From d02bbd00060d4af1b43a9cdae1b88c743afc0eef Mon Sep 17 00:00:00 2001
From: Andrey Kiselev <dron@ak4719.spb.edu>
Date: Tue, 16 Apr 2002 13:49:14 +0000
Subject: [PATCH] Additional check for data integrity. Should finally close
 http://bugzilla.remotesensing.org/show_bug.cgi?id=100

---
 libtiff/tif_lzw.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/libtiff/tif_lzw.c b/libtiff/tif_lzw.c
index db43a37f..19cee96a 100644
--- a/libtiff/tif_lzw.c
+++ b/libtiff/tif_lzw.c
@@ -1,4 +1,4 @@
-/* $Header: /cvs/maptools/cvsroot/libtiff/libtiff/tif_lzw.c,v 1.11 2002-04-04 14:35:35 dron Exp $ */
+/* $Header: /cvs/maptools/cvsroot/libtiff/libtiff/tif_lzw.c,v 1.12 2002-04-16 13:49:14 dron Exp $ */
 
 /*
  * Copyright (c) 1988-1997 Sam Leffler
@@ -397,7 +397,7 @@ LZWDecode(TIFF* tif, tidata_t op0, tsize_t occ0, tsample_t s)
 	 	 * Add the new entry to the code table.
 	 	 */
 		if (&sp->dec_codetab[0] > free_entp || free_entp >= &sp->dec_codetab[CSIZE]) {
-			TIFFError(tif->tif_name, "LZWDecode: Unexpected end of code table");
+			TIFFError(tif->tif_name, "LZWDecode: Corrupted LZW table");
 			return (0);
 		}
 
@@ -427,6 +427,11 @@ LZWDecode(TIFF* tif, tidata_t op0, tsize_t occ0, tsample_t s)
 				 */
 				sp->dec_codep = codep;
 				do {
+					if (codep < sp->dec_codetab) {
+						TIFFError(tif->tif_name,
+							"LZWDecode: Corrupted LZW data");
+						return (0);
+					}
 					codep = codep->next;
 				} while (codep && codep->length > occ);
 				if (codep) {