• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /* exif-data.c
2  *
3  * Copyright (c) 2001 Lutz Mueller <lutz@users.sourceforge.net>
4  *
5  * This library is free software; you can redistribute it and/or
6  * modify it under the terms of the GNU Lesser General Public
7  * License as published by the Free Software Foundation; either
8  * version 2 of the License, or (at your option) any later version.
9  *
10  * This library is distributed in the hope that it will be useful,
11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
13  * Lesser General Public License for more details.
14  *
15  * You should have received a copy of the GNU Lesser General Public
16  * License along with this library; if not, write to the
17  * Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
18  * Boston, MA  02110-1301  USA.
19  */
20 
21 #include <config.h>
22 
23 #include <libexif/exif-mnote-data.h>
24 #include <libexif/exif-data.h>
25 #include <libexif/exif-ifd.h>
26 #include <libexif/exif-mnote-data-priv.h>
27 #include <libexif/exif-utils.h>
28 #include <libexif/exif-loader.h>
29 #include <libexif/exif-log.h>
30 #include <libexif/i18n.h>
31 #include <libexif/exif-system.h>
32 
33 #include <libexif/apple/exif-mnote-data-apple.h>
34 #include <libexif/canon/exif-mnote-data-canon.h>
35 #include <libexif/fuji/exif-mnote-data-fuji.h>
36 #include <libexif/olympus/exif-mnote-data-olympus.h>
37 #include <libexif/pentax/exif-mnote-data-pentax.h>
38 #include <libexif/huawei/exif-mnote-data-huawei.h>
39 
40 #include <math.h>
41 #include <stdlib.h>
42 #include <stdio.h>
43 #include <string.h>
44 
45 #undef JPEG_MARKER_SOI
46 #define JPEG_MARKER_SOI  0xd8
47 #undef JPEG_MARKER_APP0
48 #define JPEG_MARKER_APP0 0xe0
49 #undef JPEG_MARKER_APP1
50 #define JPEG_MARKER_APP1 0xe1
51 #undef JPEG_HEADER_LEN
52 #define JPEG_HEADER_LEN 6
53 #define ENTRY_SIZE 12
54 
55 #define CHECKOVERFLOW(offset,datasize,structsize) (( offset >= datasize) || (structsize > datasize) || (offset > datasize - structsize ))
56 
57 static const unsigned char ExifHeader[] = {0x45, 0x78, 0x69, 0x66, 0x00, 0x00};
58 
59 struct _ExifDataPrivate
60 {
61 	ExifByteOrder order;
62 
63 	ExifMnoteData *md;
64 
65 	ExifLog *log;
66 	ExifMem *mem;
67 
68 	unsigned int ref_count;
69 
70 	/* Temporarily used while loading data */
71 	unsigned int offset_mnote;
72 
73 	ExifDataOption options;
74 	ExifDataType data_type;
75 };
76 
77 static void *
exif_data_alloc(ExifData * data,unsigned int i)78 exif_data_alloc (ExifData *data, unsigned int i)
79 {
80 	void *d;
81 
82 	if (!data || !i)
83 		return NULL;
84 
85 	d = exif_mem_alloc (data->priv->mem, i);
86 	if (d)
87 		return d;
88 
89 	EXIF_LOG_NO_MEMORY (data->priv->log, "ExifData", i);
90 	return NULL;
91 }
92 
93 ExifMnoteData *
exif_data_get_mnote_data(ExifData * d)94 exif_data_get_mnote_data (ExifData *d)
95 {
96 	return (d && d->priv) ? d->priv->md : NULL;
97 }
98 
99 ExifMem *
exif_data_get_priv_mem(ExifData * d)100 exif_data_get_priv_mem (ExifData *d)
101 {
102 	return (d && d->priv) ? d->priv->mem : NULL;
103 }
104 
105 void
exif_data_set_priv_md(ExifData * d,ExifMnoteData * md)106 exif_data_set_priv_md (ExifData *d, ExifMnoteData *md)
107 {
108 	if (d && d->priv) {
109 		d->priv->md = md;
110 	}
111 }
112 
113 ExifData *
exif_data_new(void)114 exif_data_new (void)
115 {
116 	ExifMem *mem = exif_mem_new_default ();
117 	ExifData *d = exif_data_new_mem (mem);
118 
119 	exif_mem_unref (mem);
120 
121 	return d;
122 }
123 
124 ExifData *
exif_data_new_mem(ExifMem * mem)125 exif_data_new_mem (ExifMem *mem)
126 {
127 	ExifData *data;
128 	unsigned int i;
129 
130 	if (!mem)
131 		return NULL;
132 
133 	data = exif_mem_alloc (mem, sizeof (ExifData));
134 	if (!data)
135 		return (NULL);
136 	data->priv = exif_mem_alloc (mem, sizeof (ExifDataPrivate));
137 	if (!data->priv) {
138 	  	exif_mem_free (mem, data);
139 		return (NULL);
140 	}
141 	data->priv->ref_count = 1;
142 
143 	data->priv->mem = mem;
144 	exif_mem_ref (mem);
145 
146 	for (i = 0; i < EXIF_IFD_COUNT; i++) {
147 		data->ifd[i] = exif_content_new_mem (data->priv->mem);
148 		if (!data->ifd[i]) {
149 			exif_data_free (data);
150 			return (NULL);
151 		}
152 		data->ifd[i]->parent = data;
153 	}
154 
155 	/* Default options */
156 #ifndef NO_VERBOSE_TAG_STRINGS
157 	/*
158 	 * When the tag list is compiled away, setting this option prevents
159 	 * any tags from being loaded
160 	 */
161 	exif_data_set_option (data, EXIF_DATA_OPTION_IGNORE_UNKNOWN_TAGS);
162 #endif
163 	exif_data_set_option (data, EXIF_DATA_OPTION_FOLLOW_SPECIFICATION);
164 
165 	/* Default data type: none */
166 	exif_data_set_data_type (data, EXIF_DATA_TYPE_COUNT);
167 
168 	return (data);
169 }
170 
171 ExifData *
exif_data_new_from_data(const unsigned char * data,unsigned int size)172 exif_data_new_from_data (const unsigned char *data, unsigned int size)
173 {
174 	ExifData *edata;
175 
176 	edata = exif_data_new ();
177 	exif_data_load_data (edata, data, size);
178 	return (edata);
179 }
180 
181 static int
exif_data_load_data_entry(ExifData * data,ExifEntry * entry,const unsigned char * d,unsigned int size,unsigned int offset)182 exif_data_load_data_entry (ExifData *data, ExifEntry *entry,
183 			   const unsigned char *d,
184 			   unsigned int size, unsigned int offset)
185 {
186 	unsigned int s, doff;
187 
188 	entry->tag        = exif_get_short (d + offset + 0, data->priv->order);
189 	entry->format     = exif_get_short (d + offset + 2, data->priv->order);
190 	entry->components = exif_get_long  (d + offset + 4, data->priv->order);
191 
192 	/* FIXME: should use exif_tag_get_name_in_ifd here but entry->parent
193 	 * has not been set yet
194 	 */
195 	exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
196 		  "Loading entry 0x%x ('%s')...", entry->tag,
197 		  exif_tag_get_name (entry->tag));
198 
199 	/* {0,1,2,4,8} x { 0x00000000 .. 0xffffffff }
200 	 *   -> { 0x000000000 .. 0x7fffffff8 } */
201 	s = exif_format_get_size(entry->format) * entry->components;
202 	if ((s < entry->components) || (s == 0)){
203 		return 0;
204 	}
205 
206 	/*
207 	 * Size? If bigger than 4 bytes, the actual data is not
208 	 * in the entry but somewhere else (offset).
209 	 */
210 	if (s > 4)
211 		doff = exif_get_long (d + offset + 8, data->priv->order);
212 	else
213 		doff = offset + 8;
214 
215 	/* Sanity checks */
216 	if (doff >= size) {
217 		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
218 				  "Tag starts past end of buffer (%u > %u)", doff, size);
219 		return 0;
220 	}
221 
222 	if (s > size - doff) {
223 		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
224 				  "Tag data goes past end of buffer (%u > %u)", doff+s, size);
225 		return 0;
226 	}
227 
228 	entry->data = exif_data_alloc (data, s);
229 	if (entry->data) {
230 		entry->size = s;
231 		memcpy (entry->data, d + doff, s);
232         entry->offset = doff;
233 	} else {
234 		EXIF_LOG_NO_MEMORY(data->priv->log, "ExifData", s);
235 		return 0;
236 	}
237 
238 	/* If this is the MakerNote, remember the offset */
239 	if (entry->tag == EXIF_TAG_MAKER_NOTE) {
240 		if (!entry->data) {
241 			exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
242 					  "MakerNote found with empty data");
243 		} else if (entry->size > 6) {
244 			exif_log (data->priv->log,
245 					       EXIF_LOG_CODE_DEBUG, "ExifData",
246 					       "MakerNote found (%02x %02x %02x %02x "
247 					       "%02x %02x %02x...).",
248 					       entry->data[0], entry->data[1], entry->data[2],
249 					       entry->data[3], entry->data[4], entry->data[5],
250 					       entry->data[6]);
251 		}
252 
253 		if (!data->priv->offset_mnote) {
254 			data->priv->offset_mnote = doff;
255 		}
256 		if (entry->data && (entry->size >= 8) &&
257 			!memcmp(entry->data, HUAWEI_HEADER, 8)) {
258 			data->priv->offset_mnote = doff;
259 		}
260 	}
261 	return 1;
262 }
263 
264 static void
exif_data_save_data_entry(ExifData * data,ExifEntry * e,unsigned char ** d,unsigned int * ds,unsigned int offset)265 exif_data_save_data_entry (ExifData *data, ExifEntry *e,
266 			   unsigned char **d, unsigned int *ds,
267 			   unsigned int offset)
268 {
269 	unsigned int doff, s;
270 	unsigned int ts;
271 
272 	if (!data || !data->priv)
273 		return;
274 
275 	/*
276 	 * Each entry is 12 bytes long. The memory for the entry has
277 	 * already been allocated.
