Retain LZW decoder across tiles

Fix: clip border tile rows when discarding extra samples

.github/workflows/fuzz.yml

@@ -0,0 +1,85 @@
+name: Fuzz
+
+on:
+  push:
+    branches: [main]
+  schedule:
+    - cron: '0 3 * * *'
+  workflow_dispatch:
+    inputs:
+      duration:
+        description: 'Seconds per fuzz target'
+        required: false
+        default: '300'
+
+concurrency:
+  group: fuzz-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  fuzz:
+    name: Fuzz (${{ matrix.target }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        target:
+          - decode_comprehensive
+          - decode_image
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dtolnay/rust-toolchain@nightly
+      - uses: Swatinem/rust-cache@v2
+        with:
+          key: fuzz-${{ matrix.target }}
+          cache-directories: fuzz/target
+
+      - name: Install cargo-fuzz
+        run: cargo install cargo-fuzz --locked
+
+      - name: Determine duration
+        id: duration
+        run: |
+          if [ "${{ github.event_name }}" = "schedule" ]; then
+            echo "seconds=300" >> "$GITHUB_OUTPUT"
+          elif [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "seconds=${{ github.event.inputs.duration || '300' }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "seconds=60" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Seed corpus
+        run: |
+          mkdir -p fuzz/corpus/${{ matrix.target }}
+          cp fuzz/regression/* fuzz/corpus/${{ matrix.target }}/ 2>/dev/null || true
+          cp fuzz/seed_corpus/${{ matrix.target }}/* fuzz/corpus/${{ matrix.target }}/ 2>/dev/null || true
+
+      - name: Fuzz ${{ matrix.target }}
+        run: |
+          cargo +nightly fuzz run ${{ matrix.target }} \
+            -- -max_total_time=${{ steps.duration.outputs.seconds }} \
+               -dict=fuzz/tiff.dict \
+               -rss_limit_mb=2048
+
+      - name: Upload crashes
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: fuzz-crashes-${{ matrix.target }}
+          path: fuzz/artifacts/
+          retention-days: 30
+
+  regression:
+    name: Fuzz regression
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - name: Build
+        run: cargo build
+      - name: Regression seeds
+        run: |
+          if [ -d fuzz/regression ] && [ "$(ls fuzz/regression/ 2>/dev/null | wc -l)" -gt 0 ]; then
+            cargo test --test fuzz_regression 2>/dev/null || echo "No regression test found — seeds exist but no test harness"
+          fi

.github/workflows/rust.yml

@@ -9,14 +9,14 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        rust: ["1.85.0", stable, beta, nightly]
+        rust: ["1.88.0", stable, beta, nightly]
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v6
 
     - uses: dtolnay/rust-toolchain@nightly
-      if: ${{ matrix.rust == '1.85.0' }}
+      if: ${{ matrix.rust == '1.88.0' }}
     - name: Generate Cargo.lock with minimal-version dependencies
-      if: ${{ matrix.rust == '1.85.0' }}
+      if: ${{ matrix.rust == '1.88.0' }}
       run: cargo -Zminimal-versions generate-lockfile
 
     - uses: dtolnay/rust-toolchain@v1
@@ -29,16 +29,32 @@ jobs:
     - name: build
       run: cargo build -v
     - name: test
-      if: ${{ matrix.rust != '1.85.0' }}
+      if: ${{ matrix.rust != '1.88.0' }}
       run: cargo test -v && cargo doc -v
 
+  test-platforms:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, macos-26-intel, windows-latest, windows-11-arm]
+    steps:
+    - uses: actions/checkout@v6
+    - uses: dtolnay/rust-toolchain@stable
+    - name: Cache Cargo Dependencies
+      uses: Swatinem/rust-cache@v2
+      with:
+        cache-on-failure: true
+    - name: test
+      run: cargo test -v
+
   features:
     runs-on: ubuntu-latest
     strategy:
       matrix:
         feature: ["", deflate, jpeg, lzw, zstd, default, "default,zstd"]
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v6
     - uses: dtolnay/rust-toolchain@stable
       with:
         components: clippy
@@ -59,25 +75,29 @@ jobs:
       matrix:
         arch: [powerpc-unknown-linux-gnu, i686-unknown-linux-gnu]
     steps:
-      - uses: actions/checkout@v4
-      - name: Install or use cached cross-rs/cross
-        uses: baptiste0928/cargo-install@v2
-        with:
-          crate: cross
+      - uses: actions/checkout@v6
+      - uses: taiki-e/install-action@cross
       - name: Cache Cargo Dependencies
         uses: Swatinem/rust-cache@v2
         with:
           cache-on-failure: true
           key: ${{ matrix.arch }}
-      - name: Start Docker (required for cross-rs)
-        run: sudo systemctl start docker
       - name: Cross-Run Tests using QEMU
         run: cross test --target ${{ matrix.arch }}
 
+  msrv:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v6
+    - uses: dtolnay/rust-toolchain@stable
+    - uses: taiki-e/install-action@cargo-hack
+    - name: Check MSRV
+      run: cargo hack check --rust-version
+
   rustfmt:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v6
     - uses: dtolnay/rust-toolchain@stable
       with:
         components: rustfmt
@@ -87,8 +107,8 @@ jobs:
   clippy:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v6
     - uses: dtolnay/rust-toolchain@stable
       with:
         components: clippy
-    - run: cargo clippy --all-features # TODO: enable "-- -D warnings" once all outstanding clippy lints are fixed
+    - run: cargo clippy --all-features --all-targets -- -D warnings

.gitignore

@@ -2,3 +2,4 @@
 /target/
 **/*.rs.bk
 Cargo.lock
+tests/benches/corpus/

CHANGES.md

@@ -1,3 +1,40 @@
+# Version 0.12.0 (unreleased)
+
+Fixes:
+- Decoding a tiled image whose width is not a multiple of the tile width no
+  longer corrupts the columns below the right border tiles when extra samples
+  are discarded (e.g. RGB with an unspecified extra sample). The horizontal
+  tile padding was written past the end of the output row, spilling into the
+  leftmost columns of the following row.
+
+Additions:
+- Added the `TiffHeader` type. It can be used to create a `Decoder` in a state
+  before the first IFD and allows opening files at an arbitrary first IFD
+  offset rather than one indicated by an encoded header at the start.
+
+Changes:
+- The IFD iteration methods on `Decoder` (`next_image`, `seek_to_image`, etc)
+  now come with a strong error guarantee. They will not modify the current
+  directory state if they fail. This includes the failure to interpret an IFD
+  as a supported image in the case of `*_image` variants.
+
+Compatibility:
+- Changed how tiled TIFF files are detected. The presence of a TileWidth OR
+  TileHeight/TileLength tag now marks an image as tiled. Data is no retrieved
+  from either StripOffsets or TileOffsets with the latter taking precedence.
+  This is closer to the behavior of libtiff.
+
+# Version 0.11.3
+
+Additions:
+- Added support for `webp` compression (as per GDAL) under the `webp` feature flag (default: off).
+- Added `Decoder::image_ifd`, creating an `IfdDecoder` of the current IFD.
+- Added `IfdDecoder::directory`, returning the `Directory` underlying it.
+- Added `LowerHex` and `UpwerHex` implementations for `IfdPointer`.
+
+Notes:
+- A new example `tiff-ls` demonstrates use of the new features.
+
 # Version 0.11.2
 
 Changes:

Cargo.toml

@@ -1,11 +1,11 @@
 [package]
 name = "tiff"
-version = "0.11.2"
+version = "0.11.3"
 edition = "2021"
 resolver = "2"
 
 # note: when changed, also update test runner in `.github/workflows/rust.yml`
-rust-version = "1.85.0"
+rust-version = "1.88.0"
 
 license = "MIT"
 description = "TIFF decoding and encoding library in pure Rust"
@@ -23,14 +23,18 @@ quick-error = "2.0.1"
 # Rename to avoid confusion with the feature name.
 fax34 = { package = "fax", version = "0.2.6", optional = true }
 flate2 = { version = "1.0.20", optional = true }
-weezl = { version = "0.1.10", optional = true }
+weezl = { version = "0.2.1", optional = true }
 zstd = { version = "0.13", optional = true }
+zrip-decode = { version = "0.8.2", features = ["paranoid"], optional = true }
 zune-jpeg = { version = "0.5.1", optional = true }
+image-webp = {version = "0.2.4", optional = true }
 
 [dev-dependencies]
 criterion = "0.3.1"
 # We may already depend on this via flate2
 crc32fast = "1.5"
+libtest-mimic = "0.8.1"
+walkdir = "2.5"
 
 [features]
 default = ["deflate", "fax", "jpeg", "lzw"]
@@ -40,8 +44,26 @@ deflate = ["dep:flate2"]
 fax = ["dep:fax34"]
 jpeg = ["dep:zune-jpeg"]
 lzw = ["dep:weezl"]
+webp = ["dep:image-webp"]
 zstd = ["dep:zstd"]
+# Fully safe Rust but somewhat slower Zstd decoding.
+# When both zstd and zstd-safe-rust are enabled, zstd takes precedence.
+zstd-safe-rust = ["dep:zrip-decode"]
 
 [[bench]]
 name = "lzw"
 harness = false
+
+[[bench]]
+name = "encode"
+harness = false
+
+[[bench]]
+name = "decode"
+harness = false
+
+
+[[test]]
+name = "decode_libtiffpic"
+path = "tests/decode_libtiffpic.rs"
+harness = false

README.md

@@ -55,4 +55,4 @@ This crate uses [cargo-fuzz](https://github.com/rust-fuzz/cargo-fuzz) in order t
 
 After installing it with `cargo install cargo-fuzz` on a nightly rustc, the
 fuzzing harness can be run with recommended settings using 
-`cargo fuzz run decode_image -snone -- -timeout=5`.
+`cargo fuzz run decode_comprehensive -snone -- -dict=fuzz/tiff.dict -timeout=5`.

