libextractor

geotiff_extractor.c (52449B)

---

 /*
      This file is part of libextractor.
      Copyright (C) 2026 Vidyut Samanta and Christian Grothoff
 
      libextractor is free software; you can redistribute it and/or modify
      it under the terms of the GNU General Public License as published
      by the Free Software Foundation; either version 3, or (at your
      option) any later version.
 
      libextractor is distributed in the hope that it will be useful, but
      WITHOUT ANY WARRANTY; without even the implied warranty of
      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
      General Public License for more details.
 
      You should have received a copy of the GNU General Public License
      along with libextractor; see the file COPYING.  If not, write to the
      Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
      Boston, MA 02110-1301, USA.
  */
 /**
  * @file plugins/geotiff_extractor.c
  * @brief plugin to support GeoTIFF files
  * @author Christian Grothoff
  *
  * A GeoTIFF is an ordinary TIFF 6.0 (or BigTIFF) file that additionally
  * carries a handful of private tags describing where on the Earth the
  * raster sits.  We do not link libtiff or libgeotiff: all we need is a
  * bounded walk over the image file directory, and the `tiff' plugin --
  * which does link libtiff -- is only built when that library is
  * present, so this plugin has to stand on its own anyway.
  *
  * Deliberately, we say nothing at all about a plain TIFF: without one
  * of the four georeferencing tags the file belongs to the `tiff' and
  * `exiv2' plugins and we return without emitting anything.
  *
  * References: OGC GeoTIFF 1.1 (OGC 19-008r4), the original GeoTIFF
  * 1.8.2 specification, TIFF 6.0 and Adobe's BigTIFF description.
  */
 #include "platform.h"
 #include "extractor.h"
 #include "forensics.h"
 
 #include <math.h>
 
 
 /**
  * How many image file directories we are willing to follow.  Real
  * files have one plus a handful of reduced-resolution overviews.
  */
 #define GEOTIFF_MAX_IFD 16
 
 /**
  * How many entries we look at in a single IFD.  GDAL writes a few
  * dozen; anything past this is padding or an attack.
  */
 #define GEOTIFF_MAX_ENTRIES 512
 
 /**
  * How many GeoTIFF keys we parse out of the key directory.  The
  * registry defines well under a hundred.
  */
 #define GEOTIFF_MAX_KEYS 512
 
 /**
  * Cap on the number of bytes of any one tag value we will read (and
  * hence allocate).  The largest thing we touch is GDAL's XML blob.
  */
 #define GEOTIFF_MAX_VALUE 65536
 
 /**
  * How many `<Item>' elements we pull out of GDAL_METADATA.
  */
 #define GEOTIFF_MAX_GDAL_ITEMS 16
 
 /**
  * Exclusive upper bound on ImageWidth/ImageLength.  Both are LONG in
  * the TIFF specification, so 2^32 admits every legal file; the point of
  * the bound is that the tag is read as a `double' (it may be typed
  * DOUBLE in the file) and converting one larger than ULLONG_MAX to
  * `unsigned long long' is undefined behaviour.
  */
 #define GEOTIFF_MAX_DIM 4294967296.0
 
 
 /* TIFF field types, from TIFF 6.0 plus the BigTIFF additions. */
 #define TT_BYTE 1
 #define TT_ASCII 2
 #define TT_SHORT 3
 #define TT_LONG 4
 #define TT_RATIONAL 5
 #define TT_SBYTE 6
 #define TT_UNDEFINED 7
 #define TT_SSHORT 8
 #define TT_SLONG 9
 #define TT_SRATIONAL 10
 #define TT_FLOAT 11
 #define TT_DOUBLE 12
 #define TT_LONG8 16
 #define TT_SLONG8 17
 #define TT_IFD8 18
 
 
 /**
  * The tags we care about.  Used to index #Context::tags.
  */
 enum WantedTag
 {
   W_WIDTH = 0,
   W_LENGTH,
   W_BITS,
   W_COMPRESSION,
   W_DESCRIPTION,
   W_MAKE,
   W_MODEL,
   W_SAMPLES,
   W_SOFTWARE,
   W_DATETIME,
   W_ARTIST,
   W_COPYRIGHT,
   W_PIXELSCALE,
   W_TIEPOINT,
   W_TRANSFORM,
   W_GEOKEYS,
   W_GEODOUBLE,
   W_GEOASCII,
   W_GDAL_META,
   W_GDAL_NODATA,
   W_COUNT
 };
 
 
 /**
  * TIFF tag numbers, in the order of `enum WantedTag'.
  */
 static const uint16_t wanted_tags[W_COUNT] = {
   256,     /* ImageWidth */
   257,     /* ImageLength */
   258,     /* BitsPerSample */
   259,     /* Compression */
   270,     /* ImageDescription */
   271,     /* Make */
   272,     /* Model */
   277,     /* SamplesPerPixel */
   305,     /* Software */
   306,     /* DateTime */
   315,     /* Artist */
   33432,   /* Copyright */
   33550,   /* ModelPixelScaleTag */
   33922,   /* ModelTiepointTag */
   34264,   /* ModelTransformationTag */
   34735,   /* GeoKeyDirectoryTag */
   34736,   /* GeoDoubleParamsTag */
   34737,   /* GeoAsciiParamsTag */
   42112,   /* GDAL_METADATA */
   42113    /* GDAL_NODATA */
 };
 
 
 /**
  * One directory entry we decided to keep.
  */
 struct Entry
 {
   /**
    * Number of values, from the entry's count field.
    */
   uint64_t count;
 
   /**
    * Where the value lives, if it did not fit in the entry.  Only
    * meaningful when the total size exceeds the inline field.
    */
   uint64_t offset;
 
   /**
    * The raw value/offset field, 4 bytes for classic TIFF and 8 for
    * BigTIFF.  Small values live here directly.
    */
   unsigned char val[8];
 
   /**
    * TIFF field type (one of the TT_* constants).
    */
   uint16_t type;
 
   /**
    * True once we have seen this tag.  We keep the first occurrence:
    * later IFDs are overviews and thumbnails.
    */
   int found;
 };
 
 
 /**
  * State for one extraction run.
  */
 struct Context
 {
   /**
    * Extraction context we were handed.
    */
   struct EXTRACTOR_ExtractContext *ec;
 
   /**
    * Size of the file, used to bounds-check every offset.
    */
   uint64_t fsize;
 
   /**
    * True if the file is big-endian (`MM').
    */
   int be;
 
   /**
    * True if the file is BigTIFF (version 43): 8-byte offsets and
    * counts, 20-byte directory entries.
    */
   int big;
 
   /**
    * The tags we found, indexed by `enum WantedTag'.
    */
   struct Entry tags[W_COUNT];
 };
 
 
 /**
  * The GeoTIFF keys we understand, as read out of the key directory.
  */
 struct GeoKeys
 {
   /**
    * GTModelTypeGeoKey (1024): 1 projected, 2 geographic, 3 geocentric.
    */
   unsigned int model_type;
 
   /**
    * GTRasterTypeGeoKey (1025): 1 pixel-is-area, 2 pixel-is-point.
    */
   unsigned int raster_type;
 
   /**
    * GeographicTypeGeoKey (2048), an EPSG geographic CRS code.
    */
   unsigned int geographic;
 
