Tifflib fix: Thunder RLE can fail to decode last run.

GPDL decode of tests_private/tiff/text.tif gives valgrind errors
due to the "thunder decode" failing to extract the last run of
bytes.

The logic in the decoder, presumably intended to spot overruns of
data is incorrect, in that runs that end at the end of a row
(npixels == maxpixels) will not be decoded.

Fix this by limiting 'n', the number of pixels to copy. Note that
npixels is updated by the 'unlimited' value to ensure the error
reporting at the end of the loop still works.

1 files changed, 4 insertions, 4 deletions

diff --git a/tiff/libtiff/tif_thunder.c b/tiff/libtiff/tif_thunder.c
index db6383a81..b56e3c359 100644
--- a/tiff/libtiff/tif_thunder.c
+++ b/tiff/libtiff/tif_thunder.c
@@ -112,10 +112,10 @@ ThunderDecode(TIFF* tif, uint8* op, tmsize_t maxpixels)
 			} else
 				lastpixel |= lastpixel << 4;
 			npixels += n;
-			if (npixels < maxpixels) {
-				for (; n > 0; n -= 2)
-					*op++ = (uint8) lastpixel;
-			}
+			if (npixels > maxpixels)
+				n -= npixels - maxpixels;
+			for (; n > 0; n -= 2)
+				*op++ = (uint8) lastpixel;
 			if (n == -1)
 				*--op &= 0xf0;
 			lastpixel &= 0xf;