benches/decode.rs

@@ -0,0 +1,461 @@
+extern crate criterion;
+extern crate tiff;
+
+use criterion::{black_box, Criterion, Throughput};
+use std::io::Cursor;
+use tiff::decoder::Decoder;
+use tiff::encoder::colortype::{Gray16, Gray8, RGB32Float, RGB16, RGB8, RGBA8};
+use tiff::encoder::{Compression, Predictor, TiffEncoder};
+
+const WIDTH: u32 = 2048;
+const HEIGHT: u32 = 2048;
+
+// === Corpus paths (real photo-based TIFFs) ===
+// Set TIFF_BENCH_DIR / TIFF_GEOTIFF_DIR env vars to a directory containing the corpus files.
+// If the files are not found, the corresponding benchmarks are silently skipped.
+// The corpus can be generated with vips/imagemagick from any large photo; see the benchmark
+// names for the expected filenames and compression settings.
+const CORPUS_DIR: &str = "tests/benches/corpus";
+
+fn bench_dir() -> String {
+    std::env::var("TIFF_BENCH_DIR").unwrap_or_else(|_| CORPUS_DIR.to_string())
+}
+
+fn geotiff_dir() -> String {
+    std::env::var("TIFF_GEOTIFF_DIR").unwrap_or_else(|_| CORPUS_DIR.to_string())
+}
+
+/// Load a file from the corpus directory, returning None if not found.
+fn load_corpus(dir: &str, name: &str) -> Option<Vec<u8>> {
+    let path = format!("{}/{}", dir, name);
+    std::fs::read(&path).ok()
+}
+
+fn decode_tiff_bytes(data: &[u8]) {
+    let cursor = Cursor::new(data);
+    let mut decoder = Decoder::open(black_box(cursor)).unwrap();
+    decoder.next_image().unwrap();
+    decoder.read_image().unwrap();
+}
+
+// === Synthetic image generators ===
+
+fn generate_rgb8(w: u32, h: u32) -> Vec<u8> {
+    (0..w * h * 3)
+        .map(|i| ((i * 7 + i / w * 3) & 0xFF) as u8)
+        .collect()
+}
+
+fn generate_rgba8(w: u32, h: u32) -> Vec<u8> {
+    (0..w * h * 4)
+        .map(|i| ((i * 11 + i / w * 5) & 0xFF) as u8)
+        .collect()
+}
+
+fn generate_gray8(w: u32, h: u32) -> Vec<u8> {
+    (0..w * h)
+        .map(|i| ((i * 7 + i / w * 3) & 0xFF) as u8)
+        .collect()
+}
+
+fn generate_rgb16(w: u32, h: u32) -> Vec<u16> {
+    (0..w * h * 3)
+        .map(|i| ((i * 257 + i / w * 131) & 0xFFFF) as u16)
+        .collect()
+}
+
+fn generate_gray16(w: u32, h: u32) -> Vec<u16> {
+    (0..w * h)
+        .map(|i| ((i * 257 + i / w * 131) & 0xFFFF) as u16)
+        .collect()
+}
+
+fn generate_rgb_f32(w: u32, h: u32) -> Vec<f32> {
+    let mut data = Vec::with_capacity((w * h * 3) as usize);
+    for y in 0..h {
+        for x in 0..w {
+            let fx = x as f32 / w as f32;
+            let fy = y as f32 / h as f32;
+            data.push(fx * 0.5 + fy * 0.3);
+            data.push(fy * 0.7 + fx * 0.2);
+            data.push((fx + fy) * 0.25);
+        }
+    }
+    data
+}
+
+// === Synthetic encoders (strip-only, encoder doesn't support tiles) ===
+
+fn encode<C: tiff::encoder::colortype::ColorType>(
+    data: &[C::Inner],
+    w: u32,
+    h: u32,
+    compression: Compression,
+    predictor: Predictor,
+) -> Vec<u8>
+where
+    [C::Inner]: tiff::encoder::TiffValue,
+{
+    let mut buf = Cursor::new(Vec::new());
+    TiffEncoder::new(&mut buf)
+        .unwrap()
+        .with_predictor(predictor)
+        .with_compression(compression)
+        .write_image::<C>(w, h, data)
+        .unwrap();
+    buf.into_inner()
+}
+
+fn main() {
+    let mut c = Criterion::default().configure_from_args();
+    let bd = bench_dir();
+    let gd = geotiff_dir();
+
+    // ========================================================================
+    // PART 1: Real photo corpus (5616x3744, ~21MP)
+    // ========================================================================
+    // Raw pixel sizes for throughput calculation:
+    //   RGB8:  5616*3744*3 = 63,078,912
+    //   RGB16: 5616*3744*6 = 126,157,824
+    //   F32x3: 5616*3744*12 = 252,315,648
+    //   Gray8: 5616*3744*1 = 21,026,304
+    //   GrayF32: 5616*3744*4 = 84,105,216
+    //   Palette8: 5616*3744*1 = 21,026,304 (output)
+
+    struct CorpusBench {
+        file: &'static str,
+        name: &'static str,
+        raw_bytes: u64,
+    }
+
+    let photo_benches = [
+        // Strip-based
+        CorpusBench {
+            file: "photo-rgb8-none.tif",
+            name: "strip-rgb8-none",
+            raw_bytes: 63_078_912,
+        },
+        CorpusBench {
+            file: "photo-rgb8-packbits.tif",
+            name: "strip-rgb8-packbits",
+            raw_bytes: 63_078_912,
+        },
+        CorpusBench {
+            file: "photo-rgb8-lzw.tif",
+            name: "strip-rgb8-lzw",
+            raw_bytes: 63_078_912,
+        },
+        CorpusBench {
+            file: "photo-rgb8-lzw-hpred.tif",
+            name: "strip-rgb8-lzw-hpred",
+            raw_bytes: 63_078_912,
+        },
+        CorpusBench {
+            file: "photo-rgb8-deflate-hpred.tif",
+            name: "strip-rgb8-deflate-hpred",
+            raw_bytes: 63_078_912,
+        },
+        CorpusBench {
+            file: "photo-rgb16-deflate-hpred.tif",
+            name: "strip-rgb16-deflate-hpred",
+            raw_bytes: 126_157_824,
+        },
+        CorpusBench {
+            file: "photo-gray8-lzw.tif",
+            name: "strip-gray8-lzw",
+            raw_bytes: 21_026_304,
+        },
+        CorpusBench {
+            file: "photo-gray8-deflate-hpred.tif",
+            name: "strip-gray8-deflate-hpred",
+            raw_bytes: 21_026_304,
+        },
+        CorpusBench {
+            file: "photo-rgb-f32-deflate-fpred.tif",
+            name: "strip-rgb-f32-deflate-fpred",
+            raw_bytes: 252_315_648,
+        },
+        CorpusBench {
+            file: "photo-gray-f32-deflate-fpred.tif",
+            name: "strip-gray-f32-deflate-fpred",
+            raw_bytes: 84_105_216,
+        },
+        CorpusBench {
+            file: "photo-palette8-lzw.tif",
+            name: "strip-palette8-lzw",
+            raw_bytes: 21_026_304,
+        },
+        CorpusBench {
+            file: "scan-bilevel-fax4.tif",
+            name: "strip-bilevel-fax4",
+            raw_bytes: 5616 * 3744 / 8,
+        },
+        // Tiled
+        CorpusBench {
+            file: "photo-rgb8-lzw-hpred-tiled256.tif",
+            name: "tiled256-rgb8-lzw-hpred",
+            raw_bytes: 63_078_912,
+        },
+        CorpusBench {
+            file: "photo-rgb8-deflate-hpred-tiled256.tif",
+            name: "tiled256-rgb8-deflate-hpred",
+            raw_bytes: 63_078_912,
+        },
+        CorpusBench {
+            file: "photo-rgb8-jpeg-tiled256.tif",
+            name: "tiled256-rgb8-jpeg",
+            raw_bytes: 63_078_912,
+        },
+        CorpusBench {
+            file: "photo-gray-f32-deflate-fpred-tiled512.tif",
+            name: "tiled512-gray-f32-deflate-fpred",
+            raw_bytes: 84_105_216,
+        },
+    ];
+
+    {
+        let mut group = c.benchmark_group("photo-21mp");
+        group.sample_size(10);
+
+        for bench in &photo_benches {
+            if let Some(data) = load_corpus(&bd, bench.file) {
+                group.throughput(Throughput::Bytes(bench.raw_bytes));
+                let data_ref = &data;
+                group.bench_function(bench.name, |b| b.iter(|| decode_tiff_bytes(data_ref)));
+            }
+        }
+
+        group.finish();
+    }
+
+    // ========================================================================
+    // PART 2: GeoTIFF (real tiled DEM data)
+    // ========================================================================
+
+    let geotiff_benches = [
+        // Copernicus DEM: 3600x3600, tiled 1024x1024, Gray f32, deflate + fpredict
+        CorpusBench {
+            file: "Copernicus_DSM_COG_10_N40_00_W075_00_DEM.tif",
+            name: "copernicus-dem-f32-deflate-fpred-1024tile",
+            raw_bytes: 3600 * 3600 * 4,
+        },
+        // USGS DEM: 3612x3612, tiled 512x512, Gray f32, LZW + fpredict
+        CorpusBench {
+            file: "USGS_1_n40w075.tif",
+            name: "usgs-dem-f32-lzw-fpred-512tile",
+            raw_bytes: 3612 * 3612 * 4,
+        },
+    ];
+
+    {
+        let mut group = c.benchmark_group("geotiff");
+        group.sample_size(10);
+
+        for bench in &geotiff_benches {
+            if let Some(data) = load_corpus(&gd, bench.file) {
+                group.throughput(Throughput::Bytes(bench.raw_bytes));
+                let data_ref = &data;
+                group.bench_function(bench.name, |b| b.iter(|| decode_tiff_bytes(data_ref)));
+            }
+        }
+
+        group.finish();
+    }
+
+    // ========================================================================
+    // PART 3: Synthetic (2048x2048, controlled comparisons)
+    // ========================================================================
+
+    let rgb8 = generate_rgb8(WIDTH, HEIGHT);
+    let rgba8 = generate_rgba8(WIDTH, HEIGHT);
+    let gray8 = generate_gray8(WIDTH, HEIGHT);
+    let rgb16 = generate_rgb16(WIDTH, HEIGHT);
+    let gray16 = generate_gray16(WIDTH, HEIGHT);
+    let rgb_f32 = generate_rgb_f32(WIDTH, HEIGHT);
+
+    let raw_rgb8 = (WIDTH * HEIGHT * 3) as u64;
+    let raw_rgba8 = (WIDTH * HEIGHT * 4) as u64;
+    let raw_gray8 = (WIDTH * HEIGHT) as u64;
+    let raw_rgb16 = (WIDTH * HEIGHT * 6) as u64;
+    let raw_gray16 = (WIDTH * HEIGHT * 2) as u64;
+    let raw_f32x3 = (WIDTH * HEIGHT * 12) as u64;
+
+    // --- Uncompressed baseline ---
+    {
+        let mut group = c.benchmark_group("synth-uncompressed");
+        group.sample_size(10);
+
+        let t = encode::<RGB8>(
+            &rgb8,
+            WIDTH,
+            HEIGHT,
+            Compression::Uncompressed,
+            Predictor::None,
+        );
+        group
+            .throughput(Throughput::Bytes(raw_rgb8))
+            .bench_function("rgb8", |b| b.iter(|| decode_tiff_bytes(&t)));
+
+        let t = encode::<RGBA8>(
+            &rgba8,
+            WIDTH,
+            HEIGHT,
+            Compression::Uncompressed,
+            Predictor::None,
+        );
+        group
+            .throughput(Throughput::Bytes(raw_rgba8))
+            .bench_function("rgba8", |b| b.iter(|| decode_tiff_bytes(&t)));
+
+        let t = encode::<Gray8>(
+            &gray8,
+            WIDTH,
+            HEIGHT,
+            Compression::Uncompressed,
+            Predictor::None,
+        );
+        group
+            .throughput(Throughput::Bytes(raw_gray8))
+            .bench_function("gray8", |b| b.iter(|| decode_tiff_bytes(&t)));
+
+        let t = encode::<RGB16>(
+            &rgb16,
+            WIDTH,
+            HEIGHT,
+            Compression::Uncompressed,
+            Predictor::None,
+        );
+        group
+            .throughput(Throughput::Bytes(raw_rgb16))
+            .bench_function("rgb16", |b| b.iter(|| decode_tiff_bytes(&t)));
+
+        let t = encode::<Gray16>(
+            &gray16,
+            WIDTH,
+            HEIGHT,
+            Compression::Uncompressed,
+            Predictor::None,
+        );
+        group
+            .throughput(Throughput::Bytes(raw_gray16))
+            .bench_function("gray16", |b| b.iter(|| decode_tiff_bytes(&t)));
+
+        group.finish();
+    }
+
+    // --- Predictor overhead isolation (deflate-1, with vs without predictor) ---
+    {
+        let mut group = c.benchmark_group("synth-predictor");
+        group.sample_size(10);
+
+        let t = encode::<RGB8>(
+            &rgb8,
+            WIDTH,
+            HEIGHT,
+            Compression::Deflate(1),
+            Predictor::None,
+        );
+        group
+            .throughput(Throughput::Bytes(raw_rgb8))
+            .bench_function("rgb8-deflate-none", |b| b.iter(|| decode_tiff_bytes(&t)));
+
+        let t = encode::<RGB8>(
+            &rgb8,
+            WIDTH,
+            HEIGHT,
+            Compression::Deflate(1),
+            Predictor::Horizontal,
+        );
+        group
+            .throughput(Throughput::Bytes(raw_rgb8))
+            .bench_function("rgb8-deflate-hpred", |b| b.iter(|| decode_tiff_bytes(&t)));
+
+        let t = encode::<RGB16>(
+            &rgb16,
+            WIDTH,
+            HEIGHT,
+            Compression::Deflate(1),
+            Predictor::None,
+        );
+        group
+            .throughput(Throughput::Bytes(raw_rgb16))
+            .bench_function("rgb16-deflate-none", |b| b.iter(|| decode_tiff_bytes(&t)));
+
+        let t = encode::<RGB16>(
+            &rgb16,
+            WIDTH,
+            HEIGHT,
+            Compression::Deflate(1),
+            Predictor::Horizontal,
+        );
+        group
+            .throughput(Throughput::Bytes(raw_rgb16))
+            .bench_function("rgb16-deflate-hpred", |b| b.iter(|| decode_tiff_bytes(&t)));
+
+        let t = encode::<RGB32Float>(
+            &rgb_f32,
+            WIDTH,
+            HEIGHT,
+            Compression::Deflate(1),
+            Predictor::None,
+        );
+        group
+            .throughput(Throughput::Bytes(raw_f32x3))
+            .bench_function("rgb-f32-deflate-none", |b| b.iter(|| decode_tiff_bytes(&t)));
+
+        let t = encode::<RGB32Float>(
+            &rgb_f32,
+            WIDTH,
+            HEIGHT,
+            Compression::Deflate(1),
+            Predictor::FloatingPoint,
+        );
+        group
+            .throughput(Throughput::Bytes(raw_f32x3))
+            .bench_function("rgb-f32-deflate-fpred", |b| {
+                b.iter(|| decode_tiff_bytes(&t))
+            });
+
+        group.finish();
+    }
+
+    // --- LZW vs Deflate comparison ---
+    {
+        let mut group = c.benchmark_group("synth-compression");
+        group.sample_size(10);
+
+        let t = encode::<RGB8>(
+            &rgb8,
+            WIDTH,
+            HEIGHT,
+            Compression::Deflate(1),
+            Predictor::Horizontal,
+        );
+        group
+            .throughput(Throughput::Bytes(raw_rgb8))
+            .bench_function("rgb8-deflate-hpred", |b| b.iter(|| decode_tiff_bytes(&t)));
+
+        let t = encode::<RGB8>(
+            &rgb8,
+            WIDTH,
+            HEIGHT,
+            Compression::Lzw,
+            Predictor::Horizontal,
+        );
+        group
+            .throughput(Throughput::Bytes(raw_rgb8))
+            .bench_function("rgb8-lzw-hpred", |b| b.iter(|| decode_tiff_bytes(&t)));
+
+        let t = encode::<RGB8>(&rgb8, WIDTH, HEIGHT, Compression::Lzw, Predictor::None);
+        group
+            .throughput(Throughput::Bytes(raw_rgb8))
+            .bench_function("rgb8-lzw-none", |b| b.iter(|| decode_tiff_bytes(&t)));
+
+        let t = encode::<RGB8>(&rgb8, WIDTH, HEIGHT, Compression::Packbits, Predictor::None);
+        group
+            .throughput(Throughput::Bytes(raw_rgb8))
+            .bench_function("rgb8-packbits", |b| b.iter(|| decode_tiff_bytes(&t)));
+
+        group.finish();
+    }
+}

