$NetBSD: patch-ad,v 1.14 2005/05/12 12:53:21 salo Exp $ --- libtiff/tif_dirread.c.orig 2005-03-05 10:06:00.000000000 +0100 +++ libtiff/tif_dirread.c 2005-05-12 14:38:22.000000000 +0200 @@ -1310,12 +1310,16 @@ uint16 buf[10]; uint16* v = buf; - if (samples > NITEMS(buf)) - v = (uint16*) CheckMalloc(tif, samples, sizeof(uint16), + if (dir->tdir_count > NITEMS(buf)) + v = (uint16*) CheckMalloc(tif, dir->tdir_count, sizeof(uint16), "to fetch per-sample values"); if (v && TIFFFetchShortArray(tif, dir, v)) { uint16 i; - for (i = 1; i < samples; i++) + int check_count = dir->tdir_count; + if( samples < check_count ) + check_count = samples; + + for (i = 1; i < check_count; i++) if (v[i] != v[0]) { TIFFError(tif->tif_name, "Cannot handle different per-sample values for field \"%s\"", @@ -1347,12 +1351,16 @@ uint32 buf[10]; uint32* v = buf; - if (samples > NITEMS(buf)) - v = (uint32*) CheckMalloc(tif, samples, sizeof(uint32), + if (dir->tdir_count > NITEMS(buf)) + v = (uint32*) CheckMalloc(tif, dir->tdir_count, sizeof(uint32), "to fetch per-sample values"); if (v && TIFFFetchLongArray(tif, dir, v)) { uint16 i; - for (i = 1; i < samples; i++) + int check_count = dir->tdir_count; + + if( samples < check_count ) + check_count = samples; + for (i = 1; i < check_count; i++) if (v[i] != v[0]) { TIFFError(tif->tif_name, "Cannot handle different per-sample values for field \"%s\"", @@ -1384,12 +1392,16 @@ double buf[10]; double* v = buf; - if (samples > NITEMS(buf)) - v = (double*) CheckMalloc(tif, samples, sizeof (double), + if (dir->tdir_count > NITEMS(buf)) + v = (double*) CheckMalloc(tif, dir->tdir_count, sizeof (double), "to fetch per-sample values"); if (v && TIFFFetchAnyArray(tif, dir, v)) { uint16 i; - for (i = 1; i < samples; i++) + int check_count = dir->tdir_count; + if( samples < check_count ) + check_count = samples; + + for (i = 1; i < check_count; i++) if (v[i] != v[0]) { TIFFError(tif->tif_name, "Cannot handle different per-sample values for field \"%s\"",