278 	 */
279 	exif_set_short (*d + 6 + offset + 0,
280 			data->priv->order, (ExifShort) e->tag);
281 	exif_set_short (*d + 6 + offset + 2,
282 			data->priv->order, (ExifShort) e->format);
283 
284 	if (!(data->priv->options & EXIF_DATA_OPTION_DONT_CHANGE_MAKER_NOTE)) {
285 		/* If this is the maker note tag, update it. */
286 		if ((e->tag == EXIF_TAG_MAKER_NOTE) && data->priv->md) {
287 			if (is_huawei_md(data->priv->md) &&
288 				e->data && (e->size >= 8) &&
289 				!memcmp(e->data, HUAWEI_HEADER, 8)) {
290 					/* TODO: this is using the wrong ExifMem to free e->data */
291 					exif_mem_free (data->priv->mem, e->data);
292 					e->data = NULL;
293 					e->size = 0;
294 					exif_mnote_data_set_offset (data->priv->md, *ds - 6);
295 					exif_mnote_data_save (data->priv->md, &e->data, &e->size);
296 					e->components = e->size;
297 					if (exif_format_get_size (e->format) != 1) {
298 						/* e->format is taken from input code,
299 						* but we need to make sure it is a 1 byte
300 						* entity due to the multiplication below. */
301 						e->format = EXIF_FORMAT_UNDEFINED;
302 					}
303 				}
304 		}
305 	}
306 
307 	exif_set_long  (*d + 6 + offset + 4,
308 			data->priv->order, e->components);
309 
310 	/*
311 	 * Size? If bigger than 4 bytes, the actual data is not in
312 	 * the entry but somewhere else.
313 	 */
314 	s = exif_format_get_size (e->format) * e->components;
315 	if (s > 4) {
316 		unsigned char *t;
317 		doff = *ds - 6;
318 		ts = *ds + s;
319 
320 		/*
321 		 * According to the TIFF specification,
322 		 * the offset must be an even number. If we need to introduce
323 		 * a padding byte, we set it to 0.
324 		 */
325 		if (s & 1)
326 			ts++;
327 		t = exif_mem_realloc (data->priv->mem, *d, ts);
328 		if (!t) {
329 			EXIF_LOG_NO_MEMORY (data->priv->log, "ExifData", ts);
330 		  	return;
331 		}
332 		*d = t;
333 		*ds = ts;
334 		exif_set_long (*d + 6 + offset + 8, data->priv->order, doff);
335 		if (s & 1)
336 			*(*d + *ds - 1) = '\0';
337 
338 	} else
339 		doff = offset + 8;
340 
341 	/* Write the data. Fill unneeded bytes with 0. Do not crash with
342 	 * e->data is NULL */
343 	if (e->data) {
344 		unsigned int len = s;
345 		if (e->size < s) len = e->size;
346 		memcpy (*d + 6 + doff, e->data, len);
347 	} else {
348 		memset (*d + 6 + doff, 0, s);
349 	}
350 	if (s < 4)
351 		memset (*d + 6 + doff + s, 0, (4 - s));
352 }
353 
354 static void
exif_data_save_data_entry_general(ExifData * data,ExifEntry * e,unsigned char ** d,unsigned int * ds,unsigned int offset)355 exif_data_save_data_entry_general (ExifData *data, ExifEntry *e,
356 								   unsigned char **d, unsigned int *ds,
357 								   unsigned int offset)
358 {
359 	unsigned int doff, s;
360 	unsigned int ts;
361 
362 	if (!data || !data->priv)
363 		return;
364 
365 	/*
366 	 * Each entry is 12 bytes long. The memory for the entry has
367 	 * already been allocated.
368 	 */
369 	exif_set_short(*d + 6 - JPEG_HEADER_LEN + offset + 0,
370 		data->priv->order, (ExifShort)e->tag);
371 	exif_set_short(*d + 6 - JPEG_HEADER_LEN + offset + 2,
372 		data->priv->order, (ExifShort)e->format);
373 
374 	if (!(data->priv->options & EXIF_DATA_OPTION_DONT_CHANGE_MAKER_NOTE)) {
375 		/* If this is the maker note tag, update it. */
376 		if ((e->tag == EXIF_TAG_MAKER_NOTE) && data->priv->md) {
377 			if (is_huawei_md(data->priv->md) &&
378 				e->data && (e->size >= 8) &&
379 				!memcmp(e->data, HUAWEI_HEADER, 8)) {
380 					/* TODO: this is using the wrong ExifMem to free e->data */
381 					exif_mem_free(data->priv->mem, e->data);
382 					e->data = NULL;
383 					e->size = 0;
384 					exif_mnote_data_set_offset(data->priv->md, *ds - 6 + JPEG_HEADER_LEN);
385 					exif_mnote_data_save(data->priv->md, &e->data, &e->size);
386 					e->components = e->size;
387 					if (exif_format_get_size(e->format) != 1) {
388 						/* e->format is taken from input code,
389 						* but we need to make sure it is a 1 byte
390 						* entity due to the multiplication below. */
391 						e->format = EXIF_FORMAT_UNDEFINED;
392 					}
393 				}
394 		}
395 	}
396 
397 	exif_set_long(*d + 6 - JPEG_HEADER_LEN + offset + 4,
398 		data->priv->order, e->components);
399 
400 	/*
401 	 * Size? If bigger than 4 bytes, the actual data is not in
402 	 * the entry but somewhere else.
403 	 */
404 	s = exif_format_get_size(e->format) * e->components;
405 	if (s > 4) {
406 		unsigned char* t;
407 		doff = *ds - 6 + JPEG_HEADER_LEN;
408 		ts = *ds + s;
409 
410 		/*
411 		 * According to the TIFF specification,
412 		 * the offset must be an even number. If we need to introduce
413 		 * a padding byte, we set it to 0.
414 		 */
415 		if (s & 1)
416 			ts++;
417 		t = exif_mem_realloc(data->priv->mem, *d, ts);
418 		if (!t) {
419 			EXIF_LOG_NO_MEMORY(data->priv->log, "ExifData", ts);
420 			return;
421 		}
422 		*d = t;
423 		*ds = ts;
424 		exif_set_long(*d + 6 - JPEG_HEADER_LEN + offset + 8, data->priv->order, doff);
425 		if (s & 1)
426 			*(*d + *ds - 1) = '\0';
427 
428 	} else
429 		doff = offset + 8;
430 
431 	/* Write the data. Fill unneeded bytes with 0. Do not crash with
432 	 * e->data is NULL */
433 	if (e->data) {
434 		unsigned int len = s;
435 		if (e->size < s) len = e->size;
436         if (!d || !(*d) || CHECKOVERFLOW(6 - JPEG_HEADER_LEN + doff, *ds, len)) {
437             return;
438         }
439 		memcpy(*d + 6 - JPEG_HEADER_LEN + doff, e->data, len);
440 	} else {
441 		memset(*d + 6 - JPEG_HEADER_LEN + doff, 0, s);
442 	}
443 	if (s < 4)
444 		memset(*d + 6 - JPEG_HEADER_LEN + doff + s, 0, (4 - s));
445 }
446 
447 static void
exif_data_load_data_thumbnail(ExifData * data,const unsigned char * d,unsigned int ds,ExifLong o,ExifLong s)448 exif_data_load_data_thumbnail (ExifData *data, const unsigned char *d,
449 			       unsigned int ds, ExifLong o, ExifLong s)
450 {
451 	/* Sanity checks */
452 	if (o >= ds) {
453 		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", "Bogus thumbnail offset (%u).", o);
454 		return;
455 	}
456 	if (CHECKOVERFLOW(o,ds,s)) {
457 		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", "Bogus thumbnail size (%u), max would be %u.", s, ds-o);
458 		return;
459 	}
460 	if (data->data)
461 		exif_mem_free (data->priv->mem, data->data);
462 	if (!(data->data = exif_data_alloc (data, s))) {
463 		EXIF_LOG_NO_MEMORY (data->priv->log, "ExifData", s);
464 		data->size = 0;
465 		return;
466 	}
467 	data->size = s;
468 	memcpy (data->data, d + o, s);
469 }
470 
471 #undef CHECK_REC
472 #define CHECK_REC(i) 					\
473 if ((i) == ifd) {				\
474 	exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, \
475 		"ExifData", "Recursive entry in IFD "	\
476 		"'%s' detected. Skipping...",		\
477 		exif_ifd_get_name (i));			\
478 	break;						\
479 }							\
480 if (data->ifd[(i)]->count) {				\
481 	exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG,	\
482 		"ExifData", "Attempt to load IFD "	\
483 		"'%s' multiple times detected. "	\
484 		"Skipping...",				\
485 		exif_ifd_get_name (i));			\
486 	break;						\
487 }
488 
489 /*! Calculate the recursion cost added by one level of IFD loading.
490  *
491  * The work performed is related to the cost in the exponential relation
492  *   work=1.1**cost
493  */
494 static unsigned int
level_cost(unsigned int n)495 level_cost(unsigned int n)
496 {
497     static const double log_1_1 = 0.09531017980432493;
498 
499 	/* Adding 0.1 protects against the case where n==1 */
500 	return ceil(log(n + 0.1)/log_1_1);
501 }
502 
503 static void
load_thumbnail_entry(ExifData * data,ExifTag tag,ExifIfd ifd,const unsigned char * d,unsigned int ds,unsigned int offset,unsigned i)504 load_thumbnail_entry (ExifData *data, ExifTag tag, ExifIfd ifd,
505 					  const unsigned char *d,
506 					  unsigned int ds, unsigned int offset, unsigned i)
507 {
508 	/*
509 		* If we don't know the tag, don't fail. It could be that new
510 		* versions of the standard have defined additional tags. Note that
511 		* 0 is a valid tag in the GPS IFD.
