Fix for CVE-2021-25291

* Invalid tile boundaries lead to OOB Read in TiffDecode.c, in TiffReadRGBATile
* Check the tile validity before attempting to read.

(cherry picked from commit 8b8076bdcb)

CHANGES.rst

@@ -15,6 +15,9 @@ since Pillow 4.3.0.
 - Fix CVE-2021-2791
   [rickprice]
 
+- Fix CVE-2021-25291
+  [rickprice]
+
 6.2.2.3 (2023-02-23)
 ------------------
 

Tests/test_tiff_crashes.py

@@ -1,11 +1,50 @@
+# Reproductions/tests for crashes/read errors in TiffDecode.c
+
+# When run in Python, all of these images should fail for
+# one reason or another, either as a buffer overrun,
+# unrecognized datastream, or truncated image file.
+# There shouldn't be any segfaults.
+#
+# if run like
+# `valgrind --tool=memcheck pytest test_tiff_crashes.py 2>&1 | grep TiffDecode.c`
+# the output should be empty. There may be Python issues
+# in the valgrind especially if run in a debug Python
+# version.
+
 import pytest
 
 from PIL import Image
 
+from .helper import on_ci
+
+
+@pytest.mark.parametrize(
+    "test_file",
+    [
+        "Tests/images/crash_1.tif",
+        "Tests/images/crash_2.tif",
+        "Tests/images/crash-2020-10-test.tif",
+        "Tests/images/crash-0c7e0e8e11ce787078f00b5b0ca409a167f070e0.tif",
+        "Tests/images/crash-0e16d3bfb83be87356d026d66919deaefca44dac.tif",
+        "Tests/images/crash-1152ec2d1a1a71395b6f2ce6721c38924d025bf3.tif",
+        "Tests/images/crash-1185209cf7655b5aed8ae5e77784dfdd18ab59e9.tif",
+        "Tests/images/crash-338516dbd2f0e83caddb8ce256c22db3bd6dc40f.tif",
+        "Tests/images/crash-4f085cc12ece8cde18758d42608bed6a2a2cfb1c.tif",
+        "Tests/images/crash-86214e58da443d2b80820cff9677a38a33dcbbca.tif",
+        "Tests/images/crash-f46f5b2f43c370fe65706c11449f567ecc345e74.tif",
+        "Tests/images/crash-63b1dffefc8c075ddc606c0a2f5fdc15ece78863.tif",
+    ],
+)
 @pytest.mark.filterwarnings("ignore:Possibly corrupt EXIF data")
 @pytest.mark.filterwarnings("ignore:Metadata warning")
-def test_tiff_crashes():
+def test_tiff_crashes(test_file):
-    test_file = "Tests/images/crash-63b1dffefc8c075ddc606c0a2f5fdc15ece78863.tif"
+    try:
-    with pytest.raises(IOError):
         with Image.open(test_file) as im:
             im.load()
+    except FileNotFoundError:
+        if not on_ci():
+            pytest.skip("test image not found")
+            return
+        raise
+    except OSError:
+        pass

docs/releasenotes/6.2.2.4.rst

@@ -9,4 +9,6 @@ This release addresses several critical CVEs.
 :cve:`CVE-2021-25293`: There is an out-of-bounds read in ``SgiRleDecode.c``,
 since Pillow 4.3.0.
 
-:cve: `CVE-2021-2791` : Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.
+:cve: `CVE-2021-25291`: An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in TiffreadRGBATile via invalid tile boundaries.
+
+

src/libImaging/TiffDecode.c

@@ -20,6 +20,17 @@
 
 #include "TiffDecode.h"
 
