xref: /PHP-7.0/ext/exif/exif.c (revision 3462efa3)
1 /*
2    +----------------------------------------------------------------------+
3    | PHP Version 7                                                        |
4    +----------------------------------------------------------------------+
5    | Copyright (c) 1997-2017 The PHP Group                                |
6    +----------------------------------------------------------------------+
7    | This source file is subject to version 3.01 of the PHP license,      |
8    | that is bundled with this package in the file LICENSE, and is        |
9    | available through the world-wide-web at the following url:           |
10    | http://www.php.net/license/3_01.txt                                  |
11    | If you did not receive a copy of the PHP license and are unable to   |
12    | obtain it through the world-wide-web, please send a note to          |
13    | license@php.net so we can mail you a copy immediately.               |
14    +----------------------------------------------------------------------+
15    | Authors: Rasmus Lerdorf <rasmus@php.net>                             |
16    |          Marcus Boerger <helly@php.net>                              |
17    +----------------------------------------------------------------------+
18  */
19 
20 /* $Id: 6fa60f7a2a20e6daf6b0447f73f279469b26d20f $ */
21 
22 /*  ToDos
23  *
24  * 	See if example images from http://www.exif.org have illegal
25  * 		thumbnail sizes or if code is corrupt.
26  * 	Create/Update exif headers.
27  * 	Create/Remove/Update image thumbnails.
28  */
29 
30 /*  Security
31  *
32  *  At current time i do not see any security problems but a potential
33  *  attacker could generate an image with recursive ifd pointers...(Marcus)
34  */
35 
36 #ifdef HAVE_CONFIG_H
37 #include "config.h"
38 #endif
39 
40 #include "php.h"
41 #include "ext/standard/file.h"
42 
43 #if HAVE_EXIF
44 
45 /* When EXIF_DEBUG is defined the module generates a lot of debug messages
46  * that help understanding what is going on. This can and should be used
47  * while extending the module as it shows if you are at the right position.
48  * You are always considered to have a copy of TIFF6.0 and EXIF2.10 standard.
49  */
50 #undef EXIF_DEBUG
51 
52 #ifdef EXIF_DEBUG
53 #define EXIFERR_DC , const char *_file, size_t _line
54 #define EXIFERR_CC , __FILE__, __LINE__
55 #else
56 #define EXIFERR_DC
57 #define EXIFERR_CC
58 #endif
59 
60 #undef EXIF_JPEG2000
61 
62 #include "php_exif.h"
63 #include <math.h>
64 #include "php_ini.h"
65 #include "ext/standard/php_string.h"
66 #include "ext/standard/php_image.h"
67 #include "ext/standard/info.h"
68 
69 /* needed for ssize_t definition */
70 #include <sys/types.h>
71 
72 typedef unsigned char uchar;
73 
74 #ifndef safe_emalloc
75 # define safe_emalloc(a,b,c) emalloc((a)*(b)+(c))
76 #endif
77 #ifndef safe_erealloc
78 # define safe_erealloc(p,a,b,c) erealloc(p, (a)*(b)+(c))
79 #endif
80 
81 #ifndef TRUE
82 #	define TRUE 1
83 #	define FALSE 0
84 #endif
85 
86 #ifndef max
87 #	define max(a,b) ((a)>(b) ? (a) : (b))
88 #endif
89 
90 #define EFREE_IF(ptr)	if (ptr) efree(ptr)
91 
92 #define MAX_IFD_NESTING_LEVEL 100
93 
94 /* {{{ arginfo */
95 ZEND_BEGIN_ARG_INFO(arginfo_exif_tagname, 0)
96 	ZEND_ARG_INFO(0, index)
97 ZEND_END_ARG_INFO()
98 
99 ZEND_BEGIN_ARG_INFO_EX(arginfo_exif_read_data, 0, 0, 1)
100 	ZEND_ARG_INFO(0, filename)
101 	ZEND_ARG_INFO(0, sections_needed)
102 	ZEND_ARG_INFO(0, sub_arrays)
103 	ZEND_ARG_INFO(0, read_thumbnail)
104 ZEND_END_ARG_INFO()
105 
106 ZEND_BEGIN_ARG_INFO_EX(arginfo_exif_thumbnail, 0, 0, 1)
107 	ZEND_ARG_INFO(0, filename)
108 	ZEND_ARG_INFO(1, width)
109 	ZEND_ARG_INFO(1, height)
110 	ZEND_ARG_INFO(1, imagetype)
111 ZEND_END_ARG_INFO()
112 
113 ZEND_BEGIN_ARG_INFO(arginfo_exif_imagetype, 0)
114 	ZEND_ARG_INFO(0, imagefile)
115 ZEND_END_ARG_INFO()
116 
117 /* }}} */
118 
119 /* {{{ exif_functions[]
120  */
121 const zend_function_entry exif_functions[] = {
122 	PHP_FE(exif_read_data, arginfo_exif_read_data)
123 	PHP_FALIAS(read_exif_data, exif_read_data, arginfo_exif_read_data)
124 	PHP_FE(exif_tagname, arginfo_exif_tagname)
125 	PHP_FE(exif_thumbnail, arginfo_exif_thumbnail)
126 	PHP_FE(exif_imagetype, arginfo_exif_imagetype)
127 	PHP_FE_END
128 };
129 /* }}} */
130 
131 /* {{{ PHP_MINFO_FUNCTION
132  */
PHP_MINFO_FUNCTION(exif)133 PHP_MINFO_FUNCTION(exif)
134 {
135 	php_info_print_table_start();
136 	php_info_print_table_row(2, "EXIF Support", "enabled");
137 	php_info_print_table_row(2, "EXIF Version", PHP_EXIF_VERSION);
138 	php_info_print_table_row(2, "Supported EXIF Version", "0220");
139 	php_info_print_table_row(2, "Supported filetypes", "JPEG,TIFF");
140 	php_info_print_table_end();
141 	DISPLAY_INI_ENTRIES();
142 }
143 /* }}} */
144 
145 ZEND_BEGIN_MODULE_GLOBALS(exif)
146 	char * encode_unicode;
147 	char * decode_unicode_be;
148 	char * decode_unicode_le;
149 	char * encode_jis;
150 	char * decode_jis_be;
151 	char * decode_jis_le;
152 ZEND_END_MODULE_GLOBALS(exif)
153 
ZEND_DECLARE_MODULE_GLOBALS(exif)154 ZEND_DECLARE_MODULE_GLOBALS(exif)
155 #define EXIF_G(v) ZEND_MODULE_GLOBALS_ACCESSOR(exif, v)
156 
157 #if defined(ZTS) && defined(COMPILE_DL_EXIF)
158 ZEND_TSRMLS_CACHE_DEFINE()
159 #endif
160 
161 /* {{{ PHP_INI
162  */
163 
164 ZEND_INI_MH(OnUpdateEncode)
165 {
166 	if (new_value && ZSTR_LEN(new_value)) {
167 		const zend_encoding **return_list;
168 		size_t return_size;
169 		if (FAILURE == zend_multibyte_parse_encoding_list(ZSTR_VAL(new_value), ZSTR_LEN(new_value),
170 	&return_list, &return_size, 0)) {
171 			php_error_docref(NULL, E_WARNING, "Illegal encoding ignored: '%s'", ZSTR_VAL(new_value));
172 			return FAILURE;
173 		}
174 		efree(return_list);
175 	}
176 	return OnUpdateString(entry, new_value, mh_arg1, mh_arg2, mh_arg3, stage);
177 }
178 
ZEND_INI_MH(OnUpdateDecode)179 ZEND_INI_MH(OnUpdateDecode)
180 {
181 	if (new_value) {
182 		const zend_encoding **return_list;
183 		size_t return_size;
184 		if (FAILURE == zend_multibyte_parse_encoding_list(ZSTR_VAL(new_value), ZSTR_LEN(new_value),
185 	&return_list, &return_size, 0)) {
186 			php_error_docref(NULL, E_WARNING, "Illegal encoding ignored: '%s'", ZSTR_VAL(new_value));
187 			return FAILURE;
188 		}
189 		efree(return_list);
190 	}
191 	return OnUpdateString(entry, new_value, mh_arg1, mh_arg2, mh_arg3, stage);
192 }
193 
194 PHP_INI_BEGIN()
195     STD_PHP_INI_ENTRY("exif.encode_unicode",          "ISO-8859-15", PHP_INI_ALL, OnUpdateEncode, encode_unicode,    zend_exif_globals, exif_globals)
196     STD_PHP_INI_ENTRY("exif.decode_unicode_motorola", "UCS-2BE",     PHP_INI_ALL, OnUpdateDecode, decode_unicode_be, zend_exif_globals, exif_globals)
197     STD_PHP_INI_ENTRY("exif.decode_unicode_intel",    "UCS-2LE",     PHP_INI_ALL, OnUpdateDecode, decode_unicode_le, zend_exif_globals, exif_globals)
198     STD_PHP_INI_ENTRY("exif.encode_jis",              "",            PHP_INI_ALL, OnUpdateEncode, encode_jis,        zend_exif_globals, exif_globals)
199     STD_PHP_INI_ENTRY("exif.decode_jis_motorola",     "JIS",         PHP_INI_ALL, OnUpdateDecode, decode_jis_be,     zend_exif_globals, exif_globals)
200     STD_PHP_INI_ENTRY("exif.decode_jis_intel",        "JIS",         PHP_INI_ALL, OnUpdateDecode, decode_jis_le,     zend_exif_globals, exif_globals)
PHP_INI_END()201 PHP_INI_END()
202 /* }}} */
203 
204 /* {{{ PHP_GINIT_FUNCTION
205  */
206 static PHP_GINIT_FUNCTION(exif)
207 {
208 #if defined(COMPILE_DL_EXIF) && defined(ZTS)
209 	ZEND_TSRMLS_CACHE_UPDATE();
210 #endif
211 	exif_globals->encode_unicode    = NULL;
212 	exif_globals->decode_unicode_be = NULL;
213 	exif_globals->decode_unicode_le = NULL;
214 	exif_globals->encode_jis        = NULL;
215 	exif_globals->decode_jis_be     = NULL;
216 	exif_globals->decode_jis_le     = NULL;
217 }
218 /* }}} */
219 
220 /* {{{ PHP_MINIT_FUNCTION(exif)
221    Get the size of an image as 4-element array */
PHP_MINIT_FUNCTION(exif)222 PHP_MINIT_FUNCTION(exif)
223 {
224 	REGISTER_INI_ENTRIES();
225 	if (zend_hash_str_exists(&module_registry, "mbstring", sizeof("mbstring")-1)) {
226 		REGISTER_LONG_CONSTANT("EXIF_USE_MBSTRING", 1, CONST_CS | CONST_PERSISTENT);
227 	} else {
228 		REGISTER_LONG_CONSTANT("EXIF_USE_MBSTRING", 0, CONST_CS | CONST_PERSISTENT);
229 	}
230 	return SUCCESS;
231 }
232 /* }}} */
233 
234 /* {{{ PHP_MSHUTDOWN_FUNCTION
235  */
PHP_MSHUTDOWN_FUNCTION(exif)236 PHP_MSHUTDOWN_FUNCTION(exif)
237 {
238 	UNREGISTER_INI_ENTRIES();
239 	return SUCCESS;
240 }
241 /* }}} */
242 
243 /* {{{ exif dependencies */
244 static const zend_module_dep exif_module_deps[] = {
245 	ZEND_MOD_REQUIRED("standard")
246 	ZEND_MOD_OPTIONAL("mbstring")
247 	ZEND_MOD_END
248 };
249 /* }}} */
250 
251 /* {{{ exif_module_entry
252  */
253 zend_module_entry exif_module_entry = {
254 	STANDARD_MODULE_HEADER_EX, NULL,
255 	exif_module_deps,
256 	"exif",
257 	exif_functions,
258 	PHP_MINIT(exif),
259 	PHP_MSHUTDOWN(exif),
260 	NULL, NULL,
261 	PHP_MINFO(exif),
262 	PHP_EXIF_VERSION,
263 	PHP_MODULE_GLOBALS(exif),
264 	PHP_GINIT(exif),
265 	NULL,
266 	NULL,
267 	STANDARD_MODULE_PROPERTIES_EX
268 };
269 /* }}} */
270 
271 #ifdef COMPILE_DL_EXIF
ZEND_GET_MODULE(exif)272 ZEND_GET_MODULE(exif)
273 #endif
274 
275 /* {{{ php_strnlen
276  * get length of string if buffer if less than buffer size or buffer size */
277 static size_t php_strnlen(char* str, size_t maxlen) {
278 	size_t len = 0;
279 
280 	if (str && maxlen && *str) {
281 		do {
282 			len++;
283 		} while (--maxlen && *(++str));
284 	}
285 	return len;
286 }
287 /* }}} */
288 
289 /* {{{ error messages
290 */
291 static const char * EXIF_ERROR_FILEEOF   = "Unexpected end of file reached";
292 static const char * EXIF_ERROR_CORRUPT   = "File structure corrupted";
293 static const char * EXIF_ERROR_THUMBEOF  = "Thumbnail goes IFD boundary or end of file reached";
294 static const char * EXIF_ERROR_FSREALLOC = "Illegal reallocating of undefined file section";
295 
296 #define EXIF_ERRLOG_FILEEOF(ImageInfo)    exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "%s", EXIF_ERROR_FILEEOF);
297 #define EXIF_ERRLOG_CORRUPT(ImageInfo)    exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "%s", EXIF_ERROR_CORRUPT);
298 #define EXIF_ERRLOG_THUMBEOF(ImageInfo)   exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "%s", EXIF_ERROR_THUMBEOF);
299 #define EXIF_ERRLOG_FSREALLOC(ImageInfo)  exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "%s", EXIF_ERROR_FSREALLOC);
300 /* }}} */
301 
302 /* {{{ format description defines
303    Describes format descriptor
304 */
305 static int php_tiff_bytes_per_format[] = {0, 1, 1, 2, 4, 8, 1, 1, 2, 4, 8, 4, 8, 1};
306 #define NUM_FORMATS 13
307 
308 #define TAG_FMT_BYTE       1
309 #define TAG_FMT_STRING     2
310 #define TAG_FMT_USHORT     3
311 #define TAG_FMT_ULONG      4
312 #define TAG_FMT_URATIONAL  5
313 #define TAG_FMT_SBYTE      6
314 #define TAG_FMT_UNDEFINED  7
315 #define TAG_FMT_SSHORT     8
316 #define TAG_FMT_SLONG      9
317 #define TAG_FMT_SRATIONAL 10
318 #define TAG_FMT_SINGLE    11
319 #define TAG_FMT_DOUBLE    12
320 #define TAG_FMT_IFD       13
321 
322 #ifdef EXIF_DEBUG
exif_get_tagformat(int format)323 static char *exif_get_tagformat(int format)
324 {
325 	switch(format) {
326 		case TAG_FMT_BYTE:      return "BYTE";
327 		case TAG_FMT_STRING:    return "STRING";
328 		case TAG_FMT_USHORT:    return "USHORT";
329 		case TAG_FMT_ULONG:     return "ULONG";
330 		case TAG_FMT_URATIONAL: return "URATIONAL";
331 		case TAG_FMT_SBYTE:     return "SBYTE";
332 		case TAG_FMT_UNDEFINED: return "UNDEFINED";
333 		case TAG_FMT_SSHORT:    return "SSHORT";
334 		case TAG_FMT_SLONG:     return "SLONG";
335 		case TAG_FMT_SRATIONAL: return "SRATIONAL";
336 		case TAG_FMT_SINGLE:    return "SINGLE";
337 		case TAG_FMT_DOUBLE:    return "DOUBLE";
338 		case TAG_FMT_IFD:       return "IFD";
339 	}
340 	return "*Illegal";
341 }
342 #endif
343 
344 /* Describes tag values */
345 #define TAG_GPS_VERSION_ID              0x0000
346 #define TAG_GPS_LATITUDE_REF            0x0001
347 #define TAG_GPS_LATITUDE                0x0002
348 #define TAG_GPS_LONGITUDE_REF           0x0003
349 #define TAG_GPS_LONGITUDE               0x0004
350 #define TAG_GPS_ALTITUDE_REF            0x0005
351 #define TAG_GPS_ALTITUDE                0x0006
352 #define TAG_GPS_TIME_STAMP              0x0007
353 #define TAG_GPS_SATELLITES              0x0008
354 #define TAG_GPS_STATUS                  0x0009
355 #define TAG_GPS_MEASURE_MODE            0x000A
356 #define TAG_GPS_DOP                     0x000B
357 #define TAG_GPS_SPEED_REF               0x000C
358 #define TAG_GPS_SPEED                   0x000D
359 #define TAG_GPS_TRACK_REF               0x000E
360 #define TAG_GPS_TRACK                   0x000F
361 #define TAG_GPS_IMG_DIRECTION_REF       0x0010
362 #define TAG_GPS_IMG_DIRECTION           0x0011
363 #define TAG_GPS_MAP_DATUM               0x0012
364 #define TAG_GPS_DEST_LATITUDE_REF       0x0013
365 #define TAG_GPS_DEST_LATITUDE           0x0014
366 #define TAG_GPS_DEST_LONGITUDE_REF      0x0015
367 #define TAG_GPS_DEST_LONGITUDE          0x0016
368 #define TAG_GPS_DEST_BEARING_REF        0x0017
369 #define TAG_GPS_DEST_BEARING            0x0018
370 #define TAG_GPS_DEST_DISTANCE_REF       0x0019
371 #define TAG_GPS_DEST_DISTANCE           0x001A
372 #define TAG_GPS_PROCESSING_METHOD       0x001B
373 #define TAG_GPS_AREA_INFORMATION        0x001C
374 #define TAG_GPS_DATE_STAMP              0x001D
375 #define TAG_GPS_DIFFERENTIAL            0x001E
376 #define TAG_TIFF_COMMENT                0x00FE /* SHOUDLNT HAPPEN */
377 #define TAG_NEW_SUBFILE                 0x00FE /* New version of subfile tag */
378 #define TAG_SUBFILE_TYPE                0x00FF /* Old version of subfile tag */
379 #define TAG_IMAGEWIDTH                  0x0100
380 #define TAG_IMAGEHEIGHT                 0x0101
381 #define TAG_BITS_PER_SAMPLE             0x0102
382 #define TAG_COMPRESSION                 0x0103
383 #define TAG_PHOTOMETRIC_INTERPRETATION  0x0106
384 #define TAG_TRESHHOLDING                0x0107
385 #define TAG_CELL_WIDTH                  0x0108
386 #define TAG_CELL_HEIGHT                 0x0109
387 #define TAG_FILL_ORDER                  0x010A
388 #define TAG_DOCUMENT_NAME               0x010D
389 #define TAG_IMAGE_DESCRIPTION           0x010E
390 #define TAG_MAKE                        0x010F
391 #define TAG_MODEL                       0x0110
392 #define TAG_STRIP_OFFSETS               0x0111
393 #define TAG_ORIENTATION                 0x0112
394 #define TAG_SAMPLES_PER_PIXEL           0x0115
395 #define TAG_ROWS_PER_STRIP              0x0116
396 #define TAG_STRIP_BYTE_COUNTS           0x0117
397 #define TAG_MIN_SAMPPLE_VALUE           0x0118
398 #define TAG_MAX_SAMPLE_VALUE            0x0119
399 #define TAG_X_RESOLUTION                0x011A
400 #define TAG_Y_RESOLUTION                0x011B
401 #define TAG_PLANAR_CONFIGURATION        0x011C
402 #define TAG_PAGE_NAME                   0x011D
403 #define TAG_X_POSITION                  0x011E
404 #define TAG_Y_POSITION                  0x011F
405 #define TAG_FREE_OFFSETS                0x0120
406 #define TAG_FREE_BYTE_COUNTS            0x0121
407 #define TAG_GRAY_RESPONSE_UNIT          0x0122
408 #define TAG_GRAY_RESPONSE_CURVE         0x0123
409 #define TAG_RESOLUTION_UNIT             0x0128
410 #define TAG_PAGE_NUMBER                 0x0129
411 #define TAG_TRANSFER_FUNCTION           0x012D
412 #define TAG_SOFTWARE                    0x0131
413 #define TAG_DATETIME                    0x0132
414 #define TAG_ARTIST                      0x013B
415 #define TAG_HOST_COMPUTER               0x013C
416 #define TAG_PREDICTOR                   0x013D
417 #define TAG_WHITE_POINT                 0x013E
418 #define TAG_PRIMARY_CHROMATICITIES      0x013F
419 #define TAG_COLOR_MAP                   0x0140
420 #define TAG_HALFTONE_HINTS              0x0141
421 #define TAG_TILE_WIDTH                  0x0142
422 #define TAG_TILE_LENGTH                 0x0143
423 #define TAG_TILE_OFFSETS                0x0144
424 #define TAG_TILE_BYTE_COUNTS            0x0145
425 #define TAG_SUB_IFD                     0x014A
426 #define TAG_INK_SETMPUTER               0x014C
427 #define TAG_INK_NAMES                   0x014D
428 #define TAG_NUMBER_OF_INKS              0x014E
429 #define TAG_DOT_RANGE                   0x0150
430 #define TAG_TARGET_PRINTER              0x0151
431 #define TAG_EXTRA_SAMPLE                0x0152
432 #define TAG_SAMPLE_FORMAT               0x0153
433 #define TAG_S_MIN_SAMPLE_VALUE          0x0154
434 #define TAG_S_MAX_SAMPLE_VALUE          0x0155
435 #define TAG_TRANSFER_RANGE              0x0156
436 #define TAG_JPEG_TABLES                 0x015B
437 #define TAG_JPEG_PROC                   0x0200
438 #define TAG_JPEG_INTERCHANGE_FORMAT     0x0201
439 #define TAG_JPEG_INTERCHANGE_FORMAT_LEN 0x0202
440 #define TAG_JPEG_RESTART_INTERVAL       0x0203
441 #define TAG_JPEG_LOSSLESS_PREDICTOR     0x0205
442 #define TAG_JPEG_POINT_TRANSFORMS       0x0206
443 #define TAG_JPEG_Q_TABLES               0x0207
444 #define TAG_JPEG_DC_TABLES              0x0208
445 #define TAG_JPEG_AC_TABLES              0x0209
446 #define TAG_YCC_COEFFICIENTS            0x0211
447 #define TAG_YCC_SUB_SAMPLING            0x0212
448 #define TAG_YCC_POSITIONING             0x0213
449 #define TAG_REFERENCE_BLACK_WHITE       0x0214
450 /* 0x0301 - 0x0302 */
451 /* 0x0320 */
452 /* 0x0343 */
453 /* 0x5001 - 0x501B */
454 /* 0x5021 - 0x503B */
455 /* 0x5090 - 0x5091 */
456 /* 0x5100 - 0x5101 */
457 /* 0x5110 - 0x5113 */
458 /* 0x80E3 - 0x80E6 */
459 /* 0x828d - 0x828F */
460 #define TAG_COPYRIGHT                   0x8298
461 #define TAG_EXPOSURETIME                0x829A
462 #define TAG_FNUMBER                     0x829D
463 #define TAG_EXIF_IFD_POINTER            0x8769
464 #define TAG_ICC_PROFILE                 0x8773
465 #define TAG_EXPOSURE_PROGRAM            0x8822
466 #define TAG_SPECTRAL_SENSITY            0x8824
467 #define TAG_GPS_IFD_POINTER             0x8825
468 #define TAG_ISOSPEED                    0x8827
469 #define TAG_OPTOELECTRIC_CONVERSION_F   0x8828
470 /* 0x8829 - 0x882b */
471 #define TAG_EXIFVERSION                 0x9000
472 #define TAG_DATE_TIME_ORIGINAL          0x9003
473 #define TAG_DATE_TIME_DIGITIZED         0x9004
474 #define TAG_COMPONENT_CONFIG            0x9101
475 #define TAG_COMPRESSED_BITS_PER_PIXEL   0x9102
476 #define TAG_SHUTTERSPEED                0x9201
477 #define TAG_APERTURE                    0x9202
478 #define TAG_BRIGHTNESS_VALUE            0x9203
479 #define TAG_EXPOSURE_BIAS_VALUE         0x9204
480 #define TAG_MAX_APERTURE                0x9205
481 #define TAG_SUBJECT_DISTANCE            0x9206
482 #define TAG_METRIC_MODULE               0x9207
483 #define TAG_LIGHT_SOURCE                0x9208
484 #define TAG_FLASH                       0x9209
485 #define TAG_FOCAL_LENGTH                0x920A
486 /* 0x920B - 0x920D */
487 /* 0x9211 - 0x9216 */
488 #define TAG_SUBJECT_AREA                0x9214
489 #define TAG_MAKER_NOTE                  0x927C
490 #define TAG_USERCOMMENT                 0x9286
491 #define TAG_SUB_SEC_TIME                0x9290
492 #define TAG_SUB_SEC_TIME_ORIGINAL       0x9291
493 #define TAG_SUB_SEC_TIME_DIGITIZED      0x9292
494 /* 0x923F */
495 /* 0x935C */
496 #define TAG_XP_TITLE                    0x9C9B
497 #define TAG_XP_COMMENTS                 0x9C9C
498 #define TAG_XP_AUTHOR                   0x9C9D
499 #define TAG_XP_KEYWORDS                 0x9C9E
500 #define TAG_XP_SUBJECT                  0x9C9F
501 #define TAG_FLASH_PIX_VERSION           0xA000
502 #define TAG_COLOR_SPACE                 0xA001
503 #define TAG_COMP_IMAGE_WIDTH            0xA002 /* compressed images only */
504 #define TAG_COMP_IMAGE_HEIGHT           0xA003
505 #define TAG_RELATED_SOUND_FILE          0xA004
506 #define TAG_INTEROP_IFD_POINTER         0xA005 /* IFD pointer */
507 #define TAG_FLASH_ENERGY                0xA20B
508 #define TAG_SPATIAL_FREQUENCY_RESPONSE  0xA20C
509 #define TAG_FOCALPLANE_X_RES            0xA20E
510 #define TAG_FOCALPLANE_Y_RES            0xA20F
511 #define TAG_FOCALPLANE_RESOLUTION_UNIT  0xA210