   /**
    * ProjectedCSTypeGeoKey (3072), an EPSG projected CRS code.
    */
   unsigned int projected;
 
   /**
    * VerticalCSTypeGeoKey (4096), an EPSG vertical CRS code.
    */
   unsigned int vertical;
 
   /**
    * ProjLinearUnitsGeoKey (3076), an EPSG unit-of-measure code.
    */
   unsigned int linear_units;
 
   /**
    * Which of the above were actually present, as a bit set of
    * 1 << (key index); see the have_* flags below instead.
    */
   int have_model_type;
 
   int have_raster_type;
 
   int have_geographic;
 
   int have_projected;
 
   int have_vertical;
 
   int have_linear_units;
 };
 
 
 /**
  * Read a 16-bit integer in the file's byte order.
  *
  * @param ctx extraction state, for the byte order
  * @param p the two bytes
  * @return the value
  */
 static uint16_t
 geo_u16 (const struct Context *ctx,
          const unsigned char *p)
 {
   return ctx->be
          ? EXTRACTOR_forensic_be16_ (p)
          : EXTRACTOR_forensic_le16_ (p);
 }
 
 
 /**
  * Read a 32-bit integer in the file's byte order.
  *
  * @param ctx extraction state, for the byte order
  * @param p the four bytes
  * @return the value
  */
 static uint32_t
 geo_u32 (const struct Context *ctx,
          const unsigned char *p)
 {
   return ctx->be
          ? EXTRACTOR_forensic_be32_ (p)
          : EXTRACTOR_forensic_le32_ (p);
 }
 
 
 /**
  * Read a 64-bit integer in the file's byte order.
  *
  * @param ctx extraction state, for the byte order
  * @param p the eight bytes
  * @return the value
  */
 static uint64_t
 geo_u64 (const struct Context *ctx,
          const unsigned char *p)
 {
   return ctx->be
          ? EXTRACTOR_forensic_be64_ (p)
          : EXTRACTOR_forensic_le64_ (p);
 }
 
 
 /**
  * Read an IEEE 754 single as stored in the file.
  *
  * The bit pattern is assembled in host integer order first, so the
  * only assumption left is that the host's `float' is IEEE 754 with the
  * same byte order as its integers -- true on every platform
  * libextractor builds on.
  *
  * @param ctx extraction state, for the byte order
  * @param p the four bytes
  * @return the value
  */
 static double
 geo_f32 (const struct Context *ctx,
          const unsigned char *p)
 {
   uint32_t bits = geo_u32 (ctx,
                            p);
   float f;
 
   memcpy (&f,
           &bits,
           sizeof (f));
   return (double) f;
 }
 
 
 /**
  * Read an IEEE 754 double as stored in the file.
  *
  * @param ctx extraction state, for the byte order
  * @param p the eight bytes
  * @return the value
  */
 static double
 geo_f64 (const struct Context *ctx,
          const unsigned char *p)
 {
   uint64_t bits = geo_u64 (ctx,
                            p);
   double d;
 
   memcpy (&d,
           &bits,
           sizeof (d));
   return d;
 }
 
 
 /**
  * Size in bytes of one value of the given TIFF field type.
  *
  * @param type the TIFF field type
  * @return the size, 0 for a type we do not know (which makes the
  *         caller ignore the tag, as TIFF 6.0 requires)
  */
 static size_t
 type_size (uint16_t type)
 {
   switch (type)
   {
   case TT_BYTE:
   case TT_ASCII:
   case TT_SBYTE:
   case TT_UNDEFINED:
     return 1;
   case TT_SHORT:
   case TT_SSHORT:
     return 2;
   case TT_LONG:
   case TT_SLONG:
   case TT_FLOAT:
     return 4;
   case TT_RATIONAL:
   case TT_SRATIONAL:
   case TT_DOUBLE:
   case TT_LONG8:
   case TT_SLONG8:
   case TT_IFD8:
     return 8;
   default:
     return 0;
   }
 }
 
 
 /**
  * Fetch the bytes belonging to @a e, either from the entry itself or
  * from wherever in the file it points.
  *
  * @param ctx extraction state
  * @param e the directory entry
  * @param cap refuse to read (and allocate) more than this many bytes
  * @param[out] len number of bytes returned
  * @return the bytes, to be freed by the caller, NULL on any error
  */
 static unsigned char *
 load_value (const struct Context *ctx,
             const struct Entry *e,
             size_t cap,
             size_t *len)
 {
   size_t ts = type_size (e->type);
   size_t inline_max = ctx->big ? 8 : 4;
   size_t total;
   unsigned char *buf;
 
   if ( (! e->found) ||
        (0 == ts) ||
        (0 == e->count) )
     return NULL;
   if (cap > GEOTIFF_MAX_VALUE)
     cap = GEOTIFF_MAX_VALUE;
   /* This is the count-times-size multiplication the file controls;
      dividing instead of multiplying keeps it from wrapping. */
   if (e->count > ((uint64_t) cap) / ts)
     return NULL;
   total = (size_t) (e->count * ts);
   buf = malloc (total);
   if (NULL == buf)
     return NULL;
   if (total <= inline_max)
   {
     memcpy (buf,
             e->val,
             total);
     *len = total;
     return buf;
   }
   if ( (e->offset > ctx->fsize) ||
        (total > ctx->fsize - e->offset) ||
        (e->offset > (uint64_t) INT64_MAX) )
   {
     free (buf);
     return NULL;
   }
   if (! EXTRACTOR_forensic_read_ (ctx->ec,
                                   (int64_t) e->offset,
                                   buf,
                                   total))
   {
     free (buf);
     return NULL;
   }
   *len = total;
   return buf;
 }
 
 
 /**
  * Interpret element @a idx of an already loaded tag value as a double.
  *
  * @param ctx extraction state, for the byte order
  * @param type the TIFF field type the buffer holds
  * @param buf the value bytes
  * @param len number of bytes in @a buf
  * @param idx which element to read
  * @param[out] out where to store the value
  * @return 1 on success, 0 if the index or the type does not work out
  */
 static int
 value_as_double (const struct Context *ctx,
                  uint16_t type,
                  const unsigned char *buf,
                  size_t len,
                  size_t idx,
                  double *out)
 {
   size_t ts = type_size (type);
   const unsigned char *p;
 
   if ( (0 == ts) ||
        (idx >= len / ts) )
     return 0;
   p = &buf[idx * ts];
   switch (type)
   {
   case TT_BYTE:
   case TT_UNDEFINED:
     *out = (double) p[0];
     return 1;
   case TT_SBYTE:
     *out = (double) (int8_t) p[0];
     return 1;
   case TT_SHORT:
     *out = (double) geo_u16 (ctx, p);
     return 1;
   case TT_SSHORT:
     *out = (double) (int16_t) geo_u16 (ctx, p);
     return 1;
   case TT_LONG:
     *out = (double) geo_u32 (ctx, p);
     return 1;
   case TT_SLONG:
     *out = (double) (int32_t) geo_u32 (ctx, p);
     return 1;
   case TT_FLOAT:
     *out = geo_f32 (ctx, p);
     return 1;
   case TT_DOUBLE:
     *out = geo_f64 (ctx, p);
     return 1;
   case TT_RATIONAL:
     {
       uint32_t num = geo_u32 (ctx, p);
       uint32_t den = geo_u32 (ctx, p + 4);
 
       if (0 == den)
         return 0;
       *out = ((double) num) / ((double) den);
       return 1;
     }
   case TT_SRATIONAL:
     {
       int32_t num = (int32_t) geo_u32 (ctx, p);
       int32_t den = (int32_t) geo_u32 (ctx, p + 4);
 
       if (0 == den)
         return 0;
       *out = ((double) num) / ((double) den);
       return 1;
     }
   case TT_LONG8:
   case TT_IFD8:
     *out = (double) geo_u64 (ctx, p);
     return 1;
   case TT_SLONG8:
     *out = (double) (int64_t) geo_u64 (ctx, p);
     return 1;
   default:
     return 0;
   }
 }
 
