summaryrefslogtreecommitdiff
path: root/source/l/libtiff
diff options
context:
space:
mode:
Diffstat (limited to 'source/l/libtiff')
-rw-r--r--source/l/libtiff/libtiff-CVE-2012-1173.patch71
-rwxr-xr-xsource/l/libtiff/libtiff.SlackBuild7
-rw-r--r--source/l/libtiff/tiff-3.9.7_CVE-2012-4447_CVE-2012-4564_CVE-2013-1960_CVE-2013-1961.diff3813
-rw-r--r--source/l/libtiff/tiff-3.9.7_CVE-2013-4231.diff23
-rw-r--r--source/l/libtiff/tiff-3.9.7_CVE-2013-4232.diff24
-rw-r--r--source/l/libtiff/tiff-3.9.7_CVE-2013-4244.diff24
6 files changed, 3889 insertions, 73 deletions
diff --git a/source/l/libtiff/libtiff-CVE-2012-1173.patch b/source/l/libtiff/libtiff-CVE-2012-1173.patch
deleted file mode 100644
index 0ada700b..00000000
--- a/source/l/libtiff/libtiff-CVE-2012-1173.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-This patch is submitted to upstream for CVE-2012-1173
-
-
-diff -Naur tiff-3.9.5.orig/libtiff/tif_getimage.c tiff-3.9.5/libtiff/tif_getimage.c
---- tiff-3.9.5.orig/libtiff/tif_getimage.c 2010-07-08 12:17:59.000000000 -0400
-+++ tiff-3.9.5/libtiff/tif_getimage.c 2012-03-14 14:49:25.796728783 -0400
-@@ -673,18 +673,24 @@
- unsigned char* p2;
- unsigned char* pa;
- tsize_t tilesize;
-+ tsize_t bufsize;
- int32 fromskew, toskew;
- int alpha = img->alpha;
- uint32 nrow;
- int ret = 1, flip;
-
- tilesize = TIFFTileSize(tif);
-- buf = (unsigned char*) _TIFFmalloc((alpha?4:3)*tilesize);
-+ bufsize = TIFFSafeMultiply(tsize_t,alpha?4:3,tilesize);
-+ if (bufsize == 0) {
-+ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in %s", "gtTileSeparate");
-+ return (0);
-+ }
-+ buf = (unsigned char*) _TIFFmalloc(bufsize);
- if (buf == 0) {
- TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "No space for tile buffer");
- return (0);
- }
-- _TIFFmemset(buf, 0, (alpha?4:3)*tilesize);
-+ _TIFFmemset(buf, 0, bufsize);
- p0 = buf;
- p1 = p0 + tilesize;
- p2 = p1 + tilesize;
-@@ -880,17 +886,23 @@
- uint32 rowsperstrip, offset_row;
- uint32 imagewidth = img->width;
- tsize_t stripsize;
-+ tsize_t bufsize;
- int32 fromskew, toskew;
- int alpha = img->alpha;
- int ret = 1, flip;
-
- stripsize = TIFFStripSize(tif);
-- p0 = buf = (unsigned char *)_TIFFmalloc((alpha?4:3)*stripsize);
-+ bufsize = TIFFSafeMultiply(tsize_t,alpha?4:3,stripsize);
-+ if (bufsize == 0) {
-+ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in %s", "gtStripSeparate");
-+ return (0);
-+ }
-+ p0 = buf = (unsigned char *)_TIFFmalloc(bufsize);
- if (buf == 0) {
- TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "No space for tile buffer");
- return (0);
- }
-- _TIFFmemset(buf, 0, (alpha?4:3)*stripsize);
-+ _TIFFmemset(buf, 0, bufsize);
- p1 = p0 + stripsize;
- p2 = p1 + stripsize;
- pa = (alpha?(p2+stripsize):NULL);
-diff -Naur tiff-3.9.5.orig/libtiff/tiffiop.h tiff-3.9.5/libtiff/tiffiop.h
---- tiff-3.9.5.orig/libtiff/tiffiop.h 2011-03-28 09:43:43.000000000 -0400
-+++ tiff-3.9.5/libtiff/tiffiop.h 2012-03-14 14:49:25.797728754 -0400
-@@ -246,7 +246,7 @@
- #define TIFFroundup(x, y) (TIFFhowmany(x,y)*(y))
-
- /* Safe multiply which returns zero if there is an integer overflow */
--#define TIFFSafeMultiply(t,v,m) ((((t)m != (t)0) && (((t)((v*m)/m)) == (t)v)) ? (t)(v*m) : (t)0)
-+#define TIFFSafeMultiply(t,v,m) ((((t)(m) != (t)0) && (((t)(((v)*(m))/(m))) == (t)(v))) ? (t)((v)*(m)) : (t)0)
-
- #define TIFFmax(A,B) ((A)>(B)?(A):(B))
- #define TIFFmin(A,B) ((A)<(B)?(A):(B))
diff --git a/source/l/libtiff/libtiff.SlackBuild b/source/l/libtiff/libtiff.SlackBuild
index 91ec64fa..7cdd7b71 100755
--- a/source/l/libtiff/libtiff.SlackBuild
+++ b/source/l/libtiff/libtiff.SlackBuild
@@ -1,6 +1,6 @@
#!/bin/sh
-# Copyright 2005-2012 Patrick J. Volkerding, Sebeka, Minnesota, USA
+# Copyright 2005-2013 Patrick J. Volkerding, Sebeka, Minnesota, USA
# All rights reserved.
#
# Redistribution and use of this script, with or without modification, is
@@ -63,7 +63,10 @@ rm -rf tiff-$VERSION
tar xvf $CWD/tiff-$VERSION.tar.?z* || exit 1
cd tiff-$VERSION
-zcat $CWD/libtiff-CVE-2012-1173.patch.gz | patch -p1 --verbose || exit 1
+zcat $CWD/tiff-3.9.7_CVE-2012-4447_CVE-2012-4564_CVE-2013-1960_CVE-2013-1961.diff.gz | patch -p1 --verbose || exit 1
+zcat $CWD/tiff-3.9.7_CVE-2013-4231.diff.gz | patch -p1 --verbose || exit 1
+zcat $CWD/tiff-3.9.7_CVE-2013-4232.diff.gz | patch -p1 --verbose || exit 1
+zcat $CWD/tiff-3.9.7_CVE-2013-4244.diff.gz | patch -p1 --verbose || exit 1
chown -R root:root .
find . \
diff --git a/source/l/libtiff/tiff-3.9.7_CVE-2012-4447_CVE-2012-4564_CVE-2013-1960_CVE-2013-1961.diff b/source/l/libtiff/tiff-3.9.7_CVE-2012-4447_CVE-2012-4564_CVE-2013-1960_CVE-2013-1961.diff
new file mode 100644
index 00000000..2ee6847c
--- /dev/null
+++ b/source/l/libtiff/tiff-3.9.7_CVE-2012-4447_CVE-2012-4564_CVE-2013-1960_CVE-2013-1961.diff
@@ -0,0 +1,3813 @@
+From 304327d825c7ba6a9f560d0ca792304f0b03e3b3 Mon Sep 17 00:00:00 2001
+From: mancha <mancha1@hush.com>
+Date: Sun, 11 Aug 2013
+Subject: Multiple CVEs addressed and bugs fixed.
+
+Mega-patch against libtiff-3.9.7 constructed from upstream commits
+that syncs it to the last CVS revision (5/2/2013). It fixes:
+
+ a. CVE-2012-4447
+ b. CVE-2012-4564
+ c. CVE-2013-1960
+ d. CVE-2013-1961
+ e. auto-rotate option bug
+ f. TIFFPrintDirectory bug
+---
+ ChangeLog | 781 ++++++++++++++++++++++--------------------
+ Makefile.in | 2
+ aclocal.m4 | 6
+ build/Makefile.in | 2
+ contrib/Makefile.in | 2
+ contrib/acorn/Makefile.in | 2
+ contrib/addtiffo/Makefile.in | 2
+ contrib/dbs/Makefile.in | 2
+ contrib/dbs/xtiff/Makefile.in | 2
+ contrib/dbs/xtiff/xtiff.c | 6
+ contrib/iptcutil/Makefile.in | 2
+ contrib/mac-cw/Makefile.in | 2
+ contrib/mac-mpw/Makefile.in | 2
+ contrib/mfs/Makefile.in | 2
+ contrib/pds/Makefile.in | 2
+ contrib/ras/Makefile.in | 2
+ contrib/stream/Makefile.in | 2
+ contrib/tags/Makefile.in | 2
+ contrib/win_dib/Makefile.in | 2
+ html/Makefile.in | 2
+ html/images/Makefile.in | 2
+ html/man/Makefile.in | 2
+ libtiff/Makefile.in | 2
+ libtiff/tif_codec.c | 5
+ libtiff/tif_dirinfo.c | 4
+ libtiff/tif_pixarlog.c | 94 ++---
+ libtiff/tif_print.c | 15
+ man/Makefile.in | 2
+ port/Makefile.in | 2
+ test/Makefile.in | 2
+ tools/Makefile.in | 2
+ tools/ppm2tiff.c | 39 +-
+ tools/rgb2ycbcr.c | 5
+ tools/tiff2bw.c | 4
+ tools/tiff2pdf.c | 313 ++++++++--------
+ tools/tiff2ps.c | 20 -
+ tools/tiffcrop.c | 12
+ tools/tiffdither.c | 4
+ 38 files changed, 728 insertions(+), 628 deletions(-)
+
+diff --git a/ChangeLog b/ChangeLog
+index c18d495..2d8bc7c 100644
+--- a/ChangeLog
++++ b/ChangeLog
+@@ -1,3 +1,51 @@
++2013-05-02 Tom Lane <tgl@sss.pgh.pa.us>
++
++ * tools/tiff2pdf.c: Rewrite JPEG marker parsing in
++ t2p_process_jpeg_strip to be at least marginally competent. The
++ approach is still fundamentally flawed, but at least now it won't
++ stomp all over memory when given bogus input. Fixes CVE-2013-1960.
++
++2013-05-02 Tom Lane <tgl@sss.pgh.pa.us>
++
++ * contrib/dbs/xtiff/xtiff.c, libtiff/tif_codec.c,
++ libtiff/tif_dirinfo.c, tools/rgb2ycbcr.c, tools/tiff2bw.c,
++ tools/tiff2pdf.c, tools/tiff2ps.c, tools/tiffcrop.c,
++ tools/tiffdither.c: Enlarge some fixed-size buffers that weren't
++ large enough, and eliminate substantially all uses of sprintf(buf,
++ ...) in favor of using snprintf(buf, sizeof(buf), ...), so as to
++ protect against overflow of fixed-size buffers. This responds in
++ particular to CVE-2013-1961 concerning overflow in tiff2pdf.c's
++ t2p_write_pdf_page(), but in general it seems like a good idea to
++ deprecate use of sprintf().
++
++2013-01-25 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
++
++ * tools/tiff2ps.c:Fix bug in auto rotate option code. Once a
++ rotation angle was set by the auto rotate check, it was retained
++ for all pages that followed instead of being retested for each
++ page. Patch by Richard Nolde.
++
++2012-12-12 Tom Lane <tgl@sss.pgh.pa.us>
++
++ * libtiff/tif_print.c: Back-patch recent fixes in
++ TIFFPrintDirectory to make it handle field_passcount fields sanely
++ for both TIFF_VARIABLE and TIFF_VARIABLE2 cases.
++
++2012-12-10 Tom Lane <tgl@sss.pgh.pa.us>
++
++ * tools/ppm2tiff.c: Back-patch fix for CVE-2012-4564.
++
++2012-12-10 Tom Lane <tgl@sss.pgh.pa.us>
++
++ * libtiff/tif_pixarlog.c: Back-patch recent security fixes for
++ tif_pixarlog.c, namely the fix for CVE-2012-4447 and protections
++ against accessing outside the lookup arrays for out of range
++ inputs.
++
++2012-11-18 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
++
++ * automake: Update Automake to 1.12.5 release.
++
+ 2012-09-22 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
+
+ * libtiff 3.9.7 released.
+@@ -31,7 +79,7 @@
+
+ * libtiff/tif_dirread.c: Avoid trusting samplesperpixel's default
+ of 1 for purposes of trimming tags. This is to get some super
+- crappy OJPEG files to work again. Grr.
++ crappy OJPEG files to work again. Grr.
+ http://bugzilla.maptools.org/show_bug.cgi?id=2348
+
+ 2012-06-01 Frank Warmerdam <warmerdam@google.com>
+@@ -101,8 +149,8 @@
+ * libtiff/tiffiop.h: avoid declaring int64/uint64 on AIX with XLC
+ where they are already available. (#2301)
+
+- * libtiff/tif_thunder.c: Correct potential buffer overflow with
+- thunder encoded files with wrong bitspersample set. The libtiff
++ * libtiff/tif_thunder.c: Correct potential buffer overflow with
++ thunder encoded files with wrong bitspersample set. The libtiff
+ development team would like to thank Marin Barbella and TippingPoint's
+ Zero Day Initiative for reporting this vulnerability (ZDI-CAN-1004,
+ CVE-2011-1167).
+@@ -110,18 +158,18 @@
+
+ 2011-03-10 Frank Warmerdam <warmerdam@pobox.com>
+
+- * libtiff/tif_fax3.h: Fix to last change allowing zero length
++ * libtiff/tif_fax3.h: Fix to last change allowing zero length
+ runs at the start of a scanline - needed for legal cases.
+
+ 2011-03-02 Frank Warmerdam <warmerdam@pobox.com>
+
+- * libtiff/tif_fax3.h: Protect against a fax VL(n) codeword commanding
+- a move left. Without this, a malicious input file can generate an
+- indefinitely large series of runs without a0 ever reaching the right
++ * libtiff/tif_fax3.h: Protect against a fax VL(n) codeword commanding
++ a move left. Without this, a malicious input file can generate an
++ indefinitely large series of runs without a0 ever reaching the right
+ margin, thus overrunning our buffer of run lengths. Per CVE-2011-0192.
+- This is a modified version of a patch proposed by Drew Yao of Apple
+- Product Security. It adds an unexpected() report, and disallows the
+- equality case, since emitting a run without increasing a0 still allows
++ This is a modified version of a patch proposed by Drew Yao of Apple
++ Product Security. It adds an unexpected() report, and disallows the
++ equality case, since emitting a run without increasing a0 still allows
+ buffer overrun.
+
+ 2011-02-25 Andrey Kiselev <dron@ak4719.spb.edu>
+@@ -133,7 +181,7 @@
+ 2011-01-03 Lee Howard <faxguy@howardsilvan.com>
+
+ * libtiff/tif_jpeg.c: Fix regressions with 2 and 3 band images
+- caused by commit on 2010-12-14. Submitted by e-mail from
++ caused by commit on 2010-12-14. Submitted by e-mail from
+ Even Rouault <even.rouault@mines-paris.org>
+
+ 2010-12-31 Olivier Paquet <olivier.paquet@gmail.com>
+@@ -188,13 +236,13 @@
+
+ 2010-12-12 Lee Howard <faxguy@howardsilvan.com>
+
+- * tools/tiff2pdf.c: fix colors for images with RGBA
++ * tools/tiff2pdf.c: fix colors for images with RGBA
+ interleaved data
+ http://bugzilla.maptools.org/show_bug.cgi?id=2250
+
+ 2010-12-11 Lee Howard <faxguy@howardsilvan.com>
+
+- * tools/tiff2pdf.c: remove invalid duplication for Lab
++ * tools/tiff2pdf.c: remove invalid duplication for Lab
+ http://bugzilla.maptools.org/show_bug.cgi?id=2162
+
+ 2010-12-11 Lee Howard <faxguy@howardsilvan.com>
+@@ -236,7 +284,7 @@
+
+ 2010-12-07 Lee Howard <faxguy@howardsilvan.com>
+
+- * libtiff/tif_jpeg.c, libtiff/tif_strip.c: apply patch for
++ * libtiff/tif_jpeg.c, libtiff/tif_strip.c: apply patch for
+ CVE-2010-3087 per bug
+ http://bugzilla.maptools.org/show_bug.cgi?id=2140
+
+@@ -248,7 +296,7 @@
+ 2010-09-25 Lee Howard <faxguy@howardsilvan.com>
+
+ * tools/tiff2ps.c: improvements and enhancements from Richard Nolde
+- with additional command line options for Document Title,
++ with additional command line options for Document Title,
+ Document Creator, and Page Orientation
+
+ 2010-07-13 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
+@@ -349,14 +397,14 @@
+ * libtiff/tif_dirread.c: Fixed bad handling of out of order tags
+ definated late by a codec (#2210)
+
+- * libtiff/tif_dirread.c: Fixed inadequate validation of the
++ * libtiff/tif_dirread.c: Fixed inadequate validation of the
+ SubjectDistance field (#2212).
+
+- * tiff2pdf.c: Fix assorted bugs in tiff2pdf: missing "return"
+- in t2p_read_tiff_size() causes t2p->tiff_datasize to be set entirely
+- wrong for COMPRESSION_JPEG case, resulting in memory stomp if actual
+- size is larger. Also, there are a bunch of places that try to
+- memset() a malloc'd buffer before checking for malloc failure, which
++ * tiff2pdf.c: Fix assorted bugs in tiff2pdf: missing "return"
++ in t2p_read_tiff_size() causes t2p->tiff_datasize to be set entirely
++ wrong for COMPRESSION_JPEG case, resulting in memory stomp if actual
++ size is larger. Also, there are a bunch of places that try to
++ memset() a malloc'd buffer before checking for malloc failure, which
+ would result in core dump if there actually were a failure. (#2211)
+
+ 2010-06-11 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
+@@ -452,13 +500,13 @@
+
+ 2010-05-07 Frank Warmerdam <warmerdam@pobox.com>
+
+- * libtiff/tif_jpeg.c: Ensure that quality is always set in
+- JPEGPreEncode(), not just when we want to output local tables.
++ * libtiff/tif_jpeg.c: Ensure that quality is always set in
++ JPEGPreEncode(), not just when we want to output local tables.
+ Otherwise the quality used during compression may not be right and
+ might not match the tables in the tables tag. This bug only occurs
+ when seeking between directories in the midst of writing blocks.
+ http://trac.osgeo.org/gdal/ticket/3539
+-
++
+ 2010-05-05 Olivier Paquet <olivier.paquet@gmail.com>
+
+ * libtiff/tif_print.c: Have TIFFTAG_REFERENCEBLACKWHITE always print 6
+@@ -476,11 +524,11 @@
+ 2010-02-22 Lee Howard <faxguy@howardsilvan.com>
+
+ * libtiff/tif_jpeg.c: Do not generate a JPEGTables tag when creating
+- the JPEG TIFF as is is not required in order to prevent it from
+- being unused and filled with invalid data. (Leave it to be
++ the JPEG TIFF as is is not required in order to prevent it from
++ being unused and filled with invalid data. (Leave it to be
+ generated by later activity.)
+ http://bugzilla.maptools.org/show_bug.cgi?id=2135
+- * tools/tiff2pdf.c: Write the JPEG SOI headers into the TIFF strip
++ * tools/tiff2pdf.c: Write the JPEG SOI headers into the TIFF strip
+ data rather than skipping them. This fixes the ability to view in
+ Acrobat Reader, Evince, and Ghostscript.
+ http://bugzilla.maptools.org/show_bug.cgi?id=2135
+@@ -491,13 +539,13 @@
+ 2010-01-06 Frank Warmerdam <warmerdam@pobox.com>
+
+ * libtiff/tif_dir.c: Ensure tile and scanline sizes are reset
+- when moving to new directories.
++ when moving to new directories.
+ http://bugzilla.maptools.org/show_bug.cgi?id=1936
+
+ 2009-12-03 Frank Warmerdam <warmerdam@pobox.com>
+
+ * libtiff/tif_jpeg.c: Fix a couple of issues that trigger failures in
+- some cases when using TIFFReadScanline() with JPEG compressed
++ some cases when using TIFFReadScanline() with JPEG compressed
+ subsampled ycbcr images.
+ http://bugzilla.maptools.org/show_bug.cgi?id=1936
+
+@@ -610,7 +658,7 @@
+
+ 2009-06-22 Frank Warmerdam <warmerdam@pobox.com>
+
+- * libtiff/tif_lzw.c: Fix buffer underflow bug.
++ * libtiff/tif_lzw.c: Fix buffer underflow bug.
+ http://bugzilla.maptools.org/show_bug.cgi?id=2065
+
+ 2009-06-03 Frank Warmerdam <warmerdam@pobox.com>
+@@ -621,7 +669,7 @@
+
+ 2009-02-12 Frank Warmerdam <warmerdam@pobox.com>
+
+- * libtiff/tif_luv.c: Fix handling of tiled logluv images.
++ * libtiff/tif_luv.c: Fix handling of tiled logluv images.
+ http://bugzilla.maptools.org/show_bug.cgi?id=2005
+
+ 2009-01-23 Frank Warmerdam <warmerdam@pobox.com>
+@@ -635,7 +683,7 @@
+
+ 2009-01-12 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
+
+- * tools/tiff2ps.c: Remove spurious message printed to stderr.
++ * tools/tiff2ps.c: Remove spurious message printed to stderr.
+
+ 2009-01-11 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
+
+@@ -668,7 +716,7 @@
+ 2008-12-31 Frank Warmerdam <warmerdam@pobox.com>
+
+ * tools/tiffcrop.c, man/tiffcrop.1: A major update from Richard
+- Nolde.
++ Nolde.
+
+ 2008-12-21 Frank Warmerdam <warmerdam@pobox.com>
+
+@@ -678,7 +726,7 @@
+
+ 2008-12-21 Frank Warmerdam <warmerdam@pobox.com>
+
+- * libtiff/tif_getimage.c, tiffio.h: More ABI corrections.
++ * libtiff/tif_getimage.c, tiffio.h: More ABI corrections.
+ Removed SubsamplingHor/Ver from TIFFRGBAImage structure.
+ http://bugzilla.maptools.org/show_bug.cgi?id=1980
+
+@@ -719,15 +767,15 @@
+
+ 2008-05-24 Frank Warmerdam <warmerdam@pobox.com>
+
+- * tif_codec.c: Avoid NULL pointer dereferencing for exotic
++ * tif_codec.c: Avoid NULL pointer dereferencing for exotic
+ compression codec codes.
+
+ * tif_dirread.c: zero tif->tif_dir after freeing the directory
+ in TIFFReadCustomDirectory(). I don't exactly remember why this
+- was important.
++ was important.
+
+ * tif_dirwrite.c: Fix potential memory leak writing large double
+- tags.
++ tags.
+
+ * tif_dirread.c: Fix unchecked malloc result.
+
+@@ -747,12 +795,12 @@
+
+ 2007-11-22 Frank Warmerdam <warmerdam@pobox.com>
+
+- * tif_write.c: Rip out the fancy logic in TIFFAppendToStrip() for
+- establishing if an existing tile can be rewritten to the same location
+- by comparing the current size to all the other blocks in the same
+- directory. This is dangerous in many situations and can easily
++ * tif_write.c: Rip out the fancy logic in TIFFAppendToStrip() for
++ establishing if an existing tile can be rewritten to the same location
++ by comparing the current size to all the other blocks in the same
++ directory. This is dangerous in many situations and can easily
+ corrupt a file. (observed in esoteric GDAL situation that's hard to
+- document). This change involves leaving the stripbytecount[] values
++ document). This change involves leaving the stripbytecount[] values
+ unaltered till TIFFAppendToStrip(). Now we only write a block back
+ to the same location it used to be at if the new data is the same
+ size or smaller - otherwise we move it to the end of file.
