21 @@ +Index: tiff-3.8.2/tools/tiffsplit.c +=================================================================== +--- tiff-3.8.2.orig/tools/tiffsplit.c 2008-08-17 13:03:49.014994263 -0400 ++++ tiff-3.8.2/tools/tiffsplit.c 2008-08-17 13:03:52.726994578 -0400 +@@ -61,14 +61,13 @@ + return (-3); + } + if (argc > 2) +- strcpy(fname, argv[2]); ++ snprintf(fname, sizeof(fname), "%s", argv[2]); + in = TIFFOpen(argv[1], "r"); + if (in != NULL) { + do { + char path[1024+1]; + newfilename(); +- strcpy(path, fname); +- strcat(path, ".tif"); ++ snprintf(path, sizeof(path), "%s.tif", fname); + out = TIFFOpen(path, TIFFIsBigEndian(in)?"wb":"wl"); + if (out == NULL) + return (-2); --- tiff-3.8.2.orig/debian/patches/CVE-2010-1411.patch +++ tiff-3.8.2/debian/patches/CVE-2010-1411.patch @@ -0,0 +1,25 @@ +Description: fix integer overflow in use of TIFFroundup (CVE-2010-1411) +Author: Tomas Hoger + +Index: tiff-3.8.2/libtiff/tif_fax3.c +=================================================================== +--- tiff-3.8.2.orig/libtiff/tif_fax3.c 2010-06-10 18:09:58.779641597 -0700 ++++ tiff-3.8.2/libtiff/tif_fax3.c 2010-06-10 18:11:50.949640612 -0700 +@@ -491,7 +491,16 @@ + td->td_compression == COMPRESSION_CCITTFAX4 + ); + +- nruns = needsRefLine ? 2*TIFFroundup(rowpixels,32) : rowpixels; ++ if (needsRefLine) { ++ /* integer overflow check */ ++ if ((uint32)rowpixels > 0xffffffff - 32 || TIFFroundup(rowpixels,32) > 0xffffffff / 2) ++ return (0); ++ nruns = 2*TIFFroundup(rowpixels,32); ++ } else ++ nruns = rowpixels; ++ /* integer overflow check */ ++ if (nruns > (0xffffffff - 3) / 2) ++ return (0); + + dsp->runs = (uint32*) _TIFFCheckMalloc(tif, 2*nruns+3, sizeof (uint32), + "for Group 3/4 run arrays"); --- tiff-3.8.2.orig/debian/patches/CVE-2010-2597.patch +++ tiff-3.8.2/debian/patches/CVE-2010-2597.patch @@ -0,0 +1,35 @@ +Description: fix denial of service via devide-by-zero +Origin: backport, r1.19.2.3 +Bug: http://bugzilla.maptools.org/show_bug.cgi?id=2215 +Bug-Ubuntu: https://bugs.launchpad.net/bugs/593067 + +Index: tiff-3.8.2/libtiff/tif_strip.c +=================================================================== +--- tiff-3.8.2.orig/libtiff/tif_strip.c 2011-03-03 14:19:34.000000000 -0500 ++++ tiff-3.8.2/libtiff/tif_strip.c 2011-03-03 14:27:58.000000000 -0500 +@@ -124,9 +124,9 @@ + uint16 ycbcrsubsampling[2]; + tsize_t w, scanline, samplingarea; + +- TIFFGetField( tif, TIFFTAG_YCBCRSUBSAMPLING, +- ycbcrsubsampling + 0, +- ycbcrsubsampling + 1 ); ++ TIFFGetFieldDefaulted(tif, TIFFTAG_YCBCRSUBSAMPLING, ++ ycbcrsubsampling + 0, ++ ycbcrsubsampling + 1); + + samplingarea = ycbcrsubsampling[0]*ycbcrsubsampling[1]; + if (samplingarea == 0) { +@@ -234,9 +234,9 @@ + && !isUpSampled(tif)) { + uint16 ycbcrsubsampling[2]; + +- TIFFGetField(tif, TIFFTAG_YCBCRSUBSAMPLING, +- ycbcrsubsampling + 0, +- ycbcrsubsampling + 1); ++ TIFFGetFieldDefaulted(tif, TIFFTAG_YCBCRSUBSAMPLING, ++ ycbcrsubsampling + 0, ++ ycbcrsubsampling + 1); + + if (ycbcrsubsampling[0] == 0) { + TIFFErrorExt(tif->tif_clientdata, tif->tif_name, --- tiff-3.8.2.orig/debian/patches/tiff2pdf-octal-printf.patch +++ tiff-3.8.2/debian/patches/tiff2pdf-octal-printf.patch @@ -0,0 +1,13 @@ +Index: tiff-3.8.2/tools/tiff2pdf.c +=================================================================== +--- tiff-3.8.2.orig/tools/tiff2pdf.c 2008-08-17 13:03:51.873994205 -0400 ++++ tiff-3.8.2/tools/tiff2pdf.c 2008-08-17 13:03:52.045994618 -0400 +@@ -3733,7 +3733,7 @@ + written += t2pWriteFile(output, (tdata_t) "(", 1); + for (i=0; itdir_tag == IGNORE) + continue; +- if (fix >= tif->tif_nfields) +- fix = 0; + + /* + * Silicon Beach (at least) writes unordered + * directory tags (violating the spec). Handle + * it here, but be obnoxious (maybe they'll fix it?). + */ +- if (dp->tdir_tag < tif->tif_fieldinfo[fix]->field_tag) { ++ if (dp->tdir_tag < previous_tag) { + if (!diroutoforderwarning) { + TIFFWarningExt(tif->tif_clientdata, module, + "%s: invalid TIFF directory; tags are not sorted in ascending order", + tif->tif_name); + diroutoforderwarning = 1; + } +- fix = 0; /* O(n^2) */ + } ++ previous_tag = dp->tdir_tag; ++ if (fix >= tif->tif_nfields || ++ dp->tdir_tag < tif->tif_fieldinfo[fix]->field_tag) ++ fix = 0; /* O(n^2) */ + while (fix < tif->tif_nfields && + tif->tif_fieldinfo[fix]->field_tag < dp->tdir_tag) + fix++; --- tiff-3.8.2.orig/debian/patches/CVE-2006-3459-3465.patch +++ tiff-3.8.2/debian/patches/CVE-2006-3459-3465.patch @@ -0,0 +1,677 @@ +Index: tiff-3.8.2/libtiff/tif_dir.c +=================================================================== +--- tiff-3.8.2.orig/libtiff/tif_dir.c 2008-08-17 13:03:48.954994295 -0400 ++++ tiff-3.8.2/libtiff/tif_dir.c 2008-08-17 13:03:52.881994558 -0400 +@@ -122,6 +122,7 @@ + { + static const char module[] = "_TIFFVSetField"; + ++ const TIFFFieldInfo* fip = _TIFFFindFieldInfo(tif, tag, TIFF_ANY); + TIFFDirectory* td = &tif->tif_dir; + int status = 1; + uint32 v32, i, v; +@@ -195,10 +196,12 @@ + break; + case TIFFTAG_ORIENTATION: + v = va_arg(ap, uint32); ++ const TIFFFieldInfo* fip; + if (v < ORIENTATION_TOPLEFT || ORIENTATION_LEFTBOT < v) { ++ fip = _TIFFFieldWithTag(tif, tag); + TIFFWarningExt(tif->tif_clientdata, tif->tif_name, + "Bad value %lu for \"%s\" tag ignored", +- v, _TIFFFieldWithTag(tif, tag)->field_name); ++ v, fip ? fip->field_name : "Unknown"); + } else + td->td_orientation = (uint16) v; + break; +@@ -387,11 +390,15 @@ + * happens, for example, when tiffcp is used to convert between + * compression schemes and codec-specific tags are blindly copied. + */ ++ /* ++ * better not dereference fip if it is NULL. ++ * -- taviso@google.com 15 Jun 2006 ++ */ + if(fip == NULL || fip->field_bit != FIELD_CUSTOM) { + TIFFErrorExt(tif->tif_clientdata, module, + "%s: Invalid %stag \"%s\" (not supported by codec)", + tif->tif_name, isPseudoTag(tag) ? "pseudo-" : "", +- _TIFFFieldWithTag(tif, tag)->field_name); ++ fip ? fip->field_name : "Unknown"); + status = 0; + break; + } +@@ -468,7 +475,7 @@ + if (fip->field_type == TIFF_ASCII) + _TIFFsetString((char **)&tv->value, va_arg(ap, char *)); + else { +- tv->value = _TIFFmalloc(tv_size * tv->count); ++ tv->value = _TIFFCheckMalloc(tif, tv_size, tv->count, "Tag Value"); + if (!tv->value) { + status = 0; + goto end; +@@ -563,7 +570,7 @@ + } + } + if (status) { +- TIFFSetFieldBit(tif, _TIFFFieldWithTag(tif, tag)->field_bit); ++ TIFFSetFieldBit(tif, fip->field_bit); + tif->tif_flags |= TIFF_DIRTYDIRECT; + } + +@@ -572,12 +579,12 @@ + return (status); + badvalue: + TIFFErrorExt(tif->tif_clientdata, module, "%s: Bad value %d for \"%s\"", +- tif->tif_name, v, _TIFFFieldWithTag(tif, tag)->field_name); ++ tif->tif_name, v, fip ? fip->field_name : "Unknown"); + va_end(ap); + return (0); + badvalue32: + TIFFErrorExt(tif->tif_clientdata, module, "%s: Bad value %ld for \"%s\"", +- tif->tif_name, v32, _TIFFFieldWithTag(tif, tag)->field_name); ++ tif->tif_name, v32, fip ? fip->field_name : "Unknown"); + va_end(ap); + return (0); + } +@@ -813,12 +820,16 @@ + * If the client tries to get a tag that is not valid + * for the image's codec then we'll arrive here. + */ ++ /* ++ * dont dereference fip if it's NULL. ++ * -- taviso@google.com 15 Jun 2006 ++ */ + if( fip == NULL || fip->field_bit != FIELD_CUSTOM ) + { + TIFFErrorExt(tif->tif_clientdata, "_TIFFVGetField", + "%s: Invalid %stag \"%s\" (not supported by codec)", + tif->tif_name, isPseudoTag(tag) ? "pseudo-" : "", +- _TIFFFieldWithTag(tif, tag)->field_name); ++ fip ? fip->field_name : "Unknown"); + ret_val = 0; + break; + } +Index: tiff-3.8.2/libtiff/tif_dirinfo.c +=================================================================== +--- tiff-3.8.2.orig/libtiff/tif_dirinfo.c 2008-08-17 13:03:48.958994316 -0400 ++++ tiff-3.8.2/libtiff/tif_dirinfo.c 2008-08-17 13:03:52.890034927 -0400 +@@ -775,7 +775,8 @@ + TIFFErrorExt(tif->tif_clientdata, "TIFFFieldWithTag", + "Internal error, unknown tag 0x%x", + (unsigned int) tag); +- assert(fip != NULL); ++ /* assert(fip != NULL); */ ++ + /*NOTREACHED*/ + } + return (fip); +@@ -789,7 +790,8 @@ + if (!fip) { + TIFFErrorExt(tif->tif_clientdata, "TIFFFieldWithName", + "Internal error, unknown tag %s", field_name); +- assert(fip != NULL); ++ /* assert(fip != NULL); */ ++ + /*NOTREACHED*/ + } + return (fip); +Index: tiff-3.8.2/libtiff/tif_dirread.c +=================================================================== +--- tiff-3.8.2.orig/libtiff/tif_dirread.c 2008-08-17 13:03:48.962994506 -0400 ++++ tiff-3.8.2/libtiff/tif_dirread.c 2008-08-17 13:03:52.890034927 -0400 +@@ -29,6 +29,9 @@ + * + * Directory Read Support Routines. + */ ++ ++#include ++ + #include "tiffiop.h" + + #define IGNORE 0 /* tag placeholder used below */ +@@ -81,6 +84,7 @@ + uint16 dircount; + toff_t nextdiroff; + int diroutoforderwarning = 0; ++ int compressionknown = 0; + toff_t* new_dirlist; + + tif->tif_diroff = tif->tif_nextdiroff; +@@ -147,13 +151,20 @@ + } else { + toff_t off = tif->tif_diroff; + +- if (off + sizeof (uint16) > tif->tif_size) { +- TIFFErrorExt(tif->tif_clientdata, module, +- "%s: Can not read TIFF directory count", +- tif->tif_name); +- return (0); ++ /* ++ * Check for integer overflow when validating the dir_off, otherwise ++ * a very high offset may cause an OOB read and crash the client. ++ * -- taviso@google.com, 14 Jun 2006. ++ */ ++ if (off + sizeof (uint16) > tif->tif_size || ++ off > (UINT_MAX - sizeof(uint16))) { ++ TIFFErrorExt(tif->tif_clientdata, module, ++ "%s: Can not read TIFF directory count", ++ tif->tif_name); ++ return (0); + } else +- _TIFFmemcpy(&dircount, tif->tif_base + off, sizeof (uint16)); ++ _TIFFmemcpy(&dircount, tif->tif_base + off, ++ sizeof (uint16)); + off += sizeof (uint16); + if (tif->tif_flags & TIFF_SWAB) + TIFFSwabShort(&dircount); +@@ -254,6 +265,7 @@ + while (fix < tif->tif_nfields && + tif->tif_fieldinfo[fix]->field_tag < dp->tdir_tag) + fix++; ++ + if (fix >= tif->tif_nfields || + tif->tif_fieldinfo[fix]->field_tag != dp->tdir_tag) { + +@@ -264,17 +276,23 @@ + dp->tdir_tag, + dp->tdir_tag, + dp->tdir_type); +- +- TIFFMergeFieldInfo(tif, +- _TIFFCreateAnonFieldInfo(tif, +- dp->tdir_tag, +- (TIFFDataType) dp->tdir_type), +- 1 ); ++ /* ++ * creating anonymous fields prior to knowing the compression ++ * algorithm (ie, when the field info has been merged) could cause ++ * crashes with pathological directories. ++ * -- taviso@google.com 15 Jun 2006 ++ */ ++ if (compressionknown) ++ TIFFMergeFieldInfo(tif, _TIFFCreateAnonFieldInfo(tif, dp->tdir_tag, ++ (TIFFDataType) dp->tdir_type), 1 ); ++ else goto ignore; ++ + fix = 0; + while (fix < tif->tif_nfields && + tif->tif_fieldinfo[fix]->field_tag < dp->tdir_tag) + fix++; + } ++ + /* + * Null out old tags that we ignore. + */ +@@ -326,6 +344,7 @@ + dp->tdir_type, dp->tdir_offset); + if (!TIFFSetField(tif, dp->tdir_tag, (uint16)v)) + goto bad; ++ else compressionknown++; + break; + /* XXX: workaround for broken TIFFs */ + } else if (dp->tdir_type == TIFF_LONG) { +@@ -540,6 +559,7 @@ + * Attempt to deal with a missing StripByteCounts tag. + */ + if (!TIFFFieldSet(tif, FIELD_STRIPBYTECOUNTS)) { ++ const TIFFFieldInfo* fip = _TIFFFieldWithTag(tif, TIFFTAG_STRIPBYTECOUNTS); + /* + * Some manufacturers violate the spec by not giving + * the size of the strips. In this case, assume there +@@ -556,7 +576,7 @@ + "%s: TIFF directory is missing required " + "\"%s\" field, calculating from imagelength", + tif->tif_name, +- _TIFFFieldWithTag(tif,TIFFTAG_STRIPBYTECOUNTS)->field_name); ++ fip ? fip->field_name : "Unknown"); + if (EstimateStripByteCounts(tif, dir, dircount) < 0) + goto bad; + /* +@@ -580,6 +600,7 @@ + } else if (td->td_nstrips == 1 + && td->td_stripoffset[0] != 0 + && BYTECOUNTLOOKSBAD) { ++ const TIFFFieldInfo* fip = _TIFFFieldWithTag(tif, TIFFTAG_STRIPBYTECOUNTS); + /* + * XXX: Plexus (and others) sometimes give a value of zero for + * a tag when they don't know what the correct value is! Try +@@ -589,13 +610,14 @@ + TIFFWarningExt(tif->tif_clientdata, module, + "%s: Bogus \"%s\" field, ignoring and calculating from imagelength", + tif->tif_name, +- _TIFFFieldWithTag(tif,TIFFTAG_STRIPBYTECOUNTS)->field_name); ++ fip ? fip->field_name : "Unknown"); + if(EstimateStripByteCounts(tif, dir, dircount) < 0) + goto bad; + } else if (td->td_planarconfig == PLANARCONFIG_CONTIG + && td->td_nstrips > 2 + && td->td_compression == COMPRESSION_NONE + && td->td_stripbytecount[0] != td->td_stripbytecount[1]) { ++ const TIFFFieldInfo* fip = _TIFFFieldWithTag(tif, TIFFTAG_STRIPBYTECOUNTS); + /* + * XXX: Some vendors fill StripByteCount array with absolutely + * wrong values (it can be equal to StripOffset array, for +@@ -604,7 +626,7 @@ + TIFFWarningExt(tif->tif_clientdata, module, + "%s: Wrong \"%s\" field, ignoring and calculating from imagelength", + tif->tif_name, +- _TIFFFieldWithTag(tif,TIFFTAG_STRIPBYTECOUNTS)->field_name); ++ fip ? fip->field_name : "Unknown"); + if (EstimateStripByteCounts(tif, dir, dircount) < 0) + goto bad; + } +@@ -870,7 +892,13 @@ + + register TIFFDirEntry *dp; + register TIFFDirectory *td = &tif->tif_dir; +- uint16 i; ++ ++ /* i is used to iterate over td->td_nstrips, so must be ++ * at least the same width. ++ * -- taviso@google.com 15 Jun 2006 ++ */ ++ ++ uint32 i; + + if (td->td_stripbytecount) + _TIFFfree(td->td_stripbytecount); +@@ -947,16 +975,18 @@ + static int + CheckDirCount(TIFF* tif, TIFFDirEntry* dir, uint32 count) + { ++ const TIFFFieldInfo* fip = _TIFFFieldWithTag(tif, dir->tdir_tag); ++ + if (count > dir->tdir_count) { + TIFFWarningExt(tif->tif_clientdata, tif->tif_name, + "incorrect count for field \"%s\" (%lu, expecting %lu); tag ignored", +- _TIFFFieldWithTag(tif, dir->tdir_tag)->field_name, ++ fip ? fip->field_name : "Unknown", + dir->tdir_count, count); + return (0); + } else if (count < dir->tdir_count) { + TIFFWarningExt(tif->tif_clientdata, tif->tif_name, + "incorrect count for field \"%s\" (%lu, expecting %lu); tag trimmed", +- _TIFFFieldWithTag(tif, dir->tdir_tag)->field_name, ++ fip ? fip->field_name : "Unknown", + dir->tdir_count, count); + return (1); + } +@@ -970,6 +1000,7 @@ + TIFFFetchData(TIFF* tif, TIFFDirEntry* dir, char* cp) + { + int w = TIFFDataWidth((TIFFDataType) dir->tdir_type); ++ const TIFFFieldInfo* fip = _TIFFFieldWithTag(tif, dir->tdir_tag); + tsize_t cc = dir->tdir_count * w; + + /* Check for overflow. */ +@@ -1013,7 +1044,7 @@ + bad: + TIFFErrorExt(tif->tif_clientdata, tif->tif_name, + "Error fetching data for field \"%s\"", +- _TIFFFieldWithTag(tif, dir->tdir_tag)->field_name); ++ fip ? fip->field_name : "Unknown"); + return (tsize_t) 0; + } + +@@ -1039,10 +1070,12 @@ + static int + cvtRational(TIFF* tif, TIFFDirEntry* dir, uint32 num, uint32 denom, float* rv) + { ++ const TIFFFieldInfo* fip; + if (denom == 0) { ++ fip = _TIFFFieldWithTag(tif, dir->tdir_tag); + TIFFErrorExt(tif->tif_clientdata, tif->tif_name, + "%s: Rational with zero denominator (num = %lu)", +- _TIFFFieldWithTag(tif, dir->tdir_tag)->field_name, num); ++ fip ? fip->field_name : "Unknown", num); + return (0); + } else { + if (dir->tdir_type == TIFF_RATIONAL) +@@ -1159,6 +1192,20 @@ + static int + TIFFFetchShortPair(TIFF* tif, TIFFDirEntry* dir) + { ++ /* ++ * Prevent overflowing the v stack arrays below by performing a sanity ++ * check on tdir_count, this should never be greater than two. ++ * -- taviso@google.com 14 Jun 2006. ++ */ ++ if (dir->tdir_count > 2) { ++ const TIFFFieldInfo* fip = _TIFFFieldWithTag(tif, dir->tdir_tag); ++ TIFFWarningExt(tif->tif_clientdata, tif->tif_name, ++ "unexpected count for field \"%s\", %lu, expected 2; ignored.", ++ fip ? fip->field_name : "Unknown", ++ dir->tdir_count); ++ return 0; ++ } ++ + switch (dir->tdir_type) { + case TIFF_BYTE: + case TIFF_SBYTE: +@@ -1329,14 +1376,15 @@ + case TIFF_DOUBLE: + return (TIFFFetchDoubleArray(tif, dir, (double*) v)); + default: ++ { const TIFFFieldInfo* fip = _TIFFFieldWithTag(tif, dir->tdir_tag); + /* TIFF_NOTYPE */ + /* TIFF_ASCII */ + /* TIFF_UNDEFINED */ + TIFFErrorExt(tif->tif_clientdata, tif->tif_name, + "cannot read TIFF_ANY type %d for field \"%s\"", + dir->tdir_type, +- _TIFFFieldWithTag(tif, dir->tdir_tag)->field_name); +- return (0); ++ fip ? fip->field_name : "Unknown"); ++ return (0); } + } + return (1); + } +@@ -1351,6 +1399,9 @@ + int ok = 0; + const TIFFFieldInfo* fip = _TIFFFieldWithTag(tif, dp->tdir_tag); + ++ if (fip == NULL) { ++ return (0); ++ } + if (dp->tdir_count > 1) { /* array of values */ + char* cp = NULL; + +@@ -1493,6 +1544,7 @@ + TIFFFetchPerSampleShorts(TIFF* tif, TIFFDirEntry* dir, uint16* pl) + { + uint16 samples = tif->tif_dir.td_samplesperpixel; ++ const TIFFFieldInfo* fip; + int status = 0; + + if (CheckDirCount(tif, dir, (uint32) samples)) { +@@ -1510,9 +1562,10 @@ + + for (i = 1; i < check_count; i++) + if (v[i] != v[0]) { ++ fip = _TIFFFieldWithTag(tif, dir->tdir_tag); + TIFFErrorExt(tif->tif_clientdata, tif->tif_name, + "Cannot handle different per-sample values for field \"%s\"", +- _TIFFFieldWithTag(tif, dir->tdir_tag)->field_name); ++ fip ? fip->field_name : "Unknown"); + goto bad; + } + *pl = v[0]; +@@ -1534,6 +1587,7 @@ + TIFFFetchPerSampleLongs(TIFF* tif, TIFFDirEntry* dir, uint32* pl) + { + uint16 samples = tif->tif_dir.td_samplesperpixel; ++ const TIFFFieldInfo* fip; + int status = 0; + + if (CheckDirCount(tif, dir, (uint32) samples)) { +@@ -1551,9 +1605,10 @@ + check_count = samples; + for (i = 1; i < check_count; i++) + if (v[i] != v[0]) { ++ fip = _TIFFFieldWithTag(tif, dir->tdir_tag); + TIFFErrorExt(tif->tif_clientdata, tif->tif_name, + "Cannot handle different per-sample values for field \"%s\"", +- _TIFFFieldWithTag(tif, dir->tdir_tag)->field_name); ++ fip ? fip->field_name : "Unknown"); + goto bad; + } + *pl = v[0]; +@@ -1574,6 +1629,7 @@ + TIFFFetchPerSampleAnys(TIFF* tif, TIFFDirEntry* dir, double* pl) + { + uint16 samples = tif->tif_dir.td_samplesperpixel; ++ const TIFFFieldInfo* fip; + int status = 0; + + if (CheckDirCount(tif, dir, (uint32) samples)) { +@@ -1591,9 +1647,10 @@ + + for (i = 1; i < check_count; i++) + if (v[i] != v[0]) { ++ fip = _TIFFFieldWithTag(tif, dir->tdir_tag); + TIFFErrorExt(tif->tif_clientdata, tif->tif_name, + "Cannot handle different per-sample values for field \"%s\"", +- _TIFFFieldWithTag(tif, dir->tdir_tag)->field_name); ++ fip ? fip->field_name : "Unknown"); + goto bad; + } + *pl = v[0]; +Index: tiff-3.8.2/libtiff/tif_fax3.c +=================================================================== +--- tiff-3.8.2.orig/libtiff/tif_fax3.c 2008-08-17 13:03:48.970994629 -0400 ++++ tiff-3.8.2/libtiff/tif_fax3.c 2008-08-17 13:03:52.890034927 -0400 +@@ -1136,6 +1136,7 @@ + Fax3VSetField(TIFF* tif, ttag_t tag, va_list ap) + { + Fax3BaseState* sp = Fax3State(tif); ++ const TIFFFieldInfo* fip; + + assert(sp != 0); + assert(sp->vsetparent != 0); +@@ -1181,7 +1182,13 @@ + default: + return (*sp->vsetparent)(tif, tag, ap); + } +- TIFFSetFieldBit(tif, _TIFFFieldWithTag(tif, tag)->field_bit); ++ ++ if ((fip = _TIFFFieldWithTag(tif, tag))) { ++ TIFFSetFieldBit(tif, fip->field_bit); ++ } else { ++ return (0); ++ } ++ + tif->tif_flags |= TIFF_DIRTYDIRECT; + return (1); + } +Index: tiff-3.8.2/libtiff/tif_jpeg.c +=================================================================== +--- tiff-3.8.2.orig/libtiff/tif_jpeg.c 2008-08-17 13:03:48.974994391 -0400 ++++ tiff-3.8.2/libtiff/tif_jpeg.c 2008-08-17 13:03:52.894064968 -0400 +@@ -722,15 +722,31 @@ + segment_width = TIFFhowmany(segment_width, sp->h_sampling); + segment_height = TIFFhowmany(segment_height, sp->v_sampling); + } +- if (sp->cinfo.d.image_width != segment_width || +- sp->cinfo.d.image_height != segment_height) { ++ if (sp->cinfo.d.image_width < segment_width || ++ sp->cinfo.d.image_height < segment_height) { + TIFFWarningExt(tif->tif_clientdata, module, + "Improper JPEG strip/tile size, expected %dx%d, got %dx%d", + segment_width, + segment_height, + sp->cinfo.d.image_width, + sp->cinfo.d.image_height); ++ } ++ ++ if (sp->cinfo.d.image_width > segment_width || ++ sp->cinfo.d.image_height > segment_height) { ++ /* ++ * This case could be dangerous, if the strip or tile size has been ++ * reported as less than the amount of data jpeg will return, some ++ * potential security issues arise. Catch this case and error out. ++ * -- taviso@google.com 14 Jun 2006 ++ */ ++ TIFFErrorExt(tif->tif_clientdata, module, ++ "JPEG strip/tile size exceeds expected dimensions," ++ "expected %dx%d, got %dx%d", segment_width, segment_height, ++ sp->cinfo.d.image_width, sp->cinfo.d.image_height); ++ return (0); + } ++ + if (sp->cinfo.d.num_components != + (td->td_planarconfig == PLANARCONFIG_CONTIG ? + td->td_samplesperpixel : 1)) { +@@ -761,6 +777,22 @@ + sp->cinfo.d.comp_info[0].v_samp_factor, + sp->h_sampling, sp->v_sampling); + ++ /* ++ * There are potential security issues here for decoders that ++ * have already allocated buffers based on the expected sampling ++ * factors. Lets check the sampling factors dont exceed what ++ * we were expecting. ++ * -- taviso@google.com 14 June 2006 ++ */ ++ if (sp->cinfo.d.comp_info[0].h_samp_factor > sp->h_sampling || ++ sp->cinfo.d.comp_info[0].v_samp_factor > sp->v_sampling) { ++ TIFFErrorExt(tif->tif_clientdata, module, ++ "Cannot honour JPEG sampling factors that" ++ " exceed those specified."); ++ return (0); ++ } ++ ++ + /* + * XXX: Files written by the Intergraph software + * has different sampling factors stored in the +@@ -1521,15 +1553,18 @@ + { + JPEGState *sp = JState(tif); + +- assert(sp != 0); ++ /* assert(sp != 0); */ + + tif->tif_tagmethods.vgetfield = sp->vgetparent; + tif->tif_tagmethods.vsetfield = sp->vsetparent; + +- if( sp->cinfo_initialized ) +- TIFFjpeg_destroy(sp); /* release libjpeg resources */ +- if (sp->jpegtables) /* tag value */ +- _TIFFfree(sp->jpegtables); ++ if (sp != NULL) { ++ if( sp->cinfo_initialized ) ++ TIFFjpeg_destroy(sp); /* release libjpeg resources */ ++ if (sp->jpegtables) /* tag value */ ++ _TIFFfree(sp->jpegtables); ++ } ++ + _TIFFfree(tif->tif_data); /* release local state */ + tif->tif_data = NULL; + +@@ -1541,6 +1576,7 @@ + { + JPEGState* sp = JState(tif); + TIFFDirectory* td = &tif->tif_dir; ++ const TIFFFieldInfo* fip; + uint32 v32; + + assert(sp != NULL); +@@ -1606,7 +1642,13 @@ + default: + return (*sp->vsetparent)(tif, tag, ap); + } +- TIFFSetFieldBit(tif, _TIFFFieldWithTag(tif, tag)->field_bit); ++ ++ if ((fip = _TIFFFieldWithTag(tif, tag))) { ++ TIFFSetFieldBit(tif, fip->field_bit); ++ } else { ++ return (0); ++ } ++ + tif->tif_flags |= TIFF_DIRTYDIRECT; + return (1); + } +@@ -1726,7 +1768,11 @@ + { + JPEGState* sp = JState(tif); + +- assert(sp != NULL); ++ /* assert(sp != NULL); */ ++ if (sp == NULL) { ++ TIFFWarningExt(tif->tif_clientdata, "JPEGPrintDir", "Unknown JPEGState"); ++ return; ++ } + + (void) flags; + if (TIFFFieldSet(tif,FIELD_JPEGTABLES)) +Index: tiff-3.8.2/libtiff/tif_next.c +=================================================================== +--- tiff-3.8.2.orig/libtiff/tif_next.c 2008-08-17 13:03:48.978994352 -0400 ++++ tiff-3.8.2/libtiff/tif_next.c 2008-08-17 13:03:52.894064968 -0400 +@@ -105,11 +105,16 @@ + * as codes of the form + * until we've filled the scanline. + */ ++ /* ++ * Ensure the run does not exceed the scanline ++ * bounds, potentially resulting in a security issue. ++ * -- taviso@google.com 14 Jun 2006. ++ */ + op = row; + for (;;) { + grey = (n>>6) & 0x3; + n &= 0x3f; +- while (n-- > 0) ++ while (n-- > 0 && npixels < imagewidth) + SETPIXEL(op, grey); + if (npixels >= (int) imagewidth) + break; +Index: tiff-3.8.2/libtiff/tif_pixarlog.c +=================================================================== +--- tiff-3.8.2.orig/libtiff/tif_pixarlog.c 2008-08-17 13:03:48.986994374 -0400 ++++ tiff-3.8.2/libtiff/tif_pixarlog.c 2008-08-17 13:03:52.894064968 -0400 +@@ -768,7 +768,19 @@ + if (tif->tif_flags & TIFF_SWAB) + TIFFSwabArrayOfShort(up, nsamples); + +- for (i = 0; i < nsamples; i += llen, up += llen) { ++ /* ++ * if llen is not an exact multiple of nsamples, the decode operation ++ * may overflow the output buffer, so truncate it enough to prevent that ++ * but still salvage as much data as possible. ++ * -- taviso@google.com 14th June 2006 ++ */ ++ if (nsamples % llen) ++ TIFFWarningExt(tif->tif_clientdata, module, ++ "%s: stride %lu is not a multiple of sample count, " ++ "%lu, data truncated.", tif->tif_name, llen, nsamples); ++ ++ ++ for (i = 0; i < nsamples - (nsamples % llen); i += llen, up += llen) { + switch (sp->user_datafmt) { + case PIXARLOGDATAFMT_FLOAT: + horizontalAccumulateF(up, llen, sp->stride, +Index: tiff-3.8.2/libtiff/tif_read.c +=================================================================== +--- tiff-3.8.2.orig/libtiff/tif_read.c 2008-08-17 13:03:48.990994211 -0400 ++++ tiff-3.8.2/libtiff/tif_read.c 2008-08-17 13:03:52.898026507 -0400 +@@ -31,6 +31,8 @@ + #include "tiffiop.h" + #include + ++#include ++ + int TIFFFillStrip(TIFF*, tstrip_t); + int TIFFFillTile(TIFF*, ttile_t); + static int TIFFStartStrip(TIFF*, tstrip_t); +@@ -272,7 +274,13 @@ + if ((tif->tif_flags & TIFF_MYBUFFER) && tif->tif_rawdata) + _TIFFfree(tif->tif_rawdata); + tif->tif_flags &= ~TIFF_MYBUFFER; +- if ( td->td_stripoffset[strip] + bytecount > tif->tif_size) { ++ /* ++ * This sanity check could potentially overflow, causing an OOB read. ++ * verify that offset + bytecount is > offset. ++ * -- taviso@google.com 14 Jun 2006 ++ */ ++ if ( td->td_stripoffset[strip] + bytecount > tif->tif_size || ++ bytecount > (UINT_MAX - td->td_stripoffset[strip])) { + /* + * This error message might seem strange, but it's + * what would happen if a read were done instead. +@@ -470,7 +478,13 @@ + if ((tif->tif_flags & TIFF_MYBUFFER) && tif->tif_rawdata) + _TIFFfree(tif->tif_rawdata); + tif->tif_flags &= ~TIFF_MYBUFFER; +- if ( td->td_stripoffset[tile] + bytecount > tif->tif_size) { ++ /* ++ * We must check this calculation doesnt overflow, potentially ++ * causing an OOB read. ++ * -- taviso@google.com 15 Jun 2006 ++ */ ++ if (td->td_stripoffset[tile] + bytecount > tif->tif_size || ++ bytecount > (UINT_MAX - td->td_stripoffset[tile])) { + tif->tif_curtile = NOTILE; + return (0); + } --- tiff-3.8.2.orig/debian/patches/CVE-2011-0191.patch +++ tiff-3.8.2/debian/patches/CVE-2011-0191.patch @@ -0,0 +1,19 @@ +Description: denial of service and possible code exection via + YCBCRSUBSAMPLING tag +Origin: Thanks to Apple + +Index: tiff-3.8.2/libtiff/tif_dir.c +=================================================================== +--- tiff-3.8.2.orig/libtiff/tif_dir.c 2011-03-03 14:56:43.000000000 -0500 ++++ tiff-3.8.2/libtiff/tif_dir.c 2011-03-03 14:57:20.000000000 -0500 +@@ -359,6 +359,10 @@ + case TIFFTAG_YCBCRSUBSAMPLING: + td->td_ycbcrsubsampling[0] = (uint16) va_arg(ap, int); + td->td_ycbcrsubsampling[1] = (uint16) va_arg(ap, int); ++ if (td->td_ycbcrsubsampling[0] > 4) ++ td->td_ycbcrsubsampling[0] = (td->td_compression == 7) ? 1 : 2; ++ if (td->td_ycbcrsubsampling[1] > 4) ++ td->td_ycbcrsubsampling[1] = (td->td_compression == 7) ? 1 : 2; + break; + case TIFFTAG_TRANSFERFUNCTION: + v = (td->td_samplesperpixel - td->td_extrasamples) > 1 ? 3 : 1; --- tiff-3.8.2.orig/debian/patches/CVE-2009-2347.patch +++ tiff-3.8.2/debian/patches/CVE-2009-2347.patch @@ -0,0 +1,109 @@ +Index: tiff-3.8.2/tools/rgb2ycbcr.c +=================================================================== +--- tiff-3.8.2.orig/tools/rgb2ycbcr.c 2009-07-12 14:37:00.967192158 -0400 ++++ tiff-3.8.2/tools/rgb2ycbcr.c 2009-07-12 14:37:20.287192468 -0400 +@@ -34,6 +34,7 @@ + # include + #endif + ++#include "tiffiop.h" + #include "tiffio.h" + + #define streq(a,b) (strcmp(a,b) == 0) +@@ -279,13 +280,30 @@ + char *stringv; + uint32 longv; + ++ size_t pixel_count; + TIFFGetField(in, TIFFTAG_IMAGEWIDTH, &width); + TIFFGetField(in, TIFFTAG_IMAGELENGTH, &height); +- raster = (uint32*)_TIFFmalloc(width * height * sizeof (uint32)); ++ pixel_count = width * height; ++ ++ /* XXX: Check the integer overflow. */ ++ if (!width || !height || pixel_count / width != height) { ++ TIFFError(TIFFFileName(in), ++ "Malformed input file; " ++ "can't allocate buffer for raster of %lux%lu size", ++ (unsigned long)width, (unsigned long)height); ++ return 0; ++ } ++ ++ raster = (uint32*)_TIFFCheckMalloc(in, pixel_count, sizeof(uint32), ++ "raster buffer"); + if (raster == 0) { +- TIFFError(TIFFFileName(in), "No space for raster buffer"); ++ TIFFError(TIFFFileName(in), ++ "Requested buffer size is %lu elements %lu each", ++ (unsigned long)pixel_count, ++ (unsigned long)sizeof(uint32)); + return (0); + } ++ + if (!TIFFReadRGBAImage(in, width, height, raster, 0)) { + _TIFFfree(raster); + return (0); +Index: tiff-3.8.2/tools/tiff2rgba.c +=================================================================== +--- tiff-3.8.2.orig/tools/tiff2rgba.c 2009-07-12 14:37:00.975192458 -0400 ++++ tiff-3.8.2/tools/tiff2rgba.c 2009-07-12 14:37:20.295191816 -0400 +@@ -34,6 +34,7 @@ + # include + #endif + ++#include "tiffiop.h" + #include "tiffio.h" + + #define streq(a,b) (strcmp(a,b) == 0) +@@ -328,16 +329,27 @@ + uint32* raster; /* retrieve RGBA image */ + uint32 width, height; /* image width & height */ + uint32 row; ++ size_t pixel_count; + + TIFFGetField(in, TIFFTAG_IMAGEWIDTH, &width); + TIFFGetField(in, TIFFTAG_IMAGELENGTH, &height); ++ pixel_count = width * height; ++ ++ /* XXX: Check the integer overflow. */ ++ if (!width || !height || pixel_count / width != height) { ++ TIFFError(TIFFFileName(in), ++ "Malformed input file; can't allocate buffer for raster of %lux%lu size", ++ (unsigned long)width, (unsigned long)height); ++ return 0; ++ } + + rowsperstrip = TIFFDefaultStripSize(out, rowsperstrip); + TIFFSetField(out, TIFFTAG_ROWSPERSTRIP, rowsperstrip); + +- raster = (uint32*)_TIFFmalloc(width * height * sizeof (uint32)); ++ raster = (uint32*)_TIFFCheckMalloc(in, pixel_count, sizeof(uint32), "raster buffer"); + if (raster == 0) { +- TIFFError(TIFFFileName(in), "No space for raster buffer"); ++ TIFFError(TIFFFileName(in), "Requested buffer size is %lu elements %lu each", ++ (unsigned long)pixel_count, (unsigned long)sizeof(uint32)); + return (0); + } + +@@ -353,18 +365,18 @@ + */ + if( no_alpha ) + { +- int pixel_count = width * height; ++ size_t count = pixel_count; + unsigned char *src, *dst; + + src = (unsigned char *) raster; + dst = (unsigned char *) raster; +- while( pixel_count > 0 ) ++ while(count > 0) + { + *(dst++) = *(src++); + *(dst++) = *(src++); + *(dst++) = *(src++); + src++; +- pixel_count--; ++ count--; + } + } + --- tiff-3.8.2.orig/debian/patches/fix-unknown-tags.patch +++ tiff-3.8.2/debian/patches/fix-unknown-tags.patch @@ -0,0 +1,189 @@ +Description: fix crashes from unknown tag handling. +Origin: backported from upstream 3.9.4 + +Index: tiff-3.8.2/libtiff/tif_dirread.c +=================================================================== +--- tiff-3.8.2.orig/libtiff/tif_dirread.c 2010-06-17 11:40:48.836399406 -0700 ++++ tiff-3.8.2/libtiff/tif_dirread.c 2010-06-17 11:41:58.434710862 -0700 +@@ -43,6 +43,7 @@ + extern void TIFFCvtIEEEFloatToNative(TIFF*, uint32, float*); + extern void TIFFCvtIEEEDoubleToNative(TIFF*, uint32, double*); + #endif ++extern int _TIFFMergeFieldInfo_check(TIFF* tif, const TIFFFieldInfo info[], int n); + + static int EstimateStripByteCounts(TIFF*, TIFFDirEntry*, uint16); + static void MissingRequired(TIFF*, const char*); +@@ -85,6 +86,7 @@ + toff_t nextdiroff; + int diroutoforderwarning = 0; + int compressionknown = 0; ++ int haveunknowntags = 0; + toff_t* new_dirlist; + + tif->tif_diroff = tif->tif_nextdiroff; +@@ -245,8 +247,10 @@ + fix = 0; + for (dp = dir, n = dircount; n > 0; n--, dp++) { + +- if (fix >= tif->tif_nfields || dp->tdir_tag == IGNORE) ++ if (dp->tdir_tag == IGNORE) + continue; ++ if (fix >= tif->tif_nfields) ++ fix = 0; + + /* + * Silicon Beach (at least) writes unordered +@@ -268,29 +272,9 @@ + + if (fix >= tif->tif_nfields || + tif->tif_fieldinfo[fix]->field_tag != dp->tdir_tag) { +- +- TIFFWarningExt(tif->tif_clientdata, +- module, +- "%s: unknown field with tag %d (0x%x) encountered", +- tif->tif_name, +- dp->tdir_tag, +- dp->tdir_tag, +- dp->tdir_type); +- /* +- * creating anonymous fields prior to knowing the compression +- * algorithm (ie, when the field info has been merged) could cause +- * crashes with pathological directories. +- * -- taviso@google.com 15 Jun 2006 +- */ +- if (compressionknown) +- TIFFMergeFieldInfo(tif, _TIFFCreateAnonFieldInfo(tif, dp->tdir_tag, +- (TIFFDataType) dp->tdir_type), 1 ); +- else goto ignore; +- +- fix = 0; +- while (fix < tif->tif_nfields && +- tif->tif_fieldinfo[fix]->field_tag < dp->tdir_tag) +- fix++; ++ /* Unknown tag ... we'll deal with it below */ ++ haveunknowntags = 1; ++ continue; + } + + /* +@@ -381,6 +365,76 @@ + } + + /* ++ * If we saw any unknown tags, make an extra pass over the directory ++ * to deal with them. This must be done separately because the tags ++ * could have become known when we registered a codec after finding ++ * the Compression tag. In a correctly-sorted directory there's ++ * no problem because Compression will come before any codec-private ++ * tags, but if the sorting is wrong that might not hold. ++ */ ++ if (haveunknowntags) { ++ fix = 0; ++ for (dp = dir, n = dircount; n > 0; n--, dp++) { ++ if (dp->tdir_tag == IGNORE) ++ continue; ++ if (fix >= tif->tif_nfields || ++ dp->tdir_tag < tif->tif_fieldinfo[fix]->field_tag) ++ fix = 0; /* O(n^2) */ ++ while (fix < tif->tif_nfields && ++ tif->tif_fieldinfo[fix]->field_tag < dp->tdir_tag) ++ fix++; ++ if (fix >= tif->tif_nfields || ++ tif->tif_fieldinfo[fix]->field_tag != dp->tdir_tag) { ++ ++ TIFFWarningExt(tif->tif_clientdata, ++ module, ++ "%s: unknown field with tag %d (0x%x) encountered", ++ tif->tif_name, ++ dp->tdir_tag, ++ dp->tdir_tag); ++ ++ if (!_TIFFMergeFieldInfo_check(tif, ++ _TIFFCreateAnonFieldInfo(tif, ++ dp->tdir_tag, ++ (TIFFDataType) dp->tdir_type), ++ 1)) ++ { ++ TIFFWarningExt(tif->tif_clientdata, ++ module, ++ "Registering anonymous field with tag %d (0x%x) failed", ++ dp->tdir_tag, ++ dp->tdir_tag); ++ dp->tdir_tag = IGNORE; ++ continue; ++ } ++ fix = 0; ++ while (fix < tif->tif_nfields && ++ tif->tif_fieldinfo[fix]->field_tag < dp->tdir_tag) ++ fix++; ++ } ++ /* ++ * Check data type. ++ */ ++ fip = tif->tif_fieldinfo[fix]; ++ while (dp->tdir_type != (unsigned short) fip->field_type ++ && fix < tif->tif_nfields) { ++ if (fip->field_type == TIFF_ANY) /* wildcard */ ++ break; ++ fip = tif->tif_fieldinfo[++fix]; ++ if (fix >= tif->tif_nfields || ++ fip->field_tag != dp->tdir_tag) { ++ TIFFWarningExt(tif->tif_clientdata, module, ++ "%s: wrong data type %d for \"%s\"; tag ignored", ++ tif->tif_name, dp->tdir_type, ++ tif->tif_fieldinfo[fix-1]->field_name); ++ dp->tdir_tag = IGNORE; ++ break; ++ } ++ } ++ } ++ } ++ ++ /* + * Allocate directory structure and setup defaults. + */ + if (!TIFFFieldSet(tif, FIELD_IMAGEDIMENSIONS)) { +Index: tiff-3.8.2/libtiff/tif_dirinfo.c +=================================================================== +--- tiff-3.8.2.orig/libtiff/tif_dirinfo.c 2010-06-17 11:40:48.836399406 -0700 ++++ tiff-3.8.2/libtiff/tif_dirinfo.c 2010-06-17 11:41:33.193899323 -0700 +@@ -566,8 +566,8 @@ + return strcmp(ta->field_name, tb->field_name); + } + +-void +-_TIFFMergeFieldInfo(TIFF* tif, const TIFFFieldInfo info[], int n) ++int ++_TIFFMergeFieldInfo_check(TIFF* tif, const TIFFFieldInfo info[], int n) + { + TIFFFieldInfo** tp; + int i; +@@ -582,7 +582,11 @@ + tif->tif_fieldinfo = (TIFFFieldInfo**) + _TIFFmalloc(n * sizeof (TIFFFieldInfo*)); + } +- assert(tif->tif_fieldinfo != NULL); ++ if (!tif->tif_fieldinfo) { ++ TIFFErrorExt(tif->tif_clientdata, "_TIFFMergeFieldInfo", ++ "Failed to allocate field info array"); ++ return 0; ++ } + tp = tif->tif_fieldinfo + tif->tif_nfields; + for (i = 0; i < n; i++) + *tp++ = (TIFFFieldInfo*) (info + i); /* XXX */ +@@ -590,6 +594,15 @@ + /* Sort the field info by tag number */ + qsort(tif->tif_fieldinfo, tif->tif_nfields += n, + sizeof (TIFFFieldInfo*), tagCompare); ++ ++ return n; ++} ++ ++void ++_TIFFMergeFieldInfo(TIFF* tif, const TIFFFieldInfo info[], int n) ++{ ++ if (!