 
 /**
  * Read a single numeric value out of one of our tags.
  *
  * Only the one element is fetched, never the whole array:
  * ModelTiepointTag holds a list of ground control points in files that
  * are not a simple grid, and that list can run to many kilobytes we
  * have no use for.
  *
  * @param ctx extraction state
  * @param w which tag to read
  * @param idx which element of the tag to read
  * @param[out] out where to store the value
  * @return 1 on success, 0 if the tag is absent or unusable
  */
 static int
 tag_double (const struct Context *ctx,
             enum WantedTag w,
             size_t idx,
             double *out)
 {
   const struct Entry *e = &ctx->tags[w];
   size_t ts = type_size (e->type);
   size_t inline_max = ctx->big ? 8 : 4;
   unsigned char raw[8];
   uint64_t total;
   uint64_t byte_off;
   uint64_t room;
 
   if ( (! e->found) ||
        (0 == ts) ||
        (((uint64_t) idx) >= e->count) )
     return 0;
   if (e->count > UINT64_MAX / ts)
     return 0;   /* a count that cannot describe any real array */
   total = e->count * ts;
   byte_off = ((uint64_t) idx) * ts;
   if (total <= inline_max)
   {
     memcpy (raw,
             &e->val[byte_off],
             ts);
   }
   else
   {
     if ( (e->offset > ctx->fsize) ||
          (e->offset > (uint64_t) INT64_MAX) )
       return 0;
     room = ctx->fsize - e->offset;
     if ( (byte_off > room) ||
          (ts > room - byte_off) )
       return 0;
     if (! EXTRACTOR_forensic_read_ (ctx->ec,
                                     (int64_t) (e->offset + byte_off),
                                     raw,
                                     ts))
       return 0;
   }
   return value_as_double (ctx,
                           e->type,
                           raw,
                           ts,
                           0,
                           out);
 }
 
 
 /**
  * Emit a string-valued tag, if it is present.
  *
  * @param ctx extraction state
  * @param w which tag to emit
  * @param type meta data type to report it as
  * @return 1 if the caller should stop extracting, 0 to continue
  */
 static int
 emit_ascii_tag (const struct Context *ctx,
                 enum WantedTag w,
                 enum EXTRACTOR_MetaType type)
 {
   unsigned char *buf;
   size_t len;
   int stop;
 
   if (TT_ASCII != ctx->tags[w].type)
     return 0;
   buf = load_value (ctx,
                     &ctx->tags[w],
                     EXTRACTOR_FORENSIC_MAX_STRING,
                     &len);
   if (NULL == buf)
     return 0;
   stop = EXTRACTOR_forensic_emit_text_ (ctx->ec,
                                         "geotiff",
                                         type,
                                         (const char *) buf,
                                         len);
   free (buf);
   return stop;
 }
 
 
 /**
  * Walk the chain of image file directories and remember the entries
  * for the tags in #wanted_tags.
  *
  * @param ctx extraction state, updated in place
  * @param first offset of the first IFD, from the header
  */
 static void
 walk_ifds (struct Context *ctx,
            uint64_t first)
 {
   uint64_t seen[GEOTIFF_MAX_IFD];
   unsigned int nseen = 0;
   uint64_t off = first;
   size_t esz = ctx->big ? 20 : 12;
   size_t cntsz = ctx->big ? 8 : 2;
   size_t nextsz = ctx->big ? 8 : 4;
 
   while ( (0 != off) &&
           (nseen < GEOTIFF_MAX_IFD) )
   {
     unsigned char cnt[8];
     unsigned char *ents;
     uint64_t avail;
     uint64_t nent;
     uint64_t declared;
     int truncated = 0;
 
     /* An IFD that points back at one we already parsed would loop
        forever; the offset cap alone does not catch a 2-cycle. */
     for (unsigned int i = 0; i < nseen; i++)
       if (seen[i] == off)
         return;
     seen[nseen++] = off;
     if ( (off >= ctx->fsize) ||
          (off > (uint64_t) INT64_MAX) )
       return;
     avail = ctx->fsize - off;
     if (avail < cntsz)
       return;
     if (! EXTRACTOR_forensic_read_ (ctx->ec,
                                     (int64_t) off,
                                     cnt,
                                     cntsz))
       return;
     declared = ctx->big
                ? geo_u64 (ctx, cnt)
                : (uint64_t) geo_u16 (ctx, cnt);
     nent = declared;
     if (nent > GEOTIFF_MAX_ENTRIES)
     {
       nent = GEOTIFF_MAX_ENTRIES;
       truncated = 1;
     }
     avail -= cntsz;
     if (avail / esz < nent)
     {
       /* the file is shorter than it claims; take what is there */
       nent = avail / esz;
       truncated = 1;
     }
     if (0 == nent)
       return;
     ents = malloc ((size_t) (nent * esz));
     if (NULL == ents)
       return;
     if (! EXTRACTOR_forensic_read_ (ctx->ec,
                                     -1,
                                     ents,
                                     (size_t) (nent * esz)))
     {
       free (ents);
       return;
     }
     for (uint64_t i = 0; i < nent; i++)
     {
       const unsigned char *p = &ents[i * esz];
       uint16_t tag = geo_u16 (ctx, p);
 
       for (unsigned int k = 0; k < W_COUNT; k++)
       {
         struct Entry *e = &ctx->tags[k];
 
         if ( (wanted_tags[k] != tag) ||
              (e->found) )
           continue;
         e->type = geo_u16 (ctx, p + 2);
         if (ctx->big)
         {
           e->count = geo_u64 (ctx, p + 4);
           memcpy (e->val,
                   p + 12,
                   8);
           e->offset = geo_u64 (ctx, e->val);
         }
         else
         {
           e->count = (uint64_t) geo_u32 (ctx, p + 4);
           memcpy (e->val,
                   p + 8,
                   4);
           e->offset = (uint64_t) geo_u32 (ctx, e->val);
         }
         e->found = 1;
         break;
       }
     }
     free (ents);
     if (truncated)
       return;   /* the next-IFD pointer is not where we think it is */
     /* the next-IFD offset follows the entries */
     if (avail - declared * esz < nextsz)
       return;
     if (! EXTRACTOR_forensic_read_ (ctx->ec,
                                     -1,
                                     cnt,
                                     nextsz))
       return;
     off = ctx->big
           ? geo_u64 (ctx, cnt)
           : (uint64_t) geo_u32 (ctx, cnt);
   }
 }
 