+@@ -760,17 +808,17 @@
+ * tif_dirwrite.c: Try to avoid writing out a full readbuffer of tile
+ data when writing the directory just because we have BEENWRITING at
+ some point in the past. This was causing odd junk to be written out
+- in a tile of data when a single tile had an interleaving of reading
+- and writing with reading last. (highlighted by gdal
+- autotest/gcore/tif_write.py test 7.
++ in a tile of data when a single tile had an interleaving of reading
++ and writing with reading last. (highlighted by gdal
++ autotest/gcore/tif_write.py test 7.
+
+ * tif_predict.c: use working buffer in PredictorEncodeTile to avoid
+- modifying callers buffer.
++ modifying callers buffer.
+ http://trac.osgeo.org/gdal/ticket/1965
+
+- * tif_predict.c/h, tif_lzw.c, tif_zip.c: Improvements so that
++ * tif_predict.c/h, tif_lzw.c, tif_zip.c: Improvements so that
+ predictor based encoding and decoding works in read-write update
+- mode properly.
++ mode properly.
+ http://trac.osgeo.org/gdal/ticket/1948
+
+ 2007-10-05 Frank Warmerdam <warmerdam@pobox.com>
+@@ -785,7 +833,7 @@
+
+ 2007-07-18 Andrey Kiselev <dron@ak4719.spb.edu>
+
+- * libtiff/{Makefile.am, Makefile.v}: Do not distribute tiffconf.h,
++ * libtiff/{Makefile.am, Makefile.v}: Do not distribute tiffconf.h,
+ remove tif_config.h/tiffconf.h during cleaning. As per bug
+
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=1573
+@@ -803,14 +851,13 @@
+ 2007-07-03 Andrey Kiselev <dron@ak4719.spb.edu>
+
+ * tools/tiff2ps.c: Added support 16-bit images as per bug
+-
++
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=1566
+
+ Patch from William Bader.
+
+ * tools/tiff2pdf.c: Fix for TIFFTAG_JPEGTABLES tag fetching and
+ significant upgrade of the whole utility as per bug
+-
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=1560
+
+ Now we don't need tiffiop.h in tiff2pdf anymore and will open output
+@@ -828,7 +875,7 @@
+
+ * libtiff/tif_dirwrite.c: Fixed problem introduced with a fix for a
+ byte swapping issue
+-
++
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=1363
+
+ As per bug
+@@ -846,7 +893,7 @@
+ * libtiff/{tif_dir.h, tif_dirread.c, tif_dirinfo.c, tif_jpeg.c,
+ tif_fax3.c, tif_jbig.c, tif_luv.c, tif_ojpeg.c, tif_pixarlog.c,
+ tif_predict.c, tif_zip.c}: Finally fix bug
+-
++
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=1274
+
+ by introducing _TIFFMergeFieldInfo() returning integer error status
+@@ -857,7 +904,7 @@
+
+ 2007-04-07 Frank Warmerdam <warmerdam@pobox.com>
+
+- * contrib/addtiffo/tif_overview.c: Fix problems with odd sized output
++ * contrib/addtiffo/tif_overview.c: Fix problems with odd sized output
+ blocks in TIFF_DownSample_Subsampled() (bug 1542).
+
+ 2007-04-06 Frank Warmerdam <warmerdam@pobox.com>
+@@ -865,20 +912,20 @@
+ * libtiff/tif_jpeg.c: Changed JPEGInitializeLibJPEG() so that it
+ will convert from decompressor to compressor or compress to decompress
+ if required by the force arguments. This works around a problem in
+- where the JPEGFixupTestSubsampling() may cause a decompressor to
++ where the JPEGFixupTestSubsampling() may cause a decompressor to
+ be setup on a directory when later a compressor is required with the
+- force flag set. Occurs with the addtiffo program for instance.
++ force flag set. Occurs with the addtiffo program for instance.
+
+ 2007-04-06 Andrey Kiselev <dron@ak4719.spb.edu>
+
+ * libtiff/tif_dirwrite.c: Fixed swapping of byte arrays stored
+ in-place in tag offsets as per bug
+-
++
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=1363
+
+ * tools/tiffcrop.c, man/tiffcrop.1: Significant update in
+ functionality from Richard Nolde. As per bug
+-
++
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=1525
+
+ 2007-03-28 Frank Warmerdam <warmerdam@pobox.com>
+@@ -886,15 +933,15 @@
+ * libtiff/tif_fax3.c: "inline static" -> "static inline" for IRIC CC.
+
+ 2007-03-07 Joris Van Damme <joris.at.lebbeke@skynet.be>
+-
++
+ * libtiff/tif_getimage.c: workaround for 'Fractional scanline' error reading
+ OJPEG images with rowsperstrip that is not a multiple of vertical subsampling
+ factor. This bug is mentioned in:
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=1390
+- http://www.asmail.be/msg0054766825.html
++ http://www.asmail.be/msg0054766825.html
+
+ 2007-03-07 Joris Van Damme <joris.at.lebbeke@skynet.be>
+-
++
+ * libtiff/tif_win32.c: made inclusion of windows.h unconditional
+
+ * libtiff/tif_win32.c: replaced preprocessor indication for consiously
+@@ -944,14 +991,14 @@
+ larger than 2GB. Fixes bug
+
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=890
+-
++
+ Idea submitted by Matt Hancher.
+
+ 2007-01-31 Andrey Kiselev <dron@ak4719.spb.edu>
+
+ * tools/tif2rgba.c: This utility does not work properly on big-endian
+ architectures. It was fixed including the bug
+-
++
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=1149
+
+ 2007-01-15 Mateusz Loskot <mateusz@loskot.net>
+@@ -968,15 +1015,15 @@
+
+ 2006-11-19 Frank Warmerdam <warmerdam@pobox.com>
+
+- * libtiff/tif_write.c: TIFFAppendToStrip() - clear sorted flag if
+- we move a strip.
+- http://bugzilla.remotesensing.org/show_bug.cgi?id=1359
++ * libtiff/tif_write.c: TIFFAppendToStrip() - clear sorted flag if
++ we move a strip.
++ http://bugzilla.remotesensing.org/show_bug.cgi?id=1359
+
+ 2006-10-13 Andrey Kiselev <dron@ak4719.spb.edu>
+
+ * libtiff/tif_dir.c: More fixes for vulnerabilities, reported
+ in Gentoo bug ():
+-
++
+ http://bugs.gentoo.org/show_bug.cgi?id=142383
+
+ * libtiff/contrib/dbs/xtiff/xtiff.c: Make xtiff utility compilable.
+@@ -1010,12 +1057,12 @@
+ * libtiff/tif_lzw.c, libtiff/tif_zip.c: Fixed problems with mixing
+ encoding and decoding on the same read-write TIFF handle. The LZW
+ code can now maintain encode and decode state at the same time. The
+- ZIP code will switch back and forth as needed.
++ ZIP code will switch back and forth as needed.
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=757
+
+ 2006-09-20 Frank Warmerdam <warmerdam@pobox.com>
+
+- * libtiff: Rename config.h.vc and tif_config.h.vc to config.vc.h and
++ * libtiff: Rename config.h.vc and tif_config.h.vc to config.vc.h and
+ tif_config.vc.h for easier identification by folks using an IDE.
+
+ 2006-07-25 Frank Warmerdam <warmerdam@pobox.com>
+@@ -1030,7 +1077,7 @@
+
+ 2006-07-12 Frank Warmerdam <warmerdam@pobox.com>
+
+- * tif_dirwrite.c: make sure to use uint32 for wordcount in
++ * tif_dirwrite.c: make sure to use uint32 for wordcount in
+ TIFFWriteNormanTag if writecount is VARIABLE2 for ASCII fields.
+ It already seems to have been done for other field types. Needed
+ for "tiffset" on files with geotiff ascii text.
+@@ -1058,9 +1105,9 @@
+ 2006-06-17 Frank Warmerdam <warmerdam@pobox.com>
+
+ * tif_readdir.c: Added case in EstimateStripByteCounts() for tiled
+- files. Modified TIFFReadDirectory() to not invoke
++ files. Modified TIFFReadDirectory() to not invoke
+ EstimateStripByteCounts() for case where entry 0 and 1 are unequal
+- but one of them is zero.
++ but one of them is zero.
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=1204
+
+ 2006-06-08 Andrey Kiselev <dron@ak4719.spb.edu>
+@@ -1088,7 +1135,7 @@
+ * {configure, configure.ac, libtiff/tif_jbig.c, tools/tiffcp.c}: Added
+ support for JBIG compression scheme (34661 code) contributed by Lee
+ Howard. As per bug
+-
++
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=896
+
+ * configure, configure.ac: OJPEG support enabled by default.
+@@ -1127,7 +1174,7 @@
+ 2006-04-18 Frank Warmerdam <warmerdam@pobox.com>
+
+ * nmake.opt: use /EHsc for VS2005 compatibility. Also define
+- _CRT_SECURE_NO_DEPRECATE to avoid noise on VS2005.
++ _CRT_SECURE_NO_DEPRECATE to avoid noise on VS2005.
+
+ 2006-04-12 Joris Van Damme <joris.at.lebbeke@skynet.be>
+
+@@ -1135,7 +1182,7 @@
+ non-subsampled YCbCr (i.e. separate YCbCr with subsampling [1,1])
+
+ 2006-04-11 Joris Van Damme <joris.at.lebbeke@skynet.be>
+-
++
+ * libtiff/tif_getimage.c: Revision of all RGB(A) put routines
+ - Conversion of unassociated alpha to associated alpha now done with
+ more performant LUT, and calculation more correct
+@@ -1144,21 +1191,21 @@
+ - Bugfix of handling of 16bit RGB with unassociated alpha
+
+ 2006-04-11 Joris Van Damme <joris.at.lebbeke@skynet.be>
+-
+- * libtiff/tif_getimage.c:
+- - When there is no alpha, gtTileSeparate and gtStripSeparate allocated
+- buffer for alpha strile and filled it, only to never read it back.
++
++ * libtiff/tif_getimage.c:
++ - When there is no alpha, gtTileSeparate and gtStripSeparate allocated
++ buffer for alpha strile and filled it, only to never read it back.
+ Removed allocation and fill.
+- - Minor rename of vars in gtTileSeparate and gtStripSeparate
++ - Minor rename of vars in gtTileSeparate and gtStripSeparate
+ anticipating planned functionality extension
+
+ 2006-04-08 Joris Van Damme <joris.at.lebbeke@skynet.be>
+
+- * libtiff/tif_getimage.c: renamed pickTileContigCase to PickContigCase
+- and pickTileSeparateCase to PickSeparateCase as both work on strips as
++ * libtiff/tif_getimage.c: renamed pickTileContigCase to PickContigCase
++ and pickTileSeparateCase to PickSeparateCase as both work on strips as
+ well
+
+- * libtiff/tif_getimage.c: moved img->get selection from
++ * libtiff/tif_getimage.c: moved img->get selection from
+ TIFFRGBAImageBegin into PickContigCase and PickSeparateCase to create
+ logical hook for planned functionality extension
+
+@@ -1169,9 +1216,9 @@
+
+ 2006-04-07 Joris Van Damme <joris.at.lebbeke@skynet.be>
+
+- * libtiff/tif_getimage.c: replaced usage of TIFFScanlineSize in
++ * libtiff/tif_getimage.c: replaced usage of TIFFScanlineSize in
+ gtStripContig with TIFFNewScanlineSize so as to fix buggy behaviour
+- on subsampled images - this ought to get sorted when we feel brave
++ on subsampled images - this ought to get sorted when we feel brave
+ enough to replace TIFFScanlineSize alltogether
+
+ * libtiff/tif_ojpeg.c: fixed bug in OJPEGReadSkip
+@@ -1180,13 +1227,13 @@
+
+ * libtiff/tiffio.h: added new type tstrile_t
+
+- * libtiff/tif_dir.h: changed types of td_stripsperimage and td_nstrips
+- to new tstrile_t, types of td_stripoffset and td_stripbytecount to
++ * libtiff/tif_dir.h: changed types of td_stripsperimage and td_nstrips
++ to new tstrile_t, types of td_stripoffset and td_stripbytecount to
+ toff_t*
+
+ * libtiff/tif_ojpeg.c: totally new implementation
+
+- * libtiff/tif_dirread.c: added several hacks to suit new support of
++ * libtiff/tif_dirread.c: added several hacks to suit new support of
+ OJPEG
+
+ * libtiff/tif_getimage.c: removed TIFFTAG_JPEGCOLORMODE handling
+@@ -1226,7 +1273,7 @@
+
+ * libtiff/tif_getimage.c: added putcontig8bitYCbCr12tile
+
+- * libtiff/tif_read.c: added support for new TIFF_NOREADRAW flag to
++ * libtiff/tif_read.c: added support for new TIFF_NOREADRAW flag to
+ prepare the path for new tif_ojpeg.c
+
+ 2006-03-23 Andrey Kiselev <dron@ak4719.spb.edu>
+@@ -1342,7 +1389,7 @@
+
+ * libtiff/tif_write.c: Small code rearrangement in TIFFWriteScanline()
+ to avoid crash as per bug
+-
++
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=1081.
+
+ 2006-02-26 Andrey Kiselev <dron@ak4719.spb.edu>
+@@ -1392,7 +1439,7 @@
+ 2006-02-07 Frank Warmerdam <warmerdam@pobox.com>
+
+ * tools/tiff2pdf.c: Fixed support for non-YCbCr encoded JPEG
+- compressed TIFF files, per submission from Dan Cobra.
++ compressed TIFF files, per submission from Dan Cobra.
+
+ 2006-02-07 Andrey Kiselev <dron@ak4719.spb.edu>
+
+@@ -1424,7 +1471,7 @@
+
+ * libtiff/tif_dirread.c: Use _TIFFGetExifFieldInfo() instead of
+ _TIFFGetFieldInfo() in TIFFReadEXIFDirectory() call as per bug
+-
++
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=1026.
+
+ 2006-01-23 Andrey Kiselev <dron@ak4719.spb.edu>
+@@ -1490,7 +1537,7 @@
+
+ 2005-12-26 Andrey Kiselev <dron@ak4719.spb.edu>
+
+- * libtiff/{tif_dir.c, tif_dir.h, tif_dirread.c, tif_dirinfo.c}:
++ * libtiff/{tif_dir.c, tif_dir.h, tif_dirread.c, tif_dirinfo.c}:
+ tiffFieldInfo and exifFieldInfo arrays definitions moved back to
+ tif_dirinfo.c; added _TIFFGetFieldInfo() and _TIFFGetExifFieldInfo()
+ private functions to retrieve FieldInfo arrays.
+@@ -1517,10 +1564,10 @@
+
+ 2005-12-23 Joris Van Damme <joris.at.lebbeke@skynet.be>
+
+- * libtiff/tiffio.h: fixed typo that potentially resulted in
++ * libtiff/tiffio.h: fixed typo that potentially resulted in
+ redefininition of USE_WIN32_FILEIO
+
+- * libtiff/*: Added more 'dual-mode' error handling: Done TIFFWarning
++ * libtiff/*: Added more 'dual-mode' error handling: Done TIFFWarning
+ calls in core LibTiff.
+
+ 2005-12-21 Andrey Kiselev <dron@ak4719.spb.edu>
+@@ -1530,10 +1577,10 @@
+
+ 2005-12-21 Joris Van Damme <joris.at.lebbeke@skynet.be>
+
+- * libtiff/*, contrib/*: Added 'dual-mode' error handling, enabling
++ * libtiff/*, contrib/*: Added 'dual-mode' error handling, enabling
+ newer code to get context indicator in error handler and still
+- remain compatible with older code: Done TIFFError calls everywhere
+- except in tools
++ remain compatible with older code: Done TIFFError calls everywhere
++ except in tools
+
+ 2005-12-20 Andrey Kiselev <dron@ak4719.spb.edu>
+
+@@ -1606,7 +1653,7 @@
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=1002
+
+ * .cvsignore: many files added, and a few update according
+- to suggestion of Brad HArds on tiff mailing list.
++ to suggestion of Brad HArds on tiff mailing list.
+
+ 2005-11-03 Frank Warmerdam <warmerdam@pobox.com>
+
+@@ -1631,7 +1678,7 @@
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=946
+
+ * tools/bmp2tiff.c: Fixed possible integer overflow error as per bug
+-
++
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=965
+
+ * libtiff/tif_dirinfo.c: Make XResolution, YResolution and
+@@ -1641,7 +1688,7 @@
+
+ * tools/tiffsplit.c: Copy fax related fields over splitted parts
+ as per bug
+-
++
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=983
+
+ 2005-10-21 Frank Warmerdam <warmerdam@pobox.com>
+@@ -1697,7 +1744,7 @@
+
+ * libtiff/tif_dir.c: When prefreeing tv->value in TIFFSetFieldV
+ also set it to NULL to avoid double free when re-setting custom
+- string fields as per:
++ string fields as per:
+
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=922
+
+@@ -1733,7 +1780,7 @@
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=831
+
+ Remove TIFFFetchExtraSamples() function, use TIFFFetchNormalTag()
+- instead.
++ instead.
+
+ * libtiff/tiffconf.h.in: One more attempt to fix the AIX bug
+
+@@ -1904,7 +1951,7 @@
+
+ 2005-05-22 Frank Warmerdam <warmerdam@pobox.com>
+
+- * libtiff/tif_dirread.c: Changed the code that computes
++ * libtiff/tif_dirread.c: Changed the code that computes
+ stripbytecount[0] if it appears bogus to ignore if stripoffset[0] is
+ zero. This is a common case with GDAL indicating a "null" tile/strip.
+
+@@ -1914,8 +1961,8 @@
+
+ 2005-05-06 Frank Warmerdam <warmerdam@pobox.com>
+
+- * libtiff/tif_dirread.c: Applied similar change to
+- TIFFFetchPerSampleLongs and TIFFFetchPerSampleAnys.
++ * libtiff/tif_dirread.c: Applied similar change to
++ TIFFFetchPerSampleLongs and TIFFFetchPerSampleAnys.
+
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=843
+
+@@ -1965,7 +2012,7 @@
+
+ * man/TIFFSetField.3tiff: Fixed definition of the TIFFTAG_INKNAMES tag
+ as per bug
+-
++
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=816
+
+ 2005-03-30 Andrey Kiselev <dron@ak4719.spb.edu>
+@@ -2075,7 +2122,7 @@
+
+ * libtiff/tiffio.h: Move TIFFOpenW() function into the extern "C"{}
+ block as per bug
+-
++
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=763
+
+ 2005-02-03 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
+@@ -2096,7 +2143,7 @@
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=320
+
+ * tools/tiff2ps.c: Fixed problem with page sizes as per bug
+-
++
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=742
+
+ 2005-01-31 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
+@@ -2137,7 +2184,7 @@
+ TIFFRGBAImageBegin() as per bug
+
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=739
+-
++
+ 2005-01-12 Andrey Kiselev <dron@ak4719.spb.edu>
+
+ * libtiff/tif_jpeg.c: Added ability to read/write the fax specific
+@@ -2166,7 +2213,7 @@
+ * libtiff/tiff.h: Restore back the workaround for AIX Visual Age C
+ compiler to avoid double definition of BSD types as per bug
+
+- http://bugzilla.remotesensing.org/show_bug.cgi?id=39
++ http://bugzilla.remotesensing.org/show_bug.cgi?id=39
+
+ * libtiff/Makefile.am: Place the C++ stream API in the separate
+ library called libtiffxx to avoid unneeded dependencies. Probably
+@@ -2190,7 +2237,7 @@
+
+ * libtiff/tif_getimage.c: More fixes for multiple-alpha-channelled
+ RGB-images as per bug
+-
++
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=713
+
+
+@@ -2226,7 +2273,7 @@
+ 2004-12-15 Frank Warmerdam <warmerdam@pobox.com>
+
+ * libtiff/tif_getimage.c: #define A1 bracketing for clean build on
+- SunPro compiler.
++ SunPro compiler.
+
+ 2004-12-11 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
+
+@@ -2238,7 +2285,7 @@
+
+ * libtiff/tif_dirwrite.c: Always write TIFFTAG_SUBIFD using LONG type
+ as per bugs
+-
++
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=703
+
+ and
+@@ -2258,9 +2305,9 @@
+
+ * libtiff/tif_config.in.vc: Removed unneded definitions for
+ read/open/close/lseek functions to fix the
+-
++
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=680
+-
++
+ 2004-12-03 Andrey Kiselev <dron@ak4719.spb.edu>
+
+ * libtiff/{tif_dir.c, tif_dirread.c}: Remove TIFFReassignTagToIgnore()
+@@ -2296,7 +2343,7 @@
+
+ 2004-11-26 Frank Warmerdam <warmerdam@pobox.com>
+
+- * libtiff/makefile.vc: make it easier to rename the libtiff DLL.
++ * libtiff/makefile.vc: make it easier to rename the libtiff DLL.
+
+ 2004-11-24 Andrey Kiselev <dron@ak4719.spb.edu>
+
+@@ -2393,7 +2440,7 @@
+ per bug
+
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=648
+-
++
+ * libtiff/{tif_jpeg.c, tif_ojpeg.c}: TIFFTAG_JPEGTABLES should have
+ uint32 count. Use this type everywhere.
+
+@@ -2406,7 +2453,7 @@
+ * tools/tiff2rgba.c: removed extra newlines in usage message.
+
+ 2004-10-30 Andrey Kiselev <dron@ak4719.spb.edu>
+-
++
+ * libtiff/tif_dirwrite.c: Improvements in tag writing code.
+
+ * tools/tiff2ps.c: Fixed wrong variable data type when read Position
+@@ -2421,7 +2468,7 @@
+
+ * libtiff/tif_fax3.c: Fixed case with the wrong decode routines
+ choosing when the incorrect Group4Options tag set. As per bug
+-
++
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=323
+
+ * libtiff/tif_dirwrite.c: Fixed problem with passing count variable of
+@@ -2440,7 +2487,7 @@
+ * tools/tiff2pdf.c: added casts to avoid warnings.
+
+ * libtiff/libtiff.def: Added several more entry points required
+- to link fax2tiff.c against the DLL on windows.
++ to link fax2tiff.c against the DLL on windows.
+
+ 2004-10-27 Andrey Kiselev <dron@ak4719.spb.edu>
+
+@@ -2511,7 +2558,7 @@
+ 2004-10-08 Frank Warmerdam <warmerdam@pobox.com>
+
+ * libtiff/tif_dirinfo.c: Fix bug with tif_foundfield and reallocation
+- of tif_fieldinfo.
++ of tif_fieldinfo.
+
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=630
+
+@@ -2543,7 +2590,7 @@
+
+ 2004-09-30 Frank Warmerdam <warmerdam@pobox.com>
+
+- * libtiff/tif_dirinfo.c: changed type of XMLPacket (tag 700) to
++ * libtiff/tif_dirinfo.c: changed type of XMLPacket (tag 700) to
+ TIFFTAG_BYTE instead of TIFFTAG_UNDEFINED to comply with the info
+ in the Adobe XMP Specification.
+
+@@ -2563,7 +2610,7 @@
+ 2004-09-26 Andrey Kiselev <dron@ak4719.spb.edu>
+
+ * libtiff/{tif_dir.h, tif_dir.c, tif_dirread.c, tif_write.c}:
+- Optimize checking for the strip bounds.
++ Optimize checking for the strip bounds.
