xref: /PHP-5.6/ext/exif/exif.c (revision 3462efa3)
1 /*
2    +----------------------------------------------------------------------+
3    | PHP Version 5                                                        |
4    +----------------------------------------------------------------------+
5    | Copyright (c) 1997-2016 The PHP Group                                |
6    +----------------------------------------------------------------------+
7    | This source file is subject to version 3.01 of the PHP license,      |
8    | that is bundled with this package in the file LICENSE, and is        |
9    | available through the world-wide-web at the following url:           |
10    | http://www.php.net/license/3_01.txt                                  |
11    | If you did not receive a copy of the PHP license and are unable to   |
12    | obtain it through the world-wide-web, please send a note to          |
13    | license@php.net so we can mail you a copy immediately.               |
14    +----------------------------------------------------------------------+
15    | Authors: Rasmus Lerdorf <rasmus@php.net>                             |
16    |          Marcus Boerger <helly@php.net>                              |
17    +----------------------------------------------------------------------+
18  */
19 
20 /* $Id: cad29b729548e4206f0697710cc9e177f26fdff3 $ */
21 
22 /*  ToDos
23  *
24  * 	See if example images from http://www.exif.org have illegal
25  * 		thumbnail sizes or if code is corrupt.
26  * 	Create/Update exif headers.
27  * 	Create/Remove/Update image thumbnails.
28  */
29 
30 /*  Security
31  *
32  *  At current time i do not see any security problems but a potential
33  *  attacker could generate an image with recursive ifd pointers...(Marcus)
34  */
35 
36 #ifdef HAVE_CONFIG_H
37 #include "config.h"
38 #endif
39 
40 #include "php.h"
41 #include "ext/standard/file.h"
42 
43 #if HAVE_EXIF
44 
45 /* When EXIF_DEBUG is defined the module generates a lot of debug messages
46  * that help understanding what is going on. This can and should be used
47  * while extending the module as it shows if you are at the right position.
48  * You are always considered to have a copy of TIFF6.0 and EXIF2.10 standard.
49  */
50 #undef EXIF_DEBUG
51 
52 #ifdef EXIF_DEBUG
53 #define EXIFERR_DC , const char *_file, size_t _line TSRMLS_DC
54 #define EXIFERR_CC , __FILE__, __LINE__ TSRMLS_CC
55 #else
56 #define EXIFERR_DC TSRMLS_DC
57 #define EXIFERR_CC TSRMLS_CC
58 #endif
59 
60 #undef EXIF_JPEG2000
61 
62 #include "php_exif.h"
63 #include <math.h>
64 #include "php_ini.h"
65 #include "ext/standard/php_string.h"
66 #include "ext/standard/php_image.h"
67 #include "ext/standard/info.h"
68 
69 /* needed for ssize_t definition */
70 #include <sys/types.h>
71 
72 typedef unsigned char uchar;
73 
74 #ifndef safe_emalloc
75 # define safe_emalloc(a,b,c) emalloc((a)*(b)+(c))
76 #endif
77 #ifndef safe_erealloc
78 # define safe_erealloc(p,a,b,c) erealloc(p, (a)*(b)+(c))
79 #endif
80 
81 #ifndef TRUE
82 #	define TRUE 1
83 #	define FALSE 0
84 #endif
85 
86 #ifndef max
87 #	define max(a,b) ((a)>(b) ? (a) : (b))
88 #endif
89 
90 #define EFREE_IF(ptr)	if (ptr) efree(ptr)
91 
92 #define MAX_IFD_NESTING_LEVEL 100
93 
94 /* {{{ arginfo */
95 ZEND_BEGIN_ARG_INFO(arginfo_exif_tagname, 0)
96 	ZEND_ARG_INFO(0, index)
97 ZEND_END_ARG_INFO()
98 
99 ZEND_BEGIN_ARG_INFO_EX(arginfo_exif_read_data, 0, 0, 1)
100 	ZEND_ARG_INFO(0, filename)
101 	ZEND_ARG_INFO(0, sections_needed)
102 	ZEND_ARG_INFO(0, sub_arrays)
103 	ZEND_ARG_INFO(0, read_thumbnail)
104 ZEND_END_ARG_INFO()
105 
106 ZEND_BEGIN_ARG_INFO_EX(arginfo_exif_thumbnail, 0, 0, 1)
107 	ZEND_ARG_INFO(0, filename)
108 	ZEND_ARG_INFO(1, width)
109 	ZEND_ARG_INFO(1, height)
110 	ZEND_ARG_INFO(1, imagetype)
111 ZEND_END_ARG_INFO()
112 
113 ZEND_BEGIN_ARG_INFO(arginfo_exif_imagetype, 0)
114 	ZEND_ARG_INFO(0, imagefile)
115 ZEND_END_ARG_INFO()
116 
117 /* }}} */
118 
119 /* {{{ exif_functions[]
120  */
121 const zend_function_entry exif_functions[] = {
122 	PHP_FE(exif_read_data, arginfo_exif_read_data)
123 	PHP_FALIAS(read_exif_data, exif_read_data, arginfo_exif_read_data)
124 	PHP_FE(exif_tagname, arginfo_exif_tagname)
125 	PHP_FE(exif_thumbnail, arginfo_exif_thumbnail)
126 	PHP_FE(exif_imagetype, arginfo_exif_imagetype)
127 	PHP_FE_END
128 };
129 /* }}} */
130 
131 #define EXIF_VERSION "1.4 $Id: cad29b729548e4206f0697710cc9e177f26fdff3 $"
132 
133 /* {{{ PHP_MINFO_FUNCTION
134  */
PHP_MINFO_FUNCTION(exif)135 PHP_MINFO_FUNCTION(exif)
136 {
137 	php_info_print_table_start();
138 	php_info_print_table_row(2, "EXIF Support", "enabled");
139 	php_info_print_table_row(2, "EXIF Version", EXIF_VERSION);
140 	php_info_print_table_row(2, "Supported EXIF Version", "0220");
141 	php_info_print_table_row(2, "Supported filetypes", "JPEG,TIFF");
142 	php_info_print_table_end();
143 	DISPLAY_INI_ENTRIES();
144 }
145 /* }}} */
146 
147 ZEND_BEGIN_MODULE_GLOBALS(exif)
148 	char * encode_unicode;
149 	char * decode_unicode_be;
150 	char * decode_unicode_le;
151 	char * encode_jis;
152 	char * decode_jis_be;
153 	char * decode_jis_le;
154 ZEND_END_MODULE_GLOBALS(exif)
155 
ZEND_DECLARE_MODULE_GLOBALS(exif)156 ZEND_DECLARE_MODULE_GLOBALS(exif)
157 
158 #ifdef ZTS
159 #define EXIF_G(v) TSRMG(exif_globals_id, zend_exif_globals *, v)
160 #else
161 #define EXIF_G(v) (exif_globals.v)
162 #endif
163 
164 /* {{{ PHP_INI
165  */
166 
167 ZEND_INI_MH(OnUpdateEncode)
168 {
169 	if (new_value && new_value_length) {
170 		const zend_encoding **return_list;
171 		size_t return_size;
172 		if (FAILURE == zend_multibyte_parse_encoding_list(new_value, new_value_length,
173 	&return_list, &return_size, 0 TSRMLS_CC)) {
174 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Illegal encoding ignored: '%s'", new_value);
175 			return FAILURE;
176 		}
177 		efree(return_list);
178 	}
179 	return OnUpdateString(entry, new_value, new_value_length, mh_arg1, mh_arg2, mh_arg3, stage TSRMLS_CC);
180 }
181 
ZEND_INI_MH(OnUpdateDecode)182 ZEND_INI_MH(OnUpdateDecode)
183 {
184 	if (new_value) {
185 		const zend_encoding **return_list;
186 		size_t return_size;
187 		if (FAILURE == zend_multibyte_parse_encoding_list(new_value, new_value_length,
188 	&return_list, &return_size, 0 TSRMLS_CC)) {
189 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Illegal encoding ignored: '%s'", new_value);
190 			return FAILURE;
191 		}
192 		efree(return_list);
193 	}
194 	return OnUpdateString(entry, new_value, new_value_length, mh_arg1, mh_arg2, mh_arg3, stage TSRMLS_CC);
195 }
196 
197 PHP_INI_BEGIN()
198     STD_PHP_INI_ENTRY("exif.encode_unicode",          "ISO-8859-15", PHP_INI_ALL, OnUpdateEncode, encode_unicode,    zend_exif_globals, exif_globals)
199     STD_PHP_INI_ENTRY("exif.decode_unicode_motorola", "UCS-2BE",     PHP_INI_ALL, OnUpdateDecode, decode_unicode_be, zend_exif_globals, exif_globals)
200     STD_PHP_INI_ENTRY("exif.decode_unicode_intel",    "UCS-2LE",     PHP_INI_ALL, OnUpdateDecode, decode_unicode_le, zend_exif_globals, exif_globals)
201     STD_PHP_INI_ENTRY("exif.encode_jis",              "",            PHP_INI_ALL, OnUpdateEncode, encode_jis,        zend_exif_globals, exif_globals)
202     STD_PHP_INI_ENTRY("exif.decode_jis_motorola",     "JIS",         PHP_INI_ALL, OnUpdateDecode, decode_jis_be,     zend_exif_globals, exif_globals)
203     STD_PHP_INI_ENTRY("exif.decode_jis_intel",        "JIS",         PHP_INI_ALL, OnUpdateDecode, decode_jis_le,     zend_exif_globals, exif_globals)
PHP_INI_END()204 PHP_INI_END()
205 /* }}} */
206 
207 /* {{{ PHP_GINIT_FUNCTION
208  */
209 static PHP_GINIT_FUNCTION(exif)
210 {
211 	exif_globals->encode_unicode    = NULL;
212 	exif_globals->decode_unicode_be = NULL;
213 	exif_globals->decode_unicode_le = NULL;
214 	exif_globals->encode_jis        = NULL;
215 	exif_globals->decode_jis_be     = NULL;
216 	exif_globals->decode_jis_le     = NULL;
217 }
218 /* }}} */
219 
220 /* {{{ PHP_MINIT_FUNCTION(exif)
221    Get the size of an image as 4-element array */
PHP_MINIT_FUNCTION(exif)222 PHP_MINIT_FUNCTION(exif)
223 {
224 	REGISTER_INI_ENTRIES();
225 	if (zend_hash_exists(&module_registry, "mbstring", sizeof("mbstring"))) {
226 		REGISTER_LONG_CONSTANT("EXIF_USE_MBSTRING", 1, CONST_CS | CONST_PERSISTENT);
227 	} else {
228 		REGISTER_LONG_CONSTANT("EXIF_USE_MBSTRING", 0, CONST_CS | CONST_PERSISTENT);
229 	}
230 	return SUCCESS;
231 }
232 /* }}} */
233 
234 /* {{{ PHP_MSHUTDOWN_FUNCTION
235  */
PHP_MSHUTDOWN_FUNCTION(exif)236 PHP_MSHUTDOWN_FUNCTION(exif)
237 {
238 	UNREGISTER_INI_ENTRIES();
239 	return SUCCESS;
240 }
241 /* }}} */
242 
243 /* {{{ exif dependencies */
244 static const zend_module_dep exif_module_deps[] = {
245 	ZEND_MOD_REQUIRED("standard")
246 	ZEND_MOD_OPTIONAL("mbstring")
247 	ZEND_MOD_END
248 };
249 /* }}} */
250 
251 /* {{{ exif_module_entry
252  */
253 zend_module_entry exif_module_entry = {
254 	STANDARD_MODULE_HEADER_EX, NULL,
255 	exif_module_deps,
256 	"exif",
257 	exif_functions,
258 	PHP_MINIT(exif),
259 	PHP_MSHUTDOWN(exif),
260 	NULL, NULL,
261 	PHP_MINFO(exif),
262 #if ZEND_MODULE_API_NO >= 20010901
263 	EXIF_VERSION,
264 #endif
265 #if ZEND_MODULE_API_NO >= 20060613
266 	PHP_MODULE_GLOBALS(exif),
267 	PHP_GINIT(exif),
268 	NULL,
269 	NULL,
270 	STANDARD_MODULE_PROPERTIES_EX
271 #else
272 	STANDARD_MODULE_PROPERTIES
273 #endif
274 };
275 /* }}} */
276 
277 #ifdef COMPILE_DL_EXIF
ZEND_GET_MODULE(exif)278 ZEND_GET_MODULE(exif)
279 #endif
280 
281 /* {{{ php_strnlen
282  * get length of string if buffer if less than buffer size or buffer size */
283 static size_t php_strnlen(char* str, size_t maxlen) {
284 	size_t len = 0;
285 
286 	if (str && maxlen && *str) {
287 		do {
288 			len++;
289 		} while (--maxlen && *(++str));
290 	}
291 	return len;
292 }
293 /* }}} */
294 
295 /* {{{ error messages
296 */
297 static const char * EXIF_ERROR_FILEEOF   = "Unexpected end of file reached";
298 static const char * EXIF_ERROR_CORRUPT   = "File structure corrupted";
299 static const char * EXIF_ERROR_THUMBEOF  = "Thumbnail goes IFD boundary or end of file reached";
300 static const char * EXIF_ERROR_FSREALLOC = "Illegal reallocating of undefined file section";
301 
302 #define EXIF_ERRLOG_FILEEOF(ImageInfo)    exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "%s", EXIF_ERROR_FILEEOF);
303 #define EXIF_ERRLOG_CORRUPT(ImageInfo)    exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "%s", EXIF_ERROR_CORRUPT);
304 #define EXIF_ERRLOG_THUMBEOF(ImageInfo)   exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "%s", EXIF_ERROR_THUMBEOF);
305 #define EXIF_ERRLOG_FSREALLOC(ImageInfo)  exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "%s", EXIF_ERROR_FSREALLOC);
306 /* }}} */
307 
308 /* {{{ format description defines
309    Describes format descriptor
310 */
311 static int php_tiff_bytes_per_format[] = {0, 1, 1, 2, 4, 8, 1, 1, 2, 4, 8, 4, 8, 1};
312 #define NUM_FORMATS 13
313 
314 #define TAG_FMT_BYTE       1
315 #define TAG_FMT_STRING     2
316 #define TAG_FMT_USHORT     3
317 #define TAG_FMT_ULONG      4
318 #define TAG_FMT_URATIONAL  5
319 #define TAG_FMT_SBYTE      6
320 #define TAG_FMT_UNDEFINED  7
321 #define TAG_FMT_SSHORT     8
322 #define TAG_FMT_SLONG      9
323 #define TAG_FMT_SRATIONAL 10
324 #define TAG_FMT_SINGLE    11
325 #define TAG_FMT_DOUBLE    12
326 #define TAG_FMT_IFD       13
327 
328 #ifdef EXIF_DEBUG
exif_get_tagformat(int format)329 static char *exif_get_tagformat(int format)
330 {
331 	switch(format) {
332 		case TAG_FMT_BYTE:      return "BYTE";
333 		case TAG_FMT_STRING:    return "STRING";
334 		case TAG_FMT_USHORT:    return "USHORT";
335 		case TAG_FMT_ULONG:     return "ULONG";
336 		case TAG_FMT_URATIONAL: return "URATIONAL";
337 		case TAG_FMT_SBYTE:     return "SBYTE";
338 		case TAG_FMT_UNDEFINED: return "UNDEFINED";
339 		case TAG_FMT_SSHORT:    return "SSHORT";
340 		case TAG_FMT_SLONG:     return "SLONG";
341 		case TAG_FMT_SRATIONAL: return "SRATIONAL";
342 		case TAG_FMT_SINGLE:    return "SINGLE";
343 		case TAG_FMT_DOUBLE:    return "DOUBLE";
344 		case TAG_FMT_IFD:       return "IFD";
345 	}
346 	return "*Illegal";
347 }
348 #endif
349 
350 /* Describes tag values */
351 #define TAG_GPS_VERSION_ID              0x0000
352 #define TAG_GPS_LATITUDE_REF            0x0001
353 #define TAG_GPS_LATITUDE                0x0002
354 #define TAG_GPS_LONGITUDE_REF           0x0003
355 #define TAG_GPS_LONGITUDE               0x0004
356 #define TAG_GPS_ALTITUDE_REF            0x0005
357 #define TAG_GPS_ALTITUDE                0x0006
358 #define TAG_GPS_TIME_STAMP              0x0007
359 #define TAG_GPS_SATELLITES              0x0008
360 #define TAG_GPS_STATUS                  0x0009
361 #define TAG_GPS_MEASURE_MODE            0x000A
362 #define TAG_GPS_DOP                     0x000B
363 #define TAG_GPS_SPEED_REF               0x000C
364 #define TAG_GPS_SPEED                   0x000D
365 #define TAG_GPS_TRACK_REF               0x000E
366 #define TAG_GPS_TRACK                   0x000F
367 #define TAG_GPS_IMG_DIRECTION_REF       0x0010
368 #define TAG_GPS_IMG_DIRECTION           0x0011
369 #define TAG_GPS_MAP_DATUM               0x0012
370 #define TAG_GPS_DEST_LATITUDE_REF       0x0013
371 #define TAG_GPS_DEST_LATITUDE           0x0014
372 #define TAG_GPS_DEST_LONGITUDE_REF      0x0015
373 #define TAG_GPS_DEST_LONGITUDE          0x0016
374 #define TAG_GPS_DEST_BEARING_REF        0x0017
375 #define TAG_GPS_DEST_BEARING            0x0018
376 #define TAG_GPS_DEST_DISTANCE_REF       0x0019
377 #define TAG_GPS_DEST_DISTANCE           0x001A
378 #define TAG_GPS_PROCESSING_METHOD       0x001B
379 #define TAG_GPS_AREA_INFORMATION        0x001C
380 #define TAG_GPS_DATE_STAMP              0x001D
381 #define TAG_GPS_DIFFERENTIAL            0x001E
382 #define TAG_TIFF_COMMENT                0x00FE /* SHOUDLNT HAPPEN */
383 #define TAG_NEW_SUBFILE                 0x00FE /* New version of subfile tag */
384 #define TAG_SUBFILE_TYPE                0x00FF /* Old version of subfile tag */
385 #define TAG_IMAGEWIDTH                  0x0100
386 #define TAG_IMAGEHEIGHT                 0x0101
387 #define TAG_BITS_PER_SAMPLE             0x0102
388 #define TAG_COMPRESSION                 0x0103
389 #define TAG_PHOTOMETRIC_INTERPRETATION  0x0106
390 #define TAG_TRESHHOLDING                0x0107
391 #define TAG_CELL_WIDTH                  0x0108
392 #define TAG_CELL_HEIGHT                 0x0109
393 #define TAG_FILL_ORDER                  0x010A
394 #define TAG_DOCUMENT_NAME               0x010D
395 #define TAG_IMAGE_DESCRIPTION           0x010E
396 #define TAG_MAKE                        0x010F
397 #define TAG_MODEL                       0x0110
398 #define TAG_STRIP_OFFSETS               0x0111
399 #define TAG_ORIENTATION                 0x0112
400 #define TAG_SAMPLES_PER_PIXEL           0x0115
401 #define TAG_ROWS_PER_STRIP              0x0116
402 #define TAG_STRIP_BYTE_COUNTS           0x0117
403 #define TAG_MIN_SAMPPLE_VALUE           0x0118
404 #define TAG_MAX_SAMPLE_VALUE            0x0119
405 #define TAG_X_RESOLUTION                0x011A
406 #define TAG_Y_RESOLUTION                0x011B
407 #define TAG_PLANAR_CONFIGURATION        0x011C
408 #define TAG_PAGE_NAME                   0x011D
409 #define TAG_X_POSITION                  0x011E
410 #define TAG_Y_POSITION                  0x011F
411 #define TAG_FREE_OFFSETS                0x0120
412 #define TAG_FREE_BYTE_COUNTS            0x0121
413 #define TAG_GRAY_RESPONSE_UNIT          0x0122
414 #define TAG_GRAY_RESPONSE_CURVE         0x0123
415 #define TAG_RESOLUTION_UNIT             0x0128
416 #define TAG_PAGE_NUMBER                 0x0129
417 #define TAG_TRANSFER_FUNCTION           0x012D
418 #define TAG_SOFTWARE                    0x0131
419 #define TAG_DATETIME                    0x0132
420 #define TAG_ARTIST                      0x013B
421 #define TAG_HOST_COMPUTER               0x013C
422 #define TAG_PREDICTOR                   0x013D
423 #define TAG_WHITE_POINT                 0x013E
424 #define TAG_PRIMARY_CHROMATICITIES      0x013F
425 #define TAG_COLOR_MAP                   0x0140
426 #define TAG_HALFTONE_HINTS              0x0141
427 #define TAG_TILE_WIDTH                  0x0142
428 #define TAG_TILE_LENGTH                 0x0143
429 #define TAG_TILE_OFFSETS                0x0144
430 #define TAG_TILE_BYTE_COUNTS            0x0145
431 #define TAG_SUB_IFD                     0x014A
432 #define TAG_INK_SETMPUTER               0x014C
433 #define TAG_INK_NAMES                   0x014D
434 #define TAG_NUMBER_OF_INKS              0x014E
435 #define TAG_DOT_RANGE                   0x0150
436 #define TAG_TARGET_PRINTER              0x0151
437 #define TAG_EXTRA_SAMPLE                0x0152
438 #define TAG_SAMPLE_FORMAT               0x0153
439 #define TAG_S_MIN_SAMPLE_VALUE          0x0154
440 #define TAG_S_MAX_SAMPLE_VALUE          0x0155
441 #define TAG_TRANSFER_RANGE              0x0156
442 #define TAG_JPEG_TABLES                 0x015B
443 #define TAG_JPEG_PROC                   0x0200
444 #define TAG_JPEG_INTERCHANGE_FORMAT     0x0201
445 #define TAG_JPEG_INTERCHANGE_FORMAT_LEN 0x0202
446 #define TAG_JPEG_RESTART_INTERVAL       0x0203
447 #define TAG_JPEG_LOSSLESS_PREDICTOR     0x0205
448 #define TAG_JPEG_POINT_TRANSFORMS       0x0206
449 #define TAG_JPEG_Q_TABLES               0x0207
450 #define TAG_JPEG_DC_TABLES              0x0208
451 #define TAG_JPEG_AC_TABLES              0x0209
452 #define TAG_YCC_COEFFICIENTS            0x0211
453 #define TAG_YCC_SUB_SAMPLING            0x0212
454 #define TAG_YCC_POSITIONING             0x0213
455 #define TAG_REFERENCE_BLACK_WHITE       0x0214
456 /* 0x0301 - 0x0302 */
457 /* 0x0320 */
458 /* 0x0343 */
459 /* 0x5001 - 0x501B */
460 /* 0x5021 - 0x503B */
461 /* 0x5090 - 0x5091 */
462 /* 0x5100 - 0x5101 */
463 /* 0x5110 - 0x5113 */
464 /* 0x80E3 - 0x80E6 */
465 /* 0x828d - 0x828F */
466 #define TAG_COPYRIGHT                   0x8298
467 #define TAG_EXPOSURETIME                0x829A
468 #define TAG_FNUMBER                     0x829D
469 #define TAG_EXIF_IFD_POINTER            0x8769
470 #define TAG_ICC_PROFILE                 0x8773
471 #define TAG_EXPOSURE_PROGRAM            0x8822
472 #define TAG_SPECTRAL_SENSITY            0x8824
473 #define TAG_GPS_IFD_POINTER             0x8825
474 #define TAG_ISOSPEED                    0x8827
475 #define TAG_OPTOELECTRIC_CONVERSION_F   0x8828
476 /* 0x8829 - 0x882b */
477 #define TAG_EXIFVERSION                 0x9000
478 #define TAG_DATE_TIME_ORIGINAL          0x9003
479 #define TAG_DATE_TIME_DIGITIZED         0x9004
480 #define TAG_COMPONENT_CONFIG            0x9101
481 #define TAG_COMPRESSED_BITS_PER_PIXEL   0x9102
482 #define TAG_SHUTTERSPEED                0x9201
483 #define TAG_APERTURE                    0x9202
484 #define TAG_BRIGHTNESS_VALUE            0x9203
485 #define TAG_EXPOSURE_BIAS_VALUE         0x9204
486 #define TAG_MAX_APERTURE                0x9205
487 #define TAG_SUBJECT_DISTANCE            0x9206
488 #define TAG_METRIC_MODULE               0x9207
489 #define TAG_LIGHT_SOURCE                0x9208
490 #define TAG_FLASH                       0x9209
491 #define TAG_FOCAL_LENGTH                0x920A
492 /* 0x920B - 0x920D */
493 /* 0x9211 - 0x9216 */
494 #define TAG_SUBJECT_AREA                0x9214
495 #define TAG_MAKER_NOTE                  0x927C
496 #define TAG_USERCOMMENT                 0x9286
497 #define TAG_SUB_SEC_TIME                0x9290
498 #define TAG_SUB_SEC_TIME_ORIGINAL       0x9291
499 #define TAG_SUB_SEC_TIME_DIGITIZED      0x9292
500 /* 0x923F */
501 /* 0x935C */
502 #define TAG_XP_TITLE                    0x9C9B
503 #define TAG_XP_COMMENTS                 0x9C9C
504 #define TAG_XP_AUTHOR                   0x9C9D
505 #define TAG_XP_KEYWORDS                 0x9C9E
506 #define TAG_XP_SUBJECT                  0x9C9F
507 #define TAG_FLASH_PIX_VERSION           0xA000
508 #define TAG_COLOR_SPACE                 0xA001
509 #define TAG_COMP_IMAGE_WIDTH            0xA002 /* compressed images only */
510 #define TAG_COMP_IMAGE_HEIGHT           0xA003
511 #define TAG_RELATED_SOUND_FILE          0xA004
512 #define TAG_INTEROP_IFD_POINTER         0xA005 /* IFD pointer */
513 #define TAG_FLASH_ENERGY                0xA20B
514 #define TAG_SPATIAL_FREQUENCY_RESPONSE  0xA20C
515 #define TAG_FOCALPLANE_X_RES            0xA20E
