Ticket #2006: tiff_lzw3.diff

libavcodec/tiff.c

@@ -398 +398 @@
 {
     int c, line, pixels, code;
     const uint8_t *ssrc = src;
+    uint8_t *src2 = NULL;
     int width = ((s->width * s->bpp) + 7) >> 3;
 
     if (size <= 0)
@@ -449 +450 @@
     }
 #endif
     if (s->compr == TIFF_LZW) {
+        if (s->fill_order) {
+            int i;
+            src2 = av_malloc((unsigned)size + FF_INPUT_BUFFER_PADDING_SIZE);
+            if (!src2) {
+                av_log(s->avctx, AV_LOG_ERROR, "Error allocating temporary buffer\n");
+                return AVERROR(ENOMEM);
+            }
+            for (i = 0; i < size; i++)
+                src2[i] = ff_reverse[src[i]];
+            memset(src2 + size, 0, FF_INPUT_BUFFER_PADDING_SIZE);
+            src = src2;
+            ssrc = src;
+        }
         if (ff_lzw_decode_init(s->lzw, 8, src, size, FF_LZW_TIFF) < 0) {
             av_log(s->avctx, AV_LOG_ERROR, "Error initializing LZW decoder\n");
+            av_free(src2);
             return -1;
         }
     }
@@ -554 +569 @@
             if (pixels < width) {
                 av_log(s->avctx, AV_LOG_ERROR, "Decoded only %i bytes of %i\n",
                        pixels, width);
+                av_free(src2);
                 return -1;
             }
             if (s->bpp < 8 && s->avctx->pix_fmt == AV_PIX_FMT_PAL8)
                 horizontal_fill(s->bpp, dst, 1, dst, 0, width, 0);
+            av_free(src2);
             break;
         }
         dst += stride;