benches/encode.rs

@@ -0,0 +1,44 @@
+extern crate criterion;
+extern crate tiff;
+
+use criterion::{black_box, Criterion, Throughput};
+use std::io::Cursor;
+use tiff::encoder::colortype::RGB32Float;
+use tiff::encoder::{Compression, Predictor, TiffEncoder};
+
+const WIDTH: u32 = 500;
+const HEIGHT: u32 = 500;
+
+fn encode_image_f32_float_predictor_deflate(data: &[f32]) {
+    let mut buf = Cursor::new(Vec::with_capacity(WIDTH as usize * HEIGHT as usize * 4));
+    TiffEncoder::new(&mut buf)
+        .unwrap()
+        .with_predictor(Predictor::FloatingPoint)
+        .with_compression(Compression::Deflate(1))
+        .write_image::<RGB32Float>(WIDTH, HEIGHT, black_box(data))
+        .unwrap();
+}
+
+fn main() {
+    // Generate synthetic f32 image data with a gradient pattern
+    let data: Vec<f32> = (0..WIDTH as usize * HEIGHT as usize * 3)
+        .map(|i| {
+            let pixel = i / 3;
+            let x = (pixel % WIDTH as usize) as f32 / WIDTH as f32;
+            let y = (pixel / WIDTH as usize) as f32 / HEIGHT as f32;
+            x * 0.5 + y * 0.5
+        })
+        .collect();
+
+    let mut c = Criterion::default().configure_from_args();
+    let mut group = c.benchmark_group("tiff-encode");
+
+    group
+        .sample_size(20)
+        .throughput(Throughput::Bytes(
+            (WIDTH as u64) * (HEIGHT as u64) * 3 * std::mem::size_of::<f32>() as u64,
+        ))
+        .bench_function("f32-float-predictor-deflate-fast", |b| {
+            b.iter(|| encode_image_f32_float_predictor_deflate(&data))
+        });
+}

benches/lzw.rs

@@ -8,13 +8,12 @@ use tiff::decoder::Decoder;
 
 fn read_image(image: &[u8]) {
     let image = std::io::Cursor::new(image);
-    let decoder = Decoder::new(black_box(image));
+    let decoder = Decoder::open(black_box(image));
     let mut reader = decoder.unwrap();
-
-    while {
+    while reader.more_images() {
+        reader.next_directory().unwrap();
         reader.read_image().unwrap();
-        reader.more_images()
-    } {}
+    }
 }
 
 fn main() {

examples/decode.rs

@@ -1,29 +1,31 @@
-use tiff::decoder::{BufferLayoutPreference, Decoder, DecodingBuffer, DecodingResult};
+use tiff::decoder::{BufferLayoutPreference, Decoder, DecodingSampleBuffer, DecodingSampleSlice};
 
 fn main() -> Result<(), Box<dyn std::error::Error>> {
     let Some(image) = std::env::args_os().nth(1) else {
-        eprintln!("Usage: decode FILE");
+        eprintln!("Usage: decode FILE [--lenient]");
         return Ok(());
     };
 
+    let lenient = std::env::args().nth(2).as_deref() == Some("--lenient");
+
     let file = std::fs::File::open(image)?;
     let io = std::io::BufReader::new(file);
-    let mut reader = Decoder::new(io)?;
+    let mut reader = Decoder::open(io)?.with_lenient(lenient);
 
-    let mut data = DecodingResult::I8(vec![]);
+    let mut data = DecodingSampleBuffer::I8(vec![]);
 
     for i in 0u32.. {
+        if !reader.more_images() {
+            break;
+        }
+
+        reader.next_directory()?;
+
         let colortype = reader.colortype()?;
         let dimensions = reader.dimensions()?;
         let layout = reader.read_image_to_buffer(&mut data)?;
 
         debug_planes(i, &mut data, &layout, &colortype, dimensions);
-
-        if !reader.more_images() {
-            break;
-        }
-
-        reader.next_image()?
     }
 
     Ok(())
@@ -31,11 +33,36 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
 
 fn debug_planes(
     index: u32,
-    data: &mut DecodingResult,
+    data: &mut DecodingSampleBuffer,
     layout: &BufferLayoutPreference,
     colortype: &tiff::ColorType,
     (width, height): (u32, u32),
 ) {
+    match data {
+        DecodingSampleBuffer::F16(v) => {
+            let samples = v
+                .iter()
+                .map(|&f| (f64::from(f) * f64::from(u16::MAX)) as u16)
+                .collect::<Vec<_>>();
+            *data = DecodingSampleBuffer::U16(samples);
+        }
+        DecodingSampleBuffer::F32(v) => {
+            let samples = v
+                .iter()
+                .map(|&f| (f64::from(f) * f64::from(u16::MAX)) as u16)
+                .collect::<Vec<_>>();
+            *data = DecodingSampleBuffer::U16(samples);
+        }
+        DecodingSampleBuffer::F64(v) => {
+            let samples = v
+                .iter()
+                .map(|&f| (f * f64::from(u16::MAX)) as u16)
+                .collect::<Vec<_>>();
+            *data = DecodingSampleBuffer::U16(samples);
+        }
+        _ => {}
+    }
+
     let (depth, mut tupltype) = match colortype {
         // Note: we will expand, so this is in fact not BLACKANDWHITE
         tiff::ColorType::Gray(_) => (1, "GRAYSCALE"),
@@ -73,24 +100,24 @@ fn debug_planes(
         // them here (e.g. represent 1-bit as `{0, 1}`) but we'd also set `maxval` accordingly and
         // this requires tupltype to be `BLACKANDWHITE` so introducing a bunch of complexity. If
         // you want to do that in your real code, go ahead.
-        DecodingBuffer::U8(buf) => match colortype.bit_depth() {
+        DecodingSampleSlice::U8(buf) => match colortype.bit_depth() {
             8 => u64::from(u8::MAX),
             4 => {
                 fallback_buffer = vec![0; (swidth * sheight) as usize];
                 expand_4bit(buf, swidth, &mut fallback_buffer);
-                *data = DecodingResult::U8(fallback_buffer);
+                *data = DecodingSampleBuffer::U8(fallback_buffer);
                 u64::from(u8::MAX)
             }
             2 => {
                 fallback_buffer = vec![0; (swidth * sheight) as usize];
                 expand_2bit(buf, swidth, &mut fallback_buffer);
-                *data = DecodingResult::U8(fallback_buffer);
+                *data = DecodingSampleBuffer::U8(fallback_buffer);
                 u64::from(u8::MAX)
             }
             1 => {
                 fallback_buffer = vec![0; (swidth * sheight) as usize];
                 expand_1bit(buf, swidth, &mut fallback_buffer);
-                *data = DecodingResult::U8(fallback_buffer);
+                *data = DecodingSampleBuffer::U8(fallback_buffer);
                 u64::from(u8::MAX)
             }
             _ => {
@@ -101,28 +128,30 @@ fn debug_planes(
                 return;
             }
         },
-        DecodingBuffer::U16(_) => u64::from(u16::MAX),
-        DecodingBuffer::U32(_) => u64::from(u32::MAX),
-        DecodingBuffer::U64(_) => u64::MAX,
+        DecodingSampleSlice::U16(_) => u64::from(u16::MAX),
+        DecodingSampleSlice::U32(_) => u64::from(u32::MAX),
+        DecodingSampleSlice::U64(_) => u64::MAX,
         // Eh, this is a good effort I guess.
-        DecodingBuffer::I8(items) => {
+        DecodingSampleSlice::I8(items) => {
             items.iter_mut().for_each(|v| *v = 0.max(*v));
             u64::from(i8::MAX as u8)
         }
-        DecodingBuffer::I16(items) => {
+        DecodingSampleSlice::I16(items) => {
             items.iter_mut().for_each(|v| *v = 0.max(*v));
             u64::from(i16::MAX as u16)
         }
-        DecodingBuffer::I32(items) => {
+        DecodingSampleSlice::I32(items) => {
             items.iter_mut().for_each(|v| *v = 0.max(*v));
             u64::from(i32::MAX as u32)
         }
-        DecodingBuffer::I64(items) => {
+        DecodingSampleSlice::I64(items) => {
             items.iter_mut().for_each(|v| *v = 0.max(*v));
             i64::MAX as u64
         }
         // Not supported by PAM.
-        DecodingBuffer::F16(_) | DecodingBuffer::F32(_) | DecodingBuffer::F64(_) => return,
+        DecodingSampleSlice::F16(_) | DecodingSampleSlice::F32(_) | DecodingSampleSlice::F64(_) => {
+            return
+        }
     };
 