512 #define TAG_SUBJECT_LOCATION            0xA214
513 #define TAG_EXPOSURE_INDEX              0xA215
514 #define TAG_SENSING_METHOD              0xA217
515 #define TAG_FILE_SOURCE                 0xA300
516 #define TAG_SCENE_TYPE                  0xA301
517 #define TAG_CFA_PATTERN                 0xA302
518 #define TAG_CUSTOM_RENDERED             0xA401
519 #define TAG_EXPOSURE_MODE               0xA402
520 #define TAG_WHITE_BALANCE               0xA403
521 #define TAG_DIGITAL_ZOOM_RATIO          0xA404
522 #define TAG_FOCAL_LENGTH_IN_35_MM_FILM  0xA405
523 #define TAG_SCENE_CAPTURE_TYPE          0xA406
524 #define TAG_GAIN_CONTROL                0xA407
525 #define TAG_CONTRAST                    0xA408
526 #define TAG_SATURATION                  0xA409
527 #define TAG_SHARPNESS                   0xA40A
528 #define TAG_DEVICE_SETTING_DESCRIPTION  0xA40B
529 #define TAG_SUBJECT_DISTANCE_RANGE      0xA40C
530 #define TAG_IMAGE_UNIQUE_ID             0xA420
531 
532 /* Olympus specific tags */
533 #define TAG_OLYMPUS_SPECIALMODE         0x0200
534 #define TAG_OLYMPUS_JPEGQUAL            0x0201
535 #define TAG_OLYMPUS_MACRO               0x0202
536 #define TAG_OLYMPUS_DIGIZOOM            0x0204
537 #define TAG_OLYMPUS_SOFTWARERELEASE     0x0207
538 #define TAG_OLYMPUS_PICTINFO            0x0208
539 #define TAG_OLYMPUS_CAMERAID            0x0209
540 /* end Olympus specific tags */
541 
542 /* Internal */
543 #define TAG_NONE               			-1 /* note that -1 <> 0xFFFF */
544 #define TAG_COMPUTED_VALUE     			-2
545 #define TAG_END_OF_LIST                 0xFFFD
546 
547 /* Values for TAG_PHOTOMETRIC_INTERPRETATION */
548 #define PMI_BLACK_IS_ZERO       0
549 #define PMI_WHITE_IS_ZERO       1
550 #define PMI_RGB          	    2
551 #define PMI_PALETTE_COLOR       3
552 #define PMI_TRANSPARENCY_MASK   4
553 #define PMI_SEPARATED           5
554 #define PMI_YCBCR               6
555 #define PMI_CIELAB              8
556 
557 /* }}} */
558 
559 /* {{{ TabTable[]
560  */
561 typedef const struct {
562 	unsigned short Tag;
563 	char *Desc;
564 } tag_info_type;
565 
566 typedef tag_info_type  tag_info_array[];
567 typedef tag_info_type  *tag_table_type;
568 
569 #define TAG_TABLE_END \
570   {TAG_NONE,           "No tag value"},\
571   {TAG_COMPUTED_VALUE, "Computed value"},\
572   {TAG_END_OF_LIST,    ""}  /* Important for exif_get_tagname() IF value != "" function result is != false */
573 
574 static tag_info_array tag_table_IFD = {
575   { 0x000B, "ACDComment"},
576   { 0x00FE, "NewSubFile"}, /* better name it 'ImageType' ? */
577   { 0x00FF, "SubFile"},
578   { 0x0100, "ImageWidth"},
579   { 0x0101, "ImageLength"},
580   { 0x0102, "BitsPerSample"},
581   { 0x0103, "Compression"},
582   { 0x0106, "PhotometricInterpretation"},
583   { 0x010A, "FillOrder"},
584   { 0x010D, "DocumentName"},
585   { 0x010E, "ImageDescription"},
586   { 0x010F, "Make"},
587   { 0x0110, "Model"},
588   { 0x0111, "StripOffsets"},
589   { 0x0112, "Orientation"},
590   { 0x0115, "SamplesPerPixel"},
591   { 0x0116, "RowsPerStrip"},
592   { 0x0117, "StripByteCounts"},
593   { 0x0118, "MinSampleValue"},
594   { 0x0119, "MaxSampleValue"},
595   { 0x011A, "XResolution"},
596   { 0x011B, "YResolution"},
597   { 0x011C, "PlanarConfiguration"},
598   { 0x011D, "PageName"},
599   { 0x011E, "XPosition"},
600   { 0x011F, "YPosition"},
601   { 0x0120, "FreeOffsets"},
602   { 0x0121, "FreeByteCounts"},
603   { 0x0122, "GrayResponseUnit"},
604   { 0x0123, "GrayResponseCurve"},
605   { 0x0124, "T4Options"},
606   { 0x0125, "T6Options"},
607   { 0x0128, "ResolutionUnit"},
608   { 0x0129, "PageNumber"},
609   { 0x012D, "TransferFunction"},
610   { 0x0131, "Software"},
611   { 0x0132, "DateTime"},
612   { 0x013B, "Artist"},
613   { 0x013C, "HostComputer"},
614   { 0x013D, "Predictor"},
615   { 0x013E, "WhitePoint"},
616   { 0x013F, "PrimaryChromaticities"},
617   { 0x0140, "ColorMap"},
618   { 0x0141, "HalfToneHints"},
619   { 0x0142, "TileWidth"},
620   { 0x0143, "TileLength"},
621   { 0x0144, "TileOffsets"},
622   { 0x0145, "TileByteCounts"},
623   { 0x014A, "SubIFD"},
624   { 0x014C, "InkSet"},
625   { 0x014D, "InkNames"},
626   { 0x014E, "NumberOfInks"},
627   { 0x0150, "DotRange"},
628   { 0x0151, "TargetPrinter"},
629   { 0x0152, "ExtraSample"},
630   { 0x0153, "SampleFormat"},
631   { 0x0154, "SMinSampleValue"},
632   { 0x0155, "SMaxSampleValue"},
633   { 0x0156, "TransferRange"},
634   { 0x0157, "ClipPath"},
635   { 0x0158, "XClipPathUnits"},
636   { 0x0159, "YClipPathUnits"},
637   { 0x015A, "Indexed"},
638   { 0x015B, "JPEGTables"},
639   { 0x015F, "OPIProxy"},
640   { 0x0200, "JPEGProc"},
641   { 0x0201, "JPEGInterchangeFormat"},
642   { 0x0202, "JPEGInterchangeFormatLength"},
643   { 0x0203, "JPEGRestartInterval"},
644   { 0x0205, "JPEGLosslessPredictors"},
645   { 0x0206, "JPEGPointTransforms"},
646   { 0x0207, "JPEGQTables"},
647   { 0x0208, "JPEGDCTables"},
648   { 0x0209, "JPEGACTables"},
649   { 0x0211, "YCbCrCoefficients"},
650   { 0x0212, "YCbCrSubSampling"},
651   { 0x0213, "YCbCrPositioning"},
652   { 0x0214, "ReferenceBlackWhite"},
653   { 0x02BC, "ExtensibleMetadataPlatform"}, /* XAP: Extensible Authoring Publishing, obsoleted by XMP: Extensible Metadata Platform */
654   { 0x0301, "Gamma"},
655   { 0x0302, "ICCProfileDescriptor"},
656   { 0x0303, "SRGBRenderingIntent"},
657   { 0x0320, "ImageTitle"},
658   { 0x5001, "ResolutionXUnit"},
659   { 0x5002, "ResolutionYUnit"},
660   { 0x5003, "ResolutionXLengthUnit"},
661   { 0x5004, "ResolutionYLengthUnit"},
662   { 0x5005, "PrintFlags"},
663   { 0x5006, "PrintFlagsVersion"},
664   { 0x5007, "PrintFlagsCrop"},
665   { 0x5008, "PrintFlagsBleedWidth"},
666   { 0x5009, "PrintFlagsBleedWidthScale"},
667   { 0x500A, "HalftoneLPI"},
668   { 0x500B, "HalftoneLPIUnit"},
669   { 0x500C, "HalftoneDegree"},
670   { 0x500D, "HalftoneShape"},
671   { 0x500E, "HalftoneMisc"},
672   { 0x500F, "HalftoneScreen"},
673   { 0x5010, "JPEGQuality"},
674   { 0x5011, "GridSize"},
675   { 0x5012, "ThumbnailFormat"},
676   { 0x5013, "ThumbnailWidth"},
677   { 0x5014, "ThumbnailHeight"},
678   { 0x5015, "ThumbnailColorDepth"},
679   { 0x5016, "ThumbnailPlanes"},
680   { 0x5017, "ThumbnailRawBytes"},
681   { 0x5018, "ThumbnailSize"},
682   { 0x5019, "ThumbnailCompressedSize"},
683   { 0x501A, "ColorTransferFunction"},
684   { 0x501B, "ThumbnailData"},
685   { 0x5020, "ThumbnailImageWidth"},
686   { 0x5021, "ThumbnailImageHeight"},
687   { 0x5022, "ThumbnailBitsPerSample"},
688   { 0x5023, "ThumbnailCompression"},
689   { 0x5024, "ThumbnailPhotometricInterp"},
690   { 0x5025, "ThumbnailImageDescription"},
691   { 0x5026, "ThumbnailEquipMake"},
692   { 0x5027, "ThumbnailEquipModel"},
693   { 0x5028, "ThumbnailStripOffsets"},
694   { 0x5029, "ThumbnailOrientation"},
695   { 0x502A, "ThumbnailSamplesPerPixel"},
696   { 0x502B, "ThumbnailRowsPerStrip"},
697   { 0x502C, "ThumbnailStripBytesCount"},
698   { 0x502D, "ThumbnailResolutionX"},
699   { 0x502E, "ThumbnailResolutionY"},
700   { 0x502F, "ThumbnailPlanarConfig"},
701   { 0x5030, "ThumbnailResolutionUnit"},
702   { 0x5031, "ThumbnailTransferFunction"},
703   { 0x5032, "ThumbnailSoftwareUsed"},
704   { 0x5033, "ThumbnailDateTime"},
705   { 0x5034, "ThumbnailArtist"},
706   { 0x5035, "ThumbnailWhitePoint"},
707   { 0x5036, "ThumbnailPrimaryChromaticities"},
708   { 0x5037, "ThumbnailYCbCrCoefficients"},
709   { 0x5038, "ThumbnailYCbCrSubsampling"},
710   { 0x5039, "ThumbnailYCbCrPositioning"},
711   { 0x503A, "ThumbnailRefBlackWhite"},
712   { 0x503B, "ThumbnailCopyRight"},
713   { 0x5090, "LuminanceTable"},
714   { 0x5091, "ChrominanceTable"},
715   { 0x5100, "FrameDelay"},
716   { 0x5101, "LoopCount"},
717   { 0x5110, "PixelUnit"},
718   { 0x5111, "PixelPerUnitX"},
719   { 0x5112, "PixelPerUnitY"},
720   { 0x5113, "PaletteHistogram"},
721   { 0x1000, "RelatedImageFileFormat"},
722   { 0x800D, "ImageID"},
723   { 0x80E3, "Matteing"},   /* obsoleted by ExtraSamples */
724   { 0x80E4, "DataType"},   /* obsoleted by SampleFormat */
725   { 0x80E5, "ImageDepth"},
726   { 0x80E6, "TileDepth"},
727   { 0x828D, "CFARepeatPatternDim"},
728   { 0x828E, "CFAPattern"},
729   { 0x828F, "BatteryLevel"},
730   { 0x8298, "Copyright"},
731   { 0x829A, "ExposureTime"},
732   { 0x829D, "FNumber"},
733   { 0x83BB, "IPTC/NAA"},
734   { 0x84E3, "IT8RasterPadding"},
735   { 0x84E5, "IT8ColorTable"},
736   { 0x8649, "ImageResourceInformation"}, /* PhotoShop */
737   { 0x8769, "Exif_IFD_Pointer"},
738   { 0x8773, "ICC_Profile"},
739   { 0x8822, "ExposureProgram"},
740   { 0x8824, "SpectralSensity"},
741   { 0x8828, "OECF"},
742   { 0x8825, "GPS_IFD_Pointer"},
743   { 0x8827, "ISOSpeedRatings"},
744   { 0x8828, "OECF"},
745   { 0x9000, "ExifVersion"},
746   { 0x9003, "DateTimeOriginal"},
747   { 0x9004, "DateTimeDigitized"},
748   { 0x9101, "ComponentsConfiguration"},
749   { 0x9102, "CompressedBitsPerPixel"},
750   { 0x9201, "ShutterSpeedValue"},
751   { 0x9202, "ApertureValue"},
752   { 0x9203, "BrightnessValue"},
753   { 0x9204, "ExposureBiasValue"},
754   { 0x9205, "MaxApertureValue"},
755   { 0x9206, "SubjectDistance"},
756   { 0x9207, "MeteringMode"},
757   { 0x9208, "LightSource"},
758   { 0x9209, "Flash"},
759   { 0x920A, "FocalLength"},
760   { 0x920B, "FlashEnergy"},                 /* 0xA20B  in JPEG   */
761   { 0x920C, "SpatialFrequencyResponse"},    /* 0xA20C    -  -    */
762   { 0x920D, "Noise"},
763   { 0x920E, "FocalPlaneXResolution"},       /* 0xA20E    -  -    */
764   { 0x920F, "FocalPlaneYResolution"},       /* 0xA20F    -  -    */
765   { 0x9210, "FocalPlaneResolutionUnit"},    /* 0xA210    -  -    */
766   { 0x9211, "ImageNumber"},
767   { 0x9212, "SecurityClassification"},
768   { 0x9213, "ImageHistory"},
769   { 0x9214, "SubjectLocation"},             /* 0xA214    -  -    */
770   { 0x9215, "ExposureIndex"},               /* 0xA215    -  -    */
771   { 0x9216, "TIFF/EPStandardID"},
772   { 0x9217, "SensingMethod"},               /* 0xA217    -  -    */
773   { 0x923F, "StoNits"},
774   { 0x927C, "MakerNote"},
775   { 0x9286, "UserComment"},
776   { 0x9290, "SubSecTime"},
777   { 0x9291, "SubSecTimeOriginal"},
778   { 0x9292, "SubSecTimeDigitized"},
779   { 0x935C, "ImageSourceData"},             /* "Adobe Photoshop Document Data Block": 8BIM... */
780   { 0x9c9b, "Title" },                      /* Win XP specific, Unicode  */
781   { 0x9c9c, "Comments" },                   /* Win XP specific, Unicode  */
782   { 0x9c9d, "Author" },                     /* Win XP specific, Unicode  */
783   { 0x9c9e, "Keywords" },                   /* Win XP specific, Unicode  */
784   { 0x9c9f, "Subject" },                    /* Win XP specific, Unicode, not to be confused with SubjectDistance and SubjectLocation */
785   { 0xA000, "FlashPixVersion"},
786   { 0xA001, "ColorSpace"},
787   { 0xA002, "ExifImageWidth"},
788   { 0xA003, "ExifImageLength"},
789   { 0xA004, "RelatedSoundFile"},
790   { 0xA005, "InteroperabilityOffset"},
791   { 0xA20B, "FlashEnergy"},                 /* 0x920B in TIFF/EP */
792   { 0xA20C, "SpatialFrequencyResponse"},    /* 0x920C    -  -    */
793   { 0xA20D, "Noise"},
794   { 0xA20E, "FocalPlaneXResolution"},    	/* 0x920E    -  -    */
795   { 0xA20F, "FocalPlaneYResolution"},       /* 0x920F    -  -    */
796   { 0xA210, "FocalPlaneResolutionUnit"},    /* 0x9210    -  -    */
797   { 0xA211, "ImageNumber"},
798   { 0xA212, "SecurityClassification"},
799   { 0xA213, "ImageHistory"},
800   { 0xA214, "SubjectLocation"},             /* 0x9214    -  -    */
801   { 0xA215, "ExposureIndex"},               /* 0x9215    -  -    */
802   { 0xA216, "TIFF/EPStandardID"},
803   { 0xA217, "SensingMethod"},               /* 0x9217    -  -    */
804   { 0xA300, "FileSource"},
805   { 0xA301, "SceneType"},
806   { 0xA302, "CFAPattern"},
807   { 0xA401, "CustomRendered"},
808   { 0xA402, "ExposureMode"},
809   { 0xA403, "WhiteBalance"},
810   { 0xA404, "DigitalZoomRatio"},
811   { 0xA405, "FocalLengthIn35mmFilm"},
812   { 0xA406, "SceneCaptureType"},
813   { 0xA407, "GainControl"},
814   { 0xA408, "Contrast"},
815   { 0xA409, "Saturation"},
816   { 0xA40A, "Sharpness"},
817   { 0xA40B, "DeviceSettingDescription"},
818   { 0xA40C, "SubjectDistanceRange"},
819   { 0xA420, "ImageUniqueID"},
820   TAG_TABLE_END
821 } ;
822 
823 static tag_info_array tag_table_GPS = {
824   { 0x0000, "GPSVersion"},
825   { 0x0001, "GPSLatitudeRef"},
826   { 0x0002, "GPSLatitude"},
827   { 0x0003, "GPSLongitudeRef"},
828   { 0x0004, "GPSLongitude"},
829   { 0x0005, "GPSAltitudeRef"},
830   { 0x0006, "GPSAltitude"},
831   { 0x0007, "GPSTimeStamp"},
832   { 0x0008, "GPSSatellites"},
833   { 0x0009, "GPSStatus"},
834   { 0x000A, "GPSMeasureMode"},
835   { 0x000B, "GPSDOP"},
836   { 0x000C, "GPSSpeedRef"},
837   { 0x000D, "GPSSpeed"},
838   { 0x000E, "GPSTrackRef"},
839   { 0x000F, "GPSTrack"},
840   { 0x0010, "GPSImgDirectionRef"},
841   { 0x0011, "GPSImgDirection"},
842   { 0x0012, "GPSMapDatum"},
843   { 0x0013, "GPSDestLatitudeRef"},
844   { 0x0014, "GPSDestLatitude"},
845   { 0x0015, "GPSDestLongitudeRef"},
846   { 0x0016, "GPSDestLongitude"},
847   { 0x0017, "GPSDestBearingRef"},
848   { 0x0018, "GPSDestBearing"},
849   { 0x0019, "GPSDestDistanceRef"},
850   { 0x001A, "GPSDestDistance"},
851   { 0x001B, "GPSProcessingMode"},
852   { 0x001C, "GPSAreaInformation"},
853   { 0x001D, "GPSDateStamp"},
854   { 0x001E, "GPSDifferential"},
855   TAG_TABLE_END
856 };
857 
858 static tag_info_array tag_table_IOP = {
859   { 0x0001, "InterOperabilityIndex"}, /* should be 'R98' or 'THM' */
860   { 0x0002, "InterOperabilityVersion"},
861   { 0x1000, "RelatedFileFormat"},
862   { 0x1001, "RelatedImageWidth"},
863   { 0x1002, "RelatedImageHeight"},
864   TAG_TABLE_END
865 };
866 
867 static tag_info_array tag_table_VND_CANON = {
868   { 0x0001, "ModeArray"}, /* guess */
869   { 0x0004, "ImageInfo"}, /* guess */
870   { 0x0006, "ImageType"},
871   { 0x0007, "FirmwareVersion"},
872   { 0x0008, "ImageNumber"},
873   { 0x0009, "OwnerName"},
874   { 0x000C, "Camera"},
875   { 0x000F, "CustomFunctions"},
876   TAG_TABLE_END
877 };
878 
879 static tag_info_array tag_table_VND_CASIO = {
880   { 0x0001, "RecordingMode"},
881   { 0x0002, "Quality"},
882   { 0x0003, "FocusingMode"},
883   { 0x0004, "FlashMode"},
884   { 0x0005, "FlashIntensity"},
885   { 0x0006, "ObjectDistance"},
886   { 0x0007, "WhiteBalance"},
887   { 0x000A, "DigitalZoom"},
888   { 0x000B, "Sharpness"},
889   { 0x000C, "Contrast"},
890   { 0x000D, "Saturation"},
891   { 0x0014, "CCDSensitivity"},
892   TAG_TABLE_END
893 };
894 
895 static tag_info_array tag_table_VND_FUJI = {
896   { 0x0000, "Version"},
897   { 0x1000, "Quality"},
898   { 0x1001, "Sharpness"},
899   { 0x1002, "WhiteBalance"},
900   { 0x1003, "Color"},
901   { 0x1004, "Tone"},
902   { 0x1010, "FlashMode"},
903   { 0x1011, "FlashStrength"},
904   { 0x1020, "Macro"},
905   { 0x1021, "FocusMode"},
906   { 0x1030, "SlowSync"},
907   { 0x1031, "PictureMode"},
908   { 0x1100, "ContTake"},
909   { 0x1300, "BlurWarning"},
910   { 0x1301, "FocusWarning"},
911   { 0x1302, "AEWarning "},
912   TAG_TABLE_END
913 };
914 
915 static tag_info_array tag_table_VND_NIKON = {
916   { 0x0003, "Quality"},
917   { 0x0004, "ColorMode"},
918   { 0x0005, "ImageAdjustment"},
919   { 0x0006, "CCDSensitivity"},
920   { 0x0007, "WhiteBalance"},
921   { 0x0008, "Focus"},
922   { 0x000a, "DigitalZoom"},
923   { 0x000b, "Converter"},
924   TAG_TABLE_END
925 };
926 
927 static tag_info_array tag_table_VND_NIKON_990 = {
928   { 0x0001, "Version"},
929   { 0x0002, "ISOSetting"},
930   { 0x0003, "ColorMode"},
931   { 0x0004, "Quality"},
932   { 0x0005, "WhiteBalance"},
933   { 0x0006, "ImageSharpening"},
934   { 0x0007, "FocusMode"},
935   { 0x0008, "FlashSetting"},
936   { 0x000F, "ISOSelection"},
937   { 0x0080, "ImageAdjustment"},
938   { 0x0082, "AuxiliaryLens"},
939   { 0x0085, "ManualFocusDistance"},
940   { 0x0086, "DigitalZoom"},
941   { 0x0088, "AFFocusPosition"},
942   { 0x0010, "DataDump"},
943   TAG_TABLE_END
944 };
945 
946 static tag_info_array tag_table_VND_OLYMPUS = {
947   { 0x0200, "SpecialMode"},
948   { 0x0201, "JPEGQuality"},
949   { 0x0202, "Macro"},
950   { 0x0204, "DigitalZoom"},
951   { 0x0207, "SoftwareRelease"},
952   { 0x0208, "PictureInfo"},
953   { 0x0209, "CameraId"},
954   { 0x0F00, "DataDump"},
955   TAG_TABLE_END
956 };
957 
958 typedef enum mn_byte_order_t {
959 	MN_ORDER_INTEL    = 0,
960 	MN_ORDER_MOTOROLA = 1,
961 	MN_ORDER_NORMAL
962 } mn_byte_order_t;
963 
964 typedef enum mn_offset_mode_t {
965 	MN_OFFSET_NORMAL,
966 	MN_OFFSET_MAKER,
967 	MN_OFFSET_GUESS
968 } mn_offset_mode_t;
969 
970 typedef struct {
971 	tag_table_type   tag_table;
972 	char *           make;
973 	char *           model;
974 	char *           id_string;
975 	int              id_string_len;
976 	int              offset;
977 	mn_byte_order_t  byte_order;
978 	mn_offset_mode_t offset_mode;
979 } maker_note_type;
980 
981 static const maker_note_type maker_note_array[] = {
982   { tag_table_VND_CANON,     "Canon",                   NULL,  NULL,                       0,  0,  MN_ORDER_INTEL,    MN_OFFSET_GUESS},
983 /*  { tag_table_VND_CANON,     "Canon",                   NULL,  NULL,                       0,  0,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},*/
984   { tag_table_VND_CASIO,     "CASIO",                   NULL,  NULL,                       0,  0,  MN_ORDER_MOTOROLA, MN_OFFSET_NORMAL},
985   { tag_table_VND_FUJI,      "FUJIFILM",                NULL,  "FUJIFILM\x0C\x00\x00\x00", 12, 12, MN_ORDER_INTEL,    MN_OFFSET_MAKER},
986   { tag_table_VND_NIKON,     "NIKON",                   NULL,  "Nikon\x00\x01\x00",        8,  8,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
987   { tag_table_VND_NIKON_990, "NIKON",                   NULL,  NULL,                       0,  0,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
988   { tag_table_VND_OLYMPUS,   "OLYMPUS OPTICAL CO.,LTD", NULL,  "OLYMP\x00\x01\x00",        8,  8,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
989 };
990 /* }}} */
991 
992 /* {{{ exif_get_tagname
993 	Get headername for tag_num or NULL if not defined */
exif_get_tagname(int tag_num,char * ret,int len,tag_table_type tag_table)994 static char * exif_get_tagname(int tag_num, char *ret, int len, tag_table_type tag_table)
995 {
996 	int i, t;
997 	char tmp[32];
998 
999 	for (i = 0; (t = tag_table[i].Tag) != TAG_END_OF_LIST; i++) {
1000 		if (t == tag_num) {
1001 			if (ret && len)  {
1002 				strlcpy(ret, tag_table[i].Desc, abs(len));
1003 				if (len < 0) {
1004 					memset(ret + strlen(ret), ' ', -len - strlen(ret) - 1);
1005 					ret[-len - 1] = '\0';
1006 				}
1007 				return ret;
1008 			}
1009 			return tag_table[i].Desc;
1010 		}
1011 	}
1012 
1013 	if (ret && len) {
1014 		snprintf(tmp, sizeof(tmp), "UndefinedTag:0x%04X", tag_num);
1015 		strlcpy(ret, tmp, abs(len));
1016 		if (len < 0) {
1017 			memset(ret + strlen(ret), ' ', -len - strlen(ret) - 1);
1018 			ret[-len - 1] = '\0';
1019 		}
1020 		return ret;
1021 	}
1022 	return "";
1023 }
1024 /* }}} */
1025 
1026 /* {{{ exif_char_dump
1027  * Do not use! This is a debug function... */
1028 #ifdef EXIF_DEBUG
exif_char_dump(unsigned char * addr,int len,int offset)1029 static unsigned char* exif_char_dump(unsigned char * addr, int len, int offset)
1030 {
1031 	static unsigned char buf[4096+1];
1032 	static unsigned char tmp[20];
1033 	int c, i, p=0, n = 5+31;
1034 
1035 	p += slprintf(buf+p, sizeof(buf)-p, "\nDump Len: %08X (%d)", len, len);
1036 	if (len) {
1037 		for(i=0; i<len+15 && p+n<=sizeof(buf); i++) {
1038 			if (i%16==0) {
1039 				p += slprintf(buf+p, sizeof(buf)-p, "\n%08X: ", i+offset);
1040 			}
1041 			if (i<len) {
1042 				c = *addr++;
1043 				p += slprintf(buf+p, sizeof(buf)-p, "%02X ", c);
1044 				tmp[i%16] = c>=32 ? c : '.';
1045 				tmp[(i%16)+1] = '\0';
1046 			} else {
1047 				p += slprintf(buf+p, sizeof(buf)-p, "   ");
1048 			}
1049 			if (i%16==15) {
1050 				p += slprintf(buf+p, sizeof(buf)-p, "    %s", tmp);
1051 				if (i>=len) {
1052 					break;
1053 				}
1054 			}
1055 		}
1056 	}
1057 	buf[sizeof(buf)-1] = '\0';
1058 	return buf;