_TIFFMergeFieldInfo_check(tif, info, n)) ++ assert(tif->tif_fieldinfo != NULL); + } + + void --- tiff-3.8.2.orig/debian/patches/CVE-2011-0192.patch +++ tiff-3.8.2/debian/patches/CVE-2011-0192.patch @@ -0,0 +1,19 @@ +Description: fix denial of service and possible code execution via + buffer overflow in Fax4Decode +Origin: Thanks to Apple and Huzaifa Sidhpurwala + +Index: tiff-3.8.2/libtiff/tif_fax3.h +=================================================================== +--- tiff-3.8.2.orig/libtiff/tif_fax3.h 2011-03-03 14:57:43.000000000 -0500 ++++ tiff-3.8.2/libtiff/tif_fax3.h 2011-03-03 14:58:04.000000000 -0500 +@@ -478,6 +478,10 @@ + break; \ + case S_VL: \ + CHECK_b1; \ ++ if (b1 <= (int) (a0 + TabEnt->Param)) { \ ++ unexpected("VL", a0); \ ++ goto eol2d; \ ++ } \ + SETVALUE(b1 - a0 - TabEnt->Param); \ + b1 -= *--pb; \ + break; \ --- tiff-3.8.2.orig/debian/patches/man-errors.patch +++ tiff-3.8.2/debian/patches/man-errors.patch @@ -0,0 +1,308 @@ +Index: tiff-3.8.2/man/fax2ps.1 +=================================================================== +--- tiff-3.8.2.orig/man/fax2ps.1 2008-08-17 13:03:49.038994710 -0400 ++++ tiff-3.8.2/man/fax2ps.1 2008-08-17 13:03:52.510994390 -0400 +@@ -27,7 +27,7 @@ + .SH NAME + fax2ps \- convert a + .SM TIFF +-facsimile to compressed \*(Ps\(tm ++facsimile to compressed PostScript\(tm + .SH SYNOPSIS + .B fax2ps + [ +@@ -40,7 +40,7 @@ + reads one or more + .SM TIFF + facsimile image files and prints a compressed form of +-\*(Ps on the standard output that is suitable for printing. ++PostScript on the standard output that is suitable for printing. + .PP + By default, each page is scaled to reflect the + image dimensions and resolutions stored in the file. +@@ -62,26 +62,26 @@ + .PP + By default + .I fax2ps +-generates \*(Ps for all pages in the file. ++generates PostScript for all pages in the file. + The + .B \-p + option can be used to select one or more pages from + a multi-page document. + .PP + .I fax2ps +-generates a compressed form of \*(Ps that is +-optimized for sending pages of text to a \*(Ps ++generates a compressed form of PostScript that is ++optimized for sending pages of text to a PostScript + printer attached to a host through a low-speed link (such + as a serial line). + Each output page is filled with white and then only + the black areas are drawn. +-The \*(Ps specification of the black drawing operations ++The PostScript specification of the black drawing operations + is optimized by using a special font that encodes the + move-draw operations required to fill + the black regions on the page. + This compression scheme typically results in a substantially +-reduced \*(Ps description, relative to the straightforward +-imaging of the page with a \*(Ps ++reduced PostScript description, relative to the straightforward ++imaging of the page with a PostScript + .I image + operator. + This algorithm can, however, be ineffective +@@ -138,9 +138,9 @@ + attempts to recover from such data errors by resynchronizing + decoding at the end of the current scanline. + This can result in long horizontal black lines in the resultant +-\*(Ps image. ++PostScript image. + .SH NOTES +-If the destination printer supports \*(Ps Level II then ++If the destination printer supports PostScript Level II then + it is always faster to just send the encoded bitmap generated + by the + .BR tiff2ps (1) +@@ -149,7 +149,7 @@ + .I fax2ps + should probably figure out when it is doing a poor + job of compressing the output and just generate +-\*(Ps to image the bitmap raster instead. ++PostScript to image the bitmap raster instead. + .SH "SEE ALSO" + .BR tiff2ps (1), + .BR libtiff (3) +Index: tiff-3.8.2/man/raw2tiff.1 +=================================================================== +--- tiff-3.8.2.orig/man/raw2tiff.1 2008-08-17 13:03:49.042994359 -0400 ++++ tiff-3.8.2/man/raw2tiff.1 2008-08-17 13:03:52.519034963 -0400 +@@ -184,7 +184,7 @@ + in some cases. But for most ordinary images guessing method will work fine. + .SH "SEE ALSO" + .BR pal2rgb (1), +-.bR tiffinfo (1), ++.BR tiffinfo (1), + .BR tiffcp (1), + .BR tiffmedian (1), + .BR libtiff (3) +Index: tiff-3.8.2/man/tiff2pdf.1 +=================================================================== +--- tiff-3.8.2.orig/man/tiff2pdf.1 2008-08-17 13:03:49.046994376 -0400 ++++ tiff-3.8.2/man/tiff2pdf.1 2008-08-17 13:03:52.522727821 -0400 +@@ -207,18 +207,14 @@ + The following example would generate the file output.pdf from input.tiff. + .PP + .RS +-.NF +-tiff2pdf -o output.pdf input.tiff +-.FI ++\f(CWtiff2pdf -o output.pdf input.tiff\fP + .RE + .PP + The following example would generate PDF output from input.tiff and write it + to standard output. + .PP + .RS +-.NF +-tiff2pdf input.tiff +-.FI ++\f(CWtiff2pdf input.tiff\fP + .RE + .PP + The following example would generate the file output.pdf from input.tiff, +@@ -227,9 +223,7 @@ + the "Fit Window" option. + .PP + .RS +-.NF +-tiff2pdf -p letter -j -q 75 -t "Document" -f -o output.pdf input.tiff +-.FI ++\f(CWtiff2pdf -p letter -j -q 75 -t "Document" -f -o output.pdf input.tiff\f) + .RE + .SH BUGS + Please report bugs via the web interface at +Index: tiff-3.8.2/man/tiff2ps.1 +=================================================================== +--- tiff-3.8.2.orig/man/tiff2ps.1 2008-08-17 13:03:49.050994382 -0400 ++++ tiff-3.8.2/man/tiff2ps.1 2008-08-17 13:03:52.522727821 -0400 +@@ -27,7 +27,7 @@ + .SH NAME + tiff2ps \- convert a + .SM TIFF +-image to \*(Ps\(tm ++image to PostScript\(tm + .SH SYNOPSIS + .B tiff2ps + [ +@@ -38,17 +38,17 @@ + .I tiff2ps + reads + .SM TIFF +-images and writes \*(Ps or Encapsulated \*(Ps (EPS) ++images and writes PostScript or Encapsulated PostScript (EPS) + on the standard output. + By default, + .I tiff2ps +-writes Encapsulated \*(Ps for the first image in the specified ++writes Encapsulated PostScript for the first image in the specified + .SM TIFF + image file. + .PP + By default, + .I tiff2ps +-will generate \*(Ps that fills a printed area specified ++will generate PostScript that fills a printed area specified + by the + .SM TIFF + tags in the input file. +@@ -67,22 +67,22 @@ + .SM TIFF + tags. + .PP +-The \*(Ps generated for ++The PostScript generated for + .SM RGB, + palette, and + .SM CMYK + images uses the + .I colorimage + operator. +-The \*(Ps generated for ++The PostScript generated for + greyscale and bilevel images + uses the + .I image + operator. + When the + .I colorimage +-operator is used, \*(Ps code to emulate this operator +-on older \*(Ps printers is also generated. ++operator is used, PostScript code to emulate this operator ++on older PostScript printers is also generated. + Note that this emulation code can be very slow. + .PP + Color images with associated alpha data are composited over +@@ -90,13 +90,13 @@ + .SH OPTIONS + .TP + .B \-1 +-Generate \*(Ps Level 1 (the default). ++Generate PostScript Level 1 (the default). + .TP + .B \-2 +-Generate \*(Ps Level 2. ++Generate PostScript Level 2. + .TP + .B \-3 +-Generate \*(Ps Level 3. It basically allows one to use the /flateDecode ++Generate PostScript Level 3. It basically allows one to use the /flateDecode + filter for ZIP compressed TIFF images. + .TP + .B \-a +@@ -119,7 +119,7 @@ + multi-page (e.g. facsimile) file. + .TP + .B \-e +-Force the generation of Encapsulated \*(Ps (implies -z). ++Force the generation of Encapsulated PostScript (implies -z). + .TP + .B \-h + Specify the vertical size of the printed area (in inches). +@@ -148,7 +148,7 @@ + .B \-m + Where possible render using the + .B imagemask +-\*(Ps operator instead of the image operator. When this option is specified ++PostScript operator instead of the image operator. When this option is specified + .I tiff2ps + will use + .B imagemask +@@ -166,7 +166,7 @@ + like which are hidden using the SubIFD tag. + .TP + .B \-p +-Force the generation of (non-Encapsulated) \*(Ps. ++Force the generation of (non-Encapsulated) PostScript. + .TP + .B \-r + Rotate image by 180 degrees. +@@ -184,15 +184,15 @@ + Override resolution units specified in the TIFF as inches. + .TP + .B \-z +-When generating \*(Ps Level 2, data is scaled so that it does not ++When generating PostScript Level 2, data is scaled so that it does not + image into the + .I deadzone + on a page (the outer margin that the printing device is unable to mark). + This option suppresses this behavior. +-When \*(Ps Level 1 is generated, data is imaged to the entire printed ++When PostScript Level 1 is generated, data is imaged to the entire printed + page and this option has no affect. + .SH EXAMPLES +-The following generates \*(Ps Level 2 for all pages of a facsimile: ++The following generates PostScript Level 2 for all pages of a facsimile: + .RS + .nf + tiff2ps -a2 fax.tif | lpr +@@ -201,7 +201,7 @@ + Note also that if you have version 2.6.1 or newer of Ghostscript then you + can efficiently preview facsimile generated with the above command. + .PP +-To generate Encapsulated \*(Ps for a the image at directory 2 ++To generate Encapsulated PostScript for a the image at directory 2 + of an image use: + .RS + .nf +@@ -228,8 +228,8 @@ + .B \-L.5 + option says to repeat a half inch on the next page (to improve readability). + .SH BUGS +-Because \*(Ps does not support the notion of a colormap, +-8-bit palette images produce 24-bit \*(Ps images. ++Because PostScript does not support the notion of a colormap, ++8-bit palette images produce 24-bit PostScript images. + This conversion results in output that is six times + bigger than the original image and which takes a long time + to send to a printer over a serial line. +Index: tiff-3.8.2/man/TIFFClose.3tiff +=================================================================== +--- tiff-3.8.2.orig/man/TIFFClose.3tiff 2008-08-17 13:03:49.058994404 -0400 ++++ tiff-3.8.2/man/TIFFClose.3tiff 2008-08-17 13:03:52.522727821 -0400 +@@ -40,7 +40,7 @@ + current directory (if modified); and all resources are reclaimed. + .SH DIAGNOSTICS + All error messages are directed to the +-.bR TIFFError (3TIFF) ++.BR TIFFError (3TIFF) + routine. + Likewise, warning messages are directed to the + .BR TIFFWarning (3TIFF) +Index: tiff-3.8.2/man/tiffcmp.1 +=================================================================== +--- tiff-3.8.2.orig/man/tiffcmp.1 2008-08-17 13:03:49.062994301 -0400 ++++ tiff-3.8.2/man/tiffcmp.1 2008-08-17 13:03:52.522727821 -0400 +@@ -77,7 +77,7 @@ + in some exotic cases. + .SH "SEE ALSO" + .BR pal2rgb (1), +-.bR tiffinfo (1), ++.BR tiffinfo (1), + .BR tiffcp (1), + .BR tiffmedian (1), + .BR libtiff (3TIFF) +Index: tiff-3.8.2/man/tiffsplit.1 +=================================================================== +--- tiff-3.8.2.orig/man/tiffsplit.1 2008-08-17 13:03:49.070994233 -0400 ++++ tiff-3.8.2/man/tiffsplit.1 2008-08-17 13:03:52.522727821 -0400 +@@ -50,7 +50,7 @@ + (e.g. + .IR xaaa.tif , + .IR xaab.tif , +-\... ++.IR ... , + .IR xzzz.tif ). + If a prefix is not specified on the command line, + the default prefix of --- tiff-3.8.2.orig/debian/patches/CVE-2009-2285-lzw.patch +++ tiff-3.8.2/debian/patches/CVE-2009-2285-lzw.patch @@ -0,0 +1,22 @@ +Index: tiff-3.8.2/libtiff/tif_lzw.c +=================================================================== +--- tiff-3.8.2.orig/libtiff/tif_lzw.c 2009-06-28 12:17:47.625264945 -0400 ++++ tiff-3.8.2/libtiff/tif_lzw.c 2009-06-28 12:19:09.913264599 -0400 +@@ -422,7 +422,7 @@ + NextCode(tif, sp, bp, code, GetNextCode); + if (code == CODE_EOI) + break; +- if (code == CODE_CLEAR) { ++ if (code >= CODE_CLEAR) { + TIFFErrorExt(tif->tif_clientdata, tif->tif_name, + "LZWDecode: Corrupted LZW table at scanline %d", + tif->tif_row); +@@ -626,7 +626,7 @@ + NextCode(tif, sp, bp, code, GetNextCodeCompat); + if (code == CODE_EOI) + break; +- if (code == CODE_CLEAR) { ++ if (code >= CODE_CLEAR) { + TIFFErrorExt(tif->tif_clientdata, tif->tif_name, + "LZWDecode: Corrupted LZW table at scanline %d", + tif->tif_row); --- tiff-3.8.2.orig/debian/patches/tiff2pdf.patch +++ tiff-3.8.2/debian/patches/tiff2pdf.patch @@ -0,0 +1,2904 @@ +Index: tiff-3.8.2/tools/tiff2pdf.c +=================================================================== +--- tiff-3.8.2.orig/tools/tiff2pdf.c 2008-08-17 13:03:49.181994249 -0400 ++++ tiff-3.8.2/tools/tiff2pdf.c 2008-08-17 13:03:51.873994205 -0400 +@@ -1,4 +1,4 @@ +-/* $Id: tiff2pdf.c,v 1.30 2006/03/21 16:37:51 dron Exp $ ++/* $Id: tiff2pdf.c,v 1.45 2008/01/01 15:49:00 fwarmerdam Exp $ + * + * tiff2pdf - converts a TIFF image to a PDF document + * +@@ -24,47 +24,50 @@ + * OF THIS SOFTWARE. + */ + +-#include "tif_config.h" ++#include "tiffconf.h" + + #include + #include + #include + #include + #include ++#include + +-#include "tiffiop.h" ++typedef int32_t tmsize_t; + + #if HAVE_UNISTD_H + # include + #endif + +-#ifndef NULL +-#define NULL ((void*)0) ++#ifdef HAVE_FCNTL_H ++# include + #endif + +-#if defined(VMS) +-#define unlink remove ++#ifdef HAVE_IO_H ++# include + #endif +-#if defined(_WIN32) && defined(USE_WIN32_FILEIO) +-#include +-#include +-#define unlink DeleteFileA ++ ++#include "tiffio.h" ++ ++#ifndef HAVE_GETOPT ++extern int getopt(int, char**, char*); + #endif + + #define TIFF2PDF_MODULE "tiff2pdf" +-#define T2P_VERSION "d" ++ ++#define PS_UNIT_SIZE 72.0F + + /* This type is of PDF color spaces. */ +-typedef enum{ +- T2P_CS_BILEVEL=0x01, /* Bilevel, black and white */ +- T2P_CS_GRAY=0x02, /* Single channel */ +- T2P_CS_RGB=0x04, /* Three channel tristimulus RGB */ +- T2P_CS_CMYK=0x08, /* Four channel CMYK print inkset */ +- T2P_CS_LAB=0x10, /* Three channel L*a*b* color space */ +- T2P_CS_PALETTE=0x1000 /* One of the above with a color map */ +- , T2P_CS_CALGRAY=0x20 /* Calibrated single channel */ +- , T2P_CS_CALRGB=0x40 /* Calibrated three channel tristimulus RGB */ +- , T2P_CS_ICCBASED=0x80 /* ICC profile color specification */ ++typedef enum { ++ T2P_CS_BILEVEL = 0x01, /* Bilevel, black and white */ ++ T2P_CS_GRAY = 0x02, /* Single channel */ ++ T2P_CS_RGB = 0x04, /* Three channel tristimulus RGB */ ++ T2P_CS_CMYK = 0x08, /* Four channel CMYK print inkset */ ++ T2P_CS_LAB = 0x10, /* Three channel L*a*b* color space */ ++ T2P_CS_PALETTE = 0x1000,/* One of the above with a color map */ ++ T2P_CS_CALGRAY = 0x20, /* Calibrated single channel */ ++ T2P_CS_CALRGB = 0x40, /* Calibrated three channel tristimulus RGB */ ++ T2P_CS_ICCBASED = 0x80 /* ICC profile color specification */ + } t2p_cs_t; + + /* This type is of PDF compression types. */ +@@ -160,9 +163,6 @@ + uint16 tiff_orientation; + toff_t tiff_dataoffset; + tsize_t tiff_datasize; +- TIFFReadWriteProc tiff_readproc; +- TIFFReadWriteProc tiff_writeproc; +- TIFFSeekProc tiff_seekproc; + uint16 tiff_resunit; + uint16 pdf_centimeters; + uint16 pdf_overrideres; +@@ -187,13 +187,13 @@ + uint32 pdf_palettecs; + uint16 pdf_fitwindow; + uint32 pdf_startxref; +- char* pdf_fileid; +- char* pdf_datetime; +- char* pdf_creator; +- char* pdf_author; +- char* pdf_title; +- char* pdf_subject; +- char* pdf_keywords; ++ unsigned char* pdf_fileid; ++ unsigned char* pdf_datetime; ++ unsigned char* pdf_creator; ++ unsigned char* pdf_author; ++ unsigned char* pdf_title; ++ unsigned char* pdf_subject; ++ unsigned char* pdf_keywords; + t2p_cs_t pdf_colorspace; + uint16 pdf_colorspace_invert; + uint16 pdf_switchdecode; +@@ -225,6 +225,11 @@ + uint32 pdf_icccs; + uint32 tiff_iccprofilelength; + tdata_t tiff_iccprofile; ++ ++ /* fields for custom read/write procedures */ ++ FILE *outputfile; ++ int outputdisable; ++ tsize_t outputwritten; + } T2P; + + /* These functions are called by main. */ +@@ -247,10 +252,6 @@ + } + #endif + +-tsize_t t2p_empty_readproc(thandle_t, tdata_t, tsize_t); +-tsize_t t2p_empty_writeproc(thandle_t, tdata_t, tsize_t); +-toff_t t2p_empty_seekproc(thandle_t, toff_t, int); +-int t2p_empty_closeproc(thandle_t); + void t2p_read_tiff_init(T2P*, TIFF*); + int t2p_cmp_t2p_page(const void*, const void*); + void t2p_read_tiff_data(T2P*, TIFF*); +@@ -279,8 +280,8 @@ + tsize_t t2p_write_pdf_header(T2P*, TIFF*); + tsize_t t2p_write_pdf_obj_start(uint32, TIFF*); + tsize_t t2p_write_pdf_obj_end(TIFF*); +-tsize_t t2p_write_pdf_name(char*, TIFF*); +-tsize_t t2p_write_pdf_string(char*, TIFF*); ++tsize_t t2p_write_pdf_name(unsigned char*, TIFF*); ++tsize_t t2p_write_pdf_string(unsigned char*, TIFF*); + tsize_t t2p_write_pdf_stream(tdata_t, tsize_t, TIFF*); + tsize_t t2p_write_pdf_stream_start(TIFF*); + tsize_t t2p_write_pdf_stream_end(TIFF*); +@@ -313,6 +314,109 @@ + tsize_t t2p_write_pdf_xreftable(T2P*, TIFF*); + tsize_t t2p_write_pdf_trailer(T2P*, TIFF*); + ++static void ++t2p_disable(TIFF *tif) ++{ ++ T2P *t2p = (T2P*) TIFFClientdata(tif); ++ t2p->outputdisable = 1; ++} ++ ++static void ++t2p_enable(TIFF *tif) ++{ ++ T2P *t2p = (T2P*) TIFFClientdata(tif); ++ t2p->outputdisable = 0; ++} ++ ++/* ++ * Procs for TIFFClientOpen ++ */ ++ ++static tmsize_t ++t2pReadFile(TIFF *tif, tdata_t data, tmsize_t size) ++{ ++ thandle_t client = TIFFClientdata(tif); ++ TIFFReadWriteProc proc = TIFFGetReadProc(tif); ++ if (proc) ++ return proc(client, data, size); ++ return -1; ++} ++ ++static tmsize_t ++t2pWriteFile(TIFF *tif, tdata_t data, tmsize_t size) ++{ ++ thandle_t client = TIFFClientdata(tif); ++ TIFFReadWriteProc proc = TIFFGetWriteProc(tif); ++ if (proc) ++ return proc(client, data, size); ++ return -1; ++} ++ ++static toff_t ++t2pSeekFile(TIFF *tif, toff_t offset, int whence) ++{ ++ thandle_t client = TIFFClientdata(tif); ++ TIFFSeekProc proc = TIFFGetSeekProc(tif); ++ if (proc) ++ return proc(client, offset, whence); ++ return -1; ++} ++ ++static tmsize_t ++t2p_readproc(thandle_t handle, tdata_t data, tmsize_t size) ++{ ++ (void) handle, (void) data, (void) size; ++ return -1; ++} ++ ++static tmsize_t ++t2p_writeproc(thandle_t handle, tdata_t data, tmsize_t size) ++{ ++ T2P *t2p = (T2P*) handle; ++ if (t2p->outputdisable <= 0 && t2p->outputfile) { ++ tsize_t written = fwrite(data, 1, size, t2p->outputfile); ++ t2p->outputwritten += written; ++ return written; ++ } ++ return size; ++} ++ ++static toff_t ++t2p_seekproc(thandle_t handle, toff_t offset, int whence) ++{ ++ T2P *t2p = (T2P*) handle; ++ if (t2p->outputdisable <= 0 && t2p->outputfile) ++ return fseek(t2p->outputfile, offset, whence); ++ return offset; ++} ++ ++static int ++t2p_closeproc(thandle_t handle) ++{ ++ (void) handle; ++ return 0; ++} ++ ++static toff_t ++t2p_sizeproc(thandle_t handle) ++{ ++ (void) handle; ++ return -1; ++} ++ ++static int ++t2p_mapproc(thandle_t handle, void **data, toff_t *offset) ++{ ++ (void) handle, (void) data, (void) offset; ++ return -1; ++} ++ ++static void ++t2p_unmapproc(thandle_t handle, void *data, toff_t offset) ++{ ++ (void) handle, (void) data, (void) offset; ++} ++ + /* + + This is the main function. +@@ -385,23 +489,21 @@ + options: + -o: output to file name + +- -j compress with JPEG (requires libjpeg configured with libtiff) +- -z compress with Zip/Deflate (requires zlib configured with libtiff) ++ -j: compress with JPEG (requires libjpeg configured with libtiff) ++ -z: compress with Zip/Deflate (requires zlib configured with libtiff) + -q: compression quality +- -n no compressed data passthrough +- -d do not compress (decompress) +- +- -i invert colors +- ++ -n: no compressed data passthrough ++ -d: do not compress (decompress) ++ -i: invert colors + -u: set distance unit, 'i' for inch, 'm' for centimeter + -x: set x resolution default + -y: set y resolution default + -w: width in units + -l: length in units + -r: 'd' for resolution default, 'o' for resolution override +- -p: paper size, eg "letter", "legal", "A4" +- -f set PDF "Fit Window" user preference +- -b set PDF "Interpolate" user preference ++ -p: paper size, eg "letter", "legal", "a4" ++ -f: set pdf "fit window" user preference ++ -b: set PDF "Interpolate" user preference + -e: date, overrides image or current date/time default, YYYYMMDDHHMMSS + -c: creator, overrides image software default + -a: author, overrides image artist default +@@ -409,7 +511,7 @@ + -s: subject, overrides image image description default + -k: keywords + +- -h usage ++ -h: usage + + examples: + +@@ -437,24 +539,24 @@ + + int main(int argc, char** argv){ + +- extern int optind; + extern char *optarg; ++ extern int optind; ++ const char *outfilename = NULL; + T2P *t2p = NULL; + TIFF *input = NULL, *output = NULL; +- const char *outfilename = NULL; +- tsize_t written=0; +- int c=0; ++ tsize_t written = 0; ++ int c; + + t2p = t2p_init(); + + if (t2p == NULL){ +- TIFFError( +- TIFF2PDF_MODULE, +- "Can't initialize context"); +- goto failexit; ++ TIFFError(TIFF2PDF_MODULE, "Can't initialize context"); ++ goto fail; + } + +- while ((c = getopt(argc, argv, "o:q:u:x:y:w:l:r:p:e:c:a:t:s:k:jzndifbh")) != -1){ ++ while (argv && ++ (c = getopt(argc, argv, ++ "o:q:u:x:y:w:l:r:p:e:c:a:t:s:k:jzndifbh")) != -1){ + switch (c) { + case 'o': + outfilename = optarg; +@@ -508,12 +610,12 @@ + case 'w': + t2p->pdf_overridepagesize=1; + t2p->pdf_defaultpagewidth = +- ((float)atof(optarg) * 72.0F) / (t2p->pdf_centimeters?2.54F:1.0F); ++ ((float)atof(optarg) * PS_UNIT_SIZE) / (t2p->pdf_centimeters?2.54F:1.0F); + break; + case 'l': + t2p->pdf_overridepagesize=1; + t2p->pdf_defaultpagelength = +- ((float)atof(optarg) * 72.0F) / (t2p->pdf_centimeters?2.54F:1.0F); ++ ((float)atof(optarg) * PS_UNIT_SIZE) / (t2p->pdf_centimeters?2.54F:1.0F); + break; + case 'r': + if(optarg[0]=='o'){ +@@ -539,82 +641,87 @@ + t2p->pdf_fitwindow=1; + break; + case 'e': +- t2p->pdf_datetime = (char*)_TIFFmalloc(17); ++ t2p->pdf_datetime = ++ (unsigned char*)_TIFFmalloc(17); + if(t2p->pdf_datetime==NULL){ + TIFFError(TIFF2PDF_MODULE, + "Can't allocate %u bytes of memory for main", + 17); +- goto failfreet2p; ++ goto fail; + } + if(strlen(optarg)==0){ +- t2p->pdf_datetime[0]=0; ++ t2p->pdf_datetime[0] = 0; + } else { + if(strlen(optarg)>14){optarg[14]=0;} +- t2p->pdf_datetime[0]='D'; +- t2p->pdf_datetime[1]=':'; +- strcpy(&(t2p->pdf_datetime[2]), optarg); ++ t2p->pdf_datetime[0] = 'D'; ++ t2p->pdf_datetime[1] = ':'; ++ strcpy((char *)t2p->pdf_datetime + 2, ++ optarg); + } + break; + case 'c': +- t2p->pdf_creator = +- (char *)_TIFFmalloc(strlen(optarg) + 1); ++ t2p->pdf_creator = (unsigned char *) ++ _TIFFmalloc(strlen(optarg) + 1); + if(t2p->pdf_creator==NULL){ + TIFFError(TIFF2PDF_MODULE, + "Can't allocate %u bytes of memory for main", +- strlen(optarg)+1); +- goto failfreet2p; ++ strlen(optarg) + 1); ++ goto fail; + } +- strcpy(t2p->pdf_creator, optarg); +- t2p->pdf_creator[strlen(optarg)]=0; ++ strcpy((char *)t2p->pdf_creator, optarg); ++ t2p->pdf_creator[strlen(optarg)] = 0; + break; + case 'a': +- t2p->pdf_author = +- (char *)_TIFFmalloc(strlen(optarg) + 1); ++ t2p->pdf_author = (unsigned char *) ++ _TIFFmalloc(strlen(optarg) + 1); + if(t2p->pdf_author==NULL){ + TIFFError( + TIFF2PDF_MODULE, +- "Can't allocate %u bytes of memory for main", +- strlen(optarg)+1); +- goto failfreet2p; ++ "Can't allocate %u bytes of memory for main", ++ strlen(optarg) + 1); ++ goto fail; + } +- strcpy(t2p->pdf_author, optarg); ++ strcpy((char *)t2p->pdf_author, optarg); + t2p->pdf_author[strlen(optarg)]=0; + break; + case 't': +- t2p->pdf_title= (char*)_TIFFmalloc(strlen(optarg)+1); ++ t2p->pdf_title = (unsigned char*) ++ _TIFFmalloc(strlen(optarg)+1); + if(t2p->pdf_title==NULL){ + TIFFError( + TIFF2PDF_MODULE, +- "Can't allocate %u bytes of memory for main", +- strlen(optarg)+1); +- goto failfreet2p; ++ "Can't allocate %u bytes of memory for main", ++ strlen(optarg) + 1); ++ goto fail; + } +- strcpy(t2p->pdf_title, optarg); +- t2p->pdf_title[strlen(optarg)]=0; ++ strcpy((char *)t2p->pdf_title, optarg); ++ t2p->pdf_title[strlen(optarg)] = 0; + break; + case 's': +- t2p->pdf_subject= (char*)_TIFFmalloc(strlen(optarg)+1); ++ t2p->pdf_subject = (unsigned char*) ++ _TIFFmalloc(strlen(optarg) + 1); + if(t2p->pdf_subject==NULL){ + TIFFError( + TIFF2PDF_MODULE, +- "Can't allocate %u bytes of memory for main", ++ "Can't allocate %u bytes of memory for main", + strlen(optarg)+1); +- goto failfreet2p; ++ goto fail; + } +- strcpy(t2p->pdf_subject, optarg); ++ strcpy((char *)t2p->pdf_subject, optarg); + t2p->pdf_subject[strlen(optarg)]=0; + break; + case 'k': +- t2p->pdf_keywords= (char*)_TIFFmalloc(strlen(optarg)+1); ++ t2p->pdf_keywords = (unsigned char*) ++ _TIFFmalloc(strlen(optarg) + 1); + if(t2p->pdf_keywords==NULL){ + TIFFError( + TIFF2PDF_MODULE, +- "Can't allocate %u bytes of memory for main", +- strlen(optarg)+1); +- goto failfreet2p; ++ "Can't allocate %u bytes of memory for main", ++ strlen(optarg) + 1); ++ goto fail; + } +- strcpy(t2p->pdf_keywords, optarg); +- t2p->pdf_keywords[strlen(optarg)]=0; ++ strcpy((char *)t2p->pdf_keywords, optarg); ++ t2p->pdf_keywords[strlen(optarg)] = 0; + break; + case 'b': + t2p->pdf_image_interpolate = 1; +@@ -622,123 +729,94 @@ + case 'h': + case '?': + tiff2pdf_usage(); +- goto failfreet2p; ++ goto success; + break; + } + } + +- t2p_validate(t2p); +- +- if(argc>optind){ ++ /* ++ * Input ++ */ ++ if(argc > optind) { + input = TIFFOpen(argv[optind++], "r"); +- if(input==NULL){ +- TIFFError( +- TIFF2PDF_MODULE, +- "Can't open input file %s for reading", +- argv[optind-1]); +- goto failfreet2p; ++ if (input==NULL) { ++ TIFFError(TIFF2PDF_MODULE, ++ "Can't open input file %s for reading", ++ argv[optind-1]); ++ goto fail; + } + } else { +- TIFFError( +- TIFF2PDF_MODULE, +- "No input file specified"); ++ TIFFError(TIFF2PDF_MODULE, "No input file specified"); + tiff2pdf_usage(); +- goto failfreet2p; ++ goto fail; + } + +- if(argc>optind){ +- TIFFError( +- TIFF2PDF_MODULE, +- "No support for multiple input files"); ++ if(argc > optind) { ++ TIFFError(TIFF2PDF_MODULE, ++ "No support for multiple input files"); + tiff2pdf_usage(); +- goto failcloseinput; ++ goto fail; + } + ++ /* ++ * Output ++ */ ++ t2p->outputdisable = 0; + if (outfilename) { +- output = TIFFOpen(outfilename, "w"); +- if(output == NULL) { +- TIFFError(TIFF2PDF_MODULE, +- "Can't open output file %s for writing", +- optarg); +- goto failfreet2p; +- } +- if(output->tif_seekproc != NULL) { +- TIFFSeekFile(output, (toff_t) 0, SEEK_SET); ++ t2p->outputfile = fopen(outfilename, "wb"); ++ if (t2p->outputfile == NULL) { ++ TIFFError(TIFF2PDF_MODULE, ++ "Can't open output file %s for writing", ++ outfilename); ++ goto fail; + } + } else { +-#if !defined(_WIN32) || defined(AVOID_WIN32_FILEIO) +- output = TIFFFdOpen((int)fileno(tmpfile()), "-", "w"); +-#else +- { +- TCHAR temppath[MAX_PATH]; +- TCHAR tempfile[MAX_PATH]; +- GetTempPath((DWORD)MAX_PATH, (LPTSTR)temppath); +- GetTempFileName((LPCTSTR)temppath, (LPTSTR) "t2p", 0, (LPTSTR)tempfile); +- output = TIFFFdOpen( (int)CreateFile( +- (LPCTSTR)tempfile, +- GENERIC_WRITE, +- 0, +- NULL, +- CREATE_ALWAYS, +- FILE_FLAG_DELETE_ON_CLOSE, +- NULL), +- "-", "w"); +- } +-#endif +- if(output==NULL){ +- TIFFError(TIFF2PDF_MODULE, +- "Can't open temporary output file for writing to stdout", +- argv[optind-1]); +- goto failcloseinput; +- } +- TIFFFlush(output); +- output->tif_readproc=t2p_empty_readproc; +- output->tif_seekproc=t2p_empty_seekproc; +- output->tif_closeproc=t2p_empty_closeproc; +-#if !defined(_WIN32) || defined(AVOID_WIN32_FILEIO) +- close(output->tif_fd); +- output->tif_fd=(int)fileno(stdout); +-#else +- CloseHandle((HANDLE) output->tif_fd); +- output->tif_fd=(int)GetStdHandle(STD_OUTPUT_HANDLE); +-#endif +- output->tif_clientdata=(thandle_t)output->tif_fd; ++ outfilename = "-"; ++ t2p->outputfile = stdout; + } + +- written = t2p_write_pdf(t2p, input, output); ++ output = TIFFClientOpen(outfilename, "w", (thandle_t) t2p, ++ t2p_readproc, t2p_writeproc, t2p_seekproc, ++ t2p_closeproc, t2p_sizeproc, ++ t2p_mapproc, t2p_unmapproc); ++ if (output == NULL) { ++ TIFFError(TIFF2PDF_MODULE, ++ "Can't initialize output descriptor"); ++ goto fail; ++ } ++ ++ /* ++ * Validate ++ */ ++ t2p_validate(t2p); ++ t2pSeekFile(output, (toff_t) 0, SEEK_SET); + +- if(t2p->t2p_error != 0){ +- TIFFError( +- TIFF2PDF_MODULE, +- "An error occurred in converting TIFF %s to PDF %s", +- TIFFFileName(input), +- TIFFFileName(output) +- ); +- goto failcloseinput; ++ /* ++ * Write ++ */ ++ written = t2p_write_pdf(t2p, input, output); ++ if (t2p->t2p_error != 0) { ++ TIFFError(TIFF2PDF_MODULE, ++ "An error occurred creating output PDF file"); ++ goto fail; + } + +- if(input != NULL){ +- TIFFClose(input); +- } +- if(output != NULL){ ++success: ++ if (output != NULL) + TIFFClose(output); +- } +- if(t2p != NULL){ ++ if (t2p != NULL) + t2p_free(t2p); +- } +- + return(EXIT_SUCCESS); + +-failcloseinput: +- if(input != NULL){ ++fail: ++ if(input != NULL) + TIFFClose(input); +- } +-failfreet2p: +- if(t2p != NULL){ ++ if (output != NULL) ++ TIFFClose(output); ++ if (t2p != NULL) + t2p_free(t2p); +- } +-failexit: + return(EXIT_FAILURE); ++ + } + + void tiff2pdf_usage(){ +@@ -747,14 +825,15 @@ + "options:", + " -o: output to file name", + #ifdef JPEG_SUPPORT +- " -j compress with JPEG", ++ " -j: compress with JPEG", + #endif + #ifdef ZIP_SUPPORT +- " -z compress with Zip/Deflate", ++ " -z: compress with Zip/Deflate", + #endif + " -q: compression quality", +- " -n no compressed data passthrough", +- " -d do not compress (decompress)", ++ " -n: no compressed data passthrough", ++ " -d: do not compress (decompress)", ++ " -i: invert colors", + " -u: set distance unit, 'i' for inch, 'm' for centimeter", + " -x: set x resolution default in dots per unit", + " -y: set y resolution default in dots per unit", +@@ -762,15 +841,15 @@ + " -l: length in units", + " -r: 'd' for resolution default, 'o' for resolution override", + " -p: paper size, eg \"letter\", \"legal\", \"A4\"", +- " -f set PDF \"Fit Window\" user preference", ++ " -f: set PDF \"Fit Window\" user preference", + " -e: date, overrides image or current date/time default, YYYYMMDDHHMMSS", + " -c: sets document creator, overrides image software default", + " -a: sets document author, overrides image artist default", + " -t: sets document title, overrides image document name default", + " -s: sets document subject, overrides image image description default", + " -k: sets document keywords", +- " -b set PDF \"Interpolate\" user preference", +- " -h usage", ++ " -b: set PDF \"Interpolate\" user preference", ++ " -h: usage", + NULL + }; + int i=0; +@@ -786,7 +865,7 @@ + int tiff2pdf_match_paper_size(float* width, float* length, char* papersize){ + + int i=0; +- int len=0; ++ size_t len=0; + const char* sizes[]={ + "LETTER", "A4", "LEGAL", + "EXECUTIVE", "LETTER", "LEGAL", "LEDGER", "TABLOID", +@@ -937,7 +1016,7 @@ + + #ifdef JPEG_SUPPORT + if(t2p->pdf_defaultcompression==T2P_COMPRESS_JPEG){ +- if(t2p->pdf_defaultcompressionquality<100 || ++ if(t2p->pdf_defaultcompressionquality>100 || + t2p->pdf_defaultcompressionquality<1){ + t2p->pdf_defaultcompressionquality=0; + } +@@ -945,25 +1024,17 @@ + #endif + #ifdef ZIP_SUPPORT + if(t2p->pdf_defaultcompression==T2P_COMPRESS_ZIP){ +- switch (t2p->pdf_defaultcompressionquality){ +- case 1: case 10: case 11: case 12: case 13: case 14: case 15: +- case 101: case 110: case 111: case 112: case 113: case 114: case 115: +- case 201: case 210: case 211: case 212: case 213: case 214: case 215: +- case 301: case 310: case 311: case 312: case 313: case 314: case 315: +- case 401: case 410: case 411: case 412: case 413: case 414: case 415: +- case 501: case 510: case 511: case 512: case 513: case 514: case 515: +- case 601: case 610: case 611: case 612: case 613: case 614: case 615: +- case 701: case 710: case 711: case 712: case 713: case 714: case 715: +- case 801: case 810: case 811: case 812: case 813: case 814: case 815: +- case 901: case 910: case 911: case 912: case 913: case 914: case 915: +- break; +- default: +- t2p->pdf_defaultcompressionquality=0; ++ uint16 m=t2p->pdf_defaultcompressionquality%100; ++ if(t2p->pdf_defaultcompressionquality/100 > 9 || ++ (m>1 && m<10) || m>15){ ++ t2p->pdf_defaultcompressionquality=0; + } + if(t2p->pdf_defaultcompressionquality%100 !=0){ ++ t2p->pdf_defaultcompressionquality/=100; ++ t2p->pdf_defaultcompressionquality*=100; + TIFFError( + TIFF2PDF_MODULE, +- "PNG Group predictor differencing not implemented, assuming compresion quality %u", ++ "PNG Group predictor differencing not implemented, assuming compression quality %u", + t2p->pdf_defaultcompressionquality); + } + t2p->pdf_defaultcompressionquality%=100; +@@ -1152,8 +1223,9 @@ + } + + /* +- This function is used by qsort to sort a T2P_PAGE* array of page structures by page number. +-*/ ++ * This function is used by qsort to sort a T2P_PAGE* array of page structures ++ * by page number. ++ */ + + int t2p_cmp_t2p_page(const void* e1, const void* e2){ + +@@ -1483,7 +1555,7 @@ + t2p->pdf_palette[(i*4)] = (unsigned char) (r[i]>>8); + t2p->pdf_palette[(i*4)+1]= (unsigned char) (g[i]>>8); + t2p->pdf_palette[(i*4)+2]= (unsigned char) (b[i]>>8); +- t2p->pdf_palette[(i*4)+2]= (unsigned char) (a[i]>>8); ++ t2p->pdf_palette[(i*4)+3]= (unsigned char) (a[i]>>8); + } + t2p->pdf_palettesize *= 4; + break; +@@ -1591,13 +1663,15 @@ + if(TIFFGetField(input, TIFFTAG_YRESOLUTION, &(t2p->tiff_yres) ) == 0){ + t2p->tiff_yres=0.0; + } +- TIFFGetFieldDefaulted(input, TIFFTAG_RESOLUTIONUNIT, &(t2p->tiff_resunit) ); +- if(t2p->tiff_resunit==RESUNIT_CENTIMETER){ +- t2p->tiff_xres*=2.54F; +- t2p->tiff_yres*=2.54F; +- } else if (t2p->tiff_resunit!=RESUNIT_INCH && t2p->pdf_centimeters!=0){ +- t2p->tiff_xres*=2.54F; +- t2p->tiff_yres*=2.54F; ++ TIFFGetFieldDefaulted(input, TIFFTAG_RESOLUTIONUNIT, ++ &(t2p->tiff_resunit)); ++ if(t2p->tiff_resunit == RESUNIT_CENTIMETER) { ++ t2p->tiff_xres *= 2.54F; ++ t2p->tiff_yres *= 2.54F; ++ } else if (t2p->tiff_resunit != RESUNIT_INCH ++ && t2p->pdf_centimeters != 0) { ++ t2p->tiff_xres *= 2.54F; ++ t2p->tiff_yres *= 2.54F; + } + + t2p_compose_pdf_page(t2p); +@@ -1758,7 +1832,6 @@ + uint32* sbc=NULL; + #if defined(JPEG_SUPPORT) || defined (OJPEG_SUPPORT) + unsigned char* jpt=NULL; +- uint16 xuint16=0; + tstrip_t i=0; + tstrip_t stripcount=0; + #endif +@@ -1824,14 +1897,15 @@ + } + #endif + #ifdef JPEG_SUPPORT +- if(t2p->tiff_compression == COMPRESSION_JPEG){ +- if(TIFFGetField(input, TIFFTAG_JPEGTABLES, &xuint16, &jpt) != 0 ){ +- if(xuint16>4){ +- t2p->tiff_datasize+= xuint16; +- t2p->tiff_datasize -=2; /* don't use EOI of header */ ++ if(t2p->tiff_compression == COMPRESSION_JPEG) { ++ uint32 count = 0; ++ if(TIFFGetField(input, TIFFTAG_JPEGTABLES, &count, &jpt) != 0 ){ ++ if(count > 4){ ++ t2p->tiff_datasize += count; ++ t2p->tiff_datasize -= 2; /* don't use EOI of header */ + } + } else { +- t2p->tiff_datasize=2; /* SOI for first strip */ ++ t2p->tiff_datasize = 2; /* SOI for first strip */ + } + stripcount=TIFFNumberOfStrips(input); + if(!TIFFGetField(input, TIFFTAG_STRIPBYTECOUNTS, &sbc)){ +@@ -1868,7 +1942,6 @@ + uint32* tbc = NULL; + uint16 edge=0; + #ifdef JPEG_SUPPORT +- uint16 xuint16=0; + unsigned char* jpt; + #endif + +@@ -1893,11 +1966,12 @@ + } + #endif + #ifdef JPEG_SUPPORT +- if(t2p->tiff_compression==COMPRESSION_JPEG){ +- if(TIFFGetField(input, TIFFTAG_JPEGTABLES, &xuint16, &jpt)!=0){ +- if(xuint16>4){ +- t2p->tiff_datasize+=xuint16; +- t2p->tiff_datasize-=4; /* don't use EOI of header or SOI of tile */ ++ if(t2p->tiff_compression==COMPRESSION_JPEG) { ++ uint32 count = 0; ++ if(TIFFGetField(input, TIFFTAG_JPEGTABLES, &count, &jpt)!