--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/mupdf-source/source/fitz/load-tiff.c	Mon Sep 15 11:43:07 2025 +0200
@@ -0,0 +1,1789 @@
+// Copyright (C) 2004-2025 Artifex Software, Inc.
+//
+// This file is part of MuPDF.
+//
+// MuPDF is free software: you can redistribute it and/or modify it under the
+// terms of the GNU Affero General Public License as published by the Free
+// Software Foundation, either version 3 of the License, or (at your option)
+// any later version.
+//
+// MuPDF is distributed in the hope that it will be useful, but WITHOUT ANY
+// WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+// FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
+// details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with MuPDF. If not, see <https://www.gnu.org/licenses/agpl-3.0.en.html>
+//
+// Alternative licensing terms are available from the licensor.
+// For commercial licensing, see <https://www.artifex.com/> or contact
+// Artifex Software, Inc., 39 Mesa Street, Suite 108A, San Francisco,
+// CA 94129, USA, for further information.
+
+#include "mupdf/fitz.h"
+
+#include "pixmap-imp.h"
+
+#include <limits.h>
+#include <assert.h>
+#include <string.h>
+
+/*
+ * TIFF image loader. Should be enough to support TIFF files in XPS.
+ * Baseline TIFF 6.0 plus CMYK, LZW, Flate and JPEG support.
+ * Limited bit depths (1,2,4,8).
+ * Limited planar configurations (1=chunky).
+ * TODO: RGBPal images
+ */
+
+struct tiff
+{
+	/* "file" */
+	const unsigned char *bp, *rp, *ep;
+
+	/* byte order */
+	unsigned order;
+
+	/* offset of first ifd */
+	unsigned *ifd_offsets;
+	int ifds;
+
+	/* where we can find the strips of image data */
+	unsigned rowsperstrip;
+	unsigned *stripoffsets;
+	unsigned *stripbytecounts;
+	unsigned stripoffsetslen;
+	unsigned stripbytecountslen;
+	unsigned maxstrips;
+
+	/* where we can find the tiles of image data */
+	unsigned tilelength;
+	unsigned tilewidth;
+	unsigned *tileoffsets;
+	unsigned *tilebytecounts;
+	unsigned tileoffsetslen;
+	unsigned tilebytecountslen;
+	unsigned maxtiles;
+
+	/* colormap */
+	unsigned *colormap;
+	unsigned colormaplen;
+	unsigned maxcolors;
+
+	/* assorted tags */
+	unsigned subfiletype;
+	unsigned photometric;
+	unsigned compression;
+	unsigned imagewidth;
+	unsigned imagelength;
+	unsigned samplesperpixel;
+	unsigned bitspersample;
+	unsigned planar;
+	unsigned extrasamples;
+	unsigned xresolution;
+	unsigned yresolution;
+	unsigned resolutionunit;
+	unsigned fillorder;
+	unsigned g3opts;
+	unsigned g4opts;
+	unsigned predictor;
+
+	unsigned ycbcrsubsamp[2];
+
+	const unsigned char *jpegtables; /* point into "file" buffer */
+	unsigned jpegtableslen;
+	unsigned jpegofs;
+	unsigned jpeglen;
+
+	unsigned char *profile;
+	int profilesize;
+
+	/* decoded data */
+	fz_colorspace *colorspace;
+	unsigned char *samples;
+	unsigned char *data;
+	int tilestride;
+	int stride;
+};
+
+enum
+{
+	TII = 0x4949, /* 'II' */
+	TMM = 0x4d4d, /* 'MM' */
+	TBYTE = 1,
+	TASCII = 2,
+	TSHORT = 3,
+	TLONG = 4,
+	TRATIONAL = 5
+};
+
+#define NewSubfileType 254
+#define ImageWidth 256
+#define ImageLength 257
+#define BitsPerSample 258
+#define Compression 259
+#define PhotometricInterpretation 262
+#define FillOrder 266
+#define StripOffsets 273
+#define SamplesPerPixel 277
+#define RowsPerStrip 278
+#define StripByteCounts 279
+#define XResolution 282
+#define YResolution 283
+#define PlanarConfiguration 284
+#define T4Options 292
+#define T6Options 293
+#define ResolutionUnit 296
+#define Predictor 317
+#define ColorMap 320
+#define TileWidth 322
+#define TileLength 323
+#define TileOffsets 324
+#define TileByteCounts 325
+#define ExtraSamples 338
+#define JPEGTables 347
+#define JPEGInterchangeFormat 513
+#define JPEGInterchangeFormatLength 514
+#define YCbCrSubSampling 530
+#define ICCProfile 34675
+
+static const unsigned char bitrev[256] =
+{
+	0x00, 0x80, 0x40, 0xc0, 0x20, 0xa0, 0x60, 0xe0,
+	0x10, 0x90, 0x50, 0xd0, 0x30, 0xb0, 0x70, 0xf0,
+	0x08, 0x88, 0x48, 0xc8, 0x28, 0xa8, 0x68, 0xe8,
+	0x18, 0x98, 0x58, 0xd8, 0x38, 0xb8, 0x78, 0xf8,
+	0x04, 0x84, 0x44, 0xc4, 0x24, 0xa4, 0x64, 0xe4,
+	0x14, 0x94, 0x54, 0xd4, 0x34, 0xb4, 0x74, 0xf4,
+	0x0c, 0x8c, 0x4c, 0xcc, 0x2c, 0xac, 0x6c, 0xec,
+	0x1c, 0x9c, 0x5c, 0xdc, 0x3c, 0xbc, 0x7c, 0xfc,
+	0x02, 0x82, 0x42, 0xc2, 0x22, 0xa2, 0x62, 0xe2,
+	0x12, 0x92, 0x52, 0xd2, 0x32, 0xb2, 0x72, 0xf2,
+	0x0a, 0x8a, 0x4a, 0xca, 0x2a, 0xaa, 0x6a, 0xea,
+	0x1a, 0x9a, 0x5a, 0xda, 0x3a, 0xba, 0x7a, 0xfa,
+	0x06, 0x86, 0x46, 0xc6, 0x26, 0xa6, 0x66, 0xe6,
+	0x16, 0x96, 0x56, 0xd6, 0x36, 0xb6, 0x76, 0xf6,
+	0x0e, 0x8e, 0x4e, 0xce, 0x2e, 0xae, 0x6e, 0xee,
+	0x1e, 0x9e, 0x5e, 0xde, 0x3e, 0xbe, 0x7e, 0xfe,
+	0x01, 0x81, 0x41, 0xc1, 0x21, 0xa1, 0x61, 0xe1,
+	0x11, 0x91, 0x51, 0xd1, 0x31, 0xb1, 0x71, 0xf1,
+	0x09, 0x89, 0x49, 0xc9, 0x29, 0xa9, 0x69, 0xe9,
+	0x19, 0x99, 0x59, 0xd9, 0x39, 0xb9, 0x79, 0xf9,
+	0x05, 0x85, 0x45, 0xc5, 0x25, 0xa5, 0x65, 0xe5,
+	0x15, 0x95, 0x55, 0xd5, 0x35, 0xb5, 0x75, 0xf5,
+	0x0d, 0x8d, 0x4d, 0xcd, 0x2d, 0xad, 0x6d, 0xed,
+	0x1d, 0x9d, 0x5d, 0xdd, 0x3d, 0xbd, 0x7d, 0xfd,
+	0x03, 0x83, 0x43, 0xc3, 0x23, 0xa3, 0x63, 0xe3,
+	0x13, 0x93, 0x53, 0xd3, 0x33, 0xb3, 0x73, 0xf3,
+	0x0b, 0x8b, 0x4b, 0xcb, 0x2b, 0xab, 0x6b, 0xeb,
+	0x1b, 0x9b, 0x5b, 0xdb, 0x3b, 0xbb, 0x7b, 0xfb,
+	0x07, 0x87, 0x47, 0xc7, 0x27, 0xa7, 0x67, 0xe7,
+	0x17, 0x97, 0x57, 0xd7, 0x37, 0xb7, 0x77, 0xf7,
+	0x0f, 0x8f, 0x4f, 0xcf, 0x2f, 0xaf, 0x6f, 0xef,
+	0x1f, 0x9f, 0x5f, 0xdf, 0x3f, 0xbf, 0x7f, 0xff
+};
+
+/* coverity[ +tainted_data_sanitize ] */
+static inline int tiff_getcomp(unsigned char *line, int x, int bpc)
+{
+	switch (bpc)
+	{
+	case 1: return (line[x >> 3] >> ( 7 - (x & 7) ) ) & 1;
+	case 2: return (line[x >> 2] >> ( ( 3 - (x & 3) ) << 1 ) ) & 3;
+	case 4: return (line[x >> 1] >> ( ( 1 - (x & 1) ) << 2 ) ) & 15;
+	case 8: return line[x];
+	case 16: return line[x << 1] << 8 | line[(x << 1) + 1];
+	}
+	return 0;
+}
+
+static inline void tiff_putcomp(unsigned char *line, int x, int bpc, int value)
+{
+	int maxval = (1 << bpc) - 1;
+
+	switch (bpc)
+	{
+	case 1: line[x >> 3] &= ~(maxval << (7 - (x & 7))); break;
+	case 2: line[x >> 2] &= ~(maxval << ((3 - (x & 3)) << 1)); break;
+	case 4: line[x >> 1] &= ~(maxval << ((1 - (x & 1)) << 2)); break;
+	}
+
+	switch (bpc)
+	{
+	case 1: line[x >> 3] |= value << (7 - (x & 7)); break;
+	case 2: line[x >> 2] |= value << ((3 - (x & 3)) << 1); break;
+	case 4: line[x >> 1] |= value << ((1 - (x & 1)) << 2); break;
+	case 8: line[x] = value; break;
+	case 16: line[x << 1] = value >> 8; line[(x << 1) + 1] = value & 0xFF; break;
+	}
+}
+
+static void
+tiff_unpredict_line(unsigned char *line, int width, int comps, int bits)
+{
+	unsigned char left[FZ_MAX_COLORS];
+	int i, k, v;
+
+	for (k = 0; k < comps; k++)
+		left[k] = 0;
+
+	for (i = 0; i < width; i++)
+	{
+		for (k = 0; k < comps; k++)
+		{
+			v = tiff_getcomp(line, i * comps + k, bits);
+			v = v + left[k];
+			v = v % (1 << bits);
+			tiff_putcomp(line, i * comps + k, bits, v);
+			left[k] = v;
+		}
+	}
+}
+
+static void
+tiff_invert_line(unsigned char *line, int width, int comps, int bits, int alpha)
+{
+	int i, k, v;
+	int m = (1 << bits) - 1;
+
+	for (i = 0; i < width; i++)
+	{
+		for (k = 0; k < comps; k++)
+		{
+			v = tiff_getcomp(line, i * comps + k, bits);
+			if (!alpha || k < comps - 1)
+				v = m - v;
+			tiff_putcomp(line, i * comps + k, bits, v);
+		}
+	}
+}
+
+static void
+tiff_expand_colormap(fz_context *ctx, struct tiff *tiff)
