2022-04-19  Juan Manuel Guerrero  <juan.guerrero@gmx.de>

	* contrib/iptcutil/iptcutil.c [_O_BINARY]:  Define _O_BINARY as O_BINARY,
	_fileno as _fileno and _setmode as setmode.
	[__DJGPP__]:  Include <sys/exceptn.h> for __djgpp_set_ctrl_c declaration
	and <unistd.h> for isatty declaration.
	Define SET_BINARY macro.  For POSIX like OS this is a no-op.  For Win32
	it calls setmode.
	(main):  For DJGPP, call SET_BINARY to reenable SIGINT and SIGQUIT
	signals if stdin and/or stdout is connected to console and has been
	switched to binary mode.

	* libtiff/tif_jpeg.c (JPEGCleanup, JPEGPrintDir):  Assertion did not
	hold true, resulting in the client application calling abort().

	* tools/fax2ps.c [_O_BINARY]:  Define _O_BINARY as O_BINARY, _fileno as
	_fileno and _setmode as setmode.
	[__DJGPP__]:  Define SET_BINARY to have interruptible terminal reads
	and writes; include <unistd.h> for isatty declaration and
	<sys/exceptn.h> for __djgpp_set_ctrl_c declaration.  For POSIX like OS
	this is a no-op.  For Win32 it calls setmode.
	(main):  Use SET_BINARY instead of setmode() to reenable SIGINT and
	SIGQUIT if stdin and/or stdout is connected to console and has been
	switched to binary mode.

	* tools/ppm2tiff.c [_O_BINARY]:  Define _O_BINARY as O_BINARY, _fileno as
	_fileno and _setmode as setmode.
	[__DJGPP__]: Define SET_BINARY to have interruptible terminale reads
	and writes; include <unistd.h> for isatty declaration and
	<sys/exceptn.h> for __djgpp_set_ctrl_c declaration.  For POSIX like OS
	this is a no-op.  For Win32 it calls setmode.
	(main):  Use SET_BINARY instead of setmode() to reenable SIGINT and
	SIGQUIT if stdin and/or stdout is connected to console and has been
	switched to binary mode.





diff -aprNU5 tiff-4.3.0.orig/contrib/iptcutil/iptcutil.c tiff-4.3.0/contrib/iptcutil/iptcutil.c
--- tiff-4.3.0.orig/contrib/iptcutil/iptcutil.c	2021-03-05 13:01:42 +0000
+++ tiff-4.3.0/contrib/iptcutil/iptcutil.c	2022-04-19 23:26:44 +0000
@@ -9,10 +9,50 @@
 # include <strings.h>
 #endif
 
 #ifdef HAVE_IO_H
 # include <io.h>
+# ifdef _O_BINARY
+#  define _O_BINARY       O_BINARY
+#  define _fileno(f)      fileno(f)
+#  define _setmode(f, m)  setmode(f, m)
+# endif /* __O_BINARY */
+
+# ifdef __DJGPP__
+#  if defined (__GNUC__) && (__GNUC__ > 2 || (__GNUC__ == 2 && __GNUC_MINOR__ >= 8))
+#    define __gnuc_extension__  __extension__
+#  else
+#    define __gnuc_extension__
+#  endif
+
+#  include <unistd.h>       /* to declare isatty() */
+#  include <sys/exceptn.h>  /* to declare __djgpp_set_ctrl_c() */
+   /* This is DJGPP-specific.  By default, switching console
+      to binary mode disables SIGINT and SIGQUIT.  But it
+      is preferable to have terminal reads and writes to
+      be interruptible.  */
+#  define SET_BINARY(f)                                          \
+   (__gnuc_extension__                                           \
+     ({                                                          \
+        int file_descriptor = fileno(f);                         \
+        int previous_mode = setmode(file_descriptor, O_BINARY);  \
+        if (isatty(file_descriptor))                             \
+          __djgpp_set_ctrl_c(1);                                 \
+        previous_mode;                                           \
+     })                                                          \
+   )
+# endif /* __DJGPP__ */
+# ifdef WIN32
+#  define SET_BINARY(f)   (setmode(fileno(f), O_BINARY))
+# endif
+# ifdef __CYGWIN__
+#  define SET_BINARY(f)   /* */
+# endif
+#endif
+
+#ifndef SET_BINARY
+# define SET_BINARY(f)   /* */
 #endif
 
