From owner-tiff@olympiakos.com  Fri Mar 17 19:36:20 2000
Received: (from uucp@localhost)
	by smtp02.oce.nl (8.9.3/8.9.3) id TAA10655
	for rvdt@smtp02; Fri, 17 Mar 2000 19:36:20 +0100 (MET)
>Received: from gate7.olympiakos.com ([207.176.88.85])
	by oce.nl (8.9.0/8.9.0) with ESMTP id TAA12782;
	Fri, 17 Mar 2000 19:35:41 +0100 (MET)
Received: from localhost (daemon@localhost)
	by gate7.olympiakos.com (8.9.3/8.9.3) with SMTP id NAA15271;
	Fri, 17 Mar 2000 13:34:24 -0500
Received: by gate7.olympiakos.com (bulk_mailer v1.9); Fri, 17 Mar 2000 13:34:17 -0500
Received: (from majordom@localhost)
	by gate7.olympiakos.com (8.9.3/8.9.3) id NAA15258
	for tiff-outgoing; Fri, 17 Mar 2000 13:34:16 -0500
X-Authentication-Warning: gate7.olympiakos.com: majordom set sender to owner-tiff@olympiakos.com using -f
Received: from mail.rdc2.on.home.com (ha1.rdc2.on.home.com [24.9.0.15])
	by gate7.olympiakos.com (8.9.3/8.9.3) with ESMTP id NAA15255
	for <tiff@olympiakos.com>; Fri, 17 Mar 2000 13:34:14 -0500
Received: from home.com ([24.68.90.78]) by mail.rdc2.on.home.com
          (InterMail v4.01.01.07 201-229-111-110) with ESMTP
          id <20000317183402.UOIJ12801.mail.rdc2.on.home.com@home.com>;
          Fri, 17 Mar 2000 10:34:02 -0800
Message-ID: <38D27AA9.303107C4@home.com>
Date: Fri, 17 Mar 2000 13:34:17 -0500
From: Frank Warmerdam <warmerda@home.com>
X-Mailer: Mozilla 4.72 [en] (X11; U; Linux 2.2.14 i586)
X-Accept-Language: en
MIME-Version: 1.0
To: Jason Summers <jason@med-web.com>
CC: TIFF Mailing List <tiff@olympiakos.com>
Subject: Re: Some CCITT Group 3 TIFFs crash libtiff
References: <38CFCC1B.B75FE060@med-web.com> <38CFCFAD.2B9824BC@home.com> <38D26078.C1991FF7@med-web.com>
Content-Transfer-Encoding: 7bit
Sender: owner-tiff@olympiakos.com
Content-Type: text/plain; charset=us-ascii

Jason Summers wrote:
> The problem that your patch addresses may well be related, but the patch
> doesn't seem to have any affect on my problem TIFFs. They crash just the
> same.

Jason,

Good news, I have worked out what the bug is.  In the last few months the
fax3 code was changed to handle files wider (or longer?) than 65536 pixels
and part of this was converting the runs arrays from uint16 to uint32.  

However, a -1 was used as a special value that used to be used as 65536 
which trigger "over the end" code, but as a uint32 it wrapped back to a small
number when added to a small number and didn't trigger the code properly. 
I have added a couple extra tests and now all is well with at least one of
your files!

The updated tif_fax3.c code can be found at:

  http://gdal.velocet.ca/~warmerda/tif_fax3.c

Let me know if this seems fine, and I will talk to Mike about preparing a
new release before too many more people run into the same problem. 

Best regards,

---------------------------------------+--------------------------------------
I set the clouds in motion - turn up   | Frank Warmerdam, warmerda@home.com
light and sound - activate the windows | http://members.home.com/warmerda
and watch the world go round - Rush    | Geospatial Programmer for Rent