+
+ * libtiff/{tif_dirread.c, tif_strip.c}: TIFFScanlineSize() and
+ TIFFRasterScanlineSize() functions report zero in the case of integer
+@@ -2714,7 +2761,7 @@
+ here
+
+ http://www.asmail.be/msg0054799560.html
+-
++
+ for details.
+
+ * tools/fax2tiff.c: Use the new functions in the code.
+@@ -2842,11 +2889,11 @@
+ * tools/tiffsplit.c: Fixed problem with unproperly written multibyte
+ files. Now output files will be written using the same byte order
+ flag as in the input image. See
+-
++
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=574
+-
++
+ for details.
+-
++
+ 2004-05-19 Frank Warmerdam <warmerdam@pobox.com>
+
+ * libtiff/tif_print.c: added (untested) support for printing
+@@ -2858,7 +2905,7 @@
+
+ * libtiff/tif_fax3.c: Avoid reading CCITT compression options
+ if compression type mismatches. See
+-
++
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=565
+
+ 2004-04-30 Andrey Kiselev <dron@ak4719.spb.edu>
+@@ -2903,7 +2950,7 @@
+ 2004-04-04 Frank Warmerdam <warmerdam@pobox.com>
+
+ * libtiff/tif_open.c: close clientdata if TIFFClientOpen() fails
+- via bad2.
++ via bad2.
+
+ 2004-03-26 Andrey Kiselev <dron@ak4719.spb.edu>
+
+@@ -2930,10 +2977,10 @@
+
+ 2004-02-26 Andrey Kiselev <dron@ak4719.spb.edu>
+
+- * tools/tiffsplit.c: Copy JPEGTables tag contents for JPEG compressed
++ * tools/tiffsplit.c: Copy JPEGTables tag contents for JPEG compressed
+ images. Reported by Artem Mirolubov.
+
+- * libtiff/tif_dirread.c: Fixed problem with handling TIFF_UNDEFINED
++ * libtiff/tif_dirread.c: Fixed problem with handling TIFF_UNDEFINED
+ tag type in TIFFFetchNormalTag() as per bug
+
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=508
+@@ -2955,8 +3002,8 @@
+ 2004-01-30 Frank Warmerdam <warmerdam@pobox.com>
+
+ * libtiff/libtiff.def: Added TIFFCurrentDirOffset, TIFFWriteCheck,
+- TIFFRGBAImageOK, and TIFFNumberOfDirectories as suggested by
+- Scott Reynolds.
++ TIFFRGBAImageOK, and TIFFNumberOfDirectories as suggested by
++ Scott Reynolds.
+
+ 2004-01-29 Andrey Kiselev <dron@ak4719.spb.edu>
+
+@@ -2974,7 +3021,7 @@
+ file if TIFFFdOpen() failed as per bug
+
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=468
+-
++
+ * libtiff/tif_open.c: More fixes for
+
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=468
+@@ -2998,7 +3045,7 @@
+ * libtiff/tif_dirwrite.c: Fixed handling of writable ASCII tags that
+ are field_passcount=TRUE properly. Arguably anonymous custom tags
+ should be declared as passcount=FALSE, but I don't want to change
+- that without a careful review.
++ that without a careful review.
+
+ 2004-01-20 Andrey Kiselev <dron@ak4719.spb.edu>
+
+@@ -3161,8 +3208,8 @@
+
+ 2003-11-17 Frank Warmerdam <warmerdam@pobox.com>
+
+- * tif_dirread.c: do not mark all anonymously defined tags to be
+- IGNOREd.
++ * tif_dirread.c: do not mark all anonymously defined tags to be
++ IGNOREd.
+
+ 2003-11-17 Andrey Kiselev <dron@ak4719.spb.edu>
+
+@@ -3202,15 +3249,15 @@
+
+ 2003-11-09 Frank Warmerdam <warmerdam@pobox.com>
+
+- * libtiff/tif_tile.c: remove spurious use of "s" (sample) in the
++ * libtiff/tif_tile.c: remove spurious use of "s" (sample) in the
+ planarconfig_contig case in TIFFComputeTile().
+
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=387
+
+ 2003-11-09 Andrey Kiselev <dron@ak4719.spb.edu>
+-
++
+ * libtiff/tiffiop.h: New macros: TIFFmax, TIFFmin and TIFFrint.
+-
++
+ 2003-11-07 Andrey Kiselev <dron@ak4719.spb.edu>
+
+ * libtiff/{tiffio.h, tif_strip.c}, man/{TIFFstrip.3t, libtiff.3t}:
+@@ -3277,11 +3324,11 @@
+ function TIFFReadRGBAImageOriented() implemented to retrieve raster
+ array with user-specified origin position as suggested by Jason Frank.
+ See
+-
++
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=322
+
+ for details.
+-
++
+ * tools/tiff2rgba.c: Switched to use TIFFReadRGBAImageOriented()
+ instead of TIFFReadRGBAImage().
+
+@@ -3362,9 +3409,9 @@
+ encoded write functions use tif_postdecode() to apply byte order
+ swapping (swab) to the application passed data buffer if the same
+ would be done when reading. This allows us to write pixel data with
+- more than 8 bits per sample to existing files of a non-native byte
++ more than 8 bits per sample to existing files of a non-native byte
+ order. One side effect of this change is the applications buffer
+- itself is altered in this case by the act of writing.
++ itself is altered in this case by the act of writing.
+
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=171
+
+@@ -3390,9 +3437,9 @@
+ 2003-07-08 Frank Warmerdam <warmerdam@pobox.com>
+
+ * tif_aux.c, tif_codec.c, tif_dir.c, tif_dirread.c, tif_extension.c,
+- tif_fax3.c, tif_getimage.c, tif_luv.c, tif_lzw.c, tif_next.c,
++ tif_fax3.c, tif_getimage.c, tif_luv.c, tif_lzw.c, tif_next.c,
+ tif_packbits.c, tif_predict.c, tif_print.c, tif_swab.c, tif_thunder.c:
+- avoid casting warning at /W4.
++ avoid casting warning at /W4.
+
+ 2003-07-03 Andrey Kiselev <dron@ak4719.spb.edu>
+
+@@ -3414,11 +3461,11 @@
+
+ * libtiff/tif_dirinfo.c: TIFFDataWidth() returns 0 in case of
+ unknown data type.
+-
++
+ 2003-06-19 Frank Warmerdam <warmerdam@pobox.com>
+
+ * libtiff/tif_print.c: fixed some serious bugs when printing
+- custom tags ... almost certain to crash.
++ custom tags ... almost certain to crash.
+
+ * libtiff/tif_dirread.c: Don't ignore custom fields that are
+ autodefined. Not sure how this got to be like this.
+@@ -3429,12 +3476,12 @@
+
+ * tools/tiffcmp.c, man/tiffcmp.1: Fixed problem with unused data
+ comparing as per bug
+-
++
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=349
+
+ `-z' option now can be used to set the number of reported different
+ bytes.
+-
++
+ 2003-06-09 Andrey Kiselev <dron@ak4719.spb.edu>
+
+ * tools/tiffcp.c, man/tiffcp.1: Added possibility to specify value -1
+@@ -3460,7 +3507,7 @@
+ 2003-05-25 Andrey Kiselev <dron@ak4719.spb.edu>
+
+ * tools/fax2tiff.c: Page numbering fixed, as per bug
+-
++
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=341
+
+ 2003-05-20 Andrey Kiselev <dron@ak4719.spb.edu>
+@@ -3526,7 +3573,7 @@
+
+ * tools/tiffcp.c: Fixed problem with colorspace conversion for JPEG
+ encoded images. See bug entries
+-
++
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=275
+
+ and
+@@ -3587,16 +3634,16 @@
+
+ * libtiff/tif_jpeg.c: Modified to defer initialization of jpeg
+ library so that we can check if there is already any tile/strip data
+- before deciding between creating a compressor or a decompressor.
++ before deciding between creating a compressor or a decompressor.
+
+ 2003-01-31 Frank Warmerdam <warmerdam@pobox.com>
+
+ * libtiff/tif_write.c: TIFFWriteCheck() now fails if the image is
+- a pre-existing compressed image. That is, image writing to
++ a pre-existing compressed image. That is, image writing to
+ pre-existing compressed images is not allowed.
+
+ * libtiff/tif_open.c: Removed error if opening a compressed file
+- in update mode.
++ in update mode.
+
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=198
+
+@@ -3609,16 +3656,16 @@
+ * cut 3.6.0 Beta release.
+
+ 2002-12-20 Andrey Kiselev <dron@ak4719.spb.edu>
+-
++
+ * tools/fax2ps.c, man/fax2ps.1: Page size was determined
+ in wrong way as per bug
+-
++
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=239
+
+ 2002-12-17 Frank Warmerdam <warmerdam@pobox.com>
+
+- * libtiff/tif_dirread.c: Allow wrong sized arrays in
+- TIFFFetchStripThing().
++ * libtiff/tif_dirread.c: Allow wrong sized arrays in
++ TIFFFetchStripThing().
+
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=49
+
+@@ -3632,7 +3679,7 @@
+ * libtiff/tif_dir.c: fixed bug with resetting an existing custom
+ field value.
+
+- * libtiff/tif_dir.c: Fixed potential problem with ascii "custom"
++ * libtiff/tif_dir.c: Fixed potential problem with ascii "custom"
+ tags in TIFFVGetField() ... added missing break.
+
+ 2002-10-14 Frank Warmerdam <warmerdam@pobox.com>
+@@ -3644,11 +3691,11 @@
+ the eps by redefining the colorimage operator will get messed up.
+ Patch supplied by William Bader.
+
+- * Makefile.in: added tif_extension.c to file list as per
++ * Makefile.in: added tif_extension.c to file list as per
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=218.
+
+ 2002-10-11 Andrey Kiselev <dron@ak4719.spb.edu>
+-
++
+ * configure, config.site, libtiff/{tif_unix.c, Makefile.in}: Fix for
+ large files (>2GiB) supporting. New option in the config.site:
+ LARGEFILE="yes". Should be enough for I/O of the large files.
+@@ -3680,13 +3727,13 @@
+ 2002-10-06 Frank Warmerdam <warmerdam@pobox.com>
+
+ * libtiff/tif_jpeg.c: fixed problem with boolean defined with wrong
+- size on windows. Use #define boolean hack.
++ size on windows. Use #define boolean hack.
+
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=188
+
+ * libtiff/tiff.h: Don't do special type handling in tiff.h unless
+ USING_VISUALAGE is defined.
+-
++
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=39
+
+ 2002-10-03 Frank Warmerdam <warmerdam@pobox.com>
+@@ -3697,30 +3744,30 @@
+
+ * libtiff/tif_dirread.c: Another fix for the fetching SBYTE arrays
+ by the TIFFFetchByteArray() function. Should finally resolve
+-
++
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=52
+-
++
+ * configure: Set -DPIXARLOG_SUPPORT option along with -DZIP_SUPPORT
+
+ * html/Makefile.in: New targets added: html and groffhtml for
+ producing HTML representations of the manual pages automatically.
+ html target uses man2html tool, groffhtml uses groff tool.
+-
++
+ 2002-09-29 Frank Warmerdam <warmerdam@pobox.com>
+
+ * configure, libtiff/Makefile.in: Added SCO OpenServer 5.0.6 support
+- from John H. DuBois III.
++ from John H. DuBois III.
+
+ 2002-09-15 Andrey Kiselev <dron@ak4719.spb.edu>
+
+ * Makefile.in, /man/{raw2tiff.1, Makefile.in, libtiff.3}: Added
+ manual page for raw2tiff(1) tool.
+-
++
+ 2002-09-12 Andrey Kiselev <dron@ak4719.spb.edu>
+
+ * /libtiff/{tiffio.h, tif_dir.h}: TIFFDataWidth() declaration moved to
+ the tiffio.h header file.
+-
++
+ * Makefile.in, /man/{TIFFDataWidth.3t, Makefile.in, libtiff.3}: Added
+ manual page for TIFFDataWidth() function
+
+@@ -3730,8 +3777,8 @@
+ as per http://bugzilla.remotesensing.org/show_bug.cgi?id=196.
+
+ * tools/tiff2ps.c: Don't emit BeginData/EndData DSC comments
+- since we are unable to properly include the amount to skip.
+-
++ since we are unable to properly include the amount to skip.
++
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=80
+
+ 2002-09-02 Andrey Kiselev <dron@ak4719.spb.edu>
+@@ -3741,7 +3788,7 @@
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=52
+
+ 2002-08-22 Andrey Kiselev <dron@ak4719.spb.edu>
+-
++
+ * /libtiff/tif_dirinfo.c: Further additions to free custom fields
+ in _TIFFSetupFieldInfo() function.
+ See http://bugzilla.remotesensing.org/show_bug.cgi?id=169 for details.
+@@ -3750,14 +3797,14 @@
+ LZWDecode() and LZWDecodeCompat().
+ Fixes http://bugzilla.remotesensing.org/show_bug.cgi?id=190
+ and http://bugzilla.remotesensing.org/show_bug.cgi?id=100
+-
++
+ * /libtiff/tif_lzw.c:
+ Added check for valid code lengths in LZWDecode() and
+ LZWDecodeCompat(). Fixes
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=115
+
+ 2002-08-16 Andrey Kiselev <dron@ak4719.spb.edu>
+-
++
+ * /libtiff/{Makefile.vc, libtiff.def}:
+ Missed declarations added.
+
+@@ -3768,7 +3815,7 @@
+
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=177
+
+- * tif_dir.h: changed FIELD_CODEC to 66 from 64 to avoid overlap
++ * tif_dir.h: changed FIELD_CODEC to 66 from 64 to avoid overlap
+ with FIELD_CUSTOM as mentioned in bug 169.
+
+ * tif_close.c: added logic to free dynamically created anonymous
+@@ -3777,31 +3824,31 @@
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=169
+
+ 2002-08-10 Andrey Kiselev <dron@ak4719.spb.edu>
+-
++
+ * /tools/{raw2tiff.c, Makefile.in, Makefile.lcc, Makefile.vc}:
+ New tool: raw2tiff --- raw images to TIFF converter. No manual page yet.
+
+ 2002-07-31 Frank Warmerdam <warmerdam@pobox.com>
+
+- * libtiff/tif_jpeg.c: Fixed problem with setting of nrows in
++ * libtiff/tif_jpeg.c: Fixed problem with setting of nrows in
+ JPEGDecode() as per bugzilla bug (issue 1):
+
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=129
+
+ * libtiff/{tif_jpeg.c,tif_strip.c,tif_print.c}: Hacked tif_jpeg.c to
+ fetch TIFFTAG_YCBCRSUBSAMPLING from the jpeg data stream if it isn't
+- present in the tiff tags.
++ present in the tiff tags.
+
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=168
+
+ * libtiff/tif_read.c, libtiff/tif_write.c: TIFFReadScanline() and
+ TIFFWriteScanline() now set tif_row explicitly in case the codec has
+- fooled with the value.
++ fooled with the value.
+
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=129
+
+ 2002-06-22 Andrey Kiselev <dron@ak4719.spb.edu>
+-
++
+ * /tools/tiff2ps.c: Added workaround for some software that may crash
+ when last strip of image contains fewer number of scanlines than
+ specified by the `/Height' variable. See
+@@ -3817,8 +3864,8 @@
+
+ 2002-06-11 Frank Warmerdam <warmerdam@pobox.com>
+
+- * libtiff/contrib/win95: renamed to contrib/win_dib. Added new
+- Tiffile.cpp example of converting TIFF files into a DIB on Win32.
++ * libtiff/contrib/win95: renamed to contrib/win_dib. Added new
++ Tiffile.cpp example of converting TIFF files into a DIB on Win32.
+ This one is described in:
+
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=143
+@@ -3834,21 +3881,21 @@
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=131
+
+ 2002-04-26 Andrey Kiselev <dron@ak4719.spb.edu>
+-
++
+ * libtiff/libtiff.def: Added missed declaration.
+-
++
+ 2002-04-22 Andrey Kiselev <dron@ak4719.spb.edu>
+-
++
+ * tools/fax2tiff.c: Updated to reflect latest changes in libtiff.
+ Closes http://bugzilla.remotesensing.org/show_bug.cgi?id=125
+
+ 2002-04-20 Andrey Kiselev <dron@ak4719.spb.edu>
+-
++
+ * libtiff/tif_open.c: Pointers to custom procedures
+ in TIFFClientOpen() are checked to be not NULL-pointers.
+-
++
+ 2002-04-18 Andrey Kiselev <dron@ak4719.spb.edu>
+-
++
+ * libtiff/libtiff.def: Added missed declarations.
+
+ * libtiff/tif_pixarlog.c: Updated for using tif_tagmethods structure.
+@@ -3858,14 +3905,14 @@
+ * libtiff/tif_lzw.c: Additional checks for data integrity introduced.
+ Should finally close
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=100
+-
++
+ 2002-04-10 Andrey Kiselev <dron@ak4719.spb.edu>
+
+ * tools/tiff2ps: Division by zero fixed.
+ Closes http://bugzilla.remotesensing.org/show_bug.cgi?id=88
+
+ 2002-04-09 Andrey Kiselev <dron@ak4719.spb.edu>
+-
++
+ * libtiff/: tif_dirwrite.c, tif_write.c, tiffio.h:
+ TIFFCheckpointDirectory() routine added.
+ Closes http://bugzilla.remotesensing.org/show_bug.cgi?id=124
+@@ -3897,7 +3944,7 @@
+ replaced by warnings. Now libtiff should read corrupted LZW-compressed
+ files by skipping bad strips.
+ Closes http://bugzilla.remotesensing.org/show_bug.cgi?id=100
+-
++
+ 2002-04-03 Frank Warmerdam <warmerdam@pobox.com>
+
+ * libtiff/tif_dirwrite.c: Removed some dead code.
+@@ -3919,18 +3966,18 @@
+
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=111
+
+- * tif_print.c: Fixed so that ASCII FIELD_CUSTOM values with
++ * tif_print.c: Fixed so that ASCII FIELD_CUSTOM values with
+ passcount set FALSE can be printed (such as TIFFTAG_SOFTWARE).
+
+- * libtiff/tif_dir.c,tif_dirinfo.c,tif_dir.h,tif_ojpeg.c: modified so
++ * libtiff/tif_dir.c,tif_dirinfo.c,tif_dir.h,tif_ojpeg.c: modified so
+ that TIFFTAG_SOFTWARE uses FIELD_CUSTOM as an example.
+
+ 2002-03-26 Dwight Kelly <dbmalloc@remotesensing.org>
+
+ * libtiff/: tiff.h, tif_dir.c, tif_dir.h, tif_dirinfo.c, tif_dirread.c,
+ tif_dirwrite.c: Added get/put code for new tag XMLPACKET as defined
+- in Adobe XMP Technote. Added missing INKSET tag value from TIFF 6.0 spec
+- INKSET_MULTIINK (=2). Added missing tags from Adobe TIFF technotes:
++ in Adobe XMP Technote. Added missing INKSET tag value from TIFF 6.0 spec
++ INKSET_MULTIINK (=2). Added missing tags from Adobe TIFF technotes:
+ CLIPPATH, XCLIPPATHUNITS, YCLIPPATHUNITS, OPIIMAGEID, OPIPROXY and
+ INDEXED. Added PHOTOMETRIC tag value from TIFF technote 4 ICCLAB (=9).
+
+@@ -3989,7 +4036,7 @@
+
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=94
+
+- * man/Makefile.in: Patch DESTDIR handling
++ * man/Makefile.in: Patch DESTDIR handling
+
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=95
+
+@@ -4027,9 +4074,9 @@
+
+ 2002-01-04 Frank Warmerdam <warmerdam@pobox.com>
+
+- * libtiff/tif_jpeg.c: fixed computation of segment_width for
+- tiles files to avoid error about it not matching the
+- cinfo.d.image_width values ("JPEGPreDecode: Improper JPEG strip/tile
++ * libtiff/tif_jpeg.c: fixed computation of segment_width for
++ tiles files to avoid error about it not matching the
++ cinfo.d.image_width values ("JPEGPreDecode: Improper JPEG strip/tile
+ size.") for ITIFF files. Apparently the problem was incorporated since
+ 3.5.5, presumably during the OJPEG/JPEG work recently.
+
+@@ -4039,7 +4086,7 @@
+
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=94
+
+- * libtiff/tif_getimage.c: If DEFAULT_EXTRASAMPLE_AS_ALPHA is 1
++ * libtiff/tif_getimage.c: If DEFAULT_EXTRASAMPLE_AS_ALPHA is 1
+ (defined in tiffconf.h - 1 by default) then the RGBA interface
+ will assume that a fourth extra sample is ASSOCALPHA if the
+ EXTRASAMPLE value isn't set for it. This changes the behaviour of
+@@ -4051,9 +4098,9 @@
+
+ 2001-12-12 Frank Warmerdam <warmerdam@pobox.com>
+
+- * libtiff/tif_jpeg.c: allow jpeg data stream sampling values to
+- override those from tiff directory. This makes this work with
+- ImageGear generated files.
++ * libtiff/tif_jpeg.c: allow jpeg data stream sampling values to
++ override those from tiff directory. This makes this work with
++ ImageGear generated files.
+
+ 2001-12-07 Frank Warmerdam <warmerdam@pobox.com>
+
+@@ -4066,7 +4113,7 @@
+ * Reissue 3.5.7 release.
+
+ * libtiff/mkversion.c: Fix output of TIFF_VERSION to be
+- YYYYMMDD so that it is increasing over time.
++ YYYYMMDD so that it is increasing over time.
+
+ * Makefile.in: Ensure that tiffvers.h is regenerated in the
+ make release target.
+@@ -4091,8 +4138,8 @@
+
+ 2001-10-10 Frank Warmerdam <warmerdam@pobox.com>
+
+- * libtiff/tiff.h: I have created COMPRESSION_CCITT_T4,
+- COMPRESSION_CCITT_T6, TIFFTAG_T4OPTIONS and TIFFTAG_T6OPTIONS aliases
++ * libtiff/tiff.h: I have created COMPRESSION_CCITT_T4,
++ COMPRESSION_CCITT_T6, TIFFTAG_T4OPTIONS and TIFFTAG_T6OPTIONS aliases
+ in keeping with TIFF 6.0 standard in tiff.h
+
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=83
+@@ -4112,10 +4159,10 @@
+ error about LZW not being available.
+
+ * libtiff/tif_dir.c: propagate failure to initialize compression
+- back from TIFFSetField() as an error status, so applications can
++ back from TIFFSetField() as an error status, so applications can
+ detect failure.
+
+- * libtiff/tif_dir.c: removed the auto replacement of
++ * libtiff/tif_dir.c: removed the auto replacement of
+ COMPRESSION_LZW with COMPRESSION_NONE in _TIFFVSetField().
+
+ * Removed Makefile, tools/Makefile, port/install.sh, man/Makefile
+@@ -4123,7 +4170,7 @@
+
+ 2001-09-22 Frank Warmerdam <warmerdam@pobox.com>
+
+- * libtiff/tif_ojpeg.c: new update from Scott.
++ * libtiff/tif_ojpeg.c: new update from Scott.
+
+ 2001-09-09 Frank Warmerdam <warmerdam@pobox.com>
+
+@@ -4142,7 +4189,7 @@
+
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=47
+
+- * tools/tiff2ps.c: added OJPEG YCbCr to RGB support.
++ * tools/tiff2ps.c: added OJPEG YCbCr to RGB support.
+
+ * libtiff/tif_ojpeg.c: Applied substantial patch from Scott.
