Merge commit '9c2216976907336dfae0e8e38a4d70ca2465a92c'

* commit '9c2216976907336dfae0e8e38a4d70ca2465a92c':
  tiff: do not overread the source buffer

Conflicts:
	libavcodec/tiff.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

libavcodec/tiff.c

@@ -577,15 +577,12 @@ static int tiff_unpack_strip(TiffContext *s, uint8_t *dst, int stride,
                 code = s->fill_order ? (int8_t) ff_reverse[*src++]: (int8_t) *src++;
                 if (code >= 0) {
                     code++;
-                    if (pixels + code > width) {
+                    if (pixels + code > width ||
+                        ssrc + size - src < code) {
                         av_log(s->avctx, AV_LOG_ERROR,
                                "Copy went out of bounds\n");
                         return AVERROR_INVALIDDATA;
                     }
-                    if (ssrc + size - src < code) {
-                        av_log(s->avctx, AV_LOG_ERROR, "Read went out of bounds\n");
-                        return AVERROR_INVALIDDATA;
-                    }
                     horizontal_fill(s->bpp * (s->avctx->pix_fmt == AV_PIX_FMT_PAL8),
                                     dst, 1, src, 0, code, pixels);
                     src    += code;