PSP3D Left Header
PSP3D Header Right
PSP3D Logo CraveOnline Logo
Help the PSP 3D community grow!
Vote for us below:


Vote on the PSP Top 200
PSP Top 200 - Games, Videos, Wallpapers, Files, Hacks, Homebrew

Homebrew/Hacking - Discuss the latest available homebrew applications and games.

Welcome to PSP3D.com - Sony PlayStation Portable News, Homebrew, Hacks, Reviews, Videos, Mods, Forums!

You are currently viewing our website as a guest, which gives you limited access to reply and interact to discussions and other members. By joining our free community, you will be able to post topics in the forums, communicate privately with other members, vote in polls, and access many other special features.

Registration is fast, simple, and absolutely free so join our community today!

Go Back PSP3D.com - Sony PlayStation Portable News, Homebrew, Hacks, Reviews, Videos, Mods, Forums > PSP Forums > Homebrew/Hacking

Reply
 
LinkBack Thread Tools Display Modes
  #1 (permalink)  
Old 06-13-2006, 04:24 PM
MiG's Avatar
MiG MiG is offline
Member
 
Join Date: May 2006
Posts: 73
Points: 0.31
Donate
New Libtiff exploit - Large Files. (News Only, nothing as of yet)

This message is one of a series of messages with questions about advanced
raster topics and TIFF. See the message entitled "Tiff Questions - TIFF
7.0 ?" for more info.

- Large images (>2gb & >4gb)

We sell hardware for scanning aerial photos. Typical aerial photos
are 10"by10" and are scanned in 24-bit color at 7.5 microns (~3300 DPI).
It is possible that both higher resolutions and greater bit depths will be
used in the future.

Our imagery exploitation systems use tiling and a "full-set" of overviews
(1/2, 1/4, ...) to optimize performance. Usually there are about 8
overviews in a full set. With a full 10x10 RGB scan and a full set of
overviews, the uncompressed data size approaches 5 Gigabytes for a single
image. In the uncompressed form, this exceeds the addressing capability of
the TIFF format.

Of course, we could write compressed files instead of uncompressed. Our
experience with compression of these types of images has been:

* PackBits does not compress scanned photos well since there are very few
runs.

* LZW, besides being patented and slow, usually only gets us down to about
3.75 Gig. We have not yet tested "Deflate", but I doubt that it will get
us much more than LZW.

* For some workflows, JPEG's lossy compression is not allowed, since even
though the picture might "look" good, correlation and other processing of
the images get hung up on JPEG artifacts and give different results than
the same algorithms on losslessly or un-compressed imagery.

The 2 Gigabyte limit is not a limit of TIFF, since offsets are defined to
be "unsigned long"s. However many TIFF readers will blindly hand off the
offset to the "fseek" function. Since the standard C library
implementation of fseek takes a signed number, >2Gig offsets will be
negative. This may even be true on 64-bit OS's if sign extension is
automatically done when converting from 32-bit long to 64-bit long.

Files with offsets to strips or tiles that are past the 4Gig limit are
plainly not allowed in TIFF.

It is apparent that larger files are in the works: the recently released
NITF format allows images up to 17 Gigabytes in size.


Niles Ritter suggested that one solution to this dilemma could be to have
the first IFD in the file be a reduced resolution version of the image that
adheres to the current TIFF spec, and always contains offsets less than
2Gig (to avoid either problem).

A "private" tag in the first IFD could point to other IFDs much the same
way the TIFF TREES proposal in TTN1 does. These IFDs would contain
advanced features that a naive TIFF reader would not understand, but only
apps that understand the private tag would be accessing these IFDs.

To implement this, we need some new tags, and some new tag types.

Obviously a tag type of "LONG64 - A 64 bit unsigned integer" is needed, and
while we are at it we might as well include the signed version: "SLONG64"

New definitions of the offset tags for both strips and tiles are needed. I
would assume that for single strip and single tile compatibility, new
definitions of the bytecounts tags will also be needed, as well as a new
RowsPerStrip definition.

The question now is: What numbers do we assign these new tags and types ?
I realize that with a private tag and essentially private IFDs, we are free
to use any numbers we see fit. However, if any of these changes are
planned for TIFF 7.0, I would like to be compatible with them.

Conversely, what should I do to get this into TIFF 7.0 ?

Write up TTN3 ?

