diff --git a/libtiff/tif_next.c b/libtiff/tif_next.c

index b014685..13c0848 100644

--- a/libtiff/tif_next.c

+++ b/libtiff/tif_next.c

@@ -37,7 +37,7 @@

case 0: op[0] = (unsigned char) ((v) << 6); break; \

case 1: op[0] |= (v) << 4; break; \

case 2: op[0] |= (v) << 2; break; \

- case 3: *op++ |= (v); break; \

+ case 3: *op++ |= (v); op_offset++; break; \

} \

}

@@ -107,6 +107,8 @@ NeXTDecode(TIFF* tif, uint8* buf, tmsize_t occ, uint16 s)

if( isTiled(tif) )

imagewidth = tif->tif_dir.td_tilewidth;

+ tmsize_t op_offset = 0;

+

/*

* The scanline is composed of a sequence of constant

* color ``runs''. We shift into ``run mode'' and

@@ -120,10 +122,15 @@ NeXTDecode(TIFF* tif, uint8* buf, tmsize_t occ, uint16 s)

* bounds, potentially resulting in a security

* issue.

*/

- while (n-- > 0 && npixels < imagewidth)

+ while (n-- > 0 && npixels < imagewidth && op_offset < scanline)

SETPIXEL(op, grey);

if (npixels >= imagewidth)

break;

+ if (op_offset >= scanline ) {

+ TIFFErrorExt(tif->tif_clientdata, module, "Invalid data for scanline %ld",

+ (long) tif->tif_row);

+ return (0);

+ }

if (cc == 0)

goto bad;

n = *bp++, cc--;

@@ -162,9 +169,9 @@ NeXTPreDecode(TIFF* tif, uint16 s)

TIFFInitNeXT(TIFF* tif, int scheme)

{

(void) scheme;

- tif->tif_predecode = NeXTPreDecode;

- tif->tif_decoderow = NeXTDecode;

- tif->tif_decodestrip = NeXTDecode;

+ tif->tif_predecode = NeXTPreDecode;

+ tif->tif_decoderow = NeXTDecode;

+ tif->tif_decodestrip = NeXTDecode;

tif->tif_decodetile = NeXTDecode;

return (1);

}