 #ifdef HAVE_FCNTL_H
 # include <fcntl.h>
 #endif
@@ -412,21 +452,17 @@ int main(int argc, char *argv[])
           c = argv[i][1];
           switch( c )
             {
             case 't':
               mode = 1;
-#ifdef _WIN32
               /* Set "stdout" to binary mode: */
-              _setmode( _fileno( ofile ), _O_BINARY );
-#endif
+              SET_BINARY(ofile);
               break;
             case 'b':
               mode = 0;
-#ifdef _WIN32
               /* Set "stdin" to binary mode: */
-              _setmode( _fileno( ifile ), _O_BINARY );
-#endif
+              SET_BINARY(ifile);
               break;
             case 'i':
               if (mode == 0)
                 ifile = fopen(argv[++i], "rb");
               else
diff -aprNU5 tiff-4.3.0.orig/libtiff/tif_jpeg.c tiff-4.3.0/libtiff/tif_jpeg.c
--- tiff-4.3.0.orig/libtiff/tif_jpeg.c	2021-03-05 13:01:42 +0000
+++ tiff-4.3.0/libtiff/tif_jpeg.c	2022-04-19 23:26:44 +0000
@@ -2233,11 +2233,11 @@ JPEGPostEncode(TIFF* tif)
 static void
 JPEGCleanup(TIFF* tif)
 {
 	JPEGState *sp = JState(tif);
 	
-	assert(sp != 0);
+	/* assert(sp != 0); */
 
 	tif->tif_tagmethods.vgetfield = sp->vgetparent;
 	tif->tif_tagmethods.vsetfield = sp->vsetparent;
 	tif->tif_tagmethods.printdir = sp->printdir;
         if( sp->cinfo_initialized )
@@ -2370,11 +2370,15 @@ JPEGVGetField(TIFF* tif, uint32_t tag, v
 static void
 JPEGPrintDir(TIFF* tif, FILE* fd, long flags)
 {
 	JPEGState* sp = JState(tif);
 
-	assert(sp != NULL);
+	/* assert(sp != NULL); */
+	if (sp == NULL) {
+		TIFFWarningExt(tif->tif_clientdata, "JPEGPrintDir", "Unknown JPEGState");
+		return;
+	}
 	(void) flags;
 
         if( sp != NULL ) {
 		if (TIFFFieldSet(tif,FIELD_JPEGTABLES))
 			fprintf(fd, "  JPEG Tables: (%"PRIu32" bytes)\n",
diff -aprNU5 tiff-4.3.0.orig/tools/fax2ps.c tiff-4.3.0/tools/fax2ps.c
--- tiff-4.3.0.orig/tools/fax2ps.c	2021-03-07 11:39:10 +0000
+++ tiff-4.3.0/tools/fax2ps.c	2022-04-19 23:26:44 +0000
@@ -38,10 +38,50 @@
 # include <fcntl.h>
 #endif
 
 #ifdef HAVE_IO_H
 # include <io.h>
+# ifdef _O_BINARY
+#  define _O_BINARY       O_BINARY
+#  define _fileno(f)      fileno(f)
+#  define _setmode(f, m)  setmode(f, m)
+# endif /* __O_BINARY */
+
+# ifdef __DJGPP__
+#  if defined (__GNUC__) && (__GNUC__ > 2 || (__GNUC__ == 2 && __GNUC_MINOR__ >= 8))
+#    define __gnuc_extension__  __extension__
+#  else
+#    define __gnuc_extension__
+#  endif
+
+#  include <unistd.h>       /* to declare isatty() */
+#  include <sys/exceptn.h>  /* to declare __djgpp_set_ctrl_c() */
+   /* This is DJGPP-specific.  By default, switching console
+      to binary mode disables SIGINT and SIGQUIT.  But it
+      is preferable to have terminal reads and writes to
+      be interruptible.  */
+#  define SET_BINARY(f)                                          \
+   (__gnuc_extension__                                           \
+     ({                                                          \
+        int file_descriptor = fileno(f);                         \
+        int previous_mode = setmode(file_descriptor, O_BINARY);  \
+        if (isatty(file_descriptor))                             \
+          __djgpp_set_ctrl_c(1);                                 \
+        previous_mode;                                           \
+     })                                                          \
+   )
+# endif /* __DJGPP__ */
+# ifdef WIN32
+#  define SET_BINARY(f)   (setmode(fileno(f), O_BINARY))
+# endif
+# ifdef __CYGWIN__
+#  define SET_BINARY(f)   /* */
+# endif
+#endif
+
+#ifndef SET_BINARY
+# define SET_BINARY(f)   /* */
 #endif
 
 #include "tiffiop.h"
 #include "tiffio.h"
 
@@ -398,13 +438,11 @@ main(int argc, char** argv)
 	fd = tmpfile();
 	if (fd == NULL) {
 	    fprintf(stderr, "Could not obtain temporary file.\n");
 	    exit(EXIT_FAILURE);
 	}
-#if defined(HAVE_SETMODE) && defined(O_BINARY)
-	setmode(fileno(stdin), O_BINARY);
-#endif
+	SET_BINARY(stdin);
 	while ((n = read(fileno(stdin), buf, sizeof (buf))) > 0) {
                 if (write(fileno(fd), buf, n) != n) {
                         fclose(fd);
                         fprintf(stderr,
                                 "Could not copy stdin to temporary file.\n");
diff -aprNU5 tiff-4.3.0.orig/tools/ppm2tiff.c tiff-4.3.0/tools/ppm2tiff.c
--- tiff-4.3.0.orig/tools/ppm2tiff.c	2021-03-07 11:39:10 +0000
+++ tiff-4.3.0/tools/ppm2tiff.c	2022-04-19 23:26:44 +0000
@@ -38,10 +38,50 @@
 # include <fcntl.h>
 #endif
 
