From 197bfe4c1410a89d1208642fed5ddb8eb728ebeb Mon Sep 17 00:00:00 2001
From: Thomas Bernard <miniupnp@free.fr>
Date: Wed, 11 Mar 2020 23:34:21 +0100
Subject: [PATCH] Fax3SetupState(): check consistency of rowbytes and rowpixels

also add some parameter documentation to Fax3Decode1D()

fixes #160
http://bugzilla.maptools.org/show_bug.cgi?id=2854
---
 libtiff/tif_fax3.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/libtiff/tif_fax3.c b/libtiff/tif_fax3.c
index e82878f9..e96e148b 100644
--- a/libtiff/tif_fax3.c
+++ b/libtiff/tif_fax3.c
@@ -219,8 +219,12 @@ Fax3PrematureEOF(const char* module, TIFF* tif, uint32 line, uint32 a0)
 
 #define	Nop
 
-/*
+/**
  * Decode the requested amount of G3 1D-encoded data.
+ * @param buf destination buffer
+ * @param occ available bytes in destination buffer
+ * @param s number of planes (ignored)
+ * @returns 1 for success, -1 in case of error
  */
 static int
 Fax3Decode1D(TIFF* tif, uint8* buf, tmsize_t occ, uint16 s)
@@ -524,6 +528,13 @@ Fax3SetupState(TIFF* tif)
 		rowbytes = TIFFScanlineSize(tif);
 		rowpixels = td->td_imagewidth;
 	}
+	if (rowbytes < (rowpixels + 7) / 8)
+	{
+		TIFFErrorExt(tif->tif_clientdata, module,
+			"Inconsistent number of bytes per row : rowbytes=%lu rowpixels=%lu",
+			(unsigned long)(rowbytes), (unsigned long)(rowpixels));
+		return (0);
+	}
 	sp->rowbytes = rowbytes;
 	sp->rowpixels = rowpixels;
 	/*