crash on GDALOpen of GeoTIFF in WinCE build

[fbausch]

when using Windows CE build of GDAL 1.5.0 (also 1.4.4) on GDALOpen of GeoTIFF file in Windows Mobile 6, uncaught exception causes crash.

No problems encountered when using GDAL 1.4.2.
using Visual Studio 2005, debugging in WM6 Professional emulator

crash seems to be prompted by call to wceex_bsearch with num parameter=0, which is not valid, suggesting the problem must lie upstream of the call to bsearch.

call stack:

GPSMap.exe!wceex_bsearch(const void* key = 0x1e1cde2c, const void* base = 0x00212740, unsigned int num = 0, unsigned int width = 4, int (const void*, const void*)* compare = 0x000f32ec) Line: 58, Byte Offsets: 0x10	C

GPSMap.exe!TIFFFindField(tiff* tif = 0x00212460, unsigned int tag = 254, TIFFDataType dt = 0) Line: 483, Byte Offsets: 0x144	C

GPSMap.exe!_TIFFMergeFields(tiff* tif = 0x00212460, _TIFFField* info = 0x00196920, unsigned int n = 138) Line: 354, Byte Offsets: 0x168	C

GPSMap.exe!_TIFFSetupFields(tiff* tif = 0x00212460, _TIFFFieldArray* fieldarray = 0x00195784) Line: 292, Byte Offsets: 0x134	C

GPSMap.exe!TIFFDefaultDirectory(tiff* tif = 0x00212460) Line: 1101, Byte Offsets: 0x38	C

GPSMap.exe!TIFFReadDirectory(tiff* tif = 0x00212460) Line: 3368, Byte Offsets: 0x15c	C

GPSMap.exe!TIFFClientOpen(const char* name = 0x001fed10, const char* mode = 0x0016a518, void* clientdata = 0x001fef10, long int (void*, void*, long int)* readproc = 0x000de2c4, long int (void*, void*, long int)* writeproc = 0x000de300, unsigned long int (void*, unsigned long int, int)* seekproc = 0x000de33c, int (void*)* closeproc = 0x000de39c, unsigned long int (void*)* sizeproc = 0x000de3cc, int (void*, void**, unsigned long int*)* mapproc = 0x000de438, void (void*, void*, unsigned long int)* unmapproc = 0x000de45c) Line: 464, Byte Offsets: 0xc44	C

GPSMap.exe!XTIFFClientOpen(const char* name = 0x001fed10, const char* mode = 0x0016a518, void* thehandle = 0x001fef10, long int (void*, void*, long int)* RWProc = 0x000de2c4, long int (void*, void*, long int)* RWProc2 = 0x000de300, unsigned long int (void*, unsigned long int, int)* SProc = 0x000de33c, int (void*)* CProc = 0x000de39c, unsigned long int (void*)* SzProc = 0x000de3cc, int (void*, void**, unsigned long int*)* MFProvc = 0x000de438, void (void*, void*, unsigned long int)* UMFProc = 0x000de45c) Line: 184, Byte Offsets: 0x58	C

GPSMap.exe!VSI_TIFFOpen(const char* name = 0x001fed10, const char* mode = 0x0016a518) Line: 145, Byte Offsets: 0x1d0	C++

GPSMap.exe!GTiffDataset::Open(GDALOpenInfo* poOpenInfo = 0x1e1ce1f8) Line: 2855, Byte Offsets: 0x250	C++

GPSMap.exe!GDALOpen(const char* pszFilename = 0x001fecd0, GDALAccess eAccess = 0) Line: 1774, Byte Offsets: 0x10c	C++

[warmerdam]

I see that TIFFFindField() can easily call bsearch() with num=0, but it isn't clear to me why this should cause a problem. Perhaps the wceex_bsearch() implementation needs handling for this case?

I can fix libtiff if it can be demonstrated that it is inappropriate to call bsearch() this way.