 #ifdef HAVE_IO_H
 # include <io.h>
+# ifdef _O_BINARY
+#  define _O_BINARY       O_BINARY
+#  define _fileno(f)      fileno(f)
+#  define _setmode(f, m)  setmode(f, m)
+# endif /* __O_BINARY */
+
+# ifdef __DJGPP__
+#  if defined (__GNUC__) && (__GNUC__ > 2 || (__GNUC__ == 2 && __GNUC_MINOR__ >= 8))
+#    define __gnuc_extension__  __extension__
+#  else
+#    define __gnuc_extension__
+#  endif
+
+#  include <unistd.h>       /* to declare isatty() */
+#  include <sys/exceptn.h>  /* to declare __djgpp_set_ctrl_c() */
+   /* This is DJGPP-specific.  By default, switching console
+      to binary mode disables SIGINT and SIGQUIT.  But it
+      is preferable to have terminal reads and writes to
+      be interruptible.  */
+#  define SET_BINARY(f)                                          \
+   (__gnuc_extension__                                           \
+     ({                                                          \
+        int file_descriptor = fileno(f);                         \
+        int previous_mode = setmode(file_descriptor, O_BINARY);  \
+        if (isatty(file_descriptor))                             \
+          __djgpp_set_ctrl_c(1);                                 \
+        previous_mode;                                           \
+     })                                                          \
+   )
+# endif /* __DJGPP__ */
+# ifdef WIN32
+#  define SET_BINARY(f)   (setmode(fileno(f), O_BINARY))
+# endif
+# ifdef __CYGWIN__
+#  define SET_BINARY(f)   /* */
+# endif
+#endif
+
+#ifndef SET_BINARY
+# define SET_BINARY(f)   /* */
 #endif
 
 #include "tiffio.h"
 
 #ifndef EXIT_SUCCESS
@@ -238,13 +278,11 @@ main(int argc, char* argv[])
 			return (EXIT_FAILURE);
 		}
 	} else {
 		infile = "<stdin>";
 		in = stdin;
-#if defined(HAVE_SETMODE) && defined(O_BINARY)
-		setmode(fileno(stdin), O_BINARY);
-#endif
+		SET_BINARY(stdin);
 	}
 
 	if (fgetc(in) != 'P')
 		BadPPM(infile);
 	switch (fgetc(in)) {




2022-04-19  Juan Manuel Guerrero  <juan.guerrero@gmx.de>

	Applied all patches taken from tiff_4.3.0-6.debian.tar.xz available at
	http://ftp.de.debian.org/debian/pool/main/t/tiff/.
	See the ChangeLog file for changes.









diff -aprNU5 tiff-4.3.0.orig/html/man/RdRawStrip_3tiff.html tiff-4.3.0/html/man/RdRawStrip_3tiff.html
--- tiff-4.3.0.orig/html/man/RdRawStrip_3tiff.html	2021-03-05 13:01:42 +0000
+++ tiff-4.3.0/html/man/RdRawStrip_3tiff.html	2022-04-19 23:51:40 +0000
@@ -69,11 +69,11 @@ typically be at least as large as the nu
        cols="2" cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
 <td width="8%"></td>
 <td width="91%">
 <p>The actual number of bytes of data that were placed in
-<i>buf</i> is returned; <i>TIFFReadEncodedStrip</i> returns
+<i>buf</i> is returned; <i>TIFFReadRawStrip</i> returns
 &minus;1 if an error was encountered.</p>
 </td>
 </table>
 <a name="DIAGNOSTICS"></a>
 <h2>DIAGNOSTICS</h2>
diff -aprNU5 tiff-4.3.0.orig/libtiff/tif_dir.c tiff-4.3.0/libtiff/tif_dir.c
--- tiff-4.3.0.orig/libtiff/tif_dir.c	2021-03-05 13:01:42 +0000
+++ tiff-4.3.0/libtiff/tif_dir.c	2022-04-19 23:51:40 +0000
@@ -333,17 +333,17 @@ _TIFFVSetField(TIFF* tif, uint32_t tag,
 		else
 			setDoubleArrayOneValue(&td->td_smaxsamplevalue, va_arg(ap, double), td->td_samplesperpixel);
 		break;
 	case TIFFTAG_XRESOLUTION:
         dblval = va_arg(ap, double);
-        if( dblval < 0 )
+        if( dblval != dblval || dblval < 0 )
             goto badvaluedouble;
 		td->td_xresolution = _TIFFClampDoubleToFloat( dblval );
 		break;
 	case TIFFTAG_YRESOLUTION:
         dblval = va_arg(ap, double);
-        if( dblval < 0 )
+        if( dblval != dblval || dblval < 0 )
             goto badvaluedouble;
 		td->td_yresolution = _TIFFClampDoubleToFloat( dblval );
 		break;
 	case TIFFTAG_PLANARCONFIG:
 		v = (uint16_t) va_arg(ap, uint16_vap);
diff -aprNU5 tiff-4.3.0.orig/libtiff/tif_dirread.c tiff-4.3.0/libtiff/tif_dirread.c
--- tiff-4.3.0.orig/libtiff/tif_dirread.c	2021-03-07 18:37:24 +0000
+++ tiff-4.3.0/libtiff/tif_dirread.c	2022-04-19 23:51:40 +0000
@@ -4171,11 +4171,12 @@ TIFFReadDirectory(TIFF* tif)
                                                               "(%"PRIu16" 16 bit elements)",
                                 tif->tif_dir.td_extrasamples);
                     goto bad;
                 }
 
