16-bit Grayscale TIFF Load Failures Due to Buffer Underflow and Endian'ness (Patch #2601)

The TiffDecoder class incorrectly uses the LibTiff function TIFFGetField(). When trying to load a 16-bit grayscale TIFF image on Solaris 10 (SPARC), two methods of the TiffDecoder class that use LibTiff's TIFFGetField() function are implemented inappropriately. The data variable that is to be filled-in with TIFFGetField() function must point to an appropriately sized storage buffer. The implementation of TiffDecoder::readHeader() and TiffDecoder::readData() incorrectly use a pointer to an int in all places. This is not correct usage of LibTiff.

Different TIFF field values have various storage requirements - some being uint16 and others being uint32. For example the image width and height fields are uint32 values, whereas the bits-per-sample is a uint16. By using a normal int for all values retrieved, differing behavior is possible depending on the target environment's Big-Endian vs. Little-Endian status. If you pass a pointer to a 32-bit int into TIFFGetField() for the bits-per-sample value, only 16-bits of actual data will be copied to the target memory location. Depending on the Endian'ness, it could be the most-significant or least-significant bytes of the target that get filled. If you're trying to read a 16-bit grayscale (bpp=0x0010) image on the wrong target, then your BPP value will actually be 0x00100000, which will not be recognized by OpenCV as a valid BPP setting, and will load the file incorrectly.

To correct this issue, appropriate variable types must be used depending on the required sizeof() for which TIFF field being retrieved.

The repaired defect is isolated to two methods of TiffDecoder, and are implemented in the file attached to this Patch Issue (e.g., "modules/highgui/src/grfmt_tiff.cpp").