From Michael Henheffer, "Bug: The reader would crash when trying to load a .tif image that

contained an 8-bit color map.  The crash occured at line 545:

remap_row(currPtr, inbuf, w, red, green, blue);


Cause:  The code was trying to write past the end of the buffer while
doing this remapping.  The size of the buffer is determined based on the
value of 'format', which was 1 in this case since bitspersample is
8(indicating a 8-bit color map).  The buffer should have been created 3
times as large since that 8-bit value is indexing a 24-bit color.


Fix:  I've put in an if statement to set format to 3 if 'photometric'
indicates the tif contains a palette as the output data will always be
24-bit color data in this case."

src/osgPlugins/tiff/ReaderWriterTIFF.cpp

@@ -472,7 +472,14 @@ int *numComponents_ret)
     else
         format = 3;
     */
-    format = samplesperpixel * bitspersample / 8;
+    // if it has a palette, data returned is 3 byte rgb
+    // so set format to 3.
+    if (photometric == PHOTOMETRIC_PALETTE)
+        format = 3; 
+    else
+        format = samplesperpixel * bitspersample / 8;
+    
+    
 
     buffer = new unsigned char [w*h*format];
     for(unsigned char* ptr=buffer;ptr<buffer+w*h*format;++ptr) *ptr = 0;