--- tif_fax3.c.orig	2006-06-02 17:26:44.000000000 +0800
+++ tif_fax3.c	2006-06-02 19:52:52.000000000 +0800
@@ -83,10 +83,12 @@
 	/* Encoder state info */
 	Ttag    tag;			/* encoding state */
 	unsigned char*	refline;	/* reference line for 2d decoding */
 	int	k;			/* #rows left that can be 2d encoded */
 	int	maxk;			/* max #rows that can be 2d encoded */
+
+	int line;
 } Fax3CodecState;
 #define	DecoderState(tif)	((Fax3CodecState*) Fax3State(tif))
 #define	EncoderState(tif)	((Fax3CodecState*) Fax3State(tif))
 
 #define	is2DEncoding(sp) \
@@ -165,10 +167,11 @@
 	    TIFFGetBitRevTable(tif->tif_dir.td_fillorder != FILLORDER_LSB2MSB);
 	if (sp->refruns) {		/* init reference line to white */
 		sp->refruns[0] = (uint32) sp->b.rowpixels;
 		sp->refruns[1] = 0;
 	}
+	sp->line = 0;
 	return (1);
 }
 
 /*
  * Routine for handling various errors/conditions.
@@ -182,22 +185,22 @@
 	TIFFErrorExt(tif->tif_clientdata, module, "%s: Bad code word at line %lu of %s %lu (x %lu)",
 		tif->tif_name, (unsigned long) line, isTiled(tif) ? "tile" : "strip",
 	   (unsigned long) (isTiled(tif) ? tif->tif_curtile : tif->tif_curstrip),
 	   (unsigned long) a0);
 }
-#define	unexpected(table, a0)	Fax3Unexpected(module, tif, line, a0)
+#define	unexpected(table, a0)	Fax3Unexpected(module, tif, sp->line, a0)
 
 static void
 Fax3Extension(const char* module, TIFF* tif, uint32 line, uint32 a0)
 {
 	TIFFErrorExt(tif->tif_clientdata, module,
 	    "%s: Uncompressed data (not supported) at line %lu of %s %lu (x %lu)",
 	    tif->tif_name, (unsigned long) line, isTiled(tif) ? "tile" : "strip",
        (unsigned long) (isTiled(tif) ? tif->tif_curtile : tif->tif_curstrip),
        (unsigned long) a0);
 }
-#define	extension(a0)	Fax3Extension(module, tif, line, a0)
+#define	extension(a0)	Fax3Extension(module, tif, sp->line, a0)
 
 static void
 Fax3BadLength(const char* module, TIFF* tif, uint32 line, uint32 a0, uint32 lastx)
 {
 	TIFFWarningExt(tif->tif_clientdata, module, "%s: %s at line %lu of %s %lu (got %lu, expected %lu)",
@@ -205,33 +208,32 @@
 	    a0 < lastx ? "Premature EOL" : "Line length mismatch",
 	    (unsigned long) line, isTiled(tif) ? "tile" : "strip",
         (unsigned long) (isTiled(tif) ? tif->tif_curtile : tif->tif_curstrip),
         (unsigned long) a0, lastx);
 }
-#define	badlength(a0,lastx)	Fax3BadLength(module, tif, line, a0, lastx)
+#define	badlength(a0,lastx)	Fax3BadLength(module, tif, sp->line, a0, lastx)
 
 static void
 Fax3PrematureEOF(const char* module, TIFF* tif, uint32 line, uint32 a0)
 {
 	TIFFWarningExt(tif->tif_clientdata, module, "%s: Premature EOF at line %lu of %s %lu (x %lu)",
 	    tif->tif_name,
 	    (unsigned long) line, isTiled(tif) ? "tile" : "strip",
         (unsigned long) (isTiled(tif) ? tif->tif_curtile : tif->tif_curstrip),
         (unsigned long) a0);
 }
-#define	prematureEOF(a0)	Fax3PrematureEOF(module, tif, line, a0)
+#define	prematureEOF(a0)	Fax3PrematureEOF(module, tif, sp->line, a0)
 
 #define	Nop
 
 /*
  * Decode the requested amount of G3 1D-encoded data.
  */
 static int
 Fax3Decode1D(TIFF* tif, tidata_t buf, tsize_t occ, tsample_t s)
 {
 	DECLARE_STATE(tif, sp, "Fax3Decode1D");
-        int line = 0;
 