+
+@@ -4151,14 +4198,14 @@
+ * libtiff/tif_packbits.c: fixed memory overrun error.
+
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=77
+-
++
+ 2001-08-31 Frank Warmerdam <warmerdam@pobox.com>
+
+ * libtiff/tif_getimage.c: relax handling of contig case where
+ there are extra samples that are supposed to be ignored. This
+- should now work for 8bit greyscale or palletted images.
++ should now work for 8bit greyscale or palletted images.
+
+- http://bugzilla.remotesensing.org/show_bug.cgi?id=75
++ http://bugzilla.remotesensing.org/show_bug.cgi?id=75
+
+ 2001-08-28 Frank Warmerdam <warmerdam@pobox.com>
+
+@@ -4171,15 +4218,15 @@
+
+ * libtiff/tif_getimage.c: Use memmove() instead of TIFFmemcpy()
+ in TIFFReadRGBATile() to avoid issues in cases of overlapping
+- buffers. See Bug 69 in Bugzilla.
++ buffers. See Bug 69 in Bugzilla.
+
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=69
+-
++
+ * tools/tiff2rgba.c: fixed getopt() call so that -b works again.
+
+ 2001-08-09 Frank Warmerdam <warmerdam@pobox.com>
+
+- * libtiff/tiff.h, libtiff/tif_fax3.c: added check for __LP64__
++ * libtiff/tiff.h, libtiff/tif_fax3.c: added check for __LP64__
+ when checking for 64 bit architectures as per bugzilla bug 67.
+
+ 2001-07-27 Frank Warmerdam <warmerdam@pobox.com>
+@@ -4189,7 +4236,7 @@
+
+ 2001-07-20 Frank Warmerdam <warmerdam@pobox.com>
+
+- * libtiff/tif_jpeg.c: Define HAVE_BOOLEAN on windows if RPCNDR.H
++ * libtiff/tif_jpeg.c: Define HAVE_BOOLEAN on windows if RPCNDR.H
+ has been included.
+
+ 2001-07-19 Frank Warmerdam <warmerdam@pobox.com>
+@@ -4201,11 +4248,11 @@
+
+ * libtiff/tif_ojpeg.c: updates from Scott. Handles colors
+ much better. Now depends on having patched libjpeg as per
+- patch in contrib/ojpeg/*.
++ patch in contrib/ojpeg/*.
+
+ 2001-07-17 Frank Warmerdam <warmerdam@pobox.com>
+
+- * */Makefile.in: added DESTDIR support.
++ * */Makefile.in: added DESTDIR support.
+
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=60
+
+@@ -4213,20 +4260,20 @@
+
+ * configure, libtiff/Makefile.in: applied OpenBSD patches
+ as per:
+-
++
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=61
+
+ 2001-06-28 Frank Warmerdam <warmerdam@pobox.com>
+
+ * libtiff/tif_getimage.c: Fixed so that failure is properly
+- reported by gtTileContig, gtStripContig, gtTileSeparate and
++ reported by gtTileContig, gtStripContig, gtTileSeparate and
+ gtStripSeparate.
+
+ See http://bugzilla.remotesensing.org/show_bug.cgi?id=51
+
+- * tiffcmp.c: Fixed multi samples per pixel support for ContigCompare.
++ * tiffcmp.c: Fixed multi samples per pixel support for ContigCompare.
+ Updated bug section of tiffcmp.1 to note tiled file issues.
+-
++
+ See http://bugzilla.remotesensing.org/show_bug.cgi?id=53
+
+ 2001-06-22 Frank Warmerdam <warmerdam@pobox.com>
+@@ -4267,10 +4314,10 @@
+
+ 2001-05-08 Frank Warmerdam <warmerdam@pobox.com>
+
+- * libtiff/tif_dirinfo.c: moved pixar and copyright flags to
++ * libtiff/tif_dirinfo.c: moved pixar and copyright flags to
+ ensure everything is in order.
+
+- * libtiff/libtiff.def: added TIFFCreateDirectory and
++ * libtiff/libtiff.def: added TIFFCreateDirectory and
+ TIFFDefaultStripSize as per:
+
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=46
+@@ -4279,10 +4326,10 @@
+
+ * libtiff/tif_dirinfo.c: Modified the TIFF_BYTE definition for
+ TIFFTAG_PHOTOSHOP to use a writecount of TIFF_VARIABLE2 (-3) to
+- force use of uint32 counts instead of short counts.
++ force use of uint32 counts instead of short counts.
+
+ * libtiff/tif_dirwrite.c: Added support for TIFF_VARIABLE2 in the
+- case of writing TIFF_BYTE/TIFF_SBYTE fields.
++ case of writing TIFF_BYTE/TIFF_SBYTE fields.
+
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=43
+
+@@ -4318,20 +4365,20 @@
+ with the inttypes.h include file on AIX.
+
+ See http://bugzilla.remotesensing.org/show_bug.cgi?id=39
+-
++
+ * VERSION: update to 3.5.7 beta in preparation for release.
+
+ * configure/config.site: modified to check if -lm is needed for
+ MACHDEPLIBS if not supplied by config.site. Needed for Darwin.
+
+- * config.guess: updated wholesale to an FSF version apparently
+- from 1998 (as opposed to 1994). This is mainly inspired by
++ * config.guess: updated wholesale to an FSF version apparently
++ from 1998 (as opposed to 1994). This is mainly inspired by
+ providing for MacOS X support.
+
+ 2001-03-29 Frank Warmerdam <warmerdam@pobox.com>
+
+ * configure, Makefile.in, etc: added support for OPTIMIZER being
+- set from config.site.
++ set from config.site.
+
+ 2001-03-28 Frank Warmerdam <warmerdam@pobox.com>
+
+@@ -4350,7 +4397,7 @@
+ (in particular short ones) print properly.
+
+ See http://bugzilla.remotesensing.org/show_bug.cgi?id=35
+-
++
+ * tiff2ps.c/tiff2ps.1: Substantial changes to tiff2ps by
+ Bruce A. Mallett. See check message for detailed information
+ on all the changes, including a faster encoder, fixes for level
+@@ -4358,7 +4405,7 @@
+
+ 2001-03-27 Frank Warmerdam <warmerdam@pobox.com>
+
+- * libtiff/tiffio.h: Changed "#if LOGLUV_PUBLIC" to
++ * libtiff/tiffio.h: Changed "#if LOGLUV_PUBLIC" to
+ "#ifdef LOGLUV_PUBLIC" so it will work with VisualAge on AIX.
+
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=39
+@@ -4370,7 +4417,7 @@
+
+ 2001-03-13 Frank Warmerdam <warmerdam@pobox.com>
+
+- * tif_getimage.c: Added support for 16bit minisblack/miniswhite
++ * tif_getimage.c: Added support for 16bit minisblack/miniswhite
+ images in RGBA interface.
+
+ 2001-03-02 Frank Warmerdam <warmerdam@pobox.com>
+@@ -4381,29 +4428,29 @@
+
+ * Brent Roman contributed updated tiffcp utility (and tiffcp.1)
+ with support for extracting subimages with the ,n syntax, and also
+- adding the -b bias removal flag.
++ adding the -b bias removal flag.
+
+ 2001-02-16 Frank Warmerdam <warmerdam@pobox.com>
+
+ * libtiff/libtiff.def: Brent Roman submitted new version adding
+- serveral missing entry points.
++ serveral missing entry points.
+
+ * libtiff/tif_dirinfo.c: don't declare tiffFieldInfo static on VMS.
+- Some sort of weird VMS thing.
++ Some sort of weird VMS thing.
+
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=31
+
+- * tif_luv.c/tiff.h/tiffio.h:
+- New version of TIFF LogLuv (SGILOG) modules contributed by Greg Ward
++ * tif_luv.c/tiff.h/tiffio.h:
++ New version of TIFF LogLuv (SGILOG) modules contributed by Greg Ward
+ (greg@shutterfly.com). He writes:
+
+ 1) I improved the gamut-mapping function in tif_luv.c for imaginary
+- colors, because some images were being super-saturated on the input
++ colors, because some images were being super-saturated on the input
+ side and this resulted in some strange color shifts in the output.
+
+ 2) I added a psuedotag in tiff.h to control random dithering during
+- LogLuv encoding. This is turned off by default for 32-bit LogLuv and
+- on for 24-bit LogLuv output. Dithering improves the average color
++ LogLuv encoding. This is turned off by default for 32-bit LogLuv and
++ on for 24-bit LogLuv output. Dithering improves the average color
+ accuracy over the image.
+
+ 3) I added a #define for LOG_LUV_PUBLIC, which is enabled by default in
+@@ -4416,20 +4463,20 @@
+ 2001-01-23 Frank Warmerdam <warmerdam@pobox.com>
+
+ * tif_fax3.c: keep rw_mode flag internal to fax3 state to remember
+- whether we are encoding or decoding. This is to ensure graceful
++ whether we are encoding or decoding. This is to ensure graceful
+ recovery if TIFFClientOpen() discovers an attempt to open a compressed
+- file for "r+" access, and subsequently close it, as it resets the
++ file for "r+" access, and subsequently close it, as it resets the
+ tif_mode flag to O_RDONLY in this case to avoid writes, confusing the
+ compressor's concept of whether it is in encode or decode mode.
+
+-2001-01-08 Mike Welles <mike@bangstate.com>
++2001-01-08 Mike Welles <mike@bangstate.com>
+
+ * Makefile.in: Now cleaning up after itself after creating the .tar.gz and .zip
+-
++
+ 2001-01-07 Frank Warmerdam <warmerdam@pobox.com>
+
+ * html/libtiff.html: Fixed arguments in example for TIFFRGBAImageGet()
+- as per bug report by Patrick Connor.
++ as per bug report by Patrick Connor.
+
+ 2000-12-28 Frank Warmerdam <warmerdam@pobox.com>
+
+@@ -4437,12 +4484,12 @@
+
+ * Fixed libtiff/makefile.vc to make tiffvers.h not version.h.
+
+-2000-12-22 Mike Welles <mike@bangstate.com>
++2000-12-22 Mike Welles <mike@bangstate.com>
+ * added link to CVS mirror from index.html
+-
+- * updated html/internals.html to note that LZW compression is
+- not supported by default.
+-
++
++ * updated html/internals.html to note that LZW compression is
++ not supported by default.
++
+ 2000-12-22 Frank Warmerdam <warmerdam@pobox.com>
+
+ * updated html/libtiff.html to not point at Niles' old JPL web site
+@@ -4454,19 +4501,19 @@
+ Leonard Rosenthol <leonardr@lazerware.com>. May interfere
+ with correct building on older systems. If so, please let me know.
+
+-2000-12-19 Mike Welles <mike@bangsate.com>
++2000-12-19 Mike Welles <mike@bangsate.com>
+
+- * Took out LZW Encoding from tif_lzw.c
++ * Took out LZW Encoding from tif_lzw.c
+
+ * Created HOWTO-RELEASE
+
+ * Created html/v3.5.6.html
+
+ * updated index.html
+-
++
+ 2000-12-01 Frank Warmerdam <warmerdam@pobox.com>
+
+- * Added patches for EOFB support in tif_fax3.c and tif_fax3.h.
++ * Added patches for EOFB support in tif_fax3.c and tif_fax3.h.
+ Patches supplied by Frank Cringle <fdc@cliwe.ping.de>
+ Example file at: ftp://ftp.remotesensing.org/pub/libtiff/eofb_396.tif
+
+@@ -4480,30 +4527,30 @@
+ targets so libtiff.so will be built with an explicit dependency
+ on libm.so.
+
+- * libtiff/Makefile.in: Use softlinks to link libtiff.so.3 to
+- libtiff.so.3.5.5.
++ * libtiff/Makefile.in: Use softlinks to link libtiff.so.3 to
++ libtiff.so.3.5.5.
+
+- * libtiff/Makefile.in & configure: Remove all references to the ALPHA
+- file, or ALPHA version logic. Added stuff about DIST_POINT in
++ * libtiff/Makefile.in & configure: Remove all references to the ALPHA
++ file, or ALPHA version logic. Added stuff about DIST_POINT in
+ place of DIST_TYPE and the alpha release number stuff.
+
+ 2000-11-22 Frank Warmerdam <warmerdam@pobox.com>
+
+ * I have applied a patch from Steffen Moeller <moeller@ebi.ac.uk> to
+- the configure script so that it now accepts the --prefix, and
+- --exec-prefix directives.
++ the configure script so that it now accepts the --prefix, and
++ --exec-prefix directives.
+
+ 2000-11-13 Frank Warmerdam <warmerda@cs46980-c>
+
+- * I have made a variety of modifications in an effort to ensure the
++ * I have made a variety of modifications in an effort to ensure the
+ TIFFLIB_VERSION macro is automatically generated from the RELEASE-DATE
+- file which seems to be updated regularly.
++ file which seems to be updated regularly.
+
+- o mkversion.c now reads RELEASE-DATE and emits TIFFLIB_VERSION in
+- version include file.
+- o renamed version.h to tiffvers.h because we now have to install it
+- with the public libtiff include files.
+- o include tiffvers.h in tiffio.h.
++ o mkversion.c now reads RELEASE-DATE and emits TIFFLIB_VERSION in
++ version include file.
++ o renamed version.h to tiffvers.h because we now have to install it
++ with the public libtiff include files.
++ o include tiffvers.h in tiffio.h.
+ o updated tif_version.c to use tiffvers.h.
+ o Updated Makefile.in accordingly.
+
+@@ -4517,13 +4564,13 @@
+ See http://bugzilla.remotesensing.org/show_bug.cgi?id=20
+ Some patches from Rick LaMont of Dot C Software.
+
+- * Modified tif_packbits.c encoder to avoid compressing more
++ * Modified tif_packbits.c encoder to avoid compressing more
+ data than provided if rowsize doesn't factor into provided data
+ (such as occurs for YCbCr).
+
+ 2000-10-19 Frank Warmerdam <warmerda@cs46980-c>
+
+- * tools/rgb2ycbcr.c: fixed output strip size to account for vertical
++ * tools/rgb2ycbcr.c: fixed output strip size to account for vertical
+ roundup if rows_per_strip not a multiple of vertical sample size.
+
+ 2000-10-16 Frank Warmerdam <warmerda@cs46980-c>
+@@ -4539,8 +4586,8 @@
+ 2000-10-12 Frank Warmerdam <warmerda@cs46980-c>
+
+ * Modified tiff2bw to ensure portions add to 100%, and that
+- white is properly recovered.
+-
++ white is properly recovered.
++
+ See bug http://bugzilla.remotesensing.org/show_bug.cgi?id=15
+ Patch c/o Stanislav Brabec <utx@penguin.cz>
+
+@@ -4554,26 +4601,26 @@
+
+ 2000-09-27 Frank Warmerdam <warmerda@cs46980-c>
+
+- * Added GNULDdso target an`d switched linux and freebsd to use it.
++ * Added GNULDdso target an`d switched linux and freebsd to use it.
+
+ 2000-09-26 Frank Warmerdam <warmerda@cs46980-c>
+
+ * Applied patch for 0x0000 sequences in tif_fax3.h's definition
+- of EXPAND1D() as per bug 11 (from Roman).
++ of EXPAND1D() as per bug 11 (from Roman).
+
+ 2000-09-25 Frank Warmerdam <warmerda@cs46980-c>
+ * Fixed tiffcomp.h to avoid win32 stuff if unix #defined, to improve
+ cygwin compatibility.
+
+ * Applied patch from Roman Shpount to tif_fax3.c. This seems to
+- be a proper fix to the buffer sizing problem. See
++ be a proper fix to the buffer sizing problem. See
+ http://bugzilla.remotesensing.org/show_bug.cgi?id=11
+
+ * Fixed tif_getimage.c to fix overrun bug with YCbCr images without
+ downsampling. http://bugzilla.remotesensing.org/show_bug.cgi?id=10
+ Thanks to Nick Lamb <njl98r@ecs.soton.ac.uk> for reporting the
+ bug and proving the patch.
+-
++
+ 2000-09-18 Frank Warmerdam <warmerda@cs46980-c>
+
+ * Fixed tif_jpeg.c so avoid destroying the decompressor before
+@@ -4603,15 +4650,15 @@
+ * Tentatively added support for SAMPLEFORMAT_COMPLEXIEEEFP, and
+ SAMPLEFORMAT_COMPLEXINT.
+
+-2000-07-13 Mike Welles <mike@onshore.com>
++2000-07-13 Mike Welles <mike@onshore.com>
++
++ * index.html, bugs.html: added bugzilla info.
+
+- * index.html, bugs.html: added bugzilla info.
+-
+ 2000-07-12 Frank Warmerdam <warmerda@rommel.atlsci.com>
+
+ * tif_read.c: fix subtle bug with determining the number of
+ rows for strips that are the last strip in a separation but
+- not the last strip of all in TIFFReadEncodedStrip().
++ not the last strip of all in TIFFReadEncodedStrip().
+
+ * Applied 16/32 bit fix to tif_fax3.c. Fix supplied by
+ Peter Skarpetis <peters@serendipity-software.com.au>
+@@ -4633,7 +4680,7 @@
+
+ * libtiff/tif_dirread.c: Don't use estimate strip byte count for
+ one tile/strip images with an offset, and byte count of zero. These
+- could be "unpopulated" images.
++ could be "unpopulated" images.
+
+ 2000-04-18 Frank Warmerdam <warmerda@rommel.atlsci.com>
+
+@@ -4648,17 +4695,17 @@ Tue Apr 18 16:18:08 2000 Frank Warmerdam <warmerda@esabot.atlsci.com>
+ 2000-04-12 Mike Welles <mike@onshore.com>
+ * configure: Fixed stupid mistake in libc6 test on Linux
+
+-2000-04-04 Mike Welles <mike@onshore.com>
++2000-04-04 Mike Welles <mike@onshore.com>
+ * tif_win32.c: Applied patch to fix overreads and ovverwrites
+- caught by BoundsChecker. From Arvan Pritchard
+- <arvan.pritchard@infomatix.co.uk> (untested).
+-
+- * tif_getimage.c: Applied patch to silence VC6 warnings. From
++ caught by BoundsChecker. From Arvan Pritchard
++ <arvan.pritchard@infomatix.co.uk> (untested).
++
++ * tif_getimage.c: Applied patch to silence VC6 warnings. From
+ Arvan Pritchard <arvan.pritchard@informatix.co.uk>
+-
+- * tif_lzw.c: Applied patch to silence VC6 warnings. From
++
++ * tif_lzw.c: Applied patch to silence VC6 warnings. From
+ Arvan Pritchard <arvan.pritchard@informatix.co.uk>
+-
++
+ 2000-03-28 Frank Warmerdam <warmerda@cs46980-c>
+
+ * Added contrib/stream (stream io) code submitted by Avi Bleiweiss.
+@@ -4668,34 +4715,34 @@ Tue Apr 18 16:18:08 2000 Frank Warmerdam <warmerda@esabot.atlsci.com>
+ * fax2ps: Fixed mixup of width and height in bounding box statement
+ as per submission by Nalin Dahyabhai <nalin@redhat.com>.
+
+-2000-03-27 Mike Welles <mike@onshore.com>
++2000-03-27 Mike Welles <mike@onshore.com>
+
+- * fax2ps: Modified printruns to take uint32 instead of uint16.
+- Patch courtesy of Bernt Herd <herd@herdsoft.com>
+-
+-2000-03-20 Mike Welles <mike@onshore.com>
++ * fax2ps: Modified printruns to take uint32 instead of uint16.
++ Patch courtesy of Bernt Herd <herd@herdsoft.com>
+
+- * configure: added test for libc6 for linux targets. Bug reported by
++2000-03-20 Mike Welles <mike@onshore.com>
++
++ * configure: added test for libc6 for linux targets. Bug reported by
+ Stanislav Brabec <utx@k332.feld.cvut.cz>
+
+- * Added 3.5 docs to html/Makefile.in.
++ * Added 3.5 docs to html/Makefile.in.
+ Thanks to Stanislav Brabec <utx@k332.feld.cvut.cz>
+
+- * configure: fixed bugs in sed scripts
+- (applied sed script s:/@:s;@:;s:/s;;:;: to configure).
++ * configure: fixed bugs in sed scripts
++ (applied sed script s:/@:s;@:;s:/s;;:;: to configure).
+ fix submitted to Stanislav Brabec <utx@k332.feld.cvut.cz>
+
+- * tools/iptcutil was not in files list, and wasn't being
++ * tools/iptcutil was not in files list, and wasn't being
+ added to tar archive. Updated Makefile.in.
+
+ 2000-03-17 Frank Warmerdam <warmerda@cs46980-c>
+
+ * tif_fax3.c: Fixed serious bug introduced during the uint16->uint32
+- conversion for the run arrays.
++ conversion for the run arrays.
+
+ 2000-03-03 Frank Warmerdam <warmerda@cs46980-c.mtnk1.on.wave.home.com>
+
+- * Set td_sampleformat default to SAMPLEFORMAT_UINT instead of
++ * Set td_sampleformat default to SAMPLEFORMAT_UINT instead of
+ SAMPLEFORMAT_VOID in TIFFDefaultDirectory() in tif_dir.c.
+
+ 2000-03-02 Frank Warmerdam <warmerda@cs46980-c.mtnk1.on.wave.home.com>
+@@ -4716,20 +4763,20 @@ Tue Feb 15 22:01:05 2000 Frank Warmerdam <warmerda@gdal.velocet.ca>
+ set to 1, and added default (off) setting in tiffconf.h. This
+ should eventually be set by the configure script somehow.
+
+- The original work on all these 2-4GB changes was done by
++ The original work on all these 2-4GB changes was done by
+ Peter Smith (psmith@creo.com).
+
+ * Modified tif_win32.c to support 2-4GB seeks.
+
+ * tentatively changed toff_t to be unsigned instead of signed to
+- facilitate support for 2-4GB files.
++ facilitate support for 2-4GB files.
+
+ * Updated a variety of files to use toff_t. Fixed some mixups
+ between toff_t and tsize_t.
+
+ Fri Jan 28 10:13:49 2000 Frank Warmerdam <warmerda@gdal.velocet.ca>
+
+- * Largely reimplemented contrib/addtiffo to avoid temp files,
++ * Largely reimplemented contrib/addtiffo to avoid temp files,
+ updating the TIFF file in place. Fixed a few other bugs to.
+
+ * Set tif_rawdatasize to zero when freeing raw data buffer in
+@@ -4738,7 +4785,7 @@ Fri Jan 28 10:13:49 2000 Frank Warmerdam <warmerda@gdal.velocet.ca>
+ * Enabled "REWRITE_HACK" in tif_write.c by default.
+
+ * Fix bug in tif_write.c when switching between reading one directory
+- and writing to another.
++ and writing to another.
+
+ * Made TIFFWriteCheck() public, and added TIFFCreateDirectory()
+
+@@ -4750,41 +4797,41 @@ Tue Jan 4 13:39:00 2000 Frank Warmerdam <warmerda@gdal.velocet.ca>
+
+ * Added libtiff/libtiff.def to TIFFILES distribution list.
+
+-Mon Dec 27 12:13:39 EST 1999 Mike Welles <mike@onshore.com>
++Mon Dec 27 12:13:39 EST 1999 Mike Welles <mike@onshore.com>
+
+- * Created lzw compression kit, as a new module (libtiff-lzw-compression-kit).
++ * Created lzw compression kit, as a new module (libtiff-lzw-compression-kit).