 
 /**
  * Human-readable name for the EPSG codes a first pass is most likely
  * to run into.  Anything else is reported as the bare code; resolving
  * the full registry would mean shipping it.
  *
  * @param code the EPSG CRS code
  * @param[out] buf where to write the name
  * @param buf_size number of bytes in @a buf
  * @return 1 if a name was written, 0 if the code is not one we know
  */
 static int
 epsg_name (unsigned int code,
            char *buf,
            size_t buf_size)
 {
   static const struct
   {
     unsigned int code;
     const char *name;
   } known[] = {
     { 4326, "WGS 84" },
     { 4269, "NAD83" },
     { 4258, "ETRS89" },
     { 4979, "WGS 84 (3D)" },
     { 3857, "WGS 84 / Pseudo-Mercator" },
     { 3395, "WGS 84 / World Mercator" },
     { 5714, "MSL height" },
     { 5773, "EGM96 height" },
     { 3855, "EGM2008 height" },
     { 0, NULL }
   };
 
   for (unsigned int i = 0; NULL != known[i].name; i++)
     if (known[i].code == code)
     {
       if (((size_t) snprintf (buf,
                               buf_size,
                               "%s",
                               known[i].name)) >= buf_size)
         return 0;
       return 1;
     }
   if ( (32601 <= code) &&
        (32660 >= code) )
   {
     snprintf (buf,
               buf_size,
               "WGS 84 / UTM zone %uN",
               code - 32600);
     return 1;
   }
   if ( (32701 <= code) &&
        (32760 >= code) )
   {
     snprintf (buf,
               buf_size,
               "WGS 84 / UTM zone %uS",
               code - 32700);
     return 1;
   }
   return 0;
 }
 
 
 /**
  * How many citation strings we remember in order not to report the
  * same CRS name twice.
  */
 #define GEOTIFF_MAX_CITATIONS 4
 
 
 /**
  * The citation strings emitted so far, so that the very common case of
  * GTCitationGeoKey and PCSCitationGeoKey carrying the same text does
  * not produce the same value twice.
  */
 struct Citations
 {
   /**
    * The strings, not NUL-terminated.
    */
   char text[GEOTIFF_MAX_CITATIONS][128];
 
   /**
    * Length of each entry in #text.
    */
   size_t len[GEOTIFF_MAX_CITATIONS];
 
   /**
    * How many entries of #text are in use.
    */
   unsigned int count;
 };
 
 
 /**
  * Emit one GeoTIFF key whose value is a substring of
  * GeoAsciiParamsTag.
  *
  * GeoASCII strings are packed into one blob and terminated by `|'
  * rather than by NUL, because a NUL would end the whole TIFF ASCII
  * field.
  *
  * @param ctx extraction state
  * @param[in,out] cits citations reported so far
  * @param ascii the GeoAsciiParamsTag bytes, NULL if the tag is absent
  * @param ascii_len number of bytes in @a ascii
  * @param off offset of the substring, from the key's Value_Offset
  * @param count length of the substring, from the key's Count
  * @param type meta data type to report it as
  * @return 1 if the caller should stop extracting, 0 to continue
  */
 static int
 emit_geo_ascii (const struct Context *ctx,
                 struct Citations *cits,
                 const unsigned char *ascii,
                 size_t ascii_len,
                 size_t off,
                 size_t count,
                 enum EXTRACTOR_MetaType type)
 {
   size_t n;
 
   if ( (NULL == ascii) ||
        (off >= ascii_len) )
     return 0;
   n = count;
   if (n > ascii_len - off)
     n = ascii_len - off;
   /* The string runs to its `|' terminator.  Trusting Count instead
      would run one string into the next whenever Count is wrong, and it
      is the file that chooses Count. */
   for (size_t i = 0; i < n; i++)
     if ('|' == ascii[off + i])
     {
       n = i;
       break;
     }
   if (0 == n)
     return 0;
   for (unsigned int i = 0; i < cits->count; i++)
   {
     if ( (cits->len[i] == n) &&
          (0 == memcmp (cits->text[i],
                        &ascii[off],
                        n)) )
       return 0;   /* already reported under another key */
   }
   if ( (cits->count < GEOTIFF_MAX_CITATIONS) &&
        (n <= sizeof (cits->text[0])) )
   {
     memcpy (cits->text[cits->count],
             &ascii[off],
             n);
     cits->len[cits->count] = n;
     cits->count++;
   }
   return EXTRACTOR_forensic_emit_text_ (ctx->ec,
                                         "geotiff",
                                         type,
                                         (const char *) &ascii[off],
                                         n);
 }
 
 
 /**
  * Parse GeoKeyDirectoryTag, emitting the human-readable citations as
  * we go and collecting the numeric keys into @a gk.
  *
  * @param ctx extraction state
  * @param[out] gk where to store the numeric keys
  * @return 1 if the caller should stop extracting, 0 to continue
  */
 static int
 parse_geo_keys (const struct Context *ctx,
                 struct GeoKeys *gk)
 {
   struct Citations cits;
   unsigned char *dir;
   unsigned char *ascii = NULL;
   size_t dir_len;
   size_t ascii_len = 0;
   size_t nvals;
   size_t nkeys;
   int stop = 0;
 
   memset (gk,
           0,
           sizeof (*gk));
   memset (&cits,
           0,
           sizeof (cits));
   if (TT_SHORT != ctx->tags[W_GEOKEYS].type)
     return 0;
   dir = load_value (ctx,
                     &ctx->tags[W_GEOKEYS],
                     2 * (4 + 4 * GEOTIFF_MAX_KEYS),
                     &dir_len);
   if (NULL == dir)
     return 0;
   nvals = dir_len / 2;
   if (4 > nvals)
   {
     free (dir);
     return 0;
   }
   nkeys = geo_u16 (ctx,
                    &dir[6]);
   if (nkeys > GEOTIFF_MAX_KEYS)
     nkeys = GEOTIFF_MAX_KEYS;
   /* NumberOfKeys is not to be trusted over the tag's own count */
   if (nkeys > (nvals - 4) / 4)
     nkeys = (nvals - 4) / 4;
   if ( (0 != ctx->tags[W_GEOASCII].found) &&
        (TT_ASCII == ctx->tags[W_GEOASCII].type) )
     ascii = load_value (ctx,
                         &ctx->tags[W_GEOASCII],
                         GEOTIFF_MAX_VALUE,
                         &ascii_len);
   for (size_t i = 0; (i < nkeys) && (0 == stop); i++)
   {
     const unsigned char *k = &dir[8 + i * 8];
     uint16_t key_id = geo_u16 (ctx, k);
     uint16_t location = geo_u16 (ctx, k + 2);
     uint16_t count = geo_u16 (ctx, k + 4);
     uint16_t value = geo_u16 (ctx, k + 6);
 