516 #define TAG_FOCALPLANE_Y_RES            0xA20F
517 #define TAG_FOCALPLANE_RESOLUTION_UNIT  0xA210
518 #define TAG_SUBJECT_LOCATION            0xA214
519 #define TAG_EXPOSURE_INDEX              0xA215
520 #define TAG_SENSING_METHOD              0xA217
521 #define TAG_FILE_SOURCE                 0xA300
522 #define TAG_SCENE_TYPE                  0xA301
523 #define TAG_CFA_PATTERN                 0xA302
524 #define TAG_CUSTOM_RENDERED             0xA401
525 #define TAG_EXPOSURE_MODE               0xA402
526 #define TAG_WHITE_BALANCE               0xA403
527 #define TAG_DIGITAL_ZOOM_RATIO          0xA404
528 #define TAG_FOCAL_LENGTH_IN_35_MM_FILM  0xA405
529 #define TAG_SCENE_CAPTURE_TYPE          0xA406
530 #define TAG_GAIN_CONTROL                0xA407
531 #define TAG_CONTRAST                    0xA408
532 #define TAG_SATURATION                  0xA409
533 #define TAG_SHARPNESS                   0xA40A
534 #define TAG_DEVICE_SETTING_DESCRIPTION  0xA40B
535 #define TAG_SUBJECT_DISTANCE_RANGE      0xA40C
536 #define TAG_IMAGE_UNIQUE_ID             0xA420
537 
538 /* Olympus specific tags */
539 #define TAG_OLYMPUS_SPECIALMODE         0x0200
540 #define TAG_OLYMPUS_JPEGQUAL            0x0201
541 #define TAG_OLYMPUS_MACRO               0x0202
542 #define TAG_OLYMPUS_DIGIZOOM            0x0204
543 #define TAG_OLYMPUS_SOFTWARERELEASE     0x0207
544 #define TAG_OLYMPUS_PICTINFO            0x0208
545 #define TAG_OLYMPUS_CAMERAID            0x0209
546 /* end Olympus specific tags */
547 
548 /* Internal */
549 #define TAG_NONE               			-1 /* note that -1 <> 0xFFFF */
550 #define TAG_COMPUTED_VALUE     			-2
551 #define TAG_END_OF_LIST                 0xFFFD
552 
553 /* Values for TAG_PHOTOMETRIC_INTERPRETATION */
554 #define PMI_BLACK_IS_ZERO       0
555 #define PMI_WHITE_IS_ZERO       1
556 #define PMI_RGB          	    2
557 #define PMI_PALETTE_COLOR       3
558 #define PMI_TRANSPARENCY_MASK   4
559 #define PMI_SEPARATED           5
560 #define PMI_YCBCR               6
561 #define PMI_CIELAB              8
562 
563 /* }}} */
564 
565 /* {{{ TabTable[]
566  */
567 typedef const struct {
568 	unsigned short Tag;
569 	char *Desc;
570 } tag_info_type;
571 
572 typedef tag_info_type  tag_info_array[];
573 typedef tag_info_type  *tag_table_type;
574 
575 #define TAG_TABLE_END \
576   {TAG_NONE,           "No tag value"},\
577   {TAG_COMPUTED_VALUE, "Computed value"},\
578   {TAG_END_OF_LIST,    ""}  /* Important for exif_get_tagname() IF value != "" function result is != false */
579 
580 static tag_info_array tag_table_IFD = {
581   { 0x000B, "ACDComment"},
582   { 0x00FE, "NewSubFile"}, /* better name it 'ImageType' ? */
583   { 0x00FF, "SubFile"},
584   { 0x0100, "ImageWidth"},
585   { 0x0101, "ImageLength"},
586   { 0x0102, "BitsPerSample"},
587   { 0x0103, "Compression"},
588   { 0x0106, "PhotometricInterpretation"},
589   { 0x010A, "FillOrder"},
590   { 0x010D, "DocumentName"},
591   { 0x010E, "ImageDescription"},
592   { 0x010F, "Make"},
593   { 0x0110, "Model"},
594   { 0x0111, "StripOffsets"},
595   { 0x0112, "Orientation"},
596   { 0x0115, "SamplesPerPixel"},
597   { 0x0116, "RowsPerStrip"},
598   { 0x0117, "StripByteCounts"},
599   { 0x0118, "MinSampleValue"},
600   { 0x0119, "MaxSampleValue"},
601   { 0x011A, "XResolution"},
602   { 0x011B, "YResolution"},
603   { 0x011C, "PlanarConfiguration"},
604   { 0x011D, "PageName"},
605   { 0x011E, "XPosition"},
606   { 0x011F, "YPosition"},
607   { 0x0120, "FreeOffsets"},
608   { 0x0121, "FreeByteCounts"},
609   { 0x0122, "GrayResponseUnit"},
610   { 0x0123, "GrayResponseCurve"},
611   { 0x0124, "T4Options"},
612   { 0x0125, "T6Options"},
613   { 0x0128, "ResolutionUnit"},
614   { 0x0129, "PageNumber"},
615   { 0x012D, "TransferFunction"},
616   { 0x0131, "Software"},
617   { 0x0132, "DateTime"},
618   { 0x013B, "Artist"},
619   { 0x013C, "HostComputer"},
620   { 0x013D, "Predictor"},
621   { 0x013E, "WhitePoint"},
622   { 0x013F, "PrimaryChromaticities"},
623   { 0x0140, "ColorMap"},
624   { 0x0141, "HalfToneHints"},
625   { 0x0142, "TileWidth"},
626   { 0x0143, "TileLength"},
627   { 0x0144, "TileOffsets"},
628   { 0x0145, "TileByteCounts"},
629   { 0x014A, "SubIFD"},
630   { 0x014C, "InkSet"},
631   { 0x014D, "InkNames"},
632   { 0x014E, "NumberOfInks"},
633   { 0x0150, "DotRange"},
634   { 0x0151, "TargetPrinter"},
635   { 0x0152, "ExtraSample"},
636   { 0x0153, "SampleFormat"},
637   { 0x0154, "SMinSampleValue"},
638   { 0x0155, "SMaxSampleValue"},
639   { 0x0156, "TransferRange"},
640   { 0x0157, "ClipPath"},
641   { 0x0158, "XClipPathUnits"},
642   { 0x0159, "YClipPathUnits"},
643   { 0x015A, "Indexed"},
644   { 0x015B, "JPEGTables"},
645   { 0x015F, "OPIProxy"},
646   { 0x0200, "JPEGProc"},
647   { 0x0201, "JPEGInterchangeFormat"},
648   { 0x0202, "JPEGInterchangeFormatLength"},
649   { 0x0203, "JPEGRestartInterval"},
650   { 0x0205, "JPEGLosslessPredictors"},
651   { 0x0206, "JPEGPointTransforms"},
652   { 0x0207, "JPEGQTables"},
653   { 0x0208, "JPEGDCTables"},
654   { 0x0209, "JPEGACTables"},
655   { 0x0211, "YCbCrCoefficients"},
656   { 0x0212, "YCbCrSubSampling"},
657   { 0x0213, "YCbCrPositioning"},
658   { 0x0214, "ReferenceBlackWhite"},
659   { 0x02BC, "ExtensibleMetadataPlatform"}, /* XAP: Extensible Authoring Publishing, obsoleted by XMP: Extensible Metadata Platform */
660   { 0x0301, "Gamma"},
661   { 0x0302, "ICCProfileDescriptor"},
662   { 0x0303, "SRGBRenderingIntent"},
663   { 0x0320, "ImageTitle"},
664   { 0x5001, "ResolutionXUnit"},
665   { 0x5002, "ResolutionYUnit"},
666   { 0x5003, "ResolutionXLengthUnit"},
667   { 0x5004, "ResolutionYLengthUnit"},
668   { 0x5005, "PrintFlags"},
669   { 0x5006, "PrintFlagsVersion"},
670   { 0x5007, "PrintFlagsCrop"},
671   { 0x5008, "PrintFlagsBleedWidth"},
672   { 0x5009, "PrintFlagsBleedWidthScale"},
673   { 0x500A, "HalftoneLPI"},
674   { 0x500B, "HalftoneLPIUnit"},
675   { 0x500C, "HalftoneDegree"},
676   { 0x500D, "HalftoneShape"},
677   { 0x500E, "HalftoneMisc"},
678   { 0x500F, "HalftoneScreen"},
679   { 0x5010, "JPEGQuality"},
680   { 0x5011, "GridSize"},
681   { 0x5012, "ThumbnailFormat"},
682   { 0x5013, "ThumbnailWidth"},
683   { 0x5014, "ThumbnailHeight"},
684   { 0x5015, "ThumbnailColorDepth"},
685   { 0x5016, "ThumbnailPlanes"},
686   { 0x5017, "ThumbnailRawBytes"},
687   { 0x5018, "ThumbnailSize"},
688   { 0x5019, "ThumbnailCompressedSize"},
689   { 0x501A, "ColorTransferFunction"},
690   { 0x501B, "ThumbnailData"},
691   { 0x5020, "ThumbnailImageWidth"},
692   { 0x5021, "ThumbnailImageHeight"},
693   { 0x5022, "ThumbnailBitsPerSample"},
694   { 0x5023, "ThumbnailCompression"},
695   { 0x5024, "ThumbnailPhotometricInterp"},
696   { 0x5025, "ThumbnailImageDescription"},
697   { 0x5026, "ThumbnailEquipMake"},
698   { 0x5027, "ThumbnailEquipModel"},
699   { 0x5028, "ThumbnailStripOffsets"},
700   { 0x5029, "ThumbnailOrientation"},
701   { 0x502A, "ThumbnailSamplesPerPixel"},
702   { 0x502B, "ThumbnailRowsPerStrip"},
703   { 0x502C, "ThumbnailStripBytesCount"},
704   { 0x502D, "ThumbnailResolutionX"},
705   { 0x502E, "ThumbnailResolutionY"},
706   { 0x502F, "ThumbnailPlanarConfig"},
707   { 0x5030, "ThumbnailResolutionUnit"},
708   { 0x5031, "ThumbnailTransferFunction"},
709   { 0x5032, "ThumbnailSoftwareUsed"},
710   { 0x5033, "ThumbnailDateTime"},
711   { 0x5034, "ThumbnailArtist"},
712   { 0x5035, "ThumbnailWhitePoint"},
713   { 0x5036, "ThumbnailPrimaryChromaticities"},
714   { 0x5037, "ThumbnailYCbCrCoefficients"},
715   { 0x5038, "ThumbnailYCbCrSubsampling"},
716   { 0x5039, "ThumbnailYCbCrPositioning"},
717   { 0x503A, "ThumbnailRefBlackWhite"},
718   { 0x503B, "ThumbnailCopyRight"},
719   { 0x5090, "LuminanceTable"},
720   { 0x5091, "ChrominanceTable"},
721   { 0x5100, "FrameDelay"},
722   { 0x5101, "LoopCount"},
723   { 0x5110, "PixelUnit"},
724   { 0x5111, "PixelPerUnitX"},
725   { 0x5112, "PixelPerUnitY"},
726   { 0x5113, "PaletteHistogram"},
727   { 0x1000, "RelatedImageFileFormat"},
728   { 0x800D, "ImageID"},
729   { 0x80E3, "Matteing"},   /* obsoleted by ExtraSamples */
730   { 0x80E4, "DataType"},   /* obsoleted by SampleFormat */
731   { 0x80E5, "ImageDepth"},
732   { 0x80E6, "TileDepth"},
733   { 0x828D, "CFARepeatPatternDim"},
734   { 0x828E, "CFAPattern"},
735   { 0x828F, "BatteryLevel"},
736   { 0x8298, "Copyright"},
737   { 0x829A, "ExposureTime"},
738   { 0x829D, "FNumber"},
739   { 0x83BB, "IPTC/NAA"},
740   { 0x84E3, "IT8RasterPadding"},
741   { 0x84E5, "IT8ColorTable"},
742   { 0x8649, "ImageResourceInformation"}, /* PhotoShop */
743   { 0x8769, "Exif_IFD_Pointer"},
744   { 0x8773, "ICC_Profile"},
745   { 0x8822, "ExposureProgram"},
746   { 0x8824, "SpectralSensity"},
747   { 0x8828, "OECF"},
748   { 0x8825, "GPS_IFD_Pointer"},
749   { 0x8827, "ISOSpeedRatings"},
750   { 0x8828, "OECF"},
751   { 0x9000, "ExifVersion"},
752   { 0x9003, "DateTimeOriginal"},
753   { 0x9004, "DateTimeDigitized"},
754   { 0x9101, "ComponentsConfiguration"},
755   { 0x9102, "CompressedBitsPerPixel"},
756   { 0x9201, "ShutterSpeedValue"},
757   { 0x9202, "ApertureValue"},
758   { 0x9203, "BrightnessValue"},
759   { 0x9204, "ExposureBiasValue"},
760   { 0x9205, "MaxApertureValue"},
761   { 0x9206, "SubjectDistance"},
762   { 0x9207, "MeteringMode"},
763   { 0x9208, "LightSource"},
764   { 0x9209, "Flash"},
765   { 0x920A, "FocalLength"},
766   { 0x920B, "FlashEnergy"},                 /* 0xA20B  in JPEG   */
767   { 0x920C, "SpatialFrequencyResponse"},    /* 0xA20C    -  -    */
768   { 0x920D, "Noise"},
769   { 0x920E, "FocalPlaneXResolution"},       /* 0xA20E    -  -    */
770   { 0x920F, "FocalPlaneYResolution"},       /* 0xA20F    -  -    */
771   { 0x9210, "FocalPlaneResolutionUnit"},    /* 0xA210    -  -    */
772   { 0x9211, "ImageNumber"},
773   { 0x9212, "SecurityClassification"},
774   { 0x9213, "ImageHistory"},
775   { 0x9214, "SubjectLocation"},             /* 0xA214    -  -    */
776   { 0x9215, "ExposureIndex"},               /* 0xA215    -  -    */
777   { 0x9216, "TIFF/EPStandardID"},
778   { 0x9217, "SensingMethod"},               /* 0xA217    -  -    */
779   { 0x923F, "StoNits"},
780   { 0x927C, "MakerNote"},
781   { 0x9286, "UserComment"},
782   { 0x9290, "SubSecTime"},
783   { 0x9291, "SubSecTimeOriginal"},
784   { 0x9292, "SubSecTimeDigitized"},
785   { 0x935C, "ImageSourceData"},             /* "Adobe Photoshop Document Data Block": 8BIM... */
786   { 0x9c9b, "Title" },                      /* Win XP specific, Unicode  */
787   { 0x9c9c, "Comments" },                   /* Win XP specific, Unicode  */
788   { 0x9c9d, "Author" },                     /* Win XP specific, Unicode  */
789   { 0x9c9e, "Keywords" },                   /* Win XP specific, Unicode  */
790   { 0x9c9f, "Subject" },                    /* Win XP specific, Unicode, not to be confused with SubjectDistance and SubjectLocation */
791   { 0xA000, "FlashPixVersion"},
792   { 0xA001, "ColorSpace"},
793   { 0xA002, "ExifImageWidth"},
794   { 0xA003, "ExifImageLength"},
795   { 0xA004, "RelatedSoundFile"},
796   { 0xA005, "InteroperabilityOffset"},
797   { 0xA20B, "FlashEnergy"},                 /* 0x920B in TIFF/EP */
798   { 0xA20C, "SpatialFrequencyResponse"},    /* 0x920C    -  -    */
799   { 0xA20D, "Noise"},
800   { 0xA20E, "FocalPlaneXResolution"},    	/* 0x920E    -  -    */
801   { 0xA20F, "FocalPlaneYResolution"},       /* 0x920F    -  -    */
802   { 0xA210, "FocalPlaneResolutionUnit"},    /* 0x9210    -  -    */
803   { 0xA211, "ImageNumber"},
804   { 0xA212, "SecurityClassification"},
805   { 0xA213, "ImageHistory"},
806   { 0xA214, "SubjectLocation"},             /* 0x9214    -  -    */
807   { 0xA215, "ExposureIndex"},               /* 0x9215    -  -    */
808   { 0xA216, "TIFF/EPStandardID"},
809   { 0xA217, "SensingMethod"},               /* 0x9217    -  -    */
810   { 0xA300, "FileSource"},
811   { 0xA301, "SceneType"},
812   { 0xA302, "CFAPattern"},
813   { 0xA401, "CustomRendered"},
814   { 0xA402, "ExposureMode"},
815   { 0xA403, "WhiteBalance"},
816   { 0xA404, "DigitalZoomRatio"},
817   { 0xA405, "FocalLengthIn35mmFilm"},
818   { 0xA406, "SceneCaptureType"},
819   { 0xA407, "GainControl"},
820   { 0xA408, "Contrast"},
821   { 0xA409, "Saturation"},
822   { 0xA40A, "Sharpness"},
823   { 0xA40B, "DeviceSettingDescription"},
824   { 0xA40C, "SubjectDistanceRange"},
825   { 0xA420, "ImageUniqueID"},
826   TAG_TABLE_END
827 } ;
828 
829 static tag_info_array tag_table_GPS = {
830   { 0x0000, "GPSVersion"},
831   { 0x0001, "GPSLatitudeRef"},
832   { 0x0002, "GPSLatitude"},
833   { 0x0003, "GPSLongitudeRef"},
834   { 0x0004, "GPSLongitude"},
835   { 0x0005, "GPSAltitudeRef"},
836   { 0x0006, "GPSAltitude"},
837   { 0x0007, "GPSTimeStamp"},
838   { 0x0008, "GPSSatellites"},
839   { 0x0009, "GPSStatus"},
840   { 0x000A, "GPSMeasureMode"},
841   { 0x000B, "GPSDOP"},
842   { 0x000C, "GPSSpeedRef"},
843   { 0x000D, "GPSSpeed"},
844   { 0x000E, "GPSTrackRef"},
845   { 0x000F, "GPSTrack"},
846   { 0x0010, "GPSImgDirectionRef"},
847   { 0x0011, "GPSImgDirection"},
848   { 0x0012, "GPSMapDatum"},
849   { 0x0013, "GPSDestLatitudeRef"},
850   { 0x0014, "GPSDestLatitude"},
851   { 0x0015, "GPSDestLongitudeRef"},
852   { 0x0016, "GPSDestLongitude"},
853   { 0x0017, "GPSDestBearingRef"},
854   { 0x0018, "GPSDestBearing"},
855   { 0x0019, "GPSDestDistanceRef"},
856   { 0x001A, "GPSDestDistance"},
857   { 0x001B, "GPSProcessingMode"},
858   { 0x001C, "GPSAreaInformation"},
859   { 0x001D, "GPSDateStamp"},
860   { 0x001E, "GPSDifferential"},
861   TAG_TABLE_END
862 };
863 
864 static tag_info_array tag_table_IOP = {
865   { 0x0001, "InterOperabilityIndex"}, /* should be 'R98' or 'THM' */
866   { 0x0002, "InterOperabilityVersion"},
867   { 0x1000, "RelatedFileFormat"},
868   { 0x1001, "RelatedImageWidth"},
869   { 0x1002, "RelatedImageHeight"},
870   TAG_TABLE_END
871 };
872 
873 static tag_info_array tag_table_VND_CANON = {
874   { 0x0001, "ModeArray"}, /* guess */
875   { 0x0004, "ImageInfo"}, /* guess */
876   { 0x0006, "ImageType"},
877   { 0x0007, "FirmwareVersion"},
878   { 0x0008, "ImageNumber"},
879   { 0x0009, "OwnerName"},
880   { 0x000C, "Camera"},
881   { 0x000F, "CustomFunctions"},
882   TAG_TABLE_END
883 };
884 
885 static tag_info_array tag_table_VND_CASIO = {
886   { 0x0001, "RecordingMode"},
887   { 0x0002, "Quality"},
888   { 0x0003, "FocusingMode"},
889   { 0x0004, "FlashMode"},
890   { 0x0005, "FlashIntensity"},
891   { 0x0006, "ObjectDistance"},
892   { 0x0007, "WhiteBalance"},
893   { 0x000A, "DigitalZoom"},
894   { 0x000B, "Sharpness"},
895   { 0x000C, "Contrast"},
896   { 0x000D, "Saturation"},
897   { 0x0014, "CCDSensitivity"},
898   TAG_TABLE_END
899 };
900 
901 static tag_info_array tag_table_VND_FUJI = {
902   { 0x0000, "Version"},
903   { 0x1000, "Quality"},
904   { 0x1001, "Sharpness"},
905   { 0x1002, "WhiteBalance"},
906   { 0x1003, "Color"},
907   { 0x1004, "Tone"},
908   { 0x1010, "FlashMode"},
909   { 0x1011, "FlashStrength"},
910   { 0x1020, "Macro"},
911   { 0x1021, "FocusMode"},
912   { 0x1030, "SlowSync"},
913   { 0x1031, "PictureMode"},
914   { 0x1100, "ContTake"},
915   { 0x1300, "BlurWarning"},
916   { 0x1301, "FocusWarning"},
917   { 0x1302, "AEWarning "},
918   TAG_TABLE_END
919 };
920 
921 static tag_info_array tag_table_VND_NIKON = {
922   { 0x0003, "Quality"},
923   { 0x0004, "ColorMode"},
924   { 0x0005, "ImageAdjustment"},
925   { 0x0006, "CCDSensitivity"},
926   { 0x0007, "WhiteBalance"},
927   { 0x0008, "Focus"},
928   { 0x000a, "DigitalZoom"},
929   { 0x000b, "Converter"},
930   TAG_TABLE_END
931 };
932 
933 static tag_info_array tag_table_VND_NIKON_990 = {
934   { 0x0001, "Version"},
935   { 0x0002, "ISOSetting"},
936   { 0x0003, "ColorMode"},
937   { 0x0004, "Quality"},
938   { 0x0005, "WhiteBalance"},
939   { 0x0006, "ImageSharpening"},
940   { 0x0007, "FocusMode"},
941   { 0x0008, "FlashSetting"},
942   { 0x000F, "ISOSelection"},
943   { 0x0080, "ImageAdjustment"},
944   { 0x0082, "AuxiliaryLens"},
945   { 0x0085, "ManualFocusDistance"},
946   { 0x0086, "DigitalZoom"},
947   { 0x0088, "AFFocusPosition"},
948   { 0x0010, "DataDump"},
949   TAG_TABLE_END
950 };
951 
952 static tag_info_array tag_table_VND_OLYMPUS = {
953   { 0x0200, "SpecialMode"},
954   { 0x0201, "JPEGQuality"},
955   { 0x0202, "Macro"},
956   { 0x0204, "DigitalZoom"},
957   { 0x0207, "SoftwareRelease"},
958   { 0x0208, "PictureInfo"},
959   { 0x0209, "CameraId"},
960   { 0x0F00, "DataDump"},
961   TAG_TABLE_END
962 };
963 
964 typedef enum mn_byte_order_t {
965 	MN_ORDER_INTEL    = 0,
966 	MN_ORDER_MOTOROLA = 1,
967 	MN_ORDER_NORMAL
968 } mn_byte_order_t;
969 
970 typedef enum mn_offset_mode_t {
971 	MN_OFFSET_NORMAL,
972 	MN_OFFSET_MAKER,
973 	MN_OFFSET_GUESS
974 } mn_offset_mode_t;
975 
976 typedef struct {
977 	tag_table_type   tag_table;
978 	char *           make;
979 	char *           model;
980 	char *           id_string;
981 	int              id_string_len;
982 	int              offset;
983 	mn_byte_order_t  byte_order;
984 	mn_offset_mode_t offset_mode;
985 } maker_note_type;
986 
987 static const maker_note_type maker_note_array[] = {
988   { tag_table_VND_CANON,     "Canon",                   NULL,  NULL,                       0,  0,  MN_ORDER_INTEL,    MN_OFFSET_GUESS},
989 /*  { tag_table_VND_CANON,     "Canon",                   NULL,  NULL,                       0,  0,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},*/
990   { tag_table_VND_CASIO,     "CASIO",                   NULL,  NULL,                       0,  0,  MN_ORDER_MOTOROLA, MN_OFFSET_NORMAL},
991   { tag_table_VND_FUJI,      "FUJIFILM",                NULL,  "FUJIFILM\x0C\x00\x00\x00", 12, 12, MN_ORDER_INTEL,    MN_OFFSET_MAKER},
992   { tag_table_VND_NIKON,     "NIKON",                   NULL,  "Nikon\x00\x01\x00",        8,  8,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
993   { tag_table_VND_NIKON_990, "NIKON",                   NULL,  NULL,                       0,  0,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
994   { tag_table_VND_OLYMPUS,   "OLYMPUS OPTICAL CO.,LTD", NULL,  "OLYMP\x00\x01\x00",        8,  8,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
995 };
996 /* }}} */
997 
998 /* {{{ exif_get_tagname
999 	Get headername for tag_num or NULL if not defined */
exif_get_tagname(int tag_num,char * ret,int len,tag_table_type tag_table TSRMLS_DC)1000 static char * exif_get_tagname(int tag_num, char *ret, int len, tag_table_type tag_table TSRMLS_DC)
1001 {
1002 	int i, t;
1003 	char tmp[32];
1004 
1005 	for (i = 0; (t = tag_table[i].Tag) != TAG_END_OF_LIST; i++) {
1006 		if (t == tag_num) {
1007 			if (ret && len)  {
1008 				strlcpy(ret, tag_table[i].Desc, abs(len));
1009 				if (len < 0) {
1010 					memset(ret + strlen(ret), ' ', -len - strlen(ret) - 1);
1011 					ret[-len - 1] = '\0';
1012 				}
1013 				return ret;
1014 			}
1015 			return tag_table[i].Desc;
1016 		}
1017 	}
1018 
1019 	if (ret && len) {
1020 		snprintf(tmp, sizeof(tmp), "UndefinedTag:0x%04X", tag_num);
1021 		strlcpy(ret, tmp, abs(len));
1022 		if (len < 0) {
1023 			memset(ret + strlen(ret), ' ', -len - strlen(ret) - 1);
1024 			ret[-len - 1] = '\0';
1025 		}
1026 		return ret;
1027 	}
1028 	return "";
1029 }
1030 /* }}} */
1031 
1032 /* {{{ exif_char_dump
1033  * Do not use! This is a debug function... */
1034 #ifdef EXIF_DEBUG
exif_char_dump(unsigned char * addr,int len,int offset)1035 static unsigned char* exif_char_dump(unsigned char * addr, int len, int offset)
1036 {
1037 	static unsigned char buf[4096+1];
1038 	static unsigned char tmp[20];
1039 	int c, i, p=0, n = 5+31;
1040 
1041 	p += slprintf(buf+p, sizeof(buf)-p, "\nDump Len: %08X (%d)", len, len);
1042 	if (len) {
1043 		for(i=0; i<len+15 && p+n<=sizeof(buf); i++) {
1044 			if (i%16==0) {
1045 				p += slprintf(buf+p, sizeof(buf)-p, "\n%08X: ", i+offset);
1046 			}
1047 			if (i<len) {
1048 				c = *addr++;
1049 				p += slprintf(buf+p, sizeof(buf)-p, "%02X ", c);
1050 				tmp[i%16] = c>=32 ? c : '.';
1051 				tmp[(i%16)+1] = '\0';
1052 			} else {
1053 				p += slprintf(buf+p, sizeof(buf)-p, "   ");
1054 			}
1055 			if (i%16==15) {
1056 				p += slprintf(buf+p, sizeof(buf)-p, "    %s", tmp);
1057 				if (i>=len) {
1058 					break;
1059 				}
1060 			}
1061 		}
1062 	}
1063 	buf[sizeof(buf)-1] = '\0';
1064 	return buf;