Here is a stab at the basics....
================================================== ======================
TAG TYPES:

YY = "LONG64 - A 64 bit unsigned integer"
YY+1 = "SLONG64 - A 64 bit signed integer"
!!! DONT USE THESE TYPES - THIS IS NOT YET APPROVED !!!



TAGS:

IFDOffset64 !!! DONT USE THIS TAG - THIS IS NOT YET APPROVED !!!
Tag = XXX
Type = LONG
Count = 1
Points to a IFD that contains LONG64 data types in the tag list.


RowsPerStrip64 !!! DONT USE THIS TAG - THIS IS NOT YET APPROVED !!!
Tag = XXX+1
Type = LONG64

The number of rows in each strip (except possibly the last strip.) For
example, if ImageLength is 24, and RowsPerStrip is 10, then there are 3
strips, with 10 rows in the first strip, 10 rows in the second strip, and
4 rows in the third strip. (The data in the last strip is not padded with
6 extra rows of dummy data.)


StripOffsets64 !!! DONT USE THIS TAG - THIS IS NOT YET APPROVED !!!
Tag = XXX+2
Type = LONG64
For each strip, the byte offset of that strip.


StripByteCounts64 !!! DONT USE THIS TAG - THIS IS NOT YET APPROVED !!!
Tag = XXX+3
Type = LONG64
For each strip, the number of bytes in that strip after any compression.


TileOffsets64 !!! DONT USE THIS TAG - THIS IS NOT YET APPROVED !!!
Tag = XXX+4
Type = LONG64
N = TilesPerImage for PlanarConfiguration = 1
= SamplesPerPixel * TilesPerImage for PlanarConfiguration = 2

For each tile, the byte offset of that tile, as compressed and stored on
disk. The offset is specified with respect to the beginning of the TIFF
file. Note that this implies that each tile has a location independent of
the locations of other tiles. Offsets are ordered left-to-right and
top-to-bottom. For PlanarConfiguration = 2, the offsets for the first
component plane are stored first, followed by all the offsets for the
second component plane, and so on.

No default. See also TileWidth, TileLength, TileByteCounts64.


TileByteCounts 64 !!! DONT USE THIS TAG - THIS IS NOT YET APPROVED !!!
Tag = XXX+5
Type = LONG64
N = TilesPerImage for PlanarConfiguration = 1
= SamplesPerPixel * TilesPerImage for PlanarConfiguration = 2

For each tile, the number of (compressed) bytes in that tile. See
TileOffsets for a description of how the byte counts are ordered.

No default. See also TileWidth, TileLength, TileOffsets64.


================================================== ======================


I can see at least one problem with this approach. Programs that add to or
modify header values "in-place" (i.e. without re-writing the entire file)
may try to re-write the IFD or some data pointed to by the TAGs in the IFD
at the end of the image. Such programs will either fail or write a
corrupted image if they try to modify one of these files.

Even programs that understand the LONG64 construct will be hard pressed to
do this correctly since there is no free space in the <2gig area to write
additional data for the first image.

Perhaps an additional tag that points to some free space that was
purposefully left in the <2gig area could help here. (bring back the
deprecated "FreeOffsets & FreeByteCounts tags ?)


The only other valid solution I can see is so drastic that I hate to even
bring it up. We would need to modify the TIFF Version number to be
something other than "42" and use an 8-byte initial IFD offset along with
the definitions for the new tags above (or re-cast the current
implementation of the necessary TAGs to accept LONG64 values).


--
ed grissom
__________________
Reply With Quote
  #2 (permalink)  
Old 06-13-2006, 04:30 PM
pspeters's Avatar
pspeters pspeters is offline
Senior Member
My Mood:
 
Join Date: Mar 2006
Location: USA
Age: 16
Posts: 284
Points: 32.38
Donate
wow....um..ok
__________________
ever heard of cashcrate? you complete offers FOR FREE and get paid buy check monthly! beleive me it works-Cashcrate



Reply With Quote
  #3 (permalink)  
Old 06-13-2006, 04:36 PM
Time For A Game!'s Avatar
Time For A Game! Time For A Game! is offline
Senior Member
My Mood:
 
Join Date: May 2006
Location: Portugal!
Age: 15
Posts: 531
Points: 1.81
Donate
Send a message via MSN to Time For A Game!
Quote:
Originally Posted by pspeters
wow....um..ok
OK.....
Big speech alright...