     if (34737 == location)
     {
       /* a substring of GeoAsciiParamsTag: these are the CRS names */
       switch (key_id)
       {
       case 1026:   /* GTCitationGeoKey */
       case 2049:   /* GeogCitationGeoKey */
       case 3073:   /* PCSCitationGeoKey */
       case 4097:   /* VerticalCitationGeoKey */
         stop = emit_geo_ascii (ctx,
                                &cits,
                                ascii,
                                ascii_len,
                                value,
                                count,
                                EXTRACTOR_METATYPE_COORDINATE_SYSTEM);
         break;
       default:
         break;
       }
       continue;
     }
     if (34736 == location)
       continue;   /* a DOUBLE in GeoDoubleParamsTag; none of the keys
                      we report is double-valued (they are ellipsoid
                      parameters and projection constants) */
     if (0 != location)
       continue;   /* not a location the specification defines */
     if (1 != count)
       continue;   /* an inline key is a single SHORT by definition */
     switch (key_id)
     {
     case 1024:   /* GTModelTypeGeoKey */
       gk->model_type = value;
       gk->have_model_type = 1;
       break;
     case 1025:   /* GTRasterTypeGeoKey */
       gk->raster_type = value;
       gk->have_raster_type = 1;
       break;
     case 2048:   /* GeographicTypeGeoKey */
       gk->geographic = value;
       gk->have_geographic = 1;
       break;
     case 3072:   /* ProjectedCSTypeGeoKey */
       gk->projected = value;
       gk->have_projected = 1;
       break;
     case 3076:   /* ProjLinearUnitsGeoKey */
       gk->linear_units = value;
       gk->have_linear_units = 1;
       break;
     case 4096:   /* VerticalCSTypeGeoKey */
       gk->vertical = value;
       gk->have_vertical = 1;
       break;
     default:
       break;
     }
   }
   free (ascii);
   free (dir);
   return stop;
 }
 
 
 /**
  * Emit the coordinate reference system and the two descriptive keys.
  *
  * @param ctx extraction state
  * @param gk the parsed GeoTIFF keys
  * @return 1 if the caller should stop extracting, 0 to continue
  */
 static int
 emit_crs (const struct Context *ctx,
           const struct GeoKeys *gk)
 {
   static const char *model_names[] = {
     NULL,
     "projected",
     "geographic",
     "geocentric"
   };
   char name[128];
   unsigned int code = 0;
   int have = 0;
 
   /* A projected CRS is the more specific statement, so it wins; the
      geographic key is then only the datum the projection sits on. */
   if ( (gk->have_projected) &&
        (0 != gk->projected) &&
        (32767 != gk->projected) )
   {
     code = gk->projected;
     have = 1;
   }
   else if ( (gk->have_geographic) &&
             (0 != gk->geographic) &&
             (32767 != gk->geographic) )
   {
     code = gk->geographic;
     have = 1;
   }
   else if ( (gk->have_vertical) &&
             (0 != gk->vertical) &&
             (32767 != gk->vertical) )
   {
     code = gk->vertical;
     have = 1;
   }
   if (have)
   {
     if (epsg_name (code,
                    name,
                    sizeof (name)))
     {
       if (EXTRACTOR_forensic_emit_ (ctx->ec,
                                     "geotiff",
                                     EXTRACTOR_METATYPE_COORDINATE_SYSTEM,
                                     "EPSG:%u (%s)",
                                     code,
                                     name))
         return 1;
     }
     else if (EXTRACTOR_forensic_emit_ (ctx->ec,
                                        "geotiff",
                                        EXTRACTOR_METATYPE_COORDINATE_SYSTEM,
                                        "EPSG:%u",
                                        code))
     {
       return 1;
     }
   }
   if ( (gk->have_vertical) &&
        (have) &&
        (code != gk->vertical) &&
        (0 != gk->vertical) &&
        (32767 != gk->vertical) &&
        (EXTRACTOR_forensic_emit_ (ctx->ec,
                                   "geotiff",
                                   EXTRACTOR_METATYPE_COORDINATE_SYSTEM,
                                   "vertical EPSG:%u",
                                   gk->vertical)) )
     return 1;
   if ( (gk->have_model_type) &&
        (gk->model_type < sizeof (model_names) / sizeof (model_names[0])) &&
        (NULL != model_names[gk->model_type]) &&
        (EXTRACTOR_forensic_emit_ (ctx->ec,
                                   "geotiff",
                                   EXTRACTOR_METATYPE_COMMENT,
                                   "GeoTIFF model type: %s",
                                   model_names[gk->model_type])) )
     return 1;
   if ( (gk->have_raster_type) &&
        ( (1 == gk->raster_type) ||
          (2 == gk->raster_type) ) &&
        (EXTRACTOR_forensic_emit_ (ctx->ec,
                                   "geotiff",
                                   EXTRACTOR_METATYPE_COMMENT,
                                   "GeoTIFF raster type: %s",
                                   (1 == gk->raster_type)
                                   ? "pixel is area"
                                   : "pixel is point")) )
     return 1;
   return 0;
 }
 
 
 /**
  * Name of the unit the model coordinates are expressed in.
  *
  * @param gk the parsed GeoTIFF keys
  * @return a unit name, or NULL if we cannot tell
  */
 static const char *
 model_units (const struct GeoKeys *gk)
 {
   if (gk->have_linear_units)
     switch (gk->linear_units)
     {
     case 9001:
       return "m";
     case 9002:
     case 9003:
       return "ft";
     case 9036:
       return "km";
     default:
       break;
     }
   if (gk->have_model_type)
   {
     if (2 == gk->model_type)
       return "degrees";   /* a geographic CRS; angular units by definition */
     if (1 == gk->model_type)
       return "m";         /* the overwhelmingly common projected case */
   }
   if ( (gk->have_geographic) &&
        (! gk->have_projected) )
     return "degrees";
   return NULL;
 }
 
 
 /**
  * Emit the georeferencing derived from the model tags: the pixel
  * scale, the extent of the raster, and the tiepoint elevation.
  *
  * @param ctx extraction state
  * @param gk the parsed GeoTIFF keys
  * @return 1 if the caller should stop extracting, 0 to continue
  */
 static int
 emit_geometry (const struct Context *ctx,
                const struct GeoKeys *gk)
 {
   const char *units = model_units (gk);
   double width;
   double height;
   double sx;
   double sy;
   double sz;
   double west = 0.0;
   double east = 0.0;
   double north = 0.0;
   double south = 0.0;
   int have_scale;
   int have_box = 0;
 
   if ( (! tag_double (ctx, W_WIDTH, 0, &width)) ||
        (! tag_double (ctx, W_LENGTH, 0, &height)) ||
        (! isfinite (width)) ||
        (! isfinite (height)) ||
        (1.0 > width) ||
        (1.0 > height) )
   {
     width = 0.0;
     height = 0.0;
   }
   have_scale = (tag_double (ctx, W_PIXELSCALE, 0, &sx) &&
                 tag_double (ctx, W_PIXELSCALE, 1, &sy) &&
                 isfinite (sx) &&
                 isfinite (sy) &&
                 (0.0 != sx) &&
                 (0.0 != sy));
   if ( (! tag_double (ctx, W_PIXELSCALE, 2, &sz)) ||
        (! isfinite (sz)) )
     sz = 0.0;
   if (have_scale)
   {
     if (NULL != units)
     {
       if (EXTRACTOR_forensic_emit_ (ctx->ec,
                                     "geotiff",
                                     EXTRACTOR_METATYPE_IMAGE_RESOLUTION,
                                     "%.10g x %.10g %s/pixel",
                                     sx,
                                     sy,
                                     units))
         return 1;
     }
     else if (EXTRACTOR_forensic_emit_ (ctx->ec,
                                        "geotiff",
                                        EXTRACTOR_METATYPE_IMAGE_RESOLUTION,
                                        "%.10g x %.10g per pixel",
                                        sx,
                                        sy))
     {
       return 1;
     }
   }
   /* Preferred georeferencing: one tiepoint plus a pixel scale.  The
      model coordinate of raster point (i,j) is
        x = x_tie + (i - i_tie) * sx,  y = y_tie - (j - j_tie) * sy
      (y grows northwards while j grows downwards, which is why sy is
      subtracted).  Note that with GTRasterTypeGeoKey = RasterPixelIsArea
      the tiepoint names the *corner* of the pixel and the extent below
      is exact, whereas with RasterPixelIsPoint it names the pixel
      *centre* and the true extent is half a pixel larger on every side.
      We do not correct for that: half a pixel is not worth a second
      code path, but it is worth knowing about. */
   if (have_scale &&
       (0.0 < width) &&
       (0.0 < height))
   {
     double ti;
     double tj;
     double tx;
     double ty;
 