1065 }
1066 #endif
1067 /* }}} */
1068 
1069 /* {{{ php_jpg_get16
1070    Get 16 bits motorola order (always) for jpeg header stuff.
1071 */
php_jpg_get16(void * value)1072 static int php_jpg_get16(void *value)
1073 {
1074 	return (((uchar *)value)[0] << 8) | ((uchar *)value)[1];
1075 }
1076 /* }}} */
1077 
1078 /* {{{ php_ifd_get16u
1079  * Convert a 16 bit unsigned value from file's native byte order */
php_ifd_get16u(void * value,int motorola_intel)1080 static int php_ifd_get16u(void *value, int motorola_intel)
1081 {
1082 	if (motorola_intel) {
1083 		return (((uchar *)value)[0] << 8) | ((uchar *)value)[1];
1084 	} else {
1085 		return (((uchar *)value)[1] << 8) | ((uchar *)value)[0];
1086 	}
1087 }
1088 /* }}} */
1089 
1090 /* {{{ php_ifd_get16s
1091  * Convert a 16 bit signed value from file's native byte order */
php_ifd_get16s(void * value,int motorola_intel)1092 static signed short php_ifd_get16s(void *value, int motorola_intel)
1093 {
1094 	return (signed short)php_ifd_get16u(value, motorola_intel);
1095 }
1096 /* }}} */
1097 
1098 /* {{{ php_ifd_get32s
1099  * Convert a 32 bit signed value from file's native byte order */
php_ifd_get32s(void * value,int motorola_intel)1100 static int php_ifd_get32s(void *value, int motorola_intel)
1101 {
1102 	if (motorola_intel) {
1103 		return  (((char  *)value)[0] << 24)
1104 			  | (((uchar *)value)[1] << 16)
1105 			  | (((uchar *)value)[2] << 8 )
1106 			  | (((uchar *)value)[3]      );
1107 	} else {
1108 		return  (((char  *)value)[3] << 24)
1109 			  | (((uchar *)value)[2] << 16)
1110 			  | (((uchar *)value)[1] << 8 )
1111 			  | (((uchar *)value)[0]      );
1112 	}
1113 }
1114 /* }}} */
1115 
1116 /* {{{ php_ifd_get32u
1117  * Write 32 bit unsigned value to data */
php_ifd_get32u(void * value,int motorola_intel)1118 static unsigned php_ifd_get32u(void *value, int motorola_intel)
1119 {
1120 	return (unsigned)php_ifd_get32s(value, motorola_intel) & 0xffffffff;
1121 }
1122 /* }}} */
1123 
1124 /* {{{ php_ifd_set16u
1125  * Write 16 bit unsigned value to data */
php_ifd_set16u(char * data,unsigned int value,int motorola_intel)1126 static void php_ifd_set16u(char *data, unsigned int value, int motorola_intel)
1127 {
1128 	if (motorola_intel) {
1129 		data[0] = (value & 0xFF00) >> 8;
1130 		data[1] = (value & 0x00FF);
1131 	} else {
1132 		data[1] = (value & 0xFF00) >> 8;
1133 		data[0] = (value & 0x00FF);
1134 	}
1135 }
1136 /* }}} */
1137 
1138 /* {{{ php_ifd_set32u
1139  * Convert a 32 bit unsigned value from file's native byte order */
php_ifd_set32u(char * data,size_t value,int motorola_intel)1140 static void php_ifd_set32u(char *data, size_t value, int motorola_intel)
1141 {
1142 	if (motorola_intel) {
1143 		data[0] = (value & 0xFF000000) >> 24;
1144 		data[1] = (value & 0x00FF0000) >> 16;
1145 		data[2] = (value & 0x0000FF00) >>  8;
1146 		data[3] = (value & 0x000000FF);
1147 	} else {
1148 		data[3] = (value & 0xFF000000) >> 24;
1149 		data[2] = (value & 0x00FF0000) >> 16;
1150 		data[1] = (value & 0x0000FF00) >>  8;
1151 		data[0] = (value & 0x000000FF);
1152 	}
1153 }
1154 /* }}} */
1155 
1156 #ifdef EXIF_DEBUG
exif_dump_data(int * dump_free,int format,int components,int length,int motorola_intel,char * value_ptr TSRMLS_DC)1157 char * exif_dump_data(int *dump_free, int format, int components, int length, int motorola_intel, char *value_ptr TSRMLS_DC) /* {{{ */
1158 {
1159 	char *dump;
1160 	int len;
1161 
1162 	*dump_free = 0;
1163 	if (format == TAG_FMT_STRING) {
1164 		return value_ptr ? value_ptr : "<no data>";
1165 	}
1166 	if (format == TAG_FMT_UNDEFINED) {
1167 		return "<undefined>\n";
1168 	}
1169 	if (format == TAG_FMT_IFD) {
1170 		return "";
1171 	}
1172 	if (format == TAG_FMT_SINGLE || format == TAG_FMT_DOUBLE) {
1173 		return "<not implemented>";
1174 	}
1175 	*dump_free = 1;
1176 	if (components > 1) {
1177 		len = spprintf(&dump, 0, "(%d,%d) {", components, length);
1178 	} else {
1179 		len = spprintf(&dump, 0, "{");
1180 	}
1181 	while(components > 0) {
1182 		switch(format) {
1183 			case TAG_FMT_BYTE:
1184 			case TAG_FMT_UNDEFINED:
1185 			case TAG_FMT_STRING:
1186 			case TAG_FMT_SBYTE:
1187 				dump = erealloc(dump, len + 4 + 1);
1188 				snprintf(dump + len, 4 + 1, "0x%02X", *value_ptr);
1189 				len += 4;
1190 				value_ptr++;
1191 				break;
1192 			case TAG_FMT_USHORT:
1193 			case TAG_FMT_SSHORT:
1194 				dump = erealloc(dump, len + 6 + 1);
1195 				snprintf(dump + len, 6 + 1, "0x%04X", php_ifd_get16s(value_ptr, motorola_intel));
1196 				len += 6;
1197 				value_ptr += 2;
1198 				break;
1199 			case TAG_FMT_ULONG:
1200 			case TAG_FMT_SLONG:
1201 				dump = erealloc(dump, len + 6 + 1);
1202 				snprintf(dump + len, 6 + 1, "0x%04X", php_ifd_get32s(value_ptr, motorola_intel));
1203 				len += 6;
1204 				value_ptr += 4;
1205 				break;
1206 			case TAG_FMT_URATIONAL:
1207 			case TAG_FMT_SRATIONAL:
1208 				dump = erealloc(dump, len + 13 + 1);
1209 				snprintf(dump + len, 13 + 1, "0x%04X/0x%04X", php_ifd_get32s(value_ptr, motorola_intel), php_ifd_get32s(value_ptr+4, motorola_intel));
1210 				len += 13;
1211 				value_ptr += 8;
1212 				break;
1213 		}
1214 		if (components > 0) {
1215 			dump = erealloc(dump, len + 2 + 1);
1216 			snprintf(dump + len, 2 + 1, ", ");
1217 			len += 2;
1218 			components--;
1219 		} else{
1220 			break;
1221 		}
1222 	}
1223 	dump = erealloc(dump, len + 1 + 1);
1224 	snprintf(dump + len, 1 + 1, "}");
1225 	return dump;
1226 }
1227 /* }}} */
1228 #endif
1229 
1230 /* {{{ exif_convert_any_format
1231  * Evaluate number, be it int, rational, or float from directory. */
exif_convert_any_format(void * value,int format,int motorola_intel TSRMLS_DC)1232 static double exif_convert_any_format(void *value, int format, int motorola_intel TSRMLS_DC)
1233 {
1234 	int 		s_den;
1235 	unsigned 	u_den;
1236 
1237 	switch(format) {
1238 		case TAG_FMT_SBYTE:     return *(signed char *)value;
1239 		case TAG_FMT_BYTE:      return *(uchar *)value;
1240 
1241 		case TAG_FMT_USHORT:    return php_ifd_get16u(value, motorola_intel);
1242 		case TAG_FMT_ULONG:     return php_ifd_get32u(value, motorola_intel);
1243 
1244 		case TAG_FMT_URATIONAL:
1245 			u_den = php_ifd_get32u(4+(char *)value, motorola_intel);
1246 			if (u_den == 0) {
1247 				return 0;
1248 			} else {
1249 				return (double)php_ifd_get32u(value, motorola_intel) / u_den;
1250 			}
1251 
1252 		case TAG_FMT_SRATIONAL:
1253 			s_den = php_ifd_get32s(4+(char *)value, motorola_intel);
1254 			if (s_den == 0) {
1255 				return 0;
1256 			} else {
1257 				return (double)php_ifd_get32s(value, motorola_intel) / s_den;
1258 			}
1259 
1260 		case TAG_FMT_SSHORT:    return (signed short)php_ifd_get16u(value, motorola_intel);
1261 		case TAG_FMT_SLONG:     return php_ifd_get32s(value, motorola_intel);
1262 
1263 		/* Not sure if this is correct (never seen float used in Exif format) */
1264 		case TAG_FMT_SINGLE:
1265 #ifdef EXIF_DEBUG
1266 			php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Found value of type single");
1267 #endif
1268 			return (double)*(float *)value;
1269 		case TAG_FMT_DOUBLE:
1270 #ifdef EXIF_DEBUG
1271 			php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Found value of type double");
1272 #endif
1273 			return *(double *)value;
1274 	}
1275 	return 0;
1276 }
1277 /* }}} */
1278 
1279 /* {{{ exif_convert_any_to_int
1280  * Evaluate number, be it int, rational, or float from directory. */
exif_convert_any_to_int(void * value,int format,int motorola_intel TSRMLS_DC)1281 static size_t exif_convert_any_to_int(void *value, int format, int motorola_intel TSRMLS_DC)
1282 {
1283 	int 		s_den;
1284 	unsigned 	u_den;
1285 
1286 	switch(format) {
1287 		case TAG_FMT_SBYTE:     return *(signed char *)value;
1288 		case TAG_FMT_BYTE:      return *(uchar *)value;
1289 
1290 		case TAG_FMT_USHORT:    return php_ifd_get16u(value, motorola_intel);
1291 		case TAG_FMT_ULONG:     return php_ifd_get32u(value, motorola_intel);
1292 
1293 		case TAG_FMT_URATIONAL:
1294 			u_den = php_ifd_get32u(4+(char *)value, motorola_intel);
1295 			if (u_den == 0) {
1296 				return 0;
1297 			} else {
1298 				return php_ifd_get32u(value, motorola_intel) / u_den;
1299 			}
1300 
1301 		case TAG_FMT_SRATIONAL:
1302 			s_den = php_ifd_get32s(4+(char *)value, motorola_intel);
1303 			if (s_den == 0) {
1304 				return 0;
1305 			} else {
1306 				return (size_t)((double)php_ifd_get32s(value, motorola_intel) / s_den);
1307 			}
1308 
1309 		case TAG_FMT_SSHORT:    return php_ifd_get16u(value, motorola_intel);
1310 		case TAG_FMT_SLONG:     return php_ifd_get32s(value, motorola_intel);
1311 
1312 		/* Not sure if this is correct (never seen float used in Exif format) */
1313 		case TAG_FMT_SINGLE:
1314 #ifdef EXIF_DEBUG
1315 			php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Found value of type single");
1316 #endif
1317 			return (size_t)*(float *)value;
1318 		case TAG_FMT_DOUBLE:
1319 #ifdef EXIF_DEBUG
1320 			php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Found value of type double");
1321 #endif
1322 			return (size_t)*(double *)value;
1323 	}
1324 	return 0;
1325 }
1326 /* }}} */
1327 
1328 /* {{{ struct image_info_value, image_info_list
1329 */
1330 #ifndef WORD
1331 #define WORD unsigned short
1332 #endif
1333 #ifndef DWORD
1334 #define DWORD unsigned int
1335 #endif
1336 
1337 typedef struct {
1338 	int             num;
1339 	int             den;
1340 } signed_rational;
1341 
1342 typedef struct {
1343 	unsigned int    num;
1344 	unsigned int    den;
1345 } unsigned_rational;
1346 
1347 typedef union _image_info_value {
1348 	char 				*s;
1349 	unsigned            u;
1350 	int 				i;
1351 	float               f;
1352 	double              d;
1353 	signed_rational 	sr;
1354 	unsigned_rational 	ur;
1355 	union _image_info_value   *list;
1356 } image_info_value;
1357 
1358 typedef struct {
1359 	WORD                tag;
1360 	WORD                format;
1361 	DWORD               length;
1362 	DWORD               dummy;  /* value ptr of tiff directory entry */
1363 	char 				*name;
1364 	image_info_value    value;
1365 } image_info_data;
1366 
1367 typedef struct {
1368 	int                 count;
1369 	image_info_data 	*list;
1370 } image_info_list;
1371 /* }}} */
1372 
1373 /* {{{ exif_get_sectionname
1374  Returns the name of a section
1375 */
1376 #define SECTION_FILE        0
1377 #define SECTION_COMPUTED    1
1378 #define SECTION_ANY_TAG     2
1379 #define SECTION_IFD0        3
1380 #define SECTION_THUMBNAIL   4
1381 #define SECTION_COMMENT     5
1382 #define SECTION_APP0        6
1383 #define SECTION_EXIF        7
1384 #define SECTION_FPIX        8
1385 #define SECTION_GPS         9
1386 #define SECTION_INTEROP     10
1387 #define SECTION_APP12       11
1388 #define SECTION_WINXP       12
1389 #define SECTION_MAKERNOTE   13
1390 #define SECTION_COUNT       14
1391 
1392 #define FOUND_FILE          (1<<SECTION_FILE)
1393 #define FOUND_COMPUTED      (1<<SECTION_COMPUTED)
1394 #define FOUND_ANY_TAG       (1<<SECTION_ANY_TAG)
1395 #define FOUND_IFD0          (1<<SECTION_IFD0)
1396 #define FOUND_THUMBNAIL     (1<<SECTION_THUMBNAIL)
1397 #define FOUND_COMMENT       (1<<SECTION_COMMENT)
1398 #define FOUND_APP0          (1<<SECTION_APP0)
1399 #define FOUND_EXIF          (1<<SECTION_EXIF)
1400 #define FOUND_FPIX          (1<<SECTION_FPIX)
1401 #define FOUND_GPS           (1<<SECTION_GPS)
1402 #define FOUND_INTEROP       (1<<SECTION_INTEROP)
1403 #define FOUND_APP12         (1<<SECTION_APP12)
1404 #define FOUND_WINXP         (1<<SECTION_WINXP)
1405 #define FOUND_MAKERNOTE     (1<<SECTION_MAKERNOTE)
1406 
exif_get_sectionname(int section)1407 static char *exif_get_sectionname(int section)
1408 {
1409 	switch(section) {
1410 		case SECTION_FILE:      return "FILE";
1411 		case SECTION_COMPUTED:  return "COMPUTED";
1412 		case SECTION_ANY_TAG:   return "ANY_TAG";
1413 		case SECTION_IFD0:      return "IFD0";
1414 		case SECTION_THUMBNAIL: return "THUMBNAIL";
1415 		case SECTION_COMMENT:   return "COMMENT";
1416 		case SECTION_APP0:      return "APP0";
1417 		case SECTION_EXIF:      return "EXIF";
1418 		case SECTION_FPIX:      return "FPIX";
1419 		case SECTION_GPS:       return "GPS";
1420 		case SECTION_INTEROP:   return "INTEROP";
1421 		case SECTION_APP12:     return "APP12";
1422 		case SECTION_WINXP:     return "WINXP";
1423 		case SECTION_MAKERNOTE: return "MAKERNOTE";
1424 	}
1425 	return "";
1426 }
1427 
exif_get_tag_table(int section)1428 static tag_table_type exif_get_tag_table(int section)
1429 {
1430 	switch(section) {
1431 		case SECTION_FILE:      return &tag_table_IFD[0];
1432 		case SECTION_COMPUTED:  return &tag_table_IFD[0];
1433 		case SECTION_ANY_TAG:   return &tag_table_IFD[0];
1434 		case SECTION_IFD0:      return &tag_table_IFD[0];
1435 		case SECTION_THUMBNAIL: return &tag_table_IFD[0];
1436 		case SECTION_COMMENT:   return &tag_table_IFD[0];
1437 		case SECTION_APP0:      return &tag_table_IFD[0];
1438 		case SECTION_EXIF:      return &tag_table_IFD[0];
1439 		case SECTION_FPIX:      return &tag_table_IFD[0];
1440 		case SECTION_GPS:       return &tag_table_GPS[0];
1441 		case SECTION_INTEROP:   return &tag_table_IOP[0];
1442 		case SECTION_APP12:     return &tag_table_IFD[0];
1443 		case SECTION_WINXP:     return &tag_table_IFD[0];
1444 	}
1445 	return &tag_table_IFD[0];
1446 }
1447 /* }}} */
1448 
1449 /* {{{ exif_get_sectionlist
1450    Return list of sectionnames specified by sectionlist. Return value must be freed
1451 */
exif_get_sectionlist(int sectionlist TSRMLS_DC)1452 static char *exif_get_sectionlist(int sectionlist TSRMLS_DC)
1453 {
1454 	int i, len, ml = 0;
1455 	char *sections;
1456 
1457 	for(i=0; i<SECTION_COUNT; i++) {
1458 		ml += strlen(exif_get_sectionname(i))+2;
1459 	}
1460 	sections = safe_emalloc(ml, 1, 1);
1461 	sections[0] = '\0';
1462 	len = 0;
1463 	for(i=0; i<SECTION_COUNT; i++) {
1464 		if (sectionlist&(1<<i)) {
1465 			snprintf(sections+len, ml-len, "%s, ", exif_get_sectionname(i));
1466 			len = strlen(sections);
1467 		}
1468 	}
1469 	if (len>2)
1470 		sections[len-2] = '\0';
1471 	return sections;
1472 }
1473 /* }}} */
1474 
1475 /* {{{ struct image_info_type
1476    This structure stores Exif header image elements in a simple manner
1477    Used to store camera data as extracted from the various ways that it can be
1478    stored in a nexif header
1479 */
1480 
1481 typedef struct {
1482 	int     type;
1483 	size_t  size;
1484 	uchar   *data;
1485 } file_section;
1486 
1487 typedef struct {
1488 	int             count;
1489 	file_section    *list;
1490 } file_section_list;
1491 
1492 typedef struct {
1493 	image_filetype  filetype;
1494 	size_t          width, height;
1495 	size_t          size;
1496 	size_t          offset;
1497 	char 	        *data;
1498 } thumbnail_data;
1499 
1500 typedef struct {
1501 	char			*value;
1502 	size_t			size;
1503 	int				tag;
1504 } xp_field_type;
1505 
1506 typedef struct {
1507 	int             count;
1508 	xp_field_type   *list;
1509 } xp_field_list;
1510 
1511 /* This structure is used to store a section of a Jpeg file. */
1512 typedef struct {
1513 	php_stream      *infile;
1514 	char            *FileName;
1515 	time_t          FileDateTime;
1516 	size_t          FileSize;
1517 	image_filetype  FileType;
1518 	int             Height, Width;
1519 	int             IsColor;
1520 
1521 	char            *make;
1522 	char            *model;
1523 
1524 	float           ApertureFNumber;
1525 	float           ExposureTime;
1526 	double          FocalplaneUnits;
1527 	float           CCDWidth;
1528 	double          FocalplaneXRes;
1529 	size_t          ExifImageWidth;
1530 	float           FocalLength;
1531 	float           Distance;
1532 
1533 	int             motorola_intel; /* 1 Motorola; 0 Intel */
1534 
1535 	char            *UserComment;
1536 	int             UserCommentLength;
1537 	char            *UserCommentEncoding;
1538 	char            *encode_unicode;
1539 	char            *decode_unicode_be;
1540 	char            *decode_unicode_le;
1541 	char            *encode_jis;
1542 	char            *decode_jis_be;
1543 	char            *decode_jis_le;
1544 	char            *Copyright;/* EXIF standard defines Copyright as "<Photographer> [ '\0' <Editor> ] ['\0']" */
1545 	char            *CopyrightPhotographer;
1546 	char            *CopyrightEditor;
1547 
1548 	xp_field_list   xp_fields;
1549 
1550 	thumbnail_data  Thumbnail;
1551 	/* other */
1552 	int             sections_found; /* FOUND_<marker> */
1553 	image_info_list info_list[SECTION_COUNT];
1554 	/* for parsing */
1555 	int             read_thumbnail;
1556 	int             read_all;
1557 	int             ifd_nesting_level;
1558 	/* internal */
1559 	file_section_list 	file;
1560 } image_info_type;
1561 /* }}} */
1562 
1563 /* {{{ exif_error_docref */
exif_error_docref(const char * docref EXIFERR_DC,const image_info_type * ImageInfo,int type,const char * format,...)1564 static void exif_error_docref(const char *docref EXIFERR_DC, const image_info_type *ImageInfo, int type, const char *format, ...)
1565 {
1566 	va_list args;
1567 
1568 	va_start(args, format);
1569 #ifdef EXIF_DEBUG
1570 	{
1571 		char *buf;
1572 
1573 		spprintf(&buf, 0, "%s(%d): %s", _file, _line, format);
1574 		php_verror(docref, ImageInfo->FileName?ImageInfo->FileName:"", type, buf, args TSRMLS_CC);
1575 		efree(buf);
1576 	}
1577 #else
1578 	php_verror(docref, ImageInfo->FileName?ImageInfo->FileName:"", type, format, args TSRMLS_CC);
1579 #endif
1580 	va_end(args);
1581 }
1582 /* }}} */
1583 
1584 /* {{{ jpeg_sof_info
1585  */
1586 typedef struct {
1587 	int     bits_per_sample;
1588 	size_t  width;
1589 	size_t  height;
1590 	int     num_components;
1591 } jpeg_sof_info;
1592 /* }}} */
1593 
1594 /* {{{ exif_file_sections_add
1595  Add a file_section to image_info
1596  returns the used block or -1. if size>0 and data == NULL buffer of size is allocated
1597 */
exif_file_sections_add(image_info_type * ImageInfo,int type,size_t size,uchar * data)1598 static int exif_file_sections_add(image_info_type *ImageInfo, int type, size_t size, uchar *data)
1599 {
1600 	file_section    *tmp;
1601 	int             count = ImageInfo->file.count;
1602 
1603 	tmp = safe_erealloc(ImageInfo->file.list, (count+1), sizeof(file_section), 0);
1604 	ImageInfo->file.list = tmp;
1605 	ImageInfo->file.list[count].type = 0xFFFF;
1606 	ImageInfo->file.list[count].data = NULL;
1607 	ImageInfo->file.list[count].size = 0;
1608 	ImageInfo->file.count = count+1;
1609 	if (!size) {
1610 		data = NULL;
1611 	} else if (data == NULL) {
1612 		data = safe_emalloc(size, 1, 0);
1613 	}
1614 	ImageInfo->file.list[count].type = type;
1615 	ImageInfo->file.list[count].data = data;
1616 	ImageInfo->file.list[count].size = size;
1617 	return count;
1618 }
1619 /* }}} */
1620 
1621 /* {{{ exif_file_sections_realloc
1622  Reallocate a file section returns 0 on success and -1 on failure
1623 */
exif_file_sections_realloc(image_info_type * ImageInfo,int section_index,size_t size TSRMLS_DC)1624 static int exif_file_sections_realloc(image_info_type *ImageInfo, int section_index, size_t size TSRMLS_DC)
1625 {
1626 	void *tmp;
1627 
1628 	/* This is not a malloc/realloc check. It is a plausibility check for the
1629 	 * function parameters (requirements engineering).
1630 	 */
1631 	if (section_index >= ImageInfo->file.count) {
1632 		EXIF_ERRLOG_FSREALLOC(ImageInfo)
1633 		return -1;
1634 	}
1635 	tmp = safe_erealloc(ImageInfo->file.list[section_index].data, 1, size, 0);
1636 	ImageInfo->file.list[section_index].data = tmp;
1637 	ImageInfo->file.list[section_index].size = size;
1638 	return 0;
1639 }
1640 /* }}} */
1641 
1642 /* {{{ exif_file_section_free
1643    Discard all file_sections in ImageInfo
1644 */
exif_file_sections_free(image_info_type * ImageInfo)1645 static int exif_file_sections_free(image_info_type *ImageInfo)
1646 {
1647 	int i;
1648 
1649 	if (ImageInfo->file.count) {
1650 		for (i=0; i<ImageInfo->file.count; i++) {
1651 			EFREE_IF(ImageInfo->file.list[i].data);
1652 		}
1653 	}
1654 	EFREE_IF(ImageInfo->file.list);
1655 	ImageInfo->file.count = 0;
1656 	return TRUE;
1657 }
1658 /* }}} */
1659 
1660 /* {{{ exif_iif_add_value
1661  Add a value to image_info
1662 */
exif_iif_add_value(image_info_type * image_info,int section_index,char * name,int tag,int format,int length,void * value,int motorola_intel TSRMLS_DC)1663 static void exif_iif_add_value(image_info_type *image_info, int section_index, char *name, int tag, int format, int length, void* value, int motorola_intel TSRMLS_DC)
1664 {
1665 	size_t idex;
1666 	void *vptr;
1667 	image_info_value *info_value;
1668 	image_info_data  *info_data;
1669 	image_info_data  *list;
1670 
1671 	if (length < 0) {
1672 		return;
1673 	}
1674 
1675 	list = safe_erealloc(image_info->info_list[section_index].list, (image_info->info_list[section_index].count+1), sizeof(image_info_data), 0);
1676 	image_info->info_list[section_index].list = list;
1677 
1678 	info_data  = &image_info->info_list[section_index].list[image_info->info_list[section_index].count];
1679 	memset(info_data, 0, sizeof(image_info_data));
1680 	info_data->tag    = tag;
1681 	info_data->format = format;
1682 	info_data->length = length;
1683 	info_data->name   = estrdup(name);
1684 	info_value        = &info_data->value;
1685 
1686 	switch (format) {
1687 		case TAG_FMT_STRING:
1688 			if (value) {
1689 				length = php_strnlen(value, length);
1690 				info_value->s = estrndup(value, length);
1691 				info_data->length = length;
1692 			} else {
1693 				info_data->length = 0;
1694 				info_value->s = estrdup("");
1695 			}
1696 			break;
1697 
1698 		default:
1699 			/* Standard says more types possible but skip them...