+{
+	int maxval = 1 << tiff->bitspersample;
+	unsigned char *samples;
+	unsigned char *src, *dst;
+	unsigned int x, y;
+	unsigned int stride;
+	unsigned int srcstride;
+
+	/* colormap has first all red, then all green, then all blue values */
+	/* colormap values are 0..65535, bits is 4 or 8 */
+	/* image can be with or without extrasamples: comps is 1 or 2 */
+
+	if (!(tiff->samplesperpixel == 1 && tiff->extrasamples == 0) && !(tiff->samplesperpixel == 2 && tiff->extrasamples))
+		fz_throw(ctx, FZ_ERROR_FORMAT, "invalid number of samples for RGBPal");
+
+	if (tiff->bitspersample != 1 && tiff->bitspersample != 2 && tiff->bitspersample != 4 && tiff->bitspersample != 8 && tiff->bitspersample != 16)
+		fz_throw(ctx, FZ_ERROR_FORMAT, "invalid number of bits for RGBPal");
+
+	if (tiff->colormaplen < (unsigned)maxval * 3)
+		fz_throw(ctx, FZ_ERROR_FORMAT, "insufficient colormap data");
+
+	if (tiff->imagelength > UINT_MAX / tiff->imagewidth / (tiff->samplesperpixel + 2))
+		fz_throw(ctx, FZ_ERROR_LIMIT, "image too large");
+
+	srcstride = (tiff->imagewidth * (1 + tiff->extrasamples) * tiff->bitspersample + 7) / 8;
+	if (tiff->stride < 0 || srcstride > (unsigned int)tiff->stride)
+		fz_throw(ctx, FZ_ERROR_FORMAT, "insufficient data for format");
+
+	/* Multiplying by two at the end because each component value in the
+	   colormap is 16 bits wide. */
+	stride = tiff->imagewidth * (3 + !!tiff->extrasamples) * 2;
+
+	samples = Memento_label(fz_malloc(ctx, (size_t)stride * tiff->imagelength), "tiff_samples");
+
+	for (y = 0; y < tiff->imagelength; y++)
+	{
+		int s = 0;
+		src = tiff->samples + (unsigned int)(tiff->stride * y);
+		dst = samples + (unsigned int)(stride * y);
+
+		for (x = 0; x < tiff->imagewidth; x++)
+		{
+			int c = tiff_getcomp(src, s++, tiff->bitspersample);
+			*dst++ = tiff->colormap[c + 0] >> 8;
+			*dst++ = tiff->colormap[c + 0];
+			*dst++ = tiff->colormap[c + maxval] >> 8;
+			*dst++ = tiff->colormap[c + maxval];
+			*dst++ = tiff->colormap[c + maxval * 2] >> 8;
+			*dst++ = tiff->colormap[c + maxval * 2];
+			if (tiff->extrasamples)
+			{
+				/* Assume the first is alpha, and skip the rest. */
+				int a = tiff_getcomp(src, s++, tiff->bitspersample);
+				if (tiff->bitspersample <= 16)
+					a = a << (16 - tiff->bitspersample);
+				else
+					a = a >> (tiff->bitspersample - 16);
+				*dst++ = a >> 8;
+				*dst++ = a;
+				s += tiff->extrasamples-1;
+			}
+		}
+	}
+
+	tiff->samplesperpixel += 2;
+	tiff->bitspersample = 16;
+	tiff->stride = stride;
+	fz_free(ctx, tiff->samples);
+	tiff->samples = samples;
+}
+
+static unsigned
+tiff_decode_data(fz_context *ctx, struct tiff *tiff, const unsigned char *rp, unsigned int rlen, unsigned char *wp, unsigned int wlen)
+{
+	fz_stream *encstm = NULL;
+	fz_stream *stm = NULL;
+	unsigned i, size = 0;
+	unsigned char *reversed = NULL;
+	fz_stream *jpegtables = NULL;
+	int old_tiff;
+
+	if (rp + rlen > tiff->ep)
+		fz_throw(ctx, FZ_ERROR_FORMAT, "strip extends beyond the end of the file");
+
+	/* the bits are in un-natural order */
+	if (tiff->fillorder == 2)
+	{
+		reversed = fz_malloc(ctx, rlen);
+		for (i = 0; i < rlen; i++)
+			reversed[i] = bitrev[rp[i]];
+		rp = reversed;
+	}
+
+	fz_var(jpegtables);
+	fz_var(encstm);
+	fz_var(stm);
+
+	fz_try(ctx)
+	{
+		encstm = fz_open_memory(ctx, rp, rlen);
+
+		/* switch on compression to create a filter */
+		/* feed each chunk (strip or tile) to the filter */
+		/* read out the data into a buffer */
+		/* the level above packs the chunk's samples into a pixmap */
+
+		/* type 32773 / packbits -- nothing special (same row-padding as PDF) */
+		/* type 2 / ccitt rle -- no EOL, no RTC, rows are byte-aligned */
+		/* type 3 and 4 / g3 and g4 -- each strip starts new section */
+		/* type 5 / lzw -- each strip is handled separately */
+
+		switch (tiff->compression)
+		{
+		case 1:
+			/* stm already open and reading uncompressed data */
+			stm = fz_keep_stream(ctx, encstm);
+			break;
+		case 2:
+		case 3:
+		case 4:
+			stm = fz_open_faxd(ctx, encstm,
+					tiff->compression == 4 ? -1 :
+					tiff->compression == 2 ? 0 :
+					(int) (tiff->g3opts & 1),
+					0,
+					tiff->compression == 2,
+					tiff->imagewidth,
+					tiff->imagelength,
+					0,
+					1);
+			break;
+		case 5:
+			old_tiff = rp[0] == 0 && (rp[1] & 1);
+			stm = fz_open_lzwd(ctx, encstm, old_tiff ? 0 : 1, 9, old_tiff ? 1 : 0, old_tiff);
+			break;
+		case 6:
+			fz_warn(ctx, "deprecated JPEG in TIFF compression not fully supported");
+			/* fall through */
+		case 7:
+			if (tiff->jpegtables && (int)tiff->jpegtableslen > 0)
+				jpegtables = fz_open_memory(ctx, tiff->jpegtables, tiff->jpegtableslen);
+
+			stm = fz_open_dctd(ctx, encstm,
+					tiff->photometric == 2 || tiff->photometric == 3 ? 0 : -1,
+					1,
+					0,
+					jpegtables);
+			break;
+		case 8:
+		case 32946:
+			stm = fz_open_flated(ctx, encstm, 15);
+			break;
+		case 32773:
+			stm = fz_open_rld(ctx, encstm);
+			break;
+		case 34676:
+			if (tiff->photometric == 32845)
+				stm = fz_open_sgilog32(ctx, encstm, tiff->imagewidth);
+			else
+				stm = fz_open_sgilog16(ctx, encstm, tiff->imagewidth);
+			break;
+		case 34677:
+			stm = fz_open_sgilog24(ctx, encstm, tiff->imagewidth);
+			break;
+		case 32809:
+			if (tiff->bitspersample != 4)
+				fz_throw(ctx, FZ_ERROR_FORMAT, "invalid bits per pixel in thunder encoding");
+			stm = fz_open_thunder(ctx, encstm, tiff->imagewidth);
+			break;
+		default:
+			fz_throw(ctx, FZ_ERROR_FORMAT, "unknown TIFF compression: %d", tiff->compression);
+		}
+
+		size = (unsigned)fz_read(ctx, stm, wp, wlen);
+	}
+	fz_always(ctx)
+	{
+		fz_drop_stream(ctx, jpegtables);
+		fz_drop_stream(ctx, encstm);
+		fz_drop_stream(ctx, stm);
+		fz_free(ctx, reversed);
+	}
+	fz_catch(ctx)
+		fz_rethrow(ctx);
+
+	return size;
+}
+
+static void
+tiff_paste_tile(fz_context *ctx, struct tiff *tiff, unsigned char *tile, unsigned int row, unsigned int col)
+{
+	unsigned int x, y, k;
+
+	for (y = 0; y < tiff->tilelength && row + y < tiff->imagelength; y++)
+	{
+		for (x = 0; x < tiff->tilewidth && col + x < tiff->imagewidth; x++)
+		{
+			for (k = 0; k < tiff->samplesperpixel; k++)
+			{
+				unsigned char *dst, *src;
+				unsigned shift;
+
+				dst = tiff->samples;
+				dst += (row + y) * tiff->stride;
+				dst += (((col + x) * tiff->samplesperpixel + k) * tiff->bitspersample) / 8;
+				shift = 8 - ((((col + x) * tiff->samplesperpixel + k) * tiff->bitspersample) % 8) - tiff->bitspersample;
+
+				src = tile;
+				src += y * tiff->tilestride;
+				src += ((x * tiff->samplesperpixel + k) * tiff->bitspersample) / 8;
+
+				switch (tiff->bitspersample)
+				{
+				case 1: *dst |= ((*src >> (7 - 1 * ((col + x) % 8))) & 0x1) << shift; break;
+				case 2: *dst |= ((*src >> (6 - 2 * ((col + x) % 4))) & 0x3) << shift; break;
+				case 4: *dst |= ((*src >> (4 - 4 * ((col + x) % 2))) & 0xf) << shift; break;
+				case 8: *dst = *src; break;
+				case 16: dst[0] = src[0]; dst[1] = src[1]; break;
+				case 24: dst[0] = src[0]; dst[1] = src[1]; dst[2] = src[2]; break;
+				case 32: dst[0] = src[0]; dst[1] = src[1]; dst[2] = src[2]; dst[3] = src[3]; break;
+				}
+			}
+		}
+	}
+}
+
+static void
+tiff_paste_subsampled_tile(fz_context *ctx, struct tiff *tiff, unsigned char *tile, unsigned len, unsigned tw, unsigned th, unsigned row, unsigned col)
+{
+	/*
+	This explains how the samples are laid out in tiff data, the spec example is non-obvious.