=0){ ++ if(count > 4){ ++ t2p->tiff_datasize += count; ++ t2p->tiff_datasize -= 4; /* don't use EOI of header or SOI of tile */ + } + } + } +@@ -1914,9 +1988,9 @@ + } + + /* +- This functions returns a non-zero value when the tile is on the right edge +- and does not have full imaged tile width. +-*/ ++ * This functions returns a non-zero value when the tile is on the right edge ++ * and does not have full imaged tile width. ++ */ + + int t2p_tile_is_right_edge(T2P_TILES tiles, ttile_t tile){ + +@@ -1926,15 +2000,12 @@ + } else { + return(0); + } +- +- return(0); +- + } + + /* +- This functions returns a non-zero value when the tile is on the bottom edge +- and does not have full imaged tile length. +-*/ ++ * This functions returns a non-zero value when the tile is on the bottom edge ++ * and does not have full imaged tile length. ++ */ + + int t2p_tile_is_bottom_edge(T2P_TILES tiles, ttile_t tile){ + +@@ -1944,14 +2015,12 @@ + } else { + return(0); + } +- +- return(0); + } + + /* +- This function returns a non-zero value when the tile is a right edge tile or a bottom +- edge tile. +-*/ ++ * This function returns a non-zero value when the tile is a right edge tile ++ * or a bottom edge tile. ++ */ + + int t2p_tile_is_edge(T2P_TILES tiles, ttile_t tile){ + +@@ -1968,52 +2037,6 @@ + return(t2p_tile_is_right_edge(tiles, tile) & t2p_tile_is_bottom_edge(tiles, tile) ); + } + +-/* +- This function is an empty (dummy) TIFFReadWriteProc that returns the amount +- requested to be read without reading anything. +-*/ +- +-tsize_t t2p_empty_readproc(thandle_t fd, tdata_t buf, tsize_t size){ +- +- (void) fd; (void) buf; (void) size; +- +- return (size); +-} +- +-/* +- This function is an empty (dummy) TIFFReadWriteProc that returns the amount +- requested to be written without writing anything. +-*/ +- +-tsize_t t2p_empty_writeproc(thandle_t fd, tdata_t buf, tsize_t size){ +- +- (void) fd; (void) buf; (void) size; +- +- return (size); +-} +- +-/* +- This function is an empty (dummy) TIFFSeekProc that returns off. +-*/ +- +-toff_t t2p_empty_seekproc(thandle_t fd, toff_t off, int whence){ +- +- (void) fd; (void) off; (void) whence; +- +- return( off ); +-} +- +-/* +- This function is an empty (dummy) TIFFCloseProc that returns 0. +-*/ +- +-int t2p_empty_closeproc(thandle_t fd){ +- +- (void) fd; +- +- return(0); +-} +- + + /* + This function reads the raster image data from the input TIFF for an image and writes +@@ -2044,8 +2067,6 @@ + #endif + #ifdef JPEG_SUPPORT + unsigned char* jpt; +- uint16 xuint16_1=0; +- uint16 xuint16_2=0; + float* xfloatp; + uint32* sbc; + unsigned char* stripbuffer; +@@ -2056,75 +2077,101 @@ + if(t2p->pdf_transcode == T2P_TRANSCODE_RAW){ + #ifdef CCITT_SUPPORT + if(t2p->pdf_compression == T2P_COMPRESS_G4){ +- buffer= (unsigned char*) _TIFFmalloc(t2p->tiff_datasize); +- if(buffer==NULL){ ++ buffer = (unsigned char*) ++ _TIFFmalloc(t2p->tiff_datasize); ++ if (buffer == NULL) { + TIFFError(TIFF2PDF_MODULE, +- "Can't allocate %u bytes of memory for t2p_readwrite_pdf_image, %s", ++ "Can't allocate %u bytes of memory for t2p_readwrite_pdf_image, %s", + t2p->tiff_datasize, + TIFFFileName(input)); + t2p->t2p_error = T2P_ERR_ERROR; + return(0); + } +- TIFFReadRawStrip(input, 0, (tdata_t) buffer, t2p->tiff_datasize); ++ TIFFReadRawStrip(input, 0, (tdata_t) buffer, ++ t2p->tiff_datasize); + if (t2p->tiff_fillorder==FILLORDER_LSB2MSB){ +- /* make sure is lsb-to-msb bit-endianness fill order */ +- TIFFReverseBits(buffer, t2p->tiff_datasize); ++ /* ++ * make sure is lsb-to-msb ++ * bit-endianness fill order ++ */ ++ TIFFReverseBits(buffer, ++ t2p->tiff_datasize); + } +- TIFFWriteFile(output, (tdata_t) buffer, t2p->tiff_datasize); ++ t2pWriteFile(output, (tdata_t) buffer, ++ t2p->tiff_datasize); + _TIFFfree(buffer); + return(t2p->tiff_datasize); + } + #endif + #ifdef ZIP_SUPPORT +- if(t2p->pdf_compression == T2P_COMPRESS_ZIP){ +- buffer= (unsigned char*) _TIFFmalloc(t2p->tiff_datasize); ++ if (t2p->pdf_compression == T2P_COMPRESS_ZIP) { ++ buffer = (unsigned char*) ++ _TIFFmalloc(t2p->tiff_datasize); + memset(buffer, 0, t2p->tiff_datasize); +- if(buffer==NULL){ ++ if(buffer == NULL){ + TIFFError(TIFF2PDF_MODULE, +- "Can't allocate %u bytes of memory for t2p_readwrite_pdf_image, %s", ++ "Can't allocate %u bytes of memory for t2p_readwrite_pdf_image, %s", + t2p->tiff_datasize, + TIFFFileName(input)); + t2p->t2p_error = T2P_ERR_ERROR; + return(0); + } +- TIFFReadRawStrip(input, 0, (tdata_t) buffer, t2p->tiff_datasize); +- if (t2p->tiff_fillorder==FILLORDER_LSB2MSB){ +- TIFFReverseBits(buffer, t2p->tiff_datasize); ++ TIFFReadRawStrip(input, 0, (tdata_t) buffer, ++ t2p->tiff_datasize); ++ if (t2p->tiff_fillorder==FILLORDER_LSB2MSB) { ++ TIFFReverseBits(buffer, ++ t2p->tiff_datasize); + } +- TIFFWriteFile(output, (tdata_t) buffer, t2p->tiff_datasize); ++ t2pWriteFile(output, (tdata_t) buffer, ++ t2p->tiff_datasize); + _TIFFfree(buffer); + return(t2p->tiff_datasize); + } + #endif + #ifdef OJPEG_SUPPORT +- if(t2p->tiff_compression == COMPRESSION_OJPEG){ ++ if(t2p->tiff_compression == COMPRESSION_OJPEG) { + +- if(t2p->tiff_dataoffset != 0){ +- buffer= (unsigned char*) _TIFFmalloc(t2p->tiff_datasize); ++ if(t2p->tiff_dataoffset != 0) { ++ buffer = (unsigned char*) ++ _TIFFmalloc(t2p->tiff_datasize); + memset(buffer, 0, t2p->tiff_datasize); +- if(buffer==NULL){ ++ if(buffer == NULL) { + TIFFError(TIFF2PDF_MODULE, +- "Can't allocate %u bytes of memory for t2p_readwrite_pdf_image, %s", ++ "Can't allocate %u bytes of memory for t2p_readwrite_pdf_image, %s", + t2p->tiff_datasize, + TIFFFileName(input)); + t2p->t2p_error = T2P_ERR_ERROR; + return(0); + } + if(t2p->pdf_ojpegiflength==0){ +- inputoffset=TIFFSeekFile(input, 0, SEEK_CUR); +- TIFFSeekFile(input, t2p->tiff_dataoffset, SEEK_SET); +- TIFFReadFile(input, (tdata_t) buffer, t2p->tiff_datasize); +- TIFFSeekFile(input, inputoffset, SEEK_SET); +- TIFFWriteFile(output, (tdata_t) buffer, t2p->tiff_datasize); ++ inputoffset=t2pSeekFile(input, 0, ++ SEEK_CUR); ++ t2pSeekFile(input, ++ t2p->tiff_dataoffset, ++ SEEK_SET); ++ t2pReadFile(input, (tdata_t) buffer, ++ t2p->tiff_datasize); ++ t2pSeekFile(input, inputoffset, ++ SEEK_SET); ++ t2pWriteFile(output, (tdata_t) buffer, ++ t2p->tiff_datasize); + _TIFFfree(buffer); + return(t2p->tiff_datasize); + } else { +- inputoffset=TIFFSeekFile(input, 0, SEEK_CUR); +- TIFFSeekFile(input, t2p->tiff_dataoffset, SEEK_SET); +- bufferoffset=TIFFReadFile(input, (tdata_t) buffer, t2p->pdf_ojpegiflength); +- t2p->pdf_ojpegiflength=0; +- TIFFSeekFile(input, inputoffset, SEEK_SET); +- TIFFGetField(input, TIFFTAG_YCBCRSUBSAMPLING, &h_samp, &v_samp); ++ inputoffset=t2pSeekFile(input, 0, ++ SEEK_CUR); ++ t2pSeekFile(input, ++ t2p->tiff_dataoffset, ++ SEEK_SET); ++ bufferoffset = t2pReadFile(input, ++ (tdata_t) buffer, ++ t2p->pdf_ojpegiflength); ++ t2p->pdf_ojpegiflength = 0; ++ t2pSeekFile(input, inputoffset, ++ SEEK_SET); ++ TIFFGetField(input, ++ TIFFTAG_YCBCRSUBSAMPLING, ++ &h_samp, &v_samp); + buffer[bufferoffset++]= 0xff; + buffer[bufferoffset++]= 0xdd; + buffer[bufferoffset++]= 0x00; +@@ -2132,7 +2179,9 @@ + h_samp*=8; + v_samp*=8; + ri=(t2p->tiff_width+h_samp-1) / h_samp; +- TIFFGetField(input, TIFFTAG_ROWSPERSTRIP, &rows); ++ TIFFGetField(input, ++ TIFFTAG_ROWSPERSTRIP, ++ &rows); + ri*=(rows+v_samp-1)/v_samp; + buffer[bufferoffset++]= (ri>>8) & 0xff; + buffer[bufferoffset++]= ri & 0xff; +@@ -2147,23 +2196,24 @@ + (tdata_t) &(((unsigned char*)buffer)[bufferoffset]), + -1); + } +- TIFFWriteFile(output, (tdata_t) buffer, bufferoffset); ++ t2pWriteFile(output, (tdata_t) buffer, bufferoffset); + _TIFFfree(buffer); + return(bufferoffset); + } + } else { + if(! t2p->pdf_ojpegdata){ + TIFFError(TIFF2PDF_MODULE, +- "No support for OJPEG image %s with bad tables", ++ "No support for OJPEG image %s with bad tables", + TIFFFileName(input)); + t2p->t2p_error = T2P_ERR_ERROR; + return(0); + } +- buffer=(unsigned char*) _TIFFmalloc(t2p->tiff_datasize); ++ buffer = (unsigned char*) ++ _TIFFmalloc(t2p->tiff_datasize); + memset(buffer, 0, t2p->tiff_datasize); + if(buffer==NULL){ + TIFFError(TIFF2PDF_MODULE, +- "Can't allocate %u bytes of memory for t2p_readwrite_pdf_image, %s", ++ "Can't allocate %u bytes of memory for t2p_readwrite_pdf_image, %s", + t2p->tiff_datasize, + TIFFFileName(input)); + t2p->t2p_error = T2P_ERR_ERROR; +@@ -2186,11 +2236,11 @@ + buffer[bufferoffset++]=0xff; + buffer[bufferoffset++]=0xd9; + } +- TIFFWriteFile(output, (tdata_t) buffer, bufferoffset); ++ t2pWriteFile(output, (tdata_t) buffer, bufferoffset); + _TIFFfree(buffer); + return(bufferoffset); + TIFFError(TIFF2PDF_MODULE, +- "No support for OJPEG image %s with no JPEG File Interchange offset", ++ "No support for OJPEG image %s with no JPEG File Interchange offset", + TIFFFileName(input)); + t2p->t2p_error = T2P_ERR_ERROR; + return(0); +@@ -2199,21 +2249,23 @@ + } + #endif + #ifdef JPEG_SUPPORT +- if(t2p->tiff_compression == COMPRESSION_JPEG){ +- buffer= (unsigned char*) _TIFFmalloc(t2p->tiff_datasize); ++ if(t2p->tiff_compression == COMPRESSION_JPEG) { ++ uint32 count = 0; ++ buffer = (unsigned char*) ++ _TIFFmalloc(t2p->tiff_datasize); + memset(buffer, 0, t2p->tiff_datasize); + if(buffer==NULL){ + TIFFError(TIFF2PDF_MODULE, +- "Can't allocate %u bytes of memory for t2p_readwrite_pdf_image, %s", ++ "Can't allocate %u bytes of memory for t2p_readwrite_pdf_image, %s", + t2p->tiff_datasize, + TIFFFileName(input)); + t2p->t2p_error = T2P_ERR_ERROR; + return(0); + } +- if(TIFFGetField(input, TIFFTAG_JPEGTABLES, &xuint16_1, &jpt) != 0){ +- if(xuint16_1>4){ +- _TIFFmemcpy(buffer, jpt, xuint16_1); +- bufferoffset+=xuint16_1-2; ++ if (TIFFGetField(input, TIFFTAG_JPEGTABLES, &count, &jpt) != 0) { ++ if(count > 4) { ++ _TIFFmemcpy(buffer, jpt, count); ++ bufferoffset += count - 2; + } + } + stripcount=TIFFNumberOfStrips(input); +@@ -2221,10 +2273,11 @@ + for(i=0;imax_striplength) max_striplength=sbc[i]; + } +- stripbuffer=(unsigned char*) _TIFFmalloc(max_striplength); ++ stripbuffer = (unsigned char*) ++ _TIFFmalloc(max_striplength); + if(stripbuffer==NULL){ + TIFFError(TIFF2PDF_MODULE, +- "Can't allocate %u bytes of memory for t2p_readwrite_pdf_image, %s", ++ "Can't allocate %u bytes of memory for t2p_readwrite_pdf_image, %s", + max_striplength, + TIFFFileName(input)); + _TIFFfree(buffer); +@@ -2241,7 +2294,7 @@ + i, + t2p->tiff_length)){ + TIFFError(TIFF2PDF_MODULE, +- "Can't process JPEG data in input file %s", ++ "Can't process JPEG data in input file %s", + TIFFFileName(input)); + _TIFFfree(samplebuffer); + _TIFFfree(buffer); +@@ -2251,7 +2304,7 @@ + } + buffer[bufferoffset++]=0xff; + buffer[bufferoffset++]=0xd9; +- TIFFWriteFile(output, (tdata_t) buffer, bufferoffset); ++ t2pWriteFile(output, (tdata_t) buffer, bufferoffset); + _TIFFfree(stripbuffer); + _TIFFfree(buffer); + return(bufferoffset); +@@ -2265,7 +2318,7 @@ + memset(buffer, 0, t2p->tiff_datasize); + if(buffer==NULL){ + TIFFError(TIFF2PDF_MODULE, +- "Can't allocate %u bytes of memory for t2p_readwrite_pdf_image, %s", ++ "Can't allocate %u bytes of memory for t2p_readwrite_pdf_image, %s", + t2p->tiff_datasize, + TIFFFileName(input)); + t2p->t2p_error = T2P_ERR_ERROR; +@@ -2303,7 +2356,7 @@ + memset(buffer, 0, t2p->tiff_datasize); + if(buffer==NULL){ + TIFFError(TIFF2PDF_MODULE, +- "Can't allocate %u bytes of memory for t2p_readwrite_pdf_image, %s", ++ "Can't allocate %u bytes of memory for t2p_readwrite_pdf_image, %s", + t2p->tiff_datasize, + TIFFFileName(input)); + t2p->t2p_error = T2P_ERR_ERROR; +@@ -2312,7 +2365,7 @@ + samplebuffer = (unsigned char*) _TIFFmalloc(stripsize); + if(samplebuffer==NULL){ + TIFFError(TIFF2PDF_MODULE, +- "Can't allocate %u bytes of memory for t2p_readwrite_pdf_image, %s", ++ "Can't allocate %u bytes of memory for t2p_readwrite_pdf_image, %s", + t2p->tiff_datasize, + TIFFFileName(input)); + t2p->t2p_error = T2P_ERR_ERROR; +@@ -2328,7 +2381,7 @@ + sepstripsize); + if(read==-1){ + TIFFError(TIFF2PDF_MODULE, +- "Error on decoding strip %u of %s", ++ "Error on decoding strip %u of %s", + i + j*stripcount, + TIFFFileName(input)); + _TIFFfree(buffer); +@@ -2352,7 +2405,7 @@ + memset(buffer, 0, t2p->tiff_datasize); + if(buffer==NULL){ + TIFFError(TIFF2PDF_MODULE, +- "Can't allocate %u bytes of memory for t2p_readwrite_pdf_image, %s", ++ "Can't allocate %u bytes of memory for t2p_readwrite_pdf_image, %s", + t2p->tiff_datasize, + TIFFFileName(input)); + t2p->t2p_error = T2P_ERR_ERROR; +@@ -2385,7 +2438,7 @@ + t2p->tiff_datasize * t2p->tiff_samplesperpixel); + if(samplebuffer==NULL){ + TIFFError(TIFF2PDF_MODULE, +- "Can't allocate %u bytes of memory for t2p_readwrite_pdf_image, %s", ++ "Can't allocate %u bytes of memory for t2p_readwrite_pdf_image, %s", + t2p->tiff_datasize, + TIFFFileName(input)); + t2p->t2p_error = T2P_ERR_ERROR; +@@ -2415,7 +2468,7 @@ + t2p->tiff_width*t2p->tiff_length*4); + if(samplebuffer==NULL){ + TIFFError(TIFF2PDF_MODULE, +- "Can't allocate %u bytes of memory for t2p_readwrite_pdf_image, %s", ++ "Can't allocate %u bytes of memory for t2p_readwrite_pdf_image, %s", + t2p->tiff_datasize, + TIFFFileName(input)); + t2p->t2p_error = T2P_ERR_ERROR; +@@ -2432,7 +2485,7 @@ + ORIENTATION_TOPLEFT, + 0)){ + TIFFError(TIFF2PDF_MODULE, +- "Can't use TIFFReadRGBAImageOriented to extract RGB image from %s", ++ "Can't use TIFFReadRGBAImageOriented to extract RGB image from %s", + TIFFFileName(input)); + t2p->t2p_error = T2P_ERR_ERROR; + return(0); +@@ -2450,11 +2503,9 @@ + } + } + +- dataready: +- +- t2p->tiff_writeproc=output->tif_writeproc; +- output->tif_writeproc=t2p_empty_writeproc; ++dataready: + ++ t2p_disable(output); + TIFFSetField(output, TIFFTAG_PHOTOMETRIC, t2p->tiff_photometric); + TIFFSetField(output, TIFFTAG_BITSPERSAMPLE, t2p->tiff_bitspersample); + TIFFSetField(output, TIFFTAG_SAMPLESPERPIXEL, t2p->tiff_samplesperpixel); +@@ -2475,10 +2526,11 @@ + #endif + #ifdef JPEG_SUPPORT + case T2P_COMPRESS_JPEG: +- if(t2p->tiff_photometric==PHOTOMETRIC_YCBCR){ +- if(TIFFGetField(input, TIFFTAG_YCBCRSUBSAMPLING, &xuint16_1, &xuint16_2)!=0){ +- if(xuint16_1 != 0 && xuint16_2 != 0){ +- TIFFSetField(output, TIFFTAG_YCBCRSUBSAMPLING, xuint16_1, xuint16_2); ++ if(t2p->tiff_photometric==PHOTOMETRIC_YCBCR) { ++ uint16 hor = 0, ver = 0; ++ if (TIFFGetField(input, TIFFTAG_YCBCRSUBSAMPLING, &hor, &ver) !=0 ) { ++ if(hor != 0 && ver != 0){ ++ TIFFSetField(output, TIFFTAG_YCBCRSUBSAMPLING, hor, ver); + } + } + if(TIFFGetField(input, TIFFTAG_REFERENCEBLACKWHITE, &xfloatp)!=0){ +@@ -2487,7 +2539,7 @@ + } + if(TIFFSetField(output, TIFFTAG_COMPRESSION, COMPRESSION_JPEG)==0){ + TIFFError(TIFF2PDF_MODULE, +- "Unable to use JPEG compression for input %s and output %s", ++ "Unable to use JPEG compression for input %s and output %s", + TIFFFileName(input), + TIFFFileName(output)); + _TIFFfree(buffer); +@@ -2536,37 +2588,44 @@ + default: + break; + } +- +- output->tif_writeproc=t2p->tiff_writeproc; ++ ++ t2p_enable(output); ++ t2p->outputwritten = 0; + #ifdef JPEG_SUPPORT +- if(t2p->pdf_compression==T2P_COMPRESS_JPEG && t2p->tiff_photometric==PHOTOMETRIC_YCBCR){ +- bufferoffset=TIFFWriteEncodedStrip(output, (tstrip_t)0, buffer,stripsize*stripcount); ++ if(t2p->pdf_compression == T2P_COMPRESS_JPEG ++ && t2p->tiff_photometric == PHOTOMETRIC_YCBCR){ ++ bufferoffset = TIFFWriteEncodedStrip(output, (tstrip_t)0, ++ buffer, ++ stripsize * stripcount); + } else + #endif +- bufferoffset=TIFFWriteEncodedStrip(output, (tstrip_t)0, buffer, t2p->tiff_datasize); +- if(buffer != NULL){ ++ { ++ bufferoffset = TIFFWriteEncodedStrip(output, (tstrip_t)0, ++ buffer, ++ t2p->tiff_datasize); ++ } ++ if (buffer != NULL) { + _TIFFfree(buffer); + buffer=NULL; + } + +- if(bufferoffset==(tsize_t)-1){ ++ if (bufferoffset == (tsize_t)-1) { + TIFFError(TIFF2PDF_MODULE, +- "Error writing encoded strip to output PDF %s", +- TIFFFileName(output)); ++ "Error writing encoded strip to output PDF %s", ++ TIFFFileName(output)); + t2p->t2p_error = T2P_ERR_ERROR; + return(0); + } + +- written= output->tif_dir.td_stripbytecount[0]; +- ++ written = t2p->outputwritten; + return(written); + } + + /* +- This function reads the raster image data from the input TIFF for an image tile and writes +- the data to the output PDF XObject image dictionary stream for the tile. It returns the +- amount written or zero on error. +-*/ ++ * This function reads the raster image data from the input TIFF for an image ++ * tile and writes the data to the output PDF XObject image dictionary stream ++ * for the tile. It returns the amount written or zero on error. ++ */ + + tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_t tile){ + +@@ -2584,8 +2643,6 @@ + tsize_t septilesize=0; + #ifdef JPEG_SUPPORT + unsigned char* jpt; +- uint16 xuint16_1=0; +- uint16 xuint16_2=0; + float* xfloatp; + uint32 xuint32=0; + #endif +@@ -2615,7 +2672,7 @@ + if (t2p->tiff_fillorder==FILLORDER_LSB2MSB){ + TIFFReverseBits(buffer, t2p->tiff_datasize); + } +- TIFFWriteFile(output, (tdata_t) buffer, t2p->tiff_datasize); ++ t2pWriteFile(output, (tdata_t) buffer, t2p->tiff_datasize); + _TIFFfree(buffer); + return(t2p->tiff_datasize); + } +@@ -2636,7 +2693,7 @@ + if (t2p->tiff_fillorder==FILLORDER_LSB2MSB){ + TIFFReverseBits(buffer, t2p->tiff_datasize); + } +- TIFFWriteFile(output, (tdata_t) buffer, t2p->tiff_datasize); ++ t2pWriteFile(output, (tdata_t) buffer, t2p->tiff_datasize); + _TIFFfree(buffer); + return(t2p->tiff_datasize); + } +@@ -2683,7 +2740,7 @@ + -1); + ((unsigned char*)buffer)[bufferoffset++]=0xff; + ((unsigned char*)buffer)[bufferoffset++]=0xd9; +- TIFFWriteFile(output, (tdata_t) buffer, bufferoffset); ++ t2pWriteFile(output, (tdata_t) buffer, bufferoffset); + _TIFFfree(buffer); + return(bufferoffset); + } +@@ -2691,6 +2748,7 @@ + #ifdef JPEG_SUPPORT + if(t2p->tiff_compression == COMPRESSION_JPEG){ + unsigned char table_end[2]; ++ uint32 count = 0; + buffer= (unsigned char*) _TIFFmalloc(t2p->tiff_datasize); + if(buffer==NULL){ + TIFFError(TIFF2PDF_MODULE, +@@ -2701,14 +2759,14 @@ + t2p->t2p_error = T2P_ERR_ERROR; + return(0); + } +- if(TIFFGetField(input, TIFFTAG_JPEGTABLES, &xuint16_1, &jpt) != 0) { +- if(xuint16_1 > 0){ +- _TIFFmemcpy(buffer, jpt, xuint16_1); +- bufferoffset += xuint16_1 - 2; ++ if(TIFFGetField(input, TIFFTAG_JPEGTABLES, &count, &jpt) != 0) { ++ if (count > 0) { ++ _TIFFmemcpy(buffer, jpt, count); ++ bufferoffset += count - 2; + table_end[0] = buffer[bufferoffset-2]; + table_end[1] = buffer[bufferoffset-1]; + } +- if(xuint16_1 > 0) { ++ if (count > 0) { + xuint32 = bufferoffset; + bufferoffset += TIFFReadRawTile( + input, +@@ -2725,7 +2783,7 @@ + -1); + } + } +- TIFFWriteFile(output, (tdata_t) buffer, bufferoffset); ++ t2pWriteFile(output, (tdata_t) buffer, bufferoffset); + _TIFFfree(buffer); + return(bufferoffset); + } +@@ -2882,9 +2940,8 @@ + t2p->tiff_tiles[t2p->pdf_page].tiles_tilelength); + } + +- t2p->tiff_writeproc=output->tif_writeproc; +- output->tif_writeproc=t2p_empty_writeproc; + ++ t2p_disable(output); + TIFFSetField(output, TIFFTAG_PHOTOMETRIC, t2p->tiff_photometric); + TIFFSetField(output, TIFFTAG_BITSPERSAMPLE, t2p->tiff_bitspersample); + TIFFSetField(output, TIFFTAG_SAMPLESPERPIXEL, t2p->tiff_samplesperpixel); +@@ -2932,10 +2989,11 @@ + #endif + #ifdef JPEG_SUPPORT + case T2P_COMPRESS_JPEG: +- if(t2p->tiff_photometric==PHOTOMETRIC_YCBCR){ +- if(TIFFGetField(input, TIFFTAG_YCBCRSUBSAMPLING, &xuint16_1, &xuint16_2)!