1700 			 * but allow users to handle data if they know how to
1701 			 * So not return but use type UNDEFINED
1702 			 * return;
1703 			 */
1704 			info_data->tag = TAG_FMT_UNDEFINED;/* otherwise not freed from memory */
1705 		case TAG_FMT_SBYTE:
1706 		case TAG_FMT_BYTE:
1707 		/* in contrast to strings bytes do not need to allocate buffer for NULL if length==0 */
1708 			if (!length)
1709 				break;
1710 		case TAG_FMT_UNDEFINED:
1711 			if (value) {
1712 				if (tag == TAG_MAKER_NOTE) {
1713 					length = (int) php_strnlen(value, length);
1714 				}
1715 
1716 				/* do not recompute length here */
1717 				info_value->s = estrndup(value, length);
1718 				info_data->length = length;
1719 			} else {
1720 				info_data->length = 0;
1721 				info_value->s = estrdup("");
1722 			}
1723 			break;
1724 
1725 		case TAG_FMT_USHORT:
1726 		case TAG_FMT_ULONG:
1727 		case TAG_FMT_URATIONAL:
1728 		case TAG_FMT_SSHORT:
1729 		case TAG_FMT_SLONG:
1730 		case TAG_FMT_SRATIONAL:
1731 		case TAG_FMT_SINGLE:
1732 		case TAG_FMT_DOUBLE:
1733 			if (length==0) {
1734 				break;
1735 			} else
1736 			if (length>1) {
1737 				info_value->list = safe_emalloc(length, sizeof(image_info_value), 0);
1738 			} else {
1739 				info_value = &info_data->value;
1740 			}
1741 			for (idex=0,vptr=value; idex<(size_t)length; idex++,vptr=(char *) vptr + php_tiff_bytes_per_format[format]) {
1742 				if (length>1) {
1743 					info_value = &info_data->value.list[idex];
1744 				}
1745 				switch (format) {
1746 					case TAG_FMT_USHORT:
1747 						info_value->u = php_ifd_get16u(vptr, motorola_intel);
1748 						break;
1749 
1750 					case TAG_FMT_ULONG:
1751 						info_value->u = php_ifd_get32u(vptr, motorola_intel);
1752 						break;
1753 
1754 					case TAG_FMT_URATIONAL:
1755 						info_value->ur.num = php_ifd_get32u(vptr, motorola_intel);
1756 						info_value->ur.den = php_ifd_get32u(4+(char *)vptr, motorola_intel);
1757 						break;
1758 
1759 					case TAG_FMT_SSHORT:
1760 						info_value->i = php_ifd_get16s(vptr, motorola_intel);
1761 						break;
1762 
1763 					case TAG_FMT_SLONG:
1764 						info_value->i = php_ifd_get32s(vptr, motorola_intel);
1765 						break;
1766 
1767 					case TAG_FMT_SRATIONAL:
1768 						info_value->sr.num = php_ifd_get32u(vptr, motorola_intel);
1769 						info_value->sr.den = php_ifd_get32u(4+(char *)vptr, motorola_intel);
1770 						break;
1771 
1772 					case TAG_FMT_SINGLE:
1773 #ifdef EXIF_DEBUG
1774 						php_error_docref(NULL TSRMLS_CC, E_WARNING, "Found value of type single");
1775 #endif
1776 						info_value->f = *(float *)value;
1777 
1778 					case TAG_FMT_DOUBLE:
1779 #ifdef EXIF_DEBUG
1780 						php_error_docref(NULL TSRMLS_CC, E_WARNING, "Found value of type double");
1781 #endif
1782 						info_value->d = *(double *)value;
1783 						break;
1784 				}
1785 			}
1786 	}
1787 	image_info->sections_found |= 1<<section_index;
1788 	image_info->info_list[section_index].count++;
1789 }
1790 /* }}} */
1791 
1792 /* {{{ exif_iif_add_tag
1793  Add a tag from IFD to image_info
1794 */
exif_iif_add_tag(image_info_type * image_info,int section_index,char * name,int tag,int format,size_t length,void * value TSRMLS_DC)1795 static void exif_iif_add_tag(image_info_type *image_info, int section_index, char *name, int tag, int format, size_t length, void* value TSRMLS_DC)
1796 {
1797 	exif_iif_add_value(image_info, section_index, name, tag, format, (int)length, value, image_info->motorola_intel TSRMLS_CC);
1798 }
1799 /* }}} */
1800 
1801 /* {{{ exif_iif_add_int
1802  Add an int value to image_info
1803 */
exif_iif_add_int(image_info_type * image_info,int section_index,char * name,int value TSRMLS_DC)1804 static void exif_iif_add_int(image_info_type *image_info, int section_index, char *name, int value TSRMLS_DC)
1805 {
1806 	image_info_data  *info_data;
1807 	image_info_data  *list;
1808 
1809 	list = safe_erealloc(image_info->info_list[section_index].list, (image_info->info_list[section_index].count+1), sizeof(image_info_data), 0);
1810 	image_info->info_list[section_index].list = list;
1811 
1812 	info_data  = &image_info->info_list[section_index].list[image_info->info_list[section_index].count];
1813 	info_data->tag    = TAG_NONE;
1814 	info_data->format = TAG_FMT_SLONG;
1815 	info_data->length = 1;
1816 	info_data->name   = estrdup(name);
1817 	info_data->value.i = value;
1818 	image_info->sections_found |= 1<<section_index;
1819 	image_info->info_list[section_index].count++;
1820 }
1821 /* }}} */
1822 
1823 /* {{{ exif_iif_add_str
1824  Add a string value to image_info MUST BE NUL TERMINATED
1825 */
exif_iif_add_str(image_info_type * image_info,int section_index,char * name,char * value TSRMLS_DC)1826 static void exif_iif_add_str(image_info_type *image_info, int section_index, char *name, char *value TSRMLS_DC)
1827 {
1828 	image_info_data  *info_data;
1829 	image_info_data  *list;
1830 
1831 	if (value) {
1832 		list = safe_erealloc(image_info->info_list[section_index].list, (image_info->info_list[section_index].count+1), sizeof(image_info_data), 0);
1833 		image_info->info_list[section_index].list = list;
1834 		info_data  = &image_info->info_list[section_index].list[image_info->info_list[section_index].count];
1835 		info_data->tag    = TAG_NONE;
1836 		info_data->format = TAG_FMT_STRING;
1837 		info_data->length = 1;
1838 		info_data->name   = estrdup(name);
1839 		info_data->value.s = estrdup(value);
1840 		image_info->sections_found |= 1<<section_index;
1841 		image_info->info_list[section_index].count++;
1842 	}
1843 }
1844 /* }}} */
1845 
1846 /* {{{ exif_iif_add_fmt
1847  Add a format string value to image_info MUST BE NUL TERMINATED
1848 */
exif_iif_add_fmt(image_info_type * image_info,int section_index,char * name TSRMLS_DC,char * value,...)1849 static void exif_iif_add_fmt(image_info_type *image_info, int section_index, char *name TSRMLS_DC, char *value, ...)
1850 {
1851 	char             *tmp;
1852 	va_list 		 arglist;
1853 
1854 	va_start(arglist, value);
1855 	if (value) {
1856 		vspprintf(&tmp, 0, value, arglist);
1857 		exif_iif_add_str(image_info, section_index, name, tmp TSRMLS_CC);
1858 		efree(tmp);
1859 	}
1860 	va_end(arglist);
1861 }
1862 /* }}} */
1863 
1864 /* {{{ exif_iif_add_str
1865  Add a string value to image_info MUST BE NUL TERMINATED
1866 */
exif_iif_add_buffer(image_info_type * image_info,int section_index,char * name,int length,char * value TSRMLS_DC)1867 static void exif_iif_add_buffer(image_info_type *image_info, int section_index, char *name, int length, char *value TSRMLS_DC)
1868 {
1869 	image_info_data  *info_data;
1870 	image_info_data  *list;
1871 
1872 	if (value) {
1873 		list = safe_erealloc(image_info->info_list[section_index].list, (image_info->info_list[section_index].count+1), sizeof(image_info_data), 0);
1874 		image_info->info_list[section_index].list = list;
1875 		info_data  = &image_info->info_list[section_index].list[image_info->info_list[section_index].count];
1876 		info_data->tag    = TAG_NONE;
1877 		info_data->format = TAG_FMT_UNDEFINED;
1878 		info_data->length = length;
1879 		info_data->name   = estrdup(name);
1880 		info_data->value.s = safe_emalloc(length, 1, 1);
1881 		memcpy(info_data->value.s, value, length);
1882 		info_data->value.s[length] = 0;
1883 		image_info->sections_found |= 1<<section_index;
1884 		image_info->info_list[section_index].count++;
1885 	}
1886 }
1887 /* }}} */
1888 
1889 /* {{{ exif_iif_free
1890  Free memory allocated for image_info
1891 */
exif_iif_free(image_info_type * image_info,int section_index)1892 static void exif_iif_free(image_info_type *image_info, int section_index) {
1893 	int  i;
1894 	void *f; /* faster */
1895 
1896 	if (image_info->info_list[section_index].count) {
1897 		for (i=0; i < image_info->info_list[section_index].count; i++) {
1898 			if ((f=image_info->info_list[section_index].list[i].name) != NULL) {
1899 				efree(f);
1900 			}
1901 			switch(image_info->info_list[section_index].list[i].format) {
1902 				case TAG_FMT_SBYTE:
1903 				case TAG_FMT_BYTE:
1904 					/* in contrast to strings bytes do not need to allocate buffer for NULL if length==0 */
1905 					if (image_info->info_list[section_index].list[i].length<1)
1906 						break;
1907 				default:
1908 				case TAG_FMT_UNDEFINED:
1909 				case TAG_FMT_STRING:
1910 					if ((f=image_info->info_list[section_index].list[i].value.s) != NULL) {
1911 						efree(f);
1912 					}
1913 					break;
1914 
1915 				case TAG_FMT_USHORT:
1916 				case TAG_FMT_ULONG:
1917 				case TAG_FMT_URATIONAL:
1918 				case TAG_FMT_SSHORT:
1919 				case TAG_FMT_SLONG:
1920 				case TAG_FMT_SRATIONAL:
1921 				case TAG_FMT_SINGLE:
1922 				case TAG_FMT_DOUBLE:
1923 					/* nothing to do here */
1924 					if (image_info->info_list[section_index].list[i].length > 1) {
1925 						if ((f=image_info->info_list[section_index].list[i].value.list) != NULL) {
1926 							efree(f);
1927 						}
1928 					}
1929 					break;
1930 			}
1931 		}
1932 	}
1933 	EFREE_IF(image_info->info_list[section_index].list);
1934 }
1935 /* }}} */
1936 
1937 /* {{{ add_assoc_image_info
1938  * Add image_info to associative array value. */
add_assoc_image_info(zval * value,int sub_array,image_info_type * image_info,int section_index TSRMLS_DC)1939 static void add_assoc_image_info(zval *value, int sub_array, image_info_type *image_info, int section_index TSRMLS_DC)
1940 {
1941 	char    buffer[64], *val, *name, uname[64];
1942 	int     i, ap, l, b, idx=0, unknown=0;
1943 #ifdef EXIF_DEBUG
1944 	int     info_tag;
1945 #endif
1946 	image_info_value *info_value;
1947 	image_info_data  *info_data;
1948 	zval 			 *tmpi, *array = NULL;
1949 
1950 #ifdef EXIF_DEBUG
1951 /*		php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Adding %d infos from section %s", image_info->info_list[section_index].count, exif_get_sectionname(section_index));*/
1952 #endif
1953 	if (image_info->info_list[section_index].count) {
1954 		if (sub_array) {
1955 			MAKE_STD_ZVAL(tmpi);
1956 			array_init(tmpi);
1957 		} else {
1958 			tmpi = value;
1959 		}
1960 
1961 		for(i=0; i<image_info->info_list[section_index].count; i++) {
1962 			info_data  = &image_info->info_list[section_index].list[i];
1963 #ifdef EXIF_DEBUG
1964 			info_tag   = info_data->tag; /* conversion */
1965 #endif
1966 			info_value = &info_data->value;
1967 			if (!(name = info_data->name)) {
1968 				snprintf(uname, sizeof(uname), "%d", unknown++);
1969 				name = uname;
1970 			}
1971 #ifdef EXIF_DEBUG
1972 /*		php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Adding infos: tag(0x%04X,%12s,L=0x%04X): %s", info_tag, exif_get_tagname(info_tag, buffer, -12, exif_get_tag_table(section_index) TSRMLS_CC), info_data->length, info_data->format==TAG_FMT_STRING?(info_value&&info_value->s?info_value->s:"<no data>"):exif_get_tagformat(info_data->format));*/
1973 #endif
1974 			if (info_data->length==0) {
1975 				add_assoc_null(tmpi, name);
1976 			} else {
1977 				switch (info_data->format) {
1978 					default:
1979 						/* Standard says more types possible but skip them...
1980 						 * but allow users to handle data if they know how to
1981 						 * So not return but use type UNDEFINED
1982 						 * return;
1983 						 */
1984 					case TAG_FMT_BYTE:
1985 					case TAG_FMT_SBYTE:
1986 					case TAG_FMT_UNDEFINED:
1987 						if (!info_value->s) {
1988 							add_assoc_stringl(tmpi, name, "", 0, 1);
1989 						} else {
1990 							add_assoc_stringl(tmpi, name, info_value->s, info_data->length, 1);
1991 						}
1992 						break;
1993 
1994 					case TAG_FMT_STRING:
1995 						if (!(val = info_value->s)) {
1996 							val = "";
1997 						}
1998 						if (section_index==SECTION_COMMENT) {
1999 							add_index_string(tmpi, idx++, val, 1);
2000 						} else {
2001 							add_assoc_string(tmpi, name, val, 1);
2002 						}
2003 						break;
2004 
2005 					case TAG_FMT_URATIONAL:
2006 					case TAG_FMT_SRATIONAL:
2007 					/*case TAG_FMT_BYTE:
2008 					case TAG_FMT_SBYTE:*/
2009 					case TAG_FMT_USHORT:
2010 					case TAG_FMT_SSHORT:
2011 					case TAG_FMT_SINGLE:
2012 					case TAG_FMT_DOUBLE:
2013 					case TAG_FMT_ULONG:
2014 					case TAG_FMT_SLONG:
2015 						/* now the rest, first see if it becomes an array */
2016 						if ((l = info_data->length) > 1) {
2017 							array = NULL;
2018 							MAKE_STD_ZVAL(array);
2019 							array_init(array);
2020 						}
2021 						for(ap=0; ap<l; ap++) {
2022 							if (l>1) {
2023 								info_value = &info_data->value.list[ap];
2024 							}
2025 							switch (info_data->format) {
2026 								case TAG_FMT_BYTE:
2027 									if (l>1) {
2028 										info_value = &info_data->value;
2029 										for (b=0;b<l;b++) {
2030 											add_index_long(array, b, (int)(info_value->s[b]));
2031 										}
2032 										break;
2033 									}
2034 								case TAG_FMT_USHORT:
2035 								case TAG_FMT_ULONG:
2036 									if (l==1) {
2037 										add_assoc_long(tmpi, name, (int)info_value->u);
2038 									} else {
2039 										add_index_long(array, ap, (int)info_value->u);
2040 									}
2041 									break;
2042 
2043 								case TAG_FMT_URATIONAL:
2044 									snprintf(buffer, sizeof(buffer), "%i/%i", info_value->ur.num, info_value->ur.den);
2045 									if (l==1) {
2046 										add_assoc_string(tmpi, name, buffer, 1);
2047 									} else {
2048 										add_index_string(array, ap, buffer, 1);
2049 									}
2050 									break;
2051 
2052 								case TAG_FMT_SBYTE:
2053 									if (l>1) {
2054 										info_value = &info_data->value;
2055 										for (b=0;b<l;b++) {
2056 											add_index_long(array, ap, (int)info_value->s[b]);
2057 										}
2058 										break;
2059 									}
2060 								case TAG_FMT_SSHORT:
2061 								case TAG_FMT_SLONG:
2062 									if (l==1) {
2063 										add_assoc_long(tmpi, name, info_value->i);
2064 									} else {
2065 										add_index_long(array, ap, info_value->i);
2066 									}
2067 									break;
2068 
2069 								case TAG_FMT_SRATIONAL:
2070 									snprintf(buffer, sizeof(buffer), "%i/%i", info_value->sr.num, info_value->sr.den);
2071 									if (l==1) {
2072 										add_assoc_string(tmpi, name, buffer, 1);
2073 									} else {
2074 										add_index_string(array, ap, buffer, 1);
2075 									}
2076 									break;
2077 
2078 								case TAG_FMT_SINGLE:
2079 									if (l==1) {
2080 										add_assoc_double(tmpi, name, info_value->f);
2081 									} else {
2082 										add_index_double(array, ap, info_value->f);
2083 									}
2084 									break;
2085 
2086 								case TAG_FMT_DOUBLE:
2087 									if (l==1) {
2088 										add_assoc_double(tmpi, name, info_value->d);
2089 									} else {
2090 										add_index_double(array, ap, info_value->d);
2091 									}
2092 									break;
2093 							}
2094 							info_value = &info_data->value.list[ap];
2095 						}
2096 						if (l>1) {
2097 							add_assoc_zval(tmpi, name, array);
2098 						}
2099 						break;
2100 				}
2101 			}
2102 		}
2103 		if (sub_array) {
2104 			add_assoc_zval(value, exif_get_sectionname(section_index), tmpi);
2105 		}
2106 	}
2107 }
2108 /* }}} */
2109 
2110 /* {{{ Markers
2111    JPEG markers consist of one or more 0xFF bytes, followed by a marker
2112    code byte (which is not an FF).  Here are the marker codes of interest
2113    in this program.  (See jdmarker.c for a more complete list.)
2114 */
2115 
2116 #define M_TEM   0x01    /* temp for arithmetic coding              */
2117 #define M_RES   0x02    /* reserved                                */
2118 #define M_SOF0  0xC0    /* Start Of Frame N                        */
2119 #define M_SOF1  0xC1    /* N indicates which compression process   */
2120 #define M_SOF2  0xC2    /* Only SOF0-SOF2 are now in common use    */
2121 #define M_SOF3  0xC3
2122 #define M_DHT   0xC4
2123 #define M_SOF5  0xC5    /* NB: codes C4 and CC are NOT SOF markers */
2124 #define M_SOF6  0xC6
2125 #define M_SOF7  0xC7
2126 #define M_JPEG  0x08    /* reserved for extensions                 */
2127 #define M_SOF9  0xC9
2128 #define M_SOF10 0xCA
2129 #define M_SOF11 0xCB
2130 #define M_DAC   0xCC    /* arithmetic table                         */
2131 #define M_SOF13 0xCD
2132 #define M_SOF14 0xCE
2133 #define M_SOF15 0xCF
2134 #define M_RST0  0xD0    /* restart segment                          */
2135 #define M_RST1  0xD1
2136 #define M_RST2  0xD2
2137 #define M_RST3  0xD3
2138 #define M_RST4  0xD4
2139 #define M_RST5  0xD5
2140 #define M_RST6  0xD6
2141 #define M_RST7  0xD7
2142 #define M_SOI   0xD8    /* Start Of Image (beginning of datastream) */
2143 #define M_EOI   0xD9    /* End Of Image (end of datastream)         */
2144 #define M_SOS   0xDA    /* Start Of Scan (begins compressed data)   */
2145 #define M_DQT   0xDB
2146 #define M_DNL   0xDC
2147 #define M_DRI   0xDD
2148 #define M_DHP   0xDE
2149 #define M_EXP   0xDF
2150 #define M_APP0  0xE0    /* JPEG: 'JFIFF' AND (additional 'JFXX')    */
2151 #define M_EXIF  0xE1    /* Exif Attribute Information               */
2152 #define M_APP2  0xE2    /* Flash Pix Extension Data?                */
2153 #define M_APP3  0xE3
2154 #define M_APP4  0xE4
2155 #define M_APP5  0xE5
2156 #define M_APP6  0xE6
2157 #define M_APP7  0xE7
2158 #define M_APP8  0xE8
2159 #define M_APP9  0xE9
2160 #define M_APP10 0xEA
2161 #define M_APP11 0xEB
2162 #define M_APP12 0xEC
2163 #define M_APP13 0xED    /* IPTC International Press Telecommunications Council */
2164 #define M_APP14 0xEE    /* Software, Copyright?                     */
2165 #define M_APP15 0xEF
2166 #define M_JPG0  0xF0
2167 #define M_JPG1  0xF1
2168 #define M_JPG2  0xF2
2169 #define M_JPG3  0xF3
2170 #define M_JPG4  0xF4
2171 #define M_JPG5  0xF5
2172 #define M_JPG6  0xF6
2173 #define M_JPG7  0xF7
2174 #define M_JPG8  0xF8
2175 #define M_JPG9  0xF9
2176 #define M_JPG10 0xFA
2177 #define M_JPG11 0xFB
2178 #define M_JPG12 0xFC
2179 #define M_JPG13 0xFD
2180 #define M_COM   0xFE    /* COMment                                  */
2181 
2182 #define M_PSEUDO 0x123 	/* Extra value.                             */
2183 
2184 /* }}} */
2185 
2186 /* {{{ jpeg2000 markers
2187  */
2188 /* Markers x30 - x3F do not have a segment */
2189 /* Markers x00, x01, xFE, xC0 - xDF ISO/IEC 10918-1 -> M_<xx> */
2190 /* Markers xF0 - xF7 ISO/IEC 10918-3 */
2191 /* Markers xF7 - xF8 ISO/IEC 14495-1 */
2192 /* XY=Main/Tile-header:(R:required, N:not_allowed, O:optional, L:last_marker) */
2193 #define JC_SOC   0x4F   /* NN, Start of codestream                          */
2194 #define JC_SIZ   0x51   /* RN, Image and tile size                          */
2195 #define JC_COD   0x52   /* RO, Codeing style defaulte                       */
2196 #define JC_COC   0x53   /* OO, Coding style component                       */
2197 #define JC_TLM   0x55   /* ON, Tile part length main header                 */
2198 #define JC_PLM   0x57   /* ON, Packet length main header                    */
2199 #define JC_PLT   0x58   /* NO, Packet length tile part header               */
2200 #define JC_QCD   0x5C   /* RO, Quantization default                         */
2201 #define JC_QCC   0x5D   /* OO, Quantization component                       */
2202 #define JC_RGN   0x5E   /* OO, Region of interest                           */
2203 #define JC_POD   0x5F   /* OO, Progression order default                    */
2204 #define JC_PPM   0x60   /* ON, Packed packet headers main header            */
2205 #define JC_PPT   0x61   /* NO, Packet packet headers tile part header       */
2206 #define JC_CME   0x64   /* OO, Comment: "LL E <text>" E=0:binary, E=1:ascii */
2207 #define JC_SOT   0x90   /* NR, Start of tile                                */
2208 #define JC_SOP   0x91   /* NO, Start of packeter default                    */
2209 #define JC_EPH   0x92   /* NO, End of packet header                         */
2210 #define JC_SOD   0x93   /* NL, Start of data                                */
2211 #define JC_EOC   0xD9   /* NN, End of codestream                            */
2212 /* }}} */
2213 
2214 /* {{{ exif_process_COM
2215    Process a COM marker.
2216    We want to print out the marker contents as legible text;
2217    we must guard against random junk and varying newline representations.
2218 */
exif_process_COM(image_info_type * image_info,char * value,size_t length TSRMLS_DC)2219 static void exif_process_COM (image_info_type *image_info, char *value, size_t length TSRMLS_DC)
2220 {
2221 	exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_STRING, length-2, value+2 TSRMLS_CC);
2222 }
2223 /* }}} */
2224 
2225 /* {{{ exif_process_CME
2226    Process a CME marker.
2227    We want to print out the marker contents as legible text;
2228    we must guard against random junk and varying newline representations.
