Received: by smtp02.oce.nl (4.1/SMI-4.1)
	id AA11671; Fri, 1 May 98 06:40:17 +0200
Received: from sgi.sgi.com (SGI.COM [192.48.153.1])
	by oce.nl (8.9.0.Beta5/8.9.0.Ver5) with ESMTP id GAA06933
	for <rvdt@oce.nl>; Fri, 1 May 1998 06:34:11 +0200 (MET DST)
Received: from cthulhu.engr.sgi.com (cthulhu.engr.sgi.com [192.26.80.2]) by sgi.sgi.com (980309.SGI.8.8.8-aspam-6.2/980304.SGI-aspam) via ESMTP id VAA16943; Thu, 30 Apr 1998 21:27:47 -0700 (PDT)
	mail_from (owner-tiff@sgi.engr.sgi.com)
Received: (from majordomo-owner@localhost)
	by cthulhu.engr.sgi.com (980205.SGI.8.8.8/970903.SGI.AUTOCF)
	id UAA18469065
	for tiff-list;
	Thu, 30 Apr 1998 20:10:11 -0700 (PDT)
Received: from sgi.sgi.com (sgi.engr.sgi.com [192.26.80.37])
	by cthulhu.engr.sgi.com (980205.SGI.8.8.8/970903.SGI.AUTOCF)
	via ESMTP id UAA8557021
	for <tiff-relay@cthulhu.engr.sgi.com>;
	Thu, 30 Apr 1998 20:10:10 -0700 (PDT)
Received: from cc-server9.massey.ac.nz (cc-server9.massey.ac.nz [130.123.128.11]) by sgi.sgi.com (980309.SGI.8.8.8-aspam-6.2/980304.SGI-aspam) via SMTP id UAA28875
	for <tiff@sgi.com>; Thu, 30 Apr 1998 20:10:01 -0700 (PDT)
	mail_from (B.R.Foster@massey.ac.nz)
Message-Id: <199805010310.UAA28875@sgi.sgi.com>
Received: from localhost (actually cc-server9) by cc-server9 with SMTP(PP);
          Fri, 1 May 1998 13:41:31 +1200
Date: Fri, 1 May 98 13:38:00 +1200
To: tiff@sgi.com
From: Brent Foster <B.R.Foster@massey.ac.nz>
Subject: Potential problem with libtiff G4 decompression
X-Mailer: MUMail 2.11
Sender: owner-tiff@fddi-sgi.sgi.com
Precedence: bulk

While dealing with these bad Kofax images and basically being fed random 
codes, I discovered that problems can occur with VL codes when
b1 - codeLength < a0, which is of course invalid. You end up with 
negative length runs, which cause havoc.
S_VL in EXPAND2D needs to be changed to something like below I think. I 
don't know what it's appropriate to do in this situation - give up? 
Insert a zero run?

Does this sound right?

Brent


  case S_VL:
    CHECK_b1;
    if (TabEnt->Width > b1 - a0) {
      /* bad data */
    }
    SETVAL(b1 - a0 - TabEnt->Param);
    b1 -= *--pb;
    break;
