From 50b48786d5a10125b5a4955ce49bbd48c6c56cfc Mon Sep 17 00:00:00 2001
From: Even Rouault <even.rouault@spatialys.com>
Date: Wed, 11 Jan 2017 16:33:34 +0000
Subject: [PATCH] * libtiff/tif_read.c: avoid potential undefined behaviour on
 signed integer addition in TIFFReadRawStrip1() in isMapped() case. Fixes
 http://bugzilla.maptools.org/show_bug.cgi?id=2650

---
 ChangeLog          |  6 ++++++
 libtiff/tif_read.c | 29 +++++++++++++++++++----------
 2 files changed, 25 insertions(+), 10 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 8e202a2c..3e314644 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2017-01-11 Even Rouault <even.rouault at spatialys.com>
+
+	* libtiff/tif_read.c: avoid potential undefined behaviour on signed integer
+	addition in TIFFReadRawStrip1() in isMapped() case.
+	Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2650
+
 2017-01-11 Even Rouault <even.rouault at spatialys.com>
 
 	* libtiff/tif_jpeg.c: validate BitsPerSample in JPEGSetupEncode() to avoid
diff --git a/libtiff/tif_read.c b/libtiff/tif_read.c
index 29a311db..8c5af6a8 100644
--- a/libtiff/tif_read.c
+++ b/libtiff/tif_read.c
@@ -1,4 +1,4 @@
-/* $Id: tif_read.c,v 1.50 2016-12-02 21:56:56 erouault Exp $ */
+/* $Id: tif_read.c,v 1.51 2017-01-11 16:33:34 erouault Exp $ */
 
 /*
  * Copyright (c) 1988-1997 Sam Leffler
@@ -420,16 +420,25 @@ TIFFReadRawStrip1(TIFF* tif, uint32 strip, void* buf, tmsize_t size,
 			return ((tmsize_t)(-1));
 		}
 	} else {
-		tmsize_t ma,mb;
+		tmsize_t ma;
 		tmsize_t n;
-		ma=(tmsize_t)td->td_stripoffset[strip];
-		mb=ma+size;
-		if ((td->td_stripoffset[strip] > (uint64)TIFF_TMSIZE_T_MAX)||(ma>tif->tif_size))
-			n=0;
-		else if ((mb<ma)||(mb<size)||(mb>tif->tif_size))
-			n=tif->tif_size-ma;
-		else
-			n=size;
+		if ((td->td_stripoffset[strip] > (uint64)TIFF_TMSIZE_T_MAX)||
+                    ((ma=(tmsize_t)td->td_stripoffset[strip])>tif->tif_size))
+                {
+                    n=0;
+                }
+                else if( ma > TIFF_TMSIZE_T_MAX - size )
+                {
+                    n=0;
+                }
+                else
+                {
+                    tmsize_t mb=ma+size;
+                    if (mb>tif->tif_size)
+                            n=tif->tif_size-ma;
+                    else
+                            n=size;
+                }
 		if (n!=size) {
 #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
 			TIFFErrorExt(tif->tif_clientdata, module,