-                memcpy(new_sampleinfo, tif->tif_dir.td_sampleinfo, old_extrasamples * sizeof(uint16_t));
+                if (old_extrasamples > 0)
+                    memcpy(new_sampleinfo, tif->tif_dir.td_sampleinfo, old_extrasamples * sizeof(uint16_t));
                 _TIFFsetShortArray(&tif->tif_dir.td_sampleinfo, new_sampleinfo, tif->tif_dir.td_extrasamples);
                 _TIFFfree(new_sampleinfo);
         }
 
 	/*
@@ -5077,11 +5078,14 @@ TIFFFetchNormalTag(TIFF* tif, TIFFDirEnt
 						{
 							if (data!=NULL)
 								_TIFFfree(data);
 							return(0);
 						}
-						_TIFFmemcpy(o,data,(uint32_t)dp->tdir_count);
+						if (dp->tdir_count > 0 )
+						{
+							_TIFFmemcpy(o,data,(uint32_t)dp->tdir_count);
+						}
 						o[(uint32_t)dp->tdir_count]=0;
 						if (data!=0)
 							_TIFFfree(data);
 						data=o;
 					}
@@ -5763,12 +5767,13 @@ TIFFFetchStripThing(TIFF* tif, TIFFDirEn
 		resizeddata=(uint64_t*)_TIFFCheckMalloc(tif, nstrips, sizeof(uint64_t), "for strip array");
 		if (resizeddata==0) {
 			_TIFFfree(data);
 			return(0);
 		}
-                _TIFFmemcpy(resizeddata,data, (uint32_t)dir->tdir_count * sizeof(uint64_t));
-                _TIFFmemset(resizeddata+(uint32_t)dir->tdir_count, 0, (nstrips - (uint32_t)dir->tdir_count) * sizeof(uint64_t));
+		if( dir->tdir_count )
+			_TIFFmemcpy(resizeddata,data, (uint32_t)dir->tdir_count * sizeof(uint64_t));
+		_TIFFmemset(resizeddata+(uint32_t)dir->tdir_count, 0, (nstrips - (uint32_t)dir->tdir_count) * sizeof(uint64_t));
 		_TIFFfree(data);
 		data=resizeddata;
 	}
 	*lpp=data;
 	return(1);
diff -aprNU5 tiff-4.3.0.orig/libtiff/tif_jbig.c tiff-4.3.0/libtiff/tif_jbig.c
--- tiff-4.3.0.orig/libtiff/tif_jbig.c	2021-03-05 13:01:42 +0000
+++ tiff-4.3.0/libtiff/tif_jbig.c	2022-04-19 23:51:40 +0000
@@ -207,10 +207,20 @@ int TIFFInitJBIG(TIFF* tif, int scheme)
 	 * bits and when not to and to allow the jbig decoder and bit reverser
 	 * to write to memory when necessary.
 	 */
 	tif->tif_flags |= TIFF_NOBITREV;
 	tif->tif_flags &= ~TIFF_MAPPED;
+	/* We may have read from a previous IFD and thus set TIFF_BUFFERMMAP and
+	 * cleared TIFF_MYBUFFER. It is necessary to restore them to their initial
+	 * value to be consistent with the state of a non-memory mapped file.
+	 */
+	if (tif->tif_flags&TIFF_BUFFERMMAP) {
+		tif->tif_rawdata = NULL;
+		tif->tif_rawdatasize = 0;
+		tif->tif_flags &= ~TIFF_BUFFERMMAP;
+		tif->tif_flags |= TIFF_MYBUFFER;
+	}
 