512 		*/
513 	if (!exif_tag_get_name_in_ifd (tag, ifd)) {
514 
515 		/*
516 			* Special case: Tag and format 0. That's against specification
517 			* (at least up to 2.2). But Photoshop writes it anyways.
518 			*/
519 		if (!d || CHECKOVERFLOW(offset + 12 * i, ds, 4) ||
520             !memcmp (d + offset + 12 * i, "\0\0\0\0", 4)) {
521 			exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
522 					"Skipping empty entry at position %u in '%s'.", i,
523 					exif_ifd_get_name (ifd));
524 			return;
525 		}
526 		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
527 				"Unknown tag 0x%04x (entry %u in '%s'). Please report this tag "
528 				"to <libexif-devel@lists.sourceforge.net>.", tag, i,
529 				exif_ifd_get_name (ifd));
530 		if (data->priv->options & EXIF_DATA_OPTION_IGNORE_UNKNOWN_TAGS)
531 			return;
532 	}
533 	ExifEntry *entry = exif_entry_new_mem (data->priv->mem);
534 	if (!entry) {
535 			exif_log (data->priv->log, EXIF_LOG_CODE_NO_MEMORY, "ExifData",
536 									"Could not allocate memory");
537 			return;
538 	}
539 	if (exif_data_load_data_entry (data, entry, d, ds,
540 					offset + 12 * i))
541 		exif_content_add_entry (data->ifd[ifd], entry);
542 	exif_entry_unref (entry);
543 }
544 
545 /*! Load data for an IFD.
546  *
547  * \param[in,out] data #ExifData
548  * \param[in] ifd IFD to load
549  * \param[in] d pointer to buffer containing raw IFD data
550  * \param[in] ds size of raw data in buffer at \c d
551  * \param[in] offset offset into buffer at \c d at which IFD starts
552  * \param[in] recursion_cost factor indicating how expensive this recursive
553  * call could be
554  */
555 static void
exif_data_load_data_content(ExifData * data,ExifIfd ifd,const unsigned char * d,unsigned int ds,unsigned int offset,unsigned int recursion_cost)556 exif_data_load_data_content (ExifData *data, ExifIfd ifd,
557 			     const unsigned char *d,
558 			     unsigned int ds, unsigned int offset, unsigned int recursion_cost)
559 {
560 	ExifLong o, thumbnail_offset = 0, thumbnail_length = 0;
561 	ExifShort n;
562 	ExifEntry *entry;
563 	unsigned int i;
564 	ExifTag tag;
565 
566 	if (!data || !data->priv)
567 		return;
568 
569 	/* check for valid ExifIfd enum range */
570 	if ((((int)ifd) < 0) || ( ((int)ifd) >= EXIF_IFD_COUNT))
571 	  return;
572 
573 	if (recursion_cost > 170) {
574 		/*
575 		 * recursion_cost is a logarithmic-scale indicator of how expensive this
576 		 * recursive call might end up being. It is an indicator of the depth of
577 		 * recursion as well as the potential for worst-case future recursive
578 		 * calls. Since it's difficult to tell ahead of time how often recursion
579 		 * will occur, this assumes the worst by assuming every tag could end up
580 		 * causing recursion.
581 		 * The value of 170 was chosen to limit typical EXIF structures to a
582 		 * recursive depth of about 6, but pathological ones (those with very
583 		 * many tags) to only 2.
584 		 */
585 		exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifData",
586 			  "Deep/expensive recursion detected!");
587 		return;
588 	}
589 
590 	/* Read the number of entries */
591 	if (CHECKOVERFLOW(offset, ds, 2)) {
592 		exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifData",
593 			  "Tag data past end of buffer (%u+2 > %u)", offset, ds);
594 		return;
595 	}
596 	n = exif_get_short (d + offset, data->priv->order);
597 	exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
598 	          "Loading %hu entries...", n);
599 	offset += 2;
600 
601 	/* Check if we have enough data. */
602 	if (CHECKOVERFLOW(offset, ds, 12*n)) {
603 		n = (ds - offset) / 12;
604 		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
605 				  "Short data; only loading %hu entries...", n);
606 	}
607 
608 	for (i = 0; i < n; i++) {
609 
610 		/* Check if we have enough data. */
611 		if (CHECKOVERFLOW(offset + ENTRY_SIZE * i, ds, sizeof(ExifShort))) {
612 			exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifData",
613 					"Tag data past end of buffer (%u+2 > %u)", offset + ENTRY_SIZE * i, ds);
614 			return;
615 		}
616 
617 		tag = exif_get_short (d + offset + 12 * i, data->priv->order);
618 		switch (tag) {
619 		case EXIF_TAG_EXIF_IFD_POINTER:
620 		case EXIF_TAG_GPS_INFO_IFD_POINTER:
621 		case EXIF_TAG_INTEROPERABILITY_IFD_POINTER:
622 		case EXIF_TAG_JPEG_INTERCHANGE_FORMAT_LENGTH:
623 		case EXIF_TAG_JPEG_INTERCHANGE_FORMAT:
624 			o = exif_get_long (d + offset + 12 * i + 8,
625 					   data->priv->order);
626 			if (o >= ds) {
627 				exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifData",
628 					  "Tag data past end of buffer (%u > %u)", offset+2, ds);
629 				if (recursion_cost > 0)
630 					return;
631 				break;
632 			}
633 			/* FIXME: IFD_POINTER tags aren't marked as being in a
634 			 * specific IFD, so exif_tag_get_name_in_ifd won't work
635 			 */
636 			exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
637 				  "Sub-IFD entry 0x%x ('%s') at %u.", tag,
638 				  exif_tag_get_name(tag), o);
639 			switch (tag) {
640 			case EXIF_TAG_EXIF_IFD_POINTER:
641 				CHECK_REC (EXIF_IFD_EXIF);
642 				exif_data_load_data_content (data, EXIF_IFD_EXIF, d, ds, o,
643 					recursion_cost + level_cost(n));
644 				break;
645 			case EXIF_TAG_GPS_INFO_IFD_POINTER:
646 				CHECK_REC (EXIF_IFD_GPS);
647 				exif_data_load_data_content (data, EXIF_IFD_GPS, d, ds, o,
648 					recursion_cost + level_cost(n));
649 				break;
650 			case EXIF_TAG_INTEROPERABILITY_IFD_POINTER:
651 				CHECK_REC (EXIF_IFD_INTEROPERABILITY);
652 				exif_data_load_data_content (data, EXIF_IFD_INTEROPERABILITY, d, ds, o,
653 					recursion_cost + level_cost(n));
654 				break;
655 			case EXIF_TAG_JPEG_INTERCHANGE_FORMAT:
656 				thumbnail_offset = o;
657 				if (thumbnail_offset && thumbnail_length)
658 					exif_data_load_data_thumbnail (data, d,
659 								       ds, thumbnail_offset,
660 								       thumbnail_length);
661 				load_thumbnail_entry(data, tag, ifd, d, ds, offset, i);
662 				break;
663 			case EXIF_TAG_JPEG_INTERCHANGE_FORMAT_LENGTH:
664 				thumbnail_length = o;
665 				if (thumbnail_offset && thumbnail_length)
666 					exif_data_load_data_thumbnail (data, d,
667 								       ds, thumbnail_offset,
668 								       thumbnail_length);
669 				load_thumbnail_entry(data, tag, ifd, d, ds, offset, i);
670 				break;
671 			default:
672 				return;
673 			}
674 			break;
675 		default:
676 			/*
677 			 * If we don't know the tag, don't fail. It could be that new
678 			 * versions of the standard have defined additional tags. Note that
679 			 * 0 is a valid tag in the GPS IFD.
680 			 */
681 			if (!exif_tag_get_name_in_ifd (tag, ifd)) {
682 
683 				/*
684 				 * Special case: Tag and format 0. That's against specification
685 				 * (at least up to 2.2). But Photoshop writes it anyways.
686 				 */
687 				if (!memcmp (d + offset + 12 * i, "\0\0\0\0", 4)) {
688 					exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
689 						  "Skipping empty entry at position %u in '%s'.", i,
690 						  exif_ifd_get_name (ifd));
691 					break;
692 				}
693 				exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
694 					  "Unknown tag 0x%04x (entry %u in '%s'). Please report this tag "
695 					  "to <libexif-devel@lists.sourceforge.net>.", tag, i,
696 					  exif_ifd_get_name (ifd));
697 				if (data->priv->options & EXIF_DATA_OPTION_IGNORE_UNKNOWN_TAGS)
698 					break;
699 			}
700 			entry = exif_entry_new_mem (data->priv->mem);
701 			if (!entry) {
702 				  exif_log (data->priv->log, EXIF_LOG_CODE_NO_MEMORY, "ExifData",
703                                           "Could not allocate memory");
704 				  return;
705 			}
706 			if (exif_data_load_data_entry (data, entry, d, ds,
707 						   offset + 12 * i))
708 				exif_content_add_entry (data->ifd[ifd], entry);
709 			exif_entry_unref (entry);
710 			break;
711 		}
712 	}
713 }
714 
715 static int
cmp_func(const unsigned char * p1,const unsigned char * p2,ExifByteOrder o)716 cmp_func (const unsigned char *p1, const unsigned char *p2, ExifByteOrder o)
717 {
718 	ExifShort tag1 = exif_get_short (p1, o);
719 	ExifShort tag2 = exif_get_short (p2, o);
720 
721 	return (tag1 < tag2) ? -1 : (tag1 > tag2) ? 1 : 0;
722 }
723 
724 static int
cmp_func_intel(const void * elem1,const void * elem2)725 cmp_func_intel (const void *elem1, const void *elem2)
726 {
727 	return cmp_func ((const unsigned char *) elem1,
728 			 (const unsigned char *) elem2, EXIF_BYTE_ORDER_INTEL);
729 }
730 
731 static int
cmp_func_motorola(const void * elem1,const void * elem2)732 cmp_func_motorola (const void *elem1, const void *elem2)
733 {
734 	return cmp_func ((const unsigned char *) elem1,
735 			 (const unsigned char *) elem2, EXIF_BYTE_ORDER_MOTOROLA);
736 }
737 
738 static void
exif_data_save_data_content(ExifData * data,ExifContent * ifd,unsigned char ** d,unsigned int * ds,unsigned int offset)739 exif_data_save_data_content (ExifData *data, ExifContent *ifd,
740 			     unsigned char **d, unsigned int *ds,
741 			     unsigned int offset)
742 {
743 	unsigned int j, n_ptr = 0, n_thumb = 0;
744 	ExifIfd i;
745 	unsigned char *t;
746 	unsigned int ts;
747 	unsigned int icount = 0;
748 
749 	if (!data || !data->priv || !ifd || !d || !ds)
750 		return;
751 
752 	for (i = 0; i < EXIF_IFD_COUNT; i++)
753 		if (ifd == data->ifd[i])
754 			break;
755 	if (i == EXIF_IFD_COUNT)
756 		return;	/* error */
757 
758 	/*
759 	 * Check if we need some extra entries for pointers or the thumbnail.