+	The y, cb, cr indices follow the spec, i.e. y17 is the y sample at row 1, column 7.
+	All indices start at 0.
+
+	hexlookup = (horizontalsubsampling & 0xf) << 4 | (verticalsubsampling & 0xf)
+
+	0x11	y00 cb00 cr00	0x21	y00 y01 cb00 cr00	0x41	y00 y01 y02 y03 cb00 cr00
+		y01 cb01 cr01		y10 y11 cb01 cr01		y04 y05 y06 y07 cb01 cr01
+		....			...				...
+		y10 cb10 cr10		y20 y21 cb10 cr10		y10 y11 y12 y13 cb10 cr10
+		y11 cb11 cr11		y30 y31 cb11 cr11		y14 y15 y16 y17 cb11 cr11
+
+	0x12	y00		0x22	y00 y01			0x42	y00 y01 y02 y03
+		y10 cb00 cr00		y10 y11 cb00 cr00		y10 y11 y12 y13 cb00 cr00
+		y01			y02 y03				y04 y05 y06 y07
+		y11 cb01 cr01		y12 y13 cb01 cr01		y14 y15 y16 y17 cb01 cr01
+		....			...				...
+		y20			y20 y21				y20 y21 y22 y23
+		y30 cb10 cr10		y30 y31 cb10 cr10		y30 y31 y32 y33 cb10 cr10
+		y21			y22 y23				y24 y25 y26 y27
+		y31 cb11 cr11		y32 y33 cb11 cr11		y34 y35 y36 y37 cb11 cr11
+
+	0x14	y00		0x24	y00 y01			0x44	y00 y01 y02 y03
+		y10			y10 y11				y10 y11 y12 y13
+		y20			y20 y21				y20 y21 y22 y23
+		y30 cb00 cr00		y30 y31 cb00 cr00		y30 y31 y32 y33 cb00 cr00
+		y01			y02 y03				y04 y05 y06 y07
+		y11			y12 y13				y14 y15 y16 y17
+		y21			y22 y23				y24 y25 y26 y27
+		y31 cb01 cr01		y32 y33 cb01 cr01		y34 y35 y36 y37 cb01 cr01
+		....			...				...
+		y40			y40 y41				y40 y41 y42 y43
+		y50			y50 y51				y50 y51 y52 y53
+		y60			y60 y61				y60 y61 y62 y63
+		y70 cb10 cr10		y70 y71 cb10 cr10		y70 y71 y72 y73 cb10 cr10
+		y41			y42 y43				y44 y45 y46 y47
+		y51			y52 y53				y54 y55 y56 y57
+		y61			y62 y63				y64 y65 y66 y67
+		y71 cb11 cr11		y72 y73 cb11 cr11		y74 y75 y76 y77 cb11 cr11
+	*/
+
+	unsigned char *src = tile;
+	unsigned char *dst;
+	unsigned x, y, w, h; /* coordinates and dimensions of entire image */
+	unsigned sx, sy, sw, sh; /* coordinates and dimensions of a single subsample region, i.e. max 4 x 4 samples */
+	int k;
+	int offsets[4 * 4 * 3]; /* for a pixel position, these point to all pixel components in a subsample region */
+	int *offset = offsets;
+
+	assert(tiff->samplesperpixel == 3);
+	assert(tiff->bitspersample == 8);
+
+	w = tiff->imagewidth;
+	h = tiff->imagelength;
+
+	sx = 0;
+	sy = 0;
+	sw = tiff->ycbcrsubsamp[0];
+	sh = tiff->ycbcrsubsamp[1];
+	if (sw > 4 || sh > 4 || !fz_is_pow2(sw) || !fz_is_pow2(sh))
+		fz_throw(ctx, FZ_ERROR_FORMAT, "Illegal TIFF Subsample values %d %d", sw, sh);
+
+	for (k = 0; k < 3; k++)
+		for (y = 0; y < sh; y++)
+			for (x = 0; x < sw; x++)
+				*offset++ = k + y * tiff->stride + x * 3;
+
+	offset = offsets;
+	x = col;
+	y = row;
+	k = 0;
+
+	dst = &tiff->samples[row * tiff->stride + col * 3];
+
+	while (src < tile + len)
+	{
+		if (k == 0)
+		{ /* put all Y samples for a subsample region at the correct image pixel */
+			if (y + sy < h && y + sy < row + th && x + sx < w && x + sx < col + tw)
+				dst[*offset] = *src;
+			offset++;
+
+			if (++sx >= sw)
+			{
+				sx = 0;
+				if (++sy >= sh)
+				{
+					sy = 0;
+					k++;
+				}
+			}
+		}
+		else
+		{ /* put all Cb/Cr samples for a subsample region at the correct image pixel */
+			for (sy = 0; sy < sh; sy++)
+				for (sx = 0; sx < sw; sx++)
+				{
+					if (y + sy < h && y + sy < row + th && x + sx < w && x + sx < col + tw)
+						dst[*offset] = *src;
+					offset++;
+				}
+
+			if (++k >= 3)
+			{ /* we're done with this subsample region, on to the next one */
+				k = sx = sy = 0;
+				offset = offsets;
+
+				dst += sw * 3;
+
+				x += sw;
+				if (x >= col + tw)
+				{
+					dst -= (x - (col + tw)) * 3;
+					dst += (sh - 1) * w * 3;
+					dst += col * 3;
+					x = col;
+					y += sh;
+				}
+			}
+		}
+
+		src++;
+	}
+}
+
+static void
+tiff_decode_tiles(fz_context *ctx, struct tiff *tiff)
+{
+	unsigned char *data;
+	unsigned x, y, wlen, tile;
+	unsigned tiles, tilesacross, tilesdown;
+
+	tilesdown = (tiff->imagelength + tiff->tilelength - 1) / tiff->tilelength;
+	tilesacross = (tiff->imagewidth + tiff->tilewidth - 1) / tiff->tilewidth;
+	tiles = tilesacross * tilesdown;
+	if (tiff->tileoffsetslen < tiles || tiff->tilebytecountslen < tiles)
+		fz_throw(ctx, FZ_ERROR_FORMAT, "insufficient tile metadata");
+
+	/* JPEG can handle subsampling on its own */
+	if (tiff->photometric == 6 && tiff->compression != 6 && tiff->compression != 7)
+	{
+		/* regardless of how this is subsampled, a tile is never larger */
+		if (tiff->tilelength >= tiff->ycbcrsubsamp[1])
+			wlen = tiff->tilestride * tiff->tilelength;
+		else
+			wlen = tiff->tilestride * tiff->ycbcrsubsamp[1];
+
+		data = tiff->data = Memento_label(fz_malloc(ctx, wlen), "tiff_tile_jpg");
+
+		tile = 0;
+		for (y = 0; y < tiff->imagelength; y += tiff->tilelength)
+		{
+			for (x = 0; x < tiff->imagewidth; x += tiff->tilewidth)
+			{
+				unsigned int offset = tiff->tileoffsets[tile];
+				unsigned int rlen = tiff->tilebytecounts[tile];
+				const unsigned char *rp = tiff->bp + offset;
+				unsigned decoded;
+
+				if (offset > (unsigned)(tiff->ep - tiff->bp))
+					fz_throw(ctx, FZ_ERROR_FORMAT, "invalid tile offset %u", offset);
+				if (rlen > (unsigned)(tiff->ep - rp))
+					fz_throw(ctx, FZ_ERROR_FORMAT, "invalid tile byte count %u", rlen);
+				if (rlen == 0)
+					fz_throw(ctx, FZ_ERROR_FORMAT, "tile byte count zero");
+
+				decoded = tiff_decode_data(ctx, tiff, rp, rlen, data, wlen);
+				tiff_paste_subsampled_tile(ctx, tiff, data, decoded, tiff->tilewidth, tiff->tilelength, y, x);
+				tile++;
+			}
+		}
+	}
+	else
+	{
+		wlen = tiff->tilelength * tiff->tilestride;
+		data = tiff->data = Memento_label(fz_malloc(ctx, wlen), "tiff_tile");
+
+		tile = 0;
+		for (y = 0; y < tiff->imagelength; y += tiff->tilelength)
+		{
+			for (x = 0; x < tiff->imagewidth; x += tiff->tilewidth)
+			{
+				unsigned int offset = tiff->tileoffsets[tile];
+				unsigned int rlen = tiff->tilebytecounts[tile];
+				const unsigned char *rp = tiff->bp + offset;
+
+				if (offset > (unsigned)(tiff->ep - tiff->bp))
+					fz_throw(ctx, FZ_ERROR_FORMAT, "invalid tile offset %u", offset);
+				if (rlen > (unsigned)(tiff->ep - rp))
+					fz_throw(ctx, FZ_ERROR_FORMAT, "invalid tile byte count %u", rlen);
+				if (rlen == 0)
+					fz_throw(ctx, FZ_ERROR_FORMAT, "tile byte count zero");