     if (tag_double (ctx, W_TIEPOINT, 0, &ti) &&
         tag_double (ctx, W_TIEPOINT, 1, &tj) &&
         tag_double (ctx, W_TIEPOINT, 3, &tx) &&
         tag_double (ctx, W_TIEPOINT, 4, &ty) &&
         isfinite (ti) && isfinite (tj) &&
         isfinite (tx) && isfinite (ty))
     {
       double x0 = tx + (0.0 - ti) * sx;
       double x1 = tx + (width - ti) * sx;
       double y0 = ty - (0.0 - tj) * sy;
       double y1 = ty - (height - tj) * sy;
 
       west = (x0 < x1) ? x0 : x1;
       east = (x0 < x1) ? x1 : x0;
       south = (y0 < y1) ? y0 : y1;
       north = (y0 < y1) ? y1 : y0;
       have_box = 1;
     }
   }
   if ( (! have_box) &&
        (0.0 < width) &&
        (0.0 < height) )
   {
     /* Fall back on ModelTransformationTag, a row-major 4x4 matrix that
        maps (i,j,k,1) to (x,y,z,1); only the first two rows matter for
        an extent.  The mapping may rotate, so take the extremes over
        all four raster corners rather than assuming axis alignment. */
     double m[8];
     int ok = 1;
 
     for (unsigned int i = 0; i < 8; i++)
       if ( (! tag_double (ctx, W_TRANSFORM, i, &m[i])) ||
            (! isfinite (m[i])) )
       {
         ok = 0;
         break;
       }
     if (ok)
     {
       static const double corner[4][2] = {
         { 0.0, 0.0 }, { 1.0, 0.0 }, { 0.0, 1.0 }, { 1.0, 1.0 }
       };
 
       for (unsigned int c = 0; c < 4; c++)
       {
         double i = corner[c][0] * width;
         double j = corner[c][1] * height;
         double x = m[0] * i + m[1] * j + m[3];
         double y = m[4] * i + m[5] * j + m[7];
 
         if ( (! isfinite (x)) ||
              (! isfinite (y)) )
         {
           have_box = 0;
           break;
         }
         if (0 == c)
         {
           west = east = x;
           south = north = y;
           have_box = 1;
           continue;
         }
         if (x < west)
           west = x;
         if (x > east)
           east = x;
         if (y < south)
           south = y;
         if (y > north)
           north = y;
       }
     }
   }
   /* The box is in whatever units the CRS uses -- degrees for a
      geographic CRS, metres for a typical projected one.  We emit it
      unconverted and let COORDINATE_SYSTEM say which; reprojecting
      would mean linking PROJ. */
   if ( (have_box) &&
        (EXTRACTOR_forensic_emit_ (ctx->ec,
                                   "geotiff",
                                   EXTRACTOR_METATYPE_BOUNDING_BOX,
                                   "%.10g,%.10g,%.10g,%.10g",
                                   west,
                                   south,
                                   east,
                                   north)) )
     return 1;
   {
     double tz;
 
     /* The tiepoint's z is only meaningful when the file actually
        carries a vertical dimension; a plain 2D raster stores 0 there. */
     if ( (tag_double (ctx, W_TIEPOINT, 5, &tz)) &&
          (isfinite (tz)) &&
          (0.0 != tz) &&
          ( (gk->have_vertical) ||
            (0.0 != sz) ) &&
          (EXTRACTOR_forensic_emit_ (ctx->ec,
                                     "geotiff",
                                     EXTRACTOR_METATYPE_LOCATION_ELEVATION,
                                     "%.10g",
                                     tz)) )
       return 1;
   }
   return 0;
 }
 
 
 /**
  * Find @a needle in @a hay.
  *
  * @param hay where to search
  * @param hay_len number of bytes in @a hay
  * @param from index to start searching at
  * @param needle NUL-terminated string to look for
  * @param[out] pos index of the match
  * @return 1 if found, 0 if not
  */
 static int
 find_sub (const char *hay,
           size_t hay_len,
           size_t from,
           const char *needle,
           size_t *pos)
 {
   size_t nlen = strlen (needle);
 
   if ( (0 == nlen) ||
        (hay_len < nlen) )
     return 0;
   for (size_t i = from; i + nlen <= hay_len; i++)
     if (0 == memcmp (&hay[i],
                      needle,
                      nlen))
     {
       *pos = i;
       return 1;
     }
   return 0;
 }
 
 
 /**
  * Pull `<Item name="...">value</Item>' pairs out of GDAL's private
  * metadata tag.  This is where a GDAL-produced raster keeps its real
  * provenance: the acquisition time, the sensor, the processing chain.
  *
  * We do not decode XML entities or attributes beyond `name'; the point
  * is a cheap characterisation, and a value that needed unescaping is
  * still recognisable.
  *
  * @param ctx extraction state
  * @param xml the tag contents
  * @param len number of bytes in @a xml
  * @return 1 if the caller should stop extracting, 0 to continue
  */
 static int
 scan_gdal_metadata (const struct Context *ctx,
                     const char *xml,
                     size_t len)
 {
   /* GDAL item names that name the thing that made the data rather
      than describing the data. */
   static const char *device_items[] = {
     "SENSOR",
     "SENSOR_NAME",
     "SENSORNAME",
     "SENSOR_ID",
     "INSTRUMENT",
     "PLATFORM",
     "SATELLITEID",
     NULL
   };
   unsigned int items = 0;
   size_t i = 0;
 
   while ( (i < len) &&
           (items < GEOTIFF_MAX_GDAL_ITEMS) )
   {
     size_t open;
     size_t tag_end;
     size_t name_start;
     size_t name_end;
     size_t close;
     size_t name_len;
     size_t val_len;
     enum EXTRACTOR_MetaType type = EXTRACTOR_METATYPE_COMMENT;
     char buf[EXTRACTOR_FORENSIC_MAX_STRING];
     int n;
 