1059 }
1060 #endif
1061 /* }}} */
1062 
1063 /* {{{ php_jpg_get16
1064    Get 16 bits motorola order (always) for jpeg header stuff.
1065 */
php_jpg_get16(void * value)1066 static int php_jpg_get16(void *value)
1067 {
1068 	return (((uchar *)value)[0] << 8) | ((uchar *)value)[1];
1069 }
1070 /* }}} */
1071 
1072 /* {{{ php_ifd_get16u
1073  * Convert a 16 bit unsigned value from file's native byte order */
php_ifd_get16u(void * value,int motorola_intel)1074 static int php_ifd_get16u(void *value, int motorola_intel)
1075 {
1076 	if (motorola_intel) {
1077 		return (((uchar *)value)[0] << 8) | ((uchar *)value)[1];
1078 	} else {
1079 		return (((uchar *)value)[1] << 8) | ((uchar *)value)[0];
1080 	}
1081 }
1082 /* }}} */
1083 
1084 /* {{{ php_ifd_get16s
1085  * Convert a 16 bit signed value from file's native byte order */
php_ifd_get16s(void * value,int motorola_intel)1086 static signed short php_ifd_get16s(void *value, int motorola_intel)
1087 {
1088 	return (signed short)php_ifd_get16u(value, motorola_intel);
1089 }
1090 /* }}} */
1091 
1092 /* {{{ php_ifd_get32s
1093  * Convert a 32 bit signed value from file's native byte order */
php_ifd_get32s(void * value,int motorola_intel)1094 static int php_ifd_get32s(void *value, int motorola_intel)
1095 {
1096 	if (motorola_intel) {
1097 		return  (((char  *)value)[0] << 24)
1098 			  | (((uchar *)value)[1] << 16)
1099 			  | (((uchar *)value)[2] << 8 )
1100 			  | (((uchar *)value)[3]      );
1101 	} else {
1102 		return  (((char  *)value)[3] << 24)
1103 			  | (((uchar *)value)[2] << 16)
1104 			  | (((uchar *)value)[1] << 8 )
1105 			  | (((uchar *)value)[0]      );
1106 	}
1107 }
1108 /* }}} */
1109 
1110 /* {{{ php_ifd_get32u
1111  * Write 32 bit unsigned value to data */
php_ifd_get32u(void * value,int motorola_intel)1112 static unsigned php_ifd_get32u(void *value, int motorola_intel)
1113 {
1114 	return (unsigned)php_ifd_get32s(value, motorola_intel) & 0xffffffff;
1115 }
1116 /* }}} */
1117 
1118 /* {{{ php_ifd_set16u
1119  * Write 16 bit unsigned value to data */
php_ifd_set16u(char * data,unsigned int value,int motorola_intel)1120 static void php_ifd_set16u(char *data, unsigned int value, int motorola_intel)
1121 {
1122 	if (motorola_intel) {
1123 		data[0] = (value & 0xFF00) >> 8;
1124 		data[1] = (value & 0x00FF);
1125 	} else {
1126 		data[1] = (value & 0xFF00) >> 8;
1127 		data[0] = (value & 0x00FF);
1128 	}
1129 }
1130 /* }}} */
1131 
1132 /* {{{ php_ifd_set32u
1133  * Convert a 32 bit unsigned value from file's native byte order */
php_ifd_set32u(char * data,size_t value,int motorola_intel)1134 static void php_ifd_set32u(char *data, size_t value, int motorola_intel)
1135 {
1136 	if (motorola_intel) {
1137 		data[0] = (value & 0xFF000000) >> 24;
1138 		data[1] = (value & 0x00FF0000) >> 16;
1139 		data[2] = (value & 0x0000FF00) >>  8;
1140 		data[3] = (value & 0x000000FF);
1141 	} else {
1142 		data[3] = (value & 0xFF000000) >> 24;
1143 		data[2] = (value & 0x00FF0000) >> 16;
1144 		data[1] = (value & 0x0000FF00) >>  8;
1145 		data[0] = (value & 0x000000FF);
1146 	}
1147 }
1148 /* }}} */
1149 
1150 #ifdef EXIF_DEBUG
exif_dump_data(int * dump_free,int format,int components,int length,int motorola_intel,char * value_ptr)1151 char * exif_dump_data(int *dump_free, int format, int components, int length, int motorola_intel, char *value_ptr) /* {{{ */
1152 {
1153 	char *dump;
1154 	int len;
1155 
1156 	*dump_free = 0;
1157 	if (format == TAG_FMT_STRING) {
1158 		return value_ptr ? value_ptr : "<no data>";
1159 	}
1160 	if (format == TAG_FMT_UNDEFINED) {
1161 		return "<undefined>\n";
1162 	}
1163 	if (format == TAG_FMT_IFD) {
1164 		return "";
1165 	}
1166 	if (format == TAG_FMT_SINGLE || format == TAG_FMT_DOUBLE) {
1167 		return "<not implemented>";
1168 	}
1169 	*dump_free = 1;
1170 	if (components > 1) {
1171 		len = spprintf(&dump, 0, "(%d,%d) {", components, length);
1172 	} else {
1173 		len = spprintf(&dump, 0, "{");
1174 	}
1175 	while(components > 0) {
1176 		switch(format) {
1177 			case TAG_FMT_BYTE:
1178 			case TAG_FMT_UNDEFINED:
1179 			case TAG_FMT_STRING:
1180 			case TAG_FMT_SBYTE:
1181 				dump = erealloc(dump, len + 4 + 1);
1182 				snprintf(dump + len, 4 + 1, "0x%02X", *value_ptr);
1183 				len += 4;
1184 				value_ptr++;
1185 				break;
1186 			case TAG_FMT_USHORT:
1187 			case TAG_FMT_SSHORT:
1188 				dump = erealloc(dump, len + 6 + 1);
1189 				snprintf(dump + len, 6 + 1, "0x%04X", php_ifd_get16s(value_ptr, motorola_intel));
1190 				len += 6;
1191 				value_ptr += 2;
1192 				break;
1193 			case TAG_FMT_ULONG:
1194 			case TAG_FMT_SLONG:
1195 				dump = erealloc(dump, len + 6 + 1);
1196 				snprintf(dump + len, 6 + 1, "0x%04X", php_ifd_get32s(value_ptr, motorola_intel));
1197 				len += 6;
1198 				value_ptr += 4;
1199 				break;
1200 			case TAG_FMT_URATIONAL:
1201 			case TAG_FMT_SRATIONAL:
1202 				dump = erealloc(dump, len + 13 + 1);
1203 				snprintf(dump + len, 13 + 1, "0x%04X/0x%04X", php_ifd_get32s(value_ptr, motorola_intel), php_ifd_get32s(value_ptr+4, motorola_intel));
1204 				len += 13;
1205 				value_ptr += 8;
1206 				break;
1207 		}
1208 		if (components > 0) {
1209 			dump = erealloc(dump, len + 2 + 1);
1210 			snprintf(dump + len, 2 + 1, ", ");
1211 			len += 2;
1212 			components--;
1213 		} else{
1214 			break;
1215 		}
1216 	}
1217 	dump = erealloc(dump, len + 1 + 1);
1218 	snprintf(dump + len, 1 + 1, "}");
1219 	return dump;
1220 }
1221 /* }}} */
1222 #endif
1223 
1224 /* {{{ exif_convert_any_format
1225  * Evaluate number, be it int, rational, or float from directory. */
exif_convert_any_format(void * value,int format,int motorola_intel)1226 static double exif_convert_any_format(void *value, int format, int motorola_intel)
1227 {
1228 	int 		s_den;
1229 	unsigned 	u_den;
1230 
1231 	switch(format) {
1232 		case TAG_FMT_SBYTE:     return *(signed char *)value;
1233 		case TAG_FMT_BYTE:      return *(uchar *)value;
1234 
1235 		case TAG_FMT_USHORT:    return php_ifd_get16u(value, motorola_intel);
1236 		case TAG_FMT_ULONG:     return php_ifd_get32u(value, motorola_intel);
1237 
1238 		case TAG_FMT_URATIONAL:
1239 			u_den = php_ifd_get32u(4+(char *)value, motorola_intel);
1240 			if (u_den == 0) {
1241 				return 0;
1242 			} else {
1243 				return (double)php_ifd_get32u(value, motorola_intel) / u_den;
1244 			}
1245 
1246 		case TAG_FMT_SRATIONAL:
1247 			s_den = php_ifd_get32s(4+(char *)value, motorola_intel);
1248 			if (s_den == 0) {
1249 				return 0;
1250 			} else {
1251 				return (double)php_ifd_get32s(value, motorola_intel) / s_den;
1252 			}
1253 
1254 		case TAG_FMT_SSHORT:    return (signed short)php_ifd_get16u(value, motorola_intel);
1255 		case TAG_FMT_SLONG:     return php_ifd_get32s(value, motorola_intel);
1256 
1257 		/* Not sure if this is correct (never seen float used in Exif format) */
1258 		case TAG_FMT_SINGLE:
1259 #ifdef EXIF_DEBUG
1260 			php_error_docref(NULL, E_NOTICE, "Found value of type single");
1261 #endif
1262 			return (double)*(float *)value;
1263 		case TAG_FMT_DOUBLE:
1264 #ifdef EXIF_DEBUG
1265 			php_error_docref(NULL, E_NOTICE, "Found value of type double");
1266 #endif
1267 			return *(double *)value;
1268 	}
1269 	return 0;
1270 }
1271 /* }}} */
1272 
1273 /* {{{ exif_convert_any_to_int
1274  * Evaluate number, be it int, rational, or float from directory. */
exif_convert_any_to_int(void * value,int format,int motorola_intel)1275 static size_t exif_convert_any_to_int(void *value, int format, int motorola_intel)
1276 {
1277 	int 		s_den;
1278 	unsigned 	u_den;
1279 
1280 	switch(format) {
1281 		case TAG_FMT_SBYTE:     return *(signed char *)value;
1282 		case TAG_FMT_BYTE:      return *(uchar *)value;
1283 
1284 		case TAG_FMT_USHORT:    return php_ifd_get16u(value, motorola_intel);
1285 		case TAG_FMT_ULONG:     return php_ifd_get32u(value, motorola_intel);
1286 
1287 		case TAG_FMT_URATIONAL:
1288 			u_den = php_ifd_get32u(4+(char *)value, motorola_intel);
1289 			if (u_den == 0) {
1290 				return 0;
1291 			} else {
1292 				return php_ifd_get32u(value, motorola_intel) / u_den;
1293 			}
1294 
1295 		case TAG_FMT_SRATIONAL:
1296 			s_den = php_ifd_get32s(4+(char *)value, motorola_intel);
1297 			if (s_den == 0) {
1298 				return 0;
1299 			} else {
1300 				return (size_t)((double)php_ifd_get32s(value, motorola_intel) / s_den);
1301 			}
1302 
1303 		case TAG_FMT_SSHORT:    return php_ifd_get16u(value, motorola_intel);
1304 		case TAG_FMT_SLONG:     return php_ifd_get32s(value, motorola_intel);
1305 
1306 		/* Not sure if this is correct (never seen float used in Exif format) */
1307 		case TAG_FMT_SINGLE:
1308 #ifdef EXIF_DEBUG
1309 			php_error_docref(NULL, E_NOTICE, "Found value of type single");
1310 #endif
1311 			return (size_t)*(float *)value;
1312 		case TAG_FMT_DOUBLE:
1313 #ifdef EXIF_DEBUG
1314 			php_error_docref(NULL, E_NOTICE, "Found value of type double");
1315 #endif
1316 			return (size_t)*(double *)value;
1317 	}
1318 	return 0;
1319 }
1320 /* }}} */
1321 
1322 /* {{{ struct image_info_value, image_info_list
1323 */
1324 #ifndef WORD
1325 #define WORD unsigned short
1326 #endif
1327 #ifndef DWORD
1328 #define DWORD unsigned int
1329 #endif
1330 
1331 typedef struct {
1332 	int             num;
1333 	int             den;
1334 } signed_rational;
1335 
1336 typedef struct {
1337 	unsigned int    num;
1338 	unsigned int    den;
1339 } unsigned_rational;
1340 
1341 typedef union _image_info_value {
1342 	char 				*s;
1343 	unsigned            u;
1344 	int 				i;
1345 	float               f;
1346 	double              d;
1347 	signed_rational 	sr;
1348 	unsigned_rational 	ur;
1349 	union _image_info_value   *list;
1350 } image_info_value;
1351 
1352 typedef struct {
1353 	WORD                tag;
1354 	WORD                format;
1355 	DWORD               length;
1356 	DWORD               dummy;  /* value ptr of tiff directory entry */
1357 	char 				*name;
1358 	image_info_value    value;
1359 } image_info_data;
1360 
1361 typedef struct {
1362 	int                 count;
1363 	image_info_data 	*list;
1364 } image_info_list;
1365 /* }}} */
1366 
1367 /* {{{ exif_get_sectionname
1368  Returns the name of a section
1369 */
1370 #define SECTION_FILE        0
1371 #define SECTION_COMPUTED    1
1372 #define SECTION_ANY_TAG     2
1373 #define SECTION_IFD0        3
1374 #define SECTION_THUMBNAIL   4
1375 #define SECTION_COMMENT     5
1376 #define SECTION_APP0        6
1377 #define SECTION_EXIF        7
1378 #define SECTION_FPIX        8
1379 #define SECTION_GPS         9
1380 #define SECTION_INTEROP     10
1381 #define SECTION_APP12       11
1382 #define SECTION_WINXP       12
1383 #define SECTION_MAKERNOTE   13
1384 #define SECTION_COUNT       14
1385 
1386 #define FOUND_FILE          (1<<SECTION_FILE)
1387 #define FOUND_COMPUTED      (1<<SECTION_COMPUTED)
1388 #define FOUND_ANY_TAG       (1<<SECTION_ANY_TAG)
1389 #define FOUND_IFD0          (1<<SECTION_IFD0)
1390 #define FOUND_THUMBNAIL     (1<<SECTION_THUMBNAIL)
1391 #define FOUND_COMMENT       (1<<SECTION_COMMENT)
1392 #define FOUND_APP0          (1<<SECTION_APP0)
1393 #define FOUND_EXIF          (1<<SECTION_EXIF)
1394 #define FOUND_FPIX          (1<<SECTION_FPIX)
1395 #define FOUND_GPS           (1<<SECTION_GPS)
1396 #define FOUND_INTEROP       (1<<SECTION_INTEROP)
1397 #define FOUND_APP12         (1<<SECTION_APP12)
1398 #define FOUND_WINXP         (1<<SECTION_WINXP)
1399 #define FOUND_MAKERNOTE     (1<<SECTION_MAKERNOTE)
1400 
exif_get_sectionname(int section)1401 static char *exif_get_sectionname(int section)
1402 {
1403 	switch(section) {
1404 		case SECTION_FILE:      return "FILE";
1405 		case SECTION_COMPUTED:  return "COMPUTED";
1406 		case SECTION_ANY_TAG:   return "ANY_TAG";
1407 		case SECTION_IFD0:      return "IFD0";
1408 		case SECTION_THUMBNAIL: return "THUMBNAIL";
1409 		case SECTION_COMMENT:   return "COMMENT";
1410 		case SECTION_APP0:      return "APP0";
1411 		case SECTION_EXIF:      return "EXIF";
1412 		case SECTION_FPIX:      return "FPIX";
1413 		case SECTION_GPS:       return "GPS";
1414 		case SECTION_INTEROP:   return "INTEROP";
1415 		case SECTION_APP12:     return "APP12";
1416 		case SECTION_WINXP:     return "WINXP";
1417 		case SECTION_MAKERNOTE: return "MAKERNOTE";
1418 	}
1419 	return "";
1420 }
1421 
exif_get_tag_table(int section)1422 static tag_table_type exif_get_tag_table(int section)
1423 {
1424 	switch(section) {
1425 		case SECTION_FILE:      return &tag_table_IFD[0];
1426 		case SECTION_COMPUTED:  return &tag_table_IFD[0];
1427 		case SECTION_ANY_TAG:   return &tag_table_IFD[0];
1428 		case SECTION_IFD0:      return &tag_table_IFD[0];
1429 		case SECTION_THUMBNAIL: return &tag_table_IFD[0];
1430 		case SECTION_COMMENT:   return &tag_table_IFD[0];
1431 		case SECTION_APP0:      return &tag_table_IFD[0];
1432 		case SECTION_EXIF:      return &tag_table_IFD[0];
1433 		case SECTION_FPIX:      return &tag_table_IFD[0];
1434 		case SECTION_GPS:       return &tag_table_GPS[0];
1435 		case SECTION_INTEROP:   return &tag_table_IOP[0];
1436 		case SECTION_APP12:     return &tag_table_IFD[0];
1437 		case SECTION_WINXP:     return &tag_table_IFD[0];
1438 	}
1439 	return &tag_table_IFD[0];
1440 }
1441 /* }}} */
1442 
1443 /* {{{ exif_get_sectionlist
1444    Return list of sectionnames specified by sectionlist. Return value must be freed
1445 */
exif_get_sectionlist(int sectionlist)1446 static char *exif_get_sectionlist(int sectionlist)
1447 {
1448 	int i, len, ml = 0;
1449 	char *sections;
1450 
1451 	for(i=0; i<SECTION_COUNT; i++) {
1452 		ml += strlen(exif_get_sectionname(i))+2;
1453 	}
1454 	sections = safe_emalloc(ml, 1, 1);
1455 	sections[0] = '\0';
1456 	len = 0;
1457 	for(i=0; i<SECTION_COUNT; i++) {
1458 		if (sectionlist&(1<<i)) {
1459 			snprintf(sections+len, ml-len, "%s, ", exif_get_sectionname(i));
1460 			len = strlen(sections);
1461 		}
1462 	}
1463 	if (len>2)
1464 		sections[len-2] = '\0';
1465 	return sections;
1466 }
1467 /* }}} */
1468 
1469 /* {{{ struct image_info_type
1470    This structure stores Exif header image elements in a simple manner
1471    Used to store camera data as extracted from the various ways that it can be
1472    stored in a nexif header
1473 */
1474 
1475 typedef struct {
1476 	int     type;
1477 	size_t  size;
1478 	uchar   *data;
1479 } file_section;
1480 
1481 typedef struct {
1482 	int             count;
1483 	file_section    *list;
1484 } file_section_list;
1485 
1486 typedef struct {
1487 	image_filetype  filetype;
1488 	size_t          width, height;
1489 	size_t          size;
1490 	size_t          offset;
1491 	char 	        *data;
1492 } thumbnail_data;
1493 
1494 typedef struct {
1495 	char			*value;
1496 	size_t			size;
1497 	int				tag;
1498 } xp_field_type;
1499 
1500 typedef struct {
1501 	int             count;
1502 	xp_field_type   *list;
1503 } xp_field_list;
1504 
1505 /* This structure is used to store a section of a Jpeg file. */
1506 typedef struct {
1507 	php_stream      *infile;
1508 	char            *FileName;
1509 	time_t          FileDateTime;
1510 	size_t          FileSize;
1511 	image_filetype  FileType;
1512 	int             Height, Width;
1513 	int             IsColor;
1514 
1515 	char            *make;
1516 	char            *model;
1517 
1518 	float           ApertureFNumber;
1519 	float           ExposureTime;
1520 	double          FocalplaneUnits;
1521 	float           CCDWidth;
1522 	double          FocalplaneXRes;
1523 	size_t          ExifImageWidth;
1524 	float           FocalLength;
1525 	float           Distance;
1526 
1527 	int             motorola_intel; /* 1 Motorola; 0 Intel */
1528 
1529 	char            *UserComment;
1530 	int             UserCommentLength;
1531 	char            *UserCommentEncoding;
1532 	char            *encode_unicode;
1533 	char            *decode_unicode_be;
1534 	char            *decode_unicode_le;
1535 	char            *encode_jis;
1536 	char            *decode_jis_be;
1537 	char            *decode_jis_le;
1538 	char            *Copyright;/* EXIF standard defines Copyright as "<Photographer> [ '\0' <Editor> ] ['\0']" */
1539 	char            *CopyrightPhotographer;
1540 	char            *CopyrightEditor;
1541 
1542 	xp_field_list   xp_fields;
1543 
1544 	thumbnail_data  Thumbnail;
1545 	/* other */
1546 	int             sections_found; /* FOUND_<marker> */
1547 	image_info_list info_list[SECTION_COUNT];
1548 	/* for parsing */
1549 	int             read_thumbnail;
1550 	int             read_all;
1551 	int             ifd_nesting_level;
1552 	/* internal */
1553 	file_section_list 	file;
1554 } image_info_type;
1555 /* }}} */
1556 
1557 /* {{{ exif_error_docref */
exif_error_docref(const char * docref EXIFERR_DC,const image_info_type * ImageInfo,int type,const char * format,...)1558 static void exif_error_docref(const char *docref EXIFERR_DC, const image_info_type *ImageInfo, int type, const char *format, ...)
1559 {
1560 	va_list args;
1561 
1562 	va_start(args, format);
1563 #ifdef EXIF_DEBUG
1564 	{
1565 		char *buf;
1566 
1567 		spprintf(&buf, 0, "%s(%d): %s", _file, _line, format);
1568 		php_verror(docref, ImageInfo->FileName?ImageInfo->FileName:"", type, buf, args);
1569 		efree(buf);
1570 	}
1571 #else
1572 	php_verror(docref, ImageInfo->FileName?ImageInfo->FileName:"", type, format, args);
1573 #endif
1574 	va_end(args);
1575 }
1576 /* }}} */
1577 
1578 /* {{{ jpeg_sof_info
1579  */
1580 typedef struct {
1581 	int     bits_per_sample;
1582 	size_t  width;
1583 	size_t  height;
1584 	int     num_components;
1585 } jpeg_sof_info;
1586 /* }}} */
1587 
1588 /* {{{ exif_file_sections_add
1589  Add a file_section to image_info
1590  returns the used block or -1. if size>0 and data == NULL buffer of size is allocated
1591 */
exif_file_sections_add(image_info_type * ImageInfo,int type,size_t size,uchar * data)1592 static int exif_file_sections_add(image_info_type *ImageInfo, int type, size_t size, uchar *data)
1593 {
1594 	file_section    *tmp;
1595 	int             count = ImageInfo->file.count;
1596 
1597 	tmp = safe_erealloc(ImageInfo->file.list, (count+1), sizeof(file_section), 0);
1598 	ImageInfo->file.list = tmp;
1599 	ImageInfo->file.list[count].type = 0xFFFF;
1600 	ImageInfo->file.list[count].data = NULL;
1601 	ImageInfo->file.list[count].size = 0;
1602 	ImageInfo->file.count = count+1;
1603 	if (!size) {
1604 		data = NULL;
1605 	} else if (data == NULL) {
1606 		data = safe_emalloc(size, 1, 0);
1607 	}
1608 	ImageInfo->file.list[count].type = type;
1609 	ImageInfo->file.list[count].data = data;
1610 	ImageInfo->file.list[count].size = size;
1611 	return count;
1612 }
1613 /* }}} */
1614 
1615 /* {{{ exif_file_sections_realloc
1616  Reallocate a file section returns 0 on success and -1 on failure
1617 */
exif_file_sections_realloc(image_info_type * ImageInfo,int section_index,size_t size)1618 static int exif_file_sections_realloc(image_info_type *ImageInfo, int section_index, size_t size)
1619 {
1620 	void *tmp;
1621 
1622 	/* This is not a malloc/realloc check. It is a plausibility check for the
1623 	 * function parameters (requirements engineering).