=0){ +- if(xuint16_1 != 0 && xuint16_2 != 0){ +- TIFFSetField(output, TIFFTAG_YCBCRSUBSAMPLING, xuint16_1, xuint16_2); ++ if (t2p->tiff_photometric==PHOTOMETRIC_YCBCR) { ++ uint16 hor = 0, ver = 0; ++ if (TIFFGetField(input, TIFFTAG_YCBCRSUBSAMPLING, &hor, &ver)!=0) { ++ if (hor != 0 && ver != 0) { ++ TIFFSetField(output, TIFFTAG_YCBCRSUBSAMPLING, hor, ver); + } + } + if(TIFFGetField(input, TIFFTAG_REFERENCEBLACKWHITE, &xfloatp)!=0){ +@@ -2983,22 +3041,24 @@ + default: + break; + } +- +- output->tif_writeproc=t2p->tiff_writeproc; +- bufferoffset=TIFFWriteEncodedStrip(output, (tstrip_t) 0, buffer, TIFFStripSize(output)); +- if(buffer != NULL){ ++ ++ t2p_enable(output); ++ t2p->outputwritten = 0; ++ bufferoffset = TIFFWriteEncodedStrip(output, (tstrip_t) 0, buffer, ++ TIFFStripSize(output)); ++ if (buffer != NULL) { + _TIFFfree(buffer); +- buffer=NULL; ++ buffer = NULL; + } +- if(bufferoffset==-1){ ++ if (bufferoffset == -1) { + TIFFError(TIFF2PDF_MODULE, +- "Error writing encoded tile to output PDF %s", +- TIFFFileName(output)); ++ "Error writing encoded tile to output PDF %s", ++ TIFFFileName(output)); + t2p->t2p_error = T2P_ERR_ERROR; + return(0); + } + +- written= output->tif_dir.td_stripbytecount[0]; ++ written = t2p->outputwritten; + + return(written); + } +@@ -3364,20 +3424,15 @@ + + + /* +- This function calls TIFFWriteDirectory on the output after blanking its output by replacing the +- read, write, and seek procedures with empty implementations, then it replaces the original +- implementations. +-*/ +- +-void t2p_write_advance_directory(T2P* t2p, TIFF* output){ ++ * This function calls TIFFWriteDirectory on the output after blanking its ++ * output by replacing the read, write, and seek procedures with empty ++ * implementations, then it replaces the original implementations. ++ */ + +- t2p->tiff_writeproc=output->tif_writeproc; +- output->tif_writeproc=t2p_empty_writeproc; +- t2p->tiff_readproc=output->tif_readproc; +- output->tif_readproc=t2p_empty_readproc; +- t2p->tiff_seekproc=output->tif_seekproc; +- output->tif_seekproc=t2p_empty_seekproc; +- output->tif_header.tiff_diroff=0; ++void ++t2p_write_advance_directory(T2P* t2p, TIFF* output) ++{ ++ t2p_disable(output); + if(!TIFFWriteDirectory(output)){ + TIFFError(TIFF2PDF_MODULE, + "Error writing virtual directory to output PDF %s", +@@ -3385,10 +3440,7 @@ + t2p->t2p_error = T2P_ERR_ERROR; + return; + } +- output->tif_writeproc=t2p->tiff_writeproc; +- output->tif_readproc=t2p->tiff_readproc; +- output->tif_seekproc=t2p->tiff_seekproc; +- ++ t2p_enable(output); + return; + } + +@@ -3532,8 +3584,8 @@ + int buflen=0; + + buflen=sprintf(buffer, "%%PDF-%u.%u ", t2p->pdf_majorversion&0xff, t2p->pdf_minorversion&0xff); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); +- written += TIFFWriteFile(output, (tdata_t)"\r%\342\343\317\323\r\n", 8); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t)"\n%\342\343\317\323\n", 7); + + return(written); + } +@@ -3549,8 +3601,8 @@ + int buflen=0; + + buflen=sprintf(buffer, "%lu", (unsigned long)number); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen ); +- written += TIFFWriteFile(output, (tdata_t) " 0 obj\r", 7); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen ); ++ written += t2pWriteFile(output, (tdata_t) " 0 obj\n", 7); + + return(written); + } +@@ -3563,7 +3615,7 @@ + + tsize_t written=0; + +- written += TIFFWriteFile(output, (tdata_t) "endobj\r", 7); ++ written += t2pWriteFile(output, (tdata_t) "endobj\n", 7); + + return(written); + } +@@ -3572,83 +3624,96 @@ + This function writes a PDF name object to output. + */ + +-tsize_t t2p_write_pdf_name(char* name, TIFF* output){ ++tsize_t t2p_write_pdf_name(unsigned char* name, TIFF* output){ + + tsize_t written=0; + uint32 i=0; +- char buffer[4]; ++ char buffer[64]; + uint16 nextchar=0; +- uint32 namelen=0; ++ size_t namelen=0; + +- namelen=strlen(name); ++ namelen = strlen((char *)name); + if (namelen>126) { + namelen=126; + } +- written += TIFFWriteFile(output, (tdata_t) "/", 1); ++ written += t2pWriteFile(output, (tdata_t) "/", 1); + for (i=0;i 0x7E){ +- sprintf(buffer, "#%.2X", name[i]); +- written += TIFFWriteFile(output, (tdata_t) buffer, 3); ++ sprintf(buffer, "#%.2X", name[i]); ++ buffer[sizeof(buffer) - 1] = '\0'; ++ written += t2pWriteFile(output, (tdata_t) buffer, 3); + nextchar=1; + } + if (nextchar==0){ + switch (name[i]){ + case 0x23: +- sprintf(buffer, "#%.2X", name[i]); +- written += TIFFWriteFile(output, (tdata_t) buffer, 3); ++ sprintf(buffer, "#%.2X", name[i]); ++ buffer[sizeof(buffer) - 1] = '\0'; ++ written += t2pWriteFile(output, (tdata_t) buffer, 3); + break; + case 0x25: +- sprintf(buffer, "#%.2X", name[i]); +- written += TIFFWriteFile(output, (tdata_t) buffer, 3); ++ sprintf(buffer, "#%.2X", name[i]); ++ buffer[sizeof(buffer) - 1] = '\0'; ++ written += t2pWriteFile(output, (tdata_t) buffer, 3); + break; + case 0x28: +- sprintf(buffer, "#%.2X", name[i]); +- written += TIFFWriteFile(output, (tdata_t) buffer, 3); ++ sprintf(buffer, "#%.2X", name[i]); ++ buffer[sizeof(buffer) - 1] = '\0'; ++ written += t2pWriteFile(output, (tdata_t) buffer, 3); + break; + case 0x29: + sprintf(buffer, "#%.2X", name[i]); +- written += TIFFWriteFile(output, (tdata_t) buffer, 3); ++ buffer[sizeof(buffer) - 1] = '\0'; ++ written += t2pWriteFile(output, (tdata_t) buffer, 3); + break; + case 0x2F: + sprintf(buffer, "#%.2X", name[i]); +- written += TIFFWriteFile(output, (tdata_t) buffer, 3); ++ buffer[sizeof(buffer) - 1] = '\0'; ++ written += t2pWriteFile(output, (tdata_t) buffer, 3); + break; + case 0x3C: + sprintf(buffer, "#%.2X", name[i]); +- written += TIFFWriteFile(output, (tdata_t) buffer, 3); ++ buffer[sizeof(buffer) - 1] = '\0'; ++ written += t2pWriteFile(output, (tdata_t) buffer, 3); + break; + case 0x3E: +- sprintf(buffer, "#%.2X", name[i]); +- written += TIFFWriteFile(output, (tdata_t) buffer, 3); ++ sprintf(buffer, "#%.2X", name[i]); ++ buffer[sizeof(buffer) - 1] = '\0'; ++ written += t2pWriteFile(output, (tdata_t) buffer, 3); + break; + case 0x5B: + sprintf(buffer, "#%.2X", name[i]); +- written += TIFFWriteFile(output, (tdata_t) buffer, 3); ++ buffer[sizeof(buffer) - 1] = '\0'; ++ written += t2pWriteFile(output, (tdata_t) buffer, 3); + break; + case 0x5D: +- sprintf(buffer, "#%.2X", name[i]); +- written += TIFFWriteFile(output, (tdata_t) buffer, 3); ++ sprintf(buffer, "#%.2X", name[i]); ++ buffer[sizeof(buffer) - 1] = '\0'; ++ written += t2pWriteFile(output, (tdata_t) buffer, 3); + break; + case 0x7B: + sprintf(buffer, "#%.2X", name[i]); +- written += TIFFWriteFile(output, (tdata_t) buffer, 3); ++ buffer[sizeof(buffer) - 1] = '\0'; ++ written += t2pWriteFile(output, (tdata_t) buffer, 3); + break; + case 0x7D: + sprintf(buffer, "#%.2X", name[i]); +- written += TIFFWriteFile(output, (tdata_t) buffer, 3); ++ buffer[sizeof(buffer) - 1] = '\0'; ++ written += t2pWriteFile(output, (tdata_t) buffer, 3); + break; + default: +- written += TIFFWriteFile(output, (tdata_t) &name[i], 1); ++ written += t2pWriteFile(output, (tdata_t) &name[i], 1); + } + } + nextchar=0; + } +- written += TIFFWriteFile(output, (tdata_t) " ", 1); ++ written += t2pWriteFile(output, (tdata_t) " ", 1); + + return(written); + } +@@ -3657,51 +3722,52 @@ + This function writes a PDF string object to output. + */ + +-tsize_t t2p_write_pdf_string(char* pdfstr, TIFF* output){ ++tsize_t t2p_write_pdf_string(unsigned char* pdfstr, TIFF* output){ + +- tsize_t written=0; +- uint32 i=0; +- char buffer[5]; +- uint32 len=0; ++ tsize_t written = 0; ++ uint32 i = 0; ++ char buffer[64]; ++ size_t len = 0; + +- len=strlen(pdfstr); +- written += TIFFWriteFile(output, (tdata_t) "(", 1); +- for (i=0;i>\r", 4); ++ written += t2pWriteFile(output, (tdata_t) " >>\n", 4); + + return(written); + } +@@ -3805,8 +3871,8 @@ + int buflen=0; + + buflen=sprintf(buffer, "%lu", (unsigned long)len); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); +- written += TIFFWriteFile(output, (tdata_t) "\r", 1); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) "\n", 1); + + return(written); + } +@@ -3821,18 +3887,18 @@ + char buffer[16]; + int buflen=0; + +- written += TIFFWriteFile(output, +- (tdata_t)"<< \r/Type /Catalog \r/Pages ", ++ written += t2pWriteFile(output, ++ (tdata_t)"<< \n/Type /Catalog \n/Pages ", + 27); + buflen=sprintf(buffer, "%lu", (unsigned long)t2p->pdf_pages); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen ); +- written += TIFFWriteFile(output, (tdata_t) " 0 R \r", 6); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen ); ++ written += t2pWriteFile(output, (tdata_t) " 0 R \n", 6); + if(t2p->pdf_fitwindow){ +- written += TIFFWriteFile(output, +- (tdata_t) "/ViewerPreferences <>\r", ++ written += t2pWriteFile(output, ++ (tdata_t) "/ViewerPreferences <>\n", + 39); + } +- written += TIFFWriteFile(output, (tdata_t)">>\r", 3); ++ written += t2pWriteFile(output, (tdata_t)">>\n", 3); + + return(written); + } +@@ -3843,116 +3909,137 @@ + + tsize_t t2p_write_pdf_info(T2P* t2p, TIFF* input, TIFF* output){ + +- tsize_t written=0; +- char* info; ++ tsize_t written = 0; ++ unsigned char* info; + char buffer[512]; +- int buflen=0; ++ int buflen = 0; + + if(t2p->pdf_datetime==NULL){ + t2p_pdf_tifftime(t2p, input); + } +- if(strlen(t2p->pdf_datetime) > 0){ +- written += TIFFWriteFile(output, (tdata_t) "<< \r/CreationDate ", 18); ++ if(strlen((char *)t2p->pdf_datetime) > 0){ ++ written += t2pWriteFile(output, (tdata_t) "<< \n/CreationDate ", 18); + written += t2p_write_pdf_string(t2p->pdf_datetime, output); +- written += TIFFWriteFile(output, (tdata_t) "\r/ModDate ", 10); ++ written += t2pWriteFile(output, (tdata_t) "\n/ModDate ", 10); + written += t2p_write_pdf_string(t2p->pdf_datetime, output); + } +- written += TIFFWriteFile(output, (tdata_t) "\r/Producer ", 11); +- _TIFFmemset((tdata_t)buffer, 0x00, 512); +- buflen=sprintf(buffer, "libtiff / tiff2pdf - %d / %s", TIFFLIB_VERSION, T2P_VERSION); +- written += t2p_write_pdf_string(buffer, output); +- written += TIFFWriteFile(output, (tdata_t) "\r", 1); ++ written += t2pWriteFile(output, (tdata_t) "\n/Producer ", 11); ++ _TIFFmemset((tdata_t)buffer, 0x00, sizeof(buffer)); ++ buflen = sprintf(buffer, "libtiff / tiff2pdf - %d", TIFFLIB_VERSION); ++ written += t2p_write_pdf_string((unsigned char*)buffer, output); ++ written += t2pWriteFile(output, (tdata_t) "\n", 1); + if(t2p->pdf_creator != NULL){ +- if(strlen(t2p->pdf_creator)>0){ +- if(strlen(t2p->pdf_creator)>511){t2p->pdf_creator[512]=(char)0;} +- written += TIFFWriteFile(output, (tdata_t) "/Creator ", 9); ++ if(strlen((char *)t2p->pdf_creator)>0){ ++ if(strlen((char *)t2p->pdf_creator) > 511) { ++ t2p->pdf_creator[512] = '\0'; ++ } ++ written += t2pWriteFile(output, (tdata_t) "/Creator ", 9); + written += t2p_write_pdf_string(t2p->pdf_creator, output); +- written += TIFFWriteFile(output, (tdata_t) "\r", 1); ++ written += t2pWriteFile(output, (tdata_t) "\n", 1); + } + } else{ + if( TIFFGetField(input, TIFFTAG_SOFTWARE, &info) != 0){ +- if(strlen(info)>511){info[512]=(char)0;} +- written += TIFFWriteFile(output, (tdata_t) "/Creator ", 9); ++ if(strlen((char *)info) > 511) { ++ info[512] = '\0'; ++ } ++ written += t2pWriteFile(output, (tdata_t) "/Creator ", 9); + written += t2p_write_pdf_string(info, output); +- written += TIFFWriteFile(output, (tdata_t) "\r", 1); ++ written += t2pWriteFile(output, (tdata_t) "\n", 1); + } + } +- if(t2p->pdf_author != NULL){ +- if(strlen(t2p->pdf_author)>0){ +- if(strlen(t2p->pdf_author)>511){t2p->pdf_author[512]=(char)0;} +- written += TIFFWriteFile(output, (tdata_t) "/Author ", 8); ++ if(t2p->pdf_author != NULL) { ++ if(strlen((char *)t2p->pdf_author) > 0) { ++ if(strlen((char *)t2p->pdf_author) > 511) { ++ t2p->pdf_author[512] = '\0'; ++ } ++ written += t2pWriteFile(output, (tdata_t) "/Author ", 8); + written += t2p_write_pdf_string(t2p->pdf_author, output); +- written += TIFFWriteFile(output, (tdata_t) "\r", 1); ++ written += t2pWriteFile(output, (tdata_t) "\n", 1); + } + } else{ + if( TIFFGetField(input, TIFFTAG_ARTIST, &info) != 0){ +- if(strlen(info)>511){info[512]=(char)0;} +- written += TIFFWriteFile(output, (tdata_t) "/Author ", 8); ++ if(strlen((char *)info) > 511) { ++ info[512] = '\0'; ++ } ++ written += t2pWriteFile(output, (tdata_t) "/Author ", 8); + written += t2p_write_pdf_string(info, output); +- written += TIFFWriteFile(output, (tdata_t) "\r", 1); ++ written += t2pWriteFile(output, (tdata_t) "\n", 1); + } else if ( TIFFGetField(input, TIFFTAG_COPYRIGHT, &info) != 0){ +- if(strlen(info)>511){info[512]=(char)0;} +- written += TIFFWriteFile(output, (tdata_t) "/Author ", 8); ++ if(strlen((char *)info) > 511) { ++ info[512] = '\0'; ++ } ++ written += t2pWriteFile(output, (tdata_t) "/Author ", 8); + written += t2p_write_pdf_string(info, output); +- written += TIFFWriteFile(output, (tdata_t) "\r", 1); ++ written += t2pWriteFile(output, (tdata_t) "\n", 1); + } + } +- if(t2p->pdf_title != NULL){ +- if(strlen(t2p->pdf_title)>0){ +- if(strlen(t2p->pdf_title)>511){t2p->pdf_title[512]=(char)0;} +- written += TIFFWriteFile(output, (tdata_t) "/Title ", 7); ++ if(t2p->pdf_title != NULL) { ++ if(strlen((char *)t2p->pdf_title) > 0) { ++ if(strlen((char *)t2p->pdf_title) > 511) { ++ t2p->pdf_title[512] = '\0'; ++ } ++ written += t2pWriteFile(output, (tdata_t) "/Title ", 7); + written += t2p_write_pdf_string(t2p->pdf_title, output); +- written += TIFFWriteFile(output, (tdata_t) "\r", 1); ++ written += t2pWriteFile(output, (tdata_t) "\n", 1); + } + } else{ + if( TIFFGetField(input, TIFFTAG_DOCUMENTNAME, &info) != 0){ +- if(strlen(info)>511){info[512]=(char)0;} +- written += TIFFWriteFile(output, (tdata_t) "/Title ", 7); ++ if(strlen((char *)info) > 511) { ++ info[512] = '\0'; ++ } ++ written += t2pWriteFile(output, (tdata_t) "/Title ", 7); + written += t2p_write_pdf_string(info, output); +- written += TIFFWriteFile(output, (tdata_t) "\r", 1); ++ written += t2pWriteFile(output, (tdata_t) "\n", 1); + } + } +- if(t2p->pdf_subject != NULL){ +- if(strlen(t2p->pdf_subject)>0){ +- if(strlen(t2p->pdf_subject)>511){t2p->pdf_subject[512]=(char)0;} +- written += TIFFWriteFile(output, (tdata_t) "/Subject ", 9); ++ if(t2p->pdf_subject != NULL) { ++ if(strlen((char *)t2p->pdf_subject) > 0) { ++ if(strlen((char *)t2p->pdf_subject) > 511) { ++ t2p->pdf_subject[512] = '\0'; ++ } ++ written += t2pWriteFile(output, (tdata_t) "/Subject ", 9); + written += t2p_write_pdf_string(t2p->pdf_subject, output); +- written += TIFFWriteFile(output, (tdata_t) "\r", 1); ++ written += t2pWriteFile(output, (tdata_t) "\n", 1); + } +- } else{ +- if( TIFFGetField(input, TIFFTAG_IMAGEDESCRIPTION, &info) != 0){ +- if(strlen(info)>511){info[512]=(char)0;} +- written += TIFFWriteFile(output, (tdata_t) "/Subject ", 9); ++ } else { ++ if(TIFFGetField(input, TIFFTAG_IMAGEDESCRIPTION, &info) != 0) { ++ if(strlen((char *)info) > 511) { ++ info[512] = '\0'; ++ } ++ written += t2pWriteFile(output, (tdata_t) "/Subject ", 9); + written += t2p_write_pdf_string(info, output); +- written += TIFFWriteFile(output, (tdata_t) "\r", 1); ++ written += t2pWriteFile(output, (tdata_t) "\n", 1); + } + } +- if(t2p->pdf_keywords != NULL){ +- if(strlen(t2p->pdf_keywords)>0){ +- if(strlen(t2p->pdf_keywords)>511){t2p->pdf_keywords[512]=(char)0;} +- written += TIFFWriteFile(output, (tdata_t) "/Keywords ", 10); ++ if(t2p->pdf_keywords != NULL) { ++ if(strlen((char *)t2p->pdf_keywords) > 0) { ++ if(strlen((char *)t2p->pdf_keywords) > 511) { ++ t2p->pdf_keywords[512] = '\0'; ++ } ++ written += t2pWriteFile(output, (tdata_t) "/Keywords ", 10); + written += t2p_write_pdf_string(t2p->pdf_keywords, output); +- written += TIFFWriteFile(output, (tdata_t) "\r", 1); ++ written += t2pWriteFile(output, (tdata_t) "\n", 1); + } + } +- written += TIFFWriteFile(output, (tdata_t) ">> \r", 4); ++ written += t2pWriteFile(output, (tdata_t) ">> \n", 4); + + return(written); + } + + /* +- This function fills a string of a T2P struct with the current time as a PDF date string, +- it is called by t2p_pdf_tifftime. +-*/ ++ * This function fills a string of a T2P struct with the current time as a PDF ++ * date string, it is called by t2p_pdf_tifftime. ++ */ + +-void t2p_pdf_currenttime(T2P* t2p){ ++void t2p_pdf_currenttime(T2P* t2p) ++{ + + struct tm* currenttime; + time_t timenow; + + timenow=time(0); + currenttime=localtime(&timenow); +- sprintf(t2p->pdf_datetime, "D:%.4d%.2d%.2d%.2d%.2d%.2d", ++ sprintf((char *)t2p->pdf_datetime, "D:%.4d%.2d%.2d%.2d%.2d%.2d", + (currenttime->tm_year+1900) % 65536, + (currenttime->tm_mon+1) % 256, + (currenttime->tm_mday) % 256, +@@ -3964,25 +4051,24 @@ + } + + /* +- This function fills a string of a T2P struct with the date and time of a TIFF file if it +- exists or the current time as a PDF date string. +-*/ ++ * This function fills a string of a T2P struct with the date and time of a ++ * TIFF file if it exists or the current time as a PDF date string. ++ */ + + void t2p_pdf_tifftime(T2P* t2p, TIFF* input){ + + char* datetime; + +- t2p->pdf_datetime= (char*) _TIFFmalloc(19); +- if(t2p->pdf_datetime==NULL){ ++ t2p->pdf_datetime = (unsigned char*) _TIFFmalloc(19); ++ if(t2p->pdf_datetime == NULL){ + TIFFError(TIFF2PDF_MODULE, +- "Can't allocate %u bytes of memory for t2p_pdf_tiff_time", +- 17); ++ "Can't allocate %u bytes of memory for t2p_pdf_tiff_time", 17); + t2p->t2p_error = T2P_ERR_ERROR; + return; + } +- t2p->pdf_datetime[16]=0; ++ t2p->pdf_datetime[16] = '\0'; + if( TIFFGetField(input, TIFFTAG_DATETIME, &datetime) != 0 +- && (strlen(datetime) >= 19) ){ ++ && (strlen(datetime) >= 19) ){ + t2p->pdf_datetime[0]='D'; + t2p->pdf_datetime[1]=':'; + t2p->pdf_datetime[2]=datetime[0]; +@@ -4007,28 +4093,26 @@ + } + + /* +- This function writes a PDF Pages Tree structure to output. +-*/ +- +-tsize_t t2p_write_pdf_pages(T2P* t2p, +- TIFF* output){ ++ * This function writes a PDF Pages Tree structure to output. ++ */ + ++tsize_t t2p_write_pdf_pages(T2P* t2p, TIFF* output) ++{ + tsize_t written=0; + tdir_t i=0; + char buffer[16]; + int buflen=0; + + int page=0; +- written += TIFFWriteFile(output, +- (tdata_t) "<< \r/Type /Pages \r/Kids [ ", +- 26); ++ written += t2pWriteFile(output, ++ (tdata_t) "<< \n/Type /Pages \n/Kids [ ", 26); + page = t2p->pdf_pages+1; + for (i=0;itiff_pagecount;i++){ + buflen=sprintf(buffer, "%d", page); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); +- written += TIFFWriteFile(output, (tdata_t) " 0 R ", 5); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) " 0 R ", 5); + if ( ((i+1)%8)==0 ) { +- written += TIFFWriteFile(output, (tdata_t) "\r", 1); ++ written += t2pWriteFile(output, (tdata_t) "\n", 1); + } + page +=3; + page += t2p->tiff_pages[i].page_extra; +@@ -4038,11 +4122,11 @@ + page +=2; + } + } +- written += TIFFWriteFile(output, (tdata_t) "] \r/Count ", 10); ++ written += t2pWriteFile(output, (tdata_t) "] \n/Count ", 10); + _TIFFmemset(buffer, 0x00, 16); + buflen=sprintf(buffer, "%d", t2p->tiff_pagecount); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); +- written += TIFFWriteFile(output, (tdata_t) " \r>> \r", 6); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) " \n>> \n", 6); + + return(written); + } +@@ -4058,86 +4142,86 @@ + char buffer[16]; + int buflen=0; + +- written += TIFFWriteFile(output, (tdata_t) "<<\r/Type /Page \r/Parent ", 24); ++ written += t2pWriteFile(output, (tdata_t) "<<\n/Type /Page \n/Parent ", 24); + buflen=sprintf(buffer, "%lu", (unsigned long)t2p->pdf_pages); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); +- written += TIFFWriteFile(output, (tdata_t) " 0 R \r", 6); +- written += TIFFWriteFile(output, (tdata_t) "/MediaBox [", 11); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) " 0 R \n", 6); ++ written += t2pWriteFile(output, (tdata_t) "/MediaBox [", 11); + buflen=sprintf(buffer, "%.4f",t2p->pdf_mediabox.x1); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); +- written += TIFFWriteFile(output, (tdata_t) " ", 1); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) " ", 1); + buflen=sprintf(buffer, "%.4f",t2p->pdf_mediabox.y1); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); +- written += TIFFWriteFile(output, (tdata_t) " ", 1); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) " ", 1); + buflen=sprintf(buffer, "%.4f",t2p->pdf_mediabox.x2); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); +- written += TIFFWriteFile(output, (tdata_t) " ", 1); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) " ", 1); + buflen=sprintf(buffer, "%.4f",t2p->pdf_mediabox.y2); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); +- written += TIFFWriteFile(output, (tdata_t) "] \r", 3); +- written += TIFFWriteFile(output, (tdata_t) "/Contents ", 10); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) "] \n", 3); ++ written += t2pWriteFile(output, (tdata_t) "/Contents ", 10); + buflen=sprintf(buffer, "%lu", (unsigned long)(object + 1)); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); +- written += TIFFWriteFile(output, (tdata_t) " 0 R \r", 6); +- written += TIFFWriteFile(output, (tdata_t) "/Resources << \r", 15); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) " 0 R \n", 6); ++ written += t2pWriteFile(output, (tdata_t) "/Resources << \n", 15); + if( t2p->tiff_tiles[t2p->pdf_page].tiles_tilecount != 0 ){ +- written += TIFFWriteFile(output, (tdata_t) "/XObject <<\r", 12); ++ written += t2pWriteFile(output, (tdata_t) "/XObject <<\n", 12); + for(i=0;itiff_tiles[t2p->pdf_page].tiles_tilecount;i++){ +- written += TIFFWriteFile(output, (tdata_t) "/Im", 3); ++ written += t2pWriteFile(output, (tdata_t) "/Im", 3); + buflen = sprintf(buffer, "%u", t2p->pdf_page+1); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); +- written += TIFFWriteFile(output, (tdata_t) "_", 1); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) "_", 1); + buflen = sprintf(buffer, "%u", i+1); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); +- written += TIFFWriteFile(output, (tdata_t) " ", 1); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) " ", 1); + buflen = sprintf( + buffer, + "%lu", + (unsigned long)(object+3+(2*i)+t2p->tiff_pages[t2p->pdf_page].page_extra)); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); +- written += TIFFWriteFile(output, (tdata_t) " 0 R ", 5); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) " 0 R ", 5); + if(i%4==3){ +- written += TIFFWriteFile(output, (tdata_t) "\r", 1); ++ written += t2pWriteFile(output, (tdata_t) "\n", 1); + } + } +- written += TIFFWriteFile(output, (tdata_t) ">>\r", 3); ++ written += t2pWriteFile(output, (tdata_t) ">>\n", 3); + } else { +- written += TIFFWriteFile(output, (tdata_t) "/XObject <<\r", 12); +- written += TIFFWriteFile(output, (tdata_t) "/Im", 3); ++ written += t2pWriteFile(output, (tdata_t) "/XObject <<\n", 12); ++ written += t2pWriteFile(output, (tdata_t) "/Im", 3); + buflen = sprintf(buffer, "%u", t2p->pdf_page+1); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); +- written += TIFFWriteFile(output, (tdata_t) " ", 1); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) " ", 1); + buflen = sprintf( + buffer, + "%lu", + (unsigned long)(object+3+(2*i)+t2p->tiff_pages[t2p->pdf_page].page_extra)); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); +- written += TIFFWriteFile(output, (tdata_t) " 0 R ", 5); +- written += TIFFWriteFile(output, (tdata_t) ">>\r", 3); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) " 0 R ", 5); ++ written += t2pWriteFile(output, (tdata_t) ">>\n", 3); + } + if(t2p->tiff_transferfunctioncount != 0) { +- written += TIFFWriteFile(output, (tdata_t) "/ExtGState <<", 13); +- TIFFWriteFile(output, (tdata_t) "/GS1 ", 5); ++ written += t2pWriteFile(output, (tdata_t) "/ExtGState <<", 13); ++ t2pWriteFile(output, (tdata_t) "/GS1 ", 5); + buflen = sprintf( + buffer, + "%lu", + (unsigned long)(object + 3)); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); +- written += TIFFWriteFile(output, (tdata_t) " 0 R ", 5); +- written += TIFFWriteFile(output, (tdata_t) ">> \r", 4); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) " 0 R ", 5); ++ written += t2pWriteFile(output, (tdata_t) ">> \n", 4); + } +- written += TIFFWriteFile(output, (tdata_t) "/ProcSet [ ", 11); ++ written += t2pWriteFile(output, (tdata_t) "/ProcSet [ ", 11); + if(t2p->pdf_colorspace == T2P_CS_BILEVEL + || t2p->pdf_colorspace == T2P_CS_GRAY + ){ +- written += TIFFWriteFile(output, (tdata_t) "/ImageB ", 8); ++ written += t2pWriteFile(output, (tdata_t) "/ImageB ", 8); + } else { +- written += TIFFWriteFile(output, (tdata_t) "/ImageC ", 8); ++ written += t2pWriteFile(output, (tdata_t) "/ImageC ", 8); + if(t2p->pdf_colorspace & T2P_CS_PALETTE){ +- written += TIFFWriteFile(output, (tdata_t) "/ImageI ", 8); ++ written += t2pWriteFile(output, (tdata_t) "/ImageI ", 8); + } + } +- written += TIFFWriteFile(output, (tdata_t) "]\r>>\r>>\r", 8); ++ written += t2pWriteFile(output, (tdata_t) "]\n>>\n>>\n", 8); + + return(written); + } +@@ -4161,19 +4245,25 @@ + + t2p->pdf_xres = t2p->tiff_xres; + t2p->pdf_yres = t2p->tiff_yres; +- if(t2p->pdf_overrideres){ ++ if(t2p->pdf_overrideres) { + t2p->pdf_xres = t2p->pdf_defaultxres; + t2p->pdf_yres = t2p->pdf_defaultyres; + } +- if(t2p->pdf_xres==0.0){ ++ if(t2p->pdf_xres == 0.0) + t2p->pdf_xres = t2p->pdf_defaultxres; +- } +- if(t2p->pdf_yres==0.0){ ++ if(t2p->pdf_yres == 0.0) + t2p->pdf_yres = t2p->pdf_defaultyres; ++ if (t2p->tiff_resunit != RESUNIT_CENTIMETER /* RESUNIT_NONE and */ ++ && t2p->tiff_resunit != RESUNIT_INCH) { /* other cases */ ++ t2p->pdf_imagewidth = ((float)(t2p->tiff_width))/t2p->pdf_xres; ++ t2p->pdf_imagelength = ((float)(t2p->tiff_length))/t2p->pdf_yres; ++ } else { ++ t2p->pdf_imagewidth = ++ ((float)(t2p->tiff_width))*PS_UNIT_SIZE/t2p->pdf_xres; ++ t2p->pdf_imagelength = ++ ((float)(t2p->tiff_length))*PS_UNIT_SIZE/t2p->pdf_yres; + } +- t2p->pdf_imagewidth=((float)(t2p->tiff_width)) *72.0F / t2p->pdf_xres; +- t2p->pdf_imagelength=((float)(t2p->tiff_length)) *72.0F / t2p->pdf_yres; +- if(t2p->pdf_overridepagesize != 0){ ++ if(t2p->pdf_overridepagesize != 0) { + t2p->pdf_pagewidth = t2p->pdf_defaultpagewidth; + t2p->pdf_pagelength = t2p->pdf_defaultpagelength; + } else { +@@ -4476,7 +4566,7 @@ + for(i=0;itiff_tiles[t2p->pdf_page].tiles_tilecount; i++){ + box=t2p->tiff_tiles[t2p->pdf_page].tiles_tiles[i].tile_box; + buflen=sprintf(buffer, +- "q %s %.4f %.4f %.4f %.4f %.4f %.4f cm /Im%d_%ld Do Q\r", ++ "q %s %.4f %.4f %.4f %.4f %.4f %.4f cm /Im%d_%ld Do Q\n", + t2p->tiff_transferfunctioncount?"/GS1 gs ":"", + box.mat[0], + box.mat[1], +@@ -4491,7 +4581,7 @@ + } else { + box=t2p->pdf_imagebox; + buflen=sprintf(buffer, +- "q %s %.4f %.4f %.4f %.4f %.4f %.4f cm /Im%d Do Q\r", ++ "q %s %.4f %.4f %.4f %.4f %.4f %.4f cm /Im%d Do Q\n", + t2p->tiff_transferfunctioncount?"/GS1 gs ":"", + box.mat[0], + box.mat[1], +@@ -4519,17 +4609,17 @@ + int buflen=0; + + written += t2p_write_pdf_stream_dict(0, t2p->pdf_xrefcount+1, output); +- written += TIFFWriteFile(output, +- (tdata_t) "/Type /XObject \r/Subtype /Image \r/Name /Im", ++ written += t2pWriteFile(output, ++ (tdata_t) "/Type /XObject \n/Subtype /Image \n/Name /Im", + 42); + buflen=sprintf(buffer, "%u", t2p->pdf_page+1); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); + if(tile != 0){ +- written += TIFFWriteFile(output, (tdata_t) "_", 1); ++ written += t2pWriteFile(output, (tdata_t) "_", 1); + buflen=sprintf(buffer, "%lu", (unsigned long)tile); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); + } +- written += TIFFWriteFile(output, (tdata_t) "\r/Width ", 8); ++ written += t2pWriteFile(output, (tdata_t) "\n/Width ", 8); + _TIFFmemset((tdata_t)buffer, 0x00, 16); + if(tile==0){ + buflen=sprintf(buffer, "%lu", (unsigned long)t2p->tiff_width); +@@ -4546,8 +4636,8 @@ + (unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_tilewidth); + } + } +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); +- written += TIFFWriteFile(output, (tdata_t) "\r/Height ", 9); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) "\n/Height ", 9); + _TIFFmemset((tdata_t)buffer, 0x00, 16); + if(tile==0){ + buflen=sprintf(buffer, "%lu", (unsigned long)t2p->tiff_length); +@@ -4564,16 +4654,16 @@ + (unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_tilelength); + } + } +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); +- written += TIFFWriteFile(output, (tdata_t) "\r/BitsPerComponent ", 19); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) "\n/BitsPerComponent ", 19); + _TIFFmemset((tdata_t)buffer, 0x00, 16); + buflen=sprintf(buffer, "%u", t2p->tiff_bitspersample); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); +- written += TIFFWriteFile(output, (tdata_t) "\r/ColorSpace ", 13); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) "\n/ColorSpace ", 13); + written += t2p_write_pdf_xobject_cs(t2p, output); + if (t2p->pdf_image_interpolate) +- written += TIFFWriteFile(output, +- (tdata_t) "\r/Interpolate true", 18); ++ written += t2pWriteFile(output, ++ (tdata_t) "\n/Interpolate true", 18); + if( (t2p->pdf_switchdecode != 0) + #ifdef CCITT_SUPPORT + && ! (t2p->pdf_colorspace == T2P_CS_BILEVEL +@@ -4607,66 +4697,66 @@ + return(written); + } + if( (t2p->pdf_colorspace & T2P_CS_PALETTE) != 0){ +- written += TIFFWriteFile(output, (tdata_t) "[ /Indexed ", 11); ++ written += t2pWriteFile(output, (tdata_t) "[ /Indexed ", 11); + t2p->pdf_colorspace ^= T2P_CS_PALETTE; + written += t2p_write_pdf_xobject_cs(t2p, output); + t2p->pdf_colorspace |= T2P_CS_PALETTE; + buflen=sprintf(buffer, "%u", (0x0001 << t2p->tiff_bitspersample)-1 ); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); +- written += TIFFWriteFile(output, (tdata_t) " ", 1); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) " ", 1); + _TIFFmemset(buffer, 0x00, 16); + buflen=sprintf(buffer, "%lu", (unsigned long)t2p->pdf_palettecs ); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); +- written += TIFFWriteFile(output, (tdata_t) " 0 R ]\r", 7); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) " 0 R ]\n", 7); + return(written); + } + if(t2p->pdf_colorspace & T2P_CS_BILEVEL){ +- written += TIFFWriteFile(output, (tdata_t) "/DeviceGray \r", 13); ++ written += t2pWriteFile(output, (tdata_t) "/DeviceGray \n", 13); + } + if(t2p->pdf_colorspace & T2P_CS_GRAY){ + if(t2p->pdf_colorspace & T2P_CS_CALGRAY){ + written += t2p_write_pdf_xobject_calcs(t2p, output); + } else { +- written += TIFFWriteFile(output, (tdata_t) "/DeviceGray \r", 13); ++ written += t2pWriteFile(output, (tdata_t) "/DeviceGray \n", 13); + } + } + if(t2p->pdf_colorspace & T2P_CS_RGB){ + if(t2p->pdf_colorspace & T2P_CS_CALRGB){ + written += t2p_write_pdf_xobject_calcs(t2p, output); + } else { +- written += TIFFWriteFile(output, (tdata_t) "/DeviceRGB \r", 12); ++ written += t2pWriteFile(output, (tdata_t) "/DeviceRGB \n", 12); + } + } + if(t2p->pdf_colorspace & T2P_CS_CMYK){ +- written += TIFFWriteFile(output, (tdata_t) "/DeviceCMYK \r", 13); ++ written += t2pWriteFile(output, (tdata_t) "/DeviceCMYK \n", 13); + } + if(t2p->pdf_colorspace & T2P_CS_LAB){ +- written += TIFFWriteFile(output, (tdata_t) "[/Lab << \r", 10); +- written += TIFFWriteFile(output, (tdata_t) "/WhitePoint ", 12); ++ written += t2pWriteFile(output, (tdata_t) "[/Lab << \n", 10); ++ written += t2pWriteFile(output, (tdata_t) "/WhitePoint ", 12); + X_W = t2p->tiff_whitechromaticities[0]; + Y_W = t2p->tiff_whitechromaticities[1]; + Z_W = 1.0F - (X_W + Y_W); + X_W /= Y_W; + Z_W /= Y_W; + Y_W = 1.0F; +- buflen=sprintf(buffer, "[%.4f %.4f %.4f] \r", X_W, Y_W, Z_W); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); ++ buflen=sprintf(buffer, "[%.4f %.4f %.4f] \n", X_W, Y_W, Z_W); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); + X_W = 0.3457F; /* 0.3127F; */ /* D50, commented D65 */ + Y_W = 0.3585F; /* 0.3290F; */ + Z_W = 1.0F - (X_W + Y_W); + X_W /= Y_W; + Z_W /= Y_W; + Y_W = 1.0F; +- buflen=sprintf(buffer, "[%.4f %.4f %.4f] \r", X_W, Y_W, Z_W); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); +- written += TIFFWriteFile(output, (tdata_t) "/Range ", 7); +- buflen=sprintf(buffer, "[%d %d %d %d] \r", ++ buflen=sprintf(buffer, "[%.4f %.4f %.4f] \n", X_W, Y_W, Z_W); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) "/Range ", 7); ++ buflen=sprintf(buffer, "[%d %d %d %d] \n", + t2p->pdf_labrange[0], + t2p->pdf_labrange[1], + t2p->pdf_labrange[2], + t2p->pdf_labrange[3]); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); +- written += TIFFWriteFile(output, (tdata_t) ">>] \r", 5); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) ">>] \n", 5); + + } + +@@ -4679,30 +4769,30 @@ + char buffer[16]; + int buflen=0; + +- written += TIFFWriteFile(output, (tdata_t) "<< /Type /ExtGState \r/TR ", 25); ++ written += t2pWriteFile(output, (tdata_t) "<< /Type /ExtGState \n/TR ", 25); + if(t2p->tiff_transferfunctioncount == 1){ + buflen=sprintf(buffer, "%lu", + (unsigned long)(t2p->pdf_xrefcount + 1)); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); +- written += TIFFWriteFile(output, (tdata_t) " 0 R ", 5); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) " 0 R ", 5); + } else { +- written += TIFFWriteFile(output, (tdata_t) "[ ", 2); ++ written += t2pWriteFile(output, (tdata_t) "[ ", 2); + buflen=sprintf(buffer, "%lu", + (unsigned long)(t2p->pdf_xrefcount + 1)); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); +- written += TIFFWriteFile(output, (tdata_t) " 0 R ", 5); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) " 0 R ", 5); + buflen=sprintf(buffer, "%lu", + (unsigned long)(t2p->pdf_xrefcount + 2)); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); +- written += TIFFWriteFile(output, (tdata_t) " 0 R ", 5); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) " 0 R ", 5); + buflen=sprintf(buffer, "%lu", + (unsigned long)(t2p->pdf_xrefcount + 3)); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); +- written += TIFFWriteFile(output, (tdata_t) " 0 R ", 5); +- written += TIFFWriteFile(output, (tdata_t) "/Identity ] ", 12); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) " 0 R ", 5); ++ written += t2pWriteFile(output, (tdata_t) "/Identity ] ", 12); + } + +- written += TIFFWriteFile(output, (tdata_t) " >> \r", 5); ++ written += t2pWriteFile(output, (tdata_t) " >> \n", 5); + + return(written); + } +@@ -4714,13 +4804,13 @@ + int buflen=0; + (void)i; // XXX + +- written += TIFFWriteFile(output, (tdata_t) "/FunctionType 0 \r", 17); +- written += TIFFWriteFile(output, (tdata_t) "/Domain [0.0 1.0] \r", 19); +- written += TIFFWriteFile(output, (tdata_t) "/Range [0.0 1.0] \r", 18); +- buflen=sprintf(buffer, "/Size [%u] \r", (1<tiff_bitspersample)); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); +- written += TIFFWriteFile(output, (tdata_t) "/BitsPerSample 16 \r", 19); +- written += t2p_write_pdf_stream_dict(1<<(t2p->tiff_bitspersample+1), 0, output); ++ written += t2pWriteFile(output, (tdata_t) "/FunctionType 0 \n", 17); ++ written += t2pWriteFile(output, (tdata_t) "/Domain [0.0 1.0] \n", 19); ++ written += t2pWriteFile(output, (tdata_t) "/Range [0.0 1.0] \n", 18); ++ buflen=sprintf(buffer, "/Size [%u] \n", (1<tiff_bitspersample)); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) "/BitsPerSample 16 \n", 19); ++ written += t2p_write_pdf_stream_dict(((tsize_t)1)<<(t2p->tiff_bitspersample+1), 0, output); + + return(written); + } +@@ -4731,7 +4821,7 @@ + + written += t2p_write_pdf_stream( + t2p->tiff_transferfunction[i], +- (1<<(t2p->tiff_bitspersample+1)), ++ (((tsize_t)1)<<(t2p->tiff_bitspersample+1)), + output); + + return(written); +@@ -4772,9 +4862,9 @@ + float G=1.0; + float B=1.0; + +- written += TIFFWriteFile(output, (tdata_t) "[", 1); ++ written += t2pWriteFile(output, (tdata_t) "[", 1); + if(t2p->pdf_colorspace & T2P_CS_CALGRAY){ +- written += TIFFWriteFile(output, (tdata_t) "/CalGray ", 9); ++ written += t2pWriteFile(output, (tdata_t) "/CalGray ", 9); + X_W = t2p->tiff_whitechromaticities[0]; + Y_W = t2p->tiff_whitechromaticities[1]; + Z_W = 1.0F - (X_W + Y_W); +@@ -4783,7 +4873,7 @@ + Y_W = 1.0F; + } + if(t2p->pdf_colorspace & T2P_CS_CALRGB){ +- written += TIFFWriteFile(output, (tdata_t) "/CalRGB ", 8); ++ written += t2pWriteFile(output, (tdata_t) "/CalRGB ", 8); + x_w = t2p->tiff_whitechromaticities[0]; + y_w = t2p->tiff_whitechromaticities[1]; + x_r = t2p->tiff_primarychromaticities[0]; +@@ -4809,26 +4899,26 @@ + Z_W /= Y_W; + Y_W = 1.0; + } +- written += TIFFWriteFile(output, (tdata_t) "<< \r", 4); ++ written += t2pWriteFile(output, (tdata_t) "<< \n", 4); + if(t2p->pdf_colorspace & T2P_CS_CALGRAY){ +- written += TIFFWriteFile(output, (tdata_t) "/WhitePoint ", 12); +- buflen=sprintf(buffer, "[%.4f %.4f %.4f] \r", X_W, Y_W, Z_W); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); +- written += TIFFWriteFile(output, (tdata_t) "/Gamma 2.2 \r", 12); ++ written += t2pWriteFile(output, (tdata_t) "/WhitePoint ", 12); ++ buflen=sprintf(buffer, "[%.4f %.4f %.4f] \n", X_W, Y_W, Z_W); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) "/Gamma 2.2 \n", 12); + } + if(t2p->pdf_colorspace & T2P_CS_CALRGB){ +- written += TIFFWriteFile(output, (tdata_t) "/WhitePoint ", 12); +- buflen=sprintf(buffer, "[%.4f %.4f %.4f] \r", X_W, Y_W, Z_W); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); +- written += TIFFWriteFile(output, (tdata_t) "/Matrix ", 8); +- buflen=sprintf(buffer, "[%.4f %.4f %.4f %.4f %.4f %.4f %.4f %.4f %.4f] \r", ++ written += t2pWriteFile(output, (tdata_t) "/WhitePoint ", 12); ++ buflen=sprintf(buffer, "[%.4f %.4f %.4f] \n", X_W, Y_W, Z_W); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) "/Matrix ", 8); ++ buflen=sprintf(buffer, "[%.4f %.4f %.4f %.4f %.4f %.4f %.4f %.4f %.4f] \n", + X_R, Y_R, Z_R, + X_G, Y_G, Z_G, + X_B, Y_B, Z_B); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); +- written += TIFFWriteFile(output, (tdata_t) "/Gamma [2.2 2.2 2.2] \r", 22); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) "/Gamma [2.2 2.2 2.2] \n", 22); + } +- written += TIFFWriteFile(output, (tdata_t) ">>] \r", 5); ++ written += t2pWriteFile(output, (tdata_t) ">>] \n", 5); + + return(written); + } +@@ -4843,10 +4933,10 @@ + char buffer[16]; + int buflen=0; + +- written += TIFFWriteFile(output, (tdata_t) "[/ICCBased ", 11); ++ written += t2pWriteFile(output, (tdata_t) "[/ICCBased ", 11); + buflen=sprintf(buffer, "%lu", (unsigned long)t2p->pdf_icccs); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); +- written += TIFFWriteFile(output, (tdata_t) " 0 R] \r", 7); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) " 0 R] \n", 7); + + return(written); + } +@@ -4857,10 +4947,10 @@ + char buffer[16]; + int buflen=0; + +- written += TIFFWriteFile(output, (tdata_t) "/N ", 3); +- buflen=sprintf(buffer, "%u \r", t2p->tiff_samplesperpixel); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); +- written += TIFFWriteFile(output, (tdata_t) "/Alternate ", 11); ++ written += t2pWriteFile(output, (tdata_t) "/N ", 3); ++ buflen=sprintf(buffer, "%u \n", t2p->tiff_samplesperpixel); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) "/Alternate ", 11); + t2p->pdf_colorspace ^= T2P_CS_ICCBASED; + written += t2p_write_pdf_xobject_cs(t2p, output); + t2p->pdf_colorspace |= T2P_CS_ICCBASED; +@@ -4906,11 +4996,11 @@ + tsize_t written=0; + int i=0; + +- written += TIFFWriteFile(output, (tdata_t) "/Decode [ ", 10); ++ written += t2pWriteFile(output, (tdata_t) "/Decode [ ", 10); + for (i=0;itiff_samplesperpixel;i++){ +- written += TIFFWriteFile(output, (tdata_t) "1 0 ", 4); ++ written += t2pWriteFile(output, (tdata_t) "1 0 ", 4); + } +- written += TIFFWriteFile(output, (tdata_t) "]\r", 2); ++ written += t2pWriteFile(output, (tdata_t) "]\n", 2); + + return(written); + } +@@ -4929,93 +5019,93 @@ + if(t2p->pdf_compression==T2P_COMPRESS_NONE){ + return(written); + } +- written += TIFFWriteFile(output, (tdata_t) "/Filter ", 8); ++ written += t2pWriteFile(output, (tdata_t) "/Filter ", 8); + switch(t2p->pdf_compression){ + #ifdef CCITT_SUPPORT + case T2P_COMPRESS_G4: +- written += TIFFWriteFile(output, (tdata_t) "/CCITTFaxDecode ", 16); +- written += TIFFWriteFile(output, (tdata_t) "/DecodeParms ", 13); +- written += TIFFWriteFile(output, (tdata_t) "<< /K -1 ", 9); ++ written += t2pWriteFile(output, (tdata_t) "/CCITTFaxDecode ", 16); ++ written += t2pWriteFile(output, (tdata_t) "/DecodeParms ", 13); ++ written += t2pWriteFile(output, (tdata_t) "<< /K -1 ", 9); + if(tile==0){ +- written += TIFFWriteFile(output, (tdata_t) "/Columns ", 9); ++ written += t2pWriteFile(output, (tdata_t) "/Columns ", 9); + buflen=sprintf(buffer, "%lu", + (unsigned long)t2p->tiff_width); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); +- written += TIFFWriteFile(output, (tdata_t) " /Rows ", 7); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) " /Rows ", 7); + buflen=sprintf(buffer, "%lu", + (unsigned long)t2p->tiff_length); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); + } else { + if(t2p_tile_is_right_edge(t2p->tiff_tiles[t2p->pdf_page], tile-1)==0){ +- written += TIFFWriteFile(output, (tdata_t) "/Columns ", 9); ++ written += t2pWriteFile(output, (tdata_t) "/Columns ", 9); + buflen=sprintf( + buffer, + "%lu", + (unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_tilewidth); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); + } else { +- written += TIFFWriteFile(output, (tdata_t) "/Columns ", 9); ++ written += t2pWriteFile(output, (tdata_t) "/Columns ", 9); + buflen=sprintf( + buffer, + "%lu", + (unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_edgetilewidth); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); + } + if(t2p_tile_is_bottom_edge(t2p->tiff_tiles[t2p->pdf_page], tile-1)==0){ +- written += TIFFWriteFile(output, (tdata_t) " /Rows ", 7); ++ written += t2pWriteFile(output, (tdata_t) " /Rows ", 7); + buflen=sprintf( + buffer, + "%lu", + (unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_tilelength); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); + } else { +- written += TIFFWriteFile(output, (tdata_t) " /Rows ", 7); ++ written += t2pWriteFile(output, (tdata_t) " /Rows ", 7); + buflen=sprintf( + buffer, + "%lu", + (unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_edgetilelength); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); + } + } + if(t2p->pdf_switchdecode == 0){ +- written += TIFFWriteFile(output, (tdata_t) " /BlackIs1 true ", 16); ++ written += t2pWriteFile(output, (tdata_t) " /BlackIs1 true ", 16); + } +- written += TIFFWriteFile(output, (tdata_t) ">>\r", 3); ++ written += t2pWriteFile(output, (tdata_t) ">>\n", 3); + break; + #endif + #ifdef JPEG_SUPPORT + case T2P_COMPRESS_JPEG: +- written += TIFFWriteFile(output, (tdata_t) "/DCTDecode ", 11); ++ written += t2pWriteFile(output, (tdata_t) "/DCTDecode ", 11); + + if(t2p->tiff_photometric != PHOTOMETRIC_YCBCR) { +- written += TIFFWriteFile(output, (tdata_t) "/DecodeParms ", 13); +- written += TIFFWriteFile(output, (tdata_t) "<< /ColorTransform 0 >>\r", 24); ++ written += t2pWriteFile(output, (tdata_t) "/DecodeParms ", 13); ++ written += t2pWriteFile(output, (tdata_t) "<< /ColorTransform 0 >>\n", 24); + } + break; + #endif + #ifdef ZIP_SUPPORT + case T2P_COMPRESS_ZIP: +- written += TIFFWriteFile(output, (tdata_t) "/FlateDecode ", 13); ++ written += t2pWriteFile(output, (tdata_t) "/FlateDecode ", 13); + if(t2p->pdf_compressionquality%100){ +- written += TIFFWriteFile(output, (tdata_t) "/DecodeParms ", 13); +- written += TIFFWriteFile(output, (tdata_t) "<< /Predictor ", 14); ++ written += t2pWriteFile(output, (tdata_t) "/DecodeParms ", 13); ++ written += t2pWriteFile(output, (tdata_t) "<< /Predictor ", 14); + _TIFFmemset(buffer, 0x00, 16); + buflen=sprintf(buffer, "%u", t2p->pdf_compressionquality%100); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); +- written += TIFFWriteFile(output, (tdata_t) " /Columns ", 10); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) " /Columns ", 10); + _TIFFmemset(buffer, 0x00, 16); + buflen = sprintf(buffer, "%lu", + (unsigned long)t2p->tiff_width); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); +- written += TIFFWriteFile(output, (tdata_t) " /Colors ", 9); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) " /Colors ", 9); + _TIFFmemset(buffer, 0x00, 16); + buflen=sprintf(buffer, "%u", t2p->tiff_samplesperpixel); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); +- written += TIFFWriteFile(output, (tdata_t) " /BitsPerComponent ", 19); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) " /BitsPerComponent ", 19); + _TIFFmemset(buffer, 0x00, 16); + buflen=sprintf(buffer, "%u", t2p->tiff_bitspersample); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); +- written += TIFFWriteFile(output, (tdata_t) ">>\r", 3); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) ">>\n", 3); + } + break; + #endif +@@ -5037,21 +5127,21 @@ + int buflen=0; + uint32 i=0; + +- written += TIFFWriteFile(output, (tdata_t) "xref\r0 ", 7); ++ written += t2pWriteFile(output, (tdata_t) "xref\n0 ", 7); + buflen=sprintf(buffer, "%lu", (unsigned long)(t2p->pdf_xrefcount + 1)); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); +- written += TIFFWriteFile(output, (tdata_t) " \r0000000000 65535 f\r\n", 22); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) " \n0000000000 65535 f \n", 22); + for (i=0;ipdf_xrefcount;i++){ +- sprintf(buffer, "%.10lu 00000 n\r\n", ++ sprintf(buffer, "%.10lu 00000 n \n", + (unsigned long)t2p->pdf_xrefoffsets[i]); +- written += TIFFWriteFile(output, (tdata_t) buffer, 20); ++ written += t2pWriteFile(output, (tdata_t) buffer, 20); + } + + return(written); + } + + /* +- * This function writes a PDF trailer to output. ++ * This function writes a PDF trailer to output. + */ + + tsize_t t2p_write_pdf_trailer(T2P* t2p, TIFF* output) +@@ -5067,7 +5157,7 @@ + ((int*)fileidbuf)[1] = rand(); + ((int*)fileidbuf)[2] = rand(); + ((int*)fileidbuf)[3] = rand(); +- t2p->pdf_fileid = (char*)_TIFFmalloc(33); ++ t2p->pdf_fileid = (unsigned char*)_TIFFmalloc(33); + if(t2p->pdf_fileid == NULL) { + TIFFError( + TIFF2PDF_MODULE, +@@ -5077,29 +5167,31 @@ + return(0); + } + _TIFFmemset(t2p->pdf_fileid, 0x00, 33); +- for (i=0; i<16; i++) +- sprintf(&(t2p->pdf_fileid[2*i]), "%.2hhX", fileidbuf[i]); +- written += TIFFWriteFile(output, (tdata_t) "trailer\r<<\r/Size ", 17); ++ for (i = 0; i < 16; i++) { ++ sprintf((char *)t2p->pdf_fileid + 2 * i, ++ "%.2hhX", fileidbuf[i]); ++ } ++ written += t2pWriteFile(output, (tdata_t) "trailer\n<<\n/Size ", 17); + buflen = sprintf(buffer, "%lu", (unsigned long)(t2p->pdf_xrefcount+1)); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); + _TIFFmemset(buffer, 0x00, 32); +- written += TIFFWriteFile(output, (tdata_t) "\r/Root ", 7); ++ written += t2pWriteFile(output, (tdata_t) "\n/Root ", 7); + buflen=sprintf(buffer, "%lu", (unsigned long)t2p->pdf_catalog); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); + _TIFFmemset(buffer, 0x00, 32); +- written += TIFFWriteFile(output, (tdata_t) " 0 R \r/Info ", 12); ++ written += t2pWriteFile(output, (tdata_t) " 0 R \n/Info ", 12); + buflen=sprintf(buffer, "%lu", (unsigned long)t2p->pdf_info); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); + _TIFFmemset(buffer, 0x00, 32); +- written += TIFFWriteFile(output, (tdata_t) " 0 R \r/ID[<", 11); +- written += TIFFWriteFile(output, (tdata_t) t2p->pdf_fileid, 32); +- written += TIFFWriteFile(output, (tdata_t) "><", 2); +- written += TIFFWriteFile(output, (tdata_t) t2p->pdf_fileid, 32); +- written += TIFFWriteFile(output, (tdata_t) ">]\r>>\rstartxref\r", 16); ++ written += t2pWriteFile(output, (tdata_t) " 0 R \n/ID[<", 11); ++ written += t2pWriteFile(output, (tdata_t) t2p->pdf_fileid, 32); ++ written += t2pWriteFile(output, (tdata_t) "><", 2); ++ written += t2pWriteFile(output, (tdata_t) t2p->pdf_fileid, 32); ++ written += t2pWriteFile(output, (tdata_t) ">]\n>>\nstartxref\n", 16); + buflen=sprintf(buffer, "%lu", (unsigned long)t2p->pdf_startxref); +- written += TIFFWriteFile(output, (tdata_t) buffer, buflen); ++ written += t2pWriteFile(output, (tdata_t) buffer, buflen); + _TIFFmemset(buffer, 0x00, 32); +- written += TIFFWriteFile(output, (tdata_t) "\r%%EOF\r", 7); ++ written += t2pWriteFile(output, (tdata_t) "\n%%EOF\n", 7); + + return(written); + } +@@ -5113,7 +5205,7 @@ + library, and TIFFWriteEncodedStrip can be used to write compressed data to + the output. The output is not actually a TIFF file, it is a PDF file. + +- This function uses only TIFFWriteFile and TIFFWriteEncodedStrip to write to ++ This function uses only t2pWriteFile and TIFFWriteEncodedStrip to write to + the output TIFF file. When libtiff would otherwise be writing data to the + output file, the write procedure of the TIFF structure is replaced with an + empty implementation. +@@ -5134,7 +5226,7 @@ + assert(output != NULL); + + if(output->tif_seekproc != NULL){ +- TIFFSeekFile(output, (toff_t) 0, SEEK_SET); ++ t2pSeekFile(output, (toff_t) 0, SEEK_SET); + } + + This function returns the file size of the output PDF file. On error it +@@ -5298,11 +5390,10 @@ + written += t2p_write_pdf_obj_end(output); + } + } +- t2p->pdf_startxref=written; ++ t2p->pdf_startxref = written; + written += t2p_write_pdf_xreftable(t2p, output); + written += t2p_write_pdf_trailer(t2p, output); +- t2p->tiff_writeproc=output->tif_writeproc; +- output->tif_writeproc=t2p_empty_writeproc; ++ t2p_disable(output); + + return(written); + } --- tiff-3.8.2.orig/debian/patches/soname.patch +++ tiff-3.8.2/debian/patches/soname.patch @@ -0,0 +1,40 @@ +Index: tiff-3.8.2/libtiff/Makefile.am +=================================================================== +--- tiff-3.8.2.orig/libtiff/Makefile.am 2008-08-17 13:03:49.201994524 -0400 ++++ tiff-3.8.2/libtiff/Makefile.am 2008-08-17 13:03:51.701994599 -0400 +@@ -108,7 +108,7 @@ + libtiff_la_SOURCES = $(SRCS) + libtiff_la_LDFLAGS = \ + -no-undefined \ +- -version-number $(LIBTIFF_VERSION_INFO) ++ -version-number 4:2:1 + if HAVE_RPATH + libtiff_la_LDFLAGS += $(LIBDIR) + endif +@@ -117,7 +117,7 @@ + libtiffxx_la_SOURCES = $(SRCSXX) + libtiffxx_la_LDFLAGS = \ + -no-undefined \ +- -version-number $(LIBTIFF_VERSION_INFO) ++ -version-number 0:0:6 + if HAVE_RPATH + libtiffxx_la_LDFLAGS += $(LIBDIR) + endif +Index: tiff-3.8.2/libtiff/Makefile.in +=================================================================== +--- tiff-3.8.2.orig/libtiff/Makefile.in 2008-08-17 13:03:49.209994449 -0400 ++++ tiff-3.8.2/libtiff/Makefile.in 2008-08-17 13:03:51.701994599 -0400 +@@ -356,11 +356,11 @@ + lib_LTLIBRARIES = libtiff.la $(am__append_2) + libtiff_la_SOURCES = $(SRCS) + libtiff_la_LDFLAGS = -no-undefined -version-number \ +- $(LIBTIFF_VERSION_INFO) $(am__append_3) ++ 4:2:1 $(am__append_3) + libtiff_la_LIBADD = $(LIBPORT) + libtiffxx_la_SOURCES = $(SRCSXX) + libtiffxx_la_LDFLAGS = -no-undefined -version-number \ +- $(LIBTIFF_VERSION_INFO) $(am__append_4) ++ 0:0:6 $(am__append_4) + libtiffxx_la_LIBADD = $(LIBTIFF) $(LIBPORT) + libtiffxx_la_DEPENDENCIES = libtiff.la + mkg3states_SOURCES = mkg3states.c tif_fax3.h --- tiff-3.8.2.orig/debian/patches/tif_print.patch +++ tiff-3.8.2/debian/patches/tif_print.patch @@ -0,0 +1,13 @@ +Index: tiff-3.8.2/libtiff/tif_print.c +=================================================================== +--- tiff-3.8.2.orig/libtiff/tif_print.c 2008-08-17 13:03:49.113994690 -0400 ++++ tiff-3.8.2/libtiff/tif_print.c 2008-08-17 13:03:52.201994368 -0400 +@@ -491,7 +491,7 @@ + } else + fprintf(fd, "(present)\n"); + } +- if (TIFFFieldSet(tif, FIELD_SUBIFD)) { ++ if (TIFFFieldSet(tif, FIELD_SUBIFD) && (td->td_subifd)) { + fprintf(fd, " SubIFD Offsets:"); + for (i = 0; i < td->td_nsubifd; i++) + fprintf(fd, " %5lu", (long) td->td_subifd[i]); --- tiff-3.8.2.orig/debian/patches/CVE-2010-2595.patch +++ tiff-3.8.2/debian/patches/CVE-2010-2595.patch @@ -0,0 +1,31 @@ +Description: fix denial of service via invalid ReferenceBlackWhite values +Origin: upstream, libtiff/tif_color.c r1.12.2.2 +Bug: http://bugzilla.maptools.org/show_bug.cgi?id=2208 + +Index: tiff-3.8.2/libtiff/tif_color.c +=================================================================== +--- tiff-3.8.2.orig/libtiff/tif_color.c 2011-03-03 14:18:43.000000000 -0500 ++++ tiff-3.8.2/libtiff/tif_color.c 2011-03-03 14:18:58.000000000 -0500 +@@ -183,13 +183,18 @@ + TIFFYCbCrtoRGB(TIFFYCbCrToRGB *ycbcr, uint32 Y, int32 Cb, int32 Cr, + uint32 *r, uint32 *g, uint32 *b) + { ++ int32 i; ++ + /* XXX: Only 8-bit YCbCr input supported for now */ + Y = HICLAMP(Y, 255), Cb = CLAMP(Cb, 0, 255), Cr = CLAMP(Cr, 0, 255); + +- *r = ycbcr->clamptab[ycbcr->Y_tab[Y] + ycbcr->Cr_r_tab[Cr]]; +- *g = ycbcr->clamptab[ycbcr->Y_tab[Y] +- + (int)((ycbcr->Cb_g_tab[Cb] + ycbcr->Cr_g_tab[Cr]) >> SHIFT)]; +- *b = ycbcr->clamptab[ycbcr->Y_tab[Y] + ycbcr->Cb_b_tab[Cb]]; ++ i = ycbcr->Y_tab[Y] + ycbcr->Cr_r_tab[Cr]; ++ *r = CLAMP(i, 0, 255); ++ i = ycbcr->Y_tab[Y] ++ + (int)((ycbcr->Cb_g_tab[Cb] + ycbcr->Cr_g_tab[Cr]) >> SHIFT); ++ *g = CLAMP(i, 0, 255); ++ i = ycbcr->Y_tab[Y] + ycbcr->Cb_b_tab[Cb]; ++ *b = CLAMP(i, 0, 255); + } + + /*