+
+				if (tiff_decode_data(ctx, tiff, rp, rlen, data, wlen) != wlen)
+					fz_throw(ctx, FZ_ERROR_FORMAT, "decoded tile is the wrong size");
+
+				tiff_paste_tile(ctx, tiff, data, y, x);
+				tile++;
+			}
+		}
+	}
+}
+
+static void
+tiff_decode_strips(fz_context *ctx, struct tiff *tiff)
+{
+	unsigned char *data;
+	unsigned strips;
+	unsigned strip;
+	unsigned y;
+
+	strips = (tiff->imagelength + tiff->rowsperstrip - 1) / tiff->rowsperstrip;
+	if (tiff->stripoffsetslen < strips || tiff->stripbytecountslen < strips)
+		fz_throw(ctx, FZ_ERROR_FORMAT, "insufficient strip metadata");
+
+	data = tiff->samples;
+
+	/* JPEG can handle subsampling on its own */
+	if (tiff->photometric == 6 && tiff->compression != 6 && tiff->compression != 7)
+	{
+		unsigned wlen;
+		unsigned rowsperstrip;
+
+		/* regardless of how this is subsampled, a strip is never taller */
+		if (tiff->rowsperstrip >= tiff->ycbcrsubsamp[1])
+			rowsperstrip = tiff->rowsperstrip;
+		else
+			rowsperstrip = tiff->ycbcrsubsamp[1];
+
+		wlen = rowsperstrip * tiff->stride;
+		data = tiff->data = Memento_label(fz_malloc(ctx, wlen), "tiff_strip_jpg");
+
+		strip = 0;
+		for (y = 0; y < tiff->imagelength; y += rowsperstrip)
+		{
+			unsigned offset = tiff->stripoffsets[strip];
+			unsigned rlen = tiff->stripbytecounts[strip];
+			const unsigned char *rp = tiff->bp + offset;
+			int decoded;
+
+			if (offset > (unsigned)(tiff->ep - tiff->bp))
+				fz_throw(ctx, FZ_ERROR_FORMAT, "invalid strip offset %u", offset);
+			if (rlen > (unsigned)(tiff->ep - rp))
+				fz_throw(ctx, FZ_ERROR_FORMAT, "invalid strip byte count %u", rlen);
+			if (rlen == 0)
+				fz_throw(ctx, FZ_ERROR_FORMAT, "strip byte count zero");
+
+			decoded = tiff_decode_data(ctx, tiff, rp, rlen, data, wlen);
+			tiff_paste_subsampled_tile(ctx, tiff, data, decoded, tiff->imagewidth, tiff->rowsperstrip, y, 0);
+			strip++;
+		}
+	}
+	else
+	{
+		strip = 0;
+		for (y = 0; y < tiff->imagelength; y += tiff->rowsperstrip)
+		{
+			unsigned offset = tiff->stripoffsets[strip];
+			unsigned rlen = tiff->stripbytecounts[strip];
+			unsigned wlen = tiff->stride * tiff->rowsperstrip;
+			const unsigned char *rp = tiff->bp + offset;
+
+			if (offset > (unsigned)(tiff->ep - tiff->bp))
+				fz_throw(ctx, FZ_ERROR_FORMAT, "invalid strip offset %u", offset);
+			if (rlen > (unsigned)(tiff->ep - rp))
+				fz_throw(ctx, FZ_ERROR_FORMAT, "invalid strip byte count %u", rlen);
+			if (rlen == 0)
+				fz_throw(ctx, FZ_ERROR_FORMAT, "strip byte count zero");
+
+			/* if imagelength is not a multiple of rowsperstrip, adjust the expectation of the size of the decoded data */
+			if (y + tiff->rowsperstrip >= tiff->imagelength)
+				wlen = tiff->stride * (tiff->imagelength - y);
+
+			if (tiff_decode_data(ctx, tiff, rp, rlen, data, wlen) < wlen)
+			{
+				fz_warn(ctx, "premature end of data in decoded strip");
+				break;
+			}
+
+			data += wlen;
+			strip ++;
+		}
+	}
+}
+
+static inline int tiff_readbyte(struct tiff *tiff)
+{
+	if (tiff->rp < tiff->ep)
+		return *tiff->rp++;
+	return EOF;
+}
+
+static inline unsigned readshort(struct tiff *tiff)
+{
+	int a = tiff_readbyte(tiff);
+	int b = tiff_readbyte(tiff);
+	if (tiff->order == TII)
+		return (unsigned)((b << 8) | a);
+	return (unsigned)((a << 8) | b);
+}
+
+static inline unsigned tiff_readlong(struct tiff *tiff)
+{
+	int a = tiff_readbyte(tiff);
+	int b = tiff_readbyte(tiff);
+	int c = tiff_readbyte(tiff);
+	int d = tiff_readbyte(tiff);
+	if (tiff->order == TII)
+		return (unsigned)((d << 24) | (c << 16) | (b << 8) | a);
+	return (unsigned)((a << 24) | (b << 16) | (c << 8) | d);
+}
+
+static void
+tiff_read_bytes(unsigned char *p, struct tiff *tiff, unsigned ofs, unsigned n)
+{
+	if (ofs > (unsigned)(tiff->ep - tiff->bp))
+		ofs = (unsigned)(tiff->ep - tiff->bp);
+	tiff->rp = tiff->bp + ofs;
+
+	while (n--)
+		*p++ = tiff_readbyte(tiff);
+}
+
+static void
+tiff_read_tag_value(fz_context *ctx, unsigned *p, struct tiff *tiff, unsigned type, unsigned ofs, unsigned n)
+{
+	unsigned den;
+	unsigned divisor;
+
+	if (ofs > (unsigned)(tiff->ep - tiff->bp))
+	{
+		ofs = (unsigned)(tiff->ep - tiff->bp);
+		fz_warn(ctx, "TIFF tag offset beyond end of file, truncating offset");
+	}
+	tiff->rp = tiff->bp + ofs;
+
+	switch (type)
+	{
+	default:
+	case TBYTE: divisor = 1; break;
+	case TSHORT: divisor = 2; break;
+	case TLONG: divisor = 4; break;
+	case TRATIONAL: divisor = 8; break;
+	}
+
+	if (n > (tiff->ep - tiff->rp) / divisor)
+	{
+		unsigned newn = (tiff->ep - tiff->rp) / divisor;
+		memset(&p[newn], 0, (n - newn) * sizeof (unsigned));
+		fz_warn(ctx, "TIFF tag extends beyond end of file, truncating tag");
+		n = newn;
+	}
+
+	while (n--)
+	{
+		switch (type)
+		{
+		case TRATIONAL:
+			*p = tiff_readlong(tiff);
+			den = tiff_readlong(tiff);
+			if (den)
+				*p = *p / den;
+			else
+				*p = UINT_MAX;
+			p ++;
+			break;
+		case TBYTE: *p++ = tiff_readbyte(tiff); break;
+		case TSHORT: *p++ = readshort(tiff); break;
+		case TLONG: *p++ = tiff_readlong(tiff); break;
+		default: *p++ = 0; break;
+		}
+	}
+}
+
+static void
+tiff_read_tag(fz_context *ctx, struct tiff *tiff, unsigned offset)
+{
+	unsigned tag;
+	unsigned type;
+	unsigned count;
+	unsigned value;
+
+	tiff->rp = tiff->bp + offset;
+
+	tag = readshort(tiff);
+	type = readshort(tiff);
+	count = tiff_readlong(tiff);
+
+	if ((type == TBYTE && count <= 4) ||
+			(type == TSHORT && count <= 2) ||
+			(type == TLONG && count <= 1))
+		value = tiff->rp - tiff->bp;
+	else
+		value = tiff_readlong(tiff);
+
+	switch (tag)
+	{
+	case NewSubfileType:
+		tiff_read_tag_value(ctx, &tiff->subfiletype, tiff, type, value, 1);
+		break;
+	case ImageWidth:
+		tiff_read_tag_value(ctx, &tiff->imagewidth, tiff, type, value, 1);
+		break;
+	case ImageLength:
+		tiff_read_tag_value(ctx, &tiff->imagelength, tiff, type, value, 1);
+		break;
+	case BitsPerSample:
+		tiff_read_tag_value(ctx, &tiff->bitspersample, tiff, type, value, 1);
+		break;
+	case Compression:
+		tiff_read_tag_value(ctx, &tiff->compression, tiff, type, value, 1);
+		break;
+	case PhotometricInterpretation:
+		tiff_read_tag_value(ctx, &tiff->photometric, tiff, type, value, 1);
+		break;
+	case FillOrder:
+		tiff_read_tag_value(ctx, &tiff->fillorder, tiff, type, value, 1);
+		break;
+	case StripOffsets:
+		tiff->stripoffsetslen = count;
+		break;
+	case SamplesPerPixel:
+		tiff_read_tag_value(ctx, &tiff->samplesperpixel, tiff, type, value, 1);
+		break;
+	case RowsPerStrip:
+		tiff_read_tag_value(ctx, &tiff->rowsperstrip, tiff, type, value, 1);
+		break;
+	case StripByteCounts:
+		tiff->stripbytecountslen = count;
+		break;
+	case XResolution:
+		tiff_read_tag_value(ctx, &tiff->xresolution, tiff, type, value, 1);
+		break;
+	case YResolution:
+		tiff_read_tag_value(ctx, &tiff->yresolution, tiff, type, value, 1);
+		break;
+	case PlanarConfiguration:
+		tiff_read_tag_value(ctx, &tiff->planar, tiff, type, value, 1);
+		break;
+	case T4Options:
+		tiff_read_tag_value(ctx, &tiff->g3opts, tiff, type, value, 1);
+		break;
+	case T6Options:
+		tiff_read_tag_value(ctx, &tiff->g4opts, tiff, type, value, 1);
+		break;
+	case ResolutionUnit:
+		tiff_read_tag_value(ctx, &tiff->resolutionunit, tiff, type, value, 1);
+		break;
+	case Predictor:
+		tiff_read_tag_value(ctx, &tiff->predictor, tiff, type, value, 1);
+		break;
+	case ColorMap:
+		tiff->colormaplen = count;
+		break;
+	case TileWidth:
+		tiff_read_tag_value(ctx, &tiff->tilewidth, tiff, type, value, 1);
+		break;
+	case TileLength:
+		tiff_read_tag_value(ctx, &tiff->tilelength, tiff, type, value, 1);
+		break;
+	case TileOffsets:
+		tiff->tileoffsetslen = count;
+		break;
+	case TileByteCounts:
+		tiff->tilebytecountslen = count;
+		break;
+	case ExtraSamples:
+		tiff_read_tag_value(ctx, &tiff->extrasamples, tiff, type, value, 1);
+		break;
+	case JPEGTables:
+		tiff->jpegtableslen = count;
+		break;
+	case YCbCrSubSampling:
+		tiff_read_tag_value(ctx, tiff->ycbcrsubsamp, tiff, type, value, 2);
+		break;
+	case ICCProfile:
+		tiff->profilesize = count;
+		break;
+	case JPEGInterchangeFormat:
+		tiff_read_tag_value(ctx, &tiff->jpegofs, tiff, type, value, 1);
+		break;
+	case JPEGInterchangeFormatLength:
+		tiff_read_tag_value(ctx, &tiff->jpeglen, tiff, type, value, 1);
+		break;
+	default:
+		/* fz_warn(ctx, "unknown tag: %d t=%d n=%d", tag, type, count); */
+		break;
+	}
+}
+
+static void
+tiff_read_tag_array(fz_context *ctx, struct tiff *tiff, unsigned offset)
+{
+	unsigned tag;
+	unsigned type;
+	unsigned count;
+	unsigned value;
+
+	tiff->rp = tiff->bp + offset;
+
+	tag = readshort(tiff);
+	type = readshort(tiff);
+	count = tiff_readlong(tiff);
+
+	if ((type == TBYTE && count <= 4) ||
+			(type == TSHORT && count <= 2) ||
+			(type == TLONG && count <= 1))
+		value = tiff->rp - tiff->bp;
+	else
+		value = tiff_readlong(tiff);
+
+	switch (tag)
+	{
+	case StripOffsets:
+		if (tiff->stripoffsets)
+			fz_throw(ctx, FZ_ERROR_FORMAT, "at most one strip offsets tag allowed");
+		if (tiff->rowsperstrip == 0)
+			fz_throw(ctx, FZ_ERROR_FORMAT, "invalid strip dimensions");
+		if (count > tiff->maxstrips)
+			count = tiff->maxstrips;
+		tiff->stripoffsets = Memento_label(fz_malloc_array(ctx, count, unsigned), "tiff_stripoffsets");
+		tiff_read_tag_value(ctx, tiff->stripoffsets, tiff, type, value, count);
+		tiff->stripoffsetslen = count;
+		break;
+
+	case StripByteCounts:
+		if (tiff->stripbytecounts)
+			fz_throw(ctx, FZ_ERROR_FORMAT, "at most one strip byte counts tag allowed");
+		if (tiff->rowsperstrip == 0)
+			fz_throw(ctx, FZ_ERROR_FORMAT, "invalid strip dimensions");
+		if (count > tiff->maxstrips)
+			count = tiff->maxstrips;
+		tiff->stripbytecounts = Memento_label(fz_malloc_array(ctx, count, unsigned), "tiff_stripbytecounts");
+		tiff_read_tag_value(ctx, tiff->stripbytecounts, tiff, type, value, count);
+		tiff->stripbytecountslen = count;
+		break;
+
+	case ColorMap:
+		if (tiff->colormap)
+			fz_throw(ctx, FZ_ERROR_FORMAT, "at most one color map allowed");
+		if (type != TSHORT)
+			fz_throw(ctx, FZ_ERROR_FORMAT, "unexpected element type for color map");
+		if (count > tiff->maxcolors)
+			count = tiff->maxcolors;
+		tiff->colormap = Memento_label(fz_malloc_array(ctx, count, unsigned), "tiff_colormap");
+		tiff_read_tag_value(ctx, tiff->colormap, tiff, type, value, count);
+		tiff->colormaplen = count;
+		break;
+
+	case TileOffsets:
+		if (tiff->tileoffsets)
+			fz_throw(ctx, FZ_ERROR_FORMAT, "at most one tile offsets tag allowed");
+		if (tiff->tilelength == 0 || tiff->tilewidth == 0)
+			fz_throw(ctx, FZ_ERROR_FORMAT, "invalid tile dimensions");
+		if (count > tiff->maxtiles)
+			count = tiff->maxtiles;
+		tiff->tileoffsets = Memento_label(fz_malloc_array(ctx, count, unsigned), "tiff_tileoffsets");
+		tiff_read_tag_value(ctx, tiff->tileoffsets, tiff, type, value, count);
+		tiff->tileoffsetslen = count;
+		break;
+
+	case TileByteCounts:
+		if (tiff->tilebytecounts)
+			fz_throw(ctx, FZ_ERROR_FORMAT, "at most one tile byte counts tag allowed");
+		if (tiff->tilelength == 0 || tiff->tilewidth == 0)
+			fz_throw(ctx, FZ_ERROR_FORMAT, "invalid tile dimensions");
+		if (count > tiff->maxtiles)
+			count = tiff->maxtiles;
+		tiff->tilebytecounts = Memento_label(fz_malloc_array(ctx, count, unsigned), "tiff_tilebytecounts");
+		tiff_read_tag_value(ctx, tiff->tilebytecounts, tiff, type, value, count);
+		tiff->tilebytecountslen = count;
+		break;
+
+	case JPEGTables:
+		/* Check both value and value + count to allow for overflow */
+		if (value > (size_t)(tiff->ep - tiff->bp))
+			fz_throw(ctx, FZ_ERROR_FORMAT, "TIFF JPEG tables offset out of range");
+		if (value + count > (size_t)(tiff->ep - tiff->bp))
+			count = (unsigned int)(tiff->ep - tiff->bp) - value;
+		tiff->jpegtables = tiff->bp + value;
+		tiff->jpegtableslen = count;
+		break;
+
+	case ICCProfile:
+		if (tiff->profile)
+			fz_throw(ctx, FZ_ERROR_FORMAT, "at most one ICC profile tag allowed");
+		if (value > (size_t)(tiff->ep - tiff->bp))
+			fz_throw(ctx, FZ_ERROR_FORMAT, "TIFF profile offset out of range");
+		if (value + count > (size_t)(tiff->ep - tiff->bp))
+			count = (unsigned int)(tiff->ep - tiff->bp) - value;
+		tiff->profile = Memento_label(fz_malloc(ctx, count), "tiff_profile");
+		/* ICC profile data type is set to UNDEFINED.