1624 	 */
1625 	if (section_index >= ImageInfo->file.count) {
1626 		EXIF_ERRLOG_FSREALLOC(ImageInfo)
1627 		return -1;
1628 	}
1629 	tmp = safe_erealloc(ImageInfo->file.list[section_index].data, 1, size, 0);
1630 	ImageInfo->file.list[section_index].data = tmp;
1631 	ImageInfo->file.list[section_index].size = size;
1632 	return 0;
1633 }
1634 /* }}} */
1635 
1636 /* {{{ exif_file_section_free
1637    Discard all file_sections in ImageInfo
1638 */
exif_file_sections_free(image_info_type * ImageInfo)1639 static int exif_file_sections_free(image_info_type *ImageInfo)
1640 {
1641 	int i;
1642 
1643 	if (ImageInfo->file.count) {
1644 		for (i=0; i<ImageInfo->file.count; i++) {
1645 			EFREE_IF(ImageInfo->file.list[i].data);
1646 		}
1647 	}
1648 	EFREE_IF(ImageInfo->file.list);
1649 	ImageInfo->file.count = 0;
1650 	return TRUE;
1651 }
1652 /* }}} */
1653 
1654 /* {{{ exif_iif_add_value
1655  Add a value to image_info
1656 */
exif_iif_add_value(image_info_type * image_info,int section_index,char * name,int tag,int format,int length,void * value,int motorola_intel)1657 static void exif_iif_add_value(image_info_type *image_info, int section_index, char *name, int tag, int format, int length, void* value, int motorola_intel)
1658 {
1659 	size_t idex;
1660 	void *vptr;
1661 	image_info_value *info_value;
1662 	image_info_data  *info_data;
1663 	image_info_data  *list;
1664 
1665 	if (length < 0) {
1666 		return;
1667 	}
1668 
1669 	list = safe_erealloc(image_info->info_list[section_index].list, (image_info->info_list[section_index].count+1), sizeof(image_info_data), 0);
1670 	image_info->info_list[section_index].list = list;
1671 
1672 	info_data  = &image_info->info_list[section_index].list[image_info->info_list[section_index].count];
1673 	memset(info_data, 0, sizeof(image_info_data));
1674 	info_data->tag    = tag;
1675 	info_data->format = format;
1676 	info_data->length = length;
1677 	info_data->name   = estrdup(name);
1678 	info_value        = &info_data->value;
1679 
1680 	switch (format) {
1681 		case TAG_FMT_STRING:
1682 			if (value) {
1683 				length = php_strnlen(value, length);
1684 				info_value->s = estrndup(value, length);
1685 				info_data->length = length;
1686 			} else {
1687 				info_data->length = 0;
1688 				info_value->s = estrdup("");
1689 			}
1690 			break;
1691 
1692 		default:
1693 			/* Standard says more types possible but skip them...
1694 			 * but allow users to handle data if they know how to
1695 			 * So not return but use type UNDEFINED
1696 			 * return;
1697 			 */
1698 			info_data->tag = TAG_FMT_UNDEFINED;/* otherwise not freed from memory */
1699 		case TAG_FMT_SBYTE:
1700 		case TAG_FMT_BYTE:
1701 		/* in contrast to strings bytes do not need to allocate buffer for NULL if length==0 */
1702 			if (!length)
1703 				break;
1704 		case TAG_FMT_UNDEFINED:
1705 			if (value) {
1706 				if (tag == TAG_MAKER_NOTE) {
1707 					length = (int) php_strnlen(value, length);
1708 				}
1709 
1710 				/* do not recompute length here */
1711 				info_value->s = estrndup(value, length);
1712 				info_data->length = length;
1713 			} else {
1714 				info_data->length = 0;
1715 				info_value->s = estrdup("");
1716 			}
1717 			break;
1718 
1719 		case TAG_FMT_USHORT:
1720 		case TAG_FMT_ULONG:
1721 		case TAG_FMT_URATIONAL:
1722 		case TAG_FMT_SSHORT:
1723 		case TAG_FMT_SLONG:
1724 		case TAG_FMT_SRATIONAL:
1725 		case TAG_FMT_SINGLE:
1726 		case TAG_FMT_DOUBLE:
1727 			if (length==0) {
1728 				break;
1729 			} else
1730 			if (length>1) {
1731 				info_value->list = safe_emalloc(length, sizeof(image_info_value), 0);
1732 			} else {
1733 				info_value = &info_data->value;
1734 			}
1735 			for (idex=0,vptr=value; idex<(size_t)length; idex++,vptr=(char *) vptr + php_tiff_bytes_per_format[format]) {
1736 				if (length>1) {
1737 					info_value = &info_data->value.list[idex];
1738 				}
1739 				switch (format) {
1740 					case TAG_FMT_USHORT:
1741 						info_value->u = php_ifd_get16u(vptr, motorola_intel);
1742 						break;
1743 
1744 					case TAG_FMT_ULONG:
1745 						info_value->u = php_ifd_get32u(vptr, motorola_intel);
1746 						break;
1747 
1748 					case TAG_FMT_URATIONAL:
1749 						info_value->ur.num = php_ifd_get32u(vptr, motorola_intel);
1750 						info_value->ur.den = php_ifd_get32u(4+(char *)vptr, motorola_intel);
1751 						break;
1752 
1753 					case TAG_FMT_SSHORT:
1754 						info_value->i = php_ifd_get16s(vptr, motorola_intel);
1755 						break;
1756 
1757 					case TAG_FMT_SLONG:
1758 						info_value->i = php_ifd_get32s(vptr, motorola_intel);
1759 						break;
1760 
1761 					case TAG_FMT_SRATIONAL:
1762 						info_value->sr.num = php_ifd_get32u(vptr, motorola_intel);
1763 						info_value->sr.den = php_ifd_get32u(4+(char *)vptr, motorola_intel);
1764 						break;
1765 
1766 					case TAG_FMT_SINGLE:
1767 #ifdef EXIF_DEBUG
1768 						php_error_docref(NULL, E_WARNING, "Found value of type single");
1769 #endif
1770 						info_value->f = *(float *)value;
1771 
1772 					case TAG_FMT_DOUBLE:
1773 #ifdef EXIF_DEBUG
1774 						php_error_docref(NULL, E_WARNING, "Found value of type double");
1775 #endif
1776 						info_value->d = *(double *)value;
1777 						break;
1778 				}
1779 			}
1780 	}
1781 	image_info->sections_found |= 1<<section_index;
1782 	image_info->info_list[section_index].count++;
1783 }
1784 /* }}} */
1785 
1786 /* {{{ exif_iif_add_tag
1787  Add a tag from IFD to image_info
1788 */
exif_iif_add_tag(image_info_type * image_info,int section_index,char * name,int tag,int format,size_t length,void * value)1789 static void exif_iif_add_tag(image_info_type *image_info, int section_index, char *name, int tag, int format, size_t length, void* value)
1790 {
1791 	exif_iif_add_value(image_info, section_index, name, tag, format, (int)length, value, image_info->motorola_intel);
1792 }
1793 /* }}} */
1794 
1795 /* {{{ exif_iif_add_int
1796  Add an int value to image_info
1797 */
exif_iif_add_int(image_info_type * image_info,int section_index,char * name,int value)1798 static void exif_iif_add_int(image_info_type *image_info, int section_index, char *name, int value)
1799 {
1800 	image_info_data  *info_data;
1801 	image_info_data  *list;
1802 
1803 	list = safe_erealloc(image_info->info_list[section_index].list, (image_info->info_list[section_index].count+1), sizeof(image_info_data), 0);
1804 	image_info->info_list[section_index].list = list;
1805 
1806 	info_data  = &image_info->info_list[section_index].list[image_info->info_list[section_index].count];
1807 	info_data->tag    = TAG_NONE;
1808 	info_data->format = TAG_FMT_SLONG;
1809 	info_data->length = 1;
1810 	info_data->name   = estrdup(name);
1811 	info_data->value.i = value;
1812 	image_info->sections_found |= 1<<section_index;
1813 	image_info->info_list[section_index].count++;
1814 }
1815 /* }}} */
1816 
1817 /* {{{ exif_iif_add_str
1818  Add a string value to image_info MUST BE NUL TERMINATED
1819 */
exif_iif_add_str(image_info_type * image_info,int section_index,char * name,char * value)1820 static void exif_iif_add_str(image_info_type *image_info, int section_index, char *name, char *value)
1821 {
1822 	image_info_data  *info_data;
1823 	image_info_data  *list;
1824 
1825 	if (value) {
1826 		list = safe_erealloc(image_info->info_list[section_index].list, (image_info->info_list[section_index].count+1), sizeof(image_info_data), 0);
1827 		image_info->info_list[section_index].list = list;
1828 		info_data  = &image_info->info_list[section_index].list[image_info->info_list[section_index].count];
1829 		info_data->tag    = TAG_NONE;
1830 		info_data->format = TAG_FMT_STRING;
1831 		info_data->length = 1;
1832 		info_data->name   = estrdup(name);
1833 		info_data->value.s = estrdup(value);
1834 		image_info->sections_found |= 1<<section_index;
1835 		image_info->info_list[section_index].count++;
1836 	}
1837 }
1838 /* }}} */
1839 
1840 /* {{{ exif_iif_add_fmt
1841  Add a format string value to image_info MUST BE NUL TERMINATED
1842 */
exif_iif_add_fmt(image_info_type * image_info,int section_index,char * name,char * value,...)1843 static void exif_iif_add_fmt(image_info_type *image_info, int section_index, char *name, char *value, ...)
1844 {
1845 	char             *tmp;
1846 	va_list 		 arglist;
1847 
1848 	va_start(arglist, value);
1849 	if (value) {
1850 		vspprintf(&tmp, 0, value, arglist);
1851 		exif_iif_add_str(image_info, section_index, name, tmp);
1852 		efree(tmp);
1853 	}
1854 	va_end(arglist);
1855 }
1856 /* }}} */
1857 
1858 /* {{{ exif_iif_add_str
1859  Add a string value to image_info MUST BE NUL TERMINATED
1860 */
exif_iif_add_buffer(image_info_type * image_info,int section_index,char * name,int length,char * value)1861 static void exif_iif_add_buffer(image_info_type *image_info, int section_index, char *name, int length, char *value)
1862 {
1863 	image_info_data  *info_data;
1864 	image_info_data  *list;
1865 
1866 	if (value) {
1867 		list = safe_erealloc(image_info->info_list[section_index].list, (image_info->info_list[section_index].count+1), sizeof(image_info_data), 0);
1868 		image_info->info_list[section_index].list = list;
1869 		info_data  = &image_info->info_list[section_index].list[image_info->info_list[section_index].count];
1870 		info_data->tag    = TAG_NONE;
1871 		info_data->format = TAG_FMT_UNDEFINED;
1872 		info_data->length = length;
1873 		info_data->name   = estrdup(name);
1874 		info_data->value.s = safe_emalloc(length, 1, 1);
1875 		memcpy(info_data->value.s, value, length);
1876 		info_data->value.s[length] = 0;
1877 		image_info->sections_found |= 1<<section_index;
1878 		image_info->info_list[section_index].count++;
1879 	}
1880 }
1881 /* }}} */
1882 
1883 /* {{{ exif_iif_free
1884  Free memory allocated for image_info
1885 */
exif_iif_free(image_info_type * image_info,int section_index)1886 static void exif_iif_free(image_info_type *image_info, int section_index) {
1887 	int  i;
1888 	void *f; /* faster */
1889 
1890 	if (image_info->info_list[section_index].count) {
1891 		for (i=0; i < image_info->info_list[section_index].count; i++) {
1892 			if ((f=image_info->info_list[section_index].list[i].name) != NULL) {
1893 				efree(f);
1894 			}
1895 			switch(image_info->info_list[section_index].list[i].format) {
1896 				case TAG_FMT_SBYTE:
1897 				case TAG_FMT_BYTE:
1898 					/* in contrast to strings bytes do not need to allocate buffer for NULL if length==0 */
1899 					if (image_info->info_list[section_index].list[i].length<1)
1900 						break;
1901 				default:
1902 				case TAG_FMT_UNDEFINED:
1903 				case TAG_FMT_STRING:
1904 					if ((f=image_info->info_list[section_index].list[i].value.s) != NULL) {
1905 						efree(f);
1906 					}
1907 					break;
1908 
1909 				case TAG_FMT_USHORT:
1910 				case TAG_FMT_ULONG:
1911 				case TAG_FMT_URATIONAL:
1912 				case TAG_FMT_SSHORT:
1913 				case TAG_FMT_SLONG:
1914 				case TAG_FMT_SRATIONAL:
1915 				case TAG_FMT_SINGLE:
1916 				case TAG_FMT_DOUBLE:
1917 					/* nothing to do here */
1918 					if (image_info->info_list[section_index].list[i].length > 1) {
1919 						if ((f=image_info->info_list[section_index].list[i].value.list) != NULL) {
1920 							efree(f);
1921 						}
1922 					}
1923 					break;
1924 			}
1925 		}
1926 	}
1927 	EFREE_IF(image_info->info_list[section_index].list);
1928 }
1929 /* }}} */
1930 
1931 /* {{{ add_assoc_image_info
1932  * Add image_info to associative array value. */
add_assoc_image_info(zval * value,int sub_array,image_info_type * image_info,int section_index)1933 static void add_assoc_image_info(zval *value, int sub_array, image_info_type *image_info, int section_index)
1934 {
1935 	char    buffer[64], *val, *name, uname[64];
1936 	int     i, ap, l, b, idx=0, unknown=0;
1937 #ifdef EXIF_DEBUG
1938 	int     info_tag;
1939 #endif
1940 	image_info_value *info_value;
1941 	image_info_data  *info_data;
1942 	zval 			 tmpi, array;
1943 
1944 #ifdef EXIF_DEBUG
1945 /*		php_error_docref(NULL, E_NOTICE, "Adding %d infos from section %s", image_info->info_list[section_index].count, exif_get_sectionname(section_index));*/
1946 #endif
1947 	if (image_info->info_list[section_index].count) {
1948 		if (sub_array) {
1949 			array_init(&tmpi);
1950 		} else {
1951 			ZVAL_COPY_VALUE(&tmpi, value);
1952 		}
1953 
1954 		for(i=0; i<image_info->info_list[section_index].count; i++) {
1955 			info_data  = &image_info->info_list[section_index].list[i];
1956 #ifdef EXIF_DEBUG
1957 			info_tag   = info_data->tag; /* conversion */
1958 #endif
1959 			info_value = &info_data->value;
1960 			if (!(name = info_data->name)) {
1961 				snprintf(uname, sizeof(uname), "%d", unknown++);
1962 				name = uname;
1963 			}
1964 #ifdef EXIF_DEBUG
1965 /*		php_error_docref(NULL, E_NOTICE, "Adding infos: tag(0x%04X,%12s,L=0x%04X): %s", info_tag, exif_get_tagname(info_tag, buffer, -12, exif_get_tag_table(section_index)), info_data->length, info_data->format==TAG_FMT_STRING?(info_value&&info_value->s?info_value->s:"<no data>"):exif_get_tagformat(info_data->format));*/
1966 #endif
1967 			if (info_data->length==0) {
1968 				add_assoc_null(&tmpi, name);
1969 			} else {
1970 				switch (info_data->format) {
1971 					default:
1972 						/* Standard says more types possible but skip them...
1973 						 * but allow users to handle data if they know how to
1974 						 * So not return but use type UNDEFINED
1975 						 * return;
1976 						 */
1977 					case TAG_FMT_BYTE:
1978 					case TAG_FMT_SBYTE:
1979 					case TAG_FMT_UNDEFINED:
1980 						if (!info_value->s) {
1981 							add_assoc_stringl(&tmpi, name, "", 0);
1982 						} else {
1983 							add_assoc_stringl(&tmpi, name, info_value->s, info_data->length);
1984 						}
1985 						break;
1986 
1987 					case TAG_FMT_STRING:
1988 						if (!(val = info_value->s)) {
1989 							val = "";
1990 						}
1991 						if (section_index==SECTION_COMMENT) {
1992 							add_index_string(&tmpi, idx++, val);
1993 						} else {
1994 							add_assoc_string(&tmpi, name, val);
1995 						}
1996 						break;
1997 
1998 					case TAG_FMT_URATIONAL:
1999 					case TAG_FMT_SRATIONAL:
2000 					/*case TAG_FMT_BYTE:
2001 					case TAG_FMT_SBYTE:*/
2002 					case TAG_FMT_USHORT:
2003 					case TAG_FMT_SSHORT:
2004 					case TAG_FMT_SINGLE:
2005 					case TAG_FMT_DOUBLE:
2006 					case TAG_FMT_ULONG:
2007 					case TAG_FMT_SLONG:
2008 						/* now the rest, first see if it becomes an array */
2009 						if ((l = info_data->length) > 1) {
2010 							array_init(&array);
2011 						}
2012 						for(ap=0; ap<l; ap++) {
2013 							if (l>1) {
2014 								info_value = &info_data->value.list[ap];
2015 							}
2016 							switch (info_data->format) {
2017 								case TAG_FMT_BYTE:
2018 									if (l>1) {
2019 										info_value = &info_data->value;
2020 										for (b=0;b<l;b++) {
2021 											add_index_long(&array, b, (int)(info_value->s[b]));
2022 										}
2023 										break;
2024 									}
2025 								case TAG_FMT_USHORT:
2026 								case TAG_FMT_ULONG:
2027 									if (l==1) {
2028 										add_assoc_long(&tmpi, name, (int)info_value->u);
2029 									} else {
2030 										add_index_long(&array, ap, (int)info_value->u);
2031 									}
2032 									break;
2033 
2034 								case TAG_FMT_URATIONAL:
2035 									snprintf(buffer, sizeof(buffer), "%i/%i", info_value->ur.num, info_value->ur.den);
2036 									if (l==1) {
2037 										add_assoc_string(&tmpi, name, buffer);
2038 									} else {
2039 										add_index_string(&array, ap, buffer);
2040 									}
2041 									break;
2042 
2043 								case TAG_FMT_SBYTE:
2044 									if (l>1) {
2045 										info_value = &info_data->value;
2046 										for (b=0;b<l;b++) {
2047 											add_index_long(&array, ap, (int)info_value->s[b]);
2048 										}
2049 										break;
2050 									}
2051 								case TAG_FMT_SSHORT:
2052 								case TAG_FMT_SLONG:
2053 									if (l==1) {
2054 										add_assoc_long(&tmpi, name, info_value->i);
2055 									} else {
2056 										add_index_long(&array, ap, info_value->i);
2057 									}
2058 									break;
2059 
2060 								case TAG_FMT_SRATIONAL:
2061 									snprintf(buffer, sizeof(buffer), "%i/%i", info_value->sr.num, info_value->sr.den);
2062 									if (l==1) {
2063 										add_assoc_string(&tmpi, name, buffer);
2064 									} else {
2065 										add_index_string(&array, ap, buffer);
2066 									}
2067 									break;
2068 
2069 								case TAG_FMT_SINGLE:
2070 									if (l==1) {
2071 										add_assoc_double(&tmpi, name, info_value->f);
2072 									} else {
2073 										add_index_double(&array, ap, info_value->f);
2074 									}
2075 									break;
2076 
2077 								case TAG_FMT_DOUBLE:
2078 									if (l==1) {
2079 										add_assoc_double(&tmpi, name, info_value->d);
2080 									} else {
2081 										add_index_double(&array, ap, info_value->d);
2082 									}
2083 									break;
2084 							}
2085 							info_value = &info_data->value.list[ap];
2086 						}
2087 						if (l>1) {
2088 							add_assoc_zval(&tmpi, name, &array);
2089 						}
2090 						break;
2091 				}
2092 			}
2093 		}
2094 		if (sub_array) {
2095 			add_assoc_zval(value, exif_get_sectionname(section_index), &tmpi);
2096 		}
2097 	}
2098 }
2099 /* }}} */
2100 
2101 /* {{{ Markers
2102    JPEG markers consist of one or more 0xFF bytes, followed by a marker
2103    code byte (which is not an FF).  Here are the marker codes of interest
2104    in this program.  (See jdmarker.c for a more complete list.)
2105 */
2106 
2107 #define M_TEM   0x01    /* temp for arithmetic coding              */
2108 #define M_RES   0x02    /* reserved                                */
2109 #define M_SOF0  0xC0    /* Start Of Frame N                        */
2110 #define M_SOF1  0xC1    /* N indicates which compression process   */
2111 #define M_SOF2  0xC2    /* Only SOF0-SOF2 are now in common use    */
2112 #define M_SOF3  0xC3
2113 #define M_DHT   0xC4
2114 #define M_SOF5  0xC5    /* NB: codes C4 and CC are NOT SOF markers */
2115 #define M_SOF6  0xC6
2116 #define M_SOF7  0xC7
2117 #define M_JPEG  0x08    /* reserved for extensions                 */
2118 #define M_SOF9  0xC9
2119 #define M_SOF10 0xCA
2120 #define M_SOF11 0xCB
2121 #define M_DAC   0xCC    /* arithmetic table                         */
2122 #define M_SOF13 0xCD
2123 #define M_SOF14 0xCE
2124 #define M_SOF15 0xCF
2125 #define M_RST0  0xD0    /* restart segment                          */
2126 #define M_RST1  0xD1
2127 #define M_RST2  0xD2
2128 #define M_RST3  0xD3
2129 #define M_RST4  0xD4
2130 #define M_RST5  0xD5
2131 #define M_RST6  0xD6
2132 #define M_RST7  0xD7
2133 #define M_SOI   0xD8    /* Start Of Image (beginning of datastream) */
2134 #define M_EOI   0xD9    /* End Of Image (end of datastream)         */
2135 #define M_SOS   0xDA    /* Start Of Scan (begins compressed data)   */
2136 #define M_DQT   0xDB
2137 #define M_DNL   0xDC
2138 #define M_DRI   0xDD
2139 #define M_DHP   0xDE
2140 #define M_EXP   0xDF
2141 #define M_APP0  0xE0    /* JPEG: 'JFIFF' AND (additional 'JFXX')    */
2142 #define M_EXIF  0xE1    /* Exif Attribute Information               */
2143 #define M_APP2  0xE2    /* Flash Pix Extension Data?                */
2144 #define M_APP3  0xE3
2145 #define M_APP4  0xE4
2146 #define M_APP5  0xE5
2147 #define M_APP6  0xE6
2148 #define M_APP7  0xE7
2149 #define M_APP8  0xE8
2150 #define M_APP9  0xE9
2151 #define M_APP10 0xEA
2152 #define M_APP11 0xEB
2153 #define M_APP12 0xEC
2154 #define M_APP13 0xED    /* IPTC International Press Telecommunications Council */
2155 #define M_APP14 0xEE    /* Software, Copyright?                     */
2156 #define M_APP15 0xEF
2157 #define M_JPG0  0xF0
2158 #define M_JPG1  0xF1
2159 #define M_JPG2  0xF2
2160 #define M_JPG3  0xF3
2161 #define M_JPG4  0xF4
2162 #define M_JPG5  0xF5
2163 #define M_JPG6  0xF6
2164 #define M_JPG7  0xF7
2165 #define M_JPG8  0xF8
2166 #define M_JPG9  0xF9
2167 #define M_JPG10 0xFA
2168 #define M_JPG11 0xFB
2169 #define M_JPG12 0xFC
2170 #define M_JPG13 0xFD
2171 #define M_COM   0xFE    /* COMment                                  */
2172 
2173 #define M_PSEUDO 0x123 	/* Extra value.                             */
2174 
2175 /* }}} */
2176 
2177 /* {{{ jpeg2000 markers
2178  */
2179 /* Markers x30 - x3F do not have a segment */
2180 /* Markers x00, x01, xFE, xC0 - xDF ISO/IEC 10918-1 -> M_<xx> */
2181 /* Markers xF0 - xF7 ISO/IEC 10918-3 */
2182 /* Markers xF7 - xF8 ISO/IEC 14495-1 */
2183 /* XY=Main/Tile-header:(R:required, N:not_allowed, O:optional, L:last_marker) */
2184 #define JC_SOC   0x4F   /* NN, Start of codestream                          */
2185 #define JC_SIZ   0x51   /* RN, Image and tile size                          */
2186 #define JC_COD   0x52   /* RO, Codeing style defaulte                       */
2187 #define JC_COC   0x53   /* OO, Coding style component                       */
2188 #define JC_TLM   0x55   /* ON, Tile part length main header                 */
2189 #define JC_PLM   0x57   /* ON, Packet length main header                    */
2190 #define JC_PLT   0x58   /* NO, Packet length tile part header               */
2191 #define JC_QCD   0x5C   /* RO, Quantization default                         */
2192 #define JC_QCC   0x5D   /* OO, Quantization component                       */
2193 #define JC_RGN   0x5E   /* OO, Region of interest                           */
2194 #define JC_POD   0x5F   /* OO, Progression order default                    */
2195 #define JC_PPM   0x60   /* ON, Packed packet headers main header            */
2196 #define JC_PPT   0x61   /* NO, Packet packet headers tile part header       */
2197 #define JC_CME   0x64   /* OO, Comment: "LL E <text>" E=0:binary, E=1:ascii */
2198 #define JC_SOT   0x90   /* NR, Start of tile                                */
2199 #define JC_SOP   0x91   /* NO, Start of packeter default                    */
2200 #define JC_EPH   0x92   /* NO, End of packet header                         */
2201 #define JC_SOD   0x93   /* NL, Start of data                                */
2202 #define JC_EOC   0xD9   /* NN, End of codestream                            */
2203 /* }}} */
2204 
2205 /* {{{ exif_process_COM
2206    Process a COM marker.
2207    We want to print out the marker contents as legible text;
2208    we must guard against random junk and varying newline representations.
2209 */
exif_process_COM(image_info_type * image_info,char * value,size_t length)2210 static void exif_process_COM (image_info_type *image_info, char *value, size_t length)
2211 {
2212 	exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_STRING, length-2, value+2);
2213 }
2214 /* }}} */
2215 
2216 /* {{{ exif_process_CME
2217    Process a CME marker.
2218    We want to print out the marker contents as legible text;
2219    we must guard against random junk and varying newline representations.