+
+ * Altered descriptions in tools to reflect "by default" lzw not supported
+
+- * Updated index.html to note lzw compression kit.
+-
++ * Updated index.html to note lzw compression kit.
++
+ Tue Dec 21 14:01:51 1999 Frank Warmerdam <warmerda@gdal.velocet.ca>
+
+- * Added fax3sm_winnt.c to distribution list in Makefile.in.
++ * Added fax3sm_winnt.c to distribution list in Makefile.in.
+
+ Tue Dec 21 11:04:45 EST 1999 Mike Welles <mike@onshore.com> *** 3.5.4 release ***
+-
+- * Aadded Pixar tag support. Contributed by Phil Beffery <phil@pixar.com>
+
+- * Made one more change to tif_dir.c for removal of LZW compression. Also added notice
+- when LZW compression invoked.
++ * Aadded Pixar tag support. Contributed by Phil Beffery <phil@pixar.com>
++
++ * Made one more change to tif_dir.c for removal of LZW compression. Also added notice
++ when LZW compression invoked.
+
+ * Changed default compression in tools to TIFF_PACKBITS, and changed usage descriptions
+ in tools to reflect removal of LZW compression
+-
++
+ Mon Dec 20 18:39:02 EST 1999 Mike Welles <mike@onshore.com>
+
+- * Fixed bug that caused LZW (non) compression to segfault. Added
+- warning about LZW compression removed being removed, and why.
++ * Fixed bug that caused LZW (non) compression to segfault. Added
++ warning about LZW compression removed being removed, and why.
++
++ * Added nostrip to install in tools/Makefile.in so that debugging
++ symbols are kept.
+
+- * Added nostrip to install in tools/Makefile.in so that debugging
+- symbols are kept.
+-
+ Tue Dec 7 12:04:47 EST 1999 Mike Welles <mike@onshore.com>
+
+- * Added patch from Ivo Penzar <ivo.penzar@infolink-software.com>,
+- supporting Adobe ZIP deflate. Untested.
+-
++ * Added patch from Ivo Penzar <ivo.penzar@infolink-software.com>,
++ supporting Adobe ZIP deflate. Untested.
++
+ Sat Dec 4 15:47:11 1999 Frank Warmerdam <warmerda@gdal.velocet.ca>
+
+ * Made Packbits the default compression in tools/tiff2rgba.c instead
+@@ -4794,12 +4841,12 @@ Tue Nov 30 14:41:43 1999 Frank Warmerdam <warmerda@gdal.velocet.ca> *** 3.5
+
+ * Added tif_luv to contrib/djgpp/Makefile.lib.
+
+-Tue Nov 30 14:15:32 EST 1999 Mike Welles <mike@onshore.com>
++Tue Nov 30 14:15:32 EST 1999 Mike Welles <mike@onshore.com>
++
++ * Added zip creation to relase makefile target
+
+- * Added zip creation to relase makefile target
++ * Added html for TIFFWriteTile.3t man page.
+
+- * Added html for TIFFWriteTile.3t man page.
+-
+ Tue Nov 30 09:20:16 1999 Frank Warmerdam <warmerda@gdal.velocet.ca>
+
+ * Added some changes to tif_write.c to support rewriting existing
+@@ -4812,26 +4859,26 @@ Mon Nov 29 11:43:42 1999 Frank Warmerdam <warmerda@gdal.velocet.ca>
+
+ Sun Nov 28 20:36:18 1999 Frank Warmerdam <warmerda@gdal.velocet.ca>
+
+- * Added notes on use of makefile.vc in build.html, and fixed
++ * Added notes on use of makefile.vc in build.html, and fixed
+ email subscription address.
+
+-199-11-28 Mike Welles <mike@onshore.com>
++1999-11-28 Mike Welles <mike@onshore.com>
+
+- * Fixed apocalypse-inducing y2k bug in contrib/ras/ras2tiff.c
++ * Fixed apocalypse-inducing y2k bug in contrib/ras/ras2tiff.c
+
+ * Did some casts cleaning up to reduce compiler warnings in tif_fax3.c,
+- from Bruce Carmeron <cameron@petris.com> -- modifications of
+- changes made by Frank (sun cc still complained on cast).
++ from Bruce Carmeron <cameron@petris.com> -- modifications of
++ changes made by Frank (sun cc still complained on cast).
+
+ * Added tiffconf.h to install target per request from Bill
+ Radcliffe <billr@corbis.com>: "We need a way for ImageMagick to
+ know features have been compiled into the TIFF library in order to
+- handle things properly".
+-
++ handle things properly".
++
+ Sat Nov 27 16:49:21 1999 Frank Warmerdam <warmerda@gdal.velocet.ca>
+
+ * fixed various VC++ warnings as suggested by Gilles Vollant
+- <info@winimage.com>.
++ <info@winimage.com>.
+
+ Wed Nov 24 12:08:16 1999 Frank Warmerdam <warmerda@gdal.velocet.ca>
+
+@@ -4840,59 +4887,59 @@ Wed Nov 24 12:08:16 1999 Frank Warmerdam <warmerda@gdal.velocet.ca>
+
+ 1999-11-22 Mike Welles <mike@onshore.com>
+ * HTML-ized the man pages, added to html/man
+-
+- * Removed LZW Compression to comply with Unisys patent extortion.
+-
+-1999-09-29 Mike Welles <mike@onshore.com>
+- * Corrected one remaining 16 -> 32 bit value in tif_fax3.c,
+- From Ivo Penzar <ivo.penzar@infolink-software.com.
++
++ * Removed LZW Compression to comply with Unisys patent extortion.
++
++1999-09-29 Mike Welles <mike@onshore.com>
++ * Corrected one remaining 16 -> 32 bit value in tif_fax3.c,
++ From Ivo Penzar <ivo.penzar@infolink-software.com.
+
+ * Added patch from Ivo Penzar to have TiffAdvanceDirectory handle
+ memory mapped files. <ivo.penzar@infolink-software.com>
+-
++
+ 1999-09-26 Mike Welles <mike@onshore.com> *** 3.5.2 release ***
+- * Corrected alpha versioning.
++ * Corrected alpha versioning.
+
+- * Removed distinction between alpha and release targets in Makefile.in.
++ * Removed distinction between alpha and release targets in Makefile.in.
+
+- * added release.stamp target, which tags cvs tree, and updates
++ * added release.stamp target, which tags cvs tree, and updates
+ "RELEASE-DATE"
+
+- * added releasediff target, which diffs tree with source as of
++ * added releasediff target, which diffs tree with source as of
+ date in "RELEASE-DATE"
+-
+- * Ticked up version to 3.5.2 (alpha 01 -- but I think we'll moving
+- away from alpha/non-alpha distinctions).
+
+- * updated html to reflect release
+-
++ * Ticked up version to 3.5.2 (alpha 01 -- but I think we'll moving
++ away from alpha/non-alpha distinctions).
++
++ * updated html to reflect release
++
+ 1999-09-23 <warmerda@CS46980-B>
+
+ * Set O_BINARY for tif_unix.c open() ... used on cygwin for instance.
+
+ * Added CYGWIN case in configure.
+
+-Fri Sep 17 00:13:51 CEST 1999 Mike Welles <mike@onshore.com>
++Fri Sep 17 00:13:51 CEST 1999 Mike Welles <mike@onshore.com>
++
++ * Applied Francois Dagand's patch to handle fax decompression bug.
++ (sizes >= 65536 were failing)
+
+- * Applied Francois Dagand's patch to handle fax decompression bug.
+- (sizes >= 65536 were failing)
+-
+ Tue Sep 14 21:31:43 1999 Frank Warmerdam <warmerda@gdal.velocet.ca>
+
+- * Applied "a" mode fix to tif_win32.c/TIFFOpen() as suggested
++ * Applied "a" mode fix to tif_win32.c/TIFFOpen() as suggested
+ by Christopher Lawton <clawton@mathworks.com>
+
+ Wed Sep 8 08:19:18 1999 Frank Warmerdam <warmerda@gdal.velocet.ca>
+
+- * Added IRIX/gcc, and OSF/1 4.x support on behalf of
++ * Added IRIX/gcc, and OSF/1 4.x support on behalf of
+ Albert Chin-A-Young <china@thewrittenword.com>
+
+- * Added TIFFReassignTagToIgnore() API on behalf of
++ * Added TIFFReassignTagToIgnore() API on behalf of
+ Bruce Cameron <cameron@petris.com>. Man page still pending.
+
+ Wed Aug 25 11:39:07 1999 Frank Warmerdam <warmerda@gdal.velocet.ca>
+
+- * Added test target in Makefile, test_pics.sh script and pics/*.rpt
++ * Added test target in Makefile, test_pics.sh script and pics/*.rpt
+ files to provide for a rudimentary testsuite.
+
+ * Added contrib/tags back from old distribution ... fixed up a bit.
+@@ -4900,7 +4947,7 @@ Wed Aug 25 11:39:07 1999 Frank Warmerdam <warmerda@gdal.velocet.ca>
+ 1999-08-16 <warmerda@CS46980-B>
+
+ * Added simple makefile.vc makefiles for building with MS VC++
+- on Windows NT/98/95 in console mode. Stuff in contrib/win* make give
++ on Windows NT/98/95 in console mode. Stuff in contrib/win* make give
+ better solutions for some users.
+
+ Mon Aug 16 21:52:11 1999 Frank Warmerdam <warmerda@gdal.velocet.ca>
+@@ -4910,20 +4957,20 @@ Mon Aug 16 21:52:11 1999 Frank Warmerdam <warmerda@gdal.velocet.ca>
+
+ 1999-08-16 Michael L. Welles <mike@kurtz.fake>
+
+- * Updated html/index.html with anon CVS instructions.
++ * Updated html/index.html with anon CVS instructions.
+
+ Mon Aug 16 13:18:41 1999 Frank Warmerdam <warmerda@gdal.velocet.ca>
+
+- * pre-remove so link before softlink in LINUXdso action in
++ * pre-remove so link before softlink in LINUXdso action in
+ libtiff/Makefile.in to avoid failure on LINUXdso builds other than
+ the first.
+
+ * Fixed problem with cvtcmap() in tif_getimage.c modifying the
+ colormaps owned by the TIFF handle itself when trying to fixup wrong
+ (eight bit) colormaps. Corrected by maintaining a private copy of
+- the colormap.
++ the colormap.
+
+- * Added TIFFReadRGBATile()/TIFFReadRGBAStrip() support in
++ * Added TIFFReadRGBATile()/TIFFReadRGBAStrip() support in
+ tif_getimage.c.
+
+ * CVS Repository placed at remotesensing.org. ChangeLog added.
+diff --git a/Makefile.in b/Makefile.in
+index 72fbbf3..2ed5682 100644
+--- a/Makefile.in
++++ b/Makefile.in
+@@ -1,4 +1,4 @@
+-# Makefile.in generated by automake 1.12.4 from Makefile.am.
++# Makefile.in generated by automake 1.12.5 from Makefile.am.
+ # @configure_input@
+
+ # Copyright (C) 1994-2012 Free Software Foundation, Inc.
+diff --git a/aclocal.m4 b/aclocal.m4
+index d7d14c8..9293eda 100644
+--- a/aclocal.m4
++++ b/aclocal.m4
+@@ -1,4 +1,4 @@
+-# generated automatically by aclocal 1.12.4 -*- Autoconf -*-
++# generated automatically by aclocal 1.12.5 -*- Autoconf -*-
+
+ # Copyright (C) 1996-2012 Free Software Foundation, Inc.
+
+@@ -34,7 +34,7 @@ AC_DEFUN([AM_AUTOMAKE_VERSION],
+ [am__api_version='1.12'
+ dnl Some users find AM_AUTOMAKE_VERSION and mistake it for a way to
+ dnl require some minimum version. Point them to the right macro.
+-m4_if([$1], [1.12.4], [],
++m4_if([$1], [1.12.5], [],
+ [AC_FATAL([Do not call $0, use AM_INIT_AUTOMAKE([$1]).])])dnl
+ ])
+
+@@ -50,7 +50,7 @@ m4_define([_AM_AUTOCONF_VERSION], [])
+ # Call AM_AUTOMAKE_VERSION and AM_AUTOMAKE_VERSION so they can be traced.
+ # This function is AC_REQUIREd by AM_INIT_AUTOMAKE.
+ AC_DEFUN([AM_SET_CURRENT_AUTOMAKE_VERSION],
+-[AM_AUTOMAKE_VERSION([1.12.4])dnl
++[AM_AUTOMAKE_VERSION([1.12.5])dnl
+ m4_ifndef([AC_AUTOCONF_VERSION],
+ [m4_copy([m4_PACKAGE_VERSION], [AC_AUTOCONF_VERSION])])dnl
+ _AM_AUTOCONF_VERSION(m4_defn([AC_AUTOCONF_VERSION]))])
+diff --git a/build/Makefile.in b/build/Makefile.in
+index 1a316b1..cea7a08 100644
+--- a/build/Makefile.in
++++ b/build/Makefile.in
+@@ -1,4 +1,4 @@
+-# Makefile.in generated by automake 1.12.4 from Makefile.am.
++# Makefile.in generated by automake 1.12.5 from Makefile.am.
+ # @configure_input@
+
+ # Copyright (C) 1994-2012 Free Software Foundation, Inc.
+diff --git a/contrib/Makefile.in b/contrib/Makefile.in
+index ae67554..72be7a3 100644
+--- a/contrib/Makefile.in
++++ b/contrib/Makefile.in
+@@ -1,4 +1,4 @@
+-# Makefile.in generated by automake 1.12.4 from Makefile.am.
++# Makefile.in generated by automake 1.12.5 from Makefile.am.
+ # @configure_input@
+
+ # Copyright (C) 1994-2012 Free Software Foundation, Inc.
+diff --git a/contrib/acorn/Makefile.in b/contrib/acorn/Makefile.in
+index 1e966b4..5a73941 100644
+--- a/contrib/acorn/Makefile.in
++++ b/contrib/acorn/Makefile.in
+@@ -1,4 +1,4 @@
+-# Makefile.in generated by automake 1.12.4 from Makefile.am.
++# Makefile.in generated by automake 1.12.5 from Makefile.am.
+ # @configure_input@
+
+ # Copyright (C) 1994-2012 Free Software Foundation, Inc.
+diff --git a/contrib/addtiffo/Makefile.in b/contrib/addtiffo/Makefile.in
+index 25a6e8b..e07640c 100644
+--- a/contrib/addtiffo/Makefile.in
++++ b/contrib/addtiffo/Makefile.in
+@@ -1,4 +1,4 @@
+-# Makefile.in generated by automake 1.12.4 from Makefile.am.
++# Makefile.in generated by automake 1.12.5 from Makefile.am.
+ # @configure_input@
+
+ # Copyright (C) 1994-2012 Free Software Foundation, Inc.
+diff --git a/contrib/dbs/Makefile.in b/contrib/dbs/Makefile.in
+index f5b3ee5..d5e7b40 100644
+--- a/contrib/dbs/Makefile.in
++++ b/contrib/dbs/Makefile.in
+@@ -1,4 +1,4 @@
+-# Makefile.in generated by automake 1.12.4 from Makefile.am.
++# Makefile.in generated by automake 1.12.5 from Makefile.am.
+ # @configure_input@
+
+ # Copyright (C) 1994-2012 Free Software Foundation, Inc.
+diff --git a/contrib/dbs/xtiff/Makefile.in b/contrib/dbs/xtiff/Makefile.in
+index 2d1ce94..c655c54 100644
+--- a/contrib/dbs/xtiff/Makefile.in
++++ b/contrib/dbs/xtiff/Makefile.in
+@@ -1,4 +1,4 @@
+-# Makefile.in generated by automake 1.12.4 from Makefile.am.
++# Makefile.in generated by automake 1.12.5 from Makefile.am.
+ # @configure_input@
+
+ # Copyright (C) 1994-2012 Free Software Foundation, Inc.
+diff --git a/contrib/dbs/xtiff/xtiff.c b/contrib/dbs/xtiff/xtiff.c
+index 7fe3977..de0b2a7 100644
+--- a/contrib/dbs/xtiff/xtiff.c
++++ b/contrib/dbs/xtiff/xtiff.c
+@@ -1,5 +1,5 @@
+ /*
+- * $Id: xtiff.c,v 1.2.2.1 2010-06-08 18:50:40 bfriesen Exp $
++ * $Id: xtiff.c,v 1.2.2.2 2013-05-02 14:44:43 tgl Exp $
+ *
+ * xtiff - view a TIFF file in an X window
+ *
+@@ -512,9 +512,9 @@ SetNameLabel()
+ Arg args[1];
+
+ if (tfMultiPage)
+- sprintf(buffer, "%s - page %d", fileName, tfDirectory);
++ snprintf(buffer, sizeof(buffer), "%s - page %d", fileName, tfDirectory);
+ else
+- strcpy(buffer, fileName);
++ snprintf(buffer, sizeof(buffer), "%s", fileName);
+ XtSetArg(args[0], XtNlabel, buffer);
+ XtSetValues(labelWidget, args, 1);
+ }
+diff --git a/contrib/iptcutil/Makefile.in b/contrib/iptcutil/Makefile.in
+index 75b1ca3..5858c03 100644
+--- a/contrib/iptcutil/Makefile.in
++++ b/contrib/iptcutil/Makefile.in
+@@ -1,4 +1,4 @@
+-# Makefile.in generated by automake 1.12.4 from Makefile.am.
++# Makefile.in generated by automake 1.12.5 from Makefile.am.
+ # @configure_input@
+
+ # Copyright (C) 1994-2012 Free Software Foundation, Inc.
+diff --git a/contrib/mac-cw/Makefile.in b/contrib/mac-cw/Makefile.in
+index a94a33a..054d44e 100644
+--- a/contrib/mac-cw/Makefile.in
++++ b/contrib/mac-cw/Makefile.in
+@@ -1,4 +1,4 @@
+-# Makefile.in generated by automake 1.12.4 from Makefile.am.
++# Makefile.in generated by automake 1.12.5 from Makefile.am.
+ # @configure_input@
+
+ # Copyright (C) 1994-2012 Free Software Foundation, Inc.
+diff --git a/contrib/mac-mpw/Makefile.in b/contrib/mac-mpw/Makefile.in
+index 8fdaae1..7dd27d7 100644
+--- a/contrib/mac-mpw/Makefile.in
++++ b/contrib/mac-mpw/Makefile.in
+@@ -1,4 +1,4 @@
+-# Makefile.in generated by automake 1.12.4 from Makefile.am.
++# Makefile.in generated by automake 1.12.5 from Makefile.am.
+ # @configure_input@
+
+ # Copyright (C) 1994-2012 Free Software Foundation, Inc.
+diff --git a/contrib/mfs/Makefile.in b/contrib/mfs/Makefile.in
+index 230c925..4ee41af 100644
+--- a/contrib/mfs/Makefile.in
++++ b/contrib/mfs/Makefile.in
+@@ -1,4 +1,4 @@
+-# Makefile.in generated by automake 1.12.4 from Makefile.am.
++# Makefile.in generated by automake 1.12.5 from Makefile.am.
+ # @configure_input@
+
+ # Copyright (C) 1994-2012 Free Software Foundation, Inc.
+diff --git a/contrib/pds/Makefile.in b/contrib/pds/Makefile.in
+index 3511f62..fa0bcf7 100644
+--- a/contrib/pds/Makefile.in
++++ b/contrib/pds/Makefile.in
+@@ -1,4 +1,4 @@
+-# Makefile.in generated by automake 1.12.4 from Makefile.am.
++# Makefile.in generated by automake 1.12.5 from Makefile.am.
+ # @configure_input@
+
+ # Copyright (C) 1994-2012 Free Software Foundation, Inc.
+diff --git a/contrib/ras/Makefile.in b/contrib/ras/Makefile.in
+index 88907bf..e33a00f 100644
+--- a/contrib/ras/Makefile.in
++++ b/contrib/ras/Makefile.in
+@@ -1,4 +1,4 @@
+-# Makefile.in generated by automake 1.12.4 from Makefile.am.
++# Makefile.in generated by automake 1.12.5 from Makefile.am.
+ # @configure_input@
+
+ # Copyright (C) 1994-2012 Free Software Foundation, Inc.
+diff --git a/contrib/stream/Makefile.in b/contrib/stream/Makefile.in
+index 9c9dffb..1c36a7f 100644
+--- a/contrib/stream/Makefile.in
++++ b/contrib/stream/Makefile.in
+@@ -1,4 +1,4 @@
+-# Makefile.in generated by automake 1.12.4 from Makefile.am.
++# Makefile.in generated by automake 1.12.5 from Makefile.am.
+ # @configure_input@
+
+ # Copyright (C) 1994-2012 Free Software Foundation, Inc.
+diff --git a/contrib/tags/Makefile.in b/contrib/tags/Makefile.in
+index e378f32..891d565 100644
+--- a/contrib/tags/Makefile.in
++++ b/contrib/tags/Makefile.in
+@@ -1,4 +1,4 @@
+-# Makefile.in generated by automake 1.12.4 from Makefile.am.
++# Makefile.in generated by automake 1.12.5 from Makefile.am.
+ # @configure_input@
+
+ # Copyright (C) 1994-2012 Free Software Foundation, Inc.
+diff --git a/contrib/win_dib/Makefile.in b/contrib/win_dib/Makefile.in
+index 0f68e76..45bf928 100644
+--- a/contrib/win_dib/Makefile.in
++++ b/contrib/win_dib/Makefile.in
+@@ -1,4 +1,4 @@
+-# Makefile.in generated by automake 1.12.4 from Makefile.am.
++# Makefile.in generated by automake 1.12.5 from Makefile.am.
+ # @configure_input@
+
+ # Copyright (C) 1994-2012 Free Software Foundation, Inc.
+diff --git a/html/Makefile.in b/html/Makefile.in
+index b9f86c8..a85ebd6 100644
+--- a/html/Makefile.in
++++ b/html/Makefile.in
+@@ -1,4 +1,4 @@
+-# Makefile.in generated by automake 1.12.4 from Makefile.am.
++# Makefile.in generated by automake 1.12.5 from Makefile.am.
+ # @configure_input@
+
+ # Copyright (C) 1994-2012 Free Software Foundation, Inc.
+diff --git a/html/images/Makefile.in b/html/images/Makefile.in
+index 1b96240..eaf50a3 100644
+--- a/html/images/Makefile.in
++++ b/html/images/Makefile.in
+@@ -1,4 +1,4 @@
+-# Makefile.in generated by automake 1.12.4 from Makefile.am.
++# Makefile.in generated by automake 1.12.5 from Makefile.am.
+ # @configure_input@
+
+ # Copyright (C) 1994-2012 Free Software Foundation, Inc.
+diff --git a/html/man/Makefile.in b/html/man/Makefile.in
+index 3a5278e..98226c3 100644
+--- a/html/man/Makefile.in
++++ b/html/man/Makefile.in
+@@ -1,4 +1,4 @@
+-# Makefile.in generated by automake 1.12.4 from Makefile.am.
++# Makefile.in generated by automake 1.12.5 from Makefile.am.
+ # @configure_input@
+
+ # Copyright (C) 1994-2012 Free Software Foundation, Inc.
+diff --git a/libtiff/Makefile.in b/libtiff/Makefile.in
+index 6a7c415..69e59c7 100644
+--- a/libtiff/Makefile.in
++++ b/libtiff/Makefile.in
+@@ -1,4 +1,4 @@
+-# Makefile.in generated by automake 1.12.4 from Makefile.am.