+/* Convert C file descriptor to WinApi HFILE if LibTiff was compiled with tif_win32.c
+ *
+ * This cast is safe, as the top 32-bits of HFILE are guaranteed to be zero,
+ * see https://docs.microsoft.com/en-us/windows/win32/winprog64/interprocess-communication
+ */
+#ifndef USE_WIN32_FILEIO
+#define fd_to_tiff_fd(fd) (fd)
+#else
+#define fd_to_tiff_fd(fd) ((int)_get_osfhandle(fd))
+#endif
+
 void dump_state(const TIFFSTATE *state){
     TRACE(("State: Location %u size %d eof %d data: %p ifd: %d\n", (uint)state->loc,
            (int)state->size, (uint)state->eof, state->data, state->ifd));
@@ -36,6 +47,10 @@ tsize_t _tiffReadProc(thandle_t hdata, tdata_t buf, tsize_t size) {
     TRACE(("_tiffReadProc: %d \n", (int)size));
     dump_state(state);
 
+    if (state->loc > state->eof) {
+        TIFFError("_tiffReadProc", "Invalid Read at loc %d, eof: %d", state->loc, state->eof);
+        return 0;
+    }
     to_read = min(size, min(state->size, (tsize_t)state->eof) - (tsize_t)state->loc);
     TRACE(("to_read: %d\n", (int)to_read));
 
@@ -170,111 +185,171 @@ int ImagingLibTiffInit(ImagingCodecState state, int fp, uint32 offset) {
 }
 
 
-int ReadTile(TIFF* tiff, UINT32 col, UINT32 row, UINT32* buffer) {
+int _decodeStripYCbCr(Imaging im, ImagingCodecState state, TIFF *tiff) {
-    uint16 photometric;
-
-    TIFFGetField(tiff, TIFFTAG_PHOTOMETRIC, &photometric);
-
     // To avoid dealing with YCbCr subsampling, let libtiff handle it
-    if (photometric == PHOTOMETRIC_YCBCR) {
+    // Use a TIFFRGBAImage wrapping the tiff image, and let libtiff handle
-        UINT32 tile_width, tile_height, swap_line_size, i_row;
+    // all of the conversion. Metadata read from the TIFFRGBAImage could
-        UINT32* swap_line;
+    // be different from the metadata that the base tiff returns. 
 
-        TIFFGetField(tiff, TIFFTAG_TILEWIDTH, &tile_width);
+    INT32 strip_row;
-        TIFFGetField(tiff, TIFFTAG_TILELENGTH, &tile_height);
+    UINT8 *new_data;
+    UINT32 rows_per_strip, row_byte_size, rows_to_read;
+    int ret;
+    TIFFRGBAImage img;
+    char emsg[1024] = "";
 
-        swap_line_size = tile_width * sizeof(UINT32);
+    ret = TIFFGetFieldDefaulted(tiff, TIFFTAG_ROWSPERSTRIP, &rows_per_strip);
-        if (tile_width != swap_line_size / sizeof(UINT32)) {
+    if (ret != 1) {
-            return -1;
+        rows_per_strip = state->ysize;
-        }
-
-        /* Read the tile into an RGBA array */
-        if (!TIFFReadRGBATile(tiff, col, row, buffer)) {
-            return -1;
-        }
-
-        swap_line = (UINT32*)malloc(swap_line_size);
-        if (swap_line == NULL) {
-            return -1;
-        }
-        /*
-         * For some reason the TIFFReadRGBATile() function chooses the
-         * lower left corner as the origin.  Vertically mirror scanlines.
-         */
-        for(i_row = 0; i_row < tile_height / 2; i_row++) {
-            UINT32 *top_line, *bottom_line;
-
-            top_line = buffer + tile_width * i_row;
-            bottom_line = buffer + tile_width * (tile_height - i_row - 1);
-
-            memcpy(swap_line, top_line, 4*tile_width);
-            memcpy(top_line, bottom_line, 4*tile_width);
-            memcpy(bottom_line, swap_line, 4*tile_width);
-        }
-
-        free(swap_line);
-
-        return 0;
     }
+    TRACE(("RowsPerStrip: %u \n", rows_per_strip));
 
-    if (TIFFReadTile(tiff, (tdata_t)buffer, col, row, 0, 0) == -1) {
+    if (!(TIFFRGBAImageOK(tiff, emsg) && TIFFRGBAImageBegin(&img, tiff, 0, emsg))) {
-        TRACE(("Decode Error, Tile at %dx%d\n", col, row));
+        TRACE(("Decode error, msg: %s", emsg));
+        state->errcode = IMAGING_CODEC_BROKEN;
+        // nothing to clean up, just return
         return -1;
     }
 