2220 */
2221 #ifdef EXIF_JPEG2000
exif_process_CME(image_info_type * image_info,char * value,size_t length)2222 static void exif_process_CME (image_info_type *image_info, char *value, size_t length)
2223 {
2224 	if (length>3) {
2225 		switch(value[2]) {
2226 			case 0:
2227 				exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_UNDEFINED, length, value);
2228 				break;
2229 			case 1:
2230 				exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_STRING, length, value);
2231 				break;
2232 			default:
2233 				php_error_docref(NULL, E_NOTICE, "Undefined JPEG2000 comment encoding");
2234 				break;
2235 		}
2236 	} else {
2237 		exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_UNDEFINED, 0, NULL);
2238 		php_error_docref(NULL, E_NOTICE, "JPEG2000 comment section too small");
2239 	}
2240 }
2241 #endif
2242 /* }}} */
2243 
2244 /* {{{ exif_process_SOFn
2245  * Process a SOFn marker.  This is useful for the image dimensions */
exif_process_SOFn(uchar * Data,int marker,jpeg_sof_info * result)2246 static void exif_process_SOFn (uchar *Data, int marker, jpeg_sof_info *result)
2247 {
2248 /* 0xFF SOSn SectLen(2) Bits(1) Height(2) Width(2) Channels(1)  3*Channels (1)  */
2249 	result->bits_per_sample = Data[2];
2250 	result->height          = php_jpg_get16(Data+3);
2251 	result->width           = php_jpg_get16(Data+5);
2252 	result->num_components  = Data[7];
2253 
2254 /*	switch (marker) {
2255 		case M_SOF0:  process = "Baseline";  break;
2256 		case M_SOF1:  process = "Extended sequential";  break;
2257 		case M_SOF2:  process = "Progressive";  break;
2258 		case M_SOF3:  process = "Lossless";  break;
2259 		case M_SOF5:  process = "Differential sequential";  break;
2260 		case M_SOF6:  process = "Differential progressive";  break;
2261 		case M_SOF7:  process = "Differential lossless";  break;
2262 		case M_SOF9:  process = "Extended sequential, arithmetic coding";  break;
2263 		case M_SOF10: process = "Progressive, arithmetic coding";  break;
2264 		case M_SOF11: process = "Lossless, arithmetic coding";  break;
2265 		case M_SOF13: process = "Differential sequential, arithmetic coding";  break;
2266 		case M_SOF14: process = "Differential progressive, arithmetic coding"; break;
2267 		case M_SOF15: process = "Differential lossless, arithmetic coding";  break;
2268 		default:      process = "Unknown";  break;
2269 	}*/
2270 }
2271 /* }}} */
2272 
2273 /* forward declarations */
2274 static int exif_process_IFD_in_JPEG(image_info_type *ImageInfo, char *dir_start, char *offset_base, size_t IFDlength, size_t displacement, int section_index);
2275 static int exif_process_IFD_TAG(    image_info_type *ImageInfo, char *dir_entry, char *offset_base, size_t IFDlength, size_t displacement, int section_index, int ReadNextIFD, tag_table_type tag_table);
2276 
2277 /* {{{ exif_get_markername
2278 	Get name of marker */
2279 #ifdef EXIF_DEBUG
exif_get_markername(int marker)2280 static char * exif_get_markername(int marker)
2281 {
2282 	switch(marker) {
2283 		case 0xC0: return "SOF0";
2284 		case 0xC1: return "SOF1";
2285 		case 0xC2: return "SOF2";
2286 		case 0xC3: return "SOF3";
2287 		case 0xC4: return "DHT";
2288 		case 0xC5: return "SOF5";
2289 		case 0xC6: return "SOF6";
2290 		case 0xC7: return "SOF7";
2291 		case 0xC9: return "SOF9";
2292 		case 0xCA: return "SOF10";
2293 		case 0xCB: return "SOF11";
2294 		case 0xCD: return "SOF13";
2295 		case 0xCE: return "SOF14";
2296 		case 0xCF: return "SOF15";
2297 		case 0xD8: return "SOI";
2298 		case 0xD9: return "EOI";
2299 		case 0xDA: return "SOS";
2300 		case 0xDB: return "DQT";
2301 		case 0xDC: return "DNL";
2302 		case 0xDD: return "DRI";
2303 		case 0xDE: return "DHP";
2304 		case 0xDF: return "EXP";
2305 		case 0xE0: return "APP0";
2306 		case 0xE1: return "EXIF";
2307 		case 0xE2: return "FPIX";
2308 		case 0xE3: return "APP3";
2309 		case 0xE4: return "APP4";
2310 		case 0xE5: return "APP5";
2311 		case 0xE6: return "APP6";
2312 		case 0xE7: return "APP7";
2313 		case 0xE8: return "APP8";
2314 		case 0xE9: return "APP9";
2315 		case 0xEA: return "APP10";
2316 		case 0xEB: return "APP11";
2317 		case 0xEC: return "APP12";
2318 		case 0xED: return "APP13";
2319 		case 0xEE: return "APP14";
2320 		case 0xEF: return "APP15";
2321 		case 0xF0: return "JPG0";
2322 		case 0xFD: return "JPG13";
2323 		case 0xFE: return "COM";
2324 		case 0x01: return "TEM";
2325 	}
2326 	return "Unknown";
2327 }
2328 #endif
2329 /* }}} */
2330 
2331 /* {{{ proto string exif_tagname(int index)
2332 	Get headername for index or false if not defined */
PHP_FUNCTION(exif_tagname)2333 PHP_FUNCTION(exif_tagname)
2334 {
2335 	zend_long tag;
2336 	char *szTemp;
2337 
2338 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "l", &tag) == FAILURE) {
2339 		return;
2340 	}
2341 
2342 	szTemp = exif_get_tagname(tag, NULL, 0, tag_table_IFD);
2343 
2344 	if (tag < 0 || !szTemp || !szTemp[0]) {
2345 		RETURN_FALSE;
2346 	}
2347 
2348 	RETURN_STRING(szTemp)
2349 }
2350 /* }}} */
2351 
2352 /* {{{ exif_ifd_make_value
2353  * Create a value for an ifd from an info_data pointer */
exif_ifd_make_value(image_info_data * info_data,int motorola_intel)2354 static void* exif_ifd_make_value(image_info_data *info_data, int motorola_intel) {
2355 	size_t  byte_count;
2356 	char    *value_ptr, *data_ptr;
2357 	size_t  i;
2358 
2359 	image_info_value  *info_value;
2360 
2361 	byte_count = php_tiff_bytes_per_format[info_data->format] * info_data->length;
2362 	value_ptr = safe_emalloc(max(byte_count, 4), 1, 0);
2363 	memset(value_ptr, 0, 4);
2364 	if (!info_data->length) {
2365 		return value_ptr;
2366 	}
2367 	if (info_data->format == TAG_FMT_UNDEFINED || info_data->format == TAG_FMT_STRING
2368 	  || (byte_count>1 && (info_data->format == TAG_FMT_BYTE || info_data->format == TAG_FMT_SBYTE))
2369 	) {
2370 		memmove(value_ptr, info_data->value.s, byte_count);
2371 		return value_ptr;
2372 	} else if (info_data->format == TAG_FMT_BYTE) {
2373 		*value_ptr = info_data->value.u;
2374 		return value_ptr;
2375 	} else if (info_data->format == TAG_FMT_SBYTE) {
2376 		*value_ptr = info_data->value.i;
2377 		return value_ptr;
2378 	} else {
2379 		data_ptr = value_ptr;
2380 		for(i=0; i<info_data->length; i++) {
2381 			if (info_data->length==1) {
2382 				info_value = &info_data->value;
2383 			} else {
2384 				info_value = &info_data->value.list[i];
2385 			}
2386 			switch(info_data->format) {
2387 				case TAG_FMT_USHORT:
2388 					php_ifd_set16u(data_ptr, info_value->u, motorola_intel);
2389 					data_ptr += 2;
2390 					break;
2391 				case TAG_FMT_ULONG:
2392 					php_ifd_set32u(data_ptr, info_value->u, motorola_intel);
2393 					data_ptr += 4;
2394 					break;
2395 				case TAG_FMT_SSHORT:
2396 					php_ifd_set16u(data_ptr, info_value->i, motorola_intel);
2397 					data_ptr += 2;
2398 					break;
2399 				case TAG_FMT_SLONG:
2400 					php_ifd_set32u(data_ptr, info_value->i, motorola_intel);
2401 					data_ptr += 4;
2402 					break;
2403 				case TAG_FMT_URATIONAL:
2404 					php_ifd_set32u(data_ptr,   info_value->sr.num, motorola_intel);
2405 					php_ifd_set32u(data_ptr+4, info_value->sr.den, motorola_intel);
2406 					data_ptr += 8;
2407 					break;
2408 				case TAG_FMT_SRATIONAL:
2409 					php_ifd_set32u(data_ptr,   info_value->ur.num, motorola_intel);
2410 					php_ifd_set32u(data_ptr+4, info_value->ur.den, motorola_intel);
2411 					data_ptr += 8;
2412 					break;
2413 				case TAG_FMT_SINGLE:
2414 					memmove(data_ptr, &info_value->f, 4);
2415 					data_ptr += 4;
2416 					break;
2417 				case TAG_FMT_DOUBLE:
2418 					memmove(data_ptr, &info_value->d, 8);
2419 					data_ptr += 8;
2420 					break;
2421 			}
2422 		}
2423 	}
2424 	return value_ptr;
2425 }
2426 /* }}} */
2427 
2428 /* {{{ exif_thumbnail_build
2429  * Check and build thumbnail */
exif_thumbnail_build(image_info_type * ImageInfo)2430 static void exif_thumbnail_build(image_info_type *ImageInfo) {
2431 	size_t            new_size, new_move, new_value;
2432 	char              *new_data;
2433 	void              *value_ptr;
2434 	int               i, byte_count;
2435 	image_info_list   *info_list;
2436 	image_info_data   *info_data;
2437 #ifdef EXIF_DEBUG
2438 	char              tagname[64];
2439 #endif
2440 
2441 	if (!ImageInfo->read_thumbnail || !ImageInfo->Thumbnail.offset || !ImageInfo->Thumbnail.size) {
2442 		return; /* ignore this call */
2443 	}
2444 #ifdef EXIF_DEBUG
2445 	exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Thumbnail: filetype = %d", ImageInfo->Thumbnail.filetype);
2446 #endif
2447 	switch(ImageInfo->Thumbnail.filetype) {
2448 		default:
2449 		case IMAGE_FILETYPE_JPEG:
2450 			/* done */
2451 			break;
2452 		case IMAGE_FILETYPE_TIFF_II:
2453 		case IMAGE_FILETYPE_TIFF_MM:
2454 			info_list = &ImageInfo->info_list[SECTION_THUMBNAIL];
2455 			new_size  = 8 + 2 + info_list->count * 12 + 4;
2456 #ifdef EXIF_DEBUG
2457 			exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Thumbnail: size of signature + directory(%d): 0x%02X", info_list->count, new_size);
2458 #endif
2459 			new_value= new_size; /* offset for ifd values outside ifd directory */
2460 			for (i=0; i<info_list->count; i++) {
2461 				info_data  = &info_list->list[i];
2462 				byte_count = php_tiff_bytes_per_format[info_data->format] * info_data->length;
2463 				if (byte_count > 4) {
2464 					new_size += byte_count;
2465 				}
2466 			}
2467 			new_move = new_size;
2468 			new_data = safe_erealloc(ImageInfo->Thumbnail.data, 1, ImageInfo->Thumbnail.size, new_size);
2469 			ImageInfo->Thumbnail.data = new_data;
2470 			memmove(ImageInfo->Thumbnail.data + new_move, ImageInfo->Thumbnail.data, ImageInfo->Thumbnail.size);
2471 			ImageInfo->Thumbnail.size += new_size;
2472 			/* fill in data */
2473 			if (ImageInfo->motorola_intel) {
2474 				memmove(new_data, "MM\x00\x2a\x00\x00\x00\x08", 8);
2475 			} else {
2476 				memmove(new_data, "II\x2a\x00\x08\x00\x00\x00", 8);
2477 			}
2478 			new_data += 8;
2479 			php_ifd_set16u(new_data, info_list->count, ImageInfo->motorola_intel);
2480 			new_data += 2;
2481 			for (i=0; i<info_list->count; i++) {
2482 				info_data  = &info_list->list[i];
2483 				byte_count = php_tiff_bytes_per_format[info_data->format] * info_data->length;
2484 #ifdef EXIF_DEBUG
2485 				exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Thumbnail: process tag(x%04X=%s): %s%s (%d bytes)", info_data->tag, exif_get_tagname(info_data->tag, tagname, -12, tag_table_IFD), (info_data->length>1)&&info_data->format!=TAG_FMT_UNDEFINED&&info_data->format!=TAG_FMT_STRING?"ARRAY OF ":"", exif_get_tagformat(info_data->format), byte_count);
2486 #endif
2487 				if (info_data->tag==TAG_STRIP_OFFSETS || info_data->tag==TAG_JPEG_INTERCHANGE_FORMAT) {
2488 					php_ifd_set16u(new_data + 0, info_data->tag,    ImageInfo->motorola_intel);
2489 					php_ifd_set16u(new_data + 2, TAG_FMT_ULONG,     ImageInfo->motorola_intel);
2490 					php_ifd_set32u(new_data + 4, 1,                 ImageInfo->motorola_intel);
2491 					php_ifd_set32u(new_data + 8, new_move,          ImageInfo->motorola_intel);
2492 				} else {
2493 					php_ifd_set16u(new_data + 0, info_data->tag,    ImageInfo->motorola_intel);
2494 					php_ifd_set16u(new_data + 2, info_data->format, ImageInfo->motorola_intel);
2495 					php_ifd_set32u(new_data + 4, info_data->length, ImageInfo->motorola_intel);
2496 					value_ptr  = exif_ifd_make_value(info_data, ImageInfo->motorola_intel);
2497 					if (byte_count <= 4) {
2498 						memmove(new_data+8, value_ptr, 4);
2499 					} else {
2500 						php_ifd_set32u(new_data+8, new_value, ImageInfo->motorola_intel);
2501 #ifdef EXIF_DEBUG
2502 						exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Thumbnail: writing with value offset: 0x%04X + 0x%02X", new_value, byte_count);
2503 #endif
2504 						memmove(ImageInfo->Thumbnail.data+new_value, value_ptr, byte_count);
2505 						new_value += byte_count;
2506 					}
2507 					efree(value_ptr);
2508 				}
2509 				new_data += 12;
2510 			}
2511 			memset(new_data, 0, 4); /* next ifd pointer */
2512 #ifdef EXIF_DEBUG
2513 			exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Thumbnail: created");
2514 #endif
2515 			break;
2516 	}
2517 }
2518 /* }}} */
2519 
2520 /* {{{ exif_thumbnail_extract
2521  * Grab the thumbnail, corrected */
exif_thumbnail_extract(image_info_type * ImageInfo,char * offset,size_t length)2522 static void exif_thumbnail_extract(image_info_type *ImageInfo, char *offset, size_t length) {
2523 	if (ImageInfo->Thumbnail.data) {
2524 		exif_error_docref("exif_read_data#error_mult_thumb" EXIFERR_CC, ImageInfo, E_WARNING, "Multiple possible thumbnails");
2525 		return; /* Should not happen */
2526 	}
2527 	if (!ImageInfo->read_thumbnail)	{
2528 		return; /* ignore this call */
2529 	}
2530 	/* according to exif2.1, the thumbnail is not supposed to be greater than 64K */
2531 	if (ImageInfo->Thumbnail.size >= 65536
2532 	 || ImageInfo->Thumbnail.size <= 0
2533 	 || ImageInfo->Thumbnail.offset <= 0
2534 	) {
2535 		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Illegal thumbnail size/offset");
2536 		return;
2537 	}
2538 	/* Check to make sure we are not going to go past the ExifLength */
2539 	if (ImageInfo->Thumbnail.size > length
2540 		|| (ImageInfo->Thumbnail.offset + ImageInfo->Thumbnail.size) > length
2541 		|| ImageInfo->Thumbnail.offset > length - ImageInfo->Thumbnail.size
2542 	) {
2543 		EXIF_ERRLOG_THUMBEOF(ImageInfo)
2544 		return;
2545 	}
2546 	ImageInfo->Thumbnail.data = estrndup(offset + ImageInfo->Thumbnail.offset, ImageInfo->Thumbnail.size);
2547 	exif_thumbnail_build(ImageInfo);
2548 }
2549 /* }}} */
2550 
2551 /* {{{ exif_process_undefined
2552  * Copy a string/buffer in Exif header to a character string and return length of allocated buffer if any. */
exif_process_undefined(char ** result,char * value,size_t byte_count)2553 static int exif_process_undefined(char **result, char *value, size_t byte_count) {
2554 	/* we cannot use strlcpy - here the problem is that we have to copy NUL
2555 	 * chars up to byte_count, we also have to add a single NUL character to
2556 	 * force end of string.
2557 	 * estrndup does not return length
2558 	 */
2559 	if (byte_count) {
2560 		(*result) = estrndup(value, byte_count); /* NULL @ byte_count!!! */
2561 		return byte_count+1;
2562 	}
2563 	return 0;
2564 }
2565 /* }}} */
2566 
2567 /* {{{ exif_process_string_raw
2568  * Copy a string in Exif header to a character string returns length of allocated buffer if any. */
exif_process_string_raw(char ** result,char * value,size_t byte_count)2569 static int exif_process_string_raw(char **result, char *value, size_t byte_count) {
2570 	/* we cannot use strlcpy - here the problem is that we have to copy NUL
2571 	 * chars up to byte_count, we also have to add a single NUL character to
2572 	 * force end of string.
2573 	 */
2574 	if (byte_count) {
2575 		(*result) = safe_emalloc(byte_count, 1, 1);
2576 		memcpy(*result, value, byte_count);
2577 		(*result)[byte_count] = '\0';
2578 		return byte_count+1;
2579 	}
2580 	return 0;
2581 }
2582 /* }}} */
2583 
2584 /* {{{ exif_process_string
2585  * Copy a string in Exif header to a character string and return length of allocated buffer if any.
2586  * In contrast to exif_process_string this function does always return a string buffer */
exif_process_string(char ** result,char * value,size_t byte_count)2587 static int exif_process_string(char **result, char *value, size_t byte_count) {
2588 	/* we cannot use strlcpy - here the problem is that we cannot use strlen to
2589 	 * determin length of string and we cannot use strlcpy with len=byte_count+1
2590 	 * because then we might get into an EXCEPTION if we exceed an allocated
2591 	 * memory page...so we use php_strnlen in conjunction with memcpy and add the NUL
2592 	 * char.
2593 	 * estrdup would sometimes allocate more memory and does not return length
2594 	 */
2595 	if ((byte_count=php_strnlen(value, byte_count)) > 0) {
2596 		return exif_process_undefined(result, value, byte_count);
2597 	}
2598 	(*result) = estrndup("", 1); /* force empty string */
2599 	return byte_count+1;
2600 }
2601 /* }}} */
2602 
2603 /* {{{ exif_process_user_comment
2604  * Process UserComment in IFD. */
exif_process_user_comment(image_info_type * ImageInfo,char ** pszInfoPtr,char ** pszEncoding,char * szValuePtr,int ByteCount)2605 static int exif_process_user_comment(image_info_type *ImageInfo, char **pszInfoPtr, char **pszEncoding, char *szValuePtr, int ByteCount)
2606 {
2607 	int   a;
2608 	char  *decode;
2609 	size_t len;;
2610 
2611 	*pszEncoding = NULL;
2612 	/* Copy the comment */
2613 	if (ByteCount>=8) {
2614 		const zend_encoding *from, *to;
2615 		if (!memcmp(szValuePtr, "UNICODE\0", 8)) {
2616 			*pszEncoding = estrdup((const char*)szValuePtr);
2617 			szValuePtr = szValuePtr+8;
2618 			ByteCount -= 8;
2619 			/* First try to detect BOM: ZERO WIDTH NOBREAK SPACE (FEFF 16)
2620 			 * since we have no encoding support for the BOM yet we skip that.