2229 */
2230 #ifdef EXIF_JPEG2000
exif_process_CME(image_info_type * image_info,char * value,size_t length TSRMLS_DC)2231 static void exif_process_CME (image_info_type *image_info, char *value, size_t length TSRMLS_DC)
2232 {
2233 	if (length>3) {
2234 		switch(value[2]) {
2235 			case 0:
2236 				exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_UNDEFINED, length, value TSRMLS_CC);
2237 				break;
2238 			case 1:
2239 				exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_STRING, length, value);
2240 				break;
2241 			default:
2242 				php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Undefined JPEG2000 comment encoding");
2243 				break;
2244 		}
2245 	} else {
2246 		exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_UNDEFINED, 0, NULL);
2247 		php_error_docref(NULL TSRMLS_CC, E_NOTICE, "JPEG2000 comment section too small");
2248 	}
2249 }
2250 #endif
2251 /* }}} */
2252 
2253 /* {{{ exif_process_SOFn
2254  * Process a SOFn marker.  This is useful for the image dimensions */
exif_process_SOFn(uchar * Data,int marker,jpeg_sof_info * result)2255 static void exif_process_SOFn (uchar *Data, int marker, jpeg_sof_info *result)
2256 {
2257 /* 0xFF SOSn SectLen(2) Bits(1) Height(2) Width(2) Channels(1)  3*Channels (1)  */
2258 	result->bits_per_sample = Data[2];
2259 	result->height          = php_jpg_get16(Data+3);
2260 	result->width           = php_jpg_get16(Data+5);
2261 	result->num_components  = Data[7];
2262 
2263 /*	switch (marker) {
2264 		case M_SOF0:  process = "Baseline";  break;
2265 		case M_SOF1:  process = "Extended sequential";  break;
2266 		case M_SOF2:  process = "Progressive";  break;
2267 		case M_SOF3:  process = "Lossless";  break;
2268 		case M_SOF5:  process = "Differential sequential";  break;
2269 		case M_SOF6:  process = "Differential progressive";  break;
2270 		case M_SOF7:  process = "Differential lossless";  break;
2271 		case M_SOF9:  process = "Extended sequential, arithmetic coding";  break;
2272 		case M_SOF10: process = "Progressive, arithmetic coding";  break;
2273 		case M_SOF11: process = "Lossless, arithmetic coding";  break;
2274 		case M_SOF13: process = "Differential sequential, arithmetic coding";  break;
2275 		case M_SOF14: process = "Differential progressive, arithmetic coding"; break;
2276 		case M_SOF15: process = "Differential lossless, arithmetic coding";  break;
2277 		default:      process = "Unknown";  break;
2278 	}*/
2279 }
2280 /* }}} */
2281 
2282 /* forward declarations */
2283 static int exif_process_IFD_in_JPEG(image_info_type *ImageInfo, char *dir_start, char *offset_base, size_t IFDlength, size_t displacement, int section_index TSRMLS_DC);
2284 static int exif_process_IFD_TAG(    image_info_type *ImageInfo, char *dir_entry, char *offset_base, size_t IFDlength, size_t displacement, int section_index, int ReadNextIFD, tag_table_type tag_table TSRMLS_DC);
2285 
2286 /* {{{ exif_get_markername
2287 	Get name of marker */
2288 #ifdef EXIF_DEBUG
exif_get_markername(int marker)2289 static char * exif_get_markername(int marker)
2290 {
2291 	switch(marker) {
2292 		case 0xC0: return "SOF0";
2293 		case 0xC1: return "SOF1";
2294 		case 0xC2: return "SOF2";
2295 		case 0xC3: return "SOF3";
2296 		case 0xC4: return "DHT";
2297 		case 0xC5: return "SOF5";
2298 		case 0xC6: return "SOF6";
2299 		case 0xC7: return "SOF7";
2300 		case 0xC9: return "SOF9";
2301 		case 0xCA: return "SOF10";
2302 		case 0xCB: return "SOF11";
2303 		case 0xCD: return "SOF13";
2304 		case 0xCE: return "SOF14";
2305 		case 0xCF: return "SOF15";
2306 		case 0xD8: return "SOI";
2307 		case 0xD9: return "EOI";
2308 		case 0xDA: return "SOS";
2309 		case 0xDB: return "DQT";
2310 		case 0xDC: return "DNL";
2311 		case 0xDD: return "DRI";
2312 		case 0xDE: return "DHP";
2313 		case 0xDF: return "EXP";
2314 		case 0xE0: return "APP0";
2315 		case 0xE1: return "EXIF";
2316 		case 0xE2: return "FPIX";
2317 		case 0xE3: return "APP3";
2318 		case 0xE4: return "APP4";
2319 		case 0xE5: return "APP5";
2320 		case 0xE6: return "APP6";
2321 		case 0xE7: return "APP7";
2322 		case 0xE8: return "APP8";
2323 		case 0xE9: return "APP9";
2324 		case 0xEA: return "APP10";
2325 		case 0xEB: return "APP11";
2326 		case 0xEC: return "APP12";
2327 		case 0xED: return "APP13";
2328 		case 0xEE: return "APP14";
2329 		case 0xEF: return "APP15";
2330 		case 0xF0: return "JPG0";
2331 		case 0xFD: return "JPG13";
2332 		case 0xFE: return "COM";
2333 		case 0x01: return "TEM";
2334 	}
2335 	return "Unknown";
2336 }
2337 #endif
2338 /* }}} */
2339 
2340 /* {{{ proto string exif_tagname(index)
2341 	Get headername for index or false if not defined */
PHP_FUNCTION(exif_tagname)2342 PHP_FUNCTION(exif_tagname)
2343 {
2344 	long tag;
2345 	char *szTemp;
2346 
2347 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "l", &tag) == FAILURE) {
2348 		return;
2349 	}
2350 
2351 	szTemp = exif_get_tagname(tag, NULL, 0, tag_table_IFD TSRMLS_CC);
2352 
2353 	if (tag < 0 || !szTemp || !szTemp[0]) {
2354 		RETURN_FALSE;
2355 	}
2356 
2357 	RETURN_STRING(szTemp, 1)
2358 }
2359 /* }}} */
2360 
2361 /* {{{ exif_ifd_make_value
2362  * Create a value for an ifd from an info_data pointer */
exif_ifd_make_value(image_info_data * info_data,int motorola_intel TSRMLS_DC)2363 static void* exif_ifd_make_value(image_info_data *info_data, int motorola_intel TSRMLS_DC) {
2364 	size_t  byte_count;
2365 	char    *value_ptr, *data_ptr;
2366 	size_t  i;
2367 
2368 	image_info_value  *info_value;
2369 
2370 	byte_count = php_tiff_bytes_per_format[info_data->format] * info_data->length;
2371 	value_ptr = safe_emalloc(max(byte_count, 4), 1, 0);
2372 	memset(value_ptr, 0, 4);
2373 	if (!info_data->length) {
2374 		return value_ptr;
2375 	}
2376 	if (info_data->format == TAG_FMT_UNDEFINED || info_data->format == TAG_FMT_STRING
2377 	  || (byte_count>1 && (info_data->format == TAG_FMT_BYTE || info_data->format == TAG_FMT_SBYTE))
2378 	) {
2379 		memmove(value_ptr, info_data->value.s, byte_count);
2380 		return value_ptr;
2381 	} else if (info_data->format == TAG_FMT_BYTE) {
2382 		*value_ptr = info_data->value.u;
2383 		return value_ptr;
2384 	} else if (info_data->format == TAG_FMT_SBYTE) {
2385 		*value_ptr = info_data->value.i;
2386 		return value_ptr;
2387 	} else {
2388 		data_ptr = value_ptr;
2389 		for(i=0; i<info_data->length; i++) {
2390 			if (info_data->length==1) {
2391 				info_value = &info_data->value;
2392 			} else {
2393 				info_value = &info_data->value.list[i];
2394 			}
2395 			switch(info_data->format) {
2396 				case TAG_FMT_USHORT:
2397 					php_ifd_set16u(data_ptr, info_value->u, motorola_intel);
2398 					data_ptr += 2;
2399 					break;
2400 				case TAG_FMT_ULONG:
2401 					php_ifd_set32u(data_ptr, info_value->u, motorola_intel);
2402 					data_ptr += 4;
2403 					break;
2404 				case TAG_FMT_SSHORT:
2405 					php_ifd_set16u(data_ptr, info_value->i, motorola_intel);
2406 					data_ptr += 2;
2407 					break;
2408 				case TAG_FMT_SLONG:
2409 					php_ifd_set32u(data_ptr, info_value->i, motorola_intel);
2410 					data_ptr += 4;
2411 					break;
2412 				case TAG_FMT_URATIONAL:
2413 					php_ifd_set32u(data_ptr,   info_value->sr.num, motorola_intel);
2414 					php_ifd_set32u(data_ptr+4, info_value->sr.den, motorola_intel);
2415 					data_ptr += 8;
2416 					break;
2417 				case TAG_FMT_SRATIONAL:
2418 					php_ifd_set32u(data_ptr,   info_value->ur.num, motorola_intel);
2419 					php_ifd_set32u(data_ptr+4, info_value->ur.den, motorola_intel);
2420 					data_ptr += 8;
2421 					break;
2422 				case TAG_FMT_SINGLE:
2423 					memmove(data_ptr, &info_value->f, 4);
2424 					data_ptr += 4;
2425 					break;
2426 				case TAG_FMT_DOUBLE:
2427 					memmove(data_ptr, &info_value->d, 8);
2428 					data_ptr += 8;
2429 					break;
2430 			}
2431 		}
2432 	}
2433 	return value_ptr;
2434 }
2435 /* }}} */
2436 
2437 /* {{{ exif_thumbnail_build
2438  * Check and build thumbnail */
exif_thumbnail_build(image_info_type * ImageInfo TSRMLS_DC)2439 static void exif_thumbnail_build(image_info_type *ImageInfo TSRMLS_DC) {
2440 	size_t            new_size, new_move, new_value;
2441 	char              *new_data;
2442 	void              *value_ptr;
2443 	int               i, byte_count;
2444 	image_info_list   *info_list;
2445 	image_info_data   *info_data;
2446 #ifdef EXIF_DEBUG
2447 	char              tagname[64];
2448 #endif
2449 
2450 	if (!ImageInfo->read_thumbnail || !ImageInfo->Thumbnail.offset || !ImageInfo->Thumbnail.size) {
2451 		return; /* ignore this call */
2452 	}
2453 #ifdef EXIF_DEBUG
2454 	exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Thumbnail: filetype = %d", ImageInfo->Thumbnail.filetype);
2455 #endif
2456 	switch(ImageInfo->Thumbnail.filetype) {
2457 		default:
2458 		case IMAGE_FILETYPE_JPEG:
2459 			/* done */
2460 			break;
2461 		case IMAGE_FILETYPE_TIFF_II:
2462 		case IMAGE_FILETYPE_TIFF_MM:
2463 			info_list = &ImageInfo->info_list[SECTION_THUMBNAIL];
2464 			new_size  = 8 + 2 + info_list->count * 12 + 4;
2465 #ifdef EXIF_DEBUG
2466 			exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Thumbnail: size of signature + directory(%d): 0x%02X", info_list->count, new_size);
2467 #endif
2468 			new_value= new_size; /* offset for ifd values outside ifd directory */
2469 			for (i=0; i<info_list->count; i++) {
2470 				info_data  = &info_list->list[i];
2471 				byte_count = php_tiff_bytes_per_format[info_data->format] * info_data->length;
2472 				if (byte_count > 4) {
2473 					new_size += byte_count;
2474 				}
2475 			}
2476 			new_move = new_size;
2477 			new_data = safe_erealloc(ImageInfo->Thumbnail.data, 1, ImageInfo->Thumbnail.size, new_size);
2478 			ImageInfo->Thumbnail.data = new_data;
2479 			memmove(ImageInfo->Thumbnail.data + new_move, ImageInfo->Thumbnail.data, ImageInfo->Thumbnail.size);
2480 			ImageInfo->Thumbnail.size += new_size;
2481 			/* fill in data */
2482 			if (ImageInfo->motorola_intel) {
2483 				memmove(new_data, "MM\x00\x2a\x00\x00\x00\x08", 8);
2484 			} else {
2485 				memmove(new_data, "II\x2a\x00\x08\x00\x00\x00", 8);
2486 			}
2487 			new_data += 8;
2488 			php_ifd_set16u(new_data, info_list->count, ImageInfo->motorola_intel);
2489 			new_data += 2;
2490 			for (i=0; i<info_list->count; i++) {
2491 				info_data  = &info_list->list[i];
2492 				byte_count = php_tiff_bytes_per_format[info_data->format] * info_data->length;
2493 #ifdef EXIF_DEBUG
2494 				exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Thumbnail: process tag(x%04X=%s): %s%s (%d bytes)", info_data->tag, exif_get_tagname(info_data->tag, tagname, -12, tag_table_IFD TSRMLS_CC), (info_data->length>1)&&info_data->format!=TAG_FMT_UNDEFINED&&info_data->format!=TAG_FMT_STRING?"ARRAY OF ":"", exif_get_tagformat(info_data->format), byte_count);
2495 #endif
2496 				if (info_data->tag==TAG_STRIP_OFFSETS || info_data->tag==TAG_JPEG_INTERCHANGE_FORMAT) {
2497 					php_ifd_set16u(new_data + 0, info_data->tag,    ImageInfo->motorola_intel);
2498 					php_ifd_set16u(new_data + 2, TAG_FMT_ULONG,     ImageInfo->motorola_intel);
2499 					php_ifd_set32u(new_data + 4, 1,                 ImageInfo->motorola_intel);
2500 					php_ifd_set32u(new_data + 8, new_move,          ImageInfo->motorola_intel);
2501 				} else {
2502 					php_ifd_set16u(new_data + 0, info_data->tag,    ImageInfo->motorola_intel);
2503 					php_ifd_set16u(new_data + 2, info_data->format, ImageInfo->motorola_intel);
2504 					php_ifd_set32u(new_data + 4, info_data->length, ImageInfo->motorola_intel);
2505 					value_ptr  = exif_ifd_make_value(info_data, ImageInfo->motorola_intel TSRMLS_CC);
2506 					if (byte_count <= 4) {
2507 						memmove(new_data+8, value_ptr, 4);
2508 					} else {
2509 						php_ifd_set32u(new_data+8, new_value, ImageInfo->motorola_intel);
2510 #ifdef EXIF_DEBUG
2511 						exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Thumbnail: writing with value offset: 0x%04X + 0x%02X", new_value, byte_count);
2512 #endif
2513 						memmove(ImageInfo->Thumbnail.data+new_value, value_ptr, byte_count);
2514 						new_value += byte_count;
2515 					}
2516 					efree(value_ptr);
2517 				}
2518 				new_data += 12;
2519 			}
2520 			memset(new_data, 0, 4); /* next ifd pointer */
2521 #ifdef EXIF_DEBUG
2522 			exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Thumbnail: created");
2523 #endif
2524 			break;
2525 	}
2526 }
2527 /* }}} */
2528 
2529 /* {{{ exif_thumbnail_extract
2530  * Grab the thumbnail, corrected */
exif_thumbnail_extract(image_info_type * ImageInfo,char * offset,size_t length TSRMLS_DC)2531 static void exif_thumbnail_extract(image_info_type *ImageInfo, char *offset, size_t length TSRMLS_DC) {
2532 	if (ImageInfo->Thumbnail.data) {
2533 		exif_error_docref("exif_read_data#error_mult_thumb" EXIFERR_CC, ImageInfo, E_WARNING, "Multiple possible thumbnails");
2534 		return; /* Should not happen */
2535 	}
2536 	if (!ImageInfo->read_thumbnail)	{
2537 		return; /* ignore this call */
2538 	}
2539 	/* according to exif2.1, the thumbnail is not supposed to be greater than 64K */
2540 	if (ImageInfo->Thumbnail.size >= 65536
2541 	 || ImageInfo->Thumbnail.size <= 0
2542 	 || ImageInfo->Thumbnail.offset <= 0
2543 	) {
2544 		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Illegal thumbnail size/offset");
2545 		return;
2546 	}
2547 	/* Check to make sure we are not going to go past the ExifLength */
2548 	if (ImageInfo->Thumbnail.size > length
2549 		|| (ImageInfo->Thumbnail.offset + ImageInfo->Thumbnail.size) > length
2550 		|| ImageInfo->Thumbnail.offset > length - ImageInfo->Thumbnail.size
2551 	) {
2552 		EXIF_ERRLOG_THUMBEOF(ImageInfo)
2553 		return;
2554 	}
2555 	ImageInfo->Thumbnail.data = estrndup(offset + ImageInfo->Thumbnail.offset, ImageInfo->Thumbnail.size);
2556 	exif_thumbnail_build(ImageInfo TSRMLS_CC);
2557 }
2558 /* }}} */
2559 
2560 /* {{{ exif_process_undefined
2561  * Copy a string/buffer in Exif header to a character string and return length of allocated buffer if any. */
exif_process_undefined(char ** result,char * value,size_t byte_count TSRMLS_DC)2562 static int exif_process_undefined(char **result, char *value, size_t byte_count TSRMLS_DC) {
2563 	/* we cannot use strlcpy - here the problem is that we have to copy NUL
2564 	 * chars up to byte_count, we also have to add a single NUL character to
2565 	 * force end of string.
2566 	 * estrndup does not return length
2567 	 */
2568 	if (byte_count) {
2569 		(*result) = estrndup(value, byte_count); /* NULL @ byte_count!!! */
2570 		return byte_count+1;
2571 	}
2572 	return 0;
2573 }
2574 /* }}} */
2575 
2576 /* {{{ exif_process_string_raw
2577  * Copy a string in Exif header to a character string returns length of allocated buffer if any. */
exif_process_string_raw(char ** result,char * value,size_t byte_count)2578 static int exif_process_string_raw(char **result, char *value, size_t byte_count) {
2579 	/* we cannot use strlcpy - here the problem is that we have to copy NUL
2580 	 * chars up to byte_count, we also have to add a single NUL character to
2581 	 * force end of string.
2582 	 */
2583 	if (byte_count) {
2584 		(*result) = safe_emalloc(byte_count, 1, 1);
2585 		memcpy(*result, value, byte_count);
2586 		(*result)[byte_count] = '\0';
2587 		return byte_count+1;
2588 	}
2589 	return 0;
2590 }
2591 /* }}} */
2592 
2593 /* {{{ exif_process_string
2594  * Copy a string in Exif header to a character string and return length of allocated buffer if any.
2595  * In contrast to exif_process_string this function does always return a string buffer */
exif_process_string(char ** result,char * value,size_t byte_count TSRMLS_DC)2596 static int exif_process_string(char **result, char *value, size_t byte_count TSRMLS_DC) {
2597 	/* we cannot use strlcpy - here the problem is that we cannot use strlen to
2598 	 * determin length of string and we cannot use strlcpy with len=byte_count+1
2599 	 * because then we might get into an EXCEPTION if we exceed an allocated
2600 	 * memory page...so we use php_strnlen in conjunction with memcpy and add the NUL
2601 	 * char.
2602 	 * estrdup would sometimes allocate more memory and does not return length
2603 	 */
2604 	if ((byte_count=php_strnlen(value, byte_count)) > 0) {
2605 		return exif_process_undefined(result, value, byte_count TSRMLS_CC);
2606 	}
2607 	(*result) = estrndup("", 1); /* force empty string */
2608 	return byte_count+1;
2609 }
2610 /* }}} */
2611 
2612 /* {{{ exif_process_user_comment
2613  * Process UserComment in IFD. */
exif_process_user_comment(image_info_type * ImageInfo,char ** pszInfoPtr,char ** pszEncoding,char * szValuePtr,int ByteCount TSRMLS_DC)2614 static int exif_process_user_comment(image_info_type *ImageInfo, char **pszInfoPtr, char **pszEncoding, char *szValuePtr, int ByteCount TSRMLS_DC)
2615 {
2616 	int   a;
2617 	char  *decode;
2618 	size_t len;;
2619 
2620 	*pszEncoding = NULL;
2621 	/* Copy the comment */
2622 	if (ByteCount>=8) {
2623 		const zend_encoding *from, *to;
2624 		if (!memcmp(szValuePtr, "UNICODE\0", 8)) {
2625 			*pszEncoding = estrdup((const char*)szValuePtr);
2626 			szValuePtr = szValuePtr+8;
2627 			ByteCount -= 8;
2628 			/* First try to detect BOM: ZERO WIDTH NOBREAK SPACE (FEFF 16)
2629 			 * since we have no encoding support for the BOM yet we skip that.
2630 			 */
2631 			if (!memcmp(szValuePtr, "\xFE\xFF", 2)) {
2632 				decode = "UCS-2BE";
2633 				szValuePtr = szValuePtr+2;
2634 				ByteCount -= 2;
2635 			} else if (!memcmp(szValuePtr, "\xFF\xFE", 2)) {
2636 				decode = "UCS-2LE";
2637 				szValuePtr = szValuePtr+2;
2638 				ByteCount -= 2;
2639 			} else if (ImageInfo->motorola_intel) {
2640 				decode = ImageInfo->decode_unicode_be;
2641 			} else {
2642 				decode = ImageInfo->decode_unicode_le;
2643 			}
2644 			to = zend_multibyte_fetch_encoding(ImageInfo->encode_unicode TSRMLS_CC);
2645 			from = zend_multibyte_fetch_encoding(decode TSRMLS_CC);
2646 			/* XXX this will fail again if encoding_converter returns on error something different than SIZE_MAX   */
2647 			if (!to || !from || zend_multibyte_encoding_converter(
2648 					(unsigned char**)pszInfoPtr,
2649 					&len,
2650 					(unsigned char*)szValuePtr,
2651 					ByteCount,
2652 					to,
2653 					from
2654 					TSRMLS_CC) == (size_t)-1) {
2655 				len = exif_process_string_raw(pszInfoPtr, szValuePtr, ByteCount);
2656 			}
2657 			return len;
2658 		} else if (!memcmp(szValuePtr, "ASCII\0\0\0", 8)) {
2659 			*pszEncoding = estrdup((const char*)szValuePtr);
2660 			szValuePtr = szValuePtr+8;
2661 			ByteCount -= 8;
2662 		} else if (!memcmp(szValuePtr, "JIS\0\0\0\0\0", 8)) {
2663 			/* JIS should be tanslated to MB or we leave it to the user - leave it to the user */
2664 			*pszEncoding = estrdup((const char*)szValuePtr);
2665 			szValuePtr = szValuePtr+8;
2666 			ByteCount -= 8;
2667 			/* XXX this will fail again if encoding_converter returns on error something different than SIZE_MAX   */
2668 			to = zend_multibyte_fetch_encoding(ImageInfo->encode_jis TSRMLS_CC);
2669 			from = zend_multibyte_fetch_encoding(ImageInfo->motorola_intel ? ImageInfo->decode_jis_be : ImageInfo->decode_jis_le TSRMLS_CC);
2670 			if (!to || !from || zend_multibyte_encoding_converter(
2671 					(unsigned char**)pszInfoPtr,
2672 					&len,
2673 					(unsigned char*)szValuePtr,
2674 					ByteCount,
2675 					to,
2676 					from
2677 					TSRMLS_CC) == (size_t)-1) {
2678 				len = exif_process_string_raw(pszInfoPtr, szValuePtr, ByteCount);
2679 			}
2680 			return len;
2681 		} else if (!memcmp(szValuePtr, "\0\0\0\0\0\0\0\0", 8)) {
2682 			/* 8 NULL means undefined and should be ASCII... */
2683 			*pszEncoding = estrdup("UNDEFINED");
2684 			szValuePtr = szValuePtr+8;
2685 			ByteCount -= 8;
2686 		}
2687 	}
2688 
2689 	/* Olympus has this padded with trailing spaces.  Remove these first. */
2690 	if (ByteCount>0) {
2691 		for (a=ByteCount-1;a && szValuePtr[a]==' ';a--) {
2692 			(szValuePtr)[a] = '\0';
2693 		}
2694 	}
2695 
2696 	/* normal text without encoding */
2697 	exif_process_string(pszInfoPtr, szValuePtr, ByteCount TSRMLS_CC);
2698 	return strlen(*pszInfoPtr);
2699 }
2700 /* }}} */
2701 
2702 /* {{{ exif_process_unicode
2703  * Process unicode field in IFD. */
exif_process_unicode(image_info_type * ImageInfo,xp_field_type * xp_field,int tag,char * szValuePtr,int ByteCount TSRMLS_DC)2704 static int exif_process_unicode(image_info_type *ImageInfo, xp_field_type *xp_field, int tag, char *szValuePtr, int ByteCount TSRMLS_DC)
2705 {
2706 	xp_field->tag = tag;
2707 	xp_field->value = NULL;
2708 	/* XXX this will fail again if encoding_converter returns on error something different than SIZE_MAX   */
2709 	if (zend_multibyte_encoding_converter(
2710 			(unsigned char**)&xp_field->value,
2711 			&xp_field->size,
2712 			(unsigned char*)szValuePtr,
2713 			ByteCount,
2714 			zend_multibyte_fetch_encoding(ImageInfo->encode_unicode TSRMLS_CC),
2715 			zend_multibyte_fetch_encoding(ImageInfo->motorola_intel ? ImageInfo->decode_unicode_be : ImageInfo->decode_unicode_le TSRMLS_CC)
2716 			TSRMLS_CC) == (size_t)-1) {
2717 		xp_field->size = exif_process_string_raw(&xp_field->value, szValuePtr, ByteCount);
2718 	}
2719 	return xp_field->size;
2720 }
2721 /* }}} */
2722 
2723 /* {{{ exif_process_IFD_in_MAKERNOTE
2724  * Process nested IFDs directories in Maker Note. */
exif_process_IFD_in_MAKERNOTE(image_info_type * ImageInfo,char * value_ptr,int value_len,char * offset_base,size_t IFDlength,size_t displacement TSRMLS_DC)2725 static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * value_ptr, int value_len, char *offset_base, size_t IFDlength, size_t displacement TSRMLS_DC)
2726 {
2727 	int de, i=0, section_index = SECTION_MAKERNOTE;
2728 	int NumDirEntries, old_motorola_intel, offset_diff;
2729 	const maker_note_type *maker_note;
2730 	char *dir_start;
2731 	int data_len;
2732 
2733 	for (i=0; i<=sizeof(maker_note_array)/sizeof(maker_note_type); i++) {
2734 		if (i==sizeof(maker_note_array)/sizeof(maker_note_type)) {
2735 #ifdef EXIF_DEBUG
2736 			exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "No maker note data found. Detected maker: %s (length = %d)", ImageInfo->make, strlen(ImageInfo->make));
2737 #endif
2738 			/* unknown manufacturer, not an error, use it as a string */
2739 			return TRUE;
2740 		}
2741 
2742 		maker_note = maker_note_array+i;
2743 
2744 		/*exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "check (%s,%s)", maker_note->make?maker_note->make:"", maker_note->model?maker_note->model:"");*/
2745 		if (maker_note->make && (!ImageInfo->make || strcmp(maker_note->make, ImageInfo->make)))
2746 			continue;
2747 		if (maker_note->model && (!ImageInfo->model || strcmp(maker_note->model, ImageInfo->model)))
2748 			continue;
2749 		if (maker_note->id_string && strncmp(maker_note->id_string, value_ptr, maker_note->id_string_len))
2750 			continue;
2751 		break;
2752 	}
2753 
2754 	if (maker_note->offset >= value_len) {
2755 		/* Do not go past the value end */
2756 		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "IFD data too short: 0x%04X offset 0x%04X", value_len, maker_note->offset);
2757 		return FALSE;
2758 	}
2759 
2760 	dir_start = value_ptr + maker_note->offset;
2761 
2762 #ifdef EXIF_DEBUG
