image/tiff: Reject images with SampleFormat != 1.

The TIFF spec says that a baseline TIFF reader must gracefully terminate
when the image has a SampleFormat tag which it does not support.
For baseline compatibility, only SampleFormat=1 (the default) is needed.
Images with other sample formats (e.g. floating-point color values)
are very rare in practice.

R=nigeltao
CC=golang-dev
https://golang.org/cl/4515073

src/pkg/image/tiff/consts.go

@@ -54,6 +54,7 @@ const (
 	tPredictor    = 317
 	tColorMap     = 320
 	tExtraSamples = 338
+	tSampleFormat = 339
 )
 
 // Compression types (defined in various places in the spec and supplements).

src/pkg/image/tiff/reader.go

@@ -133,6 +133,20 @@ func (d *decoder) parseIFD(p []byte) os.Error {
 				0xffff,
 			}
 		}
+	case tSampleFormat:
+		// Page 27 of the spec: If the SampleFormat is present and
+		// the value is not 1 [= unsigned integer data], a Baseline
+		// TIFF reader that cannot handle the SampleFormat value
+		// must terminate the import process gracefully.
+		val, err := d.ifdUint(p)
+		if err != nil {
+			return err
+		}
+		for _, v := range val {
+			if v != 1 {
+				return UnsupportedError("sample format")
+			}
+		}
 	}
 	return nil
 }