Now, can someone say this to me in Kidies language? (or in Portuguese )
Reply With Quote
  #4 (permalink)  
Old 06-13-2006, 04:53 PM
!_PA_!'s Avatar
!_PA_! !_PA_! is offline
Member
 
Join Date: Apr 2006
Posts: 91
Points: 0.04
Donate
__________________
http://www.pspdesire.co.nr/ psp games movies and more
Reply With Quote
  #5 (permalink)  
Old 06-13-2006, 04:58 PM
MiG's Avatar
MiG MiG is offline
Member
 
Join Date: May 2006
Posts: 73
Points: 0.31
Donate
well i just posted the newstory i found, i think it explains the techinical wat not of the exploit, so maybe an experienced dev. could try and forge a .tiff from this.

I dont really care for a downgrader, or homebrew for that matter, but any news is worthwhile and whether anything can come of it is irrelivant.
__________________
Reply With Quote
  #6 (permalink)  
Old 06-13-2006, 05:00 PM
=A.O.D='s Avatar
=A.O.D= =A.O.D= is offline
Senior Member
My Mood:
 
Join Date: Feb 2006
Location: WESTSlDE
Posts: 377
Points: 0.66
Donate
Send a message via Yahoo to =A.O.D=
engish please! me no smart word thing
__________________
Reply With Quote
  #7 (permalink)  
Old 06-13-2006, 05:06 PM
charizard2006's Avatar
charizard2006 charizard2006 is offline
Senior Member
My Mood:
 
Join Date: Mar 2006
Posts: 1,011
Points: 0.93
Donate
yea u need to make this more clear to us... wat is this exactly
__________________

Reply With Quote
  #8 (permalink)  
Old 06-13-2006, 05:11 PM
metroidblade's Avatar
metroidblade metroidblade is offline
Senior Member
My Mood:
 
Join Date: Nov 2005
Location: MO
Age: 18
Posts: 482
Points: 26.38
Donate
i think he is thinking instead of a gif exploit we could use a tif exploit to downgradei wonder if this would work?and hey at least he is thinking!!!
__________________
I wish those that ask questions would read the Readme first.....
Reply With Quote
  #9 (permalink)  
Old 06-13-2006, 05:20 PM
PSPNut's Avatar
PSPNut PSPNut is offline
Senior Member
 
Join Date: Apr 2006
Location: Aylesbury, UK
Posts: 205
Points: 0.49
Donate
Send a message via MSN to PSPNut
hmm, ok i see. But the question is how? (in simplier terms)
__________________





____________________________________________
Live Forever or Die Trying!
Reply With Quote
  #10 (permalink)  
Old 06-13-2006, 05:27 PM
MiG's Avatar
MiG MiG is offline
Member
 
Join Date: May 2006
Posts: 73
Points: 0.31
Donate
Bloody hell lol, u ppl must be all < 15yr old.

The story mentions how a 2gig tiff can cause buffer overflows in the wrong places causing code to be ran ect ect.

Probably wont work but thats the basics of el story.
__________________
Reply With Quote
Reply

« R5 IS OUT CHECK IT OUT | device hook sample launcher V0.41d! »



Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On

Points Per Thread View: 0.00
Points Per Thread: 1.00
Points Per Reply: 0.10

Similar Threads
Thread Thread Starter Forum Replies Last Post
Lua: large sound files chrispy Development Center 3 06-02-2006 11:15 AM





Crave Partner Sites: CraveOnline.com | DVDFile.com | PSP3D.com | ComingSoon.net | SuperHeroHype.com | RedBalcony.com | ActionTrip.com | CraveLyrics.com
Soundtrack.net | CraveFix.com | SpikedHumor.com | RPGamer.com | TattooNow.com | ImpactWrestling.com | SeekLyrics.com | PedalBMX.com | WildKO.com
vidKing.com | StrategyInformer.com | HHdb.com | RapLeagues.com | HipHop-Lyrics.com | Cravecocktails.com | ThePhatPhree.com | RideJudge.com | HottieSpots.com

PSP3D Footer Left Powered by Custom vB Version 5.1.0 for Crave Online Media, LLC.
Copyright © 2000 - 2007, Jelsoft Enterprises Ltd. and PSP3D.com.
LinkBacks Enabled by vBSEO 3.0.0 RC8

All times are GMT -4. The time now is 08:11 PM.
PSP3D Footer Right