diff --git a/libtiff/tif_dir.c b/libtiff/tif_dir.c

index 8bf3ea7..f812fa2 100644

--- a/libtiff/tif_dir.c

+++ b/libtiff/tif_dir.c

@@ -160,6 +160,7 @@ _TIFFVSetField(TIFF* tif, uint32 tag, va_list ap)

TIFFDirectory* td = &tif->tif_dir;

int status = 1;

uint32 v32, i, v;

+ double dblval;

char* s;

const TIFFField *fip = TIFFFindField(tif, tag, TIFF_ANY);

uint32 standard_tag = tag;

@@ -283,10 +284,16 @@ _TIFFVSetField(TIFF* tif, uint32 tag, va_list ap)

setDoubleArrayOneValue(&td->td_smaxsamplevalue, va_arg(ap, double), td->td_samplesperpixel);

break;

case TIFFTAG_XRESOLUTION:

- td->td_xresolution = (float) va_arg(ap, double);

+ dblval = va_arg(ap, double);

+ if( dblval < 0 )

+ goto badvaluedouble;

+ td->td_xresolution = (float) dblval;

break;

case TIFFTAG_YRESOLUTION:

- td->td_yresolution = (float) va_arg(ap, double);

+ dblval = va_arg(ap, double);

+ if( dblval < 0 )

+ goto badvaluedouble;

+ td->td_yresolution = (float) dblval;

break;

case TIFFTAG_PLANARCONFIG:

v = (uint16) va_arg(ap, uint16_vap);

@@ -693,6 +700,16 @@ badvalue32:

va_end(ap);

}

return (0);

+badvaluedouble:

+ {

+ const TIFFField* fip=TIFFFieldWithTag(tif,tag);

+ TIFFErrorExt(tif->tif_clientdata, module,

+ "%s: Bad value %f for \"%s\" tag",

+ tif->tif_name, dblval,

+ fip->field_name);

+ va_end(ap);

+ }

+ return (0);

}

/*

diff --git a/libtiff/tif_next.c b/libtiff/tif_next.c

index 524e127..81084ff 100644

--- a/libtiff/tif_next.c

+++ b/libtiff/tif_next.c

@@ -102,6 +102,8 @@ NeXTDecode(TIFF* tif, uint8* buf, tmsize_t occ, uint16 s)

default: {

uint32 npixels = 0, grey;

uint32 imagewidth = tif->tif_dir.td_imagewidth;

+ if( isTiled(tif) )

+ imagewidth = tif->tif_dir.td_tilewidth;

/*

* The scanline is composed of a sequence of constant

@@ -139,10 +141,28 @@ bad:

return (0);

}

+static int

+NeXTPreDecode(TIFF* tif, uint16 s)

+{

+ static const char module[] = "NeXTPreDecode";

+ TIFFDirectory *td = &tif->tif_dir;

+ (void)s;

+

+ if( td->td_bitspersample != 2 )

+ {

+ TIFFErrorExt(tif->tif_clientdata, module, "Unsupported BitsPerSample = %d",

+ td->td_bitspersample);

+ return (0);

+ }

+ return (1);

+}

+

+

int

TIFFInitNeXT(TIFF* tif, int scheme)

{

(void) scheme;

+ tif->tif_predecode = NeXTPreDecode;

tif->tif_decoderow = NeXTDecode;

tif->tif_decodestrip = NeXTDecode;

tif->tif_decodetile = NeXTDecode;

diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c

index 26a1acb..2a64ec3 100644

--- a/tools/tiff2pdf.c

+++ b/tools/tiff2pdf.c

@@ -1165,6 +1165,15 @@ void t2p_read_tiff_init(T2P* t2p, TIFF* input){

if( (TIFFGetField(input, TIFFTAG_PLANARCONFIG, &xuint16) != 0)

&& (xuint16 == PLANARCONFIG_SEPARATE ) ){

TIFFGetField(input, TIFFTAG_SAMPLESPERPIXEL, &xuint16);

+ if( (t2p->tiff_tiles[i].tiles_tilecount % xuint16) != 0 )

+ {

+ TIFFError(

+ TIFF2PDF_MODULE,

+ "Invalid tile count, %s",

+ TIFFFileName(input));

+ t2p->t2p_error = T2P_ERR_ERROR;

+ return;

+ }

t2p->tiff_tiles[i].tiles_tilecount/= xuint16;

}

if( t2p->tiff_tiles[i].tiles_tilecount > 0){

@@ -1545,6 +1554,22 @@ void t2p_read_tiff_data(T2P* t2p, TIFF* input){

#endif

break;

case PHOTOMETRIC_CIELAB:

+ if( t2p->tiff_samplesperpixel != 3){

+ TIFFError(

+ TIFF2PDF_MODULE,

+ "Unsupported samplesperpixel = %d for CIELAB",

+ t2p->tiff_samplesperpixel);

+ t2p->t2p_error = T2P_ERR_ERROR;

+ return;

+ }

+ if( t2p->tiff_bitspersample != 8){

+ TIFFError(

+ TIFF2PDF_MODULE,

+ "Invalid bitspersample = %d for CIELAB",

+ t2p->tiff_bitspersample);

+ t2p->t2p_error = T2P_ERR_ERROR;

+ return;

+ }

t2p->pdf_labrange[0]= -127;

t2p->pdf_labrange[1]= 127;

t2p->pdf_labrange[2]= -127;

@@ -1560,6 +1585,22 @@ void t2p_read_tiff_data(T2P* t2p, TIFF* input){

t2p->pdf_colorspace=T2P_CS_LAB;

break;

case PHOTOMETRIC_ITULAB:

+ if( t2p->tiff_samplesperpixel != 3){

+ TIFFError(

+ TIFF2PDF_MODULE,

+ "Unsupported samplesperpixel = %d for ITULAB",

+ t2p->tiff_samplesperpixel);

+ t2p->t2p_error = T2P_ERR_ERROR;

+ return;

+ }

+ if( t2p->tiff_bitspersample != 8){

+ TIFFError(

+ TIFF2PDF_MODULE,

+ "Invalid bitspersample = %d for ITULAB",

+ t2p->tiff_bitspersample);

+ t2p->t2p_error = T2P_ERR_ERROR;

+ return;

+ }

t2p->pdf_labrange[0]=-85;

t2p->pdf_labrange[1]=85;

t2p->pdf_labrange[2]=-75;

diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c

index abeb4f6..ea4f7a1 100644

--- a/tools/tiffcrop.c

+++ b/tools/tiffcrop.c

@@ -1205,9 +1205,10 @@ static int writeBufferToContigTiles (TIFF* out, uint8* buf, uint32 imagelength,

tsize_t tilesize = TIFFTileSize(out);

unsigned char *tilebuf = NULL;

- TIFFGetField(out, TIFFTAG_TILELENGTH, &tl);

- TIFFGetField(out, TIFFTAG_TILEWIDTH, &tw);

- TIFFGetField(out, TIFFTAG_BITSPERSAMPLE, &bps);

+ if( !TIFFGetField(out, TIFFTAG_TILELENGTH, &tl) ||

+ !TIFFGetField(out, TIFFTAG_TILEWIDTH, &tw) ||

+ !TIFFGetField(out, TIFFTAG_BITSPERSAMPLE, &bps) )

+ return 1;

tile_buffsize = tilesize;

if (tilesize < (tsize_t)(tl * tile_rowsize))