x/image/tiff: slice bounds out of range

[Dmitry Vyukov]

Run the following program on the following input:

package main

import (
    "bytes"
    "io/ioutil"
    "os"
    "golang.org/x/image/tiff"
)

func main() {
    data, _ := ioutil.ReadFile(os.Args[1])
    img, err := tiff.Decode(bytes.NewReader(data))
    if err != nil {
        return
    }
    var w bytes.Buffer
    err = tiff.Encode(&w, img, nil)
    if err != nil {
        panic(err)
    }
}

https://drive.google.com/file/d/0B20Uwp8Hs1oCMjMwZ0ZpZDE2LTg/view?usp=sharing

It crashes with:

panic: runtime error: slice bounds out of range

goroutine 1 [running]:
runtime.gopanic(0x52ae80, 0xc20800e220)
    src/runtime/panic.go:477 +0x3fe fp=0xc2080414c0 sp=0xc208041440
runtime.panicslice()
    src/runtime/panic.go:18 +0x52 fp=0xc2080414e8 sp=0xc2080414c0
golang.org/x/image/tiff.(*decoder).decode(0xc20807c000, 0x7f6150328380, 0xc2080104c0, 0x0, 0x0, 0x96, 0x67, 0x0, 0x0)
    src/golang.org/x/image/tiff/reader.go:212 +0x3d4 fp=0xc2080416e0 sp=0xc2080414e8
golang.org/x/image/tiff.Decode(0x7f61503282d8, 0xc208014480, 0x7f6150328380, 0xc2080104c0, 0x0, 0x0)
    src/golang.org/x/image/tiff/reader.go:593 +0xadc fp=0xc208041ed0 sp=0xc2080416e0
main.main()
    /tmp/tiff.go:12 +0x132 fp=0xc208041f90 sp=0xc208041ed0

I am on commit 65a798f031fd31a65574938bed2ec44c2bcba496