2621 			 */
2622 			if (!memcmp(szValuePtr, "\xFE\xFF", 2)) {
2623 				decode = "UCS-2BE";
2624 				szValuePtr = szValuePtr+2;
2625 				ByteCount -= 2;
2626 			} else if (!memcmp(szValuePtr, "\xFF\xFE", 2)) {
2627 				decode = "UCS-2LE";
2628 				szValuePtr = szValuePtr+2;
2629 				ByteCount -= 2;
2630 			} else if (ImageInfo->motorola_intel) {
2631 				decode = ImageInfo->decode_unicode_be;
2632 			} else {
2633 				decode = ImageInfo->decode_unicode_le;
2634 			}
2635 			to = zend_multibyte_fetch_encoding(ImageInfo->encode_unicode);
2636 			from = zend_multibyte_fetch_encoding(decode);
2637 			/* XXX this will fail again if encoding_converter returns on error something different than SIZE_MAX   */
2638 			if (!to || !from || zend_multibyte_encoding_converter(
2639 					(unsigned char**)pszInfoPtr,
2640 					&len,
2641 					(unsigned char*)szValuePtr,
2642 					ByteCount,
2643 					to,
2644 					from) == (size_t)-1) {
2645 				len = exif_process_string_raw(pszInfoPtr, szValuePtr, ByteCount);
2646 			}
2647 			return len;
2648 		} else if (!memcmp(szValuePtr, "ASCII\0\0\0", 8)) {
2649 			*pszEncoding = estrdup((const char*)szValuePtr);
2650 			szValuePtr = szValuePtr+8;
2651 			ByteCount -= 8;
2652 		} else if (!memcmp(szValuePtr, "JIS\0\0\0\0\0", 8)) {
2653 			/* JIS should be tanslated to MB or we leave it to the user - leave it to the user */
2654 			*pszEncoding = estrdup((const char*)szValuePtr);
2655 			szValuePtr = szValuePtr+8;
2656 			ByteCount -= 8;
2657 			/* XXX this will fail again if encoding_converter returns on error something different than SIZE_MAX   */
2658 			to = zend_multibyte_fetch_encoding(ImageInfo->encode_jis);
2659 			from = zend_multibyte_fetch_encoding(ImageInfo->motorola_intel ? ImageInfo->decode_jis_be : ImageInfo->decode_jis_le);
2660 			if (!to || !from || zend_multibyte_encoding_converter(
2661 					(unsigned char**)pszInfoPtr,
2662 					&len,
2663 					(unsigned char*)szValuePtr,
2664 					ByteCount,
2665 					to,
2666 					from) == (size_t)-1) {
2667 				len = exif_process_string_raw(pszInfoPtr, szValuePtr, ByteCount);
2668 			}
2669 			return len;
2670 		} else if (!memcmp(szValuePtr, "\0\0\0\0\0\0\0\0", 8)) {
2671 			/* 8 NULL means undefined and should be ASCII... */
2672 			*pszEncoding = estrdup("UNDEFINED");
2673 			szValuePtr = szValuePtr+8;
2674 			ByteCount -= 8;
2675 		}
2676 	}
2677 
2678 	/* Olympus has this padded with trailing spaces.  Remove these first. */
2679 	if (ByteCount>0) {
2680 		for (a=ByteCount-1;a && szValuePtr[a]==' ';a--) {
2681 			(szValuePtr)[a] = '\0';
2682 		}
2683 	}
2684 
2685 	/* normal text without encoding */
2686 	exif_process_string(pszInfoPtr, szValuePtr, ByteCount);
2687 	return strlen(*pszInfoPtr);
2688 }
2689 /* }}} */
2690 
2691 /* {{{ exif_process_unicode
2692  * Process unicode field in IFD. */
exif_process_unicode(image_info_type * ImageInfo,xp_field_type * xp_field,int tag,char * szValuePtr,int ByteCount)2693 static int exif_process_unicode(image_info_type *ImageInfo, xp_field_type *xp_field, int tag, char *szValuePtr, int ByteCount)
2694 {
2695 	xp_field->tag = tag;
2696 	xp_field->value = NULL;
2697 	/* XXX this will fail again if encoding_converter returns on error something different than SIZE_MAX   */
2698 	if (zend_multibyte_encoding_converter(
2699 			(unsigned char**)&xp_field->value,
2700 			&xp_field->size,
2701 			(unsigned char*)szValuePtr,
2702 			ByteCount,
2703 			zend_multibyte_fetch_encoding(ImageInfo->encode_unicode),
2704 			zend_multibyte_fetch_encoding(ImageInfo->motorola_intel ? ImageInfo->decode_unicode_be : ImageInfo->decode_unicode_le)
2705 			) == (size_t)-1) {
2706 		xp_field->size = exif_process_string_raw(&xp_field->value, szValuePtr, ByteCount);
2707 	}
2708 	return xp_field->size;
2709 }
2710 /* }}} */
2711 
2712 /* {{{ exif_process_IFD_in_MAKERNOTE
2713  * Process nested IFDs directories in Maker Note. */
exif_process_IFD_in_MAKERNOTE(image_info_type * ImageInfo,char * value_ptr,int value_len,char * offset_base,size_t IFDlength,size_t displacement)2714 static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * value_ptr, int value_len, char *offset_base, size_t IFDlength, size_t displacement)
2715 {
2716 	int de, i=0, section_index = SECTION_MAKERNOTE;
2717 	int NumDirEntries, old_motorola_intel, offset_diff;
2718 	const maker_note_type *maker_note;
2719 	char *dir_start;
2720 	int data_len;
2721 
2722 	for (i=0; i<=sizeof(maker_note_array)/sizeof(maker_note_type); i++) {
2723 		if (i==sizeof(maker_note_array)/sizeof(maker_note_type)) {
2724 #ifdef EXIF_DEBUG
2725 			exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "No maker note data found. Detected maker: %s (length = %d)", ImageInfo->make, strlen(ImageInfo->make));
2726 #endif
2727 			/* unknown manufacturer, not an error, use it as a string */
2728 			return TRUE;
2729 		}
2730 
2731 		maker_note = maker_note_array+i;
2732 
2733 		/*exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "check (%s,%s)", maker_note->make?maker_note->make:"", maker_note->model?maker_note->model:"");*/
2734 		if (maker_note->make && (!ImageInfo->make || strcmp(maker_note->make, ImageInfo->make)))
2735 			continue;
2736 		if (maker_note->model && (!ImageInfo->model || strcmp(maker_note->model, ImageInfo->model)))
2737 			continue;
2738 		if (maker_note->id_string && strncmp(maker_note->id_string, value_ptr, maker_note->id_string_len))
2739 			continue;
2740 		break;
2741 	}
2742 
2743 	if (maker_note->offset >= value_len) {
2744 		/* Do not go past the value end */
2745 		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "IFD data too short: 0x%04X offset 0x%04X", value_len, maker_note->offset);
2746 		return FALSE;
2747 	}
2748 
2749 	dir_start = value_ptr + maker_note->offset;
2750 
2751 #ifdef EXIF_DEBUG
2752 	exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Process %s @x%04X + 0x%04X=%d: %s", exif_get_sectionname(section_index), (int)dir_start-(int)offset_base+maker_note->offset+displacement, value_len, value_len, exif_char_dump(value_ptr, value_len, (int)dir_start-(int)offset_base+maker_note->offset+displacement));
2753 #endif
2754 
2755 	ImageInfo->sections_found |= FOUND_MAKERNOTE;
2756 
2757 	old_motorola_intel = ImageInfo->motorola_intel;
2758 	switch (maker_note->byte_order) {
2759 		case MN_ORDER_INTEL:
2760 			ImageInfo->motorola_intel = 0;
2761 			break;
2762 		case MN_ORDER_MOTOROLA:
2763 			ImageInfo->motorola_intel = 1;
2764 			break;
2765 		default:
2766 		case MN_ORDER_NORMAL:
2767 			break;
2768 	}
2769 
2770 	NumDirEntries = php_ifd_get16u(dir_start, ImageInfo->motorola_intel);
2771 
2772 	switch (maker_note->offset_mode) {
2773 		case MN_OFFSET_MAKER:
2774 			offset_base = value_ptr;
2775 			data_len = value_len;
2776 			break;
2777 		case MN_OFFSET_GUESS:
2778 			if (maker_note->offset + 10 + 4 >= value_len) {
2779 				/* Can not read dir_start+10 since it's beyond value end */
2780 				exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "IFD data too short: 0x%04X", value_len);
2781 				return FALSE;
2782 			}
2783 			offset_diff = 2 + NumDirEntries*12 + 4 - php_ifd_get32u(dir_start+10, ImageInfo->motorola_intel);
2784 #ifdef EXIF_DEBUG
2785 			exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Using automatic offset correction: 0x%04X", ((int)dir_start-(int)offset_base+maker_note->offset+displacement) + offset_diff);
2786 #endif
2787 			if (offset_diff < 0 || offset_diff >= value_len ) {
2788 				exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "IFD data bad offset: 0x%04X length 0x%04X", offset_diff, value_len);
2789 				return FALSE;
2790 			}
2791 			offset_base = value_ptr + offset_diff;
2792 			data_len = value_len - offset_diff;
2793 			break;
2794 		default:
2795 		case MN_OFFSET_NORMAL:
2796 			break;
2797 	}
2798 
2799 	if ((2+NumDirEntries*12) > value_len) {
2800 		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 2 + 0x%04X*12 = 0x%04X > 0x%04X", NumDirEntries, 2+NumDirEntries*12, value_len);
2801 		return FALSE;
2802 	}
2803 
2804 	for (de=0;de<NumDirEntries;de++) {
2805 		if (!exif_process_IFD_TAG(ImageInfo, dir_start + 2 + 12 * de,
2806 								  offset_base, data_len, displacement, section_index, 0, maker_note->tag_table)) {
2807 			return FALSE;
2808 		}
2809 	}
2810 	ImageInfo->motorola_intel = old_motorola_intel;
2811 /*	NextDirOffset (must be NULL) = php_ifd_get32u(dir_start+2+12*de, ImageInfo->motorola_intel);*/
2812 #ifdef EXIF_DEBUG
2813 	exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Subsection %s done", exif_get_sectionname(SECTION_MAKERNOTE));
2814 #endif
2815 	return TRUE;
2816 }
2817 /* }}} */
2818 
2819 /* {{{ exif_process_IFD_TAG
2820  * Process one of the nested IFDs directories. */
exif_process_IFD_TAG(image_info_type * ImageInfo,char * dir_entry,char * offset_base,size_t IFDlength,size_t displacement,int section_index,int ReadNextIFD,tag_table_type tag_table)2821 static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, char *offset_base, size_t IFDlength, size_t displacement, int section_index, int ReadNextIFD, tag_table_type tag_table)
2822 {
2823 	size_t length;
2824 	int tag, format, components;
2825 	char *value_ptr, tagname[64], cbuf[32], *outside=NULL;
2826 	size_t byte_count, offset_val, fpos, fgot;
2827 	int64_t byte_count_signed;
2828 	xp_field_type *tmp_xp;
2829 #ifdef EXIF_DEBUG
2830 	char *dump_data;
2831 	int dump_free;
2832 #endif /* EXIF_DEBUG */
2833 
2834 	/* Protect against corrupt headers */
2835 	if (ImageInfo->ifd_nesting_level > MAX_IFD_NESTING_LEVEL) {
2836 		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "corrupt EXIF header: maximum directory nesting level reached");
2837 		return FALSE;
2838 	}
2839 	ImageInfo->ifd_nesting_level++;
2840 
2841 	tag = php_ifd_get16u(dir_entry, ImageInfo->motorola_intel);
2842 	format = php_ifd_get16u(dir_entry+2, ImageInfo->motorola_intel);
2843 	components = php_ifd_get32u(dir_entry+4, ImageInfo->motorola_intel);
2844 
2845 	if (!format || format > NUM_FORMATS) {
2846 		/* (-1) catches illegal zero case as unsigned underflows to positive large. */
2847 		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Illegal format code 0x%04X, suppose BYTE", tag, exif_get_tagname(tag, tagname, -12, tag_table), format);
2848 		format = TAG_FMT_BYTE;
2849 		/*return TRUE;*/
2850 	}
2851 
2852 	if (components < 0) {
2853 		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Illegal components(%d)", tag, exif_get_tagname(tag, tagname, -12, tag_table), components);
2854 		return FALSE;
2855 	}
2856 
2857 	byte_count_signed = (int64_t)components * php_tiff_bytes_per_format[format];
2858 
2859 	if (byte_count_signed < 0 || (byte_count_signed > INT32_MAX)) {
2860 		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Illegal byte_count", tag, exif_get_tagname(tag, tagname, -12, tag_table));
2861 		return FALSE;
2862 	}
2863 
2864 	byte_count = (size_t)byte_count_signed;
2865 
2866 	if (byte_count > 4) {
2867 		offset_val = php_ifd_get32u(dir_entry+8, ImageInfo->motorola_intel);
2868 		/* If its bigger than 4 bytes, the dir entry contains an offset. */
2869 		value_ptr = offset_base+offset_val;
2870         /*
2871             dir_entry is ImageInfo->file.list[sn].data+2+i*12
2872             offset_base is ImageInfo->file.list[sn].data-dir_offset
2873             dir_entry - offset_base is dir_offset+2+i*12
2874         */
2875 		if (byte_count > IFDlength || offset_val > IFDlength-byte_count || value_ptr < dir_entry || offset_val < (size_t)(dir_entry-offset_base)) {
2876 			/* It is important to check for IMAGE_FILETYPE_TIFF
2877 			 * JPEG does not use absolute pointers instead its pointers are
2878 			 * relative to the start of the TIFF header in APP1 section. */
2879 			if (byte_count > ImageInfo->FileSize || offset_val>ImageInfo->FileSize-byte_count || (ImageInfo->FileType!=IMAGE_FILETYPE_TIFF_II && ImageInfo->FileType!=IMAGE_FILETYPE_TIFF_MM && ImageInfo->FileType!=IMAGE_FILETYPE_JPEG)) {
2880 				if (value_ptr < dir_entry) {
2881 					/* we can read this if offset_val > 0 */
2882 					/* some files have their values in other parts of the file */
2883 					exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Illegal pointer offset(x%04X < x%04X)", tag, exif_get_tagname(tag, tagname, -12, tag_table), offset_val, dir_entry);
2884 				} else {
2885 					/* this is for sure not allowed */
2886 					/* exception are IFD pointers */
2887 					exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Illegal pointer offset(x%04X + x%04X = x%04X > x%04X)", tag, exif_get_tagname(tag, tagname, -12, tag_table), offset_val, byte_count, offset_val+byte_count, IFDlength);
2888 				}
2889 				return FALSE;
2890 			}
2891 			if (byte_count>sizeof(cbuf)) {
2892 				/* mark as outside range and get buffer */
2893 				value_ptr = safe_emalloc(byte_count, 1, 0);
2894 				outside = value_ptr;
2895 			} else {
2896 				/* In most cases we only access a small range so
2897 				 * it is faster to use a static buffer there
2898 				 * BUT it offers also the possibility to have
2899 				 * pointers read without the need to free them
2900 				 * explicitley before returning. */
2901 				memset(&cbuf, 0, sizeof(cbuf));
2902 				value_ptr = cbuf;
2903 			}
2904 
2905 			fpos = php_stream_tell(ImageInfo->infile);
2906 			php_stream_seek(ImageInfo->infile, displacement+offset_val, SEEK_SET);
2907 			fgot = php_stream_tell(ImageInfo->infile);
2908 			if (fgot!=displacement+offset_val) {
2909 				EFREE_IF(outside);
2910 				exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Wrong file pointer: 0x%08X != 0x%08X", fgot, displacement+offset_val);
2911 				return FALSE;
2912 			}
2913 			fgot = php_stream_read(ImageInfo->infile, value_ptr, byte_count);
2914 			php_stream_seek(ImageInfo->infile, fpos, SEEK_SET);
2915 			if (fgot<byte_count) {
2916 				EFREE_IF(outside);
2917 				EXIF_ERRLOG_FILEEOF(ImageInfo)
2918 				return FALSE;
2919 			}
2920 		}
2921 	} else {
2922 		/* 4 bytes or less and value is in the dir entry itself */
2923 		value_ptr = dir_entry+8;
2924 		offset_val= value_ptr-offset_base;
2925 	}
2926 
2927 	ImageInfo->sections_found |= FOUND_ANY_TAG;
2928 #ifdef EXIF_DEBUG
2929 	dump_data = exif_dump_data(&dump_free, format, components, length, ImageInfo->motorola_intel, value_ptr);
2930 	exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Process tag(x%04X=%s,@x%04X + x%04X(=%d)): %s%s %s", tag, exif_get_tagname(tag, tagname, -12, tag_table), offset_val+displacement, byte_count, byte_count, (components>1)&&format!=TAG_FMT_UNDEFINED&&format!=TAG_FMT_STRING?"ARRAY OF ":"", exif_get_tagformat(format), dump_data);
2931 	if (dump_free) {
2932 		efree(dump_data);
2933 	}
2934 #endif
2935 
2936 	if (section_index==SECTION_THUMBNAIL) {
2937 		if (!ImageInfo->Thumbnail.data) {
2938 			switch(tag) {
2939 				case TAG_IMAGEWIDTH:
2940 				case TAG_COMP_IMAGE_WIDTH:
2941 					ImageInfo->Thumbnail.width = exif_convert_any_to_int(value_ptr, format, ImageInfo->motorola_intel);
2942 					break;
2943 
2944 				case TAG_IMAGEHEIGHT:
2945 				case TAG_COMP_IMAGE_HEIGHT:
2946 					ImageInfo->Thumbnail.height = exif_convert_any_to_int(value_ptr, format, ImageInfo->motorola_intel);
2947 					break;
2948 
2949 				case TAG_STRIP_OFFSETS:
2950 				case TAG_JPEG_INTERCHANGE_FORMAT:
2951 					/* accept both formats */
2952 					ImageInfo->Thumbnail.offset = exif_convert_any_to_int(value_ptr, format, ImageInfo->motorola_intel);
2953 					break;
2954 
2955 				case TAG_STRIP_BYTE_COUNTS:
2956 					if (ImageInfo->FileType == IMAGE_FILETYPE_TIFF_II || ImageInfo->FileType == IMAGE_FILETYPE_TIFF_MM) {
2957 						ImageInfo->Thumbnail.filetype = ImageInfo->FileType;
2958 					} else {
2959 						/* motorola is easier to read */
2960 						ImageInfo->Thumbnail.filetype = IMAGE_FILETYPE_TIFF_MM;
2961 					}
2962 					ImageInfo->Thumbnail.size = exif_convert_any_to_int(value_ptr, format, ImageInfo->motorola_intel);
2963 					break;
2964 
2965 				case TAG_JPEG_INTERCHANGE_FORMAT_LEN:
2966 					if (ImageInfo->Thumbnail.filetype == IMAGE_FILETYPE_UNKNOWN) {
2967 						ImageInfo->Thumbnail.filetype = IMAGE_FILETYPE_JPEG;
2968 						ImageInfo->Thumbnail.size = exif_convert_any_to_int(value_ptr, format, ImageInfo->motorola_intel);
2969 					}
2970 					break;
2971 			}
2972 		}
2973 	} else {
2974 		if (section_index==SECTION_IFD0 || section_index==SECTION_EXIF)
2975 		switch(tag) {
2976 			case TAG_COPYRIGHT:
2977 				/* check for "<photographer> NUL <editor> NUL" */
2978 				if (byte_count>1 && (length=php_strnlen(value_ptr, byte_count)) > 0) {
2979 					if (length<byte_count-1) {
2980 						/* When there are any characters after the first NUL */
2981 						ImageInfo->CopyrightPhotographer  = estrdup(value_ptr);
2982 						ImageInfo->CopyrightEditor        = estrndup(value_ptr+length+1, byte_count-length-1);
2983 						spprintf(&ImageInfo->Copyright, 0, "%s, %s", ImageInfo->CopyrightPhotographer, ImageInfo->CopyrightEditor);
2984 						/* format = TAG_FMT_UNDEFINED; this musn't be ASCII         */
2985 						/* but we are not supposed to change this                   */
2986 						/* keep in mind that image_info does not store editor value */
2987 					} else {
2988 						ImageInfo->Copyright = estrndup(value_ptr, byte_count);
2989 					}
2990 				}
2991 				break;
2992 
2993 			case TAG_USERCOMMENT:
2994 				ImageInfo->UserCommentLength = exif_process_user_comment(ImageInfo, &(ImageInfo->UserComment), &(ImageInfo->UserCommentEncoding), value_ptr, byte_count);
2995 				break;
2996 
2997 			case TAG_XP_TITLE:
2998 			case TAG_XP_COMMENTS:
2999 			case TAG_XP_AUTHOR:
3000 			case TAG_XP_KEYWORDS:
3001 			case TAG_XP_SUBJECT:
3002 				tmp_xp = (xp_field_type*)safe_erealloc(ImageInfo->xp_fields.list, (ImageInfo->xp_fields.count+1), sizeof(xp_field_type), 0);
3003 				ImageInfo->sections_found |= FOUND_WINXP;
3004 				ImageInfo->xp_fields.list = tmp_xp;
3005 				ImageInfo->xp_fields.count++;
3006 				exif_process_unicode(ImageInfo, &(ImageInfo->xp_fields.list[ImageInfo->xp_fields.count-1]), tag, value_ptr, byte_count);
3007 				break;
3008 
3009 			case TAG_FNUMBER:
3010 				/* Simplest way of expressing aperture, so I trust it the most.
3011 				   (overwrite previously computed value if there is one) */
3012 				ImageInfo->ApertureFNumber = (float)exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel);
3013 				break;
3014 
3015 			case TAG_APERTURE:
3016 			case TAG_MAX_APERTURE:
3017 				/* More relevant info always comes earlier, so only use this field if we don't
3018 				   have appropriate aperture information yet. */
3019 				if (ImageInfo->ApertureFNumber == 0) {
3020 					ImageInfo->ApertureFNumber
3021 						= (float)exp(exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel)*log(2)*0.5);
3022 				}
3023 				break;
3024 
3025 			case TAG_SHUTTERSPEED:
3026 				/* More complicated way of expressing exposure time, so only use
3027 				   this value if we don't already have it from somewhere else.
3028 				   SHUTTERSPEED comes after EXPOSURE TIME
3029 				  */
3030 				if (ImageInfo->ExposureTime == 0) {
3031 					ImageInfo->ExposureTime
3032 						= (float)(1/exp(exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel)*log(2)));
3033 				}
3034 				break;
3035 			case TAG_EXPOSURETIME:
3036 				ImageInfo->ExposureTime = -1;
3037 				break;
3038 
3039 			case TAG_COMP_IMAGE_WIDTH:
3040 				ImageInfo->ExifImageWidth = exif_convert_any_to_int(value_ptr, format, ImageInfo->motorola_intel);
3041 				break;
3042 
3043 			case TAG_FOCALPLANE_X_RES:
3044 				ImageInfo->FocalplaneXRes = exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel);
3045 				break;
3046 
3047 			case TAG_SUBJECT_DISTANCE:
3048 				/* Inidcates the distacne the autofocus camera is focused to.
3049 				   Tends to be less accurate as distance increases. */
3050 				ImageInfo->Distance = (float)exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel);
3051 				break;
3052 
3053 			case TAG_FOCALPLANE_RESOLUTION_UNIT:
3054 				switch((int)exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel)) {
3055 					case 1: ImageInfo->FocalplaneUnits = 25.4; break; /* inch */
3056 					case 2:
3057 						/* According to the information I was using, 2 measn meters.
3058 						   But looking at the Cannon powershot's files, inches is the only
3059 						   sensible value. */
3060 						ImageInfo->FocalplaneUnits = 25.4;
3061 						break;
3062 
3063 					case 3: ImageInfo->FocalplaneUnits = 10;   break;  /* centimeter */
3064 					case 4: ImageInfo->FocalplaneUnits = 1;    break;  /* milimeter  */
3065 					case 5: ImageInfo->FocalplaneUnits = .001; break;  /* micrometer */
3066 				}
3067 				break;
3068 
3069 			case TAG_SUB_IFD:
3070 				if (format==TAG_FMT_IFD) {
3071 					/* If this is called we are either in a TIFFs thumbnail or a JPEG where we cannot handle it */
3072 					/* TIFF thumbnail: our data structure cannot store a thumbnail of a thumbnail */
3073 					/* JPEG do we have the data area and what to do with it */
3074 					exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Skip SUB IFD");
3075 				}
3076 				break;
3077 
3078 			case TAG_MAKE:
3079 				ImageInfo->make = estrndup(value_ptr, byte_count);
3080 				break;
3081 			case TAG_MODEL:
3082 				ImageInfo->model = estrndup(value_ptr, byte_count);
3083 				break;
3084 
3085 			case TAG_MAKER_NOTE:
3086 				if (!exif_process_IFD_in_MAKERNOTE(ImageInfo, value_ptr, byte_count, offset_base, IFDlength, displacement)) {
3087 					EFREE_IF(outside);
3088 					return FALSE;
3089 				}
3090 				break;
3091 
3092 			case TAG_EXIF_IFD_POINTER:
3093 			case TAG_GPS_IFD_POINTER:
3094 			case TAG_INTEROP_IFD_POINTER:
3095 				if (ReadNextIFD) {
3096 					char *Subdir_start;
3097 					int sub_section_index = 0;
3098 					switch(tag) {
3099 						case TAG_EXIF_IFD_POINTER:
3100 #ifdef EXIF_DEBUG
3101 							exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Found EXIF");
3102 #endif
3103 							ImageInfo->sections_found |= FOUND_EXIF;
3104 							sub_section_index = SECTION_EXIF;
3105 							break;
3106 						case TAG_GPS_IFD_POINTER:
3107 #ifdef EXIF_DEBUG
3108 							exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Found GPS");
3109 #endif
3110 							ImageInfo->sections_found |= FOUND_GPS;
3111 							sub_section_index = SECTION_GPS;
3112 							break;
3113 						case TAG_INTEROP_IFD_POINTER:
3114 #ifdef EXIF_DEBUG
3115 							exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Found INTEROPERABILITY");
3116 #endif
3117 							ImageInfo->sections_found |= FOUND_INTEROP;
3118 							sub_section_index = SECTION_INTEROP;
3119 							break;
3120 					}
3121 					Subdir_start = offset_base + php_ifd_get32u(value_ptr, ImageInfo->motorola_intel);
3122 					if (Subdir_start < offset_base || Subdir_start > offset_base+IFDlength) {
3123 						exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD Pointer");
3124 						return FALSE;
3125 					}
3126 					if (!exif_process_IFD_in_JPEG(ImageInfo, Subdir_start, offset_base, IFDlength, displacement, sub_section_index)) {
3127 						return FALSE;
3128 					}
3129 #ifdef EXIF_DEBUG
3130 					exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Subsection %s done", exif_get_sectionname(sub_section_index));
3131 #endif
3132 				}
3133 		}
3134 	}
3135 	exif_iif_add_tag(ImageInfo, section_index, exif_get_tagname(tag, tagname, sizeof(tagname), tag_table), tag, format, components, value_ptr);
3136 	EFREE_IF(outside);
3137 	return TRUE;
3138 }
3139 /* }}} */
3140 
3141 /* {{{ exif_process_IFD_in_JPEG
3142  * Process one of the nested IFDs directories. */
exif_process_IFD_in_JPEG(image_info_type * ImageInfo,char * dir_start,char * offset_base,size_t IFDlength,size_t displacement,int section_index)3143 static int exif_process_IFD_in_JPEG(image_info_type *ImageInfo, char *dir_start, char *offset_base, size_t IFDlength, size_t displacement, int section_index)
3144 {
3145 	int de;
3146 	int NumDirEntries;
3147 	int NextDirOffset;
3148 
3149 #ifdef EXIF_DEBUG
3150 	exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Process %s (x%04X(=%d))", exif_get_sectionname(section_index), IFDlength, IFDlength);
3151 #endif
3152 
3153 	ImageInfo->sections_found |= FOUND_IFD0;
3154 
3155 	if ((dir_start + 2) >= (offset_base+IFDlength)) {
3156 		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size");
3157 		return FALSE;
3158 	}
3159 
3160 	NumDirEntries = php_ifd_get16u(dir_start, ImageInfo->motorola_intel);
3161 
3162 	if ((dir_start+2+NumDirEntries*12) > (offset_base+IFDlength)) {
3163 		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: x%04X + 2 + x%04X*12 = x%04X > x%04X", (int)((size_t)dir_start+2-(size_t)offset_base), NumDirEntries, (int)((size_t)dir_start+2+NumDirEntries*12-(size_t)offset_base), IFDlength);
3164 		return FALSE;
3165 	}
3166 
3167 	for (de=0;de<NumDirEntries;de++) {
3168 		if (!exif_process_IFD_TAG(ImageInfo, dir_start + 2 + 12 * de,
3169 								  offset_base, IFDlength, displacement, section_index, 1, exif_get_tag_table(section_index))) {
3170 			return FALSE;
3171 		}
3172 	}
3173 	/*
3174 	 * Ignore IFD2 if it purportedly exists
3175 	 */
3176 	if (section_index == SECTION_THUMBNAIL) {
3177 		return TRUE;
3178 	}
3179 	/*
3180 	 * Hack to make it process IDF1 I hope
3181 	 * There are 2 IDFs, the second one holds the keys (0x0201 and 0x0202) to the thumbnail
3182 	 */
3183 	if ((dir_start+2+12*de + 4) >= (offset_base+IFDlength)) {
3184 		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size");
3185 		return FALSE;
3186 	}
3187 	NextDirOffset = php_ifd_get32u(dir_start+2+12*de, ImageInfo->motorola_intel);
3188 	if (NextDirOffset) {
3189 		/* the next line seems false but here IFDlength means length of all IFDs */
3190 		if (offset_base + NextDirOffset < offset_base || offset_base + NextDirOffset > offset_base+IFDlength) {
3191 			exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD offset");
3192 			return FALSE;
3193 		}
3194 		/* That is the IFD for the first thumbnail */
3195 #ifdef EXIF_DEBUG
3196 		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Expect next IFD to be thumbnail");
3197 #endif
3198 		if (exif_process_IFD_in_JPEG(ImageInfo, offset_base + NextDirOffset, offset_base, IFDlength, displacement, SECTION_THUMBNAIL)) {
3199 #ifdef EXIF_DEBUG
3200 			exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Thumbnail size: 0x%04X", ImageInfo->Thumbnail.size);
3201 #endif
3202 			if (ImageInfo->Thumbnail.filetype != IMAGE_FILETYPE_UNKNOWN
3203 			&&  ImageInfo->Thumbnail.size
3204 			&&  ImageInfo->Thumbnail.offset
3205 			&&  ImageInfo->read_thumbnail
3206 			) {
3207 				exif_thumbnail_extract(ImageInfo, offset_base, IFDlength);
3208 			}
3209 			return TRUE;
3210 		} else {
3211 			return FALSE;
3212 		}
3213 	}
3214 	return TRUE;
3215 }
3216 /* }}} */
3217 
3218 /* {{{ exif_process_TIFF_in_JPEG
3219    Process a TIFF header in a JPEG file
3220 */
exif_process_TIFF_in_JPEG(image_info_type * ImageInfo,char * CharBuf,size_t length,size_t displacement)3221 static void exif_process_TIFF_in_JPEG(image_info_type *ImageInfo, char *CharBuf, size_t length, size_t displacement)
3222 {
3223 	unsigned exif_value_2a, offset_of_ifd;
3224 
3225 	/* set the thumbnail stuff to nothing so we can test to see if they get set up */
3226 	if (memcmp(CharBuf, "II", 2) == 0) {
3227 		ImageInfo->motorola_intel = 0;
3228 	} else if (memcmp(CharBuf, "MM", 2) == 0) {
3229 		ImageInfo->motorola_intel = 1;
3230 	} else {
3231 		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid TIFF alignment marker");
3232 		return;
3233 	}
3234 
3235 	/* Check the next two values for correctness. */
3236 	if (length < 8) {
3237 		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid TIFF start (1)");
3238 		return;
3239 	}
3240 	exif_value_2a = php_ifd_get16u(CharBuf+2, ImageInfo->motorola_intel);
3241 	offset_of_ifd = php_ifd_get32u(CharBuf+4, ImageInfo->motorola_intel);
3242 	if (exif_value_2a != 0x2a || offset_of_ifd < 0x08) {
3243 		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid TIFF start (1)");
3244 		return;
3245 	}
3246 	if (offset_of_ifd > length) {
3247 		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid IFD start");
3248 		return;
3249 	}
3250 
3251 	ImageInfo->sections_found |= FOUND_IFD0;
3252 	/* First directory starts at offset 8. Offsets starts at 0. */
3253 	exif_process_IFD_in_JPEG(ImageInfo, CharBuf+offset_of_ifd, CharBuf, length/*-14*/, displacement, SECTION_IFD0);
3254 
3255 #ifdef EXIF_DEBUG
3256 	exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Process TIFF in JPEG done");
3257 #endif
3258 
3259 	/* Compute the CCD width, in milimeters. */
3260 	if (ImageInfo->FocalplaneXRes != 0) {
3261 		ImageInfo->CCDWidth = (float)(ImageInfo->ExifImageWidth * ImageInfo->FocalplaneUnits / ImageInfo->FocalplaneXRes);
3262 	}
3263 }
3264 /* }}} */
3265 
3266 /* {{{ exif_process_APP1
3267    Process an JPEG APP1 block marker
3268    Describes all the drivel that most digital cameras include...
3269 */
exif_process_APP1(image_info_type * ImageInfo,char * CharBuf,size_t length,size_t displacement)3270 static void exif_process_APP1(image_info_type *ImageInfo, char *CharBuf, size_t length, size_t displacement)
3271 {
3272 	/* Check the APP1 for Exif Identifier Code */
3273 	static const uchar ExifHeader[] = {0x45, 0x78, 0x69, 0x66, 0x00, 0x00};
3274 	if (length <= 8 || memcmp(CharBuf+2, ExifHeader, 6)) {
3275 		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Incorrect APP1 Exif Identifier Code");
3276 		return;
3277 	}
3278 	exif_process_TIFF_in_JPEG(ImageInfo, CharBuf + 8, length - 8, displacement+8);
3279 #ifdef EXIF_DEBUG
3280 	exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Process APP1/EXIF done");
3281 #endif
3282 }
3283 /* }}} */
3284 
3285 /* {{{ exif_process_APP12
3286    Process an JPEG APP12 block marker used by OLYMPUS
3287 */
exif_process_APP12(image_info_type * ImageInfo,char * buffer,size_t length)3288 static void exif_process_APP12(image_info_type *ImageInfo, char *buffer, size_t length)
3289 {
3290 	size_t l1, l2=0;
3291 
3292 	if ((l1 = php_strnlen(buffer+2, length-2)) > 0) {
3293 		exif_iif_add_tag(ImageInfo, SECTION_APP12, "Company", TAG_NONE, TAG_FMT_STRING, l1, buffer+2);
3294 		if (length > 2+l1+1) {
3295 			l2 = php_strnlen(buffer+2+l1+1, length-2-l1-1);
3296 			exif_iif_add_tag(ImageInfo, SECTION_APP12, "Info", TAG_NONE, TAG_FMT_STRING, l2, buffer+2+l1+1);
3297 		}
3298 	}
3299 #ifdef EXIF_DEBUG
3300 	exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Process section APP12 with l1=%d, l2=%d done", l1, l2);
3301 #endif
3302 }
3303 /* }}} */
3304 
3305 /* {{{ exif_scan_JPEG_header
3306  * Parse the marker stream until SOS or EOI is seen; */
exif_scan_JPEG_header(image_info_type * ImageInfo)3307 static int exif_scan_JPEG_header(image_info_type *ImageInfo)
3308 {
3309 	int section, sn;
3310 	int marker = 0, last_marker = M_PSEUDO, comment_correction=1;
3311 	unsigned int ll, lh;
3312 	uchar *Data;
3313 	size_t fpos, size, got, itemlen;
3314 	jpeg_sof_info  sof_info;
3315 
3316 	for(section=0;;section++) {
3317 #ifdef EXIF_DEBUG
3318 		fpos = php_stream_tell(ImageInfo->infile);
3319 		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Needing section %d @ 0x%08X", ImageInfo->file.count, fpos);
3320 #endif
3321 
3322 		/* get marker byte, swallowing possible padding                           */
3323 		/* some software does not count the length bytes of COM section           */
3324 		/* one company doing so is very much envolved in JPEG... so we accept too */
3325 		if (last_marker==M_COM && comment_correction) {
3326 			comment_correction = 2;
3327 		}
3328 		do {
3329 			if ((marker = php_stream_getc(ImageInfo->infile)) == EOF) {
3330 				EXIF_ERRLOG_CORRUPT(ImageInfo)
3331 				return FALSE;
3332 			}
3333 			if (last_marker==M_COM && comment_correction>0) {
3334 				if (marker!=0xFF) {
3335 					marker = 0xff;
3336 					comment_correction--;
3337 				} else  {
3338 					last_marker = M_PSEUDO; /* stop skipping 0 for M_COM */
3339 				}
3340 			}
3341 		} while (marker == 0xff);
3342 		if (last_marker==M_COM && !comment_correction) {
3343 			exif_error_docref("exif_read_data#error_mcom" EXIFERR_CC, ImageInfo, E_NOTICE, "Image has corrupt COM section: some software set wrong length information");
3344 		}
3345 		if (last_marker==M_COM && comment_correction)
3346 			return M_EOI; /* ah illegal: char after COM section not 0xFF */
3347 
3348 		fpos = php_stream_tell(ImageInfo->infile);
3349 
3350 		if (marker == 0xff) {
3351 			/* 0xff is legal padding, but if we get that many, something's wrong. */
3352 			exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "To many padding bytes");
3353 			return FALSE;
3354 		}
3355 
3356 		/* Read the length of the section. */
3357 		if ((lh = php_stream_getc(ImageInfo->infile)) == EOF) {
3358 			EXIF_ERRLOG_CORRUPT(ImageInfo)
3359 			return FALSE;
3360 		}
3361 		if ((ll = php_stream_getc(ImageInfo->infile)) == EOF) {
3362 			EXIF_ERRLOG_CORRUPT(ImageInfo)
3363 			return FALSE;
3364 		}
3365 
3366 		itemlen = (lh << 8) | ll;
3367 
3368 		if (itemlen < 2) {
3369 #ifdef EXIF_DEBUG
3370 			exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "%s, Section length: 0x%02X%02X", EXIF_ERROR_CORRUPT, lh, ll);
3371 #else
3372 			EXIF_ERRLOG_CORRUPT(ImageInfo)
3373 #endif
3374 			return FALSE;
3375 		}
3376 
3377 		sn = exif_file_sections_add(ImageInfo, marker, itemlen+1, NULL);
3378 		Data = ImageInfo->file.list[sn].data;
3379 
3380 		/* Store first two pre-read bytes. */
3381 		Data[0] = (uchar)lh;
3382 		Data[1] = (uchar)ll;
3383 
3384 		got = php_stream_read(ImageInfo->infile, (char*)(Data+2), itemlen-2); /* Read the whole section. */
3385 		if (got != itemlen-2) {
3386 			exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Error reading from file: got=x%04X(=%d) != itemlen-2=x%04X(=%d)", got, got, itemlen-2, itemlen-2);
3387 			return FALSE;
3388 		}
3389 
3390 #ifdef EXIF_DEBUG
3391 		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Process section(x%02X=%s) @ x%04X + x%04X(=%d)", marker, exif_get_markername(marker), fpos, itemlen, itemlen);
3392 #endif
3393 		switch(marker) {
3394 			case M_SOS:   /* stop before hitting compressed data  */
3395 				/* If reading entire image is requested, read the rest of the data. */
3396 				if (ImageInfo->read_all) {
3397 					/* Determine how much file is left. */
3398 					fpos = php_stream_tell(ImageInfo->infile);
3399 					size = ImageInfo->FileSize - fpos;
3400 					sn = exif_file_sections_add(ImageInfo, M_PSEUDO, size, NULL);
3401 					Data = ImageInfo->file.list[sn].data;
3402 					got = php_stream_read(ImageInfo->infile, (char*)Data, size);
3403 					if (got != size) {
3404 						EXIF_ERRLOG_FILEEOF(ImageInfo)
3405 						return FALSE;
3406 					}
3407 				}
3408 				return TRUE;
3409 
3410 			case M_EOI:   /* in case it's a tables-only JPEG stream */
3411 				exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "No image in jpeg!");
3412 				return (ImageInfo->sections_found&(~FOUND_COMPUTED)) ? TRUE : FALSE;
3413 
3414 			case M_COM: /* Comment section */
3415 				exif_process_COM(ImageInfo, (char *)Data, itemlen);
3416 				break;
3417 
3418 			case M_EXIF:
3419 				if (!(ImageInfo->sections_found&FOUND_IFD0)) {
3420 					/*ImageInfo->sections_found |= FOUND_EXIF;*/
3421 					/* Seen files from some 'U-lead' software with Vivitar scanner
3422 					   that uses marker 31 later in the file (no clue what for!) */
3423 					exif_process_APP1(ImageInfo, (char *)Data, itemlen, fpos);
3424 				}
3425 				break;
3426 
3427 			case M_APP12:
3428 				exif_process_APP12(ImageInfo, (char *)Data, itemlen);
3429 				break;
3430 
3431 
3432 			case M_SOF0:
3433 			case M_SOF1:
3434 			case M_SOF2:
3435 			case M_SOF3:
3436 			case M_SOF5:
3437 			case M_SOF6:
3438 			case M_SOF7:
3439 			case M_SOF9:
3440 			case M_SOF10:
3441 			case M_SOF11:
3442 			case M_SOF13:
3443 			case M_SOF14:
3444 			case M_SOF15:
3445 				if ((itemlen - 2) < 6) {
3446 					return FALSE;
3447 				}
3448 
3449 				exif_process_SOFn(Data, marker, &sof_info);
3450 				ImageInfo->Width  = sof_info.width;
3451 				ImageInfo->Height = sof_info.height;
3452 				if (sof_info.num_components == 3) {
3453 					ImageInfo->IsColor = 1;
3454 				} else {
3455 					ImageInfo->IsColor = 0;
3456 				}
3457 				break;
3458 			default:
3459 				/* skip any other marker silently. */
3460 				break;
3461 		}
3462 
3463 		/* keep track of last marker */
3464 		last_marker = marker;
3465 	}
3466 #ifdef EXIF_DEBUG
3467 	exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Done");
3468 #endif
3469 	return TRUE;
3470 }
3471 /* }}} */
3472 
3473 /* {{{ exif_scan_thumbnail
3474  * scan JPEG in thumbnail (memory) */
exif_scan_thumbnail(image_info_type * ImageInfo)3475 static int exif_scan_thumbnail(image_info_type *ImageInfo)
3476 {
3477 	uchar           c, *data = (uchar*)ImageInfo->Thumbnail.data;
3478 	int             n, marker;
3479 	size_t          length=2, pos=0;
3480 	jpeg_sof_info   sof_info;
3481 
3482 	if (!data) {
3483 		return FALSE; /* nothing to do here */
3484 	}
3485 	if (memcmp(data, "\xFF\xD8\xFF", 3)) {
3486 		if (!ImageInfo->Thumbnail.width && !ImageInfo->Thumbnail.height) {
3487 			exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Thumbnail is not a JPEG image");
3488 		}
3489 		return FALSE;
3490 	}
3491 	for (;;) {
3492 		pos += length;
3493 		if (pos>=ImageInfo->Thumbnail.size)
3494 			return FALSE;
3495 		c = data[pos++];
3496 		if (pos>=ImageInfo->Thumbnail.size)
3497 			return FALSE;
3498 		if (c != 0xFF) {
3499 			return FALSE;
3500 		}
3501 		n = 8;
3502 		while ((c = data[pos++]) == 0xFF && n--) {
3503 			if (pos+3>=ImageInfo->Thumbnail.size)
3504 				return FALSE;
3505 			/* +3 = pos++ of next check when reaching marker + 2 bytes for length */
3506 		}
3507 		if (c == 0xFF)
3508 			return FALSE;
3509 		marker = c;
3510 		length = php_jpg_get16(data+pos);
3511 		if (pos+length>=ImageInfo->Thumbnail.size) {
3512 			return FALSE;
3513 		}
3514 #ifdef EXIF_DEBUG
3515 		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Thumbnail: process section(x%02X=%s) @ x%04X + x%04X", marker, exif_get_markername(marker), pos, length);
3516 #endif
3517 		switch (marker) {
3518 			case M_SOF0:
3519 			case M_SOF1:
3520 			case M_SOF2:
3521 			case M_SOF3:
3522 			case M_SOF5:
3523 			case M_SOF6:
3524 			case M_SOF7:
3525 			case M_SOF9:
3526 			case M_SOF10:
3527 			case M_SOF11:
3528 			case M_SOF13:
3529 			case M_SOF14:
3530 			case M_SOF15:
3531 				/* handle SOFn block */
3532 				exif_process_SOFn(data+pos, marker, &sof_info);
3533 				ImageInfo->Thumbnail.height   = sof_info.height;
3534 				ImageInfo->Thumbnail.width    = sof_info.width;
3535 #ifdef EXIF_DEBUG
3536 				exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Thumbnail: size: %d * %d", sof_info.width, sof_info.height);
3537 #endif
3538 				return TRUE;
3539 
3540 			case M_SOS:
3541 			case M_EOI:
3542 				exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Could not compute size of thumbnail");
3543 				return FALSE;
3544 				break;
3545 
3546 			default:
3547 				/* just skip */
3548 				break;
3549 		}
3550 	}
3551 
3552 	exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Could not compute size of thumbnail");
3553 	return FALSE;
3554 }
3555 /* }}} */
3556 
3557 /* {{{ exif_process_IFD_in_TIFF
3558  * Parse the TIFF header; */
exif_process_IFD_in_TIFF(image_info_type * ImageInfo,size_t dir_offset,int section_index)3559 static int exif_process_IFD_in_TIFF(image_info_type *ImageInfo, size_t dir_offset, int section_index)
3560 {
3561 	int i, sn, num_entries, sub_section_index = 0;
3562 	unsigned char *dir_entry;
3563 	char tagname[64];
3564 	size_t ifd_size, dir_size, entry_offset, next_offset, entry_length, entry_value=0, fgot;
3565 	int entry_tag , entry_type;
3566 	tag_table_type tag_table = exif_get_tag_table(section_index);
3567 
3568 	if (ImageInfo->ifd_nesting_level > MAX_IFD_NESTING_LEVEL) {
3569                 return FALSE;
3570         }
3571 
3572 	if (ImageInfo->FileSize >= dir_offset+2) {
3573 		sn = exif_file_sections_add(ImageInfo, M_PSEUDO, 2, NULL);
3574 #ifdef EXIF_DEBUG
3575 		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read from TIFF: filesize(x%04X), IFD dir(x%04X + x%04X)", ImageInfo->FileSize, dir_offset, 2);
3576 #endif
3577 		php_stream_seek(ImageInfo->infile, dir_offset, SEEK_SET); /* we do not know the order of sections */
3578 		php_stream_read(ImageInfo->infile, (char*)ImageInfo->file.list[sn].data, 2);
3579 		num_entries = php_ifd_get16u(ImageInfo->file.list[sn].data, ImageInfo->motorola_intel);
3580 		dir_size = 2/*num dir entries*/ +12/*length of entry*/*num_entries +4/* offset to next ifd (points to thumbnail or NULL)*/;
3581 		if (ImageInfo->FileSize >= dir_offset+dir_size) {
3582 #ifdef EXIF_DEBUG
3583 			exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read from TIFF: filesize(x%04X), IFD dir(x%04X + x%04X), IFD entries(%d)", ImageInfo->FileSize, dir_offset+2, dir_size-2, num_entries);
3584 #endif
3585 			if (exif_file_sections_realloc(ImageInfo, sn, dir_size)) {
3586 				return FALSE;
3587 			}
3588 			php_stream_read(ImageInfo->infile, (char*)(ImageInfo->file.list[sn].data+2), dir_size-2);
3589 			/*exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Dump: %s", exif_char_dump(ImageInfo->file.list[sn].data, dir_size, 0));*/
3590 			next_offset = php_ifd_get32u(ImageInfo->file.list[sn].data + dir_size - 4, ImageInfo->motorola_intel);
3591 #ifdef EXIF_DEBUG
3592 			exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read from TIFF done, next offset x%04X", next_offset);
3593 #endif
3594 			/* now we have the directory we can look how long it should be */
3595 			ifd_size = dir_size;
3596 			for(i=0;i<num_entries;i++) {
3597 				dir_entry 	 = ImageInfo->file.list[sn].data+2+i*12;
3598 				entry_tag    = php_ifd_get16u(dir_entry+0, ImageInfo->motorola_intel);
3599 				entry_type   = php_ifd_get16u(dir_entry+2, ImageInfo->motorola_intel);
3600 				if (entry_type > NUM_FORMATS) {
3601 					exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read from TIFF: tag(0x%04X,%12s): Illegal format code 0x%04X, switching to BYTE", entry_tag, exif_get_tagname(entry_tag, tagname, -12, tag_table), entry_type);
3602 					/* Since this is repeated in exif_process_IFD_TAG make it a notice here */
3603 					/* and make it a warning in the exif_process_IFD_TAG which is called    */
3604 					/* elsewhere. */
3605 					entry_type = TAG_FMT_BYTE;
3606 					/*The next line would break the image on writeback: */
3607 					/* php_ifd_set16u(dir_entry+2, entry_type, ImageInfo->motorola_intel);*/
3608 				}
3609 				entry_length = php_ifd_get32u(dir_entry+4, ImageInfo->motorola_intel) * php_tiff_bytes_per_format[entry_type];
3610 				if (entry_length <= 4) {
3611 					switch(entry_type) {
3612 						case TAG_FMT_USHORT:
3613 							entry_value  = php_ifd_get16u(dir_entry+8, ImageInfo->motorola_intel);
3614 							break;
3615 						case TAG_FMT_SSHORT:
3616 							entry_value  = php_ifd_get16s(dir_entry+8, ImageInfo->motorola_intel);
3617 							break;
3618 						case TAG_FMT_ULONG:
3619 							entry_value  = php_ifd_get32u(dir_entry+8, ImageInfo->motorola_intel);
3620 							break;
3621 						case TAG_FMT_SLONG:
3622 							entry_value  = php_ifd_get32s(dir_entry+8, ImageInfo->motorola_intel);
3623 							break;
3624 					}
3625 					switch(entry_tag) {
3626 						case TAG_IMAGEWIDTH:
3627 						case TAG_COMP_IMAGE_WIDTH:
3628 							ImageInfo->Width  = entry_value;
3629 							break;
3630 						case TAG_IMAGEHEIGHT:
3631 						case TAG_COMP_IMAGE_HEIGHT:
3632 							ImageInfo->Height = entry_value;
3633 							break;
3634 						case TAG_PHOTOMETRIC_INTERPRETATION:
3635 							switch (entry_value) {
3636 								case PMI_BLACK_IS_ZERO:
3637 								case PMI_WHITE_IS_ZERO:
3638 								case PMI_TRANSPARENCY_MASK:
3639 									ImageInfo->IsColor = 0;
3640 									break;
3641 								case PMI_RGB:
3642 								case PMI_PALETTE_COLOR:
3643 								case PMI_SEPARATED:
3644 								case PMI_YCBCR:
3645 								case PMI_CIELAB:
3646 									ImageInfo->IsColor = 1;
3647 									break;
3648 							}
3649 							break;
3650 					}
3651 				} else {
3652 					entry_offset = php_ifd_get32u(dir_entry+8, ImageInfo->motorola_intel);
3653 					/* if entry needs expading ifd cache and entry is at end of current ifd cache. */
3654 					/* otherwise there may be huge holes between two entries */
3655 					if (entry_offset + entry_length > dir_offset + ifd_size
3656 					  && entry_offset == dir_offset + ifd_size) {
3657 						ifd_size = entry_offset + entry_length - dir_offset;
3658 #ifdef EXIF_DEBUG
3659 						exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Resize struct: x%04X + x%04X - x%04X = x%04X", entry_offset, entry_length, dir_offset, ifd_size);
3660 #endif
3661 					}
3662 				}
3663 			}
3664 			if (ImageInfo->FileSize >= dir_offset + ImageInfo->file.list[sn].size) {
3665 				if (ifd_size > dir_size) {
3666 					if (dir_offset + ifd_size > ImageInfo->FileSize) {
3667 						exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Error in TIFF: filesize(x%04X) less than size of IFD(x%04X + x%04X)", ImageInfo->FileSize, dir_offset, ifd_size);
3668 						return FALSE;
3669 					}
3670 					if (exif_file_sections_realloc(ImageInfo, sn, ifd_size)) {
3671 						return FALSE;
3672 					}
3673 					/* read values not stored in directory itself */
3674 #ifdef EXIF_DEBUG
3675 					exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read from TIFF: filesize(x%04X), IFD(x%04X + x%04X)", ImageInfo->FileSize, dir_offset, ifd_size);
3676 #endif
3677 					php_stream_read(ImageInfo->infile, (char*)(ImageInfo->file.list[sn].data+dir_size), ifd_size-dir_size);
3678 #ifdef EXIF_DEBUG
3679 					exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read from TIFF, done");
3680 #endif
3681 				}
3682 				/* now process the tags */
3683 				for(i=0;i<num_entries;i++) {
3684 					dir_entry 	 = ImageInfo->file.list[sn].data+2+i*12;
3685 					entry_tag    = php_ifd_get16u(dir_entry+0, ImageInfo->motorola_intel);
3686 					entry_type   = php_ifd_get16u(dir_entry+2, ImageInfo->motorola_intel);
3687 					/*entry_length = php_ifd_get32u(dir_entry+4, ImageInfo->motorola_intel);*/
3688 					if (entry_tag == TAG_EXIF_IFD_POINTER ||
3689 						entry_tag == TAG_INTEROP_IFD_POINTER ||
3690 						entry_tag == TAG_GPS_IFD_POINTER ||
3691 						entry_tag == TAG_SUB_IFD
3692 					) {
3693 						switch(entry_tag) {
3694 							case TAG_EXIF_IFD_POINTER:
3695 								ImageInfo->sections_found |= FOUND_EXIF;
3696 								sub_section_index = SECTION_EXIF;
3697 								break;
3698 							case TAG_GPS_IFD_POINTER:
3699 								ImageInfo->sections_found |= FOUND_GPS;
3700 								sub_section_index = SECTION_GPS;
3701 								break;
3702 							case TAG_INTEROP_IFD_POINTER:
3703 								ImageInfo->sections_found |= FOUND_INTEROP;
3704 								sub_section_index = SECTION_INTEROP;
3705 								break;
3706 							case TAG_SUB_IFD:
3707 								ImageInfo->sections_found |= FOUND_THUMBNAIL;
3708 								sub_section_index = SECTION_THUMBNAIL;
3709 								break;
3710 						}
3711 						entry_offset = php_ifd_get32u(dir_entry+8, ImageInfo->motorola_intel);
3712 #ifdef EXIF_DEBUG
3713 						exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Next IFD: %s @x%04X", exif_get_sectionname(sub_section_index), entry_offset);
3714 #endif
3715 						ImageInfo->ifd_nesting_level++;
3716 						exif_process_IFD_in_TIFF(ImageInfo, entry_offset, sub_section_index);
3717 						if (section_index!=SECTION_THUMBNAIL && entry_tag==TAG_SUB_IFD) {
3718 							if (ImageInfo->Thumbnail.filetype != IMAGE_FILETYPE_UNKNOWN
3719 							&&  ImageInfo->Thumbnail.size
3720 							&&  ImageInfo->Thumbnail.offset
3721 							&&  ImageInfo->read_thumbnail
3722 							) {
3723 #ifdef EXIF_DEBUG
3724 								exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "%s THUMBNAIL @0x%04X + 0x%04X", ImageInfo->Thumbnail.data ? "Ignore" : "Read", ImageInfo->Thumbnail.offset, ImageInfo->Thumbnail.size);
3725 #endif
3726 								if (!ImageInfo->Thumbnail.data) {
3727 									ImageInfo->Thumbnail.data = safe_emalloc(ImageInfo->Thumbnail.size, 1, 0);
3728 									php_stream_seek(ImageInfo->infile, ImageInfo->Thumbnail.offset, SEEK_SET);
3729 									fgot = php_stream_read(ImageInfo->infile, ImageInfo->Thumbnail.data, ImageInfo->Thumbnail.size);
3730 									if (fgot < ImageInfo->Thumbnail.size) {
3731 										EXIF_ERRLOG_THUMBEOF(ImageInfo)
3732 										efree(ImageInfo->Thumbnail.data);
3733 										ImageInfo->Thumbnail.data = NULL;
3734 									} else {
3735 										exif_thumbnail_build(ImageInfo);
3736 									}
3737 								}
3738 							}
3739 						}
3740 #ifdef EXIF_DEBUG
3741 						exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Next IFD: %s done", exif_get_sectionname(sub_section_index));
3742 #endif
3743 					} else {
3744 						if (!exif_process_IFD_TAG(ImageInfo, (char*)dir_entry,
3745 												  (char*)(ImageInfo->file.list[sn].data-dir_offset),
3746 												  ifd_size, 0, section_index, 0, tag_table)) {
3747 							return FALSE;
3748 						}
3749 					}
3750 				}
3751 				/* If we had a thumbnail in a SUB_IFD we have ANOTHER image in NEXT IFD */
3752 				if (next_offset && section_index != SECTION_THUMBNAIL) {
3753 					/* this should be a thumbnail IFD */
3754 					/* the thumbnail itself is stored at Tag=StripOffsets */
3755 #ifdef EXIF_DEBUG
3756 					exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read next IFD (THUMBNAIL) at x%04X", next_offset);
3757 #endif
3758 					ImageInfo->ifd_nesting_level++;
3759 					exif_process_IFD_in_TIFF(ImageInfo, next_offset, SECTION_THUMBNAIL);
3760 #ifdef EXIF_DEBUG
3761 					exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "%s THUMBNAIL @0x%04X + 0x%04X", ImageInfo->Thumbnail.data ? "Ignore" : "Read", ImageInfo->Thumbnail.offset, ImageInfo->Thumbnail.size);
3762 #endif
3763 					if (!ImageInfo->Thumbnail.data && ImageInfo->Thumbnail.offset && ImageInfo->Thumbnail.size && ImageInfo->read_thumbnail) {
3764 						ImageInfo->Thumbnail.data = safe_emalloc(ImageInfo->Thumbnail.size, 1, 0);
3765 						php_stream_seek(ImageInfo->infile, ImageInfo->Thumbnail.offset, SEEK_SET);
3766 						fgot = php_stream_read(ImageInfo->infile, ImageInfo->Thumbnail.data, ImageInfo->Thumbnail.size);
3767 						if (fgot < ImageInfo->Thumbnail.size) {
3768 							EXIF_ERRLOG_THUMBEOF(ImageInfo)
3769 							efree(ImageInfo->Thumbnail.data);
3770 							ImageInfo->Thumbnail.data = NULL;
3771 						} else {
3772 							exif_thumbnail_build(ImageInfo);
3773 						}
3774 					}
3775 #ifdef EXIF_DEBUG
3776 					exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read next IFD (THUMBNAIL) done");
3777 #endif
3778 				}
3779 				return TRUE;
3780 			} else {
3781 				exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Error in TIFF: filesize(x%04X) less than size of IFD(x%04X)", ImageInfo->FileSize, dir_offset+ImageInfo->file.list[sn].size);
3782 				return FALSE;
3783 			}
3784 		} else {
3785 			exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Error in TIFF: filesize(x%04X) less than size of IFD dir(x%04X)", ImageInfo->FileSize, dir_offset+dir_size);
3786 			return FALSE;
3787 		}
3788 	} else {
3789 		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Error in TIFF: filesize(x%04X) less than start of IFD dir(x%04X)", ImageInfo->FileSize, dir_offset+2);
3790 		return FALSE;
3791 	}
3792 }
3793 /* }}} */
3794 
3795 /* {{{ exif_scan_FILE_header
3796  * Parse the marker stream until SOS or EOI is seen; */
exif_scan_FILE_header(image_info_type * ImageInfo)3797 static int exif_scan_FILE_header(image_info_type *ImageInfo)
3798 {
3799 	unsigned char file_header[8];
3800 	int ret = FALSE;
3801 
3802 	ImageInfo->FileType = IMAGE_FILETYPE_UNKNOWN;
3803 
3804 	if (ImageInfo->FileSize >= 2) {
3805 		php_stream_seek(ImageInfo->infile, 0, SEEK_SET);
3806 		if (php_stream_read(ImageInfo->infile, (char*)file_header, 2) != 2) {
3807 			return FALSE;
3808 		}
3809 		if ((file_header[0]==0xff) && (file_header[1]==M_SOI)) {
3810 			ImageInfo->FileType = IMAGE_FILETYPE_JPEG;
3811 			if (exif_scan_JPEG_header(ImageInfo)) {
3812 				ret = TRUE;
3813 			} else {
3814 				exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid JPEG file");
3815 			}
3816 		} else if (ImageInfo->FileSize >= 8) {
3817 			if (php_stream_read(ImageInfo->infile, (char*)(file_header+2), 6) != 6) {
3818 				return FALSE;
3819 			}
3820 			if (!memcmp(file_header, "II\x2A\x00", 4)) {
3821 				ImageInfo->FileType = IMAGE_FILETYPE_TIFF_II;
3822 				ImageInfo->motorola_intel = 0;
3823 #ifdef EXIF_DEBUG
3824 				exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "File has TIFF/II format");
3825 #endif
3826 				ImageInfo->sections_found |= FOUND_IFD0;
3827 				if (exif_process_IFD_in_TIFF(ImageInfo,
3828 											 php_ifd_get32u(file_header + 4, ImageInfo->motorola_intel),
3829 											 SECTION_IFD0)) {
3830 					ret = TRUE;
3831 				} else {
3832 					exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid TIFF file");
3833 				}
3834 			} else if (!memcmp(file_header, "MM\x00\x2a", 4)) {
3835 				ImageInfo->FileType = IMAGE_FILETYPE_TIFF_MM;
3836 				ImageInfo->motorola_intel = 1;
3837 #ifdef EXIF_DEBUG
3838 				exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "File has TIFF/MM format");
3839 #endif
3840 				ImageInfo->sections_found |= FOUND_IFD0;
3841 				if (exif_process_IFD_in_TIFF(ImageInfo,
3842 											 php_ifd_get32u(file_header + 4, ImageInfo->motorola_intel),
3843 											 SECTION_IFD0)) {
3844 					ret = TRUE;
3845 				} else {
3846 					exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid TIFF file");
3847 				}
3848 			} else {
3849 				exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "File not supported");
3850 				return FALSE;
3851 			}
3852 		}
3853 	} else {
3854 		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "File too small (%d)", ImageInfo->FileSize);
3855 	}
3856 	return ret;