 	/* Setup the function pointers for encode, decode, and cleanup. */
 	tif->tif_setupdecode = JBIGSetupDecode;
 	tif->tif_decodestrip = JBIGDecode;
 
diff -aprNU5 tiff-4.3.0.orig/man/RdRawStrip.3tiff tiff-4.3.0/man/RdRawStrip.3tiff
--- tiff-4.3.0.orig/man/RdRawStrip.3tiff	2021-03-05 13:01:42 +0000
+++ tiff-4.3.0/man/RdRawStrip.3tiff	2022-04-19 23:51:40 +0000
@@ -44,11 +44,11 @@ large as the number returned by
 .IR TIFFStripSize .
 .SH "RETURN VALUES"
 The actual number of bytes of data that were placed in
 .I buf
 is returned;
-.IR TIFFReadEncodedStrip
+.IR TIFFReadRawStrip
 returns \-1 if an error was encountered.
 .SH DIAGNOSTICS
 All error messages are directed to the
 .BR TIFFError (3TIFF)
 routine.
diff -aprNU5 tiff-4.3.0.orig/tools/tiffcp.c tiff-4.3.0/tools/tiffcp.c
--- tiff-4.3.0.orig/tools/tiffcp.c	2021-04-08 21:48:46 +0000
+++ tiff-4.3.0/tools/tiffcp.c	2022-04-19 23:51:40 +0000
@@ -1659,26 +1659,41 @@ DECLAREwriteFunc(writeBufferToSeparateSt
 	uint32_t rowsperstrip;
 	tsize_t stripsize = TIFFStripSize(out);
 	tdata_t obuf;
 	tstrip_t strip = 0;
 	tsample_t s;
+	uint16_t bps = 0, bytes_per_sample;
 
 	obuf = limitMalloc(stripsize);
 	if (obuf == NULL)
 		return (0);
 	_TIFFmemset(obuf, 0, stripsize);
 	(void) TIFFGetFieldDefaulted(out, TIFFTAG_ROWSPERSTRIP, &rowsperstrip);
+	(void) TIFFGetField(out, TIFFTAG_BITSPERSAMPLE, &bps);
+	if( bps == 0 )
+        {
+            TIFFError(TIFFFileName(out), "Error, cannot read BitsPerSample");
+            _TIFFfree(obuf);
+            return 0;
+        }
+        if( (bps % 8) != 0 )
+        {
+            TIFFError(TIFFFileName(out), "Error, cannot handle BitsPerSample that is not a multiple of 8");
+            _TIFFfree(obuf);
+            return 0;
+        }
+	bytes_per_sample = bps/8;
 	for (s = 0; s < spp; s++) {
 		uint32_t row;
 		for (row = 0; row < imagelength; row += rowsperstrip) {
 			uint32_t nrows = (row + rowsperstrip > imagelength) ?
 			    imagelength-row : rowsperstrip;
 			tsize_t stripsize = TIFFVStripSize(out, nrows);
 
 			cpContigBufToSeparateBuf(
 			    obuf, (uint8_t*) buf + row * rowsize + s,
-			    nrows, imagewidth, 0, 0, spp, 1);
+			    nrows, imagewidth, 0, 0, spp, bytes_per_sample);
 			if (TIFFWriteEncodedStrip(out, strip++, obuf, stripsize) < 0) {
 				TIFFError(TIFFFileName(out),
 				    "Error, can't write strip %"PRIu32,
 				    strip - 1u);
 				_TIFFfree(obuf);
diff -aprNU5 tiff-4.3.0.orig/tools/tiffcrop.c tiff-4.3.0/tools/tiffcrop.c
--- tiff-4.3.0.orig/tools/tiffcrop.c	2021-03-07 18:09:46 +0000
+++ tiff-4.3.0/tools/tiffcrop.c	2022-04-19 23:51:40 +0000
@@ -103,12 +103,12 @@
  *                selects which functions dump data, with higher numbers selecting
  *                lower level, scanline level routines. Debug reports a limited set
  *                of messages to monitor progress without enabling dump logs.
  */
 
-static   char tiffcrop_version_id[] = "2.4";
-static   char tiffcrop_rev_date[] = "12-13-2010";
+static   char tiffcrop_version_id[] = "2.4.1";
+static   char tiffcrop_rev_date[] = "03-03-2010";
 
 #include "tif_config.h"
 #include "libport.h"
 #include "tiffiop.h"
 
@@ -6708,24 +6708,23 @@ extractImageSection(struct image_data *i
 
   uint32_t    img_width, img_rowsize;
 #ifdef DEVELMODE
   uint32_t    img_length;
 #endif
-  uint32_t    j, shift1, shift2, trailing_bits;
+  uint32_t    j, shift1, trailing_bits;
   uint32_t    row, first_row, last_row, first_col, last_col;
   uint32_t    src_offset, dst_offset, row_offset, col_offset;
-  uint32_t    offset1, offset2, full_bytes;
+  uint32_t    offset1, full_bytes;
   uint32_t    sect_width;
 #ifdef DEVELMODE
   uint32_t    sect_length;
 #endif
   uint16_t    bps, spp;
 
 #ifdef DEVELMODE
   int      k;
   unsigned char bitset;
-  static char *bitarray = NULL;
 #endif
 
   img_width = image->width;
 #ifdef DEVELMODE
   img_length = image->length;
@@ -6739,33 +6738,33 @@ extractImageSection(struct image_data *i
 #endif
   src_offset = 0;
   dst_offset = 0;
 