     let byte_len = if layout.planes > 1 {

examples/profile_decode.rs

@@ -0,0 +1,130 @@
+//! Profiling helper: encodes and decodes several TIFF configurations.
+//! Run under callgrind: `valgrind --tool=callgrind target/release/examples/profile_decode`
+use std::io::Cursor;
+use tiff::decoder::Decoder;
+use tiff::encoder::colortype::{Gray8, RGB32Float, RGB16, RGB8};
+use tiff::encoder::{Compression, Predictor, TiffEncoder};
+
+const WIDTH: u32 = 2048;
+const HEIGHT: u32 = 2048;
+const ITERS: usize = 3;
+
+fn generate_rgb8(w: u32, h: u32) -> Vec<u8> {
+    (0..w * h * 3).map(|i| (i % 256) as u8).collect()
+}
+
+fn generate_rgb16(w: u32, h: u32) -> Vec<u16> {
+    (0..w * h * 3).map(|i| (i % 65536) as u16).collect()
+}
+
+fn generate_rgb_f32(w: u32, h: u32) -> Vec<f32> {
+    (0..w * h * 3)
+        .map(|i| (i as f32) / (w * h * 3) as f32)
+        .collect()
+}
+
+fn generate_gray8(w: u32, h: u32) -> Vec<u8> {
+    (0..w * h).map(|i| (i % 256) as u8).collect()
+}
+
+fn encode<C: tiff::encoder::colortype::ColorType>(
+    data: &[C::Inner],
+    w: u32,
+    h: u32,
+    compression: Compression,
+    predictor: Predictor,
+) -> Vec<u8>
+where
+    [C::Inner]: tiff::encoder::TiffValue,
+{
+    let mut buf = Cursor::new(Vec::new());
+    TiffEncoder::new(&mut buf)
+        .unwrap()
+        .with_predictor(predictor)
+        .with_compression(compression)
+        .write_image::<C>(w, h, data)
+        .unwrap();
+    buf.into_inner()
+}
+
+fn decode(data: &[u8]) {
+    let cursor = Cursor::new(data);
+    let mut decoder = Decoder::open(cursor).unwrap();
+    decoder.next_image().unwrap();
+    let _ = decoder.read_image().unwrap();
+}
+
+fn main() {
+    let rgb8 = generate_rgb8(WIDTH, HEIGHT);
+    let rgb16 = generate_rgb16(WIDTH, HEIGHT);
+    let rgb_f32 = generate_rgb_f32(WIDTH, HEIGHT);
+    let gray8 = generate_gray8(WIDTH, HEIGHT);
+
+    let cases: Vec<(&str, Vec<u8>)> = vec![
+        (
+            "deflate-rgb8-hpredict",
+            encode::<RGB8>(
+                &rgb8,
+                WIDTH,
+                HEIGHT,
+                Compression::Deflate(1),
+                Predictor::Horizontal,
+            ),
+        ),
+        (
+            "deflate-gray8-hpredict",
+            encode::<Gray8>(
+                &gray8,
+                WIDTH,
+                HEIGHT,
+                Compression::Deflate(1),
+                Predictor::Horizontal,
+            ),
+        ),
+        (
+            "deflate-rgb16-hpredict",
+            encode::<RGB16>(
+                &rgb16,
+                WIDTH,
+                HEIGHT,
+                Compression::Deflate(1),
+                Predictor::Horizontal,
+            ),
+        ),
+        (
+            "deflate-rgb-f32-fpredict",
+            encode::<RGB32Float>(
+                &rgb_f32,
+                WIDTH,
+                HEIGHT,
+                Compression::Deflate(1),
+                Predictor::FloatingPoint,
+            ),
+        ),
+        (
+            "lzw-rgb8-no-pred",
+            encode::<RGB8>(&rgb8, WIDTH, HEIGHT, Compression::Lzw, Predictor::None),
+        ),
+        (
+            "lzw-rgb8-hpredict",
+            encode::<RGB8>(
+                &rgb8,
+                WIDTH,
+                HEIGHT,
+                Compression::Lzw,
+                Predictor::Horizontal,
+            ),
+        ),
+    ];
+
+    for (name, tiff_data) in &cases {
+        eprintln!(
+            "=== Profiling: {} ({} bytes encoded) ===",
+            name,
+            tiff_data.len()
+        );
+        for _ in 0..ITERS {
+            decode(tiff_data);
+        }
+    }
+}

examples/tiff-ls.rs

@@ -0,0 +1,121 @@
+use std::borrow::Cow;
+
+use tiff::decoder::Decoder;
+
+fn main() -> Result<(), Box<dyn std::error::Error>> {
+    let Some(image) = std::env::args_os().nth(1) else {
+        eprintln!("Usage: decode FILE");
+        return Ok(());
+    };
+
+    let file = std::fs::File::open(image)?;
+    let io = std::io::BufReader::new(file);
+    let mut reader = Decoder::open(io)?;
+
+    while reader.more_images() {
+        reader.next_directory()?;
+        ls_dir(&mut reader);
+    }
+
+    Ok(())
+}
+
+fn ls_dir<R: std::io::Read + std::io::Seek>(reader: &mut Decoder<R>) {
+    if let Some(ifd) = reader.ifd_pointer() {
+        println!("Directory at {ifd:x}");
+    }
+
+    println!("Name\tHex\tType\tCount");
+    let ifd = reader.current_ifd();
+
+    for (tag, entry) in ifd.directory().iter() {
+        let name: &'static str = match tag {
+            tiff::tags::Tag::Artist => "Artist",
+            tiff::tags::Tag::BitsPerSample => "BitsPerSample",
+            tiff::tags::Tag::CellLength => "CellLength",
+            tiff::tags::Tag::CellWidth => "CellWidth",
+            tiff::tags::Tag::ColorMap => "ColorMap",
+            tiff::tags::Tag::Compression => "Compression",
+            tiff::tags::Tag::DateTime => "DateTime",
+            tiff::tags::Tag::ExtraSamples => "ExtraSamples",
+            tiff::tags::Tag::FillOrder => "FillOrder",
+            tiff::tags::Tag::FreeByteCounts => "FreeByteCounts",
+            tiff::tags::Tag::FreeOffsets => "FreeOffsets",
+            tiff::tags::Tag::GrayResponseCurve => "GrayResponseCurve",
+            tiff::tags::Tag::GrayResponseUnit => "GrayResponseUnit",
+            tiff::tags::Tag::HostComputer => "HostComputer",
+            tiff::tags::Tag::ImageDescription => "ImageDescription",
+            tiff::tags::Tag::ImageLength => "ImageLength",
+            tiff::tags::Tag::ImageWidth => "ImageWidth",
+            tiff::tags::Tag::Make => "Make",
+            tiff::tags::Tag::MaxSampleValue => "MaxSampleValue",
+            tiff::tags::Tag::MinSampleValue => "MinSampleValue",
+            tiff::tags::Tag::Model => "Model",
+            tiff::tags::Tag::NewSubfileType => "NewSubfileType",
+            tiff::tags::Tag::Orientation => "Orientation",
+            tiff::tags::Tag::PhotometricInterpretation => "PhotometricInterpretation",
+            tiff::tags::Tag::PlanarConfiguration => "PlanarConfiguration",
+            tiff::tags::Tag::ResolutionUnit => "ResolutionUnit",
+            tiff::tags::Tag::RowsPerStrip => "RowsPerStrip",
+            tiff::tags::Tag::SamplesPerPixel => "SamplesPerPixel",
+            tiff::tags::Tag::Software => "Software",
+            tiff::tags::Tag::StripByteCounts => "StripByteCounts",
+            tiff::tags::Tag::StripOffsets => "StripOffsets",
+            tiff::tags::Tag::SubfileType => "SubfileType",
+            tiff::tags::Tag::Threshholding => "Threshholding",
+            tiff::tags::Tag::XResolution => "XResolution",
+            tiff::tags::Tag::YResolution => "YResolution",
+            tiff::tags::Tag::Predictor => "Predictor",
+            tiff::tags::Tag::TileWidth => "TileWidth",
+            tiff::tags::Tag::TileLength => "TileLength",
+            tiff::tags::Tag::TileOffsets => "TileOffsets",
+            tiff::tags::Tag::TileByteCounts => "TileByteCounts",
+            tiff::tags::Tag::SubIfd => "SubIfd",
+            tiff::tags::Tag::SampleFormat => "SampleFormat",
+            tiff::tags::Tag::SMinSampleValue => "SMinSampleValue",
+            tiff::tags::Tag::SMaxSampleValue => "SMaxSampleValue",
+            tiff::tags::Tag::JPEGTables => "JPEGTables",
+            tiff::tags::Tag::ChromaSubsampling => "ChromaSubsampling",
+            tiff::tags::Tag::ChromaPositioning => "ChromaPositioning",
+            tiff::tags::Tag::ModelPixelScaleTag => "ModelPixelScaleTag",
+            tiff::tags::Tag::ModelTransformationTag => "ModelTransformationTag",
+            tiff::tags::Tag::ModelTiepointTag => "ModelTiepointTag",
+            tiff::tags::Tag::Copyright => "Copyright",
+            tiff::tags::Tag::ExifDirectory => "ExifDirectory",
+            tiff::tags::Tag::GpsDirectory => "GpsDirectory",
+            tiff::tags::Tag::IccProfile => "IccProfile",
+            tiff::tags::Tag::GeoKeyDirectoryTag => "GeoKeyDirectoryTag",
+            tiff::tags::Tag::GeoDoubleParamsTag => "GeoDoubleParamsTag",
+            tiff::tags::Tag::GeoAsciiParamsTag => "GeoAsciiParamsTag",
+            tiff::tags::Tag::ExifVersion => "ExifVersion",
+            tiff::tags::Tag::GdalNodata => "GdalNodata",
+            _ => "<unknown>",
+        };
+
+        let ty: Cow<'static, str> = match entry.field_type() {
+            tiff::tags::Type::BYTE => "u8".into(),
+            tiff::tags::Type::ASCII => "ascii".into(),
+            tiff::tags::Type::SHORT => "u16".into(),
+            tiff::tags::Type::LONG => "u32".into(),
+            tiff::tags::Type::RATIONAL => "r32".into(),
+            tiff::tags::Type::SBYTE => "i8".into(),
+            tiff::tags::Type::UNDEFINED => "byte".into(),
+            tiff::tags::Type::SSHORT => "s16".into(),
+            tiff::tags::Type::SLONG => "s32".into(),
+            tiff::tags::Type::SRATIONAL => "sr32".into(),
+            tiff::tags::Type::FLOAT => "f32".into(),
+            tiff::tags::Type::DOUBLE => "f64".into(),
+            tiff::tags::Type::IFD => "ifd32".into(),
+            tiff::tags::Type::LONG8 => "u64".into(),
+            tiff::tags::Type::SLONG8 => "i64".into(),
+            tiff::tags::Type::IFD8 => "ifd64".into(),
+            other => format!("{:x}", other.to_u16()).into(),
+        };
+
+        eprintln!(
+            "{name:16}\t{tag:4x}\t{ty}\t{count}",
+            tag = tag.to_u16(),
+            count = entry.count(),
+        );
+    }
+}

fuzz/Cargo.toml

@@ -19,7 +19,7 @@ path = ".."
 members = ["."]
 