760 	 */
761 	switch (i) {
762 	case EXIF_IFD_0:
763 
764 		/*
765 		 * The pointer to IFD_EXIF is in IFD_0. The pointer to
766 		 * IFD_INTEROPERABILITY is in IFD_EXIF.
767 		 */
768 		if (data->ifd[EXIF_IFD_EXIF]->count ||
769 		    data->ifd[EXIF_IFD_INTEROPERABILITY]->count)
770 			n_ptr++;
771 
772 		/* The pointer to IFD_GPS is in IFD_0. */
773 		if (data->ifd[EXIF_IFD_GPS]->count)
774 			n_ptr++;
775 
776 		break;
777 	case EXIF_IFD_1:
778 		if (data->size)
779 			n_thumb = 2;
780 		for (j = 0; j < ifd->count; j++) {
781 			if (ifd->entries[j]->tag == EXIF_TAG_JPEG_INTERCHANGE_FORMAT_LENGTH ||
782 				ifd->entries[j]->tag == EXIF_TAG_JPEG_INTERCHANGE_FORMAT) {
783 				icount++;
784 			}
785 		}
786 		ifd->count = ifd->count - icount;
787 		break;
788 	case EXIF_IFD_EXIF:
789 		if (data->ifd[EXIF_IFD_INTEROPERABILITY]->count)
790 			n_ptr++;
791 	default:
792 		break;
793 	}
794 
795 	/*
796 	 * Allocate enough memory for all entries
797 	 * and the number of entries.
798 	 */
799 	ts = *ds + (2 + (ifd->count + n_ptr + n_thumb) * 12 + 4);
800 	t = exif_mem_realloc (data->priv->mem, *d, ts);
801 	if (!t) {
802 		EXIF_LOG_NO_MEMORY (data->priv->log, "ExifData", ts);
803 	  	return;
804 	}
805 	*d = t;
806 	*ds = ts;
807 
808 	/* Save the number of entries */
809 	exif_set_short (*d + 6 + offset, data->priv->order,
810 			(ExifShort) (ifd->count + n_ptr + n_thumb));
811 	offset += 2;
812 
813 	/*
814 	 * Save each entry. Make sure that no memcpys from NULL pointers are
815 	 * performed
816 	 */
817 	exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
818 		  "Saving %i entries (IFD '%s', offset: %i)...",
819 		  ifd->count, exif_ifd_get_name (i), offset);
820 	for (j = 0; j < ifd->count; j++) {
821 		if (i == EXIF_IFD_1 &&
822 			(ifd->entries[j]->tag == EXIF_TAG_JPEG_INTERCHANGE_FORMAT ||
823 			ifd->entries[j]->tag == EXIF_TAG_JPEG_INTERCHANGE_FORMAT_LENGTH))
824 			continue;
825 		if (ifd->entries[j]) {
826 			exif_data_save_data_entry (data, ifd->entries[j], d, ds,
827 				offset + 12 * j);
828 		}
829 	}
830 
831 	offset += 12 * ifd->count;
832 
833 	/* Now save special entries. */
834 	switch (i) {
835 	case EXIF_IFD_0:
836 
837 		/*
838 		 * The pointer to IFD_EXIF is in IFD_0.
839 		 * However, the pointer to IFD_INTEROPERABILITY is in IFD_EXIF,
840 		 * therefore, if IFD_INTEROPERABILITY is not empty, we need
841 		 * IFD_EXIF even if latter is empty.
842 		 */
843 		if (data->ifd[EXIF_IFD_EXIF]->count ||
844 		    data->ifd[EXIF_IFD_INTEROPERABILITY]->count) {
845 			exif_set_short (*d + 6 + offset + 0, data->priv->order,
846 					EXIF_TAG_EXIF_IFD_POINTER);
847 			exif_set_short (*d + 6 + offset + 2, data->priv->order,
848 					EXIF_FORMAT_LONG);
849 			exif_set_long  (*d + 6 + offset + 4, data->priv->order,
850 					1);
851 			exif_set_long  (*d + 6 + offset + 8, data->priv->order,
852 					*ds - 6);
853 			exif_data_save_data_content (data,
854 						     data->ifd[EXIF_IFD_EXIF], d, ds, *ds - 6);
855 			offset += 12;
856 		}
857 
858 		/* The pointer to IFD_GPS is in IFD_0, too. */
859 		if (data->ifd[EXIF_IFD_GPS]->count) {
860 			exif_set_short (*d + 6 + offset + 0, data->priv->order,
861 					EXIF_TAG_GPS_INFO_IFD_POINTER);
862 			exif_set_short (*d + 6 + offset + 2, data->priv->order,
863 					EXIF_FORMAT_LONG);
864 			exif_set_long  (*d + 6 + offset + 4, data->priv->order,
865 					1);
866 			exif_set_long  (*d + 6 + offset + 8, data->priv->order,
867 					*ds - 6);
868 			exif_data_save_data_content (data,
869 						     data->ifd[EXIF_IFD_GPS], d, ds, *ds - 6);
870 			offset += 12;
871 		}
872 
873 		break;
874 	case EXIF_IFD_EXIF:
875 
876 		/*
877 		 * The pointer to IFD_INTEROPERABILITY is in IFD_EXIF.
878 		 * See note above.
879 		 */
880 		if (data->ifd[EXIF_IFD_INTEROPERABILITY]->count) {
881 			exif_set_short (*d + 6 + offset + 0, data->priv->order,
882 					EXIF_TAG_INTEROPERABILITY_IFD_POINTER);
883 			exif_set_short (*d + 6 + offset + 2, data->priv->order,
884 					EXIF_FORMAT_LONG);
885 			exif_set_long  (*d + 6 + offset + 4, data->priv->order,
886 					1);
887 			exif_set_long  (*d + 6 + offset + 8, data->priv->order,
888 					*ds - 6);
889 			exif_data_save_data_content (data,
890 						     data->ifd[EXIF_IFD_INTEROPERABILITY], d, ds,
891 						     *ds - 6);
892 			offset += 12;
893 		}
894 
895 		break;
896 	case EXIF_IFD_1:
897 
898 		/*
899 		 * Information about the thumbnail (if any) is saved in
900 		 * IFD_1.
901 		 */
902 		if (data->size) {
903 
904 			/* EXIF_TAG_JPEG_INTERCHANGE_FORMAT */
905 			exif_set_short (*d + 6 + offset + 0, data->priv->order,
906 					EXIF_TAG_JPEG_INTERCHANGE_FORMAT);
907 			exif_set_short (*d + 6 + offset + 2, data->priv->order,
908 					EXIF_FORMAT_LONG);
909 			exif_set_long  (*d + 6 + offset + 4, data->priv->order,
910 					1);
911 			exif_set_long  (*d + 6 + offset + 8, data->priv->order,
912 					*ds - 6);
913 			ts = *ds + data->size;
914 			t = exif_mem_realloc (data->priv->mem, *d, ts);
915 			if (!t) {
916 				EXIF_LOG_NO_MEMORY (data->priv->log, "ExifData",
917 						    ts);
918 			  	return;
919 			}
920 			*d = t;
921 			*ds = ts;
922 			memcpy (*d + *ds - data->size, data->data, data->size);
923 			offset += 12;
924 
925 			/* EXIF_TAG_JPEG_INTERCHANGE_FORMAT_LENGTH */
926 			exif_set_short (*d + 6 + offset + 0, data->priv->order,
927 					EXIF_TAG_JPEG_INTERCHANGE_FORMAT_LENGTH);
928 			exif_set_short (*d + 6 + offset + 2, data->priv->order,
929 					EXIF_FORMAT_LONG);
930 			exif_set_long  (*d + 6 + offset + 4, data->priv->order,
931 					1);
932 			exif_set_long  (*d + 6 + offset + 8, data->priv->order,
933 					data->size);
934 			offset += 12;
935 		}
936 
937 		break;
938 	default:
939 		break;
940 	}
941 
942 	/* Sort the directory according to TIFF specification */
943 	qsort (*d + 6 + offset - (ifd->count + n_ptr + n_thumb) * 12,
944 	       (ifd->count + n_ptr + n_thumb), 12,
945 	       (data->priv->order == EXIF_BYTE_ORDER_INTEL) ? cmp_func_intel : cmp_func_motorola);
946 
947 	/* Correctly terminate the directory */
948 	if (i == EXIF_IFD_0 && (data->ifd[EXIF_IFD_1]->count ||
949 				data->size)) {
950 
951 		/*
952 		 * We are saving IFD 0. Tell where IFD 1 starts and save
953 		 * IFD 1.