 #ifdef DEVELMODE
-  if (bitarray == NULL)
-    {
-    if ((bitarray = (char *)malloc(img_width)) == NULL)
-      {
-      TIFFError ("", "DEBUG: Unable to allocate debugging bitarray");
-      return (-1);
-      }
-    }
+  char bitarray[39];
 #endif
 
-  /* rows, columns, width, length are expressed in pixels */
+  /* rows, columns, width, length are expressed in pixels
+   * first_row, last_row, .. are index into image array starting at 0 to width-1,
+   * last_col shall be also extracted.  */
   first_row = section->y1;
   last_row  = section->y2;
   first_col = section->x1;
   last_col  = section->x2;
 
   sect_width = last_col - first_col + 1;
 #ifdef DEVELMODE
   sect_length = last_row - first_row + 1;
 #endif
-  img_rowsize = ((img_width * bps + 7) / 8) * spp;
-  full_bytes = (sect_width * spp * bps) / 8;   /* number of COMPLETE bytes per row in section */
-  trailing_bits = (sect_width * bps) % 8;
+    /* The read function loadImage() used copy separate plane data into a buffer as interleaved
+     * samples rather than separate planes so the same logic works to extract regions
+     * regardless of the way the data are organized in the input file.
+     * Furthermore, bytes and bits are arranged in buffer according to COMPRESSION=1 and FILLORDER=1 
+     */
+    img_rowsize = (((img_width * spp * bps) + 7) / 8);    /* row size in full bytes of source image */
+    full_bytes = (sect_width * spp * bps) / 8;            /* number of COMPLETE bytes per row in section */
+    trailing_bits = (sect_width * spp * bps) % 8;         /* trailing bits within the last byte of destination buffer */
 
 #ifdef DEVELMODE
     TIFFError ("", "First row: %"PRIu32", last row: %"PRIu32", First col: %"PRIu32", last col: %"PRIu32"\n",
            first_row, last_row, first_col, last_col);
     TIFFError ("", "Image width: %"PRIu32", Image length: %"PRIu32", bps: %"PRIu16", spp: %"PRIu16"\n",
@@ -6774,14 +6773,13 @@ extractImageSection(struct image_data *i
            sect_width, sect_length, full_bytes, trailing_bits);
 #endif
 
   if ((bps % 8) == 0)
     {
-    col_offset = first_col * spp * bps / 8;
+    col_offset = (first_col * spp * bps) / 8;
     for (row = first_row; row <= last_row; row++)
       {
-      /* row_offset = row * img_width * spp * bps / 8; */
       row_offset = row * img_rowsize;
       src_offset = row_offset + col_offset;
 
 #ifdef DEVELMODE
         TIFFError ("", "Src offset: %8"PRIu32", Dst offset: %8"PRIu32, src_offset, dst_offset); 
@@ -6790,18 +6788,16 @@ extractImageSection(struct image_data *i
       dst_offset += full_bytes;
       }        
     }
   else
     { /* bps != 8 */
-    shift1  = spp * ((first_col * bps) % 8);
-    shift2  = spp * ((last_col * bps) % 8);
+    shift1 = ((first_col * spp * bps) % 8);           /* shift1 = bits to skip in the first byte of source buffer*/
     for (row = first_row; row <= last_row; row++)
       {
       /* pull out the first byte */
       row_offset = row * img_rowsize;
-      offset1 = row_offset + (first_col * bps / 8);
-      offset2 = row_offset + (last_col * bps / 8);
+      offset1 = row_offset + ((first_col * spp * bps) / 8);   /* offset1 = offset into source of byte with first bits to be extracted */
 
 #ifdef DEVELMODE
       for (j = 0, k = 7; j < 8; j++, k--)
         {
         bitset = *(src_buff + offset1) & (((unsigned char)1 << k)) ? 1 : 0;
@@ -6809,16 +6805,16 @@ extractImageSection(struct image_data *i
         }
       sprintf(&bitarray[8], " ");
       sprintf(&bitarray[9], " ");
       for (j = 10, k = 7; j < 18; j++, k--)
         {
-        bitset = *(src_buff + offset2) & (((unsigned char)1 << k)) ? 1 : 0;
+        bitset = *(src_buff + offset1 + full_bytes) & (((unsigned char)1 << k)) ? 1 : 0;
         sprintf(&bitarray[j], (bitset) ? "1" : "0");
         }
       bitarray[18] = '\0';
-      TIFFError ("", "Row: %3d Offset1: %"PRIu32",  Shift1: %"PRIu32",    Offset2: %"PRIu32",  Shift2:  %"PRIu32"\n", 
-                 row, offset1, shift1, offset2, shift2); 
+      TIFFError ("", "Row: %3d Offset1: %"PRIu32",  Shift1: %"PRIu32",    Offset2: %"PRIu32",  Trailing_bits:  %"PRIu32"\n", 
+                 row, offset1, shift1, offset1+full_bytes, trailing_bits); 
 #endif
 