++# Makefile.in generated by automake 1.12.5 from Makefile.am.
+ # @configure_input@
+
+ # Copyright (C) 1994-2012 Free Software Foundation, Inc.
+diff --git a/libtiff/tif_codec.c b/libtiff/tif_codec.c
+index d5c6fd1..5a38184 100644
+--- a/libtiff/tif_codec.c
++++ b/libtiff/tif_codec.c
+@@ -1,4 +1,4 @@
+-/* $Id: tif_codec.c,v 1.10.2.2 2010-06-08 18:50:41 bfriesen Exp $ */
++/* $Id: tif_codec.c,v 1.10.2.3 2013-05-02 14:44:43 tgl Exp $ */
+
+ /*
+ * Copyright (c) 1988-1997 Sam Leffler
+@@ -104,7 +104,8 @@ _notConfigured(TIFF* tif)
+ const TIFFCodec* c = TIFFFindCODEC(tif->tif_dir.td_compression);
+ char compression_code[20];
+
+- sprintf( compression_code, "%d", tif->tif_dir.td_compression );
++ snprintf(compression_code, sizeof(compression_code), "%d",
++ tif->tif_dir.td_compression );
+ TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
+ "%s compression support is not configured",
+ c ? c->name : compression_code );
+diff --git a/libtiff/tif_dirinfo.c b/libtiff/tif_dirinfo.c
+index 76ef572..417a2e3 100644
+--- a/libtiff/tif_dirinfo.c
++++ b/libtiff/tif_dirinfo.c
+@@ -1,4 +1,4 @@
+-/* $Id: tif_dirinfo.c,v 1.65.2.10 2010-07-06 14:14:41 dron Exp $ */
++/* $Id: tif_dirinfo.c,v 1.65.2.11 2013-05-02 14:44:43 tgl Exp $ */
+
+ /*
+ * Copyright (c) 1988-1997 Sam Leffler
+@@ -869,7 +869,7 @@ _TIFFCreateAnonFieldInfo(TIFF *tif, ttag_t tag, TIFFDataType field_type)
+ * note that this name is a special sign to TIFFClose() and
+ * _TIFFSetupFieldInfo() to free the field
+ */
+- sprintf(fld->field_name, "Tag %d", (int) tag);
++ snprintf(fld->field_name, 32, "Tag %d", (int) tag);
+
+ return fld;
+ }
+diff --git a/libtiff/tif_pixarlog.c b/libtiff/tif_pixarlog.c
+index ed8eb40..6e127fb 100644
+--- a/libtiff/tif_pixarlog.c
++++ b/libtiff/tif_pixarlog.c
+@@ -1,4 +1,4 @@
+-/* $Id: tif_pixarlog.c,v 1.15.2.4 2010-06-08 18:50:42 bfriesen Exp $ */
++/* $Id: tif_pixarlog.c,v 1.15.2.5 2012-12-10 17:38:54 tgl Exp $ */
+
+ /*
+ * Copyright (c) 1996-1997 Sam Leffler
+@@ -117,9 +117,9 @@ horizontalAccumulateF(uint16 *wp, int n, int stride, float *op,
+ if (n >= stride) {
+ mask = CODE_MASK;
+ if (stride == 3) {
+- t0 = ToLinearF[cr = wp[0]];
+- t1 = ToLinearF[cg = wp[1]];
+- t2 = ToLinearF[cb = wp[2]];
++ t0 = ToLinearF[cr = (wp[0] & mask)];
++ t1 = ToLinearF[cg = (wp[1] & mask)];
++ t2 = ToLinearF[cb = (wp[2] & mask)];
+ op[0] = t0;
+ op[1] = t1;
+ op[2] = t2;
+@@ -136,10 +136,10 @@ horizontalAccumulateF(uint16 *wp, int n, int stride, float *op,
+ op[2] = t2;
+ }
+ } else if (stride == 4) {
+- t0 = ToLinearF[cr = wp[0]];
+- t1 = ToLinearF[cg = wp[1]];
+- t2 = ToLinearF[cb = wp[2]];
+- t3 = ToLinearF[ca = wp[3]];
++ t0 = ToLinearF[cr = (wp[0] & mask)];
++ t1 = ToLinearF[cg = (wp[1] & mask)];
++ t2 = ToLinearF[cb = (wp[2] & mask)];
++ t3 = ToLinearF[ca = (wp[3] & mask)];
+ op[0] = t0;
+ op[1] = t1;
+ op[2] = t2;
+@@ -183,9 +183,9 @@ horizontalAccumulate12(uint16 *wp, int n, int stride, int16 *op,
+ if (n >= stride) {
+ mask = CODE_MASK;
+ if (stride == 3) {
+- t0 = ToLinearF[cr = wp[0]] * SCALE12;
+- t1 = ToLinearF[cg = wp[1]] * SCALE12;
+- t2 = ToLinearF[cb = wp[2]] * SCALE12;
++ t0 = ToLinearF[cr = (wp[0] & mask)] * SCALE12;
++ t1 = ToLinearF[cg = (wp[1] & mask)] * SCALE12;
++ t2 = ToLinearF[cb = (wp[2] & mask)] * SCALE12;
+ op[0] = CLAMP12(t0);
+ op[1] = CLAMP12(t1);
+ op[2] = CLAMP12(t2);
+@@ -202,10 +202,10 @@ horizontalAccumulate12(uint16 *wp, int n, int stride, int16 *op,
+ op[2] = CLAMP12(t2);
+ }
+ } else if (stride == 4) {
+- t0 = ToLinearF[cr = wp[0]] * SCALE12;
+- t1 = ToLinearF[cg = wp[1]] * SCALE12;
+- t2 = ToLinearF[cb = wp[2]] * SCALE12;
+- t3 = ToLinearF[ca = wp[3]] * SCALE12;
++ t0 = ToLinearF[cr = (wp[0] & mask)] * SCALE12;
++ t1 = ToLinearF[cg = (wp[1] & mask)] * SCALE12;
++ t2 = ToLinearF[cb = (wp[2] & mask)] * SCALE12;
++ t3 = ToLinearF[ca = (wp[3] & mask)] * SCALE12;
+ op[0] = CLAMP12(t0);
+ op[1] = CLAMP12(t1);
+ op[2] = CLAMP12(t2);
+@@ -247,9 +247,9 @@ horizontalAccumulate16(uint16 *wp, int n, int stride, uint16 *op,
+ if (n >= stride) {
+ mask = CODE_MASK;
+ if (stride == 3) {
+- op[0] = ToLinear16[cr = wp[0]];
+- op[1] = ToLinear16[cg = wp[1]];
+- op[2] = ToLinear16[cb = wp[2]];
++ op[0] = ToLinear16[cr = (wp[0] & mask)];
++ op[1] = ToLinear16[cg = (wp[1] & mask)];
++ op[2] = ToLinear16[cb = (wp[2] & mask)];
+ n -= 3;
+ while (n > 0) {
+ wp += 3;
+@@ -260,10 +260,10 @@ horizontalAccumulate16(uint16 *wp, int n, int stride, uint16 *op,
+ op[2] = ToLinear16[(cb += wp[2]) & mask];
+ }
+ } else if (stride == 4) {
+- op[0] = ToLinear16[cr = wp[0]];
+- op[1] = ToLinear16[cg = wp[1]];
+- op[2] = ToLinear16[cb = wp[2]];
+- op[3] = ToLinear16[ca = wp[3]];
++ op[0] = ToLinear16[cr = (wp[0] & mask)];
++ op[1] = ToLinear16[cg = (wp[1] & mask)];
++ op[2] = ToLinear16[cb = (wp[2] & mask)];
++ op[3] = ToLinear16[ca = (wp[3] & mask)];
+ n -= 4;
+ while (n > 0) {
+ wp += 4;
+@@ -342,9 +342,9 @@ horizontalAccumulate8(uint16 *wp, int n, int stride, unsigned char *op,
+ if (n >= stride) {
+ mask = CODE_MASK;
+ if (stride == 3) {
+- op[0] = ToLinear8[cr = wp[0]];
+- op[1] = ToLinear8[cg = wp[1]];
+- op[2] = ToLinear8[cb = wp[2]];
++ op[0] = ToLinear8[cr = (wp[0] & mask)];
++ op[1] = ToLinear8[cg = (wp[1] & mask)];
++ op[2] = ToLinear8[cb = (wp[2] & mask)];
+ n -= 3;
+ while (n > 0) {
+ n -= 3;
+@@ -355,10 +355,10 @@ horizontalAccumulate8(uint16 *wp, int n, int stride, unsigned char *op,
+ op[2] = ToLinear8[(cb += wp[2]) & mask];
+ }
+ } else if (stride == 4) {
+- op[0] = ToLinear8[cr = wp[0]];
+- op[1] = ToLinear8[cg = wp[1]];
+- op[2] = ToLinear8[cb = wp[2]];
+- op[3] = ToLinear8[ca = wp[3]];
++ op[0] = ToLinear8[cr = (wp[0] & mask)];
++ op[1] = ToLinear8[cg = (wp[1] & mask)];
++ op[2] = ToLinear8[cb = (wp[2] & mask)];
++ op[3] = ToLinear8[ca = (wp[3] & mask)];
+ n -= 4;
+ while (n > 0) {
+ n -= 4;
+@@ -393,9 +393,9 @@ horizontalAccumulate8abgr(uint16 *wp, int n, int stride, unsigned char *op,
+ mask = CODE_MASK;
+ if (stride == 3) {
+ op[0] = 0;
+- t1 = ToLinear8[cb = wp[2]];
+- t2 = ToLinear8[cg = wp[1]];
+- t3 = ToLinear8[cr = wp[0]];
++ t1 = ToLinear8[cb = (wp[2] & mask)];
++ t2 = ToLinear8[cg = (wp[1] & mask)];
++ t3 = ToLinear8[cr = (wp[0] & mask)];
+ op[1] = t1;
+ op[2] = t2;
+ op[3] = t3;
+@@ -413,10 +413,10 @@ horizontalAccumulate8abgr(uint16 *wp, int n, int stride, unsigned char *op,
+ op[3] = t3;
+ }
+ } else if (stride == 4) {
+- t0 = ToLinear8[ca = wp[3]];
+- t1 = ToLinear8[cb = wp[2]];
+- t2 = ToLinear8[cg = wp[1]];
+- t3 = ToLinear8[cr = wp[0]];
++ t0 = ToLinear8[ca = (wp[3] & mask)];
++ t1 = ToLinear8[cb = (wp[2] & mask)];
++ t2 = ToLinear8[cg = (wp[1] & mask)];
++ t3 = ToLinear8[cr = (wp[0] & mask)];
+ op[0] = t0;
+ op[1] = t1;
+ op[2] = t2;
+@@ -630,10 +630,10 @@ PixarLogGuessDataFmt(TIFFDirectory *td)
+ return guess;
+ }
+
+-static uint32
+-multiply(size_t m1, size_t m2)
++static tsize_t
++multiply(tsize_t m1, tsize_t m2)
+ {
+- uint32 bytes = m1 * m2;
++ tsize_t bytes = m1 * m2;
+
+ if (m1 && bytes / m1 != m2)
+ bytes = 0;
+@@ -641,6 +641,20 @@ multiply(size_t m1, size_t m2)
+ return bytes;
+ }
+
++static tsize_t
++add_ms(tsize_t m1, tsize_t m2)
++{
++ tsize_t bytes = m1 + m2;
++
++ /* if either input is zero, assume overflow already occurred */
++ if (m1 == 0 || m2 == 0)
++ bytes = 0;
++ else if (bytes <= m1 || bytes <= m2)
++ bytes = 0;
++
++ return bytes;
++}
++
+ static int
+ PixarLogSetupDecode(TIFF* tif)
+ {
+@@ -661,6 +675,8 @@ PixarLogSetupDecode(TIFF* tif)
+ td->td_samplesperpixel : 1);
+ tbuf_size = multiply(multiply(multiply(sp->stride, td->td_imagewidth),
+ td->td_rowsperstrip), sizeof(uint16));
++ /* add one more stride in case input ends mid-stride */
++ tbuf_size = add_ms(tbuf_size, sizeof(uint16) * sp->stride);
+ if (tbuf_size == 0)
+ return (0);
+ sp->tbuf = (uint16 *) _TIFFmalloc(tbuf_size);
+diff --git a/libtiff/tif_print.c b/libtiff/tif_print.c
+index 7634f6e..2b255da 100644
+--- a/libtiff/tif_print.c
++++ b/libtiff/tif_print.c
+@@ -1,4 +1,4 @@
+-/* $Id: tif_print.c,v 1.36.2.5 2010-07-06 14:05:30 dron Exp $ */
++/* $Id: tif_print.c,v 1.36.2.6 2012-12-12 23:18:05 tgl Exp $ */
+
+ /*
+ * Copyright (c) 1988-1997 Sam Leffler
+@@ -514,8 +514,19 @@ TIFFPrintDirectory(TIFF* tif, FILE* fd, long flags)
+ continue;
+
+ if(fip->field_passcount) {
+- if(TIFFGetField(tif, tag, &value_count, &raw_data) != 1)
++ if (fip->field_readcount == TIFF_VARIABLE2 ) {
++ if(TIFFGetField(tif, tag, &value_count, &raw_data) != 1)
++ continue;
++ } else if (fip->field_readcount == TIFF_VARIABLE ) {
++ uint16 small_value_count;
++ if(TIFFGetField(tif, tag, &small_value_count, &raw_data) != 1)
++ continue;
++ value_count = small_value_count;
++ } else {
++ assert (fip->field_readcount == TIFF_VARIABLE
++ || fip->field_readcount == TIFF_VARIABLE2);
+ continue;
++ }
+ } else {
+ if (fip->field_readcount == TIFF_VARIABLE
+ || fip->field_readcount == TIFF_VARIABLE2)
+diff --git a/man/Makefile.in b/man/Makefile.in
+index a007da7..cac0721 100644
+--- a/man/Makefile.in
++++ b/man/Makefile.in
+@@ -1,4 +1,4 @@
+-# Makefile.in generated by automake 1.12.4 from Makefile.am.
++# Makefile.in generated by automake 1.12.5 from Makefile.am.
+ # @configure_input@
+
+ # Copyright (C) 1994-2012 Free Software Foundation, Inc.
+diff --git a/port/Makefile.in b/port/Makefile.in
+index 6674109..f95d58f 100644
+--- a/port/Makefile.in
++++ b/port/Makefile.in
+@@ -1,4 +1,4 @@
+-# Makefile.in generated by automake 1.12.4 from Makefile.am.
++# Makefile.in generated by automake 1.12.5 from Makefile.am.
+ # @configure_input@
+
+ # Copyright (C) 1994-2012 Free Software Foundation, Inc.
+diff --git a/test/Makefile.in b/test/Makefile.in
+index 61ea1ff..f88959f 100644
+--- a/test/Makefile.in
++++ b/test/Makefile.in
+@@ -1,4 +1,4 @@
+-# Makefile.in generated by automake 1.12.4 from Makefile.am.
++# Makefile.in generated by automake 1.12.5 from Makefile.am.
+ # @configure_input@
+
+ # Copyright (C) 1994-2012 Free Software Foundation, Inc.
+diff --git a/tools/Makefile.in b/tools/Makefile.in
+index 47dcec8..6f3d517 100644
+--- a/tools/Makefile.in
++++ b/tools/Makefile.in
+@@ -1,4 +1,4 @@
+-# Makefile.in generated by automake 1.12.4 from Makefile.am.
++# Makefile.in generated by automake 1.12.5 from Makefile.am.
+ # @configure_input@
+
+ # Copyright (C) 1994-2012 Free Software Foundation, Inc.
+diff --git a/tools/ppm2tiff.c b/tools/ppm2tiff.c
+index 6078459..ec8be5d 100644
+--- a/tools/ppm2tiff.c
++++ b/tools/ppm2tiff.c
+@@ -1,4 +1,4 @@
+-/* $Id: ppm2tiff.c,v 1.13.2.2 2010-06-08 18:50:44 bfriesen Exp $ */
++/* $Id: ppm2tiff.c,v 1.13.2.3 2012-12-10 18:27:35 tgl Exp $ */
+
+ /*
+ * Copyright (c) 1991-1997 Sam Leffler
+@@ -68,6 +68,17 @@ BadPPM(char* file)
+ exit(-2);
+ }
+
++static tsize_t
++multiply_ms(tsize_t m1, tsize_t m2)
++{
++ tsize_t bytes = m1 * m2;
++
++ if (m1 && bytes / m1 != m2)
++ bytes = 0;
++
++ return bytes;
++}
++
+ int
+ main(int argc, char* argv[])
+ {
+@@ -85,6 +96,7 @@ main(int argc, char* argv[])
+ int c;
+ extern int optind;
+ extern char* optarg;
++ tsize_t scanline_size;
+
+ if (argc < 2) {
+ fprintf(stderr, "%s: Too few arguments\n", argv[0]);
+@@ -217,7 +229,8 @@ main(int argc, char* argv[])
+ }
+ switch (bpp) {
+ case 1:
+- linebytes = (spp * w + (8 - 1)) / 8;
++ /* if round-up overflows, result will be zero, OK */
++ linebytes = (multiply_ms(spp, w) + (8 - 1)) / 8;
+ if (rowsperstrip == (uint32) -1) {
+ TIFFSetField(out, TIFFTAG_ROWSPERSTRIP, h);
+ } else {
+@@ -226,15 +239,31 @@ main(int argc, char* argv[])
+ }
+ break;
+ case 8:
+- linebytes = spp * w;
++ linebytes = multiply_ms(spp, w);
+ TIFFSetField(out, TIFFTAG_ROWSPERSTRIP,
+ TIFFDefaultStripSize(out, rowsperstrip));
+ break;
+ }
+- if (TIFFScanlineSize(out) > linebytes)
++ if (linebytes == 0) {
++ fprintf(stderr, "%s: scanline size overflow\n", infile);
++ (void) TIFFClose(out);
++ exit(-2);
++ }
++ scanline_size = TIFFScanlineSize(out);
++ if (scanline_size == 0) {
++ /* overflow - TIFFScanlineSize already printed a message */
++ (void) TIFFClose(out);
++ exit(-2);
++ }
++ if (scanline_size < linebytes)
+ buf = (unsigned char *)_TIFFmalloc(linebytes);
+ else
+- buf = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(out));
++ buf = (unsigned char *)_TIFFmalloc(scanline_size);
++ if (buf == NULL) {
++ fprintf(stderr, "%s: Not enough memory\n", infile);
++ (void) TIFFClose(out);
++ exit(-2);
++ }
+ if (resolution > 0) {
+ TIFFSetField(out, TIFFTAG_XRESOLUTION, resolution);
+ TIFFSetField(out, TIFFTAG_YRESOLUTION, resolution);
+diff --git a/tools/rgb2ycbcr.c b/tools/rgb2ycbcr.c
+index 0b30b51..527c036 100644
+--- a/tools/rgb2ycbcr.c
++++ b/tools/rgb2ycbcr.c
+@@ -1,4 +1,4 @@
+-/* $Id: rgb2ycbcr.c,v 1.9.2.2 2010-06-08 18:50:44 bfriesen Exp $ */
++/* $Id: rgb2ycbcr.c,v 1.9.2.3 2013-05-02 14:44:44 tgl Exp $ */
+
+ /*
+ * Copyright (c) 1991-1997 Sam Leffler
+@@ -326,7 +326,8 @@ tiffcvt(TIFF* in, TIFF* out)
+ TIFFSetField(out, TIFFTAG_PLANARCONFIG, PLANARCONFIG_CONTIG);
+ { char buf[2048];
+ char *cp = strrchr(TIFFFileName(in), '/');
+- sprintf(buf, "YCbCr conversion of %s", cp ? cp+1 : TIFFFileName(in));
++ snprintf(buf, sizeof(buf), "YCbCr conversion of %s",
++ cp ? cp+1 : TIFFFileName(in));
+ TIFFSetField(out, TIFFTAG_IMAGEDESCRIPTION, buf);
+ }
+ TIFFSetField(out, TIFFTAG_SOFTWARE, TIFFGetVersion());
+diff --git a/tools/tiff2bw.c b/tools/tiff2bw.c
+index 8fbf061..98908d1 100644
+--- a/tools/tiff2bw.c
++++ b/tools/tiff2bw.c
+@@ -1,4 +1,4 @@
+-/* $Id: tiff2bw.c,v 1.12.2.2 2010-07-02 12:03:27 dron Exp $ */
++/* $Id: tiff2bw.c,v 1.12.2.3 2013-05-02 14:44:44 tgl Exp $ */
+
+ /*
+ * Copyright (c) 1988-1997 Sam Leffler
+@@ -201,7 +201,7 @@ main(int argc, char* argv[])
+ }
+ }
+ TIFFSetField(out, TIFFTAG_PHOTOMETRIC, PHOTOMETRIC_MINISBLACK);
+- sprintf(thing, "B&W version of %s", argv[optind]);
++ snprintf(thing, sizeof(thing), "B&W version of %s", argv[optind]);
+ TIFFSetField(out, TIFFTAG_IMAGEDESCRIPTION, thing);
+ TIFFSetField(out, TIFFTAG_SOFTWARE, "tiff2bw");
+ outbuf = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(out));
+diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c
+index dee6435..c55b927 100644
+--- a/tools/tiff2pdf.c
++++ b/tools/tiff2pdf.c
+@@ -1,4 +1,4 @@
+-/* $Id: tiff2pdf.c,v 1.37.2.22 2012-07-19 15:43:31 tgl Exp $
++/* $Id: tiff2pdf.c,v 1.37.2.24 2013-05-02 14:54:18 tgl Exp $
+ *
+ * tiff2pdf - converts a TIFF image to a PDF document
+ *
+@@ -3337,33 +3337,56 @@ int t2p_process_jpeg_strip(
+ uint32 height){
+
+ tsize_t i=0;
+- uint16 ri =0;
+- uint16 v_samp=1;
+- uint16 h_samp=1;
+- int j=0;
+-
+- i++;
+-
+- while(i<(*striplength)){
++
++ while (i < *striplength) {
++ tsize_t datalen;
++ uint16 ri;
++ uint16 v_samp;
++ uint16 h_samp;
++ int j;
++ int ncomp;
++
++ /* marker header: one or more FFs */
++ if (strip[i] != 0xff)
++ return(0);
++ i++;
++ while (i < *striplength && strip[i] == 0xff)
++ i++;
++ if (i >= *striplength)
++ return(0);
++ /* SOI is the only pre-SOS marker without a length word */
++ if (strip[i] == 0xd8)
++ datalen = 0;
++ else {
++ if ((*striplength - i) <= 2)
++ return(0);
++ datalen = (strip[i+1] << 8) | strip[i+2];
++ if (datalen < 2 || datalen >= (*striplength - i))
++ return(0);
++ }
+ switch( strip[i] ){
+- case 0xd8:
+- /* SOI - start of image */
++ case 0xd8: /* SOI - start of image */
+ _TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), 2);
+ *bufferoffset+=2;
+- i+=2;
+ break;
+- case 0xc0:
+- case 0xc1:
+- case 0xc3:
+- case 0xc9:
+- case 0xca:
++ case 0xc0: /* SOF0 */
++ case 0xc1: /* SOF1 */
++ case 0xc3: /* SOF3 */
++ case 0xc9: /* SOF9 */
++ case 0xca: /* SOF10 */
+ if(no==0){
+- _TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), strip[i+2]+2);
+- for(j=0;j<buffer[*bufferoffset+9];j++){
+- if( (buffer[*bufferoffset+11+(2*j)]>>4) > h_samp)
+- h_samp = (buffer[*bufferoffset+11+(2*j)]>>4);
+- if( (buffer[*bufferoffset+11+(2*j)] & 0x0f) > v_samp)
+- v_samp = (buffer[*bufferoffset+11+(2*j)] & 0x0f);
++ _TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), datalen+2);
++ ncomp = buffer[*bufferoffset+9];
++ if (ncomp < 1 || ncomp > 4)
++ return(0);
++ v_samp=1;
++ h_samp=1;
++ for(j=0;j<ncomp;j++){
++ uint16 samp = buffer[*bufferoffset+11+(3*j)];
++ if( (samp>>4) > h_samp)
++ h_samp = (samp>>4);
++ if( (samp & 0x0f) > v_samp)
++ v_samp = (samp & 0x0f);
+ }
+ v_samp*=8;
+ h_samp*=8;
+@@ -3377,45 +3400,43 @@ int t2p_process_jpeg_strip(
+ (unsigned char) ((height>>8) & 0xff);
+ buffer[*bufferoffset+6]=
+ (unsigned char) (height & 0xff);
+- *bufferoffset+=strip[i+2]+2;
+- i+=strip[i+2]+2;
+-
++ *bufferoffset+=datalen+2;
++ /* insert a DRI marker */
+ buffer[(*bufferoffset)++]=0xff;
+ buffer[(*bufferoffset)++]=0xdd;
+ buffer[(*bufferoffset)++]=0x00;
+ buffer[(*bufferoffset)++]=0x04;
+ buffer[(*bufferoffset)++]=(ri >> 8) & 0xff;
+ buffer[(*bufferoffset)++]= ri & 0xff;
+- } else {
+- i+=strip[i+2]+2;
+ }
+ break;
+- case 0xc4:
+- case 0xdb:
+- _TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), strip[i+2]+2);
+- *bufferoffset+=strip[i+2]+2;
+- i+=strip[i+2]+2;
++ case 0xc4: /* DHT */
++ case 0xdb: /* DQT */
++ _TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), datalen+2);
++ *bufferoffset+=datalen+2;
+ break;
+- case 0xda:
++ case 0xda: /* SOS */
+ if(no==0){
+- _TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), strip[i+2]+2);
+- *bufferoffset+=strip[i+2]+2;
+- i+=strip[i+2]+2;
++ _TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), datalen+2);
++ *bufferoffset+=datalen+2;
+ } else {