954 		 */
955 		exif_set_long (*d + 6 + offset, data->priv->order, *ds - 6);
956         if (data && data->remove_thumbnail != 1) {
957             exif_data_save_data_content (data, data->ifd[EXIF_IFD_1], d, ds,
958                                          *ds - 6);
959         }
960 	} else
961 		exif_set_long (*d + 6 + offset, data->priv->order, 0);
962 }
963 
964 static void
exif_data_save_data_content_general(ExifData * data,ExifContent * ifd,unsigned char ** d,unsigned int * ds,unsigned int offset)965 exif_data_save_data_content_general (ExifData* data, ExifContent* ifd,
966 									 unsigned char** d, unsigned int* ds,
967 									 unsigned int offset)
968 {
969 	unsigned int j, n_ptr = 0, n_thumb = 0;
970 	ExifIfd i;
971 	unsigned char* t;
972 	unsigned int ts;
973 
974 	if (!data || !data->priv || !ifd || !d || !ds)
975 		return;
976 
977 	for (i = 0; i < EXIF_IFD_COUNT; i++)
978 		if (ifd == data->ifd[i])
979 			break;
980 	if (i == EXIF_IFD_COUNT)
981 		return;	/* error */
982 
983 	/*
984 	 * Check if we need some extra entries for pointers or the thumbnail.
985 	 */
986 	switch (i) {
987 	case EXIF_IFD_0:
988 
989 		/*
990 		 * The pointer to IFD_EXIF is in IFD_0. The pointer to
991 		 * IFD_INTEROPERABILITY is in IFD_EXIF.
992 		 */
993 		if (data->ifd[EXIF_IFD_EXIF]->count ||
994 			data->ifd[EXIF_IFD_INTEROPERABILITY]->count)
995 			n_ptr++;
996 
997 		/* The pointer to IFD_GPS is in IFD_0. */
998 		if (data->ifd[EXIF_IFD_GPS]->count)
999 			n_ptr++;
1000 
1001 		break;
1002 	case EXIF_IFD_1:
1003 		if (data->size)
1004 			n_thumb = 2;
1005 		break;
1006 	case EXIF_IFD_EXIF:
1007 		if (data->ifd[EXIF_IFD_INTEROPERABILITY]->count)
1008 			n_ptr++;
1009 	default:
1010 		break;
1011 	}
1012 
1013 	/*
1014 	 * Allocate enough memory for all entries
1015 	 * and the number of entries.
1016 	 */
1017 	ts = *ds + (2 + (ifd->count + n_ptr + n_thumb) * 12 + 4);
1018 	t = exif_mem_realloc(data->priv->mem, *d, ts);
1019 	if (!t) {
1020 		EXIF_LOG_NO_MEMORY(data->priv->log, "ExifData", ts);
1021 		return;
1022 	}
1023 	*d = t;
1024 	*ds = ts;
1025 
1026 	/* Save the number of entries */
1027 	exif_set_short(*d + 6 - JPEG_HEADER_LEN + offset, data->priv->order,
1028 		(ExifShort)(ifd->count + n_ptr + n_thumb));
1029 	offset += 2;
1030 
1031 	/*
1032 	 * Save each entry. Make sure that no memcpys from NULL pointers are
1033 	 * performed
1034 	 */
1035 	exif_log(data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
1036 		"Saving %i entries (IFD '%s', offset: %i)...",
1037 		ifd->count, exif_ifd_get_name(i), offset);
1038 	printf("current ifd->count %u\n", ifd->count);
1039 	for (j = 0; j < ifd->count; j++) {
1040 		if (ifd->entries[j]) {
1041 			exif_data_save_data_entry_general(data, ifd->entries[j], d, ds,
1042 				offset + 12 * j);
1043 		}
1044 	}
1045 
1046 	offset += 12 * ifd->count;
1047 
1048 	/* Now save special entries. */
1049 	switch (i) {
1050 	case EXIF_IFD_0:
1051 
1052 		/*
1053 		 * The pointer to IFD_EXIF is in IFD_0.
1054 		 * However, the pointer to IFD_INTEROPERABILITY is in IFD_EXIF,
1055 		 * therefore, if IFD_INTEROPERABILITY is not empty, we need
1056 		 * IFD_EXIF even if latter is empty.
1057 		 */
1058 		if (data->ifd[EXIF_IFD_EXIF]->count ||
1059 			data->ifd[EXIF_IFD_INTEROPERABILITY]->count) {
1060 			exif_set_short(*d + 6 - JPEG_HEADER_LEN + offset + 0, data->priv->order,
1061 				EXIF_TAG_EXIF_IFD_POINTER);
1062 			exif_set_short(*d + 6 - JPEG_HEADER_LEN + offset + 2, data->priv->order,
1063 				EXIF_FORMAT_LONG);
1064 			exif_set_long(*d + 6 - JPEG_HEADER_LEN + offset + 4, data->priv->order,
1065 				1);
1066 			exif_set_long(*d + 6 - JPEG_HEADER_LEN + offset + 8, data->priv->order,
1067 				*ds - 6 + JPEG_HEADER_LEN);
1068 			exif_data_save_data_content_general(data,
1069 				data->ifd[EXIF_IFD_EXIF], d, ds, *ds - 6 + JPEG_HEADER_LEN);
1070 			offset += 12;
1071 		}
1072 
1073 		/* The pointer to IFD_GPS is in IFD_0, too. */
1074 		if (data->ifd[EXIF_IFD_GPS]->count) {
1075 			exif_set_short(*d + 6 - JPEG_HEADER_LEN + offset + 0, data->priv->order,
1076 				EXIF_TAG_GPS_INFO_IFD_POINTER);
1077 			exif_set_short(*d + 6 - JPEG_HEADER_LEN + offset + 2, data->priv->order,
1078 				EXIF_FORMAT_LONG);
1079 			exif_set_long(*d + 6 - JPEG_HEADER_LEN + offset + 4, data->priv->order,
1080 				1);
1081 			exif_set_long(*d + 6 - JPEG_HEADER_LEN + offset + 8, data->priv->order,
1082 				*ds - 6 + JPEG_HEADER_LEN);
1083 			exif_data_save_data_content_general(data,
1084 				data->ifd[EXIF_IFD_GPS], d, ds, *ds - 6 + JPEG_HEADER_LEN);
1085 			offset += 12;
1086 		}
1087 
1088 		break;
1089 	case EXIF_IFD_EXIF:
1090 
1091 		/*
1092 		 * The pointer to IFD_INTEROPERABILITY is in IFD_EXIF.
1093 		 * See note above.
1094 		 */
1095 		if (data->ifd[EXIF_IFD_INTEROPERABILITY]->count) {
1096 			exif_set_short(*d + 6 - JPEG_HEADER_LEN + offset + 0, data->priv->order,
1097 				EXIF_TAG_INTEROPERABILITY_IFD_POINTER);
1098 			exif_set_short(*d + 6 - JPEG_HEADER_LEN + offset + 2, data->priv->order,
1099 				EXIF_FORMAT_LONG);
1100 			exif_set_long(*d + 6 - JPEG_HEADER_LEN + offset + 4, data->priv->order,
1101 				1);
1102 			exif_set_long(*d + 6 - JPEG_HEADER_LEN + offset + 8, data->priv->order,
1103 				*ds - 6 + JPEG_HEADER_LEN);
1104 			exif_data_save_data_content_general(data,
1105 				data->ifd[EXIF_IFD_INTEROPERABILITY], d, ds,
1106 				*ds - 6 + JPEG_HEADER_LEN);
1107 			offset += 12;
1108 		}
1109 
1110 		break;
1111 	case EXIF_IFD_1:
1112 
1113 		/*
1114 		 * Information about the thumbnail (if any) is saved in
1115 		 * IFD_1.
1116 		 */
1117 		if (data->size) {
1118 
1119 			/* EXIF_TAG_JPEG_INTERCHANGE_FORMAT */
1120 			exif_set_short(*d + 6 - JPEG_HEADER_LEN + offset + 0, data->priv->order,
1121 				EXIF_TAG_JPEG_INTERCHANGE_FORMAT);
1122 			exif_set_short(*d + 6 - JPEG_HEADER_LEN + offset + 2, data->priv->order,
1123 				EXIF_FORMAT_LONG);
1124 			exif_set_long(*d + 6 - JPEG_HEADER_LEN + offset + 4, data->priv->order,
1125 				1);
1126 			exif_set_long(*d + 6 - JPEG_HEADER_LEN + offset + 8, data->priv->order,
1127 				*ds - 6 + JPEG_HEADER_LEN);
1128 			ts = *ds + data->size;
1129 			t = exif_mem_realloc(data->priv->mem, *d, ts);
1130 			if (!t) {
1131 				EXIF_LOG_NO_MEMORY(data->priv->log, "ExifData",
1132 					ts);
1133 				return;
1134 			}
1135 			*d = t;
1136 			*ds = ts;
1137 			memcpy(*d + *ds - data->size, data->data, data->size);
1138 			offset += 12;
1139 
1140 			/* EXIF_TAG_JPEG_INTERCHANGE_FORMAT_LENGTH */
1141 			exif_set_short(*d + 6 - JPEG_HEADER_LEN + offset + 0, data->priv->order,
1142 				EXIF_TAG_JPEG_INTERCHANGE_FORMAT_LENGTH);
1143 			exif_set_short(*d + 6 - JPEG_HEADER_LEN + offset + 2, data->priv->order,
1144 				EXIF_FORMAT_LONG);
1145 			exif_set_long(*d + 6 - JPEG_HEADER_LEN + offset + 4, data->priv->order,
1146 				1);
1147 			exif_set_long(*d + 6 - JPEG_HEADER_LEN + offset + 8, data->priv->order,
1148 				data->size);
1149 			offset += 12;
1150 		}
1151 
1152 		break;
1153 	default:
1154 		break;
1155 	}
1156 
1157 	/* Sort the directory according to TIFF specification */
1158 	qsort(*d + 6 - JPEG_HEADER_LEN + offset - (ifd->count + n_ptr + n_thumb) * 12,
1159 		(ifd->count + n_ptr + n_thumb), 12,
1160 		(data->priv->order == EXIF_BYTE_ORDER_INTEL) ? cmp_func_intel : cmp_func_motorola);
1161 
1162 	/* Correctly terminate the directory */
1163 	if (i == EXIF_IFD_0 && (data->ifd[EXIF_IFD_1]->count ||
1164 		data->size)) {
1165 
1166 		/*
1167 		 * We are saving IFD 0. Tell where IFD 1 starts and save
1168 		 * IFD 1.