     if (! find_sub (xml, len, i, "<Item", &open))
       break;
     if (! find_sub (xml, len, open, ">", &tag_end))
       break;
     i = tag_end + 1;
     if (! find_sub (xml, tag_end, open, "name=\"", &name_start))
       continue;   /* an Item without a name; skip it, keep scanning */
     name_start += strlen ("name=\"");
     if (! find_sub (xml, tag_end, name_start, "\"", &name_end))
       continue;
     if (! find_sub (xml, len, tag_end, "</Item>", &close))
       break;
     name_len = name_end - name_start;
     val_len = close - (tag_end + 1);
     i = close + strlen ("</Item>");
     items++;
     if ( (0 == name_len) ||
          (64 < name_len) ||
          (0 == val_len) ||
          (256 < val_len) )
       continue;
     for (unsigned int k = 0; NULL != device_items[k]; k++)
       if ( (strlen (device_items[k]) == name_len) &&
            (0 == memcmp (device_items[k],
                          &xml[name_start],
                          name_len)) )
       {
         type = EXTRACTOR_METATYPE_SOURCE_DEVICE;
         break;
       }
     if (EXTRACTOR_METATYPE_SOURCE_DEVICE == type)
       n = snprintf (buf,
                     sizeof (buf),
                     "%.*s",
                     (int) val_len,
                     &xml[tag_end + 1]);
     else
       n = snprintf (buf,
                     sizeof (buf),
                     "%.*s=%.*s",
                     (int) name_len,
                     &xml[name_start],
                     (int) val_len,
                     &xml[tag_end + 1]);
     if ( (0 >= n) ||
          (((size_t) n) >= sizeof (buf)) )
       continue;
     if (EXTRACTOR_forensic_emit_text_ (ctx->ec,
                                        "geotiff",
                                        type,
                                        buf,
                                        (size_t) n))
       return 1;
   }
   return 0;
 }
 
 
 /**
  * Emit the GDAL private tags, if the file has them.
  *
  * @param ctx extraction state
  * @return 1 if the caller should stop extracting, 0 to continue
  */
 static int
 emit_gdal (const struct Context *ctx)
 {
   unsigned char *buf;
   size_t len;
   int stop;
 
   if ( (ctx->tags[W_GDAL_NODATA].found) &&
        (TT_ASCII == ctx->tags[W_GDAL_NODATA].type) )
   {
     buf = load_value (ctx,
                       &ctx->tags[W_GDAL_NODATA],
                       64,
                       &len);
     if (NULL != buf)
     {
       char nod[128];
       int n;
 
       /* trim to the C string GDAL wrote, then label it: a bare "-9999"
          under COMMENT would be unreadable */
       for (size_t i = 0; i < len; i++)
         if ('\0' == buf[i])
         {
           len = i;
           break;
         }
       n = snprintf (nod,
                     sizeof (nod),
                     "GDAL nodata value: %.*s",
                     (int) len,
                     (const char *) buf);
       free (buf);
       if ( (0 < n) &&
            (((size_t) n) < sizeof (nod)) &&
            (EXTRACTOR_forensic_emit_text_ (ctx->ec,
                                            "geotiff",
                                            EXTRACTOR_METATYPE_COMMENT,
                                            nod,
                                            (size_t) n)) )
         return 1;
     }
   }
   if ( (! ctx->tags[W_GDAL_META].found) ||
        (TT_ASCII != ctx->tags[W_GDAL_META].type) )
     return 0;
   buf = load_value (ctx,
                     &ctx->tags[W_GDAL_META],
                     GEOTIFF_MAX_VALUE,
                     &len);
   if (NULL == buf)
     return 0;
   for (size_t i = 0; i < len; i++)
     if ('\0' == buf[i])
     {
       len = i;
       break;
     }
   stop = scan_gdal_metadata (ctx,
                              (const char *) buf,
                              len);
   free (buf);
   return stop;
 }
 
 
 /**
  * Emit the plain TIFF descriptive tags: geometry, codec and the
  * provenance strings.
  *
  * @param ctx extraction state
  * @return 1 if the caller should stop extracting, 0 to continue
  */
 static int
 emit_image_tags (const struct Context *ctx)
 {
   static const struct
   {
     unsigned int code;
     const char *name;
   } codecs[] = {
     { 1, "none" },
     { 2, "CCITT modified Huffman RLE" },
     { 3, "CCITT Group 3 fax" },
     { 4, "CCITT Group 4 fax" },
     { 5, "LZW" },
     { 6, "JPEG (old-style)" },
     { 7, "JPEG" },
     { 8, "Adobe Deflate" },
     { 32773, "PackBits" },
     { 32946, "Deflate" },
     { 34712, "JPEG 2000" },
     { 34887, "LERC" },
     { 34925, "LZMA" },
     { 50000, "ZSTD" },
     { 50001, "WEBP" },
     { 0, NULL }
   };
   double width;
   double height;
   double bits;
   double samples;
   double comp;
 
   if ( (tag_double (ctx, W_WIDTH, 0, &width)) &&
        (tag_double (ctx, W_LENGTH, 0, &height)) &&
        (isfinite (width)) &&
        (isfinite (height)) &&
        (0.0 < width) &&
        (0.0 < height) &&
        (GEOTIFF_MAX_DIM > width) &&
        (GEOTIFF_MAX_DIM > height) &&
        (EXTRACTOR_forensic_emit_ (ctx->ec,
                                   "geotiff",
                                   EXTRACTOR_METATYPE_IMAGE_DIMENSIONS,
                                   "%llux%llu",
                                   (unsigned long long) width,
                                   (unsigned long long) height)) )
     return 1;
   if ( (tag_double (ctx, W_BITS, 0, &bits)) &&
        (isfinite (bits)) &&
        (0.0 < bits) &&
        (4096.0 > bits) &&
        (EXTRACTOR_forensic_emit_ (ctx->ec,
                                   "geotiff",
                                   EXTRACTOR_METATYPE_COLOR_DEPTH,
                                   "%llu",
                                   (unsigned long long) bits)) )
     return 1;
   if ( (tag_double (ctx, W_SAMPLES, 0, &samples)) &&
        (isfinite (samples)) &&
        (0.0 < samples) &&
        (4096.0 > samples) &&
        (EXTRACTOR_forensic_emit_ (ctx->ec,
                                   "geotiff",
                                   EXTRACTOR_METATYPE_CHANNELS,
                                   "%llu",
                                   (unsigned long long) samples)) )
     return 1;
   if ( (tag_double (ctx, W_COMPRESSION, 0, &comp)) &&
        (isfinite (comp)) &&
        (0.0 <= comp) &&
        (65536.0 > comp) )
   {
     unsigned int code = (unsigned int) comp;
     const char *name = NULL;
 
     for (unsigned int i = 0; NULL != codecs[i].name; i++)
       if (codecs[i].code == code)
       {
         name = codecs[i].name;
         break;
       }
     if (NULL != name)
     {
       if (EXTRACTOR_forensic_emit_ (ctx->ec,
                                     "geotiff",
                                     EXTRACTOR_METATYPE_CODEC,
                                     "%s",
                                     name))
         return 1;
     }
     else if (EXTRACTOR_forensic_emit_ (ctx->ec,
                                        "geotiff",
                                        EXTRACTOR_METATYPE_CODEC,
                                        "TIFF compression %u",
                                        code))
     {
       return 1;
     }
   }
   if (emit_ascii_tag (ctx,
                       W_SOFTWARE,
                       EXTRACTOR_METATYPE_CREATED_BY_SOFTWARE))
     return 1;
   if (emit_ascii_tag (ctx,
                       W_DESCRIPTION,
                       EXTRACTOR_METATYPE_DESCRIPTION))
     return 1;
   if (emit_ascii_tag (ctx,
                       W_ARTIST,
                       EXTRACTOR_METATYPE_AUTHOR_NAME))
     return 1;
   if (emit_ascii_tag (ctx,
                       W_COPYRIGHT,
                       EXTRACTOR_METATYPE_COPYRIGHT))
     return 1;
   if (emit_ascii_tag (ctx,
                       W_MAKE,
                       EXTRACTOR_METATYPE_DEVICE_MANUFACTURER))
     return 1;
   if (emit_ascii_tag (ctx,
                       W_MODEL,
                       EXTRACTOR_METATYPE_DEVICE_MODEL))
     return 1;
   return 0;
 }
 