-    TRACE(("Successfully read tile at %dx%d; \n\n", col, row));
+    img.req_orientation = ORIENTATION_TOPLEFT;
+    img.col_offset = 0;
 
+    if (state->xsize != img.width || state->ysize != img.height) {
+        TRACE(("Inconsistent Image Error: %d =? %d, %d =? %d",
+               state->xsize, img.width, state->ysize, img.height));
+        state->errcode = IMAGING_CODEC_BROKEN;
+        goto decodeycbcr_err;
+    }
+
+    /* overflow check for row byte size */
+    if (INT_MAX / 4 < img.width) {
+        state->errcode = IMAGING_CODEC_MEMORY;
+        goto decodeycbcr_err;
+    }        
+    
+    // TiffRGBAImages are 32bits/pixel. 
+    row_byte_size = img.width * 4;
+
+    /* overflow check for realloc */
+    if (INT_MAX / row_byte_size < rows_per_strip) {
+        state->errcode = IMAGING_CODEC_MEMORY;
+        goto decodeycbcr_err;
+    }
+
+    state->bytes = rows_per_strip * row_byte_size;
+
+    TRACE(("StripSize: %d \n", state->bytes));
+
+    /* realloc to fit whole strip */
+    /* malloc check above */
+    new_data = realloc (state->buffer, state->bytes);
+    if (!new_data) {
+        state->errcode = IMAGING_CODEC_MEMORY;
+        goto decodeycbcr_err;
+    }
+
+    state->buffer = new_data;
+
+    for (; state->y < state->ysize; state->y += rows_per_strip) {
+        img.row_offset = state->y; 
+        rows_to_read = min(rows_per_strip, img.height - state->y);
+
+        if (!TIFFRGBAImageGet(&img, (UINT32 *)state->buffer, img.width, rows_to_read)) {
+            TRACE(("Decode Error, y: %d\n", state->y ));
+            state->errcode = IMAGING_CODEC_BROKEN;
+            goto decodeycbcr_err;
+        }
+
+        TRACE(("Decoded strip for row %d \n", state->y));
+
+        // iterate over each row in the strip and stuff data into image
+        for (strip_row = 0; strip_row < min((INT32) rows_per_strip, state->ysize - state->y); strip_row++) {
+            TRACE(("Writing data into line %d ; \n", state->y + strip_row));
+
+            // UINT8 * bbb = state->buffer + strip_row * (state->bytes / rows_per_strip);
+            // TRACE(("chars: %x %x %x %x\n", ((UINT8 *)bbb)[0], ((UINT8 *)bbb)[1], ((UINT8 *)bbb)[2], ((UINT8 *)bbb)[3]));
+
+            state->shuffle((UINT8*) im->image[state->y + state->yoff + strip_row] +
+                           state->xoff * im->pixelsize,
+                           state->buffer + strip_row * row_byte_size,
+                           state->xsize);
+        }
+    }
+
+ decodeycbcr_err:
+    TIFFRGBAImageEnd(&img);
+    if (state->errcode != 0) {
+        return -1;
+    }
     return 0;
 }
 
-int ReadStrip(TIFF* tiff, UINT32 row, UINT32* buffer) {
+int _decodeStrip(Imaging im, ImagingCodecState state, TIFF *tiff) {
-    uint16 photometric;
+    INT32 strip_row;
-    TIFFGetField(tiff, TIFFTAG_PHOTOMETRIC, &photometric);
+    UINT8 *new_data;
+    UINT32 rows_per_strip, row_byte_size;
+    int ret;
 