+ buffer[(*bufferoffset)++]=0xff;
+ buffer[(*bufferoffset)++]=
+ (unsigned char)(0xd0 | ((no-1)%8));
+- i+=strip[i+2]+2;
+ }
+- _TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), (*striplength)-i-1);
+- *bufferoffset+=(*striplength)-i-1;
++ i += datalen + 1;
++ /* copy remainder of strip */
++ _TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i]), *striplength - i);
++ *bufferoffset+= *striplength - i;
+ return(1);
+ default:
+- i+=strip[i+2]+2;
++ /* ignore any other marker */
++ break;
+ }
++ i += datalen + 1;
+ }
+-
+
++ /* failed to find SOS marker */
+ return(0);
+ }
+ #endif
+@@ -3605,7 +3626,9 @@ tsize_t t2p_write_pdf_header(T2P* t2p, TIFF* output){
+ char buffer[16];
+ int buflen=0;
+
+- buflen=sprintf(buffer, "%%PDF-%u.%u ", t2p->pdf_majorversion&0xff, t2p->pdf_minorversion&0xff);
++ buflen = snprintf(buffer, sizeof(buffer), "%%PDF-%u.%u ",
++ t2p->pdf_majorversion&0xff,
++ t2p->pdf_minorversion&0xff);
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ written += t2pWriteFile(output, (tdata_t)"\n%\342\343\317\323\n", 7);
+
+@@ -3619,10 +3642,10 @@ tsize_t t2p_write_pdf_header(T2P* t2p, TIFF* output){
+ tsize_t t2p_write_pdf_obj_start(uint32 number, TIFF* output){
+
+ tsize_t written=0;
+- char buffer[16];
++ char buffer[32];
+ int buflen=0;
+
+- buflen=sprintf(buffer, "%lu", (unsigned long)number);
++ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)number);
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen );
+ written += t2pWriteFile(output, (tdata_t) " 0 obj\n", 7);
+
+@@ -3661,13 +3684,13 @@ tsize_t t2p_write_pdf_name(unsigned char* name, TIFF* output){
+ written += t2pWriteFile(output, (tdata_t) "/", 1);
+ for (i=0;i<namelen;i++){
+ if ( ((unsigned char)name[i]) < 0x21){
+- sprintf(buffer, "#%.2X", name[i]);
++ snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
+ buffer[sizeof(buffer) - 1] = '\0';
+ written += t2pWriteFile(output, (tdata_t) buffer, 3);
+ nextchar=1;
+ }
+ if ( ((unsigned char)name[i]) > 0x7E){
+- sprintf(buffer, "#%.2X", name[i]);
++ snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
+ buffer[sizeof(buffer) - 1] = '\0';
+ written += t2pWriteFile(output, (tdata_t) buffer, 3);
+ nextchar=1;
+@@ -3675,57 +3698,57 @@ tsize_t t2p_write_pdf_name(unsigned char* name, TIFF* output){
+ if (nextchar==0){
+ switch (name[i]){
+ case 0x23:
+- sprintf(buffer, "#%.2X", name[i]);
++ snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
+ buffer[sizeof(buffer) - 1] = '\0';
+ written += t2pWriteFile(output, (tdata_t) buffer, 3);
+ break;
+ case 0x25:
+- sprintf(buffer, "#%.2X", name[i]);
++ snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
+ buffer[sizeof(buffer) - 1] = '\0';
+ written += t2pWriteFile(output, (tdata_t) buffer, 3);
+ break;
+ case 0x28:
+- sprintf(buffer, "#%.2X", name[i]);
++ snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
+ buffer[sizeof(buffer) - 1] = '\0';
+ written += t2pWriteFile(output, (tdata_t) buffer, 3);
+ break;
+ case 0x29:
+- sprintf(buffer, "#%.2X", name[i]);
++ snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
+ buffer[sizeof(buffer) - 1] = '\0';
+ written += t2pWriteFile(output, (tdata_t) buffer, 3);
+ break;
+ case 0x2F:
+- sprintf(buffer, "#%.2X", name[i]);
++ snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
+ buffer[sizeof(buffer) - 1] = '\0';
+ written += t2pWriteFile(output, (tdata_t) buffer, 3);
+ break;
+ case 0x3C:
+- sprintf(buffer, "#%.2X", name[i]);
++ snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
+ buffer[sizeof(buffer) - 1] = '\0';
+ written += t2pWriteFile(output, (tdata_t) buffer, 3);
+ break;
+ case 0x3E:
+- sprintf(buffer, "#%.2X", name[i]);
++ snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
+ buffer[sizeof(buffer) - 1] = '\0';
+ written += t2pWriteFile(output, (tdata_t) buffer, 3);
+ break;
+ case 0x5B:
+- sprintf(buffer, "#%.2X", name[i]);
++ snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
+ buffer[sizeof(buffer) - 1] = '\0';
+ written += t2pWriteFile(output, (tdata_t) buffer, 3);
+ break;
+ case 0x5D:
+- sprintf(buffer, "#%.2X", name[i]);
++ snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
+ buffer[sizeof(buffer) - 1] = '\0';
+ written += t2pWriteFile(output, (tdata_t) buffer, 3);
+ break;
+ case 0x7B:
+- sprintf(buffer, "#%.2X", name[i]);
++ snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
+ buffer[sizeof(buffer) - 1] = '\0';
+ written += t2pWriteFile(output, (tdata_t) buffer, 3);
+ break;
+ case 0x7D:
+- sprintf(buffer, "#%.2X", name[i]);
++ snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
+ buffer[sizeof(buffer) - 1] = '\0';
+ written += t2pWriteFile(output, (tdata_t) buffer, 3);
+ break;
+@@ -3840,14 +3863,14 @@ tsize_t t2p_write_pdf_stream_end(TIFF* output){
+ tsize_t t2p_write_pdf_stream_dict(tsize_t len, uint32 number, TIFF* output){
+
+ tsize_t written=0;
+- char buffer[16];
++ char buffer[32];
+ int buflen=0;
+
+ written += t2pWriteFile(output, (tdata_t) "/Length ", 8);
+ if(len!=0){
+ written += t2p_write_pdf_stream_length(len, output);
+ } else {
+- buflen=sprintf(buffer, "%lu", (unsigned long)number);
++ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)number);
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ written += t2pWriteFile(output, (tdata_t) " 0 R \n", 6);
+ }
+@@ -3888,10 +3911,10 @@ tsize_t t2p_write_pdf_stream_dict_end(TIFF* output){
+ tsize_t t2p_write_pdf_stream_length(tsize_t len, TIFF* output){
+
+ tsize_t written=0;
+- char buffer[16];
++ char buffer[32];
+ int buflen=0;
+
+- buflen=sprintf(buffer, "%lu", (unsigned long)len);
++ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)len);
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ written += t2pWriteFile(output, (tdata_t) "\n", 1);
+
+@@ -3905,7 +3928,7 @@ tsize_t t2p_write_pdf_stream_length(tsize_t len, TIFF* output){
+ tsize_t t2p_write_pdf_catalog(T2P* t2p, TIFF* output)
+ {
+ tsize_t written = 0;
+- char buffer[16];
++ char buffer[32];
+ int buflen = 0;
+
+ written += t2pWriteFile(output,
+@@ -3944,7 +3967,6 @@ tsize_t t2p_write_pdf_info(T2P* t2p, TIFF* input, TIFF* output)
+ written += t2p_write_pdf_string(t2p->pdf_datetime, output);
+ }
+ written += t2pWriteFile(output, (tdata_t) "\n/Producer ", 11);
+- _TIFFmemset((tdata_t)buffer, 0x00, sizeof(buffer));
+ snprintf(buffer, sizeof(buffer), "libtiff / tiff2pdf - %d", TIFFLIB_VERSION);
+ written += t2p_write_pdf_string(buffer, output);
+ written += t2pWriteFile(output, (tdata_t) "\n", 1);
+@@ -4085,7 +4107,7 @@ tsize_t t2p_write_pdf_pages(T2P* t2p, TIFF* output)
+ {
+ tsize_t written=0;
+ tdir_t i=0;
+- char buffer[16];
++ char buffer[32];
+ int buflen=0;
+
+ int page=0;
+@@ -4093,7 +4115,7 @@ tsize_t t2p_write_pdf_pages(T2P* t2p, TIFF* output)
+ (tdata_t) "<< \n/Type /Pages \n/Kids [ ", 26);
+ page = t2p->pdf_pages+1;
+ for (i=0;i<t2p->tiff_pagecount;i++){
+- buflen=sprintf(buffer, "%d", page);
++ buflen=snprintf(buffer, sizeof(buffer), "%d", page);
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ written += t2pWriteFile(output, (tdata_t) " 0 R ", 5);
+ if ( ((i+1)%8)==0 ) {
+@@ -4108,8 +4130,7 @@ tsize_t t2p_write_pdf_pages(T2P* t2p, TIFF* output)
+ }
+ }
+ written += t2pWriteFile(output, (tdata_t) "] \n/Count ", 10);
+- _TIFFmemset(buffer, 0x00, 16);
+- buflen=sprintf(buffer, "%d", t2p->tiff_pagecount);
++ buflen=snprintf(buffer, sizeof(buffer), "%d", t2p->tiff_pagecount);
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ written += t2pWriteFile(output, (tdata_t) " \n>> \n", 6);
+
+@@ -4124,28 +4145,28 @@ tsize_t t2p_write_pdf_page(uint32 object, T2P* t2p, TIFF* output){
+
+ unsigned int i=0;
+ tsize_t written=0;
+- char buffer[16];
++ char buffer[256];
+ int buflen=0;
+
+ written += t2pWriteFile(output, (tdata_t) "<<\n/Type /Page \n/Parent ", 24);
+- buflen=sprintf(buffer, "%lu", (unsigned long)t2p->pdf_pages);
++ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->pdf_pages);
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ written += t2pWriteFile(output, (tdata_t) " 0 R \n", 6);
+ written += t2pWriteFile(output, (tdata_t) "/MediaBox [", 11);
+- buflen=sprintf(buffer, "%.4f",t2p->pdf_mediabox.x1);
++ buflen=snprintf(buffer, sizeof(buffer), "%.4f",t2p->pdf_mediabox.x1);
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ written += t2pWriteFile(output, (tdata_t) " ", 1);
+- buflen=sprintf(buffer, "%.4f",t2p->pdf_mediabox.y1);
++ buflen=snprintf(buffer, sizeof(buffer), "%.4f",t2p->pdf_mediabox.y1);
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ written += t2pWriteFile(output, (tdata_t) " ", 1);
+- buflen=sprintf(buffer, "%.4f",t2p->pdf_mediabox.x2);
++ buflen=snprintf(buffer, sizeof(buffer), "%.4f",t2p->pdf_mediabox.x2);
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ written += t2pWriteFile(output, (tdata_t) " ", 1);
+- buflen=sprintf(buffer, "%.4f",t2p->pdf_mediabox.y2);
++ buflen=snprintf(buffer, sizeof(buffer), "%.4f",t2p->pdf_mediabox.y2);
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ written += t2pWriteFile(output, (tdata_t) "] \n", 3);
+ written += t2pWriteFile(output, (tdata_t) "/Contents ", 10);
+- buflen=sprintf(buffer, "%lu", (unsigned long)(object + 1));
++ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)(object + 1));
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ written += t2pWriteFile(output, (tdata_t) " 0 R \n", 6);
+ written += t2pWriteFile(output, (tdata_t) "/Resources << \n", 15);
+@@ -4153,15 +4174,13 @@ tsize_t t2p_write_pdf_page(uint32 object, T2P* t2p, TIFF* output){
+ written += t2pWriteFile(output, (tdata_t) "/XObject <<\n", 12);
+ for(i=0;i<t2p->tiff_tiles[t2p->pdf_page].tiles_tilecount;i++){
+ written += t2pWriteFile(output, (tdata_t) "/Im", 3);
+- buflen = sprintf(buffer, "%u", t2p->pdf_page+1);
++ buflen = snprintf(buffer, sizeof(buffer), "%u", t2p->pdf_page+1);
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ written += t2pWriteFile(output, (tdata_t) "_", 1);
+- buflen = sprintf(buffer, "%u", i+1);
++ buflen = snprintf(buffer, sizeof(buffer), "%u", i+1);
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ written += t2pWriteFile(output, (tdata_t) " ", 1);
+- buflen = sprintf(
+- buffer,
+- "%lu",
++ buflen = snprintf(buffer, sizeof(buffer), "%lu",
+ (unsigned long)(object+3+(2*i)+t2p->tiff_pages[t2p->pdf_page].page_extra));
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ written += t2pWriteFile(output, (tdata_t) " 0 R ", 5);
+@@ -4173,12 +4192,10 @@ tsize_t t2p_write_pdf_page(uint32 object, T2P* t2p, TIFF* output){
+ } else {
+ written += t2pWriteFile(output, (tdata_t) "/XObject <<\n", 12);
+ written += t2pWriteFile(output, (tdata_t) "/Im", 3);
+- buflen = sprintf(buffer, "%u", t2p->pdf_page+1);
++ buflen = snprintf(buffer, sizeof(buffer), "%u", t2p->pdf_page+1);
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ written += t2pWriteFile(output, (tdata_t) " ", 1);
+- buflen = sprintf(
+- buffer,
+- "%lu",
++ buflen = snprintf(buffer, sizeof(buffer), "%lu",
+ (unsigned long)(object+3+(2*i)+t2p->tiff_pages[t2p->pdf_page].page_extra));
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ written += t2pWriteFile(output, (tdata_t) " 0 R ", 5);
+@@ -4187,9 +4204,7 @@ tsize_t t2p_write_pdf_page(uint32 object, T2P* t2p, TIFF* output){
+ if(t2p->tiff_transferfunctioncount != 0) {
+ written += t2pWriteFile(output, (tdata_t) "/ExtGState <<", 13);
+ t2pWriteFile(output, (tdata_t) "/GS1 ", 5);
+- buflen = sprintf(
+- buffer,
+- "%lu",
++ buflen = snprintf(buffer, sizeof(buffer), "%lu",
+ (unsigned long)(object + 3));
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ written += t2pWriteFile(output, (tdata_t) " 0 R ", 5);
+@@ -4562,7 +4577,7 @@ tsize_t t2p_write_pdf_page_content_stream(T2P* t2p, TIFF* output){
+ if(t2p->tiff_tiles[t2p->pdf_page].tiles_tilecount>0){
+ for(i=0;i<t2p->tiff_tiles[t2p->pdf_page].tiles_tilecount; i++){
+ box=t2p->tiff_tiles[t2p->pdf_page].tiles_tiles[i].tile_box;
+- buflen=sprintf(buffer,
++ buflen=snprintf(buffer, sizeof(buffer),
+ "q %s %.4f %.4f %.4f %.4f %.4f %.4f cm /Im%d_%ld Do Q\n",
+ t2p->tiff_transferfunctioncount?"/GS1 gs ":"",
+ box.mat[0],
+@@ -4577,7 +4592,7 @@ tsize_t t2p_write_pdf_page_content_stream(T2P* t2p, TIFF* output){
+ }
+ } else {
+ box=t2p->pdf_imagebox;
+- buflen=sprintf(buffer,
++ buflen=snprintf(buffer, sizeof(buffer),
+ "q %s %.4f %.4f %.4f %.4f %.4f %.4f cm /Im%d Do Q\n",
+ t2p->tiff_transferfunctioncount?"/GS1 gs ":"",
+ box.mat[0],
+@@ -4602,59 +4617,48 @@ tsize_t t2p_write_pdf_xobject_stream_dict(ttile_t tile,
+ TIFF* output){
+
+ tsize_t written=0;
+- char buffer[16];
++ char buffer[32];
+ int buflen=0;
+
+ written += t2p_write_pdf_stream_dict(0, t2p->pdf_xrefcount+1, output);
+ written += t2pWriteFile(output,
+ (tdata_t) "/Type /XObject \n/Subtype /Image \n/Name /Im",
+ 42);
+- buflen=sprintf(buffer, "%u", t2p->pdf_page+1);
++ buflen=snprintf(buffer, sizeof(buffer), "%u", t2p->pdf_page+1);
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ if(tile != 0){
+ written += t2pWriteFile(output, (tdata_t) "_", 1);
+- buflen=sprintf(buffer, "%lu", (unsigned long)tile);
++ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)tile);
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ }
+ written += t2pWriteFile(output, (tdata_t) "\n/Width ", 8);
+- _TIFFmemset((tdata_t)buffer, 0x00, 16);
+ if(tile==0){
+- buflen=sprintf(buffer, "%lu", (unsigned long)t2p->tiff_width);
++ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->tiff_width);
+ } else {
+ if(t2p_tile_is_right_edge(t2p->tiff_tiles[t2p->pdf_page], tile-1)!=0){
+- buflen=sprintf(
+- buffer,
+- "%lu",
++ buflen=snprintf(buffer, sizeof(buffer), "%lu",
+ (unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_edgetilewidth);
+ } else {
+- buflen=sprintf(
+- buffer,
+- "%lu",
++ buflen=snprintf(buffer, sizeof(buffer), "%lu",
+ (unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_tilewidth);
+ }
+ }
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ written += t2pWriteFile(output, (tdata_t) "\n/Height ", 9);
+- _TIFFmemset((tdata_t)buffer, 0x00, 16);
+ if(tile==0){
+- buflen=sprintf(buffer, "%lu", (unsigned long)t2p->tiff_length);
++ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->tiff_length);
+ } else {
+ if(t2p_tile_is_bottom_edge(t2p->tiff_tiles[t2p->pdf_page], tile-1)!=0){
+- buflen=sprintf(
+- buffer,
+- "%lu",
++ buflen=snprintf(buffer, sizeof(buffer), "%lu",
+ (unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_edgetilelength);
+ } else {
+- buflen=sprintf(
+- buffer,
+- "%lu",
++ buflen=snprintf(buffer, sizeof(buffer), "%lu",
+ (unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_tilelength);
+ }
+ }
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ written += t2pWriteFile(output, (tdata_t) "\n/BitsPerComponent ", 19);
+- _TIFFmemset((tdata_t)buffer, 0x00, 16);
+- buflen=sprintf(buffer, "%u", t2p->tiff_bitspersample);
++ buflen=snprintf(buffer, sizeof(buffer), "%u", t2p->tiff_bitspersample);
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ written += t2pWriteFile(output, (tdata_t) "\n/ColorSpace ", 13);
+ written += t2p_write_pdf_xobject_cs(t2p, output);
+@@ -4698,11 +4702,10 @@ tsize_t t2p_write_pdf_xobject_cs(T2P* t2p, TIFF* output){
+ t2p->pdf_colorspace ^= T2P_CS_PALETTE;
+ written += t2p_write_pdf_xobject_cs(t2p, output);
+ t2p->pdf_colorspace |= T2P_CS_PALETTE;
+- buflen=sprintf(buffer, "%u", (0x0001 << t2p->tiff_bitspersample)-1 );
++ buflen=snprintf(buffer, sizeof(buffer), "%u", (0x0001 << t2p->tiff_bitspersample)-1 );
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ written += t2pWriteFile(output, (tdata_t) " ", 1);
+- _TIFFmemset(buffer, 0x00, 16);
+- buflen=sprintf(buffer, "%lu", (unsigned long)t2p->pdf_palettecs );
++ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->pdf_palettecs );
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ written += t2pWriteFile(output, (tdata_t) " 0 R ]\n", 7);
+ return(written);
+@@ -4736,10 +4739,10 @@ tsize_t t2p_write_pdf_xobject_cs(T2P* t2p, TIFF* output){
+ X_W /= Y_W;
+ Z_W /= Y_W;
+ Y_W = 1.0F;
+- buflen=sprintf(buffer, "[%.4f %.4f %.4f] \n", X_W, Y_W, Z_W);
++ buflen=snprintf(buffer, sizeof(buffer), "[%.4f %.4f %.4f] \n", X_W, Y_W, Z_W);
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ written += t2pWriteFile(output, (tdata_t) "/Range ", 7);
+- buflen=sprintf(buffer, "[%d %d %d %d] \n",
++ buflen=snprintf(buffer, sizeof(buffer), "[%d %d %d %d] \n",
+ t2p->pdf_labrange[0],
+ t2p->pdf_labrange[1],
+ t2p->pdf_labrange[2],
+@@ -4755,26 +4758,26 @@ tsize_t t2p_write_pdf_xobject_cs(T2P* t2p, TIFF* output){
+ tsize_t t2p_write_pdf_transfer(T2P* t2p, TIFF* output){
+
+ tsize_t written=0;
+- char buffer[16];
++ char buffer[32];
+ int buflen=0;
+
+ written += t2pWriteFile(output, (tdata_t) "<< /Type /ExtGState \n/TR ", 25);
+ if(t2p->tiff_transferfunctioncount == 1){
+- buflen=sprintf(buffer, "%lu",
++ buflen=snprintf(buffer, sizeof(buffer), "%lu",
+ (unsigned long)(t2p->pdf_xrefcount + 1));
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ written += t2pWriteFile(output, (tdata_t) " 0 R ", 5);
+ } else {
+ written += t2pWriteFile(output, (tdata_t) "[ ", 2);
+- buflen=sprintf(buffer, "%lu",
++ buflen=snprintf(buffer, sizeof(buffer), "%lu",
+ (unsigned long)(t2p->pdf_xrefcount + 1));
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ written += t2pWriteFile(output, (tdata_t) " 0 R ", 5);
+- buflen=sprintf(buffer, "%lu",
++ buflen=snprintf(buffer, sizeof(buffer), "%lu",
+ (unsigned long)(t2p->pdf_xrefcount + 2));
