Merge branch 'issue-185' into 'master'

tif_fax3: more buffer overflow checks in Fax3Decode2D()

Closes #185

See merge request libtiff/libtiff!131

libtiff/tif_fax3.c

@@ -305,7 +305,9 @@ Fax3Decode2D(TIFF* tif, uint8* buf, tmsize_t occ, uint16 s)
 		else
 			EXPAND2D(EOF2Da);
 		(*sp->fill)(buf, thisrun, pa, lastx);
-		SETVALUE(0);		/* imaginary change for reference */
+		if (pa < thisrun + sp->nruns) {
+			SETVALUE(0);	/* imaginary change for reference */
+		}
 		SWAP(uint32*, sp->curruns, sp->refruns);
 		buf += sp->b.rowbytes;
 		occ -= sp->b.rowbytes;

libtiff/tif_fax3.h

@@ -514,9 +514,9 @@ done1d:									\
 	    goto eol2d;							\
 	eof2d:								\
 	    prematureEOF(a0);						\
-		if (pa < thisrun + sp->nruns) {	\
+		if (pa < thisrun + sp->nruns) {				\
 		    CLEANUP_RUNS();					\
-		}								\
+		}							\
 	    goto eoflab;						\
 	}								\
     }									\
@@ -531,9 +531,12 @@ done1d:									\
 	SETVALUE(0);							\
     }									\
 eol2d:									\
-    CLEANUP_RUNS();							\
+    if (pa < thisrun + sp->nruns) {					\
+	CLEANUP_RUNS();							\
+    }									\
 } while (0)
 #endif /* _FAX3_ */
+/* vim: set ts=8 sts=4 sw=4 noet: */
 /*
  * Local Variables:
  * mode: c