V4: Prevent negative allocation attempt for huge TIFF files

src/ImageSharp/Formats/Tiff/Compression/TiffBaseDecompressor.cs

@@ -28,20 +28,20 @@ protected TiffBaseDecompressor(MemoryAllocator memoryAllocator, int width, int b
     /// Decompresses image data into the supplied buffer.
     /// </summary>
     /// <param name="stream">The <see cref="Stream" /> to read image data from.</param>
-    /// <param name="stripOffset">The strip offset of stream.</param>
-    /// <param name="stripByteCount">The number of bytes to read from the input stream.</param>
+    /// <param name="offset">The data offset within the stream.</param>
+    /// <param name="count">The number of bytes to read from the input stream.</param>
     /// <param name="stripHeight">The height of the strip.</param>
     /// <param name="buffer">The output buffer for uncompressed data.</param>
     /// <param name="cancellationToken">The token to monitor cancellation.</param>
-    public void Decompress(BufferedReadStream stream, ulong stripOffset, ulong stripByteCount, int stripHeight, Span<byte> buffer, CancellationToken cancellationToken)
+    public void Decompress(BufferedReadStream stream, ulong offset, ulong count, int stripHeight, Span<byte> buffer, CancellationToken cancellationToken)
     {
-        DebugGuard.MustBeLessThanOrEqualTo(stripOffset, (ulong)long.MaxValue, nameof(stripOffset));
-        DebugGuard.MustBeLessThanOrEqualTo(stripByteCount, (ulong)long.MaxValue, nameof(stripByteCount));
+        DebugGuard.MustBeLessThanOrEqualTo(offset, (ulong)long.MaxValue, nameof(offset));
+        DebugGuard.MustBeLessThanOrEqualTo(count, (ulong)int.MaxValue, nameof(count));
 
-        stream.Seek((long)stripOffset, SeekOrigin.Begin);
-        this.Decompress(stream, (int)stripByteCount, stripHeight, buffer, cancellationToken);
+        stream.Seek((long)offset, SeekOrigin.Begin);
+        this.Decompress(stream, (int)count, stripHeight, buffer, cancellationToken);
 
-        if ((long)stripOffset + (long)stripByteCount < stream.Position)
+        if ((long)offset + (long)count < stream.Position)
         {
             TiffThrowHelper.ThrowImageFormatException("Out of range when reading a strip.");
         }

src/ImageSharp/Formats/Tiff/TiffDecoderCore.cs

@@ -5,6 +5,7 @@
 using System.Buffers;
 using System.Runtime.CompilerServices;
 using SixLabors.ImageSharp.Formats.Tiff.Compression;
+using SixLabors.ImageSharp.Formats.Tiff.Compression.Decompressors;
 using SixLabors.ImageSharp.Formats.Tiff.Constants;
 using SixLabors.ImageSharp.Formats.Tiff.PhotometricInterpretation;
 using SixLabors.ImageSharp.IO;
@@ -441,8 +442,14 @@ private void DecodeStripsPlanar<TPixel>(
         {
             for (int stripIndex = 0; stripIndex < stripBuffers.Length; stripIndex++)
             {
-                int uncompressedStripSize = this.CalculateStripBufferSize(width, rowsPerStrip, stripIndex);
-                stripBuffers[stripIndex] = this.memoryAllocator.Allocate<byte>(uncompressedStripSize);
+                ulong uncompressedStripSize = this.CalculateStripBufferSize(width, rowsPerStrip, stripIndex);
+
+                if (uncompressedStripSize > int.MaxValue)
+                {
+                    TiffThrowHelper.ThrowNotSupported("Strips larger than Int32.MaxValue bytes are not supported for compressed images.");
+                }
+
+                stripBuffers[stripIndex] = this.memoryAllocator.Allocate<byte>((int)uncompressedStripSize);
             }
 
             using TiffBaseDecompressor decompressor = this.CreateDecompressor<TPixel>(width, bitsPerPixel, frame.Metadata);
@@ -507,15 +514,83 @@ private void DecodeStripsChunky<TPixel>(
             rowsPerStrip = height;
         }
 
-        int uncompressedStripSize = this.CalculateStripBufferSize(width, rowsPerStrip);
+        ulong uncompressedStripSize = this.CalculateStripBufferSize(width, rowsPerStrip);
         int bitsPerPixel = this.BitsPerPixel;
 