-    // To avoid dealing with YCbCr subsampling, let libtiff handle it
+    ret = TIFFGetField(tiff, TIFFTAG_ROWSPERSTRIP, &rows_per_strip);
-    if (photometric == PHOTOMETRIC_YCBCR) {
+    if (ret != 1) {
-        TIFFRGBAImage img;
+        rows_per_strip = state->ysize;
-        char emsg[1024] = "";
-        UINT32 rows_per_strip, rows_to_read;
-        int ok;
-
-
-        TIFFGetFieldDefaulted(tiff, TIFFTAG_ROWSPERSTRIP, &rows_per_strip);
-        if ((row % rows_per_strip) != 0) {
-            TRACE(("Row passed to ReadStrip() must be first in a strip."));
-            return -1;
-        }
-
-        if (TIFFRGBAImageOK(tiff, emsg) && TIFFRGBAImageBegin(&img, tiff, 0, emsg)) {
-            TRACE(("Initialized RGBAImage\n"));
-
-            img.req_orientation = ORIENTATION_TOPLEFT;
-            img.row_offset = row;
-            img.col_offset = 0;
-
-            rows_to_read = min(rows_per_strip, img.height - row);
-
-            TRACE(("rows to read: %d\n", rows_to_read));
-            ok = TIFFRGBAImageGet(&img, buffer, img.width, rows_to_read);
-
-            TIFFRGBAImageEnd(&img);
-        } else {
-            ok = 0;
-        }
-
-        if (ok == 0) {
-            TRACE(("Decode Error, row %d; msg: %s\n", row, emsg));
-            return -1;
-        }
-
-        return 0;
     }
+    TRACE(("RowsPerStrip: %u \n", rows_per_strip));
 
-    if (TIFFReadEncodedStrip(tiff, TIFFComputeStrip(tiff, row, 0), (tdata_t)buffer, -1) == -1) {
+    // We could use TIFFStripSize, but for YCbCr data it returns subsampled data size
-        TRACE(("Decode Error, strip %d\n", TIFFComputeStrip(tiff, row, 0)));
+    row_byte_size = (state->xsize * state->bits + 7) / 8;
+
+    /* overflow check for realloc */
+    if (INT_MAX / row_byte_size < rows_per_strip) {
+        state->errcode = IMAGING_CODEC_MEMORY;
         return -1;
     }
 
+    state->bytes = rows_per_strip * row_byte_size;
+
+    TRACE(("StripSize: %d \n", state->bytes));
+
+    if (TIFFStripSize(tiff) > state->bytes) {
+        // If the strip size as expected by LibTiff isn't what we're expecting, abort.
+        // man:   TIFFStripSize returns the equivalent size for a strip of data as it would be returned in a
+        //        call to TIFFReadEncodedStrip ...
+
+        state->errcode = IMAGING_CODEC_MEMORY;
+        return -1;
+    }
+
+    /* realloc to fit whole strip */
+    /* malloc check above */
+    new_data = realloc (state->buffer, state->bytes);
+    if (!new_data) {
+        state->errcode = IMAGING_CODEC_MEMORY;
+        return -1;
+    }
+
+    state->buffer = new_data;
+
+    for (; state->y < state->ysize; state->y += rows_per_strip) {
+        if (TIFFReadEncodedStrip(tiff, TIFFComputeStrip(tiff, state->y, 0), (tdata_t)state->buffer, -1) == -1) {
+            TRACE(("Decode Error, strip %d\n", TIFFComputeStrip(tiff, state->y, 0)));
+            state->errcode = IMAGING_CODEC_BROKEN;
+            return -1;
+        }
+
+        TRACE(("Decoded strip for row %d \n", state->y));
+
+        // iterate over each row in the strip and stuff data into image
+        for (strip_row = 0; strip_row < min((INT32) rows_per_strip, state->ysize - state->y); strip_row++) {
+            TRACE(("Writing data into line %d ; \n", state->y + strip_row));
+
+            // UINT8 * bbb = state->buffer + strip_row * (state->bytes / rows_per_strip);
+            // TRACE(("chars: %x %x %x %x\n", ((UINT8 *)bbb)[0], ((UINT8 *)bbb)[1], ((UINT8 *)bbb)[2], ((UINT8 *)bbb)[3]));
+
+            state->shuffle((UINT8*) im->image[state->y + state->yoff + strip_row] +
+                           state->xoff * im->pixelsize,
+                           state->buffer + strip_row * row_byte_size,
+                           state->xsize);
+        }
+    }
     return 0;
 }
 