 	(void) s;
 	CACHE_STATE(tif, sp);
 	thisrun = sp->curruns;
 	while ((long)occ > 0) {
@@ -246,11 +248,11 @@
 		SYNC_EOL(EOF1D);
 		EXPAND1D(EOF1Da);
 		(*sp->fill)(buf, thisrun, pa, lastx);
 		buf += sp->b.rowbytes;
 		occ -= sp->b.rowbytes;
-                line++;
+		sp->line++;
 		continue;
 	EOF1D:				/* premature EOF */
 		CLEANUP_RUNS();
 	EOF1Da:				/* premature EOF */
 		(*sp->fill)(buf, thisrun, pa, lastx);
@@ -267,11 +269,10 @@
  */
 static int
 Fax3Decode2D(TIFF* tif, tidata_t buf, tsize_t occ, tsample_t s)
 {
 	DECLARE_STATE_2D(tif, sp, "Fax3Decode2D");
-        int line = 0;
 	int is1D;			/* current line is 1d/2d-encoded */
 
 	(void) s;
 	CACHE_STATE(tif, sp);
 	while ((long)occ > 0) {
@@ -300,11 +301,11 @@
 		(*sp->fill)(buf, thisrun, pa, lastx);
 		SETVALUE(0);		/* imaginary change for reference */
 		SWAP(uint32*, sp->curruns, sp->refruns);
 		buf += sp->b.rowbytes;
 		occ -= sp->b.rowbytes;
-                line++;
+		sp->line++;
 		continue;
 	EOF2D:				/* premature EOF */
 		CLEANUP_RUNS();
 	EOF2Da:				/* premature EOF */
 		(*sp->fill)(buf, thisrun, pa, lastx);
@@ -490,18 +491,18 @@
 	    (sp->groupoptions & GROUP3OPT_2DENCODING) ||
 	    td->td_compression == COMPRESSION_CCITTFAX4
 	);
 
 	nruns = needsRefLine ? 2*TIFFroundup(rowpixels,32) : rowpixels;
-
-	dsp->runs = (uint32*) _TIFFCheckMalloc(tif, 2*nruns+3, sizeof (uint32),
+	nruns += 3;
+	dsp->runs = (uint32*) _TIFFCheckMalloc(tif, 2*nruns, sizeof (uint32),
 					  "for Group 3/4 run arrays");
 	if (dsp->runs == NULL)
 		return (0);
 	dsp->curruns = dsp->runs;
 	if (needsRefLine)
-		dsp->refruns = dsp->runs + (nruns>>1);
+		dsp->refruns = dsp->runs + nruns;
 	else
 		dsp->refruns = NULL;
 	if (td->td_compression == COMPRESSION_CCITTFAX3
 	    && is2DEncoding(dsp)) {	/* NB: default is 1D routine */
 		tif->tif_decoderow = Fax3Decode2D;
@@ -716,10 +717,11 @@
 			res *= 2.54f;		/* convert to inches */
 		sp->maxk = (res > 150 ? 4 : 2);
 		sp->k = sp->maxk-1;
 	} else
 		sp->k = sp->maxk = 0;
+	sp->line = 0;
 	return (1);
 }
 
 static const unsigned char zeroruns[256] = {
     8, 7, 6, 6, 5, 5, 5, 5, 4, 4, 4, 4, 4, 4, 4, 4,	/* 0x00 - 0x0f */
@@ -1376,11 +1378,10 @@
  */
 static int
 Fax4Decode(TIFF* tif, tidata_t buf, tsize_t occ, tsample_t s)
 {
 	DECLARE_STATE_2D(tif, sp, "Fax4Decode");
-        int line = 0;
 
 	(void) s;
 	CACHE_STATE(tif, sp);
 	while ((long)occ > 0) {
 		a0 = 0;
@@ -1399,11 +1400,11 @@
 		(*sp->fill)(buf, thisrun, pa, lastx);
 		SETVALUE(0);		/* imaginary change for reference */
 		SWAP(uint32*, sp->curruns, sp->refruns);
 		buf += sp->b.rowbytes;
 		occ -= sp->b.rowbytes;
-                line++;
+		sp->line++;
 		continue;
 	EOFG4:
                 NeedBits16( 13, BADG4 );
         BADG4:
 #ifdef FAX3_DEBUG
@@ -1485,11 +1486,10 @@
 static int
 Fax3DecodeRLE(TIFF* tif, tidata_t buf, tsize_t occ, tsample_t s)
 {
 	DECLARE_STATE(tif, sp, "Fax3DecodeRLE");
 	int mode = sp->b.mode;
-        int line = 0;
 
 	(void) s;
 	CACHE_STATE(tif, sp);
 	thisrun = sp->curruns;
 	while ((long)occ > 0) {
@@ -1515,11 +1515,11 @@
 			if (BitsAvail == 0 && !isAligned(cp, uint16))
 			    cp++;
 		}
 		buf += sp->b.rowbytes;
 		occ -= sp->b.rowbytes;
-                line++;
+		sp->line++;
 		continue;
 	EOFRLE:				/* premature EOF */
 		(*sp->fill)(buf, thisrun, pa, lastx);
 		UNCACHE_STATE(tif, sp);
 		return (-1);
