$NetBSD: patch-ac,v 1.20 2009/06/22 14:54:44 drochner Exp $

--- libtiff/tif_lzw.c.orig	2006-03-21 17:42:50.000000000 +0100
+++ libtiff/tif_lzw.c
@@ -237,6 +237,13 @@ LZWSetupDecode(TIFF* tif)
                     sp->dec_codetab[code].length = 1;
                     sp->dec_codetab[code].next = NULL;
                 } while (code--);
+                /*
+                 * Zero-out the unused entries
+                 */
+                 _TIFFmemset(&sp->dec_codetab[CODE_CLEAR], 0,
+                 (CODE_FIRST-CODE_CLEAR)*sizeof (code_t));
+
+
 	}
 	return (1);
 }
@@ -408,12 +415,20 @@ LZWDecode(TIFF* tif, tidata_t op0, tsize
 			break;
 		if (code == CODE_CLEAR) {
 			free_entp = sp->dec_codetab + CODE_FIRST;
+			 _TIFFmemset(free_entp, 0, (CSIZE-CODE_FIRST)*sizeof (code_t));
 			nbits = BITS_MIN;
 			nbitsmask = MAXCODE(BITS_MIN);
 			maxcodep = sp->dec_codetab + nbitsmask-1;
 			NextCode(tif, sp, bp, code, GetNextCode);
 			if (code == CODE_EOI)
 				break;
+			 if (code == CODE_CLEAR) {
+				 TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
+				 "LZWDecode: Corrupted LZW table at scanline %d",
+				 tif->tif_row);
+				 return (0);
+			 }
+
 			*op++ = (char)code, occ--;
 			oldcodep = sp->dec_codetab + code;
 			continue;
@@ -604,12 +619,20 @@ LZWDecodeCompat(TIFF* tif, tidata_t op0,
 			break;
 		if (code == CODE_CLEAR) {
 			free_entp = sp->dec_codetab + CODE_FIRST;
+			 _TIFFmemset(free_entp, 0, (CSIZE-CODE_FIRST)*sizeof (code_t));
 			nbits = BITS_MIN;
 			nbitsmask = MAXCODE(BITS_MIN);
 			maxcodep = sp->dec_codetab + nbitsmask;
 			NextCode(tif, sp, bp, code, GetNextCodeCompat);
 			if (code == CODE_EOI)
 				break;
+			 if (code == CODE_CLEAR) {
+				 TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
+				 "LZWDecode: Corrupted LZW table at scanline %d",
+				 tif->tif_row);
+				 return (0);
+			 }
+
 			*op++ = code, occ--;
 			oldcodep = sp->dec_codetab + code;
 			continue;
@@ -647,6 +670,7 @@ LZWDecodeCompat(TIFF* tif, tidata_t op0,
 		}
 		oldcodep = codep;
 		if (code >= 256) {
+			char *op_orig = op;
 			/*
 		 	 * Code maps to a string, copy string
 			 * value to output (written in reverse).
@@ -681,7 +705,7 @@ LZWDecodeCompat(TIFF* tif, tidata_t op0,
 			tp = op;
 			do {
 				*--tp = codep->value;
-			} while( (codep = codep->next) != NULL);
+			} while( (codep = codep->next) != NULL && tp > op_orig);
 		} else
 			*op++ = code, occ--;
 	}