 [[bin]]
-name = "decode_image"
-path = "fuzz_targets/decode_image.rs"
+name = "decode_comprehensive"
+path = "fuzz_targets/decode_comprehensive.rs"
 test = false
 doc = false

fuzz/fuzz_targets/decode_comprehensive.rs

@@ -0,0 +1,96 @@
+#![no_main]
+use libfuzzer_sys::fuzz_target;
+use std::io::{Cursor, Read, Seek};
+use tiff::decoder::{Decoder, Limits};
+use tiff::tags::Tag;
+
+fuzz_target!(|data: &[u8]| {
+    // Standalone header parse (separate code path from Decoder::open)
+    let _ = tiff::decoder::TiffHeader::parse(Cursor::new(data));
+
+    let mut decoder = match Decoder::open(Cursor::new(data)) {
+        Ok(d) => d,
+        Err(_) => return,
+    };
+
+    let mut limits = Limits::default();
+    limits.decoding_buffer_size = 512 * 1024;
+    limits.ifd_value_size = 64 * 1024;
+    limits.intermediate_buffer_size = 512 * 1024;
+    decoder = decoder.with_limits(limits);
+
+    // Probe first IFD (opened but image not yet parsed)
+    probe_directory(&mut decoder);
+
+    // Linear IFD iteration via next_directory — tolerates invalid
+    // intermediate IFDs that aren't decodable as images
+    let mut ifd_count = 1u32;
+    while decoder.more_images() && ifd_count < 8 {
+        if decoder.next_directory().is_err() {
+            break;
+        }
+        probe_directory(&mut decoder);
+        ifd_count += 1;
+    }
+
+    // Random-access traversal via seek (different code path: find_nth_ifd
+    // re-walks the IFD chain from the start each time)
+    for i in 0..ifd_count.min(4) as usize {
+        if decoder.seek_to_directory(i).is_ok() {
+            probe_directory(&mut decoder);
+        }
+        // seek_to_image eagerly parses the directory as an Image
+        let _ = decoder.seek_to_image(i);
+    }
+});
+
+fn probe_directory<R: Read + Seek>(decoder: &mut Decoder<R>) {
+    // Tag iteration — exercises value parsing for every tag in the IFD
+    for result in decoder.current_ifd().tag_iter() {
+        let _ = result;
+    }
+
+    // SubIFD / EXIF / GPS directory traversal — exercises read_directory
+    // with potentially adversarial offsets
+    if let Ok(Some(val)) = decoder.current_ifd().find_tag(Tag::SubIfd) {
+        if let Ok(ptrs) = val.into_ifd_vec() {
+            for ptr in ptrs.into_iter().take(4) {
+                let _ = decoder.read_directory(ptr);
+            }
+        }
+    }
+    for tag in [Tag::ExifDirectory, Tag::GpsDirectory] {
+        if let Ok(Some(val)) = decoder.current_ifd().find_tag(tag) {
+            if let Ok(ptr) = val.into_ifd_pointer() {
+                let _ = decoder.read_directory(ptr);
+            }
+        }
+    }
+
+    // Image-level probing — dimensions() triggers ensure_image,
+    // which lazily parses the directory as an Image
+    if decoder.dimensions().is_ok() {
+        let _ = decoder.colortype();
+        let _ = decoder.color_map();
+        let _ = decoder.get_chunk_type();
+        let _ = decoder.chunk_dimensions();
+        let _ = decoder.strip_count();
+        let _ = decoder.tile_count();
+        let _ = decoder.image_buffer_layout();
+        let _ = decoder.image_chunk_buffer_layout(0);
+
+        // Chunk reads at boundaries — first and last exercise
+        // different offset calculations
+        let _ = decoder.read_chunk(0);
+        let chunk_count = decoder
+            .strip_count()
+            .or_else(|_| decoder.tile_count())
+            .unwrap_or(0);
+        if chunk_count > 1 {
+            let _ = decoder.read_chunk(chunk_count - 1);
+        }
+
+        // Full image decode
+        let _ = decoder.read_image();
+    }
+}

fuzz/fuzz_targets/decode_image.rs

@@ -1,31 +0,0 @@
-#![no_main]
-use libfuzzer_sys::fuzz_target;
-
-fuzz_target!(|data: &[u8]| {
-    let mut decoder = if let Ok(d) = tiff::decoder::Decoder::new(std::io::Cursor::new(data)) {
-        d
-    } else {
-        return;
-    };
-
-    let mut limits = tiff::decoder::Limits::default();
-    limits.decoding_buffer_size = 1_000_000;
-    limits.ifd_value_size = 1_000_000;
-    limits.intermediate_buffer_size = 1_000_000;
-
-    decoder = decoder.with_limits(limits);
-    
-    loop {
-        if let Err(_) = decoder.read_image() {
-            break;
-        }
-
-        if !decoder.more_images() {
-            break;
-        }
-
-        if let Err(_) = decoder.next_image() {
-            break;
-        }
-    }
-});

fuzz/tiff.dict

@@ -0,0 +1,139 @@
+# === File headers ===
+
+# Classic TIFF (LE, BE)
+"\x49\x49\x2A\x00"
+"\x4D\x4D\x00\x2A"
+# BigTIFF (LE, BE) — version 43, 8-byte offsets, different parsing paths
+"\x49\x49\x2B\x00\x08\x00\x00\x00"
+"\x4D\x4D\x00\x2B\x00\x08\x00\x00"
+
+# === IFD field type codes (2-byte LE) ===
+# Decoder switches on these; wrong types exercise error paths
+
+"\x01\x00"
+"\x02\x00"
+"\x03\x00"
+"\x04\x00"
+"\x05\x00"
+"\x06\x00"
+"\x07\x00"
+"\x08\x00"
+"\x09\x00"
+"\x0A\x00"
+"\x0B\x00"
+"\x0C\x00"
+"\x0D\x00"
+"\x10\x00"
+"\x11\x00"
+"\x12\x00"
+
+# === IFD tag numbers (2-byte LE) ===
+
+# 256=ImageWidth 257=ImageLength 258=BitsPerSample
+"\x00\x01"
+"\x01\x01"
+"\x02\x01"
+# 259=Compression 262=PhotometricInterpretation
+"\x03\x01"
+"\x06\x01"
+# 273=StripOffsets 274=Orientation
+"\x11\x01"
+"\x12\x01"
+# 277=SamplesPerPixel 278=RowsPerStrip 279=StripByteCounts
+"\x15\x01"
+"\x16\x01"
+"\x17\x01"
+# 282=XResolution 283=YResolution 284=PlanarConfiguration
+"\x1A\x01"
+"\x1B\x01"
+"\x1C\x01"
+# 317=Predictor 320=ColorMap
+"\x3D\x01"
+"\x40\x01"
+# 322=TileWidth 323=TileLength 324=TileOffsets 325=TileByteCounts
+"\x42\x01"
+"\x43\x01"
+"\x44\x01"
+"\x45\x01"
+# 330=SubIfd 338=ExtraSamples 339=SampleFormat
+"\x4A\x01"
+"\x52\x01"
+"\x53\x01"
+# 347=JPEGTables 530=ChromaSubsampling
+"\x5B\x01"
+"\x12\x02"
+# 34665=ExifDirectory 34675=IccProfile 34853=GpsDirectory
+"\x69\x87"
+"\x73\x87"
+"\x25\x88"
+
+# === IFD tag numbers (2-byte BE) ===
+
+"\x01\x00"
+"\x01\x01"
+"\x01\x02"
+"\x01\x03"
+"\x01\x06"
+"\x01\x11"
+"\x01\x12"
+"\x01\x15"
+"\x01\x16"
+"\x01\x17"
+"\x01\x1A"
+"\x01\x1B"
+"\x01\x1C"
+"\x01\x3D"
+"\x01\x40"
+"\x01\x42"
+"\x01\x43"
+"\x01\x44"
+"\x01\x45"
+"\x01\x4A"
+"\x01\x52"
+"\x01\x53"
+"\x01\x5B"
+"\x02\x12"
+"\x87\x69"
+"\x87\x73"
+"\x88\x25"
+
+# === Compression codes (4-byte LE inline SHORT values) ===
+# These are the values stored in the IFD entry for tag 259
+
+# 1=None 2=Huffman 3=Fax3 4=Fax4 5=LZW
+"\x01\x00\x00\x00"
+"\x02\x00\x00\x00"
+"\x03\x00\x00\x00"
+"\x04\x00\x00\x00"
+"\x05\x00\x00\x00"
+# 6=OldJPEG 7=ModernJPEG 8=Deflate
+"\x06\x00\x00\x00"
+"\x07\x00\x00\x00"
+"\x08\x00\x00\x00"
+# 0x8005=PackBits 0x80B2=OldDeflate
+"\x05\x80\x00\x00"
+"\xB2\x80\x00\x00"
+
+# === Useful small values (4-byte LE) ===
+# BitsPerSample=16, =32 (8 already covered as Deflate compression above)
+
+"\x10\x00\x00\x00"
+"\x20\x00\x00\x00"
+
+# === Minimal IFD entries (12-byte LE: tag + type SHORT + count 1 + value) ===
+# These let the fuzzer splice complete valid entries into an IFD
+
+# ImageWidth=1
+"\x00\x01\x03\x00\x01\x00\x00\x00\x01\x00\x00\x00"
+# ImageLength=1
+"\x01\x01\x03\x00\x01\x00\x00\x00\x01\x00\x00\x00"
+# BitsPerSample=8
+"\x02\x01\x03\x00\x01\x00\x00\x00\x08\x00\x00\x00"
+# Compression=None
+"\x03\x01\x03\x00\x01\x00\x00\x00\x01\x00\x00\x00"
+# PhotometricInterpretation=BlackIsZero
+"\x06\x01\x03\x00\x01\x00\x00\x00\x01\x00\x00\x00"
+# SamplesPerPixel=1
+"\x15\x01\x03\x00\x01\x00\x00\x00\x01\x00\x00\x00"
+# RowsPerStrip=1
+"\x16\x01\x03\x00\x01\x00\x00\x00\x01\x00\x00\x00"