+		 * TBYTE reading not correct in tiff_read_tag_value */
+		tiff_read_bytes(tiff->profile, tiff, value, count);
+		tiff->profilesize = count;
+		break;
+
+	default:
+		/* fz_warn(ctx, "unknown tag: %d t=%d n=%d", tag, type, count); */
+		break;
+	}
+}
+
+static void
+tiff_swap_byte_order(unsigned char *buf, int n)
+{
+	int i, t;
+	for (i = 0; i < n; i++)
+	{
+		t = buf[i * 2 + 0];
+		buf[i * 2 + 0] = buf[i * 2 + 1];
+		buf[i * 2 + 1] = t;
+	}
+}
+
+static void
+tiff_scale_lab_samples(fz_context *ctx, unsigned char *buf, int bps, int n)
+{
+	int i;
+	if (bps == 8)
+		for (i = 0; i < n; i++, buf += 3)
+		{
+			buf[1] ^= 128;
+			buf[2] ^= 128;
+		}
+	else if (bps == 16)
+		for (i = 0; i < n; i++, buf += 6)
+		{
+			buf[2] ^= 128;
+			buf[4] ^= 128;
+		}
+}
+
+static void
+tiff_read_header(fz_context *ctx, struct tiff *tiff, const unsigned char *buf, size_t len)
+{
+	unsigned version;
+
+	memset(tiff, 0, sizeof(struct tiff));
+	tiff->bp = buf;
+	tiff->rp = buf;
+	tiff->ep = buf + len;
+
+	/* tag defaults, where applicable */
+	tiff->bitspersample = 1;
+	tiff->compression = 1;
+	tiff->samplesperpixel = 1;
+	tiff->resolutionunit = 2;
+	tiff->rowsperstrip = 0xFFFFFFFF;
+	tiff->fillorder = 1;
+	tiff->planar = 1;
+	tiff->subfiletype = 0;
+	tiff->predictor = 1;
+	tiff->ycbcrsubsamp[0] = 2;
+	tiff->ycbcrsubsamp[1] = 2;
+
+	/*
+	 * Read IFH
+	 */
+
+	/* get byte order marker */
+	tiff->order = readshort(tiff);
+	if (tiff->order != TII && tiff->order != TMM)
+		fz_throw(ctx, FZ_ERROR_FORMAT, "not a TIFF file, wrong magic marker");
+
+	/* check version */
+	version = readshort(tiff);
+	if (version != 42)
+		fz_throw(ctx, FZ_ERROR_FORMAT, "not a TIFF file, wrong version marker");
+
+	/* get offset of IFD */
+	tiff->ifd_offsets = Memento_label(fz_malloc_array(ctx, 1, unsigned), "tiff_ifd_offsets");
+	tiff->ifd_offsets[0] = tiff_readlong(tiff);
+	tiff->ifds = 1;
+}
+
+static unsigned
+tiff_next_ifd(fz_context *ctx, struct tiff *tiff, unsigned offset)
+{
+	unsigned count;
+	int i;
+
+	if (offset > (unsigned)(tiff->ep - tiff->bp))
+		fz_throw(ctx, FZ_ERROR_FORMAT, "invalid IFD offset %u", offset);
+
+	tiff->rp = tiff->bp + offset;
+	count = readshort(tiff);
+
+	if (count * 12 > (unsigned)(tiff->ep - tiff->rp))
+		fz_throw(ctx, FZ_ERROR_FORMAT, "overlarge IFD entry count %u", count);
+
+	tiff->rp += count * 12;
+	offset = tiff_readlong(tiff);
+
+	for (i = 0; i < tiff->ifds; i++)
+		if (tiff->ifd_offsets[i] == offset)
+			fz_throw(ctx, FZ_ERROR_FORMAT, "cycle in IFDs detected");
+
+	tiff->ifd_offsets = fz_realloc_array(ctx, tiff->ifd_offsets, tiff->ifds + 1, unsigned);
+	tiff->ifd_offsets[tiff->ifds] = offset;
+	tiff->ifds++;
+
+	return offset;
+}
+
+static void
+tiff_seek_ifd(fz_context *ctx, struct tiff *tiff, int subimage)
+{
+	unsigned offset = tiff->ifd_offsets[0];
+
+	while (subimage--)
+	{
+		offset = tiff_next_ifd(ctx, tiff, offset);
+
+		if (offset == 0)
+			fz_throw(ctx, FZ_ERROR_FORMAT, "subimage index %i out of range", subimage);
+	}
+
+	tiff->rp = tiff->bp + offset;
+
+	if (tiff->rp < tiff->bp || tiff->rp > tiff->ep)
+		fz_throw(ctx, FZ_ERROR_FORMAT, "invalid IFD offset %u", offset);
+}
+
+static void
+tiff_read_ifd(fz_context *ctx, struct tiff *tiff)
+{
+	unsigned offset;
+	unsigned count;
+	unsigned i;
+	unsigned original;
+	const unsigned char *original_rp;
+
+	offset = tiff->rp - tiff->bp;
+	count = readshort(tiff);
+	if (count > (unsigned)(tiff->ep - tiff->rp) / 12)
+		fz_throw(ctx, FZ_ERROR_FORMAT, "overlarge IFD entry count %u", count);
+	original = offset + 2;
+	original_rp = tiff->rp;
+
+	offset = original;
+	tiff->rp = original_rp;
+	for (i = 0; i < count; i++)
+	{
+		tiff_read_tag(ctx, tiff, offset);
+		offset += 12;
+	}
+
+	if (tiff->bitspersample > 16)
+	{
+		fz_warn(ctx, "limiting bits per component to 16 in TIFF image");
+		tiff->bitspersample = 16;
+	}
+
+	tiff->maxcolors = tiff->colormaplen;
+	if (tiff->maxcolors)
+	{
+		unsigned comps;
+		switch (tiff->photometric)
+		{
+			case 0: /* WhiteIsZero -- inverted */
+			case 1: /* BlackIsZero */
+			case 4: /* Transparency mask */
+			case 32844: /* SGI CIE Log 2 L (16bpp Greyscale) */
+				comps = 1;
+				break;
+			default:
+			case 2: /* RGB */
+			case 3: /* RGBPal */
+			case 6: /* YCbCr */
+			case 8: /* Direct L*a*b* encoding. a*, b* signed values */
+			case 9: /* ICC Style L*a*b* encoding */
+			case 32845: /* SGI CIE Log 2 L, u, v (24bpp or 32bpp) */
+				comps = 3;
+				break;
+			case 5: /* CMYK */
+				comps = 4;
+				break;
+		}
+		if (tiff->maxcolors > (unsigned) (comps * (1 << tiff->bitspersample)))
+			tiff->maxcolors = (unsigned) (comps * (1 << tiff->bitspersample));
+	}
+
+	tiff->maxtiles = 0;
+	if (tiff->tilelength && tiff->tilewidth)
+	{
+		unsigned tilesdown = (tiff->imagelength + tiff->tilelength - 1) / tiff->tilelength;
+		unsigned tilesacross = (tiff->imagewidth + tiff->tilewidth - 1) / tiff->tilewidth;
+		unsigned tilesperimage = tilesacross * tilesdown;
+		if (tiff->planar == 1)
+			tiff->maxtiles = tilesperimage;
+		else
+			tiff->maxtiles = tiff->samplesperpixel * tilesperimage;
+	}
+
+	tiff->maxstrips = tiff->imagelength;
+	if (tiff->rowsperstrip && tiff->rowsperstrip != 0xFFFFFFFF)
+	{
+		if (tiff->rowsperstrip < tiff->imagelength)
+			tiff->maxstrips = (tiff->imagelength + tiff->rowsperstrip - 1) / tiff->rowsperstrip;
+	}
+
+	/* some creators write strip tags when they meant to write tile tags... */
+	if (tiff->tilelength && tiff->tilewidth)
+		tiff->maxstrips = tiff->maxtiles;
+
+	offset = original;
+	tiff->rp = original_rp;
+	for (i = 0; i < count; i++)
+	{
+		tiff_read_tag_array(ctx, tiff, offset);
+		offset += 12;
+	}
+}
+
+static void
+tiff_ycc_to_rgb(fz_context *ctx, struct tiff *tiff)
+{
+	unsigned x, y;
+	int offset = tiff->samplesperpixel;
+
+	for (y = 0; y < tiff->imagelength; y++)
+	{
+		unsigned char * row = &tiff->samples[tiff->stride * y];
+		for (x = 0; x < tiff->imagewidth; x++)
+		{
+			int ycc[3];
+			ycc[0] = row[x * offset + 0];
+			ycc[1] = row[x * offset + 1] - 128;
+			ycc[2] = row[x * offset + 2] - 128;
+
+			row[x * offset + 0] = fz_clampi(ycc[0] + 1.402f * ycc[2], 0, 255);
+			row[x * offset + 1] = fz_clampi(ycc[0] - 0.34413f * ycc[1] - 0.71414f * ycc[2], 0, 255);
+			row[x * offset + 2] = fz_clampi(ycc[0] + 1.772f * ycc[1], 0, 255);
+		}
+	}
+}
+
+static void
+tiff_decode_ifd(fz_context *ctx, struct tiff *tiff)
+{
+	unsigned i;
+
+	if (tiff->imagelength <= 0)
+		fz_throw(ctx, FZ_ERROR_FORMAT, "image height must be > 0");
+	if (tiff->imagewidth <= 0)
+		fz_throw(ctx, FZ_ERROR_FORMAT, "image width must be > 0");
+	if (tiff->bitspersample > 16 || !fz_is_pow2(tiff->bitspersample))
+		fz_throw(ctx, FZ_ERROR_FORMAT, "bits per sample illegal %d", tiff->bitspersample);
+	if (tiff->samplesperpixel == 0 || tiff->samplesperpixel >= FZ_MAX_COLORS)
+		fz_throw(ctx, FZ_ERROR_FORMAT, "components per pixel out of range");
+	if (tiff->samplesperpixel < tiff->extrasamples)
+		fz_throw(ctx, FZ_ERROR_FORMAT, "components per pixel out of range when compared to extra samples");
+	/* Bug 706071: Check for overflow in the stride calculation separately. */
+	if (tiff->imagewidth > (UINT_MAX - 7) / tiff->samplesperpixel / tiff->bitspersample)
+		fz_throw(ctx, FZ_ERROR_LIMIT, "image too large");
+	if (tiff->imagelength > UINT_MAX / tiff->imagewidth / (tiff->samplesperpixel + 2) / (tiff->bitspersample / 8 + 1))
+		fz_throw(ctx, FZ_ERROR_LIMIT, "image too large");
+	if (tiff->tilewidth & 0xf)