       bytebuff1 = bytebuff2 = 0;
       if (shift1 == 0) /* the region is byte and sample aligned */
         {
@@ -6838,15 +6834,16 @@ extractImageSection(struct image_data *i
 #endif
         dst_offset += full_bytes;
 
         if (trailing_bits != 0)
           {
-	  bytebuff2 = src_buff[offset2] & ((unsigned char)255 << (7 - shift2));
+      /* Only copy higher bits of samples and mask lower bits of not wanted column samples to zero */
+	  bytebuff2 = src_buff[offset1 + full_bytes] & ((unsigned char)255 << (8 - trailing_bits));
           sect_buff[dst_offset] = bytebuff2;
 #ifdef DEVELMODE
 	  TIFFError ("", "        Trailing bits src offset:  %8"PRIu32", Dst offset: %8"PRIu32"\n",
-                              offset2, dst_offset); 
+          offset1 + full_bytes, dst_offset);
           for (j = 30, k = 7; j < 38; j++, k--)
             {
             bitset = *(sect_buff + dst_offset) & (((unsigned char)1 << k)) ? 1 : 0;
             sprintf(&bitarray[j], (bitset) ? "1" : "0");
             }
@@ -6861,12 +6858,14 @@ extractImageSection(struct image_data *i
 #ifdef DEVELMODE
 	  TIFFError ("", "        Unalligned data src offset: %8"PRIu32", Dst offset: %8"PRIu32"\n", offset1 , dst_offset);
 #endif
         for (j = 0; j <= full_bytes; j++) 
           {
-	  bytebuff1 = src_buff[offset1 + j] & ((unsigned char)255 >> shift1);
-	  bytebuff2 = src_buff[offset1 + j + 1] & ((unsigned char)255 << (7 - shift1));
+          /* Skip the first shift1 bits and shift the source up by shift1 bits before save to destination.*/
+          /* Attention: src_buff size needs to be some bytes larger than image size, because could read behind image here. */
+          bytebuff1 = src_buff[offset1 + j] & ((unsigned char)255 >> shift1);
+          bytebuff2 = src_buff[offset1 + j + 1] & ((unsigned char)255 << (8 - shift1));
           sect_buff[dst_offset + j] = (bytebuff1 << shift1) | (bytebuff2 >> (8 - shift1));
           }
 #ifdef DEVELMODE
 	sprintf(&bitarray[18], "\n");
 	sprintf(&bitarray[19], "\t");
@@ -6878,40 +6877,21 @@ extractImageSection(struct image_data *i
         bitarray[28] = ' ';
         bitarray[29] = ' ';
 #endif
         dst_offset += full_bytes;
 
+        /* Copy the trailing_bits for the last byte in the destination buffer. 
+           Could come from one ore two bytes of the source buffer. */
         if (trailing_bits != 0)
           {
 #ifdef DEVELMODE
-	    TIFFError ("", "        Trailing bits   src offset: %8"PRIu32", Dst offset: %8"PRIu32"\n", offset1 + full_bytes, dst_offset);
-#endif
-	  if (shift2 > shift1)
-            {
-	    bytebuff1 = src_buff[offset1 + full_bytes] & ((unsigned char)255 << (7 - shift2));
-            bytebuff2 = bytebuff1 & ((unsigned char)255 << shift1);
-            sect_buff[dst_offset] = bytebuff2;
-#ifdef DEVELMODE
-	    TIFFError ("", "        Shift2 > Shift1\n"); 
+          TIFFError("", "        Trailing bits %4"PRIu32"   src offset: %8"PRIu32", Dst offset: %8"PRIu32"\n", trailing_bits, offset1 + full_bytes, dst_offset);
 #endif
+          /* More than necessary bits are already copied into last destination buffer, 
+           * only masking of last byte in destination buffer is necessary.*/ 
+          sect_buff[dst_offset] &= ((uint8_t)0xFF << (8 - trailing_bits));
             }
-          else
-            {
-	    if (shift2 < shift1)
-              {
-              bytebuff2 = ((unsigned char)255 << (shift1 - shift2 - 1));
-	      sect_buff[dst_offset] &= bytebuff2;
-#ifdef DEVELMODE
-	      TIFFError ("", "        Shift2 < Shift1\n"); 
-#endif
-              }
-#ifdef DEVELMODE
-            else
-	      TIFFError ("", "        Shift2 == Shift1\n"); 
-#endif
-            }
-	  }
 #ifdef DEVELMODE
 	  sprintf(&bitarray[28], " ");
 	  sprintf(&bitarray[29], " ");
           for (j = 30, k = 7; j < 38; j++, k--)
             {
@@ -7060,11 +7040,11 @@ writeImageSections(TIFF *in, TIFF *out,
   for (i = 0; i < k; i++)
     {
     width  = sections[i].x2 - sections[i].x1 + 1;
     length = sections[i].y2 - sections[i].y1 + 1;
     sectsize = (uint32_t)
-	    ceil((width * image->bps + 7) / (double)8) * image->spp * length;
+	    ceil((width * image->bps * image->spp + 7) / (double)8) * length;
     /* allocate a buffer if we don't have one already */
     if (createImageSection(sectsize, sect_buff_ptr))
       {
       TIFFError("writeImageSections", "Unable to allocate section buffer");
       exit(EXIT_FAILURE);
@@ -7375,11 +7355,15 @@ createImageSection(uint32_t sectsize, un
   sect_buff = *sect_buff_ptr;
 
