Fix CVE-2016-5652 (buffer overflow in t2p_readwrite_pdf_image_tile()).

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5652

Patches exfiltrated from upstream CVS repo with:
cvs diff -u -r 1.92 -r 1.94 tools/tiff2pdf.c

Index: tools/tiff2pdf.c
===================================================================
RCS file: /cvs/maptools/cvsroot/libtiff/tools/tiff2pdf.c,v
retrieving revision 1.92
retrieving revision 1.94
diff -u -r1.92 -r1.94
--- a/tools/tiff2pdf.c	23 Sep 2016 22:12:18 -0000	1.92
+++ b/tools/tiff2pdf.c	9 Oct 2016 11:03:36 -0000	1.94
@@ -2887,21 +2887,24 @@
 				return(0);
 			}
 			if(TIFFGetField(input, TIFFTAG_JPEGTABLES, &count, &jpt) != 0) {
-				if (count > 0) {
-					_TIFFmemcpy(buffer, jpt, count);
+				if (count >= 4) {
+                    /* Ignore EOI marker of JpegTables */
+					_TIFFmemcpy(buffer, jpt, count - 2);
 					bufferoffset += count - 2;
+                    /* Store last 2 bytes of the JpegTables */
 					table_end[0] = buffer[bufferoffset-2];
 					table_end[1] = buffer[bufferoffset-1];
-				}
-				if (count > 0) {
 					xuint32 = bufferoffset;
+                    bufferoffset -= 2;
 					bufferoffset += TIFFReadRawTile(
 						input, 
 						tile, 
-						(tdata_t) &(((unsigned char*)buffer)[bufferoffset-2]), 
+						(tdata_t) &(((unsigned char*)buffer)[bufferoffset]), 
 						-1);
-						buffer[xuint32-2]=table_end[0];
-						buffer[xuint32-1]=table_end[1];
+                    /* Overwrite SOI marker of image scan with previously */
+                    /* saved end of JpegTables */
+					buffer[xuint32-2]=table_end[0];
+					buffer[xuint32-1]=table_end[1];
 				} else {
 					bufferoffset += TIFFReadRawTile(
 						input, 
option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/log/?id=25623647e9c6f5cafea902ac3d8d6d7ac03c0b3c'>root</a>/<a href='/guix/log/tests?id=25623647e9c6f5cafea902ac3d8d6d7ac03c0b3c'>tests</a>/<a href='/guix/log/tests/debug-link.scm?id=25623647e9c6f5cafea902ac3d8d6d7ac03c0b3c'>debug-link.scm</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/tests/debug-link.scm?id=25623647e9c6f5cafea902ac3d8d6d7ac03c0b3c&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2018-11-12 23:37:13 +0100'>2018-11-12</span></td><td><a href='/guix/commit/tests/debug-link.scm?id=9ed86fe175c15c819d6d86681c8136ff6bc927c0'>tests: Add 'test-assertm' to (guix tests).</a><span class='msg-avail'>...</span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2018-08-24 18:01:05 +0200'>2018-08-24</span></td><td><a href='/guix/commit/tests/debug-link.scm?id=93c333895a4e2dc9baabec8ade60d9d2ac0a91e2'>grafts: Add (guix build debug-link) and use it.</a><span class='msg-avail'>...</span></td><td>Ludovic Courtès</td></tr>