2763 	exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Process %s @x%04X + 0x%04X=%d: %s", exif_get_sectionname(section_index), (int)dir_start-(int)offset_base+maker_note->offset+displacement, value_len, value_len, exif_char_dump(value_ptr, value_len, (int)dir_start-(int)offset_base+maker_note->offset+displacement));
2764 #endif
2765 
2766 	ImageInfo->sections_found |= FOUND_MAKERNOTE;
2767 
2768 	old_motorola_intel = ImageInfo->motorola_intel;
2769 	switch (maker_note->byte_order) {
2770 		case MN_ORDER_INTEL:
2771 			ImageInfo->motorola_intel = 0;
2772 			break;
2773 		case MN_ORDER_MOTOROLA:
2774 			ImageInfo->motorola_intel = 1;
2775 			break;
2776 		default:
2777 		case MN_ORDER_NORMAL:
2778 			break;
2779 	}
2780 
2781 	NumDirEntries = php_ifd_get16u(dir_start, ImageInfo->motorola_intel);
2782 
2783 	switch (maker_note->offset_mode) {
2784 		case MN_OFFSET_MAKER:
2785 			offset_base = value_ptr;
2786 			data_len = value_len;
2787 			break;
2788 		case MN_OFFSET_GUESS:
2789 			if (maker_note->offset + 10 + 4 >= value_len) {
2790 				/* Can not read dir_start+10 since it's beyond value end */
2791 				exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "IFD data too short: 0x%04X", value_len);
2792 				return FALSE;
2793 			}
2794 			offset_diff = 2 + NumDirEntries*12 + 4 - php_ifd_get32u(dir_start+10, ImageInfo->motorola_intel);
2795 #ifdef EXIF_DEBUG
2796 			exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Using automatic offset correction: 0x%04X", ((int)dir_start-(int)offset_base+maker_note->offset+displacement) + offset_diff);
2797 #endif
2798 			if (offset_diff < 0 || offset_diff >= value_len ) {
2799 				exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "IFD data bad offset: 0x%04X length 0x%04X", offset_diff, value_len);
2800 				return FALSE;
2801 			}
2802 			offset_base = value_ptr + offset_diff;
2803 			data_len = value_len - offset_diff;
2804 			break;
2805 		default:
2806 		case MN_OFFSET_NORMAL:
2807 			break;
2808 	}
2809 
2810 	if ((2+NumDirEntries*12) > value_len) {
2811 		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 2 + 0x%04X*12 = 0x%04X > 0x%04X", NumDirEntries, 2+NumDirEntries*12, value_len);
2812 		return FALSE;
2813 	}
2814 
2815 	for (de=0;de<NumDirEntries;de++) {
2816 		if (!exif_process_IFD_TAG(ImageInfo, dir_start + 2 + 12 * de,
2817 								  offset_base, data_len, displacement, section_index, 0, maker_note->tag_table TSRMLS_CC)) {
2818 			return FALSE;
2819 		}
2820 	}
2821 	ImageInfo->motorola_intel = old_motorola_intel;
2822 /*	NextDirOffset (must be NULL) = php_ifd_get32u(dir_start+2+12*de, ImageInfo->motorola_intel);*/
2823 #ifdef EXIF_DEBUG
2824 	exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Subsection %s done", exif_get_sectionname(SECTION_MAKERNOTE));
2825 #endif
2826 	return TRUE;
2827 }
2828 /* }}} */
2829 
2830 /* {{{ exif_process_IFD_TAG
2831  * Process one of the nested IFDs directories. */
exif_process_IFD_TAG(image_info_type * ImageInfo,char * dir_entry,char * offset_base,size_t IFDlength,size_t displacement,int section_index,int ReadNextIFD,tag_table_type tag_table TSRMLS_DC)2832 static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, char *offset_base, size_t IFDlength, size_t displacement, int section_index, int ReadNextIFD, tag_table_type tag_table TSRMLS_DC)
2833 {
2834 	size_t length;
2835 	int tag, format, components;
2836 	char *value_ptr, tagname[64], cbuf[32], *outside=NULL;
2837 	size_t byte_count, offset_val, fpos, fgot;
2838 	int64_t byte_count_signed;
2839 	xp_field_type *tmp_xp;
2840 #ifdef EXIF_DEBUG
2841 	char *dump_data;
2842 	int dump_free;
2843 #endif /* EXIF_DEBUG */
2844 
2845 	/* Protect against corrupt headers */
2846 	if (ImageInfo->ifd_nesting_level > MAX_IFD_NESTING_LEVEL) {
2847 		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "corrupt EXIF header: maximum directory nesting level reached");
2848 		return FALSE;
2849 	}
2850 	ImageInfo->ifd_nesting_level++;
2851 
2852 	tag = php_ifd_get16u(dir_entry, ImageInfo->motorola_intel);
2853 	format = php_ifd_get16u(dir_entry+2, ImageInfo->motorola_intel);
2854 	components = php_ifd_get32u(dir_entry+4, ImageInfo->motorola_intel);
2855 
2856 	if (!format || format > NUM_FORMATS) {
2857 		/* (-1) catches illegal zero case as unsigned underflows to positive large. */
2858 		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Illegal format code 0x%04X, suppose BYTE", tag, exif_get_tagname(tag, tagname, -12, tag_table TSRMLS_CC), format);
2859 		format = TAG_FMT_BYTE;
2860 		/*return TRUE;*/
2861 	}
2862 
2863 	if (components < 0) {
2864 		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Illegal components(%d)", tag, exif_get_tagname(tag, tagname, -12, tag_table TSRMLS_CC), components);
2865 		return FALSE;
2866 	}
2867 
2868 	byte_count_signed = (int64_t)components * php_tiff_bytes_per_format[format];
2869 
2870 	if (byte_count_signed < 0 || (byte_count_signed > INT32_MAX)) {
2871 		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Illegal byte_count", tag, exif_get_tagname(tag, tagname, -12, tag_table TSRMLS_CC));
2872 		return FALSE;
2873 	}
2874 
2875 	byte_count = (size_t)byte_count_signed;
2876 
2877 	if (byte_count > 4) {
2878 		offset_val = php_ifd_get32u(dir_entry+8, ImageInfo->motorola_intel);
2879 		/* If its bigger than 4 bytes, the dir entry contains an offset. */
2880 		value_ptr = offset_base+offset_val;
2881         /*
2882             dir_entry is ImageInfo->file.list[sn].data+2+i*12
2883             offset_base is ImageInfo->file.list[sn].data-dir_offset
2884             dir_entry - offset_base is dir_offset+2+i*12
2885         */
2886 		if (byte_count > IFDlength || offset_val > IFDlength-byte_count || value_ptr < dir_entry || offset_val < (size_t)(dir_entry-offset_base)) {
2887 			/* It is important to check for IMAGE_FILETYPE_TIFF
2888 			 * JPEG does not use absolute pointers instead its pointers are
2889 			 * relative to the start of the TIFF header in APP1 section. */
2890 			if (byte_count > ImageInfo->FileSize || offset_val>ImageInfo->FileSize-byte_count || (ImageInfo->FileType!=IMAGE_FILETYPE_TIFF_II && ImageInfo->FileType!=IMAGE_FILETYPE_TIFF_MM && ImageInfo->FileType!=IMAGE_FILETYPE_JPEG)) {
2891 				if (value_ptr < dir_entry) {
2892 					/* we can read this if offset_val > 0 */
2893 					/* some files have their values in other parts of the file */
2894 					exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Illegal pointer offset(x%04X < x%04X)", tag, exif_get_tagname(tag, tagname, -12, tag_table TSRMLS_CC), offset_val, dir_entry);
2895 				} else {
2896 					/* this is for sure not allowed */
2897 					/* exception are IFD pointers */
2898 					exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Illegal pointer offset(x%04X + x%04X = x%04X > x%04X)", tag, exif_get_tagname(tag, tagname, -12, tag_table TSRMLS_CC), offset_val, byte_count, offset_val+byte_count, IFDlength);
2899 				}
2900 				return FALSE;
2901 			}
2902 			if (byte_count>sizeof(cbuf)) {
2903 				/* mark as outside range and get buffer */
2904 				value_ptr = safe_emalloc(byte_count, 1, 0);
2905 				outside = value_ptr;
2906 			} else {
2907 				/* In most cases we only access a small range so
2908 				 * it is faster to use a static buffer there
2909 				 * BUT it offers also the possibility to have
2910 				 * pointers read without the need to free them
2911 				 * explicitley before returning. */
2912 				memset(&cbuf, 0, sizeof(cbuf));
2913 				value_ptr = cbuf;
2914 			}
2915 
2916 			fpos = php_stream_tell(ImageInfo->infile);
2917 			php_stream_seek(ImageInfo->infile, displacement+offset_val, SEEK_SET);
2918 			fgot = php_stream_tell(ImageInfo->infile);
2919 			if (fgot!=displacement+offset_val) {
2920 				EFREE_IF(outside);
2921 				exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Wrong file pointer: 0x%08X != 0x%08X", fgot, displacement+offset_val);
2922 				return FALSE;
2923 			}
2924 			fgot = php_stream_read(ImageInfo->infile, value_ptr, byte_count);
2925 			php_stream_seek(ImageInfo->infile, fpos, SEEK_SET);
2926 			if (fgot<byte_count) {
2927 				EFREE_IF(outside);
2928 				EXIF_ERRLOG_FILEEOF(ImageInfo)
2929 				return FALSE;
2930 			}
2931 		}
2932 	} else {
2933 		/* 4 bytes or less and value is in the dir entry itself */
2934 		value_ptr = dir_entry+8;
2935 		offset_val= value_ptr-offset_base;
2936 	}
2937 
2938 	ImageInfo->sections_found |= FOUND_ANY_TAG;
2939 #ifdef EXIF_DEBUG
2940 	dump_data = exif_dump_data(&dump_free, format, components, length, ImageInfo->motorola_intel, value_ptr TSRMLS_CC);
2941 	exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Process tag(x%04X=%s,@x%04X + x%04X(=%d)): %s%s %s", tag, exif_get_tagname(tag, tagname, -12, tag_table TSRMLS_CC), offset_val+displacement, byte_count, byte_count, (components>1)&&format!=TAG_FMT_UNDEFINED&&format!=TAG_FMT_STRING?"ARRAY OF ":"", exif_get_tagformat(format), dump_data);
2942 	if (dump_free) {
2943 		efree(dump_data);
2944 	}
2945 #endif
2946 
2947 	if (section_index==SECTION_THUMBNAIL) {
2948 		if (!ImageInfo->Thumbnail.data) {
2949 			switch(tag) {
2950 				case TAG_IMAGEWIDTH:
2951 				case TAG_COMP_IMAGE_WIDTH:
2952 					ImageInfo->Thumbnail.width = exif_convert_any_to_int(value_ptr, format, ImageInfo->motorola_intel TSRMLS_CC);
2953 					break;
2954 
2955 				case TAG_IMAGEHEIGHT:
2956 				case TAG_COMP_IMAGE_HEIGHT:
2957 					ImageInfo->Thumbnail.height = exif_convert_any_to_int(value_ptr, format, ImageInfo->motorola_intel TSRMLS_CC);
2958 					break;
2959 
2960 				case TAG_STRIP_OFFSETS:
2961 				case TAG_JPEG_INTERCHANGE_FORMAT:
2962 					/* accept both formats */
2963 					ImageInfo->Thumbnail.offset = exif_convert_any_to_int(value_ptr, format, ImageInfo->motorola_intel TSRMLS_CC);
2964 					break;
2965 
2966 				case TAG_STRIP_BYTE_COUNTS:
2967 					if (ImageInfo->FileType == IMAGE_FILETYPE_TIFF_II || ImageInfo->FileType == IMAGE_FILETYPE_TIFF_MM) {
2968 						ImageInfo->Thumbnail.filetype = ImageInfo->FileType;
2969 					} else {
2970 						/* motorola is easier to read */
2971 						ImageInfo->Thumbnail.filetype = IMAGE_FILETYPE_TIFF_MM;
2972 					}
2973 					ImageInfo->Thumbnail.size = exif_convert_any_to_int(value_ptr, format, ImageInfo->motorola_intel TSRMLS_CC);
2974 					break;
2975 
2976 				case TAG_JPEG_INTERCHANGE_FORMAT_LEN:
2977 					if (ImageInfo->Thumbnail.filetype == IMAGE_FILETYPE_UNKNOWN) {
2978 						ImageInfo->Thumbnail.filetype = IMAGE_FILETYPE_JPEG;
2979 						ImageInfo->Thumbnail.size = exif_convert_any_to_int(value_ptr, format, ImageInfo->motorola_intel TSRMLS_CC);
2980 					}
2981 					break;
2982 			}
2983 		}
2984 	} else {
2985 		if (section_index==SECTION_IFD0 || section_index==SECTION_EXIF)
2986 		switch(tag) {
2987 			case TAG_COPYRIGHT:
2988 				/* check for "<photographer> NUL <editor> NUL" */
2989 				if (byte_count>1 && (length=php_strnlen(value_ptr, byte_count)) > 0) {
2990 					if (length<byte_count-1) {
2991 						/* When there are any characters after the first NUL */
2992 						ImageInfo->CopyrightPhotographer  = estrdup(value_ptr);
2993 						ImageInfo->CopyrightEditor        = estrndup(value_ptr+length+1, byte_count-length-1);
2994 						spprintf(&ImageInfo->Copyright, 0, "%s, %s", ImageInfo->CopyrightPhotographer, ImageInfo->CopyrightEditor);
2995 						/* format = TAG_FMT_UNDEFINED; this musn't be ASCII         */
2996 						/* but we are not supposed to change this                   */
2997 						/* keep in mind that image_info does not store editor value */
2998 					} else {
2999 						ImageInfo->Copyright = estrndup(value_ptr, byte_count);
3000 					}
3001 				}
3002 				break;
3003 
3004 			case TAG_USERCOMMENT:
3005 				ImageInfo->UserCommentLength = exif_process_user_comment(ImageInfo, &(ImageInfo->UserComment), &(ImageInfo->UserCommentEncoding), value_ptr, byte_count TSRMLS_CC);
3006 				break;
3007 
3008 			case TAG_XP_TITLE:
3009 			case TAG_XP_COMMENTS:
3010 			case TAG_XP_AUTHOR:
3011 			case TAG_XP_KEYWORDS:
3012 			case TAG_XP_SUBJECT:
3013 				tmp_xp = (xp_field_type*)safe_erealloc(ImageInfo->xp_fields.list, (ImageInfo->xp_fields.count+1), sizeof(xp_field_type), 0);
3014 				ImageInfo->sections_found |= FOUND_WINXP;
3015 				ImageInfo->xp_fields.list = tmp_xp;
3016 				ImageInfo->xp_fields.count++;
3017 				exif_process_unicode(ImageInfo, &(ImageInfo->xp_fields.list[ImageInfo->xp_fields.count-1]), tag, value_ptr, byte_count TSRMLS_CC);
3018 				break;
3019 
3020 			case TAG_FNUMBER:
3021 				/* Simplest way of expressing aperture, so I trust it the most.
3022 				   (overwrite previously computed value if there is one) */
3023 				ImageInfo->ApertureFNumber = (float)exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel TSRMLS_CC);
3024 				break;
3025 
3026 			case TAG_APERTURE:
3027 			case TAG_MAX_APERTURE:
3028 				/* More relevant info always comes earlier, so only use this field if we don't
3029 				   have appropriate aperture information yet. */
3030 				if (ImageInfo->ApertureFNumber == 0) {
3031 					ImageInfo->ApertureFNumber
3032 						= (float)exp(exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel TSRMLS_CC)*log(2)*0.5);
3033 				}
3034 				break;
3035 
3036 			case TAG_SHUTTERSPEED:
3037 				/* More complicated way of expressing exposure time, so only use
3038 				   this value if we don't already have it from somewhere else.
3039 				   SHUTTERSPEED comes after EXPOSURE TIME
3040 				  */
3041 				if (ImageInfo->ExposureTime == 0) {
3042 					ImageInfo->ExposureTime
3043 						= (float)(1/exp(exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel TSRMLS_CC)*log(2)));
3044 				}
3045 				break;
3046 			case TAG_EXPOSURETIME:
3047 				ImageInfo->ExposureTime = -1;
3048 				break;
3049 
3050 			case TAG_COMP_IMAGE_WIDTH:
3051 				ImageInfo->ExifImageWidth = exif_convert_any_to_int(value_ptr, format, ImageInfo->motorola_intel TSRMLS_CC);
3052 				break;
3053 
3054 			case TAG_FOCALPLANE_X_RES:
3055 				ImageInfo->FocalplaneXRes = exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel TSRMLS_CC);
3056 				break;
3057 
3058 			case TAG_SUBJECT_DISTANCE:
3059 				/* Inidcates the distacne the autofocus camera is focused to.
3060 				   Tends to be less accurate as distance increases. */
3061 				ImageInfo->Distance = (float)exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel TSRMLS_CC);
3062 				break;
3063 
3064 			case TAG_FOCALPLANE_RESOLUTION_UNIT:
3065 				switch((int)exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel TSRMLS_CC)) {
3066 					case 1: ImageInfo->FocalplaneUnits = 25.4; break; /* inch */
3067 					case 2:
3068 						/* According to the information I was using, 2 measn meters.
3069 						   But looking at the Cannon powershot's files, inches is the only
3070 						   sensible value. */
3071 						ImageInfo->FocalplaneUnits = 25.4;
3072 						break;
3073 
3074 					case 3: ImageInfo->FocalplaneUnits = 10;   break;  /* centimeter */
3075 					case 4: ImageInfo->FocalplaneUnits = 1;    break;  /* milimeter  */
3076 					case 5: ImageInfo->FocalplaneUnits = .001; break;  /* micrometer */
3077 				}
3078 				break;
3079 
3080 			case TAG_SUB_IFD:
3081 				if (format==TAG_FMT_IFD) {
3082 					/* If this is called we are either in a TIFFs thumbnail or a JPEG where we cannot handle it */
3083 					/* TIFF thumbnail: our data structure cannot store a thumbnail of a thumbnail */
3084 					/* JPEG do we have the data area and what to do with it */
3085 					exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Skip SUB IFD");
3086 				}
3087 				break;
3088 
3089 			case TAG_MAKE:
3090 				ImageInfo->make = estrndup(value_ptr, byte_count);
3091 				break;
3092 			case TAG_MODEL:
3093 				ImageInfo->model = estrndup(value_ptr, byte_count);
3094 				break;
3095 
3096 			case TAG_MAKER_NOTE:
3097 				if (!exif_process_IFD_in_MAKERNOTE(ImageInfo, value_ptr, byte_count, offset_base, IFDlength, displacement TSRMLS_CC)) {
3098 					EFREE_IF(outside);
3099 					return FALSE;
3100 				}
3101 				break;
3102 
3103 			case TAG_EXIF_IFD_POINTER:
3104 			case TAG_GPS_IFD_POINTER:
3105 			case TAG_INTEROP_IFD_POINTER:
3106 				if (ReadNextIFD) {
3107 					char *Subdir_start;
3108 					int sub_section_index = 0;
3109 					switch(tag) {
3110 						case TAG_EXIF_IFD_POINTER:
3111 #ifdef EXIF_DEBUG
3112 							exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Found EXIF");
3113 #endif
3114 							ImageInfo->sections_found |= FOUND_EXIF;
3115 							sub_section_index = SECTION_EXIF;
3116 							break;
3117 						case TAG_GPS_IFD_POINTER:
3118 #ifdef EXIF_DEBUG
3119 							exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Found GPS");
3120 #endif
3121 							ImageInfo->sections_found |= FOUND_GPS;
3122 							sub_section_index = SECTION_GPS;
3123 							break;
3124 						case TAG_INTEROP_IFD_POINTER:
3125 #ifdef EXIF_DEBUG
3126 							exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Found INTEROPERABILITY");
3127 #endif
3128 							ImageInfo->sections_found |= FOUND_INTEROP;
3129 							sub_section_index = SECTION_INTEROP;
3130 							break;
3131 					}
3132 					Subdir_start = offset_base + php_ifd_get32u(value_ptr, ImageInfo->motorola_intel);
3133 					if (Subdir_start < offset_base || Subdir_start > offset_base+IFDlength) {
3134 						exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD Pointer");
3135 						return FALSE;
3136 					}
3137 					if (!exif_process_IFD_in_JPEG(ImageInfo, Subdir_start, offset_base, IFDlength, displacement, sub_section_index TSRMLS_CC)) {
3138 						return FALSE;
3139 					}
3140 #ifdef EXIF_DEBUG
3141 					exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Subsection %s done", exif_get_sectionname(sub_section_index));
3142 #endif
3143 				}
3144 		}
3145 	}
3146 	exif_iif_add_tag(ImageInfo, section_index, exif_get_tagname(tag, tagname, sizeof(tagname), tag_table TSRMLS_CC), tag, format, components, value_ptr TSRMLS_CC);
3147 	EFREE_IF(outside);
3148 	return TRUE;
3149 }
3150 /* }}} */
3151 
3152 /* {{{ exif_process_IFD_in_JPEG
3153  * Process one of the nested IFDs directories. */
exif_process_IFD_in_JPEG(image_info_type * ImageInfo,char * dir_start,char * offset_base,size_t IFDlength,size_t displacement,int section_index TSRMLS_DC)3154 static int exif_process_IFD_in_JPEG(image_info_type *ImageInfo, char *dir_start, char *offset_base, size_t IFDlength, size_t displacement, int section_index TSRMLS_DC)
3155 {
3156 	int de;
3157 	int NumDirEntries;
3158 	int NextDirOffset;
3159 
3160 #ifdef EXIF_DEBUG
3161 	exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Process %s (x%04X(=%d))", exif_get_sectionname(section_index), IFDlength, IFDlength);
3162 #endif
3163 
3164 	ImageInfo->sections_found |= FOUND_IFD0;
3165 
3166 	if ((dir_start + 2) >= (offset_base+IFDlength)) {
3167 		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size");
3168 		return FALSE;
3169 	}
3170 
3171 	NumDirEntries = php_ifd_get16u(dir_start, ImageInfo->motorola_intel);
3172 
3173 	if ((dir_start+2+NumDirEntries*12) > (offset_base+IFDlength)) {
3174 		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: x%04X + 2 + x%04X*12 = x%04X > x%04X", (int)((size_t)dir_start+2-(size_t)offset_base), NumDirEntries, (int)((size_t)dir_start+2+NumDirEntries*12-(size_t)offset_base), IFDlength);
3175 		return FALSE;
3176 	}
3177 
3178 	for (de=0;de<NumDirEntries;de++) {
3179 		if (!exif_process_IFD_TAG(ImageInfo, dir_start + 2 + 12 * de,
3180 								  offset_base, IFDlength, displacement, section_index, 1, exif_get_tag_table(section_index) TSRMLS_CC)) {
3181 			return FALSE;
3182 		}
3183 	}
3184 	/*
3185 	 * Ignore IFD2 if it purportedly exists
3186 	 */
3187 	if (section_index == SECTION_THUMBNAIL) {
3188 		return TRUE;
3189 	}
3190 	/*
3191 	 * Hack to make it process IDF1 I hope
3192 	 * There are 2 IDFs, the second one holds the keys (0x0201 and 0x0202) to the thumbnail
3193 	 */
3194 	if ((dir_start+2+12*de + 4) >= (offset_base+IFDlength)) {
3195 		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size");
3196 		return FALSE;
3197 	}
3198 	NextDirOffset = php_ifd_get32u(dir_start+2+12*de, ImageInfo->motorola_intel);
3199 	if (NextDirOffset) {
3200 		/* the next line seems false but here IFDlength means length of all IFDs */
3201 		if (offset_base + NextDirOffset < offset_base || offset_base + NextDirOffset > offset_base+IFDlength) {
3202 			exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD offset");
3203 			return FALSE;
3204 		}
3205 		/* That is the IFD for the first thumbnail */
3206 #ifdef EXIF_DEBUG
3207 		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Expect next IFD to be thumbnail");
3208 #endif
3209 		if (exif_process_IFD_in_JPEG(ImageInfo, offset_base + NextDirOffset, offset_base, IFDlength, displacement, SECTION_THUMBNAIL TSRMLS_CC)) {
3210 #ifdef EXIF_DEBUG
3211 			exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Thumbnail size: 0x%04X", ImageInfo->Thumbnail.size);
3212 #endif
3213 			if (ImageInfo->Thumbnail.filetype != IMAGE_FILETYPE_UNKNOWN
3214 			&&  ImageInfo->Thumbnail.size
3215 			&&  ImageInfo->Thumbnail.offset
3216 			&&  ImageInfo->read_thumbnail
3217 			) {
3218 				exif_thumbnail_extract(ImageInfo, offset_base, IFDlength TSRMLS_CC);
3219 			}
3220 			return TRUE;
3221 		} else {
3222 			return FALSE;
3223 		}
3224 	}
3225 	return TRUE;
3226 }
3227 /* }}} */
3228 
3229 /* {{{ exif_process_TIFF_in_JPEG
3230    Process a TIFF header in a JPEG file
3231 */
exif_process_TIFF_in_JPEG(image_info_type * ImageInfo,char * CharBuf,size_t length,size_t displacement TSRMLS_DC)3232 static void exif_process_TIFF_in_JPEG(image_info_type *ImageInfo, char *CharBuf, size_t length, size_t displacement TSRMLS_DC)
3233 {
3234 	unsigned exif_value_2a, offset_of_ifd;
3235 
3236 	/* set the thumbnail stuff to nothing so we can test to see if they get set up */
3237 	if (memcmp(CharBuf, "II", 2) == 0) {
3238 		ImageInfo->motorola_intel = 0;
3239 	} else if (memcmp(CharBuf, "MM", 2) == 0) {
3240 		ImageInfo->motorola_intel = 1;
3241 	} else {
3242 		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid TIFF alignment marker");
3243 		return;
3244 	}
3245 
3246 	/* Check the next two values for correctness. */
3247 	if (length < 8) {
3248 		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid TIFF start (1)");
3249 		return;
3250 	}
3251 	exif_value_2a = php_ifd_get16u(CharBuf+2, ImageInfo->motorola_intel);
3252 	offset_of_ifd = php_ifd_get32u(CharBuf+4, ImageInfo->motorola_intel);
3253 	if (exif_value_2a != 0x2a || offset_of_ifd < 0x08) {
3254 		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid TIFF start (1)");
3255 		return;
3256 	}
3257 	if (offset_of_ifd > length) {
3258 		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid IFD start");
3259 		return;
3260 	}
3261 
3262 	ImageInfo->sections_found |= FOUND_IFD0;
3263 	/* First directory starts at offset 8. Offsets starts at 0. */
3264 	exif_process_IFD_in_JPEG(ImageInfo, CharBuf+offset_of_ifd, CharBuf, length/*-14*/, displacement, SECTION_IFD0 TSRMLS_CC);
3265 
3266 #ifdef EXIF_DEBUG
3267 	exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Process TIFF in JPEG done");
3268 #endif
3269 
3270 	/* Compute the CCD width, in milimeters. */
3271 	if (ImageInfo->FocalplaneXRes != 0) {
3272 		ImageInfo->CCDWidth = (float)(ImageInfo->ExifImageWidth * ImageInfo->FocalplaneUnits / ImageInfo->FocalplaneXRes);
