tif_fax3.h: check for buffer overflow in EXPAND2D before "calling" CLEANUP_RUNS()

fixes #179

this fixes the regression introduced in 02bb0175 / 72c4acef
( merge request !110 )

It may be a better fix to do the overflow check in SETVALUE() but the
macro do { } while(0) construct makes it difficult to quit the loop
properly.

libtiff/tif_fax3.h

@@ -514,7 +514,9 @@ done1d:									\
 	    goto eol2d;							\
 	eof2d:								\
 	    prematureEOF(a0);						\
-	    CLEANUP_RUNS();						\
+		if (pa < thisrun + sp->nruns) {	\
+		    CLEANUP_RUNS();					\
+		}								\
 	    goto eoflab;						\
 	}								\
     }									\