   if (!sect_buff)
     {
     sect_buff = (unsigned char *)limitMalloc(sectsize);
-    *sect_buff_ptr = sect_buff;
+    if (!sect_buff)
+    {
+        TIFFError("createImageSection", "Unable to allocate/reallocate section buffer");
+        return (-1);
+    }
     _TIFFmemset(sect_buff, 0, sectsize);
     }
   else
     {
     if (prev_sectsize < sectsize)
@@ -7391,19 +7375,19 @@ createImageSection(uint32_t sectsize, un
         sect_buff = (unsigned char *)limitMalloc(sectsize);
         }
       else
         sect_buff = new_buff;
 
+      if (!sect_buff)
+      {
+          TIFFError("createImageSection", "Unable to allocate/reallocate section buffer");
+          return (-1);
+      }
       _TIFFmemset(sect_buff, 0, sectsize);
       }
     }
 
-  if (!sect_buff)
-    {
-    TIFFError("createImageSection", "Unable to allocate/reallocate section buffer");
-    return (-1);
-    }
   prev_sectsize = sectsize;
   *sect_buff_ptr = sect_buff;
 
   return (0);
   }  /* end createImageSection */
@@ -7666,11 +7650,15 @@ createCroppedImage(struct image_data *im
   cropsize = crop->bufftotal;
   crop_buff = *crop_buff_ptr;
   if (!crop_buff)
     {
     crop_buff = (unsigned char *)limitMalloc(cropsize);
-    *crop_buff_ptr = crop_buff;
+    if (!crop_buff)
+    {
+        TIFFError("createCroppedImage", "Unable to allocate/reallocate crop buffer");
+        return (-1);
+    }
     _TIFFmemset(crop_buff, 0, cropsize);
     prev_cropsize = cropsize;
     }
   else
     {
@@ -7682,19 +7670,19 @@ createCroppedImage(struct image_data *im
 	free (crop_buff);
         crop_buff = (unsigned char *)limitMalloc(cropsize);
         }
       else
         crop_buff = new_buff;
+      if (!crop_buff)
+      {
+          TIFFError("createCroppedImage", "Unable to allocate/reallocate crop buffer");
+          return (-1);
+      }
       _TIFFmemset(crop_buff, 0, cropsize);
       }
     }
 
-  if (!crop_buff)
-    {
-    TIFFError("createCroppedImage", "Unable to allocate/reallocate crop buffer");
-    return (-1);
-    }
   *crop_buff_ptr = crop_buff;
 
   if (crop->crop_mode & CROP_INVERT)
     {
     switch (crop->photometric)
@@ -9249,5 +9237,6 @@ invertImage(uint16_t photometric, uint16
  * mode: c
  * c-basic-offset: 8
  * fill-column: 78
  * End:
  */
+
diff -aprNU5 tiff-4.3.0.orig/tools/tiffset.c tiff-4.3.0/tools/tiffset.c
--- tiff-4.3.0.orig/tools/tiffset.c	2021-03-07 11:39:10 +0000
+++ tiff-4.3.0/tools/tiffset.c	2022-04-19 23:51:40 +0000
@@ -144,13 +144,23 @@ main(int argc, char* argv[])
             if (!fip)
                 return 3;
 
             arg_index++;
             if (TIFFFieldDataType(fip) == TIFF_ASCII) {
-                if (TIFFSetField(tiff, TIFFFieldTag(fip), argv[arg_index]) != 1)
-                    fprintf( stderr, "Failed to set %s=%s\n",
-                             TIFFFieldName(fip), argv[arg_index] );
+                if(TIFFFieldPassCount( fip )) {
+                    size_t len;
+                    len = strlen(argv[arg_index]) + 1;
+                    if (len > UINT16_MAX || TIFFSetField(tiff, TIFFFieldTag(fip),
+                            (uint16_t)len, argv[arg_index]) != 1)
+                        fprintf( stderr, "Failed to set %s=%s\n",
+                            TIFFFieldName(fip), argv[arg_index] );
+                } else {
+                    if (TIFFSetField(tiff, TIFFFieldTag(fip),
+                            argv[arg_index]) != 1)
+                        fprintf( stderr, "Failed to set %s=%s\n",
+                            TIFFFieldName(fip), argv[arg_index] );
+                }
             } else if (TIFFFieldWriteCount(fip) > 0
 		       || TIFFFieldWriteCount(fip) == TIFF_VARIABLE) {
                 int     ret = 1;
                 short   wc;
 
