*** empty log message ***

1 files changed, 18 insertions, 21 deletions

diff --git a/src/libtiff/tif_next.c b/src/libtiff/tif_next.c
index fc9a13d..c56dc3e 100644
--- a/src/libtiff/tif_next.c
+++ b/src/libtiff/tif_next.c
@@ -1,4 +1,4 @@
-/* $Id: tif_next.c,v 1.3 2009/12/11 15:17:41 scuri Exp $ */
+/* $Id: tif_next.c,v 1.4 2010/01/26 15:56:36 scuri Exp $ */
 
 /*
  * Copyright (c) 1988-1997 Sam Leffler
@@ -48,10 +48,11 @@
 static int
 NeXTDecode(TIFF* tif, tidata_t buf, tsize_t occ, tsample_t s)
 {
-	unsigned char *bp, *op;
-	tsize_t cc;
+	register unsigned char *bp, *op;
+	register tsize_t cc;
+	register int n;
 	tidata_t row;
-	tsize_t scanline, n;
+	tsize_t scanline;
 
 	(void) s;
 	/*
@@ -65,7 +66,7 @@ NeXTDecode(TIFF* tif, tidata_t buf, tsize_t occ, tsample_t s)
 	bp = (unsigned char *)tif->tif_rawcp;
 	cc = tif->tif_rawcc;
 	scanline = tif->tif_scanlinesize;
-	for (row = buf; occ > 0; occ -= scanline, row += scanline) {
+	for (row = buf; (long)occ > 0; occ -= scanline, row += scanline) {
 		n = *bp++, cc--;
 		switch (n) {
 		case LITERALROW:
@@ -79,10 +80,10 @@ NeXTDecode(TIFF* tif, tidata_t buf, tsize_t occ, tsample_t s)
 			cc -= scanline;
 			break;
 		case LITERALSPAN: {
-			tsize_t off;
+			int off;
 			/*
-			 * The scanline has a literal span that begins at some
-			 * offset.
+			 * The scanline has a literal span
+			 * that begins at some offset.
 			 */
 			off = (bp[0] * 256) + bp[1];
 			n = (bp[2] * 256) + bp[3];
@@ -94,27 +95,23 @@ NeXTDecode(TIFF* tif, tidata_t buf, tsize_t occ, tsample_t s)
 			break;
 		}
 		default: {
-			uint32 npixels = 0, grey;
-			uint32 imagewidth = tif->tif_dir.td_imagewidth;
+			register int npixels = 0, grey;
+			unsigned long imagewidth = tif->tif_dir.td_imagewidth;
 
 			/*
-			 * The scanline is composed of a sequence of constant
-			 * color ``runs''.  We shift into ``run mode'' and
-			 * interpret bytes as codes of the form
-			 * <color><npixels> until we've filled the scanline.
+			 * The scanline is composed of a sequence
+			 * of constant color ``runs''.  We shift
+			 * into ``run mode'' and interpret bytes
+			 * as codes of the form <color><npixels>
+			 * until we've filled the scanline.
 			 */
 			op = row;
 			for (;;) {
 				grey = (n>>6) & 0x3;
 				n &= 0x3f;
-				/*
-				 * Ensure the run does not exceed the scanline
-				 * bounds, potentially resulting in a security
-				 * issue.
-				 */
-				while (n-- > 0 && npixels < imagewidth)
+				while (n-- > 0)
 					SETPIXEL(op, grey);
-				if (npixels >= imagewidth)
+				if (npixels >= (int) imagewidth)
 					break;
 				if (cc == 0)
 					goto bad;