@@ -283,6 +358,8 @@ int ImagingLibTiffDecode(Imaging im, ImagingCodecState state, UINT8* buffer, Py_
     char *filename = "tempfile.tif";
     char *mode = "r";
     TIFF *tiff;
+    uint16 photometric = 0; // init to not PHOTOMETRIC_YCBCR
+    int isYCbCr = 0;
 
     /* buffer is the encoded file, bytes is the length of the encoded file */
     /*     it all ends up in state->buffer, which is a uint8* from Imaging.h */
@@ -316,7 +393,7 @@ int ImagingLibTiffDecode(Imaging im, ImagingCodecState state, UINT8* buffer, Py_
     if (clientstate->fp) {
         TRACE(("Opening using fd: %d\n",clientstate->fp));
         lseek(clientstate->fp,0,SEEK_SET); // Sometimes, I get it set to the end.
-        tiff = TIFFFdOpen(clientstate->fp, filename, mode);
+        tiff = TIFFFdOpen(fd_to_tiff_fd(clientstate->fp), filename, mode);
     } else {
         TRACE(("Opening from string\n"));
         tiff = TIFFClientOpen(filename, mode,
@@ -339,37 +416,61 @@ int ImagingLibTiffDecode(Imaging im, ImagingCodecState state, UINT8* buffer, Py_
         rv = TIFFSetSubDirectory(tiff, ifdoffset);
         if (!rv){
             TRACE(("error in TIFFSetSubDirectory"));
-            return -1;
+            goto decode_err;
         }
     }
 
+    
+    TIFFGetField(tiff, TIFFTAG_PHOTOMETRIC, &photometric);
+    isYCbCr = photometric == PHOTOMETRIC_YCBCR;
+    
     if (TIFFIsTiled(tiff)) {
-        UINT32 x, y, tile_y, row_byte_size;
+        INT32 x, y, tile_y;
-        UINT32 tile_width, tile_length, current_tile_width;
+        UINT32 tile_width, tile_length, current_tile_length, current_line, current_tile_width, row_byte_size;
         UINT8 *new_data;
 
         TIFFGetField(tiff, TIFFTAG_TILEWIDTH, &tile_width);
         TIFFGetField(tiff, TIFFTAG_TILELENGTH, &tile_length);
 
-        // We could use TIFFTileSize, but for YCbCr data it returns subsampled data size
+        /* overflow check for row_byte_size calculation */
-        row_byte_size = (tile_width * state->bits + 7) / 8;
+        if ((UINT32) INT_MAX / state->bits < tile_width) {
+            state->errcode = IMAGING_CODEC_MEMORY;
+            goto decode_err;
+        }
+
+
+        if (isYCbCr) {
+            row_byte_size = tile_width * 4;
+            /* sanity check, we use this value in shuffle below */
+            if (im->pixelsize != 4) {
+                state->errcode = IMAGING_CODEC_BROKEN;
+                goto decode_err;
+            }
+        } else {
+            // We could use TIFFTileSize, but for YCbCr data it returns subsampled data size
+            row_byte_size = (tile_width * state->bits + 7) / 8;
+        }
 
         /* overflow check for realloc */
         if (INT_MAX / row_byte_size < tile_length) {
             state->errcode = IMAGING_CODEC_MEMORY;
-            TIFFClose(tiff);
+            goto decode_err;
-            return -1;
         }
 
         state->bytes = row_byte_size * tile_length;
 