+		fz_throw(ctx, FZ_ERROR_FORMAT, "tile width not a multiple of 16");
+	if (tiff->tilelength & 0xf)
+		fz_throw(ctx, FZ_ERROR_FORMAT, "tile height not a multiple of 16");
+
+	if (tiff->planar != 1)
+		fz_throw(ctx, FZ_ERROR_UNSUPPORTED, "image data is not in chunky format");
+
+	if (tiff->photometric == 6)
+	{
+		if (tiff->samplesperpixel != 3)
+			fz_throw(ctx, FZ_ERROR_FORMAT, "invalid samples per pixel for YCbCr");
+		if (tiff->bitspersample != 8)
+			fz_throw(ctx, FZ_ERROR_FORMAT, "invalid bits per sample when subsampling");
+		if (tiff->ycbcrsubsamp[0] != 1 && tiff->ycbcrsubsamp[0] != 2 && tiff->ycbcrsubsamp[0] != 4)
+			fz_throw(ctx, FZ_ERROR_FORMAT, "invalid subsampling factor");
+		if (tiff->ycbcrsubsamp[1] != 1 && tiff->ycbcrsubsamp[1] != 2 && tiff->ycbcrsubsamp[1] != 4)
+			fz_throw(ctx, FZ_ERROR_FORMAT, "invalid subsampling factor");
+	}
+
+	switch (tiff->photometric)
+	{
+	case 0: /* WhiteIsZero -- inverted */
+		if (tiff->samplesperpixel - !!tiff->extrasamples < 1)
+			fz_throw(ctx, FZ_ERROR_FORMAT, "invalid samples per pixel for bw tiff");
+		tiff->colorspace = fz_keep_colorspace(ctx, fz_device_gray(ctx));
+		break;
+	case 1: /* BlackIsZero */
+		if (tiff->samplesperpixel - !!tiff->extrasamples < 1)
+			fz_throw(ctx, FZ_ERROR_FORMAT, "invalid samples per pixel for bw tiff");
+		tiff->colorspace = fz_keep_colorspace(ctx, fz_device_gray(ctx));
+		break;
+	case 2: /* RGB */
+		if (tiff->samplesperpixel - !!tiff->extrasamples < 3)
+			fz_throw(ctx, FZ_ERROR_FORMAT, "invalid samples per pixel for rgb tiff");
+		tiff->colorspace = fz_keep_colorspace(ctx, fz_device_rgb(ctx));
+		break;
+	case 3: /* RGBPal */
+		if (tiff->samplesperpixel - !!tiff->extrasamples < 1)
+			fz_throw(ctx, FZ_ERROR_FORMAT, "invalid samples per pixel for palettized tiff");
+		tiff->colorspace = fz_keep_colorspace(ctx, fz_device_rgb(ctx));
+		break;
+	case 4: /* Transparency mask */
+		if (tiff->samplesperpixel - !!tiff->extrasamples < 1)
+			fz_throw(ctx, FZ_ERROR_FORMAT, "invalid samples per pixel for transparency mask tiff");
+		tiff->colorspace = NULL;
+		break;
+	case 5: /* CMYK */
+		if (tiff->samplesperpixel - !!tiff->extrasamples < 4)
+			fz_throw(ctx, FZ_ERROR_FORMAT, "invalid samples per pixel for cmyk tiff");
+		tiff->colorspace = fz_keep_colorspace(ctx, fz_device_cmyk(ctx));
+		break;
+	case 6: /* YCbCr */
+		if (tiff->samplesperpixel - !!tiff->extrasamples < 3)
+			fz_throw(ctx, FZ_ERROR_FORMAT, "invalid samples per pixel for ycbcr tiff");
+		/* it's probably a jpeg ... we let jpeg convert to rgb */
+		tiff->colorspace = fz_keep_colorspace(ctx, fz_device_rgb(ctx));
+		break;
+	case 8: /* Direct L*a*b* encoding. a*, b* signed values */
+	case 9: /* ICC Style L*a*b* encoding */
+		if (tiff->samplesperpixel - !!tiff->extrasamples < 3)
+			fz_throw(ctx, FZ_ERROR_FORMAT, "invalid samples per pixel for lab tiff");
+		tiff->colorspace = fz_keep_colorspace(ctx, fz_device_lab(ctx));
+		break;
+	case 32844: /* SGI CIE Log 2 L (16bpp Greyscale) */
+		if (tiff->samplesperpixel - !!tiff->extrasamples < 1)
+			fz_throw(ctx, FZ_ERROR_FORMAT, "invalid samples per pixel for l tiff");
+		tiff->colorspace = fz_keep_colorspace(ctx, fz_device_gray(ctx));
+		if (tiff->bitspersample != 8)
+			tiff->bitspersample = 8;
+		tiff->stride >>= 1;
+		break;
+	case 32845: /* SGI CIE Log 2 L, u, v (24bpp or 32bpp) */
+		if (tiff->samplesperpixel - !!tiff->extrasamples < 3)
+			fz_throw(ctx, FZ_ERROR_FORMAT, "invalid samples per pixel for luv tiff");
+		tiff->colorspace = fz_keep_colorspace(ctx, fz_device_rgb(ctx));
+		if (tiff->bitspersample != 8)
+			tiff->bitspersample = 8;
+		tiff->stride >>= 1;
+		break;
+	default:
+		fz_throw(ctx, FZ_ERROR_FORMAT, "unknown photometric: %d", tiff->photometric);
+	}
+
+	tiff->stride = (tiff->imagewidth * tiff->samplesperpixel * tiff->bitspersample + 7) / 8;
+	tiff->tilestride = (tiff->tilewidth * tiff->samplesperpixel * tiff->bitspersample + 7) / 8;
+
+#if FZ_ENABLE_ICC
+	if (tiff->profile && tiff->profilesize > 0)
+	{
+		fz_buffer *buff = NULL;
+		fz_colorspace *icc = NULL;
+		fz_var(buff);
+		fz_try(ctx)
+		{
+			buff = fz_new_buffer_from_copied_data(ctx, tiff->profile, tiff->profilesize);
+			icc = fz_new_icc_colorspace(ctx, fz_colorspace_type(ctx, tiff->colorspace), 0, NULL, buff);
+			fz_drop_colorspace(ctx, tiff->colorspace);
+			tiff->colorspace = icc;
+		}
+		fz_always(ctx)
+			fz_drop_buffer(ctx, buff);
+		fz_catch(ctx)
+		{
+			fz_rethrow_if(ctx, FZ_ERROR_SYSTEM);
+			fz_report_error(ctx);
+			fz_warn(ctx, "ignoring embedded ICC profile");
+		}
+	}
+#endif
+
+	if (!tiff->colorspace && tiff->samplesperpixel < 1)
+		fz_throw(ctx, FZ_ERROR_FORMAT, "too few components for transparency mask");
+	if (tiff->colorspace && tiff->colormap && tiff->samplesperpixel < 1)
+		fz_throw(ctx, FZ_ERROR_FORMAT, "too few components for RGBPal");
+	if (tiff->colorspace && !tiff->colormap && tiff->samplesperpixel < (unsigned) fz_colorspace_n(ctx, tiff->colorspace))
+		fz_throw(ctx, FZ_ERROR_FORMAT, "fewer components per pixel than indicated by colorspace");
+
+	switch (tiff->resolutionunit)
+	{
+	case 2:
+		/* no unit conversion needed */
+		break;
+	case 3:
+		tiff->xresolution = tiff->xresolution * 254 / 100;
+		tiff->yresolution = tiff->yresolution * 254 / 100;
+		break;
+	default:
+		tiff->xresolution = 96;
+		tiff->yresolution = 96;
+		break;
+	}
+
+	/* Note xres and yres could be 0 even if unit was set. If so default to 96dpi. */
+	if (tiff->xresolution == 0 || tiff->yresolution == 0)
+	{
+		tiff->xresolution = 96;
+		tiff->yresolution = 96;
+	}
+
+	if (tiff->rowsperstrip > tiff->imagelength)
+		tiff->rowsperstrip = tiff->imagelength;
+
+	/* some creators don't write byte counts for uncompressed images */
+	if (tiff->compression == 1)
+	{
+		if (tiff->rowsperstrip == 0)
+			fz_throw(ctx, FZ_ERROR_FORMAT, "rowsperstrip cannot be 0");
+		if (!tiff->tilelength && !tiff->tilewidth && !tiff->stripbytecounts)
+		{
+			tiff->stripbytecountslen = (tiff->imagelength + tiff->rowsperstrip - 1) / tiff->rowsperstrip;
+			tiff->stripbytecounts = Memento_label(fz_malloc_array(ctx, tiff->stripbytecountslen, unsigned), "tiff_stripbytecounts");
+			for (i = 0; i < tiff->stripbytecountslen; i++)
+				tiff->stripbytecounts[i] = tiff->rowsperstrip * tiff->stride;
+		}
+		if (tiff->tilelength && tiff->tilewidth && !tiff->tilebytecounts)
+		{
+			unsigned tilesdown = (tiff->imagelength + tiff->tilelength - 1) / tiff->tilelength;
+			unsigned tilesacross = (tiff->imagewidth + tiff->tilewidth - 1) / tiff->tilewidth;
+			tiff->tilebytecountslen = tilesacross * tilesdown;
+			tiff->tilebytecounts = Memento_label(fz_malloc_array(ctx, tiff->tilebytecountslen, unsigned), "tiff_tilebytecounts");
+			for (i = 0; i < tiff->tilebytecountslen; i++)
+				tiff->tilebytecounts[i] = tiff->tilelength * tiff->tilestride;
+		}
+	}
+
+	/* some creators write strip tags when they meant to write tile tags... */
+	if (tiff->tilelength && tiff->tilewidth)
+	{
+		if (!tiff->tileoffsets && !tiff->tileoffsetslen &&
+				tiff->stripoffsets && tiff->stripoffsetslen)
+		{
+			tiff->tileoffsets = tiff->stripoffsets;
+			tiff->tileoffsetslen = tiff->stripoffsetslen;
+			tiff->stripoffsets = NULL;
+			tiff->stripoffsetslen = 0;
+		}
+		if (!tiff->tilebytecounts && !tiff->tilebytecountslen &&
+				tiff->stripbytecounts && tiff->stripbytecountslen)
+		{
+			tiff->tilebytecounts = tiff->stripbytecounts;
+			tiff->tilebytecountslen = tiff->stripbytecountslen;
