From owner-tiff@olympiakos.com  Wed Mar 15 19:01:37 2000
Received: (from uucp@localhost)
	by smtp02.oce.nl (8.9.3/8.9.3) id TAA26514
	for rvdt@smtp02; Wed, 15 Mar 2000 19:01:37 +0100 (MET)
>Received: from gate7.olympiakos.com ([207.176.88.85])
	by oce.nl (8.9.0/8.9.0) with ESMTP id TAA05131;
	Wed, 15 Mar 2000 19:01:05 +0100 (MET)
Received: from localhost (daemon@localhost)
	by gate7.olympiakos.com (8.9.3/8.9.3) with SMTP id NAA15805;
	Wed, 15 Mar 2000 13:00:16 -0500
Received: by gate7.olympiakos.com (bulk_mailer v1.9); Wed, 15 Mar 2000 13:00:08 -0500
Received: (from majordom@localhost)
	by gate7.olympiakos.com (8.9.3/8.9.3) id NAA15792
	for tiff-outgoing; Wed, 15 Mar 2000 13:00:07 -0500
X-Authentication-Warning: gate7.olympiakos.com: majordom set sender to owner-tiff@olympiakos.com using -f
Received: from mail.rdc2.on.home.com (ha1.rdc2.on.home.com [24.9.0.15])
	by gate7.olympiakos.com (8.9.3/8.9.3) with ESMTP id NAA15789
	for <tiff@olympiakos.com>; Wed, 15 Mar 2000 13:00:05 -0500
Received: from home.com ([24.68.90.78]) by mail.rdc2.on.home.com
          (InterMail v4.01.01.07 201-229-111-110) with ESMTP
          id <20000315175957.SDYL12801.mail.rdc2.on.home.com@home.com>;
          Wed, 15 Mar 2000 09:59:57 -0800
Message-ID: <38CFCFAD.2B9824BC@home.com>
Date: Wed, 15 Mar 2000 13:00:13 -0500
From: Frank Warmerdam <warmerda@home.com>
X-Mailer: Mozilla 4.72 [en] (X11; U; Linux 2.2.14 i586)
X-Accept-Language: en
MIME-Version: 1.0
To: Jason Summers <jason@med-web.com>
CC: TIFF Mailing List <tiff@olympiakos.com>
Subject: Re: Some CCITT Group 3 TIFFs crash libtiff
References: <38CFCC1B.B75FE060@med-web.com>
Content-Transfer-Encoding: 7bit
Sender: owner-tiff@olympiakos.com
Content-Type: text/plain; charset=us-ascii

Jason Summers wrote:
> 
> I've encountered several CCITT Group 3-compressed TIFF images that cause
> programs compiled with libtiff 3.5.4 to crash with an IPF/segmentation
> fault. The crash occurs both in my Windows program and in utilities like
> tiffcp on Linux.
> 
> The crash occurs in tif_fax3.c, at either line 397:
>              *lp++ = 0L;
> or line 436:
>            *lp++ = -1L;
> 
> The crash does not occur when using libtiff 3.4beta37, even though the
> tif_fax3.c file is effectively identical.
> 
> I haven't investigated this too deeply, in the hopes that someone may
> already know a simple fix. I placed several files that exhibit
> the problem at:
> http://home.mieweb.com/jason/testbed/tif/
> 
> I don't know (or really care) if those files are perfectly valid TIFFs,
> I just want to prevent a crash. Any help would be appreciated.

Jason,

I think this is the same problem reported by a couple of other people.  I 
have placed a modified tif_fax3.c at:

  http://gdal.velocet.ca/~warmerda/tif_fax3.c

This contains a patch to increase the size of the "runs" array by eight 
bytes, and this seems to avoid the problem.  However, I was unable to
establish a more appropriate patch.  You can search for the word "Problem"
to see my notes on the problem. 

This patch is checked in CVS and will appear in the next libtiff release. 

Best regards,

---------------------------------------+--------------------------------------
I set the clouds in motion - turn up   | Frank Warmerdam, warmerda@home.com
light and sound - activate the windows | http://members.home.com/warmerda
and watch the world go round - Rush    | Geospatial Programmer for Rent