1169 		 */
1170 		exif_set_long(*d + 6 - JPEG_HEADER_LEN + offset, data->priv->order, *ds - 6 + JPEG_HEADER_LEN);
1171 		exif_data_save_data_content_general(data, data->ifd[EXIF_IFD_1], d, ds,
1172 			*ds - 6 + JPEG_HEADER_LEN);
1173 	}
1174 	else
1175 		exif_set_long(*d + 6 - JPEG_HEADER_LEN + offset, data->priv->order, 0);
1176 }
1177 
1178 typedef enum {
1179 	EXIF_DATA_TYPE_MAKER_NOTE_NONE		= 0,
1180 	EXIF_DATA_TYPE_MAKER_NOTE_CANON		= 1,
1181 	EXIF_DATA_TYPE_MAKER_NOTE_OLYMPUS	= 2,
1182 	EXIF_DATA_TYPE_MAKER_NOTE_PENTAX	= 3,
1183 	EXIF_DATA_TYPE_MAKER_NOTE_NIKON		= 4,
1184 	EXIF_DATA_TYPE_MAKER_NOTE_CASIO		= 5,
1185 	EXIF_DATA_TYPE_MAKER_NOTE_FUJI 		= 6
1186 } ExifDataTypeMakerNote;
1187 
1188 /*! If MakerNote is recognized, load it.
1189  *
1190  * \param[in,out] data #ExifData
1191  * \param[in] d pointer to raw EXIF data
1192  * \param[in] ds length of data at d
1193  */
1194 static void
interpret_maker_note(ExifData * data,const unsigned char * d,unsigned int ds)1195 interpret_maker_note(ExifData *data, const unsigned char *d, unsigned int ds)
1196 {
1197 	int mnoteid;
1198 	ExifEntry* e = exif_content_get_huawei_makenote_entry(data->ifd[EXIF_IFD_EXIF]);
1199 
1200 	if (!e)
1201 		return;
1202 
1203 	if ((mnoteid = exif_mnote_data_olympus_identify (data, e)) != 0) {
1204 		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG,
1205 			"ExifData", "Olympus MakerNote variant type %d", mnoteid);
1206 		data->priv->md = exif_mnote_data_olympus_new (data->priv->mem);
1207 
1208 	} else if ((mnoteid = exif_mnote_data_canon_identify (data, e)) != 0) {
1209 		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG,
1210 			"ExifData", "Canon MakerNote variant type %d", mnoteid);
1211 		data->priv->md = exif_mnote_data_canon_new (data->priv->mem, data->priv->options);
1212 
1213 	} else if ((mnoteid = exif_mnote_data_fuji_identify (data, e)) != 0) {
1214 		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG,
1215 			"ExifData", "Fuji MakerNote variant type %d", mnoteid);
1216 		data->priv->md = exif_mnote_data_fuji_new (data->priv->mem);
1217 
1218 	/* NOTE: Must do Pentax detection last because some of the
1219 	 * heuristics are pretty general. */
1220 	} else if ((mnoteid = exif_mnote_data_pentax_identify (data, e)) != 0) {
1221 		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG,
1222 			"ExifData", "Pentax MakerNote variant type %d", mnoteid);
1223 		data->priv->md = exif_mnote_data_pentax_new (data->priv->mem);
1224 	} else if ((mnoteid = exif_mnote_data_apple_identify (data, e)) != 0) {
1225 		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG,
1226 			"ExifData", "Apple MakerNote variant type %d", mnoteid);
1227 		data->priv->md = exif_mnote_data_apple_new (data->priv->mem);
1228 	} else if ((mnoteid = exif_mnote_data_huawei_identify (data, e)) != 0) {
1229 		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG,
1230 			"ExifData", "Huawei MakerNote variant type %d", mnoteid);
1231 		data->priv->md = exif_mnote_data_huawei_new (data->priv->mem);
1232 	}
1233 
1234 	/*
1235 	 * If we are able to interpret the maker note, do so.
1236 	 */
1237 	if (data->priv->md) {
1238 		exif_mnote_data_log (data->priv->md, data->priv->log);
1239 		exif_mnote_data_set_byte_order (data->priv->md,
1240 						data->priv->order);
1241 		exif_mnote_data_set_offset (data->priv->md,
1242 					    data->priv->offset_mnote);
1243 		exif_mnote_data_load (data->priv->md, d, ds);
1244 	}
1245 }
1246 
1247 #define LOG_TOO_SMALL \
1248 exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifData", \
1249 		_("Size of data too small to allow for EXIF data."));
1250 
1251 void
exif_data_load_data(ExifData * data,const unsigned char * d_orig,unsigned int ds)1252 exif_data_load_data (ExifData *data, const unsigned char *d_orig,
1253 		     unsigned int ds)
1254 {
1255 	unsigned int l;
1256 	ExifLong offset;
1257 	ExifShort n;
1258 	const unsigned char *d = d_orig;
1259 	unsigned int len, fullds;
1260 
1261 	if (!data || !data->priv || !d || !ds)
1262 		return;
1263 
1264 	exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
1265 		  "Parsing %i byte(s) EXIF data...\n", ds);
1266 
1267 	/*
1268 	 * It can be that the data starts with the EXIF header. If it does
1269 	 * not, search the EXIF marker.
1270 	 */
1271 	if (ds < 6) {
1272 		LOG_TOO_SMALL;
1273 		return;
1274 	}
1275 	if (!memcmp (d, ExifHeader, 6)) {
1276 		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
1277 			  "Found EXIF header at start.");
1278 	} else {
1279 		while (ds >= 3) {
1280 			while (ds && (d[0] == 0xff)) {
1281 				d++;
1282 				ds--;
1283 			}
1284 
1285 			/* JPEG_MARKER_SOI */
1286 			if (ds && d[0] == JPEG_MARKER_SOI) {
1287 				d++;
1288 				ds--;
1289 				continue;
1290 			}
1291 
1292 			/* JPEG_MARKER_APP1 */
1293 			if (ds && d[0] == JPEG_MARKER_APP1) {
1294 				/*
1295 				 * Verify the exif header
1296 				 * (offset 3, length 6).
1297 				 * FF E1 NN NN EXIFHEADER
1298 				 *    ^^ d points here currently
1299 				 */
1300 				if ((ds >= 9) && !memcmp (d+3, ExifHeader, 6))
1301 					break;
1302 				/* fallthrough */
1303 			}
1304 			/* Skip irrelevant APP markers. The branch for APP1 must come before this,
1305 			   otherwise this code block will cause APP1 to be skipped. This code path
1306 			   is only relevant for files that are nonconformant to the EXIF
1307 			   specification. For conformant files, the APP1 code path above will be
1308 			   taken. */
1309 			if (ds >= 3 && d[0] >= 0xe0 && d[0] <= 0xef) {  /* JPEG_MARKER_APPn */
1310 				d++;
1311 				ds--;
1312 				l = (((unsigned int)d[0]) << 8) | d[1];
1313 				if (l > ds)
1314 					return;
1315 				d += l;
1316 				ds -= l;
1317 				continue;
1318 			}
1319 
1320 			/* Unknown marker or data. Give up. */
1321 			exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA,
1322 				  "ExifData", _("EXIF marker not found."));
1323 			return;
1324 		}
1325 		if (ds < 3) {
1326 			LOG_TOO_SMALL;
1327 			return;
1328 		}
1329 		d++;
1330 		ds--;
1331 		len = (((unsigned int)d[0]) << 8) | d[1];
1332 		if (len > ds) {
1333 			exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA,
1334 				  "ExifData", _("Read length %d is longer than data length %d."), len, ds);
1335 			return;
1336 		}
1337 		if (len < 2) {
1338 			exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA,
1339 				  "ExifData", _("APP Tag too short."));
1340 			return;
1341 		}
1342 		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
1343 			  "We have to deal with %i byte(s) of EXIF data.",
1344 			  len);
1345 		d += 2;
1346 		ds = len - 2;	/* we do not want the full rest size, but only the size of the tag */
1347 	}
1348 
1349 	/*
1350 	 * Verify the exif header
1351 	 * (offset 2, length 6).