src/decoder/buffer.rs

@@ -0,0 +1,410 @@
+use half::f16;
+use std::alloc::{Layout, LayoutError};
+
+use crate::{
+    bytecast,
+    decoder::{BufferLayoutPreference, Limits},
+    error::{TiffError, TiffResult, TiffUnsupportedError},
+    tags::{ByteOrder, EndianBytes, SampleFormat},
+};
+
+/// Result of a decoding process
+#[derive(Debug)]
+pub enum DecodingSampleBuffer {
+    /// A vector of unsigned bytes
+    U8(Vec<u8>),
+    /// A vector of unsigned words
+    U16(Vec<u16>),
+    /// A vector of 32 bit unsigned ints
+    U32(Vec<u32>),
+    /// A vector of 64 bit unsigned ints
+    U64(Vec<u64>),
+    /// A vector of 16 bit IEEE floats (held in u16)
+    F16(Vec<f16>),
+    /// A vector of 32 bit IEEE floats
+    F32(Vec<f32>),
+    /// A vector of 64 bit IEEE floats
+    F64(Vec<f64>),
+    /// A vector of 8 bit signed ints
+    I8(Vec<i8>),
+    /// A vector of 16 bit signed ints
+    I16(Vec<i16>),
+    /// A vector of 32 bit signed ints
+    I32(Vec<i32>),
+    /// A vector of 64 bit signed ints
+    I64(Vec<i64>),
+}
+
+impl DecodingSampleBuffer {
+    /// Reallocate the buffer to decode all planes of the indicated layout.
+    pub fn resize_to(
+        &mut self,
+        buffer: &BufferLayoutPreference,
+        limits: &Limits,
+    ) -> Result<(), TiffError> {
+        let sample_type = buffer.sample_type.ok_or(TiffError::UnsupportedError(
+            TiffUnsupportedError::UnknownInterpretation,
+        ))?;
+
+        let extent = sample_type.extent_for_bytes(buffer.complete_len);
+        self.resize_to_extent(extent, limits)
+    }
+
+    pub(crate) fn resize_to_extent(
+        &mut self,
+        extent: DecodingExtent,
+        limits: &Limits,
+    ) -> Result<(), TiffError> {
+        // FIXME: we *can* reuse the allocation sometimes.
+        *self = extent.to_result_buffer(limits)?;
+        Ok(())
+    }
+
+    fn new<T: Default + Copy>(
+        size: usize,
+        limits: &Limits,
+        from_fn: fn(Vec<T>) -> Self,
+    ) -> TiffResult<DecodingSampleBuffer> {
+        if size > limits.decoding_buffer_size / core::mem::size_of::<T>() {
+            Err(TiffError::LimitsExceeded)
+        } else {
+            Ok(from_fn(vec![T::default(); size]))
+        }
+    }
+
+    fn new_u8(size: usize, limits: &Limits) -> TiffResult<DecodingSampleBuffer> {
+        Self::new(size, limits, DecodingSampleBuffer::U8)
+    }
+
+    fn new_u16(size: usize, limits: &Limits) -> TiffResult<DecodingSampleBuffer> {
+        Self::new(size, limits, DecodingSampleBuffer::U16)
+    }
+
+    fn new_u32(size: usize, limits: &Limits) -> TiffResult<DecodingSampleBuffer> {
+        Self::new(size, limits, DecodingSampleBuffer::U32)
+    }
+
+    fn new_u64(size: usize, limits: &Limits) -> TiffResult<DecodingSampleBuffer> {
+        Self::new(size, limits, DecodingSampleBuffer::U64)
+    }
+
+    fn new_f32(size: usize, limits: &Limits) -> TiffResult<DecodingSampleBuffer> {
+        Self::new(size, limits, DecodingSampleBuffer::F32)
+    }
+
+    fn new_f64(size: usize, limits: &Limits) -> TiffResult<DecodingSampleBuffer> {
+        Self::new(size, limits, DecodingSampleBuffer::F64)
+    }
+
+    fn new_f16(size: usize, limits: &Limits) -> TiffResult<DecodingSampleBuffer> {
+        Self::new(size, limits, DecodingSampleBuffer::F16)
+    }
+
+    fn new_i8(size: usize, limits: &Limits) -> TiffResult<DecodingSampleBuffer> {
+        Self::new(size, limits, DecodingSampleBuffer::I8)
+    }
+
+    fn new_i16(size: usize, limits: &Limits) -> TiffResult<DecodingSampleBuffer> {
+        Self::new(size, limits, DecodingSampleBuffer::I16)
+    }
+
+    fn new_i32(size: usize, limits: &Limits) -> TiffResult<DecodingSampleBuffer> {
+        Self::new(size, limits, DecodingSampleBuffer::I32)
+    }
+
+    fn new_i64(size: usize, limits: &Limits) -> TiffResult<DecodingSampleBuffer> {
+        Self::new(size, limits, DecodingSampleBuffer::I64)
+    }
+
+    /// Get a view of this buffer starting from the nth _sample_ of the current type.
+    pub fn as_buffer(&mut self, start: usize) -> DecodingSampleSlice<'_> {
+        match *self {
+            DecodingSampleBuffer::U8(ref mut buf) => DecodingSampleSlice::U8(&mut buf[start..]),
+            DecodingSampleBuffer::U16(ref mut buf) => DecodingSampleSlice::U16(&mut buf[start..]),
+            DecodingSampleBuffer::U32(ref mut buf) => DecodingSampleSlice::U32(&mut buf[start..]),
+            DecodingSampleBuffer::U64(ref mut buf) => DecodingSampleSlice::U64(&mut buf[start..]),
+            DecodingSampleBuffer::F16(ref mut buf) => DecodingSampleSlice::F16(&mut buf[start..]),
+            DecodingSampleBuffer::F32(ref mut buf) => DecodingSampleSlice::F32(&mut buf[start..]),
+            DecodingSampleBuffer::F64(ref mut buf) => DecodingSampleSlice::F64(&mut buf[start..]),
+            DecodingSampleBuffer::I8(ref mut buf) => DecodingSampleSlice::I8(&mut buf[start..]),
+            DecodingSampleBuffer::I16(ref mut buf) => DecodingSampleSlice::I16(&mut buf[start..]),
+            DecodingSampleBuffer::I32(ref mut buf) => DecodingSampleSlice::I32(&mut buf[start..]),
+            DecodingSampleBuffer::I64(ref mut buf) => DecodingSampleSlice::I64(&mut buf[start..]),
+        }
+    }
+
+    pub fn sample_type(&self) -> DecodingSampleType {
+        match *self {
+            DecodingSampleBuffer::U8(_) => DecodingSampleType::U8,
+            DecodingSampleBuffer::U16(_) => DecodingSampleType::U16,
+            DecodingSampleBuffer::U32(_) => DecodingSampleType::U32,
+            DecodingSampleBuffer::U64(_) => DecodingSampleType::U64,
+            DecodingSampleBuffer::F16(_) => DecodingSampleType::F16,
+            DecodingSampleBuffer::F32(_) => DecodingSampleType::F32,
+            DecodingSampleBuffer::F64(_) => DecodingSampleType::F64,
+            DecodingSampleBuffer::I8(_) => DecodingSampleType::I8,
+            DecodingSampleBuffer::I16(_) => DecodingSampleType::I16,
+            DecodingSampleBuffer::I32(_) => DecodingSampleType::I32,
+            DecodingSampleBuffer::I64(_) => DecodingSampleType::I64,
+        }
+    }
+
+    /// Change the endianess of buffered data.
+    ///
+    /// This utility may be used to prepare a buffer for consumption by methods taking raw bytes or
+    /// after filling the buffer with raw bytes.
+    ///
+    /// After this, interpreting the buffer on the host may no longer produce any reasonable
+    /// results. For instance, floats in the wrong byte order may produce a `NaN` with varying
+    /// payloads. Despite unexpected result however, this operation is always sound.
+    pub fn convert_endian(&mut self, from: ByteOrder, to: ByteOrder) {
+        self.as_buffer(0).convert_endian(from, to)
+    }
+}
+
+// A buffer for image decoding
+pub enum DecodingSampleSlice<'a> {
+    /// A slice of unsigned bytes
+    U8(&'a mut [u8]),
+    /// A slice of unsigned words
+    U16(&'a mut [u16]),
+    /// A slice of 32 bit unsigned ints
+    U32(&'a mut [u32]),
+    /// A slice of 64 bit unsigned ints
+    U64(&'a mut [u64]),
+    /// A slice of 16 bit IEEE floats
+    F16(&'a mut [f16]),
+    /// A slice of 32 bit IEEE floats
+    F32(&'a mut [f32]),
+    /// A slice of 64 bit IEEE floats
+    F64(&'a mut [f64]),
+    /// A slice of 8 bits signed ints
+    I8(&'a mut [i8]),
+    /// A slice of 16 bits signed ints
+    I16(&'a mut [i16]),
+    /// A slice of 32 bits signed ints
+    I32(&'a mut [i32]),
+    /// A slice of 64 bits signed ints
+    I64(&'a mut [i64]),
+}
+
+impl<'a> DecodingSampleSlice<'a> {
+    pub fn as_bytes(&self) -> &[u8] {
+        match self {
+            DecodingSampleSlice::U8(buf) => buf,
+            DecodingSampleSlice::I8(buf) => bytecast::i8_as_ne_bytes(buf),
+            DecodingSampleSlice::U16(buf) => bytecast::u16_as_ne_bytes(buf),
+            DecodingSampleSlice::I16(buf) => bytecast::i16_as_ne_bytes(buf),
+            DecodingSampleSlice::U32(buf) => bytecast::u32_as_ne_bytes(buf),
+            DecodingSampleSlice::I32(buf) => bytecast::i32_as_ne_bytes(buf),
+            DecodingSampleSlice::U64(buf) => bytecast::u64_as_ne_bytes(buf),
+            DecodingSampleSlice::I64(buf) => bytecast::i64_as_ne_bytes(buf),
+            DecodingSampleSlice::F16(buf) => bytecast::f16_as_ne_bytes(buf),
+            DecodingSampleSlice::F32(buf) => bytecast::f32_as_ne_bytes(buf),
+            DecodingSampleSlice::F64(buf) => bytecast::f64_as_ne_bytes(buf),
+        }
+    }
+
+    pub fn as_bytes_mut(&mut self) -> &mut [u8] {
+        match self {
+            DecodingSampleSlice::U8(buf) => buf,
+            DecodingSampleSlice::I8(buf) => bytecast::i8_as_ne_mut_bytes(buf),
+            DecodingSampleSlice::U16(buf) => bytecast::u16_as_ne_mut_bytes(buf),
+            DecodingSampleSlice::I16(buf) => bytecast::i16_as_ne_mut_bytes(buf),
+            DecodingSampleSlice::U32(buf) => bytecast::u32_as_ne_mut_bytes(buf),
+            DecodingSampleSlice::I32(buf) => bytecast::i32_as_ne_mut_bytes(buf),