-        using IMemoryOwner<byte> stripBuffer = this.memoryAllocator.Allocate<byte>(uncompressedStripSize, AllocationOptions.Clean);
-        Span<byte> stripBufferSpan = stripBuffer.GetSpan();
-        Buffer2D<TPixel> pixels = frame.PixelBuffer;
-
         using TiffBaseDecompressor decompressor = this.CreateDecompressor<TPixel>(width, bitsPerPixel, frame.Metadata);
         TiffBaseColorDecoder<TPixel> colorDecoder = this.CreateChunkyColorDecoder<TPixel>();
+        Buffer2D<TPixel> pixels = frame.PixelBuffer;
+
+        // There exists in this world TIFF files with uncompressed strips larger than Int32.MaxValue.
+        // We can read them, but we cannot allocate a buffer that large to hold the uncompressed data.
+        // In this scenario we fall back to reading and decoding one row at a time.
+        //
+        // The NoneTiffCompression decompressor can be used to read individual rows since we have
+        // a guarantee that each row required the same number of bytes.
+        if (decompressor is NoneTiffCompression none && uncompressedStripSize > int.MaxValue)
+        {
+            ulong bytesPerRowU = this.CalculateStripBufferSize(width, 1);
+
+            // This should never happen, but we check just to be sure.
+            if (bytesPerRowU > int.MaxValue)
+            {
+                TiffThrowHelper.ThrowNotSupported("Strips larger than Int32.MaxValue bytes are not supported for compressed images.");
+            }
+
+            int bytesPerRow = (int)bytesPerRowU;
+            using IMemoryOwner<byte> rowBufferOwner = this.memoryAllocator.Allocate<byte>(bytesPerRow, AllocationOptions.Clean);
+            Span<byte> rowBuffer = rowBufferOwner.GetSpan();
+            for (int stripIndex = 0; stripIndex < stripOffsets.Length; stripIndex++)
+            {
+                cancellationToken.ThrowIfCancellationRequested();
+
+                int stripHeight = stripIndex < stripOffsets.Length - 1 || height % rowsPerStrip == 0
+                    ? rowsPerStrip
+                    : height % rowsPerStrip;
+
+                int top = rowsPerStrip * stripIndex;
+                if (top + stripHeight > height)
+                {
+                    break;
+                }
+
+                ulong baseOffset = stripOffsets[stripIndex];
+                ulong available = stripByteCounts[stripIndex];
+                ulong required = (ulong)bytesPerRow * (ulong)stripHeight;
+                if (available < required)
+                {
+                    break;
+                }
+
+                for (int r = 0; r < stripHeight; r++)
+                {
+                    cancellationToken.ThrowIfCancellationRequested();
+
+                    ulong rowOffset = baseOffset + ((ulong)r * (ulong)bytesPerRow);
+
+                    // Use the NoneTiffCompression decompressor to read exactly one row.
+                    none.Decompress(
+                        this.inputStream,
+                        rowOffset,
+                        (ulong)bytesPerRow,
+                        1,
+                        rowBuffer,
+                        cancellationToken);
+
+                    colorDecoder.Decode(rowBuffer, pixels, 0, top + r, width, 1);
+                }
+            }
+
+            return;
+        }
+
+        if (uncompressedStripSize > int.MaxValue)
+        {
+            TiffThrowHelper.ThrowNotSupported("Strips larger than Int32.MaxValue bytes are not supported for compressed images.");
+        }
+
+        using IMemoryOwner<byte> stripBuffer = this.memoryAllocator.Allocate<byte>((int)uncompressedStripSize, AllocationOptions.Clean);
+        Span<byte> stripBufferSpan = stripBuffer.GetSpan();
 
         for (int stripIndex = 0; stripIndex < stripOffsets.Length; stripIndex++)
         {
@@ -808,7 +883,7 @@ private IMemoryOwner<ulong> ConvertNumbers(Array array, out Span<ulong> span)
     /// <param name="height">The height for the desired pixel buffer.</param>
     /// <param name="plane">The index of the plane for planar image configuration (or zero for chunky).</param>
     /// <returns>The size (in bytes) of the required pixel buffer.</returns>
-    private int CalculateStripBufferSize(int width, int height, int plane = -1)
+    private ulong CalculateStripBufferSize(int width, int height, int plane = -1)
     {
         DebugGuard.MustBeLessThanOrEqualTo(plane, 3, nameof(plane));
 
@@ -841,8 +916,8 @@ private int CalculateStripBufferSize(int width, int height, int plane = -1)
             }
         }
 
-        int bytesPerRow = ((width * bitsPerPixel) + 7) / 8;
-        return bytesPerRow * height;
+        ulong bytesPerRow = (((ulong)width * (ulong)bitsPerPixel) + 7) / 8;
+        return bytesPerRow * (ulong)height;
     }
 
     [MethodImpl(MethodImplOptions.AggressiveInlining)]