+        if (TIFFTileSize(tiff) > state->bytes) {
+            // If the strip size as expected by LibTiff isn't what we're expecting, abort.
+            state->errcode = IMAGING_CODEC_MEMORY;
+            goto decode_err;
+        }
+
         /* realloc to fit whole tile */
         /* malloc check above */
         new_data = realloc (state->buffer, state->bytes);
         if (!new_data) {
             state->errcode = IMAGING_CODEC_MEMORY;
-            TIFFClose(tiff);
+            goto decode_err;
-            return -1;
         }
 
         state->buffer = new_data;
@@ -378,99 +479,70 @@ int ImagingLibTiffDecode(Imaging im, ImagingCodecState state, UINT8* buffer, Py_
 
         for (y = state->yoff; y < state->ysize; y += tile_length) {
             for (x = state->xoff; x < state->xsize; x += tile_width) {
+                /* Sanity Check. Apparently in some cases, the TiffReadRGBA* functions
+                   have a different view of the size of the tiff than we're getting from
+                   other functions. So, we need to check here. 
+                */
                 if (!TIFFCheckTile(tiff, x, y, 0, 0)) {
                     TRACE(("Check Tile Error, Tile at %dx%d\n", x, y));
                     state->errcode = IMAGING_CODEC_BROKEN;
-                    TIFFClose(tiff);
+                    goto decode_err;
-                    return -1;
                 }
-                if (ReadTile(tiff, x, y, (UINT32*) state->buffer) == -1) {
+                if (isYCbCr) {
-                    TRACE(("Decode Error, Tile at %dx%d\n", x, y));
+                    /* To avoid dealing with YCbCr subsampling, let libtiff handle it */
-                    state->errcode = IMAGING_CODEC_BROKEN;
+                    if (!TIFFReadRGBATile(tiff, x, y, (UINT32 *)state->buffer)) {
-                    TIFFClose(tiff);
+                        TRACE(("Decode Error, Tile at %dx%d\n", x, y));
-                    return -1;
+                        state->errcode = IMAGING_CODEC_BROKEN;
+                        goto decode_err;
+                    }
+                } else {
+                    if (TIFFReadTile(tiff, (tdata_t)state->buffer, x, y, 0, 0) == -1) {
+                        TRACE(("Decode Error, Tile at %dx%d\n", x, y));
+                        state->errcode = IMAGING_CODEC_BROKEN;
+                        goto decode_err;
+                    }
                 }
 
                 TRACE(("Read tile at %dx%d; \n\n", x, y));
 
-                current_tile_width = min(tile_width, state->xsize - x);
+                current_tile_width = min((INT32) tile_width, state->xsize - x);
-
+                current_tile_length =  min((INT32) tile_length, state->ysize - y);
                 // iterate over each line in the tile and stuff data into image
-                for (tile_y = 0; tile_y < min(tile_length, state->ysize - y); tile_y++) {
+                for (tile_y = 0; tile_y < current_tile_length; tile_y++) {
                     TRACE(("Writing tile data at %dx%d using tile_width: %d; \n", tile_y + y, x, current_tile_width));
 
                     // UINT8 * bbb = state->buffer + tile_y * row_byte_size;
                     // TRACE(("chars: %x%x%x%x\n", ((UINT8 *)bbb)[0], ((UINT8 *)bbb)[1], ((UINT8 *)bbb)[2], ((UINT8 *)bbb)[3]));
+                    /*
+                     * For some reason the TIFFReadRGBATile() function
+                     * chooses the lower left corner as the origin.
+                     * Vertically mirror by shuffling the scanlines
+                     * backwards
+                     */
+
+                    if (isYCbCr) {
+                        current_line = tile_length - tile_y - 1;
+                    } else {
+                        current_line = tile_y;
+                    }
                             