+            DecodingSampleSlice::U64(buf) => bytecast::u64_as_ne_mut_bytes(buf),
+            DecodingSampleSlice::I64(buf) => bytecast::i64_as_ne_mut_bytes(buf),
+            DecodingSampleSlice::F16(buf) => bytecast::f16_as_ne_mut_bytes(buf),
+            DecodingSampleSlice::F32(buf) => bytecast::f32_as_ne_mut_bytes(buf),
+            DecodingSampleSlice::F64(buf) => bytecast::f64_as_ne_mut_bytes(buf),
+        }
+    }
+
+    pub fn reborrow(&mut self) -> DecodingSampleSlice<'_> {
+        match self {
+            DecodingSampleSlice::U8(items) => DecodingSampleSlice::U8(items),
+            DecodingSampleSlice::I8(items) => DecodingSampleSlice::I8(items),
+            DecodingSampleSlice::U16(items) => DecodingSampleSlice::U16(items),
+            DecodingSampleSlice::I16(items) => DecodingSampleSlice::I16(items),
+            DecodingSampleSlice::U32(items) => DecodingSampleSlice::U32(items),
+            DecodingSampleSlice::I32(items) => DecodingSampleSlice::I32(items),
+            DecodingSampleSlice::U64(items) => DecodingSampleSlice::U64(items),
+            DecodingSampleSlice::I64(items) => DecodingSampleSlice::I64(items),
+            DecodingSampleSlice::F16(items) => DecodingSampleSlice::F16(items),
+            DecodingSampleSlice::F32(items) => DecodingSampleSlice::F32(items),
+            DecodingSampleSlice::F64(items) => DecodingSampleSlice::F64(items),
+        }
+    }
+
+    pub fn sample_type(&self) -> DecodingSampleType {
+        match *self {
+            DecodingSampleSlice::U8(_) => DecodingSampleType::U8,
+            DecodingSampleSlice::U16(_) => DecodingSampleType::U16,
+            DecodingSampleSlice::U32(_) => DecodingSampleType::U32,
+            DecodingSampleSlice::U64(_) => DecodingSampleType::U64,
+            DecodingSampleSlice::F16(_) => DecodingSampleType::F16,
+            DecodingSampleSlice::F32(_) => DecodingSampleType::F32,
+            DecodingSampleSlice::F64(_) => DecodingSampleType::F64,
+            DecodingSampleSlice::I8(_) => DecodingSampleType::I8,
+            DecodingSampleSlice::I16(_) => DecodingSampleType::I16,
+            DecodingSampleSlice::I32(_) => DecodingSampleType::I32,
+            DecodingSampleSlice::I64(_) => DecodingSampleType::I64,
+        }
+    }
+
+    /// Change the endianess of referenced data.
+    ///
+    /// This utility may be used to prepare a buffer for consumption by methods taking raw bytes or
+    /// after filling the buffer with raw bytes.
+    ///
+    /// After this, interpreting the buffer on the host may no longer produce any reasonable
+    /// results. For instance, floats in the wrong byte order may produce a `NaN` with varying
+    /// payloads. Despite unexpected result however, this operation is always sound.
+    pub fn convert_endian(&mut self, from: ByteOrder, to: ByteOrder) {
+        let byte_unit = self.sample_type().endian_bytes();
+        from.convert_endian_bytes(byte_unit, self.as_bytes_mut(), to);
+    }
+
+    pub fn byte_len(&self) -> usize {
+        self.as_bytes().len()
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum DecodingSampleType {
+    U8,
+    U16,
+    U32,
+    U64,
+    F16,
+    F32,
+    F64,
+    I8,
+    I16,
+    I32,
+    I64,
+}
+
+impl DecodingSampleType {
+    pub fn sample_format(self) -> SampleFormat {
+        match self {
+            DecodingSampleType::U8 => SampleFormat::Uint,
+            DecodingSampleType::U16 => SampleFormat::Uint,
+            DecodingSampleType::U32 => SampleFormat::Uint,
+            DecodingSampleType::U64 => SampleFormat::Uint,
+            DecodingSampleType::F16 => SampleFormat::IEEEFP,
+            DecodingSampleType::F32 => SampleFormat::IEEEFP,
+            DecodingSampleType::F64 => SampleFormat::IEEEFP,
+            DecodingSampleType::I8 => SampleFormat::Int,
+            DecodingSampleType::I16 => SampleFormat::Int,
+            DecodingSampleType::I32 => SampleFormat::Int,
+            DecodingSampleType::I64 => SampleFormat::Int,
+        }
+    }
+
+    pub(crate) fn extent_for_bytes(self, bytes: usize) -> DecodingExtent {
+        match self {
+            DecodingSampleType::U8 => DecodingExtent::U8(bytes),
+            DecodingSampleType::U16 => DecodingExtent::U16(bytes.div_ceil(2)),
+            DecodingSampleType::U32 => DecodingExtent::U32(bytes.div_ceil(4)),
+            DecodingSampleType::U64 => DecodingExtent::U64(bytes.div_ceil(8)),
+            DecodingSampleType::I8 => DecodingExtent::I8(bytes),
+            DecodingSampleType::I16 => DecodingExtent::I16(bytes.div_ceil(2)),
+            DecodingSampleType::I32 => DecodingExtent::I32(bytes.div_ceil(4)),
+            DecodingSampleType::I64 => DecodingExtent::I64(bytes.div_ceil(8)),
+            DecodingSampleType::F16 => DecodingExtent::F16(bytes.div_ceil(2)),
+            DecodingSampleType::F32 => DecodingExtent::F32(bytes.div_ceil(4)),
+            DecodingSampleType::F64 => DecodingExtent::F64(bytes.div_ceil(8)),
+        }
+    }
+
+    fn endian_bytes(self) -> EndianBytes {
+        use EndianBytes::*;
+
+        match self {
+            DecodingSampleType::U8 => One,
+            DecodingSampleType::U16 => Two,
+            DecodingSampleType::U32 => Four,
+            DecodingSampleType::U64 => Eight,
+            DecodingSampleType::F16 => Two,
+            DecodingSampleType::F32 => Four,
+            DecodingSampleType::F64 => Eight,
+            DecodingSampleType::I8 => One,
+            DecodingSampleType::I16 => Two,
+            DecodingSampleType::I32 => Four,
+            DecodingSampleType::I64 => Eight,
+        }
+    }
+}
+
+/// The count and matching discriminant for a `DecodingBuffer`.
+#[derive(Clone)]
+pub(crate) enum DecodingExtent {
+    U8(usize),
+    U16(usize),
+    U32(usize),
+    U64(usize),
+    F16(usize),
+    F32(usize),
+    F64(usize),
+    I8(usize),
+    I16(usize),
+    I32(usize),
+    I64(usize),
+}
+
+impl DecodingExtent {
+    pub(crate) fn to_result_buffer(&self, limits: &Limits) -> TiffResult<DecodingSampleBuffer> {
+        match *self {
+            DecodingExtent::U8(count) => DecodingSampleBuffer::new_u8(count, limits),
+            DecodingExtent::U16(count) => DecodingSampleBuffer::new_u16(count, limits),
+            DecodingExtent::U32(count) => DecodingSampleBuffer::new_u32(count, limits),
+            DecodingExtent::U64(count) => DecodingSampleBuffer::new_u64(count, limits),
+            DecodingExtent::F16(count) => DecodingSampleBuffer::new_f16(count, limits),
+            DecodingExtent::F32(count) => DecodingSampleBuffer::new_f32(count, limits),
+            DecodingExtent::F64(count) => DecodingSampleBuffer::new_f64(count, limits),
+            DecodingExtent::I8(count) => DecodingSampleBuffer::new_i8(count, limits),
+            DecodingExtent::I16(count) => DecodingSampleBuffer::new_i16(count, limits),
+            DecodingExtent::I32(count) => DecodingSampleBuffer::new_i32(count, limits),
+            DecodingExtent::I64(count) => DecodingSampleBuffer::new_i64(count, limits),
+        }
+    }
+
+    pub(crate) fn preferred_layout(self) -> TiffResult<Layout> {
+        fn overflow(_: LayoutError) -> TiffError {
+            TiffError::LimitsExceeded
+        }
+
+        match self {
+            DecodingExtent::U8(count) => Layout::array::<u8>(count),
+            DecodingExtent::U16(count) => Layout::array::<u16>(count),
+            DecodingExtent::U32(count) => Layout::array::<u32>(count),
+            DecodingExtent::U64(count) => Layout::array::<u64>(count),
+            DecodingExtent::F16(count) => Layout::array::<f16>(count),
+            DecodingExtent::F32(count) => Layout::array::<f32>(count),
+            DecodingExtent::F64(count) => Layout::array::<f64>(count),
+            DecodingExtent::I8(count) => Layout::array::<i8>(count),
+            DecodingExtent::I16(count) => Layout::array::<i16>(count),
+            DecodingExtent::I32(count) => Layout::array::<i32>(count),
+            DecodingExtent::I64(count) => Layout::array::<i64>(count),
+        }
+        .map_err(overflow)
+    }
+
+    pub(crate) fn sample_type(&self) -> DecodingSampleType {
+        match *self {
+            DecodingExtent::U8(_) => DecodingSampleType::U8,
+            DecodingExtent::U16(_) => DecodingSampleType::U16,
+            DecodingExtent::U32(_) => DecodingSampleType::U32,
+            DecodingExtent::U64(_) => DecodingSampleType::U64,
+            DecodingExtent::F16(_) => DecodingSampleType::F16,
+            DecodingExtent::F32(_) => DecodingSampleType::F32,
+            DecodingExtent::F64(_) => DecodingSampleType::F64,
+            DecodingExtent::I8(_) => DecodingSampleType::I8,
+            DecodingExtent::I16(_) => DecodingSampleType::I16,
+            DecodingExtent::I32(_) => DecodingSampleType::I32,
+            DecodingExtent::I64(_) => DecodingSampleType::I64,
+        }
+    }
+}