+			tiff->stripbytecounts = NULL;
+			tiff->stripbytecountslen = 0;
+		}
+	}
+}
+
+static void
+tiff_decode_jpeg(fz_context *ctx, struct tiff *tiff)
+{
+	size_t wlen = (size_t)tiff->imagelength * tiff->stride;
+	size_t size = 0;
+	fz_stream *rawstm = NULL;
+	fz_stream *stm = NULL;
+
+	fz_var(rawstm);
+	fz_var(stm);
+
+	if (tiff->jpegofs > (size_t)(tiff->ep - tiff->bp))
+	{
+		fz_warn(ctx, "TIFF JPEG image offset too large, capping");
+		tiff->jpegofs = (unsigned int)(tiff->ep - tiff->bp);
+	}
+	if (tiff->jpeglen > (size_t)(tiff->ep - tiff->bp) - tiff->jpegofs)
+	{
+		fz_warn(ctx, "TIFF JPEG image length too long, capping");
+		tiff->jpeglen = (unsigned int)(tiff->ep - tiff->bp) - tiff->jpegofs;
+	}
+
+	fz_try(ctx)
+	{
+		rawstm = fz_open_memory(ctx, tiff->bp + tiff->jpegofs, tiff->jpeglen);
+		stm = fz_open_dctd(ctx, rawstm, -1, 1, 0, NULL);
+		size = (unsigned)fz_read(ctx, stm, tiff->samples, wlen);
+	}
+	fz_always(ctx)
+	{
+		fz_drop_stream(ctx, stm);
+		fz_drop_stream(ctx, rawstm);
+	}
+	fz_catch(ctx)
+		fz_rethrow(ctx);
+
+	if (size < wlen)
+		fz_warn(ctx, "premature end of data in jpeg");
+}
+
+static void
+tiff_decode_samples(fz_context *ctx, struct tiff *tiff)
+{
+	unsigned i;
+
+	if (tiff->imagelength > UINT_MAX / tiff->stride)
+		fz_throw(ctx, FZ_ERROR_LIMIT, "image too large");
+	tiff->samples = Memento_label(fz_malloc(ctx, (size_t)tiff->imagelength * tiff->stride), "tiff_samples");
+	memset(tiff->samples, 0x00, (size_t)tiff->imagelength * tiff->stride);
+
+	if (tiff->tilelength && tiff->tilewidth && tiff->tileoffsets && tiff->tilebytecounts)
+		tiff_decode_tiles(ctx, tiff);
+	else if (tiff->rowsperstrip && tiff->stripoffsets && tiff->stripbytecounts)
+		tiff_decode_strips(ctx, tiff);
+	else if (tiff->jpegofs && tiff->jpeglen)
+		tiff_decode_jpeg(ctx, tiff);
+	else
+		fz_throw(ctx, FZ_ERROR_FORMAT, "image is missing strip, tile and jpeg data");
+
+	/* Predictor (only for LZW and Flate) */
+	if ((tiff->compression == 5 || tiff->compression == 8 || tiff->compression == 32946) && tiff->predictor == 2)
+	{
+		unsigned char *p = tiff->samples;
+		for (i = 0; i < tiff->imagelength; i++)
+		{
+			tiff_unpredict_line(p, tiff->imagewidth, tiff->samplesperpixel, tiff->bitspersample);
+			p += tiff->stride;
+		}
+	}
+
+	/* YCbCr -> RGB, but JPEG already has done this conversion  */
+	if (tiff->photometric == 6 && tiff->compression != 6 && tiff->compression != 7)
+		tiff_ycc_to_rgb(ctx, tiff);
+
+	/* RGBPal */
+	if (tiff->photometric == 3 && tiff->colormap)
+		tiff_expand_colormap(ctx, tiff);
+
+	/* WhiteIsZero .. invert */
+	if (tiff->photometric == 0)
+	{
+		unsigned char *p = tiff->samples;
+		for (i = 0; i < tiff->imagelength; i++)
+		{
+			tiff_invert_line(p, tiff->imagewidth, tiff->samplesperpixel, tiff->bitspersample, tiff->extrasamples);
+			p += tiff->stride;
+		}
+	}
+
+	/* Premultiplied transparency */
+	if (tiff->extrasamples == 1)
+	{
+		/* In GhostXPS we undo the premultiplication here; muxps holds
+		 * all our images premultiplied by default, so nothing to do.
+		 */
+	}
+
+	/* Non-premultiplied transparency */
+	if (tiff->extrasamples == 2)
+	{
+		/* Premultiplied files are corrected for elsewhere */
+	}
+
+	/* Byte swap 16-bit images to big endian if necessary */
+	if (tiff->bitspersample == 16 && tiff->order == TII && !tiff->colormap)
+		tiff_swap_byte_order(tiff->samples, tiff->imagewidth * tiff->imagelength * tiff->samplesperpixel);
+
+	/* Lab colorspace expects all sample components 0..255.
+	TIFF supplies them as L = 0..255, a/b = -128..127 (for
+	8 bits per sample, -32768..32767 for 16 bits per sample)
+	Scale them to the colorspace's expectations. */
+	if (tiff->photometric == 8 && tiff->samplesperpixel == 3)
+		tiff_scale_lab_samples(ctx, tiff->samples, tiff->bitspersample, tiff->imagewidth * tiff->imagelength);
+}
+
+fz_pixmap *
+fz_load_tiff_subimage(fz_context *ctx, const unsigned char *buf, size_t len, int subimage)
+{
+	fz_pixmap *image = NULL;
+	struct tiff tiff = { 0 };
+	int alpha;
+
+	fz_var(image);
+
+	fz_try(ctx)
+	{
+		tiff_read_header(ctx, &tiff, buf, len);
+		tiff_seek_ifd(ctx, &tiff, subimage);
+		tiff_read_ifd(ctx, &tiff);
+
+		/* Decode the image data */
+		tiff_decode_ifd(ctx, &tiff);
+		tiff_decode_samples(ctx, &tiff);
+
+		/* Expand into fz_pixmap struct */
+		alpha = tiff.extrasamples != 0 || tiff.colorspace == NULL;
+		image = fz_new_pixmap(ctx, tiff.colorspace, tiff.imagewidth, tiff.imagelength, NULL, alpha);
+		image->xres = tiff.xresolution;
+		image->yres = tiff.yresolution;
+
+		fz_unpack_tile(ctx, image, tiff.samples, tiff.samplesperpixel, tiff.bitspersample, tiff.stride, 0);
+
+		/* We should only do this on non-pre-multiplied images, but files in the wild are bad */
+		/* TODO: check if any samples are non-premul to detect bad files */
+		if (tiff.extrasamples /* == 2 */)
+			fz_premultiply_pixmap(ctx, image);
+	}
+	fz_always(ctx)
+	{
+		/* Clean up scratch memory */
+		fz_drop_colorspace(ctx, tiff.colorspace);
+		fz_free(ctx, tiff.colormap);
+		fz_free(ctx, tiff.stripoffsets);
+		fz_free(ctx, tiff.stripbytecounts);
+		fz_free(ctx, tiff.tileoffsets);
+		fz_free(ctx, tiff.tilebytecounts);
+		fz_free(ctx, tiff.data);
+		fz_free(ctx, tiff.samples);
+		fz_free(ctx, tiff.profile);
+		fz_free(ctx, tiff.ifd_offsets);
+	}
+	fz_catch(ctx)
+	{
+		fz_drop_pixmap(ctx, image);
+		fz_rethrow(ctx);
+	}
+
+	return image;
+}
+
+fz_pixmap *
+fz_load_tiff(fz_context *ctx, const unsigned char *buf, size_t len)
+{
+	return fz_load_tiff_subimage(ctx, buf, len, 0);
+}
+
+void
+fz_load_tiff_info_subimage(fz_context *ctx, const unsigned char *buf, size_t len, int *wp, int *hp, int *xresp, int *yresp, fz_colorspace **cspacep, int subimage)
+{
+	struct tiff tiff = { 0 };
+
+	fz_try(ctx)
+	{
+		tiff_read_header(ctx, &tiff, buf, len);
+		tiff_seek_ifd(ctx, &tiff, subimage);
+		tiff_read_ifd(ctx, &tiff);
+
+		tiff_decode_ifd(ctx, &tiff);
+
+		*wp = tiff.imagewidth;
+		*hp = tiff.imagelength;
+		*xresp = (tiff.xresolution ? tiff.xresolution : 96);
+		*yresp = (tiff.yresolution ? tiff.yresolution : 96);
+		if (tiff.extrasamples /* == 2 */)
+		{
+			fz_drop_colorspace(ctx, tiff.colorspace);
+			tiff.colorspace = fz_keep_colorspace(ctx, fz_device_rgb(ctx));
+		}
+		*cspacep = fz_keep_colorspace(ctx, tiff.colorspace);
+	}
+	fz_always(ctx)
+	{
+		/* Clean up scratch memory */
+		fz_drop_colorspace(ctx, tiff.colorspace);
+		fz_free(ctx, tiff.colormap);
+		fz_free(ctx, tiff.stripoffsets);
+		fz_free(ctx, tiff.stripbytecounts);
+		fz_free(ctx, tiff.tileoffsets);
+		fz_free(ctx, tiff.tilebytecounts);
+		fz_free(ctx, tiff.data);
+		fz_free(ctx, tiff.samples);
+		fz_free(ctx, tiff.profile);
+		fz_free(ctx, tiff.ifd_offsets);
+	}
+	fz_catch(ctx)
+	{
+		fz_rethrow(ctx);
+	}
+}
+
+void
+fz_load_tiff_info(fz_context *ctx, const unsigned char *buf, size_t len, int *wp, int *hp, int *xresp, int *yresp, fz_colorspace **cspacep)
+{
+	fz_load_tiff_info_subimage(ctx, buf, len, wp, hp, xresp, yresp, cspacep, 0);
+}
+
+int
+fz_load_tiff_subimage_count(fz_context *ctx, const unsigned char *buf, size_t len)
+{
+	unsigned offset;
+	unsigned subimage_count = 0;
+	struct tiff tiff = { 0 };
+
+	fz_try(ctx)
+	{
+		tiff_read_header(ctx, &tiff, buf, len);
+
+		offset = tiff.ifd_offsets[0];
+
+		do {
+			subimage_count++;
+			offset = tiff_next_ifd(ctx, &tiff, offset);
+		} while (offset != 0);
+	}
+	fz_always(ctx)
+		fz_free(ctx, tiff.ifd_offsets);
+	fz_catch(ctx)
+		fz_rethrow(ctx);
+
+	return subimage_count;
+}