--- tiff-v3.6.1/libtiff/tif_dirread.c.cve-2005-1544	2006-02-02 12:44:38.560173727 -0700
+++ tiff-v3.6.1/libtiff/tif_dirread.c	2006-02-02 13:09:37.187792562 -0700
@@ -1268,12 +1268,16 @@
 		uint16 buf[10];
 		uint16* v = buf;
 
-		if (samples > NITEMS(buf))
-			v = (uint16*) CheckMalloc(tif, samples, sizeof (uint16),
+		if (dir->tdir_count > NITEMS(buf))
+			v = (uint16*) CheckMalloc(tif, dir->tdir_count, sizeof (uint16),
 						  "to fetch per-sample values");
 		if (v && TIFFFetchShortArray(tif, dir, v)) {
 			int i;
-			for (i = 1; i < samples; i++)
+			int check_count = dir->tdir_count;
+			if( samples < check_count )
+				check_count = samples;
+				
+			for (i = 1; i < check_count; i++)
 				if (v[i] != v[0]) {
 					TIFFError(tif->tif_name,
 		"Cannot handle different per-sample values for field \"%s\"",
@@ -1305,12 +1309,16 @@
 		double buf[10];
 		double* v = buf;
 
-		if (samples > NITEMS(buf))
-			v = (double*) CheckMalloc(tif, samples, sizeof (double),
+		if (dir->tdir_count > NITEMS(buf))
+			v = (double*) CheckMalloc(tif, dir->tdir_count, sizeof (double),
 						  "to fetch per-sample values");
 		if (v && TIFFFetchAnyArray(tif, dir, v)) {
 			int i;
-			for (i = 1; i < samples; i++)
+			int check_count = dir->tdir_count;
+			if( samples < check_count )
+				check_count = samples;
+				
+			for (i = 1; i < check_count; i++)
 				if (v[i] != v[0]) {
 					TIFFError(tif->tif_name,
 		"Cannot handle different per-sample values for field \"%s\"",