3273 	}
3274 }
3275 /* }}} */
3276 
3277 /* {{{ exif_process_APP1
3278    Process an JPEG APP1 block marker
3279    Describes all the drivel that most digital cameras include...
3280 */
exif_process_APP1(image_info_type * ImageInfo,char * CharBuf,size_t length,size_t displacement TSRMLS_DC)3281 static void exif_process_APP1(image_info_type *ImageInfo, char *CharBuf, size_t length, size_t displacement TSRMLS_DC)
3282 {
3283 	/* Check the APP1 for Exif Identifier Code */
3284 	static const uchar ExifHeader[] = {0x45, 0x78, 0x69, 0x66, 0x00, 0x00};
3285 	if (length <= 8 || memcmp(CharBuf+2, ExifHeader, 6)) {
3286 		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Incorrect APP1 Exif Identifier Code");
3287 		return;
3288 	}
3289 	exif_process_TIFF_in_JPEG(ImageInfo, CharBuf + 8, length - 8, displacement+8 TSRMLS_CC);
3290 #ifdef EXIF_DEBUG
3291 	exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Process APP1/EXIF done");
3292 #endif
3293 }
3294 /* }}} */
3295 
3296 /* {{{ exif_process_APP12
3297    Process an JPEG APP12 block marker used by OLYMPUS
3298 */
exif_process_APP12(image_info_type * ImageInfo,char * buffer,size_t length TSRMLS_DC)3299 static void exif_process_APP12(image_info_type *ImageInfo, char *buffer, size_t length TSRMLS_DC)
3300 {
3301 	size_t l1, l2=0;
3302 
3303 	if ((l1 = php_strnlen(buffer+2, length-2)) > 0) {
3304 		exif_iif_add_tag(ImageInfo, SECTION_APP12, "Company", TAG_NONE, TAG_FMT_STRING, l1, buffer+2 TSRMLS_CC);
3305 		if (length > 2+l1+1) {
3306 			l2 = php_strnlen(buffer+2+l1+1, length-2-l1-1);
3307 			exif_iif_add_tag(ImageInfo, SECTION_APP12, "Info", TAG_NONE, TAG_FMT_STRING, l2, buffer+2+l1+1 TSRMLS_CC);
3308 		}
3309 	}
3310 #ifdef EXIF_DEBUG
3311 	exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Process section APP12 with l1=%d, l2=%d done", l1, l2);
3312 #endif
3313 }
3314 /* }}} */
3315 
3316 /* {{{ exif_scan_JPEG_header
3317  * Parse the marker stream until SOS or EOI is seen; */
exif_scan_JPEG_header(image_info_type * ImageInfo TSRMLS_DC)3318 static int exif_scan_JPEG_header(image_info_type *ImageInfo TSRMLS_DC)
3319 {
3320 	int section, sn;
3321 	int marker = 0, last_marker = M_PSEUDO, comment_correction=1;
3322 	unsigned int ll, lh;
3323 	uchar *Data;
3324 	size_t fpos, size, got, itemlen;
3325 	jpeg_sof_info  sof_info;
3326 
3327 	for(section=0;;section++) {
3328 #ifdef EXIF_DEBUG
3329 		fpos = php_stream_tell(ImageInfo->infile);
3330 		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Needing section %d @ 0x%08X", ImageInfo->file.count, fpos);
3331 #endif
3332 
3333 		/* get marker byte, swallowing possible padding                           */
3334 		/* some software does not count the length bytes of COM section           */
3335 		/* one company doing so is very much envolved in JPEG... so we accept too */
3336 		if (last_marker==M_COM && comment_correction) {
3337 			comment_correction = 2;
3338 		}
3339 		do {
3340 			if ((marker = php_stream_getc(ImageInfo->infile)) == EOF) {
3341 				EXIF_ERRLOG_CORRUPT(ImageInfo)
3342 				return FALSE;
3343 			}
3344 			if (last_marker==M_COM && comment_correction>0) {
3345 				if (marker!=0xFF) {
3346 					marker = 0xff;
3347 					comment_correction--;
3348 				} else  {
3349 					last_marker = M_PSEUDO; /* stop skipping 0 for M_COM */
3350 				}
3351 			}
3352 		} while (marker == 0xff);
3353 		if (last_marker==M_COM && !comment_correction) {
3354 			exif_error_docref("exif_read_data#error_mcom" EXIFERR_CC, ImageInfo, E_NOTICE, "Image has corrupt COM section: some software set wrong length information");
3355 		}
3356 		if (last_marker==M_COM && comment_correction)
3357 			return M_EOI; /* ah illegal: char after COM section not 0xFF */
3358 
3359 		fpos = php_stream_tell(ImageInfo->infile);
3360 
3361 		if (marker == 0xff) {
3362 			/* 0xff is legal padding, but if we get that many, something's wrong. */
3363 			exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "To many padding bytes");
3364 			return FALSE;
3365 		}
3366 
3367 		/* Read the length of the section. */
3368 		if ((lh = php_stream_getc(ImageInfo->infile)) == EOF) {
3369 			EXIF_ERRLOG_CORRUPT(ImageInfo)
3370 			return FALSE;
3371 		}
3372 		if ((ll = php_stream_getc(ImageInfo->infile)) == EOF) {
3373 			EXIF_ERRLOG_CORRUPT(ImageInfo)
3374 			return FALSE;
3375 		}
3376 
3377 		itemlen = (lh << 8) | ll;
3378 
3379 		if (itemlen < 2) {
3380 #ifdef EXIF_DEBUG
3381 			exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "%s, Section length: 0x%02X%02X", EXIF_ERROR_CORRUPT, lh, ll);
3382 #else
3383 			EXIF_ERRLOG_CORRUPT(ImageInfo)
3384 #endif
3385 			return FALSE;
3386 		}
3387 
3388 		sn = exif_file_sections_add(ImageInfo, marker, itemlen+1, NULL);
3389 		Data = ImageInfo->file.list[sn].data;
3390 
3391 		/* Store first two pre-read bytes. */
3392 		Data[0] = (uchar)lh;
3393 		Data[1] = (uchar)ll;
3394 
3395 		got = php_stream_read(ImageInfo->infile, (char*)(Data+2), itemlen-2); /* Read the whole section. */
3396 		if (got != itemlen-2) {
3397 			exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Error reading from file: got=x%04X(=%d) != itemlen-2=x%04X(=%d)", got, got, itemlen-2, itemlen-2);
3398 			return FALSE;
3399 		}
3400 
3401 #ifdef EXIF_DEBUG
3402 		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Process section(x%02X=%s) @ x%04X + x%04X(=%d)", marker, exif_get_markername(marker), fpos, itemlen, itemlen);
3403 #endif
3404 		switch(marker) {
3405 			case M_SOS:   /* stop before hitting compressed data  */
3406 				/* If reading entire image is requested, read the rest of the data. */
3407 				if (ImageInfo->read_all) {
3408 					/* Determine how much file is left. */
3409 					fpos = php_stream_tell(ImageInfo->infile);
3410 					size = ImageInfo->FileSize - fpos;
3411 					sn = exif_file_sections_add(ImageInfo, M_PSEUDO, size, NULL);
3412 					Data = ImageInfo->file.list[sn].data;
3413 					got = php_stream_read(ImageInfo->infile, (char*)Data, size);
3414 					if (got != size) {
3415 						EXIF_ERRLOG_FILEEOF(ImageInfo)
3416 						return FALSE;
3417 					}
3418 				}
3419 				return TRUE;
3420 
3421 			case M_EOI:   /* in case it's a tables-only JPEG stream */
3422 				exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "No image in jpeg!");
3423 				return (ImageInfo->sections_found&(~FOUND_COMPUTED)) ? TRUE : FALSE;
3424 
3425 			case M_COM: /* Comment section */
3426 				exif_process_COM(ImageInfo, (char *)Data, itemlen TSRMLS_CC);
3427 				break;
3428 
3429 			case M_EXIF:
3430 				if (!(ImageInfo->sections_found&FOUND_IFD0)) {
3431 					/*ImageInfo->sections_found |= FOUND_EXIF;*/
3432 					/* Seen files from some 'U-lead' software with Vivitar scanner
3433 					   that uses marker 31 later in the file (no clue what for!) */
3434 					exif_process_APP1(ImageInfo, (char *)Data, itemlen, fpos TSRMLS_CC);
3435 				}
3436 				break;
3437 
3438 			case M_APP12:
3439 				exif_process_APP12(ImageInfo, (char *)Data, itemlen TSRMLS_CC);
3440 				break;
3441 
3442 
3443 			case M_SOF0:
3444 			case M_SOF1:
3445 			case M_SOF2:
3446 			case M_SOF3:
3447 			case M_SOF5:
3448 			case M_SOF6:
3449 			case M_SOF7:
3450 			case M_SOF9:
3451 			case M_SOF10:
3452 			case M_SOF11:
3453 			case M_SOF13:
3454 			case M_SOF14:
3455 			case M_SOF15:
3456 				if ((itemlen - 2) < 6) {
3457 					return FALSE;
3458 				}
3459 
3460 				exif_process_SOFn(Data, marker, &sof_info);
3461 				ImageInfo->Width  = sof_info.width;
3462 				ImageInfo->Height = sof_info.height;
3463 				if (sof_info.num_components == 3) {
3464 					ImageInfo->IsColor = 1;
3465 				} else {
3466 					ImageInfo->IsColor = 0;
3467 				}
3468 				break;
3469 			default:
3470 				/* skip any other marker silently. */
3471 				break;
3472 		}
3473 
3474 		/* keep track of last marker */
3475 		last_marker = marker;
3476 	}
3477 #ifdef EXIF_DEBUG
3478 	exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Done");
3479 #endif
3480 	return TRUE;
3481 }
3482 /* }}} */
3483 
3484 /* {{{ exif_scan_thumbnail
3485  * scan JPEG in thumbnail (memory) */
exif_scan_thumbnail(image_info_type * ImageInfo TSRMLS_DC)3486 static int exif_scan_thumbnail(image_info_type *ImageInfo TSRMLS_DC)
3487 {
3488 	uchar           c, *data = (uchar*)ImageInfo->Thumbnail.data;
3489 	int             n, marker;
3490 	size_t          length=2, pos=0;
3491 	jpeg_sof_info   sof_info;
3492 
3493 	if (!data) {
3494 		return FALSE; /* nothing to do here */
3495 	}
3496 	if (memcmp(data, "\xFF\xD8\xFF", 3)) {
3497 		if (!ImageInfo->Thumbnail.width && !ImageInfo->Thumbnail.height) {
3498 			exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Thumbnail is not a JPEG image");
3499 		}
3500 		return FALSE;
3501 	}
3502 	for (;;) {
3503 		pos += length;
3504 		if (pos>=ImageInfo->Thumbnail.size)
3505 			return FALSE;
3506 		c = data[pos++];
3507 		if (pos>=ImageInfo->Thumbnail.size)
3508 			return FALSE;
3509 		if (c != 0xFF) {
3510 			return FALSE;
3511 		}
3512 		n = 8;
3513 		while ((c = data[pos++]) == 0xFF && n--) {
3514 			if (pos+3>=ImageInfo->Thumbnail.size)
3515 				return FALSE;
3516 			/* +3 = pos++ of next check when reaching marker + 2 bytes for length */
3517 		}
3518 		if (c == 0xFF)
3519 			return FALSE;
3520 		marker = c;
3521 		length = php_jpg_get16(data+pos);
3522 		if (pos+length>=ImageInfo->Thumbnail.size) {
3523 			return FALSE;
3524 		}
3525 #ifdef EXIF_DEBUG
3526 		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Thumbnail: process section(x%02X=%s) @ x%04X + x%04X", marker, exif_get_markername(marker), pos, length);
3527 #endif
3528 		switch (marker) {
3529 			case M_SOF0:
3530 			case M_SOF1:
3531 			case M_SOF2:
3532 			case M_SOF3:
3533 			case M_SOF5:
3534 			case M_SOF6:
3535 			case M_SOF7:
3536 			case M_SOF9:
3537 			case M_SOF10:
3538 			case M_SOF11:
3539 			case M_SOF13:
3540 			case M_SOF14:
3541 			case M_SOF15:
3542 				/* handle SOFn block */
3543 				exif_process_SOFn(data+pos, marker, &sof_info);
3544 				ImageInfo->Thumbnail.height   = sof_info.height;
3545 				ImageInfo->Thumbnail.width    = sof_info.width;
3546 #ifdef EXIF_DEBUG
3547 				exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Thumbnail: size: %d * %d", sof_info.width, sof_info.height);
3548 #endif
3549 				return TRUE;
3550 
3551 			case M_SOS:
3552 			case M_EOI:
3553 				exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Could not compute size of thumbnail");
3554 				return FALSE;
3555 				break;
3556 
3557 			default:
3558 				/* just skip */
3559 				break;
3560 		}
3561 	}
3562 
3563 	exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Could not compute size of thumbnail");
3564 	return FALSE;
3565 }
3566 /* }}} */
3567 
3568 /* {{{ exif_process_IFD_in_TIFF
3569  * Parse the TIFF header; */
exif_process_IFD_in_TIFF(image_info_type * ImageInfo,size_t dir_offset,int section_index TSRMLS_DC)3570 static int exif_process_IFD_in_TIFF(image_info_type *ImageInfo, size_t dir_offset, int section_index TSRMLS_DC)
3571 {
3572 	int i, sn, num_entries, sub_section_index = 0;
3573 	unsigned char *dir_entry;
3574 	char tagname[64];
3575 	size_t ifd_size, dir_size, entry_offset, next_offset, entry_length, entry_value=0, fgot;
3576 	int entry_tag , entry_type;
3577 	tag_table_type tag_table = exif_get_tag_table(section_index);
3578 
3579 	if (ImageInfo->ifd_nesting_level > MAX_IFD_NESTING_LEVEL) {
3580                 return FALSE;
3581         }
3582 
3583 	if (ImageInfo->FileSize >= dir_offset+2) {
3584 		sn = exif_file_sections_add(ImageInfo, M_PSEUDO, 2, NULL);
3585 #ifdef EXIF_DEBUG
3586 		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read from TIFF: filesize(x%04X), IFD dir(x%04X + x%04X)", ImageInfo->FileSize, dir_offset, 2);
3587 #endif
3588 		php_stream_seek(ImageInfo->infile, dir_offset, SEEK_SET); /* we do not know the order of sections */
3589 		php_stream_read(ImageInfo->infile, (char*)ImageInfo->file.list[sn].data, 2);
3590 		num_entries = php_ifd_get16u(ImageInfo->file.list[sn].data, ImageInfo->motorola_intel);
3591 		dir_size = 2/*num dir entries*/ +12/*length of entry*/*num_entries +4/* offset to next ifd (points to thumbnail or NULL)*/;
3592 		if (ImageInfo->FileSize >= dir_offset+dir_size) {
3593 #ifdef EXIF_DEBUG
3594 			exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read from TIFF: filesize(x%04X), IFD dir(x%04X + x%04X), IFD entries(%d)", ImageInfo->FileSize, dir_offset+2, dir_size-2, num_entries);
3595 #endif
3596 			if (exif_file_sections_realloc(ImageInfo, sn, dir_size TSRMLS_CC)) {
3597 				return FALSE;
3598 			}
3599 			php_stream_read(ImageInfo->infile, (char*)(ImageInfo->file.list[sn].data+2), dir_size-2);
3600 			/*exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Dump: %s", exif_char_dump(ImageInfo->file.list[sn].data, dir_size, 0));*/
3601 			next_offset = php_ifd_get32u(ImageInfo->file.list[sn].data + dir_size - 4, ImageInfo->motorola_intel);
3602 #ifdef EXIF_DEBUG
3603 			exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read from TIFF done, next offset x%04X", next_offset);
3604 #endif
3605 			/* now we have the directory we can look how long it should be */
3606 			ifd_size = dir_size;
3607 			for(i=0;i<num_entries;i++) {
3608 				dir_entry 	 = ImageInfo->file.list[sn].data+2+i*12;
3609 				entry_tag    = php_ifd_get16u(dir_entry+0, ImageInfo->motorola_intel);
3610 				entry_type   = php_ifd_get16u(dir_entry+2, ImageInfo->motorola_intel);
3611 				if (entry_type > NUM_FORMATS) {
3612 					exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read from TIFF: tag(0x%04X,%12s): Illegal format code 0x%04X, switching to BYTE", entry_tag, exif_get_tagname(entry_tag, tagname, -12, tag_table TSRMLS_CC), entry_type);
3613 					/* Since this is repeated in exif_process_IFD_TAG make it a notice here */
3614 					/* and make it a warning in the exif_process_IFD_TAG which is called    */
3615 					/* elsewhere. */
3616 					entry_type = TAG_FMT_BYTE;
3617 					/*The next line would break the image on writeback: */
3618 					/* php_ifd_set16u(dir_entry+2, entry_type, ImageInfo->motorola_intel);*/
3619 				}
3620 				entry_length = php_ifd_get32u(dir_entry+4, ImageInfo->motorola_intel) * php_tiff_bytes_per_format[entry_type];
3621 				if (entry_length <= 4) {
3622 					switch(entry_type) {
3623 						case TAG_FMT_USHORT:
3624 							entry_value  = php_ifd_get16u(dir_entry+8, ImageInfo->motorola_intel);
3625 							break;
3626 						case TAG_FMT_SSHORT:
3627 							entry_value  = php_ifd_get16s(dir_entry+8, ImageInfo->motorola_intel);
3628 							break;
3629 						case TAG_FMT_ULONG:
3630 							entry_value  = php_ifd_get32u(dir_entry+8, ImageInfo->motorola_intel);
3631 							break;
3632 						case TAG_FMT_SLONG:
3633 							entry_value  = php_ifd_get32s(dir_entry+8, ImageInfo->motorola_intel);
3634 							break;
3635 					}
3636 					switch(entry_tag) {
3637 						case TAG_IMAGEWIDTH:
3638 						case TAG_COMP_IMAGE_WIDTH:
3639 							ImageInfo->Width  = entry_value;
3640 							break;
3641 						case TAG_IMAGEHEIGHT:
3642 						case TAG_COMP_IMAGE_HEIGHT:
3643 							ImageInfo->Height = entry_value;
3644 							break;
3645 						case TAG_PHOTOMETRIC_INTERPRETATION:
3646 							switch (entry_value) {
3647 								case PMI_BLACK_IS_ZERO:
3648 								case PMI_WHITE_IS_ZERO:
3649 								case PMI_TRANSPARENCY_MASK:
3650 									ImageInfo->IsColor = 0;
3651 									break;
3652 								case PMI_RGB:
3653 								case PMI_PALETTE_COLOR:
3654 								case PMI_SEPARATED:
3655 								case PMI_YCBCR:
3656 								case PMI_CIELAB:
3657 									ImageInfo->IsColor = 1;
3658 									break;
3659 							}
3660 							break;
3661 					}
3662 				} else {
3663 					entry_offset = php_ifd_get32u(dir_entry+8, ImageInfo->motorola_intel);
3664 					/* if entry needs expading ifd cache and entry is at end of current ifd cache. */
3665 					/* otherwise there may be huge holes between two entries */
3666 					if (entry_offset + entry_length > dir_offset + ifd_size
3667 					  && entry_offset == dir_offset + ifd_size) {
3668 						ifd_size = entry_offset + entry_length - dir_offset;
3669 #ifdef EXIF_DEBUG
3670 						exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Resize struct: x%04X + x%04X - x%04X = x%04X", entry_offset, entry_length, dir_offset, ifd_size);
3671 #endif
3672 					}
3673 				}
3674 			}
3675 			if (ImageInfo->FileSize >= dir_offset + ImageInfo->file.list[sn].size) {
3676 				if (ifd_size > dir_size) {
3677 					if (dir_offset + ifd_size > ImageInfo->FileSize) {
3678 						exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Error in TIFF: filesize(x%04X) less than size of IFD(x%04X + x%04X)", ImageInfo->FileSize, dir_offset, ifd_size);
3679 						return FALSE;
3680 					}
3681 					if (exif_file_sections_realloc(ImageInfo, sn, ifd_size TSRMLS_CC)) {
3682 						return FALSE;
3683 					}
3684 					/* read values not stored in directory itself */
3685 #ifdef EXIF_DEBUG
3686 					exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read from TIFF: filesize(x%04X), IFD(x%04X + x%04X)", ImageInfo->FileSize, dir_offset, ifd_size);
3687 #endif
3688 					php_stream_read(ImageInfo->infile, (char*)(ImageInfo->file.list[sn].data+dir_size), ifd_size-dir_size);
3689 #ifdef EXIF_DEBUG
3690 					exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read from TIFF, done");
3691 #endif
3692 				}
3693 				/* now process the tags */
3694 				for(i=0;i<num_entries;i++) {
3695 					dir_entry 	 = ImageInfo->file.list[sn].data+2+i*12;
3696 					entry_tag    = php_ifd_get16u(dir_entry+0, ImageInfo->motorola_intel);
3697 					entry_type   = php_ifd_get16u(dir_entry+2, ImageInfo->motorola_intel);
3698 					/*entry_length = php_ifd_get32u(dir_entry+4, ImageInfo->motorola_intel);*/
3699 					if (entry_tag == TAG_EXIF_IFD_POINTER ||
3700 						entry_tag == TAG_INTEROP_IFD_POINTER ||
3701 						entry_tag == TAG_GPS_IFD_POINTER ||
3702 						entry_tag == TAG_SUB_IFD
3703 					) {
3704 						switch(entry_tag) {
3705 							case TAG_EXIF_IFD_POINTER:
3706 								ImageInfo->sections_found |= FOUND_EXIF;
3707 								sub_section_index = SECTION_EXIF;
3708 								break;
3709 							case TAG_GPS_IFD_POINTER:
3710 								ImageInfo->sections_found |= FOUND_GPS;
3711 								sub_section_index = SECTION_GPS;
3712 								break;
3713 							case TAG_INTEROP_IFD_POINTER:
3714 								ImageInfo->sections_found |= FOUND_INTEROP;
3715 								sub_section_index = SECTION_INTEROP;
3716 								break;
3717 							case TAG_SUB_IFD:
3718 								ImageInfo->sections_found |= FOUND_THUMBNAIL;
3719 								sub_section_index = SECTION_THUMBNAIL;
3720 								break;
3721 						}
3722 						entry_offset = php_ifd_get32u(dir_entry+8, ImageInfo->motorola_intel);
3723 #ifdef EXIF_DEBUG
3724 						exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Next IFD: %s @x%04X", exif_get_sectionname(sub_section_index), entry_offset);
3725 #endif
3726 						ImageInfo->ifd_nesting_level++;
3727 						exif_process_IFD_in_TIFF(ImageInfo, entry_offset, sub_section_index TSRMLS_CC);
3728 						if (section_index!=SECTION_THUMBNAIL && entry_tag==TAG_SUB_IFD) {
3729 							if (ImageInfo->Thumbnail.filetype != IMAGE_FILETYPE_UNKNOWN
3730 							&&  ImageInfo->Thumbnail.size
3731 							&&  ImageInfo->Thumbnail.offset
3732 							&&  ImageInfo->read_thumbnail
3733 							) {
3734 #ifdef EXIF_DEBUG
3735 								exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "%s THUMBNAIL @0x%04X + 0x%04X", ImageInfo->Thumbnail.data ? "Ignore" : "Read", ImageInfo->Thumbnail.offset, ImageInfo->Thumbnail.size);
3736 #endif
3737 								if (!ImageInfo->Thumbnail.data) {
3738 									ImageInfo->Thumbnail.data = safe_emalloc(ImageInfo->Thumbnail.size, 1, 0);
3739 									php_stream_seek(ImageInfo->infile, ImageInfo->Thumbnail.offset, SEEK_SET);
3740 									fgot = php_stream_read(ImageInfo->infile, ImageInfo->Thumbnail.data, ImageInfo->Thumbnail.size);
3741 									if (fgot < ImageInfo->Thumbnail.size) {
3742 										EXIF_ERRLOG_THUMBEOF(ImageInfo)
3743 										efree(ImageInfo->Thumbnail.data);
3744 										ImageInfo->Thumbnail.data = NULL;
3745 									} else {
3746 										exif_thumbnail_build(ImageInfo TSRMLS_CC);
3747 									}
3748 								}
3749 							}
3750 						}
3751 #ifdef EXIF_DEBUG
3752 						exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Next IFD: %s done", exif_get_sectionname(sub_section_index));
3753 #endif
3754 					} else {
3755 						if (!exif_process_IFD_TAG(ImageInfo, (char*)dir_entry,
3756 												  (char*)(ImageInfo->file.list[sn].data-dir_offset),
3757 												  ifd_size, 0, section_index, 0, tag_table TSRMLS_CC)) {
3758 							return FALSE;
3759 						}
3760 					}
3761 				}
3762 				/* If we had a thumbnail in a SUB_IFD we have ANOTHER image in NEXT IFD */
3763 				if (next_offset && section_index != SECTION_THUMBNAIL) {
3764 					/* this should be a thumbnail IFD */
3765 					/* the thumbnail itself is stored at Tag=StripOffsets */
3766 #ifdef EXIF_DEBUG
3767 					exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read next IFD (THUMBNAIL) at x%04X", next_offset);
3768 #endif
3769 					ImageInfo->ifd_nesting_level++;
3770 					exif_process_IFD_in_TIFF(ImageInfo, next_offset, SECTION_THUMBNAIL TSRMLS_CC);
3771 #ifdef EXIF_DEBUG
3772 					exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "%s THUMBNAIL @0x%04X + 0x%04X", ImageInfo->Thumbnail.data ? "Ignore" : "Read", ImageInfo->Thumbnail.offset, ImageInfo->Thumbnail.size);
3773 #endif
3774 					if (!ImageInfo->Thumbnail.data && ImageInfo->Thumbnail.offset && ImageInfo->Thumbnail.size && ImageInfo->read_thumbnail) {
3775 						ImageInfo->Thumbnail.data = safe_emalloc(ImageInfo->Thumbnail.size, 1, 0);
3776 						php_stream_seek(ImageInfo->infile, ImageInfo->Thumbnail.offset, SEEK_SET);
3777 						fgot = php_stream_read(ImageInfo->infile, ImageInfo->Thumbnail.data, ImageInfo->Thumbnail.size);
3778 						if (fgot < ImageInfo->Thumbnail.size) {
3779 							EXIF_ERRLOG_THUMBEOF(ImageInfo)
3780 							efree(ImageInfo->Thumbnail.data);
3781 							ImageInfo->Thumbnail.data = NULL;
3782 						} else {
3783 							exif_thumbnail_build(ImageInfo TSRMLS_CC);
3784 						}
3785 					}
3786 #ifdef EXIF_DEBUG
3787 					exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read next IFD (THUMBNAIL) done");
3788 #endif
3789 				}
3790 				return TRUE;
3791 			} else {
3792 				exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Error in TIFF: filesize(x%04X) less than size of IFD(x%04X)", ImageInfo->FileSize, dir_offset+ImageInfo->file.list[sn].size);
3793 				return FALSE;
3794 			}
3795 		} else {
3796 			exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Error in TIFF: filesize(x%04X) less than size of IFD dir(x%04X)", ImageInfo->FileSize, dir_offset+dir_size);
3797 			return FALSE;
3798 		}
3799 	} else {
3800 		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Error in TIFF: filesize(x%04X) less than start of IFD dir(x%04X)", ImageInfo->FileSize, dir_offset+2);
3801 		return FALSE;
3802 	}
3803 }
3804 /* }}} */
3805 
3806 /* {{{ exif_scan_FILE_header
3807  * Parse the marker stream until SOS or EOI is seen; */
exif_scan_FILE_header(image_info_type * ImageInfo TSRMLS_DC)3808 static int exif_scan_FILE_header(image_info_type *ImageInfo TSRMLS_DC)
3809 {
3810 	unsigned char file_header[8];
3811 	int ret = FALSE;
3812 
3813 	ImageInfo->FileType = IMAGE_FILETYPE_UNKNOWN;
3814 
3815 	if (ImageInfo->FileSize >= 2) {
3816 		php_stream_seek(ImageInfo->infile, 0, SEEK_SET);
3817 		if (php_stream_read(ImageInfo->infile, (char*)file_header, 2) != 2) {
3818 			return FALSE;
3819 		}
3820 		if ((file_header[0]==0xff) && (file_header[1]==M_SOI)) {
3821 			ImageInfo->FileType = IMAGE_FILETYPE_JPEG;
3822 			if (exif_scan_JPEG_header(ImageInfo TSRMLS_CC)) {
3823 				ret = TRUE;
3824 			} else {
3825 				exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid JPEG file");
3826 			}
3827 		} else if (ImageInfo->FileSize >= 8) {
3828 			if (php_stream_read(ImageInfo->infile, (char*)(file_header+2), 6) != 6) {
3829 				return FALSE;
3830 			}
3831 			if (!memcmp(file_header, "II\x2A\x00", 4)) {
3832 				ImageInfo->FileType = IMAGE_FILETYPE_TIFF_II;
3833 				ImageInfo->motorola_intel = 0;
3834 #ifdef EXIF_DEBUG
3835 				exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "File has TIFF/II format");
3836 #endif
3837 				ImageInfo->sections_found |= FOUND_IFD0;
3838 				if (exif_process_IFD_in_TIFF(ImageInfo,
3839 											 php_ifd_get32u(file_header + 4, ImageInfo->motorola_intel),
3840 											 SECTION_IFD0 TSRMLS_CC)) {
3841 					ret = TRUE;
3842 				} else {
3843 					exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid TIFF file");
3844 				}
3845 			} else if (!memcmp(file_header, "MM\x00\x2a", 4)) {
3846 				ImageInfo->FileType = IMAGE_FILETYPE_TIFF_MM;
3847 				ImageInfo->motorola_intel = 1;
3848 #ifdef EXIF_DEBUG
3849 				exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "File has TIFF/MM format");
3850 #endif
3851 				ImageInfo->sections_found |= FOUND_IFD0;
3852 				if (exif_process_IFD_in_TIFF(ImageInfo,
3853 											 php_ifd_get32u(file_header + 4, ImageInfo->motorola_intel),
3854 											 SECTION_IFD0 TSRMLS_CC)) {
3855 					ret = TRUE;
3856 				} else {
3857 					exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid TIFF file");
3858 				}
3859 			} else {
3860 				exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "File not supported");
3861 				return FALSE;
3862 			}
3863 		}
3864 	} else {
3865 		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "File too small (%d)", ImageInfo->FileSize);
3866 	}
3867 	return ret;