src/decoder/cycles.rs

@@ -11,7 +11,7 @@ use std::collections::HashMap;
 ///
 /// Since we only consider one child, we run union find to assign each pointer to a known chain.
 /// Then, when we insert a new edge we check if they belong to the same component.
-#[derive(Default, Debug)]
+#[derive(Clone, Default, Debug)]
 pub struct IfdCycles {
     /// The root of each component union.
     component_union: HashMap<ComponentId, ComponentId>,

src/decoder/entry_reader.rs

@@ -0,0 +1,362 @@
+use std::io::{self, Cursor, Read, Seek};
+
+use crate::{
+    decoder::{ifd::Entry, stream::EndianReader, ValueReader},
+    tags::{ByteOrder, IfdPointer, Type},
+    TiffResult,
+};
+
+pub struct EntryBytesReader<'lt, R> {
+    inner: &'lt mut EndianReader<R>,
+    variant: Variant,
+}
+
+const OFFSET_BUFFER_LEN: usize = 8;
+
+enum Variant {
+    Immediate {
+        /// An in-value reader if the offset field contains the data. Note that we rotate it to the
+        /// back of this buffer, not the front, so that `Cursor` already contains the right end.
+        /// We do not let you seek back beyond our start.
+        data: Cursor<[u8; OFFSET_BUFFER_LEN]>,
+        value_bytes: u8,
+    },
+    InFile {
+        // the length relative to the base so we can seek relative without querying the position.
+        value_bytes: u64,
+        remainder: u64,
+        base: u64,
+    },
+}
+
+impl<'lt, R> EntryBytesReader<'lt, R> {
+    pub(super) fn from_entry(inner: &'lt mut ValueReader<R>, entry: Entry) -> TiffResult<Self>
+    where
+        R: Read + Seek,
+    {
+        let offset: [_; OFFSET_BUFFER_LEN] = *entry.offset_raw();
+        let limit = if inner.bigtiff { 8 } else { 4 };
+        assert!(limit as usize <= OFFSET_BUFFER_LEN);
+
+        let value_bytes = entry.field_type().value_bytes(entry.count())?;
+
+        if value_bytes <= limit {
+            // We move the data to the back of the array whereas it is in the front right now.
+            let mut value = offset;
+            value.rotate_left(value_bytes as usize);
+            let mut cursor = Cursor::new(value);
+            cursor.set_position(OFFSET_BUFFER_LEN as u64 - value_bytes);
+
+            Ok(EntryBytesReader {
+                inner: &mut inner.reader,
+                variant: Variant::Immediate {
+                    data: cursor,
+                    value_bytes: value_bytes as u8,
+                },
+            })
+        } else {
+            // remainder > limit >= 0 so this is an unreachable panic.
+            let pointer = if inner.bigtiff {
+                let mut offset = offset;
+
+                inner
+                    .reader
+                    .byte_order
+                    .convert(Type::IFD8, &mut offset[..], ByteOrder::native());
+
+                IfdPointer(u64::from_ne_bytes(offset))
+            } else {
+                let mut offset = *offset.first_chunk::<4>().unwrap();
+
+                inner
+                    .reader
+                    .byte_order
+                    .convert(Type::IFD, &mut offset[..], ByteOrder::native());
+
+                let offset = u32::from_ne_bytes(offset);
+                IfdPointer(u64::from(offset))
+            };
+
+            inner.reader.goto_offset(pointer.0)?;
+
+            Ok(EntryBytesReader {
+                inner: &mut inner.reader,
+                variant: Variant::InFile {
+                    value_bytes,
+                    remainder: value_bytes,
+                    base: pointer.0,
+                },
+            })
+        }
+    }
+}
+
+impl<R: Read> Read for EntryBytesReader<'_, R> {
+    fn read(&mut self, buf: &mut [u8]) -> io::Result<usize> {
+        match &mut self.variant {
+            Variant::Immediate { data, .. } => data.read(buf),
+            Variant::InFile { remainder, .. } => {
+                let bound = usize::try_from(*remainder).unwrap_or(usize::MAX);
+                let avail = buf.len().min(bound);
+                let read = self.inner.inner().read(&mut buf[..avail])?;
+
+                // On a well-behaved `Read`: read <= avail <= bound <=(mathematical) remainder
+                let consume = read as u64;
+                *remainder -= consume;
+                Ok(read)
+            }
+        }
+    }
+
+    fn read_exact(&mut self, buf: &mut [u8]) -> io::Result<()> {
+        match &mut self.variant {
+            Variant::Immediate { data, .. } => data.read_exact(buf),
+            Variant::InFile { remainder, .. } => {
+                let bound = usize::try_from(*remainder).unwrap_or(usize::MAX);
+
+                // Fail early if we would be sure to over-read.
+                if buf.len() > bound {
+                    return Err(io::Error::new(
+                        io::ErrorKind::UnexpectedEof,
+                        "Tiff value shorter than the requested buffer size",
+                    ));
+                }
+
+                // since buf.len() <= bound <=(mathematical) remainder
+                let consume = buf.len() as u64;
+                self.inner.inner().read_exact(buf)?;
+                *remainder -= consume;
+
+                Ok(())
+            }
+        }
+    }
+}
+
+impl<R: Read + Seek> Seek for EntryBytesReader<'_, R> {
+    fn seek(&mut self, offset: io::SeekFrom) -> io::Result<u64> {
+        let (value_bytes, remainder) = match &self.variant {
+            Variant::Immediate { data, value_bytes } => {
+                let remainder = data.get_ref().len() as u64 - data.position();
+                (*value_bytes as u64, remainder)
+            }
+            &Variant::InFile {
+                value_bytes,
+                remainder,
+                base: _,
+            } => (value_bytes, remainder),
+        };
+
+        // Normalize to an offset from the start
+        let offset_from_start = match offset {
+            io::SeekFrom::Start(n) => Some(n),
+            io::SeekFrom::Current(n) => {
+                let front = value_bytes - remainder;
+                front.checked_add_signed(n)
+            }
+            io::SeekFrom::End(n) => value_bytes.checked_add_signed(n),
+        };
+
+        let Some((offset, remainder)) = offset_from_start.and_then(|n| {
+            let remainder = value_bytes.checked_sub(n)?;
+            Some((n, remainder))
+        }) else {
+            return Err(io::Error::new(
+                io::ErrorKind::InvalidInput,
+                "seek out of bounds of entry value",
+            ));
+        };
+
+        match &mut self.variant {
+            Variant::Immediate { data, .. } => {
+                let start = OFFSET_BUFFER_LEN as u64 - value_bytes;
+                data.set_position(start + offset);
+                Ok(offset)
+            }
+            &mut Variant::InFile { base, .. } => {
+                // We checked this against overflow on construction. Ignore the offset we get.
+                self.inner
+                    .inner()
+                    .seek(io::SeekFrom::Start(base + offset))?;
+
+                self.variant = Variant::InFile {
+                    value_bytes,
+                    remainder,
+                    base,
+                };
+
+                Ok(offset)
+            }
+        }
+    }
+
+    fn stream_position(&mut self) -> io::Result<u64> {
+        Ok(match &self.variant {
+            Variant::Immediate { data, value_bytes } => {
+                // Recall the value is at the end of the buffer.
+                let from_end = OFFSET_BUFFER_LEN as u64 - data.position();
+                u64::from(*value_bytes) - from_end
+            }
+            // Note: we might think about using the inner `stream_position` here. However that
+            // exposes something interesting: If the internal stream is modified concurrently from
+            // another instance (e.g. a shared `File`) then we may lose track of it anyways.
+            // Especially the `Read` implementation is not bounded on `Seek` so it could not
+            // acquire the position. And it should not since that is just a different form of race
+            // where we risk the position being modified by a different thread just as well.
+            //
+            // So in the interest of least surprise we just assume that we can track the position
+            // accurately here and that the inner reader uses for instance `read_at` consistently.
+            // We own the value (or mutable reference) it after all.
+            //
+            // Also this one MUST be compatible with `seek(SeekFrom::Current(0))` as per trait
+            // defintion—so at least keep those consistent if changing anything.
+            &Variant::InFile {
+                remainder,
+                value_bytes,
+                ..
+            } => value_bytes - remainder,
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::{decoder::Decoder, encoder, tags};
+    use std::io::{Read as _, Seek as _, SeekFrom};
+
+    #[test]
+    fn can_seek_tag_bytes() -> Result<(), crate::error::TiffError> {
+        let file = std::fs::File::open(concat!(
+            env!("CARGO_MANIFEST_DIR"),
+            "/tests/images/int8_rgb.tif"
+        ))
+        .unwrap();
+
+        let mut decoder = Decoder::open(file).unwrap();
+        decoder.next_directory().unwrap();
+
+        let mut buffer = crate::tags::ValueBuffer::default();
+
+        decoder
+            .current_ifd()
+            .find_tag_buf(tags::Tag::StripByteCounts, &mut buffer)
+            .expect("some strip byte count is present");
+
+        let bytes_of_value = buffer.as_bytes().len() as u64;
+
+        let mut reader = decoder
+            .read_tag(tags::Tag::StripByteCounts)?
+            .expect("some strip byte count is present");
+
+        let mut data = vec![];
+        reader.read_to_end(&mut data)?;
+
+        // `ValueBuffer` also stores its data in the file endianess until converted.
+        assert_eq!(reader.stream_position()?, bytes_of_value);
+        assert_eq!(buffer.as_bytes(), data);
+
+        reader.seek(SeekFrom::Start(0))?;
+        assert_eq!(reader.stream_position()?, 0);
+        reader.read_to_end(&mut data)?;
+        assert_eq!(reader.stream_position()?, bytes_of_value);
+
+        let (first, second) = data.split_at(bytes_of_value as usize);
+        assert_eq!(first, second);
+
+        Ok(())
+    }
+
+    #[test]
+    #[allow(clippy::seek_from_current)] // We want to test that functionality.
+    fn seek_from_end() -> Result<(), crate::error::TiffError> {
+        const ARTIST: &str = "99 little bugs in the code";
+
+        let data = {
+            let mut data = std::io::Cursor::new(vec![]);
+            let mut encoder = encoder::TiffEncoder::new(&mut data)?;
+
+            let mut dir = encoder.image_directory()?;
+            dir.write_tag(tags::Tag::Artist, ARTIST)?;
+            dir.finish()?;
+
+            data.into_inner()
+        };
+
+        let file = std::io::Cursor::new(data);
+        let mut decoder = Decoder::open(file).unwrap();
+        decoder.next_directory().unwrap();
+
+        let mut reader = decoder
+            .read_tag(tags::Tag::Artist)?
+            .expect("the artist is present?");
+
+        let mut value = vec![];
+        reader.read_to_end(&mut value)?;
+
+        let (&nul, value) = value.split_last().unwrap();
+        assert_eq!(value, ARTIST.as_bytes());
+        assert_eq!(nul, b'\0');
+
+        assert_eq!(reader.seek(SeekFrom::End(0))?, ARTIST.len() as u64 + 1);
+        assert!(reader.seek(SeekFrom::End(1)).is_err());
+        assert_eq!(reader.stream_position()?, ARTIST.len() as u64 + 1);
+
+        // Check relative seeks by comparing against the "code"
+        let code_offset = reader.seek(SeekFrom::End(-5))?;
+        let mut is_code = [0u8; 4];
+        reader.read_exact(&mut is_code)?;
+        assert_eq!(is_code, *value.last_chunk::<4>().unwrap());
+
+        assert_eq!(reader.seek(SeekFrom::Start(0))?, 0);
+        assert_eq!(reader.stream_position()?, 0);
+        assert_eq!(reader.seek(SeekFrom::Current(0))?, 0);
+        assert_eq!(reader.stream_position()?, 0);
+        assert!(reader.seek(SeekFrom::Current(-1)).is_err());
+        assert_eq!(reader.stream_position()?, 0);
+
+        reader.seek(SeekFrom::Start(code_offset))?;
+        reader.read_exact(&mut is_code)?;
+        assert_eq!(reader.stream_position()?, ARTIST.len() as u64);
+        assert_eq!(is_code, *value.last_chunk::<4>().unwrap());
+
+        Ok(())
+    }
+
+    /// Check that the reader from an `offset` field also works.
+    #[test]
+    fn read_from_offset() -> Result<(), crate::error::TiffError> {
+        let data = {
+            let mut data = std::io::Cursor::new(vec![]);
+            let mut encoder = encoder::TiffEncoder::new(&mut data)?;
+
+            let mut dir = encoder.image_directory()?;
+            dir.write_tag(
+                tags::Tag::PlanarConfiguration,
+                tags::PlanarConfiguration::Planar,
+            )?;
+            dir.finish()?;
+
+            data.into_inner()
+        };
+
+        let file = std::io::Cursor::new(data);
+        let mut decoder = Decoder::open(file).unwrap();
+        decoder.next_directory().unwrap();
+        let bo = decoder.byte_order();
+
+        let mut reader = decoder
+            .read_tag(tags::Tag::PlanarConfiguration)?
+            .expect("some artist is present");
+
+        let mut buf = [0; 2];
+        reader.read_exact(&mut buf)?;
+
+        bo.convert(tags::Type::SHORT, &mut buf, tags::ByteOrder::BigEndian);
+        assert_eