Files
Jungfraujoch/preview/JFJochTIFF.cpp
leonarski_fandClaude Opus 4.8 4b72a89249 harden untrusted-input size handling in TIFF read and raw-TCP frames
Two memory-safety/robustness fixes for input whose size is attacker- or
peer-controlled:

- ReadTIFF: a large IMAGELENGTH could overflow scanline_bytes * lines,
  undersizing the buffer that TIFFReadScanline then writes past. Guard the
  product against overflow before resize and reuse scanline_bytes in the loop.

- Raw-TCP image path: an uncapped header payload_size drove a huge resize()
  that took down the receive thread (wedging the writer-facing acceptor).
  Add JFJOCH_TCP_MAX_PAYLOAD_SIZE and reject oversized frames at the single
  receive-loop choke point on both the pusher and puller sides.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-11 11:34:11 +02:00

173 lines
7.2 KiB
C++

// SPDX-FileCopyrightText: 2024 Filip Leonarski, Paul Scherrer Institute <filip.leonarski@psi.ch>
// SPDX-License-Identifier: GPL-3.0-only
#include <tiffio.h>
#include <tiffio.hxx>
#include <cstdint>
#include <cstring>
#include <sstream>
#include "JFJochTIFF.h"
#include "../common/JFJochException.h"
void WriteTIFF(TIFF *tiff, const CompressedImage& image) {
if (tiff == nullptr)
throw JFJochException(JFJochExceptionCategory::TIFFGeneratorError, "TIFFStreamOpen error");
std::vector<uint8_t> buffer;
image.GetUncompressed(buffer);
TIFFSetField(tiff, TIFFTAG_IMAGEWIDTH, image.GetWidth()); // set the width of the image
TIFFSetField(tiff, TIFFTAG_IMAGELENGTH, image.GetHeight()); // set the height of the image
switch (image.GetMode()) {
case CompressedImageMode::RGB:
TIFFSetField(tiff, TIFFTAG_BITSPERSAMPLE, 8);
TIFFSetField(tiff, TIFFTAG_SAMPLESPERPIXEL, 3);
TIFFSetField(tiff, TIFFTAG_PHOTOMETRIC, PHOTOMETRIC_RGB);
TIFFSetField(tiff, TIFFTAG_SAMPLEFORMAT, SAMPLEFORMAT_UINT);
break;
case CompressedImageMode::Int8:
TIFFSetField(tiff, TIFFTAG_BITSPERSAMPLE, 8);
TIFFSetField(tiff, TIFFTAG_SAMPLESPERPIXEL, 1);
TIFFSetField(tiff, TIFFTAG_SAMPLEFORMAT, SAMPLEFORMAT_INT);
break;
case CompressedImageMode::Int16:
TIFFSetField(tiff, TIFFTAG_BITSPERSAMPLE, 16);
TIFFSetField(tiff, TIFFTAG_SAMPLESPERPIXEL, 1);
TIFFSetField(tiff, TIFFTAG_SAMPLEFORMAT, SAMPLEFORMAT_INT);
break;
case CompressedImageMode::Int32:
TIFFSetField(tiff, TIFFTAG_BITSPERSAMPLE, 32);
TIFFSetField(tiff, TIFFTAG_SAMPLESPERPIXEL, 1);
TIFFSetField(tiff, TIFFTAG_SAMPLEFORMAT, SAMPLEFORMAT_INT);
break;
case CompressedImageMode::Uint8:
TIFFSetField(tiff, TIFFTAG_BITSPERSAMPLE, 8);
TIFFSetField(tiff, TIFFTAG_SAMPLESPERPIXEL, 1);
TIFFSetField(tiff, TIFFTAG_SAMPLEFORMAT, SAMPLEFORMAT_UINT);
break;
case CompressedImageMode::Uint16:
TIFFSetField(tiff, TIFFTAG_BITSPERSAMPLE, 16);
TIFFSetField(tiff, TIFFTAG_SAMPLESPERPIXEL, 1);
TIFFSetField(tiff, TIFFTAG_SAMPLEFORMAT, SAMPLEFORMAT_UINT);
break;
case CompressedImageMode::Uint32:
TIFFSetField(tiff, TIFFTAG_BITSPERSAMPLE, 32);
TIFFSetField(tiff, TIFFTAG_SAMPLESPERPIXEL, 1);
TIFFSetField(tiff, TIFFTAG_SAMPLEFORMAT, SAMPLEFORMAT_UINT);
break;
case CompressedImageMode::Float16:
TIFFSetField(tiff, TIFFTAG_BITSPERSAMPLE, 16);
TIFFSetField(tiff, TIFFTAG_SAMPLEFORMAT, SAMPLEFORMAT_IEEEFP); // Float format
TIFFSetField(tiff, TIFFTAG_SAMPLESPERPIXEL, 1);
break;
case CompressedImageMode::Float32:
TIFFSetField(tiff, TIFFTAG_BITSPERSAMPLE, 32);
TIFFSetField(tiff, TIFFTAG_SAMPLEFORMAT, SAMPLEFORMAT_IEEEFP); // Float format
TIFFSetField(tiff, TIFFTAG_SAMPLESPERPIXEL, 1);
break;
case CompressedImageMode::Float64:
TIFFSetField(tiff, TIFFTAG_BITSPERSAMPLE, 64);
TIFFSetField(tiff, TIFFTAG_SAMPLEFORMAT, SAMPLEFORMAT_IEEEFP); // Float format
TIFFSetField(tiff, TIFFTAG_SAMPLESPERPIXEL, 1);
break;
}
TIFFSetField(tiff, TIFFTAG_PLANARCONFIG, PLANARCONFIG_CONTIG);
TIFFSetField(tiff, TIFFTAG_ORIENTATION, ORIENTATION_TOPLEFT);
TIFFSetField(tiff, TIFFTAG_COMPRESSION, COMPRESSION_NONE); // set compression to LZW
TIFFSetField(tiff, TIFFTAG_ROWSPERSTRIP, image.GetHeight());
if (TIFFWriteEncodedStrip(tiff, 0, buffer.data(), image.GetUncompressedSize()) < 0)
throw JFJochException(JFJochExceptionCategory::TIFFGeneratorError, "TIFFWriteEncodedStrip error");
}
std::string WriteTIFFToString(const CompressedImage& image) {
std::stringstream os;
TIFF *tiff = TIFFStreamOpen("x", (std::ostream *) &os);
WriteTIFF(tiff, image);
TIFFClose(tiff);
return os.str();
}
void WriteTIFFToFile(const std::string &filename, const CompressedImage& image) {
TIFF *tiff = TIFFOpen(filename.c_str(), "w");
WriteTIFF(tiff, image);
TIFFClose(tiff);
}
CompressedImage ReadTIFF(const std::string &s, std::vector<uint8_t> &buffer) {
if (s.empty())
throw JFJochException(JFJochExceptionCategory::TIFFGeneratorError, "No TIFF file provided");
uint32_t rows_per_string = 0;
uint16_t elem_size = 0;
uint16_t format = 0;
uint32_t cols = 0;
uint32_t lines = 0;
std::istringstream input_TIFF_stream(s);
TIFF* tiff = TIFFStreamOpen("MemTIFF", &input_TIFF_stream);
if (tiff == nullptr)
throw JFJochException(JFJochExceptionCategory::TIFFGeneratorError,"Not a proper TIFF file");
TIFFGetField(tiff, TIFFTAG_IMAGEWIDTH, &cols); // get the width of the image
TIFFGetField(tiff, TIFFTAG_IMAGELENGTH, &lines); // get the height of the image
TIFFGetField(tiff, TIFFTAG_BITSPERSAMPLE, &elem_size); // get the size of the channels
TIFFGetField(tiff, TIFFTAG_ROWSPERSTRIP, &rows_per_string);
TIFFGetField(tiff, TIFFTAG_SAMPLEFORMAT, &format);
if (elem_size % 8 != 0)
throw JFJochException(JFJochExceptionCategory::TIFFGeneratorError, "Only byte-aligned TIFF samples are supported");
const size_t elem_size_bytes = elem_size / 8;
if (cols == 0 || lines == 0 || elem_size_bytes == 0)
throw JFJochException(JFJochExceptionCategory::TIFFGeneratorError,"Size wrong");
const size_t scanline_bytes = static_cast<size_t>(cols) * elem_size_bytes;
if (scanline_bytes != TIFFScanlineSize(tiff))
throw JFJochException(JFJochExceptionCategory::TIFFGeneratorError, "TIFFScanlineSize mismatch");
// Guard the buffer size against overflow: a huge IMAGELENGTH could otherwise wrap
// scanline_bytes * lines to a small value, undersizing the buffer that TIFFReadScanline writes into.
if (lines > SIZE_MAX / scanline_bytes)
throw JFJochException(JFJochExceptionCategory::TIFFGeneratorError, "TIFF image too large");
buffer.resize(scanline_bytes * lines);
for (uint32_t i = 0; i < lines; i++) {
if (TIFFReadScanline(tiff, buffer.data() + static_cast<size_t>(i) * scanline_bytes, i, 0) < 0)
throw JFJochException(JFJochExceptionCategory::TIFFGeneratorError, "TIFFReadScanline error");
}
TIFFClose(tiff);
CompressedImageMode mode = CalcImageMode(elem_size_bytes, (format == SAMPLEFORMAT_IEEEFP), (format == SAMPLEFORMAT_INT));
return CompressedImage(buffer, cols, lines, mode);
}
std::vector<uint16_t> ReadTIFFFromString16(const std::string &s, uint32_t &cols, uint32_t &lines) {
std::vector<uint8_t> buffer;
CompressedImage image = ReadTIFF(s, buffer);
if (image.GetByteDepth() != sizeof(uint16_t) || image.GetNumChannels() != 1)
throw JFJochException(JFJochExceptionCategory::TIFFGeneratorError, "Only 16-bit format supported");
cols = image.GetWidth();
lines = image.GetHeight();
std::vector<uint16_t> ret(static_cast<size_t>(cols) * lines);
memcpy(ret.data(), buffer.data(), buffer.size());
return ret;
}
void SuppressTIFFErrors() {
TIFFSetErrorHandler(nullptr);
}