1998.05.01 01:38 "Potential problem with libtiff G4 decompression", by Brent Foster

While dealing with these bad Kofax images and basically being fed random codes, I discovered that problems can occur with VL codes when b1 - codeLength < a0, which is of course invalid. You end up with negative length runs, which cause havoc.

S_VL in EXPAND2D needs to be changed to something like below I think. I don't know what it's appropriate to do in this situation - give up? Insert a zero run?

Does this sound right?

Brent

  case S_VL:
    CHECK_b1;
    if (TabEnt->Width > b1 - a0) {
      /* bad data */
    }
    SETVAL(b1 - a0 - TabEnt->Param);
    b1 -= *--pb;
    break;