3868 }
3869 /* }}} */
3870 
3871 /* {{{ exif_discard_imageinfo
3872    Discard data scanned by exif_read_file.
3873 */
exif_discard_imageinfo(image_info_type * ImageInfo)3874 static int exif_discard_imageinfo(image_info_type *ImageInfo)
3875 {
3876 	int i;
3877 
3878 	EFREE_IF(ImageInfo->FileName);
3879 	EFREE_IF(ImageInfo->UserComment);
3880 	EFREE_IF(ImageInfo->UserCommentEncoding);
3881 	EFREE_IF(ImageInfo->Copyright);
3882 	EFREE_IF(ImageInfo->CopyrightPhotographer);
3883 	EFREE_IF(ImageInfo->CopyrightEditor);
3884 	EFREE_IF(ImageInfo->Thumbnail.data);
3885 	EFREE_IF(ImageInfo->encode_unicode);
3886 	EFREE_IF(ImageInfo->decode_unicode_be);
3887 	EFREE_IF(ImageInfo->decode_unicode_le);
3888 	EFREE_IF(ImageInfo->encode_jis);
3889 	EFREE_IF(ImageInfo->decode_jis_be);
3890 	EFREE_IF(ImageInfo->decode_jis_le);
3891 	EFREE_IF(ImageInfo->make);
3892 	EFREE_IF(ImageInfo->model);
3893 	for (i=0; i<ImageInfo->xp_fields.count; i++) {
3894 		EFREE_IF(ImageInfo->xp_fields.list[i].value);
3895 	}
3896 	EFREE_IF(ImageInfo->xp_fields.list);
3897 	for (i=0; i<SECTION_COUNT; i++) {
3898 		exif_iif_free(ImageInfo, i);
3899 	}
3900 	exif_file_sections_free(ImageInfo);
3901 	memset(ImageInfo, 0, sizeof(*ImageInfo));
3902 	return TRUE;
3903 }
3904 /* }}} */
3905 
3906 /* {{{ exif_read_file
3907  */
exif_read_file(image_info_type * ImageInfo,char * FileName,int read_thumbnail,int read_all TSRMLS_DC)3908 static int exif_read_file(image_info_type *ImageInfo, char *FileName, int read_thumbnail, int read_all TSRMLS_DC)
3909 {
3910 	int ret;
3911 	struct stat st;
3912 
3913 	/* Start with an empty image information structure. */
3914 	memset(ImageInfo, 0, sizeof(*ImageInfo));
3915 
3916 	ImageInfo->motorola_intel = -1; /* flag as unknown */
3917 
3918 	ImageInfo->infile = php_stream_open_wrapper(FileName, "rb", STREAM_MUST_SEEK|IGNORE_PATH, NULL);
3919 	if (!ImageInfo->infile) {
3920 		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Unable to open file");
3921 		return FALSE;
3922 	}
3923 
3924 	if (php_stream_is(ImageInfo->infile, PHP_STREAM_IS_STDIO)) {
3925 		if (VCWD_STAT(FileName, &st) >= 0) {
3926 			if ((st.st_mode & S_IFMT) != S_IFREG) {
3927 				exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Not a file");
3928 				php_stream_close(ImageInfo->infile);
3929 				return FALSE;
3930 			}
3931 
3932 			/* Store file date/time. */
3933 			ImageInfo->FileDateTime = st.st_mtime;
3934 			ImageInfo->FileSize = st.st_size;
3935 			/*exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Opened stream is file: %d", ImageInfo->FileSize);*/
3936 		}
3937 	} else {
3938 		if (!ImageInfo->FileSize) {
3939 			php_stream_seek(ImageInfo->infile, 0, SEEK_END);
3940 			ImageInfo->FileSize = php_stream_tell(ImageInfo->infile);
3941 			php_stream_seek(ImageInfo->infile, 0, SEEK_SET);
3942 		}
3943 	}
3944 
3945 	php_basename(FileName, strlen(FileName), NULL, 0, &(ImageInfo->FileName), NULL TSRMLS_CC);
3946 	ImageInfo->read_thumbnail = read_thumbnail;
3947 	ImageInfo->read_all = read_all;
3948 	ImageInfo->Thumbnail.filetype = IMAGE_FILETYPE_UNKNOWN;
3949 
3950 	ImageInfo->encode_unicode    = safe_estrdup(EXIF_G(encode_unicode));
3951 	ImageInfo->decode_unicode_be = safe_estrdup(EXIF_G(decode_unicode_be));
3952 	ImageInfo->decode_unicode_le = safe_estrdup(EXIF_G(decode_unicode_le));
3953 	ImageInfo->encode_jis        = safe_estrdup(EXIF_G(encode_jis));
3954 	ImageInfo->decode_jis_be     = safe_estrdup(EXIF_G(decode_jis_be));
3955 	ImageInfo->decode_jis_le     = safe_estrdup(EXIF_G(decode_jis_le));
3956 
3957 
3958 	ImageInfo->ifd_nesting_level = 0;
3959 
3960 	/* Scan the JPEG headers. */
3961 	ret = exif_scan_FILE_header(ImageInfo TSRMLS_CC);
3962 
3963 	php_stream_close(ImageInfo->infile);
3964 	return ret;
3965 }
3966 /* }}} */
3967 
3968 /* {{{ proto array exif_read_data(string filename [, sections_needed [, sub_arrays[, read_thumbnail]]])
3969    Reads header data from the JPEG/TIFF image filename and optionally reads the internal thumbnails */
PHP_FUNCTION(exif_read_data)3970 PHP_FUNCTION(exif_read_data)
3971 {
3972 	char *p_name, *p_sections_needed = NULL;
3973 	int p_name_len, p_sections_needed_len = 0;
3974 	zend_bool sub_arrays=0, read_thumbnail=0, read_all=0;
3975 
3976 	int i, ret, sections_needed=0;
3977 	image_info_type ImageInfo;
3978 	char tmp[64], *sections_str, *s;
3979 
3980 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|sbb", &p_name, &p_name_len, &p_sections_needed, &p_sections_needed_len, &sub_arrays, &read_thumbnail) == FAILURE) {
3981 		return;
3982 	}
3983 
3984 	memset(&ImageInfo, 0, sizeof(ImageInfo));
3985 
3986 	if (p_sections_needed) {
3987 		spprintf(&sections_str, 0, ",%s,", p_sections_needed);
3988 		/* sections_str DOES start with , and SPACES are NOT allowed in names */
3989 		s = sections_str;
3990 		while (*++s) {
3991 			if (*s == ' ') {
3992 				*s = ',';
3993 			}
3994 		}
3995 
3996 		for (i = 0; i < SECTION_COUNT; i++) {
3997 			snprintf(tmp, sizeof(tmp), ",%s,", exif_get_sectionname(i));
3998 			if (strstr(sections_str, tmp)) {
3999 				sections_needed |= 1<<i;
4000 			}
4001 		}
4002 		EFREE_IF(sections_str);
4003 		/* now see what we need */
4004 #ifdef EXIF_DEBUG
4005 		sections_str = exif_get_sectionlist(sections_needed TSRMLS_CC);
4006 		if (!sections_str) {
4007 			RETURN_FALSE;
4008 		}
4009 		exif_error_docref(NULL EXIFERR_CC, &ImageInfo, E_NOTICE, "Sections needed: %s", sections_str[0] ? sections_str : "None");
4010 		EFREE_IF(sections_str);
4011 #endif
4012 	}
4013 
4014 	ret = exif_read_file(&ImageInfo, p_name, read_thumbnail, read_all TSRMLS_CC);
4015 	sections_str = exif_get_sectionlist(ImageInfo.sections_found TSRMLS_CC);
4016 
4017 #ifdef EXIF_DEBUG
4018 	if (sections_str)
4019 		exif_error_docref(NULL EXIFERR_CC, &ImageInfo, E_NOTICE, "Sections found: %s", sections_str[0] ? sections_str : "None");
4020 #endif
4021 
4022 	ImageInfo.sections_found |= FOUND_COMPUTED|FOUND_FILE;/* do not inform about in debug*/
4023 
4024 	if (ret == FALSE || (sections_needed && !(sections_needed&ImageInfo.sections_found))) {
4025 		/* array_init must be checked at last! otherwise the array must be freed if a later test fails. */
4026 		exif_discard_imageinfo(&ImageInfo);
4027 	   	EFREE_IF(sections_str);
4028 		RETURN_FALSE;
4029 	}
4030 
4031 	array_init(return_value);
4032 
4033 #ifdef EXIF_DEBUG
4034 	exif_error_docref(NULL EXIFERR_CC, &ImageInfo, E_NOTICE, "Generate section FILE");
4035 #endif
4036 
4037 	/* now we can add our information */
4038 	exif_iif_add_str(&ImageInfo, SECTION_FILE, "FileName",      ImageInfo.FileName TSRMLS_CC);
4039 	exif_iif_add_int(&ImageInfo, SECTION_FILE, "FileDateTime",  ImageInfo.FileDateTime TSRMLS_CC);
4040 	exif_iif_add_int(&ImageInfo, SECTION_FILE, "FileSize",      ImageInfo.FileSize TSRMLS_CC);
4041 	exif_iif_add_int(&ImageInfo, SECTION_FILE, "FileType",      ImageInfo.FileType TSRMLS_CC);
4042 	exif_iif_add_str(&ImageInfo, SECTION_FILE, "MimeType",      (char*)php_image_type_to_mime_type(ImageInfo.FileType) TSRMLS_CC);
4043 	exif_iif_add_str(&ImageInfo, SECTION_FILE, "SectionsFound", sections_str ? sections_str : "NONE" TSRMLS_CC);
4044 
4045 #ifdef EXIF_DEBUG
4046 	exif_error_docref(NULL EXIFERR_CC, &ImageInfo, E_NOTICE, "Generate section COMPUTED");
4047 #endif
4048 
4049 	if (ImageInfo.Width>0 &&  ImageInfo.Height>0) {
4050 		exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "html"    TSRMLS_CC, "width=\"%d\" height=\"%d\"", ImageInfo.Width, ImageInfo.Height);
4051 		exif_iif_add_int(&ImageInfo, SECTION_COMPUTED, "Height", ImageInfo.Height TSRMLS_CC);
4052 		exif_iif_add_int(&ImageInfo, SECTION_COMPUTED, "Width",  ImageInfo.Width TSRMLS_CC);
4053 	}
4054 	exif_iif_add_int(&ImageInfo, SECTION_COMPUTED, "IsColor", ImageInfo.IsColor TSRMLS_CC);
4055 	if (ImageInfo.motorola_intel != -1) {
4056 		exif_iif_add_int(&ImageInfo, SECTION_COMPUTED, "ByteOrderMotorola", ImageInfo.motorola_intel TSRMLS_CC);
4057 	}
4058 	if (ImageInfo.FocalLength) {
4059 		exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "FocalLength" TSRMLS_CC, "%4.1Fmm", ImageInfo.FocalLength);
4060 		if(ImageInfo.CCDWidth) {
4061 			exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "35mmFocalLength" TSRMLS_CC, "%dmm", (int)(ImageInfo.FocalLength/ImageInfo.CCDWidth*35+0.5));
4062 		}
4063 	}
4064 	if(ImageInfo.CCDWidth) {
4065 		exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "CCDWidth" TSRMLS_CC, "%dmm", (int)ImageInfo.CCDWidth);
4066 	}
4067 	if(ImageInfo.ExposureTime>0) {
4068 		if(ImageInfo.ExposureTime <= 0.5) {
4069 			exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "ExposureTime" TSRMLS_CC, "%0.3F s (1/%d)", ImageInfo.ExposureTime, (int)(0.5 + 1/ImageInfo.ExposureTime));
4070 		} else {
4071 			exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "ExposureTime" TSRMLS_CC, "%0.3F s", ImageInfo.ExposureTime);
4072 		}
4073 	}
4074 	if(ImageInfo.ApertureFNumber) {
4075 		exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "ApertureFNumber" TSRMLS_CC, "f/%.1F", ImageInfo.ApertureFNumber);
4076 	}
4077 	if(ImageInfo.Distance) {
4078 		if(ImageInfo.Distance<0) {
4079 			exif_iif_add_str(&ImageInfo, SECTION_COMPUTED, "FocusDistance", "Infinite" TSRMLS_CC);
4080 		} else {
4081 			exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "FocusDistance" TSRMLS_CC, "%0.2Fm", ImageInfo.Distance);
4082 		}
4083 	}
4084 	if (ImageInfo.UserComment) {
4085 		exif_iif_add_buffer(&ImageInfo, SECTION_COMPUTED, "UserComment", ImageInfo.UserCommentLength, ImageInfo.UserComment TSRMLS_CC);
4086 		if (ImageInfo.UserCommentEncoding && strlen(ImageInfo.UserCommentEncoding)) {
4087 			exif_iif_add_str(&ImageInfo, SECTION_COMPUTED, "UserCommentEncoding", ImageInfo.UserCommentEncoding TSRMLS_CC);
4088 		}
4089 	}
4090 
4091 	exif_iif_add_str(&ImageInfo, SECTION_COMPUTED, "Copyright",              ImageInfo.Copyright TSRMLS_CC);
4092 	exif_iif_add_str(&ImageInfo, SECTION_COMPUTED, "Copyright.Photographer", ImageInfo.CopyrightPhotographer TSRMLS_CC);
4093 	exif_iif_add_str(&ImageInfo, SECTION_COMPUTED, "Copyright.Editor",       ImageInfo.CopyrightEditor TSRMLS_CC);
4094 
4095 	for (i=0; i<ImageInfo.xp_fields.count; i++) {
4096 		exif_iif_add_str(&ImageInfo, SECTION_WINXP, exif_get_tagname(ImageInfo.xp_fields.list[i].tag, NULL, 0, exif_get_tag_table(SECTION_WINXP) TSRMLS_CC), ImageInfo.xp_fields.list[i].value TSRMLS_CC);
4097 	}
4098 	if (ImageInfo.Thumbnail.size) {
4099 		if (read_thumbnail) {
4100 			/* not exif_iif_add_str : this is a buffer */
4101 			exif_iif_add_tag(&ImageInfo, SECTION_THUMBNAIL, "THUMBNAIL", TAG_NONE, TAG_FMT_UNDEFINED, ImageInfo.Thumbnail.size, ImageInfo.Thumbnail.data TSRMLS_CC);
4102 		}
4103 		if (!ImageInfo.Thumbnail.width || !ImageInfo.Thumbnail.height) {
4104 			/* try to evaluate if thumbnail data is present */
4105 			exif_scan_thumbnail(&ImageInfo TSRMLS_CC);
4106 		}
4107 		exif_iif_add_int(&ImageInfo, SECTION_COMPUTED, "Thumbnail.FileType", ImageInfo.Thumbnail.filetype TSRMLS_CC);
4108 		exif_iif_add_str(&ImageInfo, SECTION_COMPUTED, "Thumbnail.MimeType", (char*)php_image_type_to_mime_type(ImageInfo.Thumbnail.filetype) TSRMLS_CC);
4109 	}
4110 	if (ImageInfo.Thumbnail.width && ImageInfo.Thumbnail.height) {
4111 		exif_iif_add_int(&ImageInfo, SECTION_COMPUTED, "Thumbnail.Height", ImageInfo.Thumbnail.height TSRMLS_CC);
4112 		exif_iif_add_int(&ImageInfo, SECTION_COMPUTED, "Thumbnail.Width",  ImageInfo.Thumbnail.width TSRMLS_CC);
4113 	}
4114    	EFREE_IF(sections_str);
4115 
4116 #ifdef EXIF_DEBUG
4117 	exif_error_docref(NULL EXIFERR_CC, &ImageInfo, E_NOTICE, "Adding image infos");
4118 #endif
4119 
4120 	add_assoc_image_info(return_value, sub_arrays, &ImageInfo, SECTION_FILE       TSRMLS_CC);
4121 	add_assoc_image_info(return_value, 1,          &ImageInfo, SECTION_COMPUTED   TSRMLS_CC);
4122 	add_assoc_image_info(return_value, sub_arrays, &ImageInfo, SECTION_ANY_TAG    TSRMLS_CC);
4123 	add_assoc_image_info(return_value, sub_arrays, &ImageInfo, SECTION_IFD0       TSRMLS_CC);
4124 	add_assoc_image_info(return_value, 1,          &ImageInfo, SECTION_THUMBNAIL  TSRMLS_CC);
4125 	add_assoc_image_info(return_value, 1,          &ImageInfo, SECTION_COMMENT    TSRMLS_CC);
4126 	add_assoc_image_info(return_value, sub_arrays, &ImageInfo, SECTION_EXIF       TSRMLS_CC);
4127 	add_assoc_image_info(return_value, sub_arrays, &ImageInfo, SECTION_GPS        TSRMLS_CC);
4128 	add_assoc_image_info(return_value, sub_arrays, &ImageInfo, SECTION_INTEROP    TSRMLS_CC);
4129 	add_assoc_image_info(return_value, sub_arrays, &ImageInfo, SECTION_FPIX       TSRMLS_CC);
4130 	add_assoc_image_info(return_value, sub_arrays, &ImageInfo, SECTION_APP12      TSRMLS_CC);
4131 	add_assoc_image_info(return_value, sub_arrays, &ImageInfo, SECTION_WINXP      TSRMLS_CC);
4132 	add_assoc_image_info(return_value, sub_arrays, &ImageInfo, SECTION_MAKERNOTE  TSRMLS_CC);
4133 
4134 #ifdef EXIF_DEBUG
4135 	exif_error_docref(NULL EXIFERR_CC, &ImageInfo, E_NOTICE, "Discarding info");
4136 #endif
4137 
4138 	exif_discard_imageinfo(&ImageInfo);
4139 
4140 #ifdef EXIF_DEBUG
4141 	php_error_docref1(NULL TSRMLS_CC, Z_STRVAL_PP(p_name), E_NOTICE, "done");
4142 #endif
4143 }
4144 /* }}} */
4145 
4146 /* {{{ proto string exif_thumbnail(string filename [, &width, &height [, &imagetype]])
4147    Reads the embedded thumbnail */
PHP_FUNCTION(exif_thumbnail)4148 PHP_FUNCTION(exif_thumbnail)
4149 {
4150 	zval *p_width = 0, *p_height = 0, *p_imagetype = 0;
4151 	char *p_name;
4152 	int p_name_len, ret, arg_c = ZEND_NUM_ARGS();
4153 	image_info_type ImageInfo;
4154 
4155 	memset(&ImageInfo, 0, sizeof(ImageInfo));
4156 
4157 	if (arg_c!=1 && arg_c!=3 && arg_c!=4) {
4158 		WRONG_PARAM_COUNT;
4159 	}
4160 
4161 	if (zend_parse_parameters(arg_c TSRMLS_CC, "p|z/z/z/", &p_name, &p_name_len, &p_width, &p_height, &p_imagetype) == FAILURE) {
4162 		return;
4163 	}
4164 
4165 	ret = exif_read_file(&ImageInfo, p_name, 1, 0 TSRMLS_CC);
4166 	if (ret==FALSE) {
4167 		exif_discard_imageinfo(&ImageInfo);
4168 		RETURN_FALSE;
4169 	}
4170 
4171 #ifdef EXIF_DEBUG
4172 	exif_error_docref(NULL EXIFERR_CC, &ImageInfo, E_NOTICE, "Thumbnail data %d %d %d, %d x %d", ImageInfo.Thumbnail.data, ImageInfo.Thumbnail.size, ImageInfo.Thumbnail.filetype, ImageInfo.Thumbnail.width, ImageInfo.Thumbnail.height);
4173 #endif
4174 	if (!ImageInfo.Thumbnail.data || !ImageInfo.Thumbnail.size) {
4175 		exif_discard_imageinfo(&ImageInfo);
4176 		RETURN_FALSE;
4177 	}
4178 
4179 #ifdef EXIF_DEBUG
4180 	exif_error_docref(NULL EXIFERR_CC, &ImageInfo, E_NOTICE, "Returning thumbnail(%d)", ImageInfo.Thumbnail.size);
4181 #endif
4182 
4183 	ZVAL_STRINGL(return_value, ImageInfo.Thumbnail.data, ImageInfo.Thumbnail.size, 1);
4184 	if (arg_c >= 3) {
4185 		if (!ImageInfo.Thumbnail.width || !ImageInfo.Thumbnail.height) {
4186 			exif_scan_thumbnail(&ImageInfo TSRMLS_CC);
4187 		}
4188 		zval_dtor(p_width);
4189 		zval_dtor(p_height);
4190 		ZVAL_LONG(p_width,  ImageInfo.Thumbnail.width);
4191 		ZVAL_LONG(p_height, ImageInfo.Thumbnail.height);
4192 	}
4193 	if (arg_c >= 4)	{
4194 		zval_dtor(p_imagetype);
4195 		ZVAL_LONG(p_imagetype, ImageInfo.Thumbnail.filetype);
4196 	}
4197 
4198 #ifdef EXIF_DEBUG
4199 	exif_error_docref(NULL EXIFERR_CC, &ImageInfo, E_NOTICE, "Discarding info");
4200 #endif
4201 
4202 	exif_discard_imageinfo(&ImageInfo);
4203 
4204 #ifdef EXIF_DEBUG
4205 	php_error_docref1(NULL TSRMLS_CC, p_name, E_NOTICE, "Done");
4206 #endif
4207 }
4208 /* }}} */
4209 
4210 /* {{{ proto int exif_imagetype(string imagefile)
4211    Get the type of an image */
PHP_FUNCTION(exif_imagetype)4212 PHP_FUNCTION(exif_imagetype)
4213 {
4214 	char *imagefile;
4215 	int imagefile_len;
4216 	php_stream * stream;
4217  	int itype = 0;
4218 
4219 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &imagefile, &imagefile_len) == FAILURE) {
4220 		return;
4221 	}
4222 
4223 	stream = php_stream_open_wrapper(imagefile, "rb", IGNORE_PATH|REPORT_ERRORS, NULL);
4224 
4225 	if (stream == NULL) {
4226 		RETURN_FALSE;
4227 	}
4228 
4229 	itype = php_getimagetype(stream, NULL TSRMLS_CC);
4230 
4231 	php_stream_close(stream);
4232 
4233 	if (itype == IMAGE_FILETYPE_UNKNOWN) {
4234 		RETURN_FALSE;
4235 	} else {
4236 		ZVAL_LONG(return_value, itype);
4237 	}
4238 }
4239 /* }}} */
4240 
4241 #endif
4242 
4243 /*
4244  * Local variables:
4245  * tab-width: 4
4246  * c-basic-offset: 4
4247  * End:
4248  * vim600: sw=4 ts=4 tw=78 fdm=marker
4249  * vim<600: sw=4 ts=4 tw=78
4250  */
4251