3857 }
3858 /* }}} */
3859 
3860 /* {{{ exif_discard_imageinfo
3861    Discard data scanned by exif_read_file.
3862 */
exif_discard_imageinfo(image_info_type * ImageInfo)3863 static int exif_discard_imageinfo(image_info_type *ImageInfo)
3864 {
3865 	int i;
3866 
3867 	EFREE_IF(ImageInfo->FileName);
3868 	EFREE_IF(ImageInfo->UserComment);
3869 	EFREE_IF(ImageInfo->UserCommentEncoding);
3870 	EFREE_IF(ImageInfo->Copyright);
3871 	EFREE_IF(ImageInfo->CopyrightPhotographer);
3872 	EFREE_IF(ImageInfo->CopyrightEditor);
3873 	EFREE_IF(ImageInfo->Thumbnail.data);
3874 	EFREE_IF(ImageInfo->encode_unicode);
3875 	EFREE_IF(ImageInfo->decode_unicode_be);
3876 	EFREE_IF(ImageInfo->decode_unicode_le);
3877 	EFREE_IF(ImageInfo->encode_jis);
3878 	EFREE_IF(ImageInfo->decode_jis_be);
3879 	EFREE_IF(ImageInfo->decode_jis_le);
3880 	EFREE_IF(ImageInfo->make);
3881 	EFREE_IF(ImageInfo->model);
3882 	for (i=0; i<ImageInfo->xp_fields.count; i++) {
3883 		EFREE_IF(ImageInfo->xp_fields.list[i].value);
3884 	}
3885 	EFREE_IF(ImageInfo->xp_fields.list);
3886 	for (i=0; i<SECTION_COUNT; i++) {
3887 		exif_iif_free(ImageInfo, i);
3888 	}
3889 	exif_file_sections_free(ImageInfo);
3890 	memset(ImageInfo, 0, sizeof(*ImageInfo));
3891 	return TRUE;
3892 }
3893 /* }}} */
3894 
3895 /* {{{ exif_read_file
3896  */
exif_read_file(image_info_type * ImageInfo,char * FileName,int read_thumbnail,int read_all)3897 static int exif_read_file(image_info_type *ImageInfo, char *FileName, int read_thumbnail, int read_all)
3898 {
3899 	int ret;
3900 	zend_stat_t st;
3901 	zend_string *base;
3902 
3903 	/* Start with an empty image information structure. */
3904 	memset(ImageInfo, 0, sizeof(*ImageInfo));
3905 
3906 	ImageInfo->motorola_intel = -1; /* flag as unknown */
3907 
3908 	ImageInfo->infile = php_stream_open_wrapper(FileName, "rb", STREAM_MUST_SEEK|IGNORE_PATH, NULL);
3909 	if (!ImageInfo->infile) {
3910 		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Unable to open file");
3911 		return FALSE;
3912 	}
3913 
3914 	if (php_stream_is(ImageInfo->infile, PHP_STREAM_IS_STDIO)) {
3915 		if (VCWD_STAT(FileName, &st) >= 0) {
3916 			if ((st.st_mode & S_IFMT) != S_IFREG) {
3917 				exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Not a file");
3918 				php_stream_close(ImageInfo->infile);
3919 				return FALSE;
3920 			}
3921 
3922 			/* Store file date/time. */
3923 			ImageInfo->FileDateTime = st.st_mtime;
3924 			ImageInfo->FileSize = st.st_size;
3925 			/*exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Opened stream is file: %d", ImageInfo->FileSize);*/
3926 		}
3927 	} else {
3928 		if (!ImageInfo->FileSize) {
3929 			php_stream_seek(ImageInfo->infile, 0, SEEK_END);
3930 			ImageInfo->FileSize = php_stream_tell(ImageInfo->infile);
3931 			php_stream_seek(ImageInfo->infile, 0, SEEK_SET);
3932 		}
3933 	}
3934 
3935 	base = php_basename(FileName, strlen(FileName), NULL, 0);
3936 	ImageInfo->FileName          = estrndup(ZSTR_VAL(base), ZSTR_LEN(base));
3937 	zend_string_release(base);
3938 	ImageInfo->read_thumbnail = read_thumbnail;
3939 	ImageInfo->read_all = read_all;
3940 	ImageInfo->Thumbnail.filetype = IMAGE_FILETYPE_UNKNOWN;
3941 
3942 	ImageInfo->encode_unicode    = estrdup(EXIF_G(encode_unicode));
3943 	ImageInfo->decode_unicode_be = estrdup(EXIF_G(decode_unicode_be));
3944 	ImageInfo->decode_unicode_le = estrdup(EXIF_G(decode_unicode_le));
3945 	ImageInfo->encode_jis        = estrdup(EXIF_G(encode_jis));
3946 	ImageInfo->decode_jis_be     = estrdup(EXIF_G(decode_jis_be));
3947 	ImageInfo->decode_jis_le     = estrdup(EXIF_G(decode_jis_le));
3948 
3949 
3950 	ImageInfo->ifd_nesting_level = 0;
3951 
3952 	/* Scan the JPEG headers. */
3953 	ret = exif_scan_FILE_header(ImageInfo);
3954 
3955 	php_stream_close(ImageInfo->infile);
3956 	return ret;
3957 }
3958 /* }}} */
3959 
3960 /* {{{ proto array exif_read_data(string filename [, string sections_needed [, bool sub_arrays[, bool read_thumbnail]]])
3961    Reads header data from the JPEG/TIFF image filename and optionally reads the internal thumbnails */
PHP_FUNCTION(exif_read_data)3962 PHP_FUNCTION(exif_read_data)
3963 {
3964 	char *p_name, *p_sections_needed = NULL;
3965 	size_t p_name_len, p_sections_needed_len = 0;
3966 	zend_bool sub_arrays=0, read_thumbnail=0, read_all=0;
3967 
3968 	int i, ret, sections_needed=0;
3969 	image_info_type ImageInfo;
3970 	char tmp[64], *sections_str, *s;
3971 
3972 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "p|sbb", &p_name, &p_name_len, &p_sections_needed, &p_sections_needed_len, &sub_arrays, &read_thumbnail) == FAILURE) {
3973 		return;
3974 	}
3975 
3976 	memset(&ImageInfo, 0, sizeof(ImageInfo));
3977 
3978 	if (p_sections_needed) {
3979 		spprintf(&sections_str, 0, ",%s,", p_sections_needed);
3980 		/* sections_str DOES start with , and SPACES are NOT allowed in names */
3981 		s = sections_str;
3982 		while (*++s) {
3983 			if (*s == ' ') {
3984 				*s = ',';
3985 			}
3986 		}
3987 
3988 		for (i = 0; i < SECTION_COUNT; i++) {
3989 			snprintf(tmp, sizeof(tmp), ",%s,", exif_get_sectionname(i));
3990 			if (strstr(sections_str, tmp)) {
3991 				sections_needed |= 1<<i;
3992 			}
3993 		}
3994 		EFREE_IF(sections_str);
3995 		/* now see what we need */
3996 #ifdef EXIF_DEBUG
3997 		sections_str = exif_get_sectionlist(sections_needed);
3998 		if (!sections_str) {
3999 			RETURN_FALSE;
4000 		}
4001 		exif_error_docref(NULL EXIFERR_CC, &ImageInfo, E_NOTICE, "Sections needed: %s", sections_str[0] ? sections_str : "None");
4002 		EFREE_IF(sections_str);
4003 #endif
4004 	}
4005 
4006 	ret = exif_read_file(&ImageInfo, p_name, read_thumbnail, read_all);
4007 	sections_str = exif_get_sectionlist(ImageInfo.sections_found);
4008 
4009 #ifdef EXIF_DEBUG
4010 	if (sections_str)
4011 		exif_error_docref(NULL EXIFERR_CC, &ImageInfo, E_NOTICE, "Sections found: %s", sections_str[0] ? sections_str : "None");
4012 #endif
4013 
4014 	ImageInfo.sections_found |= FOUND_COMPUTED|FOUND_FILE;/* do not inform about in debug*/
4015 
4016 	if (ret == FALSE || (sections_needed && !(sections_needed&ImageInfo.sections_found))) {
4017 		/* array_init must be checked at last! otherwise the array must be freed if a later test fails. */
4018 		exif_discard_imageinfo(&ImageInfo);
4019 	   	EFREE_IF(sections_str);
4020 		RETURN_FALSE;
4021 	}
4022 
4023 	array_init(return_value);
4024 
4025 #ifdef EXIF_DEBUG
4026 	exif_error_docref(NULL EXIFERR_CC, &ImageInfo, E_NOTICE, "Generate section FILE");
4027 #endif
4028 
4029 	/* now we can add our information */
4030 	exif_iif_add_str(&ImageInfo, SECTION_FILE, "FileName",      ImageInfo.FileName);
4031 	exif_iif_add_int(&ImageInfo, SECTION_FILE, "FileDateTime",  ImageInfo.FileDateTime);
4032 	exif_iif_add_int(&ImageInfo, SECTION_FILE, "FileSize",      ImageInfo.FileSize);
4033 	exif_iif_add_int(&ImageInfo, SECTION_FILE, "FileType",      ImageInfo.FileType);
4034 	exif_iif_add_str(&ImageInfo, SECTION_FILE, "MimeType",      (char*)php_image_type_to_mime_type(ImageInfo.FileType));
4035 	exif_iif_add_str(&ImageInfo, SECTION_FILE, "SectionsFound", sections_str ? sections_str : "NONE");
4036 
4037 #ifdef EXIF_DEBUG
4038 	exif_error_docref(NULL EXIFERR_CC, &ImageInfo, E_NOTICE, "Generate section COMPUTED");
4039 #endif
4040 
4041 	if (ImageInfo.Width>0 &&  ImageInfo.Height>0) {
4042 		exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "html"   , "width=\"%d\" height=\"%d\"", ImageInfo.Width, ImageInfo.Height);
4043 		exif_iif_add_int(&ImageInfo, SECTION_COMPUTED, "Height", ImageInfo.Height);
4044 		exif_iif_add_int(&ImageInfo, SECTION_COMPUTED, "Width",  ImageInfo.Width);
4045 	}
4046 	exif_iif_add_int(&ImageInfo, SECTION_COMPUTED, "IsColor", ImageInfo.IsColor);
4047 	if (ImageInfo.motorola_intel != -1) {
4048 		exif_iif_add_int(&ImageInfo, SECTION_COMPUTED, "ByteOrderMotorola", ImageInfo.motorola_intel);
4049 	}
4050 	if (ImageInfo.FocalLength) {
4051 		exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "FocalLength", "%4.1Fmm", ImageInfo.FocalLength);
4052 		if(ImageInfo.CCDWidth) {
4053 			exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "35mmFocalLength", "%dmm", (int)(ImageInfo.FocalLength/ImageInfo.CCDWidth*35+0.5));
4054 		}
4055 	}
4056 	if(ImageInfo.CCDWidth) {
4057 		exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "CCDWidth", "%dmm", (int)ImageInfo.CCDWidth);
4058 	}
4059 	if(ImageInfo.ExposureTime>0) {
4060 		if(ImageInfo.ExposureTime <= 0.5) {
4061 			exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "ExposureTime", "%0.3F s (1/%d)", ImageInfo.ExposureTime, (int)(0.5 + 1/ImageInfo.ExposureTime));
4062 		} else {
4063 			exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "ExposureTime", "%0.3F s", ImageInfo.ExposureTime);
4064 		}
4065 	}
4066 	if(ImageInfo.ApertureFNumber) {
4067 		exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "ApertureFNumber", "f/%.1F", ImageInfo.ApertureFNumber);
4068 	}
4069 	if(ImageInfo.Distance) {
4070 		if(ImageInfo.Distance<0) {
4071 			exif_iif_add_str(&ImageInfo, SECTION_COMPUTED, "FocusDistance", "Infinite");
4072 		} else {
4073 			exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "FocusDistance", "%0.2Fm", ImageInfo.Distance);
4074 		}
4075 	}
4076 	if (ImageInfo.UserComment) {
4077 		exif_iif_add_buffer(&ImageInfo, SECTION_COMPUTED, "UserComment", ImageInfo.UserCommentLength, ImageInfo.UserComment);
4078 		if (ImageInfo.UserCommentEncoding && strlen(ImageInfo.UserCommentEncoding)) {
4079 			exif_iif_add_str(&ImageInfo, SECTION_COMPUTED, "UserCommentEncoding", ImageInfo.UserCommentEncoding);
4080 		}
4081 	}
4082 
4083 	exif_iif_add_str(&ImageInfo, SECTION_COMPUTED, "Copyright",              ImageInfo.Copyright);
4084 	exif_iif_add_str(&ImageInfo, SECTION_COMPUTED, "Copyright.Photographer", ImageInfo.CopyrightPhotographer);
4085 	exif_iif_add_str(&ImageInfo, SECTION_COMPUTED, "Copyright.Editor",       ImageInfo.CopyrightEditor);
4086 
4087 	for (i=0; i<ImageInfo.xp_fields.count; i++) {
4088 		exif_iif_add_str(&ImageInfo, SECTION_WINXP, exif_get_tagname(ImageInfo.xp_fields.list[i].tag, NULL, 0, exif_get_tag_table(SECTION_WINXP)), ImageInfo.xp_fields.list[i].value);
4089 	}
4090 	if (ImageInfo.Thumbnail.size) {
4091 		if (read_thumbnail) {
4092 			/* not exif_iif_add_str : this is a buffer */
4093 			exif_iif_add_tag(&ImageInfo, SECTION_THUMBNAIL, "THUMBNAIL", TAG_NONE, TAG_FMT_UNDEFINED, ImageInfo.Thumbnail.size, ImageInfo.Thumbnail.data);
4094 		}
4095 		if (!ImageInfo.Thumbnail.width || !ImageInfo.Thumbnail.height) {
4096 			/* try to evaluate if thumbnail data is present */
4097 			exif_scan_thumbnail(&ImageInfo);
4098 		}
4099 		exif_iif_add_int(&ImageInfo, SECTION_COMPUTED, "Thumbnail.FileType", ImageInfo.Thumbnail.filetype);
4100 		exif_iif_add_str(&ImageInfo, SECTION_COMPUTED, "Thumbnail.MimeType", (char*)php_image_type_to_mime_type(ImageInfo.Thumbnail.filetype));
4101 	}
4102 	if (ImageInfo.Thumbnail.width && ImageInfo.Thumbnail.height) {
4103 		exif_iif_add_int(&ImageInfo, SECTION_COMPUTED, "Thumbnail.Height", ImageInfo.Thumbnail.height);
4104 		exif_iif_add_int(&ImageInfo, SECTION_COMPUTED, "Thumbnail.Width",  ImageInfo.Thumbnail.width);
4105 	}
4106    	EFREE_IF(sections_str);
4107 
4108 #ifdef EXIF_DEBUG
4109 	exif_error_docref(NULL EXIFERR_CC, &ImageInfo, E_NOTICE, "Adding image infos");
4110 #endif
4111 
4112 	add_assoc_image_info(return_value, sub_arrays, &ImageInfo, SECTION_FILE      );
4113 	add_assoc_image_info(return_value, 1,          &ImageInfo, SECTION_COMPUTED  );
4114 	add_assoc_image_info(return_value, sub_arrays, &ImageInfo, SECTION_ANY_TAG   );
4115 	add_assoc_image_info(return_value, sub_arrays, &ImageInfo, SECTION_IFD0      );
4116 	add_assoc_image_info(return_value, 1,          &ImageInfo, SECTION_THUMBNAIL );
4117 	add_assoc_image_info(return_value, 1,          &ImageInfo, SECTION_COMMENT   );
4118 	add_assoc_image_info(return_value, sub_arrays, &ImageInfo, SECTION_EXIF      );
4119 	add_assoc_image_info(return_value, sub_arrays, &ImageInfo, SECTION_GPS       );
4120 	add_assoc_image_info(return_value, sub_arrays, &ImageInfo, SECTION_INTEROP   );
4121 	add_assoc_image_info(return_value, sub_arrays, &ImageInfo, SECTION_FPIX      );
4122 	add_assoc_image_info(return_value, sub_arrays, &ImageInfo, SECTION_APP12     );
4123 	add_assoc_image_info(return_value, sub_arrays, &ImageInfo, SECTION_WINXP     );
4124 	add_assoc_image_info(return_value, sub_arrays, &ImageInfo, SECTION_MAKERNOTE );
4125 
4126 #ifdef EXIF_DEBUG
4127 	exif_error_docref(NULL EXIFERR_CC, &ImageInfo, E_NOTICE, "Discarding info");
4128 #endif
4129 
4130 	exif_discard_imageinfo(&ImageInfo);
4131 
4132 #ifdef EXIF_DEBUG
4133 	php_error_docref1(NULL, p_name, E_NOTICE, "done");
4134 #endif
4135 }
4136 /* }}} */
4137 
4138 /* {{{ proto string exif_thumbnail(string filename [, &width, &height [, &imagetype]])
4139    Reads the embedded thumbnail */
PHP_FUNCTION(exif_thumbnail)4140 PHP_FUNCTION(exif_thumbnail)
4141 {
4142 	zval *p_width = 0, *p_height = 0, *p_imagetype = 0;
4143 	char *p_name;
4144 	size_t p_name_len;
4145 	int ret, arg_c = ZEND_NUM_ARGS();
4146 	image_info_type ImageInfo;
4147 
4148 	memset(&ImageInfo, 0, sizeof(ImageInfo));
4149 
4150 	if (arg_c!=1 && arg_c!=3 && arg_c!=4) {
4151 		WRONG_PARAM_COUNT;
4152 	}
4153 
4154 	if (zend_parse_parameters(arg_c, "p|z/z/z/", &p_name, &p_name_len, &p_width, &p_height, &p_imagetype) == FAILURE) {
4155 		return;
4156 	}
4157 
4158 	ret = exif_read_file(&ImageInfo, p_name, 1, 0);
4159 	if (ret==FALSE) {
4160 		exif_discard_imageinfo(&ImageInfo);
4161 		RETURN_FALSE;
4162 	}
4163 
4164 #ifdef EXIF_DEBUG
4165 	exif_error_docref(NULL EXIFERR_CC, &ImageInfo, E_NOTICE, "Thumbnail data %d %d %d, %d x %d", ImageInfo.Thumbnail.data, ImageInfo.Thumbnail.size, ImageInfo.Thumbnail.filetype, ImageInfo.Thumbnail.width, ImageInfo.Thumbnail.height);
4166 #endif
4167 	if (!ImageInfo.Thumbnail.data || !ImageInfo.Thumbnail.size) {
4168 		exif_discard_imageinfo(&ImageInfo);
4169 		RETURN_FALSE;
4170 	}
4171 
4172 #ifdef EXIF_DEBUG
4173 	exif_error_docref(NULL EXIFERR_CC, &ImageInfo, E_NOTICE, "Returning thumbnail(%d)", ImageInfo.Thumbnail.size);
4174 #endif
4175 
4176 	ZVAL_STRINGL(return_value, ImageInfo.Thumbnail.data, ImageInfo.Thumbnail.size);
4177 	if (arg_c >= 3) {
4178 		if (!ImageInfo.Thumbnail.width || !ImageInfo.Thumbnail.height) {
4179 			exif_scan_thumbnail(&ImageInfo);
4180 		}
4181 		zval_dtor(p_width);
4182 		zval_dtor(p_height);
4183 		ZVAL_LONG(p_width,  ImageInfo.Thumbnail.width);
4184 		ZVAL_LONG(p_height, ImageInfo.Thumbnail.height);
4185 	}
4186 	if (arg_c >= 4)	{
4187 		zval_dtor(p_imagetype);
4188 		ZVAL_LONG(p_imagetype, ImageInfo.Thumbnail.filetype);
4189 	}
4190 
4191 #ifdef EXIF_DEBUG
4192 	exif_error_docref(NULL EXIFERR_CC, &ImageInfo, E_NOTICE, "Discarding info");
4193 #endif
4194 
4195 	exif_discard_imageinfo(&ImageInfo);
4196 
4197 #ifdef EXIF_DEBUG
4198 	php_error_docref1(NULL, p_name, E_NOTICE, "Done");
4199 #endif
4200 }
4201 /* }}} */
4202 
4203 /* {{{ proto int exif_imagetype(string imagefile)
4204    Get the type of an image */
PHP_FUNCTION(exif_imagetype)4205 PHP_FUNCTION(exif_imagetype)
4206 {
4207 	char *imagefile;
4208 	size_t imagefile_len;
4209 	php_stream * stream;
4210  	int itype = 0;
4211 
4212 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "p", &imagefile, &imagefile_len) == FAILURE) {
4213 		return;
4214 	}
4215 
4216 	stream = php_stream_open_wrapper(imagefile, "rb", IGNORE_PATH|REPORT_ERRORS, NULL);
4217 
4218 	if (stream == NULL) {
4219 		RETURN_FALSE;
4220 	}
4221 
4222 	itype = php_getimagetype(stream, NULL);
4223 
4224 	php_stream_close(stream);
4225 
4226 	if (itype == IMAGE_FILETYPE_UNKNOWN) {
4227 		RETURN_FALSE;
4228 	} else {
4229 		ZVAL_LONG(return_value, itype);
4230 	}
4231 }
4232 /* }}} */
4233 
4234 #endif
4235 
4236 /*
4237  * Local variables:
4238  * tab-width: 4
4239  * c-basic-offset: 4
4240  * End:
4241  * vim600: sw=4 ts=4 tw=78 fdm=marker
4242  * vim<600: sw=4 ts=4 tw=78
4243  */
4244