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ written += t2pWriteFile(output, (tdata_t) " 0 R ", 5);
+- buflen=sprintf(buffer, "%lu",
++ buflen=snprintf(buffer, sizeof(buffer), "%lu",
+ (unsigned long)(t2p->pdf_xrefcount + 3));
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ written += t2pWriteFile(output, (tdata_t) " 0 R ", 5);
+@@ -4796,7 +4799,7 @@ tsize_t t2p_write_pdf_transfer_dict(T2P* t2p, TIFF* output, uint16 i){
+ written += t2pWriteFile(output, (tdata_t) "/FunctionType 0 \n", 17);
+ written += t2pWriteFile(output, (tdata_t) "/Domain [0.0 1.0] \n", 19);
+ written += t2pWriteFile(output, (tdata_t) "/Range [0.0 1.0] \n", 18);
+- buflen=sprintf(buffer, "/Size [%u] \n", (1<<t2p->tiff_bitspersample));
++ buflen=snprintf(buffer, sizeof(buffer), "/Size [%u] \n", (1<<t2p->tiff_bitspersample));
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ written += t2pWriteFile(output, (tdata_t) "/BitsPerSample 16 \n", 19);
+ written += t2p_write_pdf_stream_dict(1<<(t2p->tiff_bitspersample+1), 0, output);
+@@ -4823,7 +4826,7 @@ tsize_t t2p_write_pdf_transfer_stream(T2P* t2p, TIFF* output, uint16 i){
+ tsize_t t2p_write_pdf_xobject_calcs(T2P* t2p, TIFF* output){
+
+ tsize_t written=0;
+- char buffer[128];
++ char buffer[256];
+ int buflen=0;
+
+ float X_W=0.0;
+@@ -4891,16 +4894,16 @@ tsize_t t2p_write_pdf_xobject_calcs(T2P* t2p, TIFF* output){
+ written += t2pWriteFile(output, (tdata_t) "<< \n", 4);
+ if(t2p->pdf_colorspace & T2P_CS_CALGRAY){
+ written += t2pWriteFile(output, (tdata_t) "/WhitePoint ", 12);
+- buflen=sprintf(buffer, "[%.4f %.4f %.4f] \n", X_W, Y_W, Z_W);
++ buflen=snprintf(buffer, sizeof(buffer), "[%.4f %.4f %.4f] \n", X_W, Y_W, Z_W);
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ written += t2pWriteFile(output, (tdata_t) "/Gamma 2.2 \n", 12);
+ }
+ if(t2p->pdf_colorspace & T2P_CS_CALRGB){
+ written += t2pWriteFile(output, (tdata_t) "/WhitePoint ", 12);
+- buflen=sprintf(buffer, "[%.4f %.4f %.4f] \n", X_W, Y_W, Z_W);
++ buflen=snprintf(buffer, sizeof(buffer), "[%.4f %.4f %.4f] \n", X_W, Y_W, Z_W);
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ written += t2pWriteFile(output, (tdata_t) "/Matrix ", 8);
+- buflen=sprintf(buffer, "[%.4f %.4f %.4f %.4f %.4f %.4f %.4f %.4f %.4f] \n",
++ buflen=snprintf(buffer, sizeof(buffer), "[%.4f %.4f %.4f %.4f %.4f %.4f %.4f %.4f %.4f] \n",
+ X_R, Y_R, Z_R,
+ X_G, Y_G, Z_G,
+ X_B, Y_B, Z_B);
+@@ -4919,11 +4922,11 @@ tsize_t t2p_write_pdf_xobject_calcs(T2P* t2p, TIFF* output){
+ tsize_t t2p_write_pdf_xobject_icccs(T2P* t2p, TIFF* output){
+
+ tsize_t written=0;
+- char buffer[16];
++ char buffer[32];
+ int buflen=0;
+
+ written += t2pWriteFile(output, (tdata_t) "[/ICCBased ", 11);
+- buflen=sprintf(buffer, "%lu", (unsigned long)t2p->pdf_icccs);
++ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->pdf_icccs);
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ written += t2pWriteFile(output, (tdata_t) " 0 R] \n", 7);
+
+@@ -4933,11 +4936,11 @@ tsize_t t2p_write_pdf_xobject_icccs(T2P* t2p, TIFF* output){
+ tsize_t t2p_write_pdf_xobject_icccs_dict(T2P* t2p, TIFF* output){
+
+ tsize_t written=0;
+- char buffer[16];
++ char buffer[32];
+ int buflen=0;
+
+ written += t2pWriteFile(output, (tdata_t) "/N ", 3);
+- buflen=sprintf(buffer, "%u \n", t2p->tiff_samplesperpixel);
++ buflen=snprintf(buffer, sizeof(buffer), "%u \n", t2p->tiff_samplesperpixel);
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ written += t2pWriteFile(output, (tdata_t) "/Alternate ", 11);
+ t2p->pdf_colorspace ^= T2P_CS_ICCBASED;
+@@ -5002,7 +5005,7 @@ tsize_t t2p_write_pdf_xobject_decode(T2P* t2p, TIFF* output){
+ tsize_t t2p_write_pdf_xobject_stream_filter(ttile_t tile, T2P* t2p, TIFF* output){
+
+ tsize_t written=0;
+- char buffer[16];
++ char buffer[32];
+ int buflen=0;
+
+ if(t2p->pdf_compression==T2P_COMPRESS_NONE){
+@@ -5017,41 +5020,33 @@ tsize_t t2p_write_pdf_xobject_stream_filter(ttile_t tile, T2P* t2p, TIFF* output
+ written += t2pWriteFile(output, (tdata_t) "<< /K -1 ", 9);
+ if(tile==0){
+ written += t2pWriteFile(output, (tdata_t) "/Columns ", 9);
+- buflen=sprintf(buffer, "%lu",
++ buflen=snprintf(buffer, sizeof(buffer), "%lu",
+ (unsigned long)t2p->tiff_width);
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ written += t2pWriteFile(output, (tdata_t) " /Rows ", 7);
+- buflen=sprintf(buffer, "%lu",
++ buflen=snprintf(buffer, sizeof(buffer), "%lu",
+ (unsigned long)t2p->tiff_length);
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ } else {
+ if(t2p_tile_is_right_edge(t2p->tiff_tiles[t2p->pdf_page], tile-1)==0){
+ written += t2pWriteFile(output, (tdata_t) "/Columns ", 9);
+- buflen=sprintf(
+- buffer,
+- "%lu",
++ buflen=snprintf(buffer, sizeof(buffer), "%lu",
+ (unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_tilewidth);
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ } else {
+ written += t2pWriteFile(output, (tdata_t) "/Columns ", 9);
+- buflen=sprintf(
+- buffer,
+- "%lu",
++ buflen=snprintf(buffer, sizeof(buffer), "%lu",
+ (unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_edgetilewidth);
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ }
+ if(t2p_tile_is_bottom_edge(t2p->tiff_tiles[t2p->pdf_page], tile-1)==0){
+ written += t2pWriteFile(output, (tdata_t) " /Rows ", 7);
+- buflen=sprintf(
+- buffer,
+- "%lu",
++ buflen=snprintf(buffer, sizeof(buffer), "%lu",
+ (unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_tilelength);
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ } else {
+ written += t2pWriteFile(output, (tdata_t) " /Rows ", 7);
+- buflen=sprintf(
+- buffer,
+- "%lu",
++ buflen=snprintf(buffer, sizeof(buffer), "%lu",
+ (unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_edgetilelength);
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ }
+@@ -5078,21 +5073,17 @@ tsize_t t2p_write_pdf_xobject_stream_filter(ttile_t tile, T2P* t2p, TIFF* output
+ if(t2p->pdf_compressionquality%100){
+ written += t2pWriteFile(output, (tdata_t) "/DecodeParms ", 13);
+ written += t2pWriteFile(output, (tdata_t) "<< /Predictor ", 14);
+- _TIFFmemset(buffer, 0x00, 16);
+- buflen=sprintf(buffer, "%u", t2p->pdf_compressionquality%100);
++ buflen=snprintf(buffer, sizeof(buffer), "%u", t2p->pdf_compressionquality%100);
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ written += t2pWriteFile(output, (tdata_t) " /Columns ", 10);
+- _TIFFmemset(buffer, 0x00, 16);
+- buflen = sprintf(buffer, "%lu",
++ buflen = snprintf(buffer, sizeof(buffer), "%lu",
+ (unsigned long)t2p->tiff_width);
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ written += t2pWriteFile(output, (tdata_t) " /Colors ", 9);
+- _TIFFmemset(buffer, 0x00, 16);
+- buflen=sprintf(buffer, "%u", t2p->tiff_samplesperpixel);
++ buflen=snprintf(buffer, sizeof(buffer), "%u", t2p->tiff_samplesperpixel);
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ written += t2pWriteFile(output, (tdata_t) " /BitsPerComponent ", 19);
+- _TIFFmemset(buffer, 0x00, 16);
+- buflen=sprintf(buffer, "%u", t2p->tiff_bitspersample);
++ buflen=snprintf(buffer, sizeof(buffer), "%u", t2p->tiff_bitspersample);
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ written += t2pWriteFile(output, (tdata_t) ">>\n", 3);
+ }
+@@ -5112,16 +5103,16 @@ tsize_t t2p_write_pdf_xobject_stream_filter(ttile_t tile, T2P* t2p, TIFF* output
+ tsize_t t2p_write_pdf_xreftable(T2P* t2p, TIFF* output){
+
+ tsize_t written=0;
+- char buffer[21];
++ char buffer[64];
+ int buflen=0;
+ uint32 i=0;
+
+ written += t2pWriteFile(output, (tdata_t) "xref\n0 ", 7);
+- buflen=sprintf(buffer, "%lu", (unsigned long)(t2p->pdf_xrefcount + 1));
++ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)(t2p->pdf_xrefcount + 1));
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ written += t2pWriteFile(output, (tdata_t) " \n0000000000 65535 f \n", 22);
+ for (i=0;i<t2p->pdf_xrefcount;i++){
+- sprintf(buffer, "%.10lu 00000 n \n",
++ snprintf(buffer, sizeof(buffer), "%.10lu 00000 n \n",
+ (unsigned long)t2p->pdf_xrefoffsets[i]);
+ written += t2pWriteFile(output, (tdata_t) buffer, 20);
+ }
+@@ -5145,17 +5136,14 @@ tsize_t t2p_write_pdf_trailer(T2P* t2p, TIFF* output)
+ snprintf(t2p->pdf_fileid + i, 9, "%.8X", rand());
+
+ written += t2pWriteFile(output, (tdata_t) "trailer\n<<\n/Size ", 17);
+- buflen = sprintf(buffer, "%lu", (unsigned long)(t2p->pdf_xrefcount+1));
++ buflen = snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)(t2p->pdf_xrefcount+1));
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+- _TIFFmemset(buffer, 0x00, 32);
+ written += t2pWriteFile(output, (tdata_t) "\n/Root ", 7);
+- buflen=sprintf(buffer, "%lu", (unsigned long)t2p->pdf_catalog);
++ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->pdf_catalog);
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+- _TIFFmemset(buffer, 0x00, 32);
+ written += t2pWriteFile(output, (tdata_t) " 0 R \n/Info ", 12);
+- buflen=sprintf(buffer, "%lu", (unsigned long)t2p->pdf_info);
++ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->pdf_info);
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+- _TIFFmemset(buffer, 0x00, 32);
+ written += t2pWriteFile(output, (tdata_t) " 0 R \n/ID[<", 11);
+ written += t2pWriteFile(output, (tdata_t) t2p->pdf_fileid,
+ sizeof(t2p->pdf_fileid) - 1);
+@@ -5163,9 +5151,8 @@ tsize_t t2p_write_pdf_trailer(T2P* t2p, TIFF* output)
+ written += t2pWriteFile(output, (tdata_t) t2p->pdf_fileid,
+ sizeof(t2p->pdf_fileid) - 1);
+ written += t2pWriteFile(output, (tdata_t) ">]\n>>\nstartxref\n", 16);
+- buflen=sprintf(buffer, "%lu", (unsigned long)t2p->pdf_startxref);
++ buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->pdf_startxref);
+ written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+- _TIFFmemset(buffer, 0x00, 32);
+ written += t2pWriteFile(output, (tdata_t) "\n%%EOF\n", 7);
+
+ return(written);
+diff --git a/tools/tiff2ps.c b/tools/tiff2ps.c
+index 2d02b23..b9befe7 100644
+--- a/tools/tiff2ps.c
++++ b/tools/tiff2ps.c
+@@ -1,4 +1,4 @@
+-/* $Id: tiff2ps.c,v 1.35.2.7 2011-04-09 16:53:56 bfriesen Exp $ */
++/* $Id: tiff2ps.c,v 1.35.2.9 2013-05-02 14:44:44 tgl Exp $ */
+
+ /*
+ * Copyright (c) 1988-1997 Sam Leffler
+@@ -44,6 +44,11 @@
+
+ /*
+ * Revision history
++ * 2013-Jan-21
++ * Richard Nolde: Fix bug in auto rotate option code. Once a
++ * rotation angle was set by the auto rotate check, it was
++ * retained for all pages that followed instead of being
++ * retested for each page.
+ *
+ * 2010-Sep-17
+ * Richard Nolde: Reinstate code from Feb 2009 that never got
+@@ -423,9 +428,10 @@ main(int argc, char* argv[])
+ /* auto rotate requires a specified page width and height */
+ if (auto_rotate == TRUE)
+ {
++ /*
+ if ((pageWidth == 0) || (pageHeight == 0))
+ TIFFWarning ("-r auto", " requires page height and width specified with -h and -w");
+-
++ */
+ if ((maxPageWidth > 0) || (maxPageHeight > 0))
+ {
+ TIFFError ("-r auto", " is incompatible with maximum page width/height specified by -H or -W");
+@@ -1594,6 +1600,8 @@ int TIFF2PS(FILE* fd, TIFF* tif, double pgwidth, double pgheight, double lm, dou
+ }
+ if (generateEPSF)
+ break;
++ if (auto_rotate)
++ rotation = 0.0;
+ TIFFGetFieldDefaulted(tif, TIFFTAG_SUBFILETYPE, &subfiletype);
+ } while (((subfiletype & FILETYPE_PAGE) || printAll) && TIFFReadDirectory(tif));
+
+@@ -1783,8 +1791,8 @@ PS_Lvl2ImageDict(FILE* fd, TIFF* tif, uint32 w, uint32 h)
+ imageOp = "imagemask";
+
+ (void)strcpy(im_x, "0");
+- (void)sprintf(im_y, "%lu", (long) h);
+- (void)sprintf(im_h, "%lu", (long) h);
++ (void)snprintf(im_y, sizeof(im_y), "%lu", (long) h);
++ (void)snprintf(im_h, sizeof(im_h), "%lu", (long) h);
+ tile_width = w;
+ tile_height = h;
+ if (TIFFIsTiled(tif)) {
+@@ -1805,7 +1813,7 @@ PS_Lvl2ImageDict(FILE* fd, TIFF* tif, uint32 w, uint32 h)
+ }
+ if (tile_height < h) {
+ fputs("/im_y 0 def\n", fd);
+- (void)sprintf(im_y, "%lu im_y sub", (unsigned long) h);
++ (void)snprintf(im_y, sizeof(im_y), "%lu im_y sub", (unsigned long) h);
+ }
+ } else {
+ repeat_count = tf_numberstrips;
+@@ -1817,7 +1825,7 @@ PS_Lvl2ImageDict(FILE* fd, TIFF* tif, uint32 w, uint32 h)
+ fprintf(fd, "/im_h %lu def\n",
+ (unsigned long) tile_height);
+ (void)strcpy(im_h, "im_h");
+- (void)sprintf(im_y, "%lu im_y sub", (unsigned long) h);
++ (void)snprintf(im_y, sizeof(im_y), "%lu im_y sub", (unsigned long) h);
+ }
+ }
+
+diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
+index d00c912..6c53e74 100644
+--- a/tools/tiffcrop.c
++++ b/tools/tiffcrop.c
+@@ -1,4 +1,4 @@
+-/* $Id: tiffcrop.c,v 1.3.2.15 2010-12-14 02:03:55 faxguy Exp $ */
++/* $Id: tiffcrop.c,v 1.3.2.16 2013-05-02 14:44:44 tgl Exp $ */
+
+ /* tiffcrop.c -- a port of tiffcp.c extended to include manipulations of
+ * the image data through additional options listed below
+@@ -2077,7 +2077,7 @@ update_output_file (TIFF **tiffout, char *mode, int autoindex,
+ return 1;
+ }
+
+- sprintf (filenum, "-%03d%s", findex, export_ext);
++ snprintf(filenum, sizeof(filenum), "-%03d%s", findex, export_ext);
+ filenum[14] = '\0';
+ strncat (exportname, filenum, 15);
+ }
+@@ -2230,8 +2230,8 @@ main(int argc, char* argv[])
+
+ /* dump.infilename is guaranteed to be NUL termimated and have 20 bytes
+ fewer than PATH_MAX */
+- memset (temp_filename, '\0', PATH_MAX + 1);
+- sprintf (temp_filename, "%s-read-%03d.%s", dump.infilename, dump_images,
++ snprintf(temp_filename, sizeof(temp_filename), "%s-read-%03d.%s",
++ dump.infilename, dump_images,
+ (dump.format == DUMP_TEXT) ? "txt" : "raw");
+ if ((dump.infile = fopen(temp_filename, dump.mode)) == NULL)
+ {
+@@ -2249,8 +2249,8 @@ main(int argc, char* argv[])
+
+ /* dump.outfilename is guaranteed to be NUL termimated and have 20 bytes
+ fewer than PATH_MAX */
+- memset (temp_filename, '\0', PATH_MAX + 1);
+- sprintf (temp_filename, "%s-write-%03d.%s", dump.outfilename, dump_images,
++ snprintf(temp_filename, sizeof(temp_filename), "%s-write-%03d.%s",
++ dump.outfilename, dump_images,
+ (dump.format == DUMP_TEXT) ? "txt" : "raw");
+ if ((dump.outfile = fopen(temp_filename, dump.mode)) == NULL)
+ {
+diff --git a/tools/tiffdither.c b/tools/tiffdither.c
+index dee2a02..a0cb857 100644
+--- a/tools/tiffdither.c
++++ b/tools/tiffdither.c
+@@ -1,4 +1,4 @@
+-/* $Id: tiffdither.c,v 1.9.2.1 2010-06-08 18:50:44 bfriesen Exp $ */
++/* $Id: tiffdither.c,v 1.9.2.2 2013-05-02 14:44:45 tgl Exp $ */
+
+ /*
+ * Copyright (c) 1988-1997 Sam Leffler
+@@ -256,7 +256,7 @@ main(int argc, char* argv[])
+ TIFFSetField(out, TIFFTAG_FILLORDER, fillorder);
+ else
+ CopyField(TIFFTAG_FILLORDER, shortv);
+- sprintf(thing, "Dithered B&W version of %s", argv[optind]);
++ snprintf(thing, sizeof(thing), "Dithered B&W version of %s", argv[optind]);
+ TIFFSetField(out, TIFFTAG_IMAGEDESCRIPTION, thing);
+ CopyField(TIFFTAG_PHOTOMETRIC, shortv);
+ CopyField(TIFFTAG_ORIENTATION, shortv);
diff --git a/source/l/libtiff/tiff-3.9.7_CVE-2013-4231.diff b/source/l/libtiff/tiff-3.9.7_CVE-2013-4231.diff
new file mode 100644
index 00000000..79eeb449
--- /dev/null
+++ b/source/l/libtiff/tiff-3.9.7_CVE-2013-4231.diff
@@ -0,0 +1,23 @@
+From 5d19703933eaa59f97be9c88237fe00593f180ae Mon Sep 17 00:00:00 2001
+From: mancha <mancha1@hush.com>
+Date: Mon, 19 Aug 2013
+Subject: CVE-2013-4231
+
+* tools/gif2tiff.c: Be more careful about corrupt or
+ hostile input files (#2450, CVE-2013-4231)
+
+---
+ gif2tiff.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/tools/gif2tiff.c 2013-08-20
++++ b/tools/gif2tiff.c 2013-08-20
+@@ -329,6 +329,8 @@ readraster(void)
+ int status = 1;
+
+ datasize = getc(infile);
++ if (datasize > 12)
++ return 0;
+ clear = 1 << datasize;
+ eoi = clear + 1;
+ avail = clear + 2;
diff --git a/source/l/libtiff/tiff-3.9.7_CVE-2013-4232.diff b/source/l/libtiff/tiff-3.9.7_CVE-2013-4232.diff
new file mode 100644
index 00000000..b86f8f4a
--- /dev/null
+++ b/source/l/libtiff/tiff-3.9.7_CVE-2013-4232.diff
@@ -0,0 +1,24 @@
+From 8a2f9160cc4c52c73a62adef4d9282b2bd6e7ff1 Mon Sep 17 00:00:00 2001
+From: mancha <mancha1@hush.com>
+Date: Mon, 19 Aug 2013
+Subject: CVE-2013-4232
+
+* tools/tiff2pdf.c: terminate after failure of allocating
+ ycbcr buffer (bug #2449, CVE-2013-4232)
+
+---
+ tiff2pdf.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/tools/tiff2pdf.c 2013-08-20
++++ b/tools/tiff2pdf.c 2013-08-20
+@@ -2457,7 +2457,8 @@ tsize_t t2p_readwrite_pdf_image(T2P* t2p
+ t2p->tiff_datasize,
+ TIFFFileName(input));
+ t2p->t2p_error = T2P_ERR_ERROR;
+- _TIFFfree(buffer);
++ _TIFFfree(buffer);
++ return(0);
+ } else {
+ buffer=samplebuffer;
+ t2p->tiff_datasize *= t2p->tiff_samplesperpixel;
diff --git a/source/l/libtiff/tiff-3.9.7_CVE-2013-4244.diff b/source/l/libtiff/tiff-3.9.7_CVE-2013-4244.diff
new file mode 100644
index 00000000..4f8c5432
--- /dev/null
+++ b/source/l/libtiff/tiff-3.9.7_CVE-2013-4244.diff
@@ -0,0 +1,24 @@
+From 7f4cfaec643863fcdc260da46af8d6581974101d Mon Sep 17 00:00:00 2001
+From: mancha <mancha1@hush.com>
+Date: Mon, 19 Aug 2013
+Subject: CVE-2013-4244
+
+* tools/gif2tiff.c: fix possible OOB write (#2452, CVE-2013-4244)
+
+---
+ gif2tiff.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/tools/gif2tiff.c 2013-08-20
++++ b/tools/gif2tiff.c 2013-08-20
+@@ -396,6 +398,10 @@ process(register int code, unsigned char
+ }
+
+ if (oldcode == -1) {
++ if (code >= clear) {
++ fprintf(stderr, "bad input: code=%d is larger than clear=%d\n",code, clear);
++ return 0;
++ }
+ *(*fill)++ = suffix[code];
+ firstchar = oldcode = code;
+ return 1;