 
 /**
  * Emit TIFF's DateTime tag, which is `YYYY:MM:DD HH:MM:SS' in
  * unspecified local time.
  *
  * We re-spell it as ISO 8601 but deliberately do not append a `Z':
  * TIFF 6.0 attaches no time zone to the field, and claiming UTC would
  * be inventing information.
  *
  * @param ctx extraction state
  * @return 1 if the caller should stop extracting, 0 to continue
  */
 static int
 emit_datetime (const struct Context *ctx)
 {
   unsigned char *buf;
   size_t len;
   unsigned int v[6];
   int stop;
 
   if (TT_ASCII != ctx->tags[W_DATETIME].type)
     return 0;
   buf = load_value (ctx,
                     &ctx->tags[W_DATETIME],
                     64,
                     &len);
   if (NULL == buf)
     return 0;
   if (19 > len)
   {
     free (buf);
     return 0;
   }
   /* fixed layout: 4-2-2 date, space, 2-2-2 time, all digits */
   {
     static const unsigned int digit_at[] = {
       0, 1, 2, 3, 5, 6, 8, 9, 11, 12, 14, 15, 17, 18
     };
     int ok = ( (':' == buf[4]) &&
                (':' == buf[7]) &&
                (' ' == buf[10]) &&
                (':' == buf[13]) &&
                (':' == buf[16]) );
 
     for (unsigned int i = 0;
          (ok) && (i < sizeof (digit_at) / sizeof (digit_at[0]));
          i++)
       if ( ('0' > buf[digit_at[i]]) ||
            ('9' < buf[digit_at[i]]) )
         ok = 0;
     if (! ok)
     {
       free (buf);
       return 0;
     }
   }
   v[0] = (unsigned int) ((buf[0] - '0') * 1000 + (buf[1] - '0') * 100
                          + (buf[2] - '0') * 10 + (buf[3] - '0'));
   v[1] = (unsigned int) ((buf[5] - '0') * 10 + (buf[6] - '0'));
   v[2] = (unsigned int) ((buf[8] - '0') * 10 + (buf[9] - '0'));
   v[3] = (unsigned int) ((buf[11] - '0') * 10 + (buf[12] - '0'));
   v[4] = (unsigned int) ((buf[14] - '0') * 10 + (buf[15] - '0'));
   v[5] = (unsigned int) ((buf[17] - '0') * 10 + (buf[18] - '0'));
   free (buf);
   if ( (1900 > v[0]) ||
        (2200 < v[0]) ||
        (1 > v[1]) || (12 < v[1]) ||
        (1 > v[2]) || (31 < v[2]) ||
        (23 < v[3]) || (59 < v[4]) || (60 < v[5]) )
     return 0;   /* a zeroed or garbage field, not a date */
   stop = EXTRACTOR_forensic_emit_ (ctx->ec,
                                    "geotiff",
                                    EXTRACTOR_METATYPE_CREATION_DATE,
                                    "%04u-%02u-%02uT%02u:%02u:%02u",
                                    v[0], v[1], v[2], v[3], v[4], v[5]);
   return stop;
 }
 
 
 /**
  * Main entry method for the GeoTIFF extraction plugin.
  *
  * @param ec extraction context provided to the plugin
  */
 void
 EXTRACTOR_geotiff_extract_method (struct EXTRACTOR_ExtractContext *ec);
 
 void
 EXTRACTOR_geotiff_extract_method (struct EXTRACTOR_ExtractContext *ec)
 {
   struct Context ctx;
   struct GeoKeys gk;
   unsigned char hdr[16];
   uint64_t first;
   uint16_t version;
 
   memset (&ctx,
           0,
           sizeof (ctx));
   ctx.ec = ec;
   ctx.fsize = ec->get_size (ec->cls);
   if ( (UINT64_MAX == ctx.fsize) ||
        (16 > ctx.fsize) ||
        (ctx.fsize > (uint64_t) INT64_MAX) )
     return;
   if (! EXTRACTOR_forensic_read_ (ec,
                                   0,
                                   hdr,
                                   sizeof (hdr)))
     return;
   /* Bail out on the very first bytes: almost nothing we are handed is
      a TIFF, and this plugin must cost nothing for the rest. */
   if (0 == memcmp (hdr, "II", 2))
     ctx.be = 0;
   else if (0 == memcmp (hdr, "MM", 2))
     ctx.be = 1;
   else
     return;
   version = geo_u16 (&ctx,
                      &hdr[2]);
   if (42 == version)
   {
     ctx.big = 0;
     first = (uint64_t) geo_u32 (&ctx,
                                 &hdr[4]);
   }
   else if (43 == version)
   {
     /* BigTIFF: the header states the offset width, which the format
        has so far only ever used as 8. */
     ctx.big = 1;
     if (8 != geo_u16 (&ctx, &hdr[4]))
       return;
     if (0 != geo_u16 (&ctx, &hdr[6]))
       return;
     first = geo_u64 (&ctx,
                      &hdr[8]);
   }
   else
   {
     return;   /* a TIFF-like magic we do not know */
   }
   walk_ifds (&ctx,
              first);
   /* This is the whole point of the plugin being separate from `tiff':
      unless one of the four georeferencing tags is present the file is
      an ordinary TIFF and we say nothing at all about it. */
   if ( (! ctx.tags[W_PIXELSCALE].found) &&
        (! ctx.tags[W_TIEPOINT].found) &&
        (! ctx.tags[W_TRANSFORM].found) &&
        (! ctx.tags[W_GEOKEYS].found) )
     return;
   if (0 !=
       ec->proc (ec->cls,
                 "geotiff",
                 EXTRACTOR_METATYPE_MIMETYPE,
                 EXTRACTOR_METAFORMAT_UTF8,
                 "text/plain",
                 "image/tiff",
                 strlen ("image/tiff") + 1))
     return;
   if (0 !=
       ec->proc (ec->cls,
                 "geotiff",
                 EXTRACTOR_METATYPE_FORMAT,
                 EXTRACTOR_METAFORMAT_UTF8,
                 "text/plain",
                 "GeoTIFF",
                 strlen ("GeoTIFF") + 1))
     return;
   if (ctx.big &&
       (0 !=
        ec->proc (ec->cls,
                  "geotiff",
                  EXTRACTOR_METATYPE_FORMAT_VERSION,
                  EXTRACTOR_METAFORMAT_UTF8,
                  "text/plain",
                  "BigTIFF",
                  strlen ("BigTIFF") + 1)))
     return;
   if (emit_image_tags (&ctx))
     return;
   if (emit_datetime (&ctx))
     return;
   if (parse_geo_keys (&ctx,
                       &gk))
     return;
   if (emit_crs (&ctx,
                 &gk))
     return;
   if (emit_geometry (&ctx,
                      &gk))
     return;
   if (emit_gdal (&ctx))
     return;
 }
 
 
 /* end of geotiff_extractor.c */