Would you mind to provide a sample TIFF file for proof of concept?

Via e-mail or within an issue (i.e. work item) at
https://gitlab.com/libtiff/libtiff 

-----Ursprüngliche Nachricht-----
Von: Tiff [mailto:[email protected]] Im Auftrag von Nashit Hayat
via Tiff
Gesendet: Donnerstag, 2. Juli 2026 12:30
An: [email protected]
Betreff: [Tiff] [PATCH] tif_getimage: scale fromskew by samplesperpixel in
8-bit grey/palette put routines

The contiguous put routines in the RGBA read path use the fromskew argument
to advance the source pointer over the source columns that are skipped
between two output rows (the clipped part of an edge tile, or the columns
beyond the requested raster width for a strip). fromskew is expressed in
pixels, so it has to be multiplied by the per-pixel sample stride, exactly
as the inner loops advance pp by samplesperpixel for every pixel.

put8bitcmaptile(), putgreytile() and putagreytile() instead did

    pp += fromskew;

without multiplying by samplesperpixel. For greyscale or palette images that
have more than one sample per pixel (i.e. extra samples in a contiguous
configuration) and where fromskew is non-zero - a tiled image whose width is
not a multiple of the tile width, or a sub-region read via
img->col_offset - the source pointer is advanced by too few bytes 
img->between
rows, and every row after the first reads its samples from the wrong offset
inside the decoded tile/strip buffer. The result is corrupted pixel data in
the affected columns.

putRGBcontig8bittile() and, more recently, put16bitbwtile() already scale
fromskew by the sample stride; apply the same conversion here so all of the
contiguous put routines are consistent.

Signed-off-by: Nashit Hayat <[email protected]>
---
diff --git a/libtiff/tif_getimage.c b/libtiff/tif_getimage.c index
4a759a6..80f68a5 100644
--- a/libtiff/tif_getimage.c
+++ b/libtiff/tif_getimage.c
@@ -1626,6 +1626,8 @@ DECLAREContigPutFunc(put8bitcmaptile)
 {
     uint32_t **PALmap = img->PALmap;
     int samplesperpixel = img->samplesperpixel;
+    /* Convert pixel skew to sample skew */
+    const tmsize_t fromskewLocal = (tmsize_t)fromskew * 
+ (tmsize_t)samplesperpixel;
 
     (void)y;
     for (; h > 0; --h)
@@ -1636,7 +1638,7 @@ DECLAREContigPutFunc(put8bitcmaptile)
             pp += samplesperpixel;
         }
         cp += toskew;
-        pp += fromskew;
+        pp += fromskewLocal;
     }
 }
 
@@ -1704,6 +1706,8 @@ DECLAREContigPutFunc(putgreytile)  {
     int samplesperpixel = img->samplesperpixel;
     uint32_t **BWmap = img->BWmap;
+    /* Convert pixel skew to sample skew */
+    const tmsize_t fromskewLocal = (tmsize_t)fromskew * 
+ (tmsize_t)samplesperpixel;
 
     (void)y;
     for (; h > 0; --h)
@@ -1714,7 +1718,7 @@ DECLAREContigPutFunc(putgreytile)
             pp += samplesperpixel;
         }
         cp += toskew;
-        pp += fromskew;
+        pp += fromskewLocal;
     }
 }
 
@@ -1725,6 +1729,8 @@ DECLAREContigPutFunc(putagreytile)
 {
     int samplesperpixel = img->samplesperpixel;
     uint32_t **BWmap = img->BWmap;
+    /* Convert pixel skew to sample skew */
+    const tmsize_t fromskewLocal = (tmsize_t)fromskew * 
+ (tmsize_t)samplesperpixel;
 
     (void)y;
     for (; h > 0; --h)
@@ -1735,7 +1741,7 @@ DECLAREContigPutFunc(putagreytile)
             pp += samplesperpixel;
         }
         cp += toskew;
-        pp += fromskew;
+        pp += fromskewLocal;
     }
 }
 
--
2.50.1 (Apple Git-155)
_______________________________________________
Tiff mailing list
[email protected]
https://lists.osgeo.org/mailman/listinfo/tiff

_______________________________________________
Tiff mailing list
[email protected]
https://lists.osgeo.org/mailman/listinfo/tiff

Reply via email to