                     state->shuffle((UINT8*) im->image[tile_y + y] + x * im->pixelsize,
-                       state->buffer + tile_y * row_byte_size,
+                       state->buffer + current_line * row_byte_size,
                        current_tile_width
                     );
                 }
             }
         }
     } else {
-        UINT32 strip_row, row_byte_size;
+        if (!isYCbCr) {
-        UINT8 *new_data;
+            _decodeStrip(im, state, tiff);
-        UINT32 rows_per_strip;
-        int ret;
-
-        ret = TIFFGetField(tiff, TIFFTAG_ROWSPERSTRIP, &rows_per_strip);
-        if (ret != 1) {
-            rows_per_strip = state->ysize;
         }
-        TRACE(("RowsPerStrip: %u \n", rows_per_strip));
+        else {
-
+            _decodeStripYCbCr(im, state, tiff);
-        // We could use TIFFStripSize, but for YCbCr data it returns subsampled data size
-        row_byte_size = (state->xsize * state->bits + 7) / 8;
-
-        /* overflow check for realloc */
-        if (INT_MAX / row_byte_size < rows_per_strip) {
-            state->errcode = IMAGING_CODEC_MEMORY;
-            TIFFClose(tiff);
-            return -1;
-        }
-        
-        state->bytes = rows_per_strip * row_byte_size;
-
-        TRACE(("StripSize: %d \n", state->bytes));
-
-        /* realloc to fit whole strip */
-        /* malloc check above */
-        new_data = realloc (state->buffer, state->bytes);
-        if (!new_data) {
-            state->errcode = IMAGING_CODEC_MEMORY;
-            TIFFClose(tiff);
-            return -1;
-        }
-
-        state->buffer = new_data;
-
-        for (; state->y < state->ysize; state->y += rows_per_strip) {
-            if (ReadStrip(tiff, state->y, (UINT32 *)state->buffer) == -1) {
-                TRACE(("Decode Error, strip %d\n", TIFFComputeStrip(tiff, state->y, 0)));
-                state->errcode = IMAGING_CODEC_BROKEN;
-                TIFFClose(tiff);
-                return -1;
-            }
-
-            TRACE(("Decoded strip for row %d \n", state->y));
-
-            // iterate over each row in the strip and stuff data into image
-            for (strip_row = 0; strip_row < min(rows_per_strip, state->ysize - state->y); strip_row++) {
-                TRACE(("Writing data into line %d ; \n", state->y + strip_row));
-
-                // UINT8 * bbb = state->buffer + strip_row * (state->bytes / rows_per_strip);
-                // TRACE(("chars: %x %x %x %x\n", ((UINT8 *)bbb)[0], ((UINT8 *)bbb)[1], ((UINT8 *)bbb)[2], ((UINT8 *)bbb)[3]));
-
-                state->shuffle((UINT8*) im->image[state->y + state->yoff + strip_row] +
-                               state->xoff * im->pixelsize,
-                               state->buffer + strip_row * row_byte_size,
-                               state->xsize);
-            }
         }
     }
 
+ decode_err:
     TIFFClose(tiff);
     TRACE(("Done Decoding, Returning \n"));
     // Returning -1 here to force ImageFile.load to break, rather than
@@ -510,7 +582,7 @@ int ImagingLibTiffEncodeInit(ImagingCodecState state, char *filename, int fp) {
 
     if (fp) {
         TRACE(("Opening using fd: %d for writing \n",clientstate->fp));
-        clientstate->tiff = TIFFFdOpen(clientstate->fp, filename, mode);
+        clientstate->tiff = TIFFFdOpen(fd_to_tiff_fd(clientstate->fp), filename, mode);
     } else {
         // malloc a buffer to write the tif, we're going to need to realloc or something if we need bigger.
         TRACE(("Opening a buffer for writing \n"));
@@ -544,20 +616,19 @@ int ImagingLibTiffEncodeInit(ImagingCodecState state, char *filename, int fp) {
 int ImagingLibTiffMergeFieldInfo(ImagingCodecState state, TIFFDataType field_type, int key, int is_var_length){
     // Refer to libtiff docs (http://www.simplesystems.org/libtiff/addingtags.html)
     TIFFSTATE *clientstate = (TIFFSTATE *)state->context;
-    char field_name[10];
     uint32 n;
     int status = 0;
 
     // custom fields added with ImagingLibTiffMergeFieldInfo are only used for
     // decoding, ignore readcount;
-    int readcount = 0;
+    int readcount = 1;
     // we support writing a single value, or a variable number of values
     int writecount = 1;
     // whether the first value should encode the number of values.
     int passcount = 0;
 
     TIFFFieldInfo info[] = {
-        { key, readcount, writecount, field_type, FIELD_CUSTOM, 1, passcount, field_name }
+        { key, readcount, writecount, field_type, FIELD_CUSTOM, 1, passcount, "CustomField" }
     };
 
     if (is_var_length) {