tiff: ignore invalid palette indices when parsing palette-color images

disintegration#165

go.mod

@@ -1,3 +1,7 @@
 module github.com/disintegration/imaging
 
-require golang.org/x/image v0.0.0-20191009234506-e7c1f5e7dbb8
+go 1.23.1
+
+require golang.org/x/image v0.21.0
+
+require golang.org/x/text v0.19.0 // indirect

go.sum

@@ -1,3 +1,6 @@
 golang.org/x/image v0.0.0-20191009234506-e7c1f5e7dbb8 h1:hVwzHzIUGRjiF7EcUjqNxk3NCfkPxbDKRdnNE1Rpg0U=
 golang.org/x/image v0.0.0-20191009234506-e7c1f5e7dbb8/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
+golang.org/x/image v0.21.0 h1:c5qV36ajHpdj4Qi0GnE0jUc/yuo33OLFaa0d+crTD5s=
+golang.org/x/image v0.21.0/go.mod h1:vUbsLavqK/W303ZroQQVKQ+Af3Yl6Uz1Ppu5J/cLz78=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.19.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=

scanner.go

@@ -236,9 +236,14 @@ func (s *scanner) scan(x1, y1, x2, y2 int, dst []uint8) {
 
 	case *image.Paletted:
 		j := 0
+		pLen := len(s.palette)
 		for y := y1; y < y2; y++ {
 			i := y*img.Stride + x1
 			for x := x1; x < x2; x++ {
+				idx := int(img.Pix[i])
+				if idx >= pLen {
+					continue
+				}
 				c := s.palette[img.Pix[i]]
 				d := dst[j : j+4 : j+4]
 				d[0] = c.R

scanner_test.go

@@ -6,6 +6,8 @@ import (
 	"image/color"
 	"image/color/palette"
 	"image/draw"
+	"os"
+	"runtime"
 	"testing"
 )
 
@@ -227,3 +229,13 @@ func readColumn(img image.Image, x int) []uint8 {
 	}
 	return column
 }
+
+func TestTiffCrash(t *testing.T) {
+	runtime.GOMAXPROCS(1)
+	file, _ := os.Open("testdata/poc.tiff")
+	src, _, err := image.Decode(file)
+	if err != nil {
+		return
+	}
+	Grayscale(src)
+}