1352 	 */
1353 	if (ds < 6) {
1354 		LOG_TOO_SMALL;
1355 		return;
1356 	}
1357 	if (memcmp (d, ExifHeader, 6)) {
1358 		exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA,
1359 			  "ExifData", _("EXIF header not found."));
1360 		return;
1361 	}
1362 
1363 	exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
1364 		  "Found EXIF header.");
1365 
1366 	/* Sanity check the data length */
1367 	if (ds < 14)
1368 		return;
1369 
1370 	/* The JPEG APP1 section can be no longer than 64 KiB (including a
1371 	   16-bit length), so cap the data length to protect against overflow
1372 	   in future offset calculations */
1373 	fullds = ds;
1374 	if (ds > 0xfffe)
1375 		ds = 0xfffe;
1376 
1377 	/* Byte order (offset 6, length 2) */
1378 	if (!memcmp (d + 6, "II", 2))
1379 		data->priv->order = EXIF_BYTE_ORDER_INTEL;
1380 	else if (!memcmp (d + 6, "MM", 2))
1381 		data->priv->order = EXIF_BYTE_ORDER_MOTOROLA;
1382 	else {
1383 		exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA,
1384 			  "ExifData", _("Unknown encoding."));
1385 		return;
1386 	}
1387 
1388 	/* Fixed value */
1389 	if (exif_get_short (d + 8, data->priv->order) != 0x002a)
1390 		return;
1391 
1392 	/* IFD 0 offset */
1393 	offset = exif_get_long (d + 10, data->priv->order);
1394 	exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
1395 		  "IFD 0 at %i.", (int) offset);
1396 
1397 	/* ds is restricted to 16 bit above, so offset is restricted too, and offset+8 should not overflow. */
1398 	if (offset > ds || offset + 6 + 2 > ds)
1399 		return;
1400 
1401 	/* Parse the actual exif data (usually offset 14 from start) */
1402 	exif_data_load_data_content (data, EXIF_IFD_0, d + 6, ds - 6, offset, 0);
1403 
1404 	/* IFD 1 offset */
1405 	n = exif_get_short (d + 6 + offset, data->priv->order);
1406 	/* offset < 2<<16, n is 16 bit at most, so this op will not overflow */
1407 	if (offset + 6 + 2 + 12 * n + 4 > ds)
1408 		return;
1409 
1410 	offset = exif_get_long (d + 6 + offset + 2 + 12 * n, data->priv->order);
1411 	if (offset) {
1412 		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
1413 			  "IFD 1 at %i.", (int) offset);
1414 
1415 		/* Sanity check. ds is ensured to be above 6 above, offset is 16bit */
1416 		if (offset > ds - 6) {
1417 			exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA,
1418 				  "ExifData", "Bogus offset of IFD1.");
1419 		} else {
1420 			exif_data_load_data_content (data, EXIF_IFD_1, d + 6, ds - 6, offset, 0);
1421 		}
1422 	}
1423 
1424 	/*
1425 	 * If we got an EXIF_TAG_MAKER_NOTE, try to interpret it. Some
1426 	 * cameras use pointers in the maker note tag that point to the
1427 	 * space between IFDs. Here is the only place where we have access
1428 	 * to that data.
1429 	 */
1430 	interpret_maker_note(data, d, fullds);
1431 
1432 	/* Fixup tags if requested */
1433 	if (data->priv->options & EXIF_DATA_OPTION_FOLLOW_SPECIFICATION)
1434 		exif_data_fix (data);
1435 }
1436 
1437 void
exif_data_load_data_general(ExifData * data,const unsigned char * d_orig,unsigned int ds)1438 exif_data_load_data_general (ExifData* data, const unsigned char* d_orig,
1439 							 unsigned int ds)
1440 {
1441 	ExifLong offset;
1442 	ExifShort n;
1443 	const unsigned char* d = d_orig;
1444 	unsigned int fullds;
1445 
1446 	if (!data || !data->priv || !d || !ds)
1447 		return;
1448 
1449 	exif_log(data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
1450 		"Parsing %i byte(s) EXIF data...\n", ds);
1451 
1452 	/* Sanity check the data length */
1453 	if (ds < 14)
1454 		return;
1455 
1456 	/* The JPEG APP1 section can be no longer than 64 KiB (including a
1457 	   16-bit length), so cap the data length to protect against overflow
1458 	   in future offset calculations */
1459 	fullds = ds;
1460 	if (ds > 0xfffe)
1461 		ds = 0xfffe;
1462 
1463 	/* Byte order (offset 6, length 2) */
1464 	if (!memcmp(d + 6 - 6, "II", 2))
1465 		data->priv->order = EXIF_BYTE_ORDER_INTEL;
1466 	else if (!memcmp(d + 6 - 6, "MM", 2))
1467 		data->priv->order = EXIF_BYTE_ORDER_MOTOROLA;
1468 	else {
1469 		exif_log(data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA,
1470 			"ExifData", _("Unknown encoding."));
1471 		return;
1472 	}
1473 
1474 	/* Fixed value */
1475 	if (exif_get_short(d + 8 - 6, data->priv->order) != 0x002a)
1476 		return;
1477 
1478 	/* IFD 0 offset */
1479 	offset = exif_get_long(d + 10 - 6, data->priv->order);
1480 	exif_log(data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
1481 		"IFD 0 at %i.", (int)offset);
1482 
1483 	/* ds is restricted to 16 bit above, so offset is restricted too, and offset+8 should not overflow. */
1484 	// compare offset and buffer size
1485 	if (offset > ds || offset + 6 - 6 + 2 > ds)
1486 		return;
1487 
1488 	/* Parse the actual exif data (usually offset 14 from start) */
1489 	exif_data_load_data_content(data, EXIF_IFD_0, d + 6 - 6, ds - 6 + 6, offset, 0);
1490 
1491 	/* IFD 1 offset */
1492 	n = exif_get_short(d + 6 - 6 + offset, data->priv->order);
1493 	/* offset < 2<<16, n is 16 bit at most, so this op will not overflow */
1494 	if (offset + 6 - 6 + 2 + 12 * n + 4 > ds)
1495 		return;
1496 
1497 	offset = exif_get_long(d + 6 - 6 + offset + 2 + 12 * n, data->priv->order);
1498 	if (offset) {
1499 		exif_log(data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
1500 			"IFD 1 at %i.", (int)offset);
1501 
1502 		/* Sanity check. ds is ensured to be above 6 above, offset is 16bit */
1503 		if (offset > ds - 6 + 6) {
1504 			exif_log(data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA,
1505 				"ExifData", "Bogus offset of IFD1.");
1506 		} else {
1507 			exif_data_load_data_content(data, EXIF_IFD_1, d + 6 - 6, ds - 6 + 6, offset, 0);
1508 		}
1509 	}
1510 
1511 	/*
1512 	 * If we got an EXIF_TAG_MAKER_NOTE, try to interpret it. Some
1513 	 * cameras use pointers in the maker note tag that point to the
1514 	 * space between IFDs. Here is the only place where we have access
1515 	 * to that data.
1516 	 */
1517 	interpret_maker_note(data, d, fullds);
1518 
1519 	/* Fixup tags if requested */
1520 	if (data->priv->options & EXIF_DATA_OPTION_FOLLOW_SPECIFICATION)
1521 		exif_data_fix(data);
1522 }
1523 
1524 void
exif_data_save_data(ExifData * data,unsigned char ** d,unsigned int * ds)1525 exif_data_save_data (ExifData *data, unsigned char **d, unsigned int *ds)
1526 {
1527 	if (ds)
1528 		*ds = 0;	/* This means something went wrong */
1529 
1530 	if (!data || !d || !ds)
1531 		return;
1532 
1533 	/* Header */
1534 	*ds = 14;
1535 	*d = exif_data_alloc (data, *ds);
1536 	if (!*d)  {
1537 		*ds = 0;
1538 		return;
1539 	}
1540 	memcpy (*d, ExifHeader, 6);
1541 
1542 	/* Order (offset 6) */
1543 	if (data->priv->order == EXIF_BYTE_ORDER_INTEL) {
1544 		memcpy (*d + 6, "II", 2);
1545 	} else {
1546 		memcpy (*d + 6, "MM", 2);
1547 	}
1548 
1549 	/* Fixed value (2 bytes, offset 8) */
1550 	exif_set_short (*d + 8, data->priv->order, 0x002a);
1551 
1552 	/*
1553 	 * IFD 0 offset (4 bytes, offset 10).
1554 	 * We will start 8 bytes after the
1555 	 * EXIF header (2 bytes for order, another 2 for the test, and
1556 	 * 4 bytes for the IFD 0 offset make 8 bytes together).
1557 	 */
1558 	exif_set_long (*d + 10, data->priv->order, 8);
1559 
1560 	/* Now save IFD 0. IFD 1 will be saved automatically. */
1561 	exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
1562 		  "Saving IFDs...");
1563 	exif_data_save_data_content (data, data->ifd[EXIF_IFD_0], d, ds,
1564 				     *ds - 6);
1565 	exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
1566 		  "Saved %i byte(s) EXIF data.", *ds);
1567 }
1568 
1569 void
exif_data_save_data_general(ExifData * data,unsigned char ** d,unsigned int * ds)1570 exif_data_save_data_general(ExifData* data, unsigned char** d, unsigned int* ds)
1571 {
1572 	if (ds)
1573 		*ds = 0;	/* This means something went wrong */
1574 
1575 	if (!data || !d || !ds)
1576 		return;
1577 
1578 	/* Header 4D 4D 00 2A 00 00 00 08*/
1579 	*ds = 8;
1580 	*d = exif_data_alloc(data, *ds);
1581 	if (!*d) {
1582 		*ds = 0;
1583 		return;
1584 	}
1585 
1586 	/* Order (offset 6) */
1587 	if (data->priv->order == EXIF_BYTE_ORDER_INTEL) {
1588 		memcpy(*d + 6 - 6, "II", 2);
1589 	}
1590 	else {
1591 		memcpy(*d + 6 - 6, "MM", 2);
1592 	}
1593 
1594 	/* Fixed value (2 bytes, offset 8) */
1595 	exif_set_short(*d + 8 - 6, data->priv->order, 0x002a);
1596 
1597 	/*
1598 	 * IFD 0 offset (4 bytes, offset 10).
1599 	 * We will start 8 bytes after the
1600 	 * EXIF header (2 bytes for order, another 2 for the test, and
1601 	 * 4 bytes for the IFD 0 offset make 8 bytes together).
1602 	 */
1603 	exif_set_long(*d + 10 - 6, data->priv->order, 8);
1604 	/* Now save IFD 0. IFD 1 will be saved automatically. */
1605 	exif_log(data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
1606 		"Saving IFDs...");
1607 	exif_data_save_data_content_general(data, data->ifd[EXIF_IFD_0], d, ds,
1608 		*ds);
1609 	exif_log(data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
1610 		"Saved %i byte(s) EXIF data.", *ds);
1611 }
1612 
1613 ExifData *
exif_data_new_from_file(const char * path)1614 exif_data_new_from_file (const char *path)
1615 {
1616 	ExifData *edata;
1617 	ExifLoader *loader;
1618 
1619 	loader = exif_loader_new ();
1620 	exif_loader_write_file (loader, path);
1621 	edata = exif_loader_get_data (loader);
1622 	exif_loader_unref (loader);
1623 
1624 	return (edata);
1625 }
1626 
1627 void
exif_data_ref(ExifData * data)1628 exif_data_ref (ExifData *data)
1629 {
1630 	if (!data)
1631 		return;
1632 
1633 	data->priv->ref_count++;
1634 }
1635 
1636 void
exif_data_unref(ExifData * data)1637 exif_data_unref (ExifData *data)
1638 {
1639 	if (!data || !data->priv)
1640 		return;
1641 
1642 	data->priv->ref_count--;
1643 	if (!data->priv->ref_count)
1644 		exif_data_free (data);
1645 }
1646 
1647 void
exif_data_free(ExifData * data)1648 exif_data_free (ExifData *data)
1649 {
1650 	unsigned int i;
1651 	ExifMem *mem = (data && data->priv) ? data->priv->mem : NULL;
1652 
1653 	if (!data)
1654 		return;
1655 
1656 	for (i = 0; i < EXIF_IFD_COUNT; i++) {
1657 		if (data->ifd[i]) {
1658 			exif_content_unref (data->ifd[i]);
1659 			data->ifd[i] = NULL;
1660 		}
1661 	}
1662 
1663 	if (data->data) {
1664 		exif_mem_free (mem, data->data);
1665 		data->data = NULL;
1666 	}
1667 
1668 	if (data->priv) {
1669 		if (data->priv->log) {
1670 			exif_log_unref (data->priv->log);
1671 			data->priv->log = NULL;
1672 		}
1673 		if (data->priv->md) {
1674 			exif_mnote_data_unref (data->priv->md);
1675 			data->priv->md = NULL;
1676 		}
1677 		exif_mem_free (mem, data->priv);
1678 		exif_mem_free (mem, data);
1679 	}
1680 
1681 	exif_mem_unref (mem);
1682 }
1683 
1684 void
exif_data_dump(ExifData * data)1685 exif_data_dump (ExifData *data)
1686 {
1687 	unsigned int i;
1688 
1689 	if (!data)
1690 		return;
1691 
1692 	for (i = 0; i < EXIF_IFD_COUNT; i++) {
1693 		if (data->ifd[i] && data->ifd[i]->count) {
1694 			printf ("Dumping IFD '%s'...\n",
1695 				exif_ifd_get_name (i));
1696 			exif_content_dump (data->ifd[i], 0);
1697 		}
1698 	}
1699 
1700 	if (data->data) {
1701 		printf ("%i byte(s) thumbnail data available: ", data->size);
1702 		if (data->size >= 4) {
1703 			printf ("0x%02x 0x%02x ... 0x%02x 0x%02x\n",
1704 				data->data[0], data->data[1],
1705 				data->data[data->size - 2],
1706 				data->data[data->size - 1]);
1707 		}
1708 	}
1709 }
1710 
1711 ExifByteOrder
exif_data_get_byte_order(ExifData * data)1712 exif_data_get_byte_order (ExifData *data)
1713 {
1714 	if (!data)
1715 		return (0);
1716 
1717 	return (data->priv->order);
1718 }
1719 
1720 void
exif_data_foreach_content(ExifData * data,ExifDataForeachContentFunc func,void * user_data)1721 exif_data_foreach_content (ExifData *data, ExifDataForeachContentFunc func,
1722 			   void *user_data)
1723 {
1724 	unsigned int i;
1725 
1726 	if (!data || !func)
1727 		return;
1728 
1729 	for (i = 0; i < EXIF_IFD_COUNT; i++)
1730 		func (data->ifd[i], user_data);
1731 }
1732 
1733 typedef struct _ByteOrderChangeData ByteOrderChangeData;
1734 struct _ByteOrderChangeData {
1735 	ExifByteOrder old, new;
1736 };
1737 
1738 static void
entry_set_byte_order(ExifEntry * e,void * data)1739 entry_set_byte_order (ExifEntry *e, void *data)
1740 {
1741 	ByteOrderChangeData *d = data;
1742 
1743 	if (!e)
1744 		return;
1745 
1746 	exif_array_set_byte_order (e->format, e->data, e->components, d->old, d->new);
1747 }
1748 
1749 static void
content_set_byte_order(ExifContent * content,void * data)1750 content_set_byte_order (ExifContent *content, void *data)
1751 {
1752 	exif_content_foreach_entry (content, entry_set_byte_order, data);
1753 }
1754 
1755 void
exif_data_set_byte_order(ExifData * data,ExifByteOrder order)1756 exif_data_set_byte_order (ExifData *data, ExifByteOrder order)
1757 {
1758 	ByteOrderChangeData d;
1759 
1760 	if (!data || (order == data->priv->order))
1761 		return;
1762 
1763 	d.old = data->priv->order;
1764 	d.new = order;
1765 	exif_data_foreach_content (data, content_set_byte_order, &d);
1766 	data->priv->order = order;
1767 	if (data->priv->md)
1768 		exif_mnote_data_set_byte_order (data->priv->md, order);
1769 }
1770 
1771 void
exif_data_log(ExifData * data,ExifLog * log)1772 exif_data_log (ExifData *data, ExifLog *log)
1773 {
1774 	unsigned int i;
1775 
1776 	if (!data || !data->priv)
1777 		return;
1778 	exif_log_unref (data->priv->log);
1779 	data->priv->log = log;
1780 	exif_log_ref (log);
1781 
1782 	for (i = 0; i < EXIF_IFD_COUNT; i++)
1783 		exif_content_log (data->ifd[i], log);
1784 }
1785 
1786 /* Used internally within libexif */
1787 ExifLog *exif_data_get_log (ExifData *);
1788 ExifLog *
exif_data_get_log(ExifData * data)1789 exif_data_get_log (ExifData *data)
1790 {
1791 	if (!data || !data->priv)
1792 		return NULL;
1793 	return data->priv->log;
1794 }
1795 
1796 static const struct {
1797 	ExifDataOption option;
1798 	const char *name;
1799 	const char *description;
1800 } exif_data_option[] = {
1801 	{EXIF_DATA_OPTION_IGNORE_UNKNOWN_TAGS, N_("Ignore unknown tags"),
1802 	 N_("Ignore unknown tags when loading EXIF data.")},
1803 	{EXIF_DATA_OPTION_FOLLOW_SPECIFICATION, N_("Follow specification"),
1804 	 N_("Add, correct and remove entries to get EXIF data that follows "
1805 	    "the specification.")},
1806 	{EXIF_DATA_OPTION_DONT_CHANGE_MAKER_NOTE, N_("Do not change maker note"),
1807 	 N_("When loading and resaving Exif data, save the maker note unmodified."
1808 	    " Be aware that the maker note can get corrupted.")},
1809 	{0, NULL, NULL}
1810 };
1811 
1812 const char *
exif_data_option_get_name(ExifDataOption o)1813 exif_data_option_get_name (ExifDataOption o)
1814 {
1815 	unsigned int i;
1816 
1817 	for (i = 0; exif_data_option[i].name; i++)
1818 		if (exif_data_option[i].option == o)
1819 			break;
1820 	return _(exif_data_option[i].name);
1821 }
1822 
1823 const char *
exif_data_option_get_description(ExifDataOption o)1824 exif_data_option_get_description (ExifDataOption o)
1825 {
1826 	unsigned int i;
1827 
1828 	for (i = 0; exif_data_option[i].description; i++)
1829 		if (exif_data_option[i].option == o)
1830 			break;
1831 	return _(exif_data_option[i].description);
1832 }
1833 
1834 void
exif_data_set_option(ExifData * d,ExifDataOption o)1835 exif_data_set_option (ExifData *d, ExifDataOption o)
1836 {
1837 	if (!d)
1838 		return;
1839 
1840 	d->priv->options |= o;
1841 }
1842 
1843 void
exif_data_unset_option(ExifData * d,ExifDataOption o)1844 exif_data_unset_option (ExifData *d, ExifDataOption o)
1845 {
1846 	if (!d)
1847 		return;
1848 
1849 	d->priv->options &= ~o;
1850 }
1851 
1852 static void
fix_func(ExifContent * c,void * UNUSED (data))1853 fix_func (ExifContent *c, void *UNUSED(data))
1854 {
1855 	switch (exif_content_get_ifd (c)) {
1856 	case EXIF_IFD_1:
1857 		if (c->parent->data)
1858 			exif_content_fix (c);
1859 		else if (c->count) {
1860 			exif_log (c->parent->priv->log, EXIF_LOG_CODE_DEBUG, "exif-data",
1861 				  "No thumbnail but entries on thumbnail. These entries have been "
1862 				  "removed.");
1863 			while (c->count) {
1864 				unsigned int cnt = c->count;
1865 				exif_content_remove_entry (c, c->entries[c->count - 1]);
1866 				if (cnt == c->count) {
1867 					/* safety net */
1868 					exif_log (c->parent->priv->log, EXIF_LOG_CODE_DEBUG, "exif-data",
1869 					"failed to remove last entry from entries.");
1870 					c->count--;
1871 				}
1872 			}
1873 		}
1874 		break;
1875 	default:
1876 		exif_content_fix (c);
1877 	}
1878 }
1879 
1880 void
exif_data_fix(ExifData * d)1881 exif_data_fix (ExifData *d)
1882 {
1883 	exif_data_foreach_content (d, fix_func, NULL);
1884 }
1885 
1886 void
exif_data_set_data_type(ExifData * d,ExifDataType dt)1887 exif_data_set_data_type (ExifData *d, ExifDataType dt)
1888 {
1889 	if (!d || !d->priv)
1890 		return;
1891 
1892 	d->priv->data_type = dt;
1893 }
1894 
1895 ExifDataType
exif_data_get_data_type(ExifData * d)1896 exif_data_get_data_type (ExifData *d)
1897 {
1898 	return (d && d->priv) ? d->priv->data_type : EXIF_DATA_TYPE_UNKNOWN;
1899 }
1900