diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c
index 19a26e2..6667228 100644
--- a/libtiff/tif_dirread.c
+++ b/libtiff/tif_dirread.c
@@ -3881,6 +3881,32 @@ TIFFReadDirectory(TIFF* tif)
 				if (!TIFFSetField(tif,TIFFTAG_SAMPLESPERPIXEL,1))
 					goto bad;
 			}
+			/*
+			 * SamplesPerPixel value has changed, adjust SMinSampleValue
+			 * and SMaxSampleValue arrays if necessary
+			 */
+			{
+				uint32 saved_flags;
+				saved_flags = tif->tif_flags;
+				tif->tif_flags &= ~TIFF_PERSAMPLE;
+				if (TIFFFieldSet(tif,FIELD_SMINSAMPLEVALUE))
+				{
+					if (!TIFFSetField(tif,TIFFTAG_SMINSAMPLEVALUE,tif->tif_dir.td_sminsamplevalue[0]))
+					{
+						tif->tif_flags = saved_flags;
+						goto bad;
+					}
+				}
+				if (TIFFFieldSet(tif,FIELD_SMAXSAMPLEVALUE))
+				{
+					if (!TIFFSetField(tif,TIFFTAG_SMAXSAMPLEVALUE,tif->tif_dir.td_smaxsamplevalue[0]))
+					{
+						tif->tif_flags = saved_flags;
+						goto bad;
+					}
+				}
+				tif->tif_flags = saved_flags;
+			}
 		}
 	}
 	/*
diff --git a/libtiff/tif_dirwrite.c b/libtiff/tif_dirwrite.c
index fa20609..fa68d1c 100644
--- a/libtiff/tif_dirwrite.c
+++ b/libtiff/tif_dirwrite.c
@@ -542,8 +542,12 @@ TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
 			{
 				if (!isTiled(tif))
 				{
-					if (!TIFFWriteDirectoryTagLongLong8Array(tif,&ndir,dir,TIFFTAG_STRIPOFFSETS,tif->tif_dir.td_nstrips,tif->tif_dir.td_stripoffset))
-						goto bad;
+					/* td_stripoffset can be NULL even if td_nstrips == 1 due to OJPEG hack */
+					if (tif->tif_dir.td_stripoffset)
+					{
+						if (!TIFFWriteDirectoryTagLongLong8Array(tif,&ndir,dir,TIFFTAG_STRIPOFFSETS,tif->tif_dir.td_nstrips,tif->tif_dir.td_stripoffset))
+							goto bad;
+					}
 				}
 				else
 				{
diff --git a/libtiff/tif_read.c b/libtiff/tif_read.c
index 2ba822a..dfc5b07 100644
--- a/libtiff/tif_read.c
+++ b/libtiff/tif_read.c
@@ -458,7 +458,7 @@ TIFFReadRawStrip(TIFF* tif, uint32 strip, void* buf, tmsize_t size)
 		return ((tmsize_t)(-1));
 	}
 	bytecount = td->td_stripbytecount[strip];
-	if (bytecount <= 0) {
+	if ((int64)bytecount <= 0) {
 #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
 		TIFFErrorExt(tif->tif_clientdata, module,
 			     "%I64u: Invalid strip byte count, strip %lu",
@@ -498,7 +498,7 @@ TIFFFillStrip(TIFF* tif, uint32 strip)
 	if ((tif->tif_flags&TIFF_NOREADRAW)==0)
 	{
 		uint64 bytecount = td->td_stripbytecount[strip];
-		if (bytecount <= 0) {
+		if ((int64)bytecount <= 0) {
 #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
 			TIFFErrorExt(tif->tif_clientdata, module,
 				"Invalid strip byte count %I64u, strip %lu",
@@ -801,7 +801,7 @@ TIFFFillTile(TIFF* tif, uint32 tile)
 	if ((tif->tif_flags&TIFF_NOREADRAW)==0)
 	{
 		uint64 bytecount = td->td_stripbytecount[tile];
-		if (bytecount <= 0) {
+		if ((int64)bytecount <= 0) {
 #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
 			TIFFErrorExt(tif->tif_clientdata, module,
 				"%I64u: Invalid tile byte count, tile %lu",
diff --git a/tools/bmp2tiff.c b/tools/bmp2tiff.c
index b5ed30b..376f4e6 100644
--- a/tools/bmp2tiff.c
+++ b/tools/bmp2tiff.c
@@ -401,6 +401,24 @@ main(int argc, char* argv[])
 		    return 0;
 		}
 
+        if (info_hdr.iCompression == BMPC_RLE4 && info_hdr.iBitCount != 4)
+        {
+            TIFFError(infilename,
+              "Cannot process BMP file with bit count %d and RLE 4-bit/pixel compression",
+              info_hdr.iBitCount);
+            close(fd);
+            return 0;
+        }
+ 
+        if (info_hdr.iCompression == BMPC_RLE8 && info_hdr.iBitCount != 8)
+        {
+            TIFFError(infilename,
+              "Cannot process BMP file with bit count %d and RLE 8-bit/pixel compression",
+              info_hdr.iBitCount);
+            close(fd);
+            return 0;
+        }
+
 		width = info_hdr.iWidth;
 		length = (info_hdr.iHeight > 0) ? info_hdr.iHeight : -info_hdr.iHeight;
         if( width <= 0 || length <= 0 )
diff --git a/tools/pal2rgb.c b/tools/pal2rgb.c
index 8608aad..426bbc0 100644
--- a/tools/pal2rgb.c
+++ b/tools/pal2rgb.c
@@ -372,7 +372,8 @@ static struct cpTag {
     { TIFFTAG_CLEANFAXDATA,		1, TIFF_SHORT },
     { TIFFTAG_CONSECUTIVEBADFAXLINES,	1, TIFF_LONG },
     { TIFFTAG_INKSET,			1, TIFF_SHORT },
-    { TIFFTAG_INKNAMES,			1, TIFF_ASCII },
+    // disable INKNAMES tag, http://bugzilla.maptools.org/show_bug.cgi?id=2484 (CVE-2014-8127)
+    //{ TIFFTAG_INKNAMES,			1, TIFF_ASCII },
     { TIFFTAG_DOTRANGE,			2, TIFF_SHORT },
     { TIFFTAG_TARGETPRINTER,		1, TIFF_ASCII },
     { TIFFTAG_SAMPLEFORMAT,		1, TIFF_SHORT },
diff --git a/tools/thumbnail.c b/tools/thumbnail.c
index fd1cba5..06edf93 100644
--- a/tools/thumbnail.c
+++ b/tools/thumbnail.c
@@ -257,7 +257,8 @@ static struct cpTag {
     { TIFFTAG_CLEANFAXDATA,		1, TIFF_SHORT },
     { TIFFTAG_CONSECUTIVEBADFAXLINES,	1, TIFF_LONG },
     { TIFFTAG_INKSET,			1, TIFF_SHORT },
-    { TIFFTAG_INKNAMES,			1, TIFF_ASCII },
+    // disable INKNAMES tag, http://bugzilla.maptools.org/show_bug.cgi?id=2484 (CVE-2014-8127)
+    //{ TIFFTAG_INKNAMES,			1, TIFF_ASCII },
     { TIFFTAG_DOTRANGE,			2, TIFF_SHORT },
     { TIFFTAG_TARGETPRINTER,		1, TIFF_ASCII },
     { TIFFTAG_SAMPLEFORMAT,		1, TIFF_SHORT },
@@ -585,7 +586,7 @@ generateThumbnail(TIFF* in, TIFF* out)
     rowsize = TIFFScanlineSize(in);
     rastersize = sh * rowsize;
     fprintf(stderr, "rastersize=%u\n", (unsigned int)rastersize);
-    raster = (unsigned char*)_TIFFmalloc(rastersize);
+    raster = (unsigned char*)_TIFFmalloc(rastersize + 3);
     if (!raster) {
 	    TIFFError(TIFFFileName(in),
 		      "Can't allocate space for raster buffer.");
diff --git a/tools/tiff2bw.c b/tools/tiff2bw.c
index c5dcb7c..02605df 100644
--- a/tools/tiff2bw.c
+++ b/tools/tiff2bw.c
@@ -171,6 +171,11 @@ main(int argc, char* argv[])
 		    argv[optind], samplesperpixel);
 		return (-1);
 	}
+	if( photometric == PHOTOMETRIC_RGB && samplesperpixel != 3) {
+		fprintf(stderr, "%s: Bad samples/pixel %u for PHOTOMETRIC_RGB.\n",
+		    argv[optind], samplesperpixel);
+		return (-1);
+	}
 	TIFFGetField(in, TIFFTAG_BITSPERSAMPLE, &bitspersample);
 	if (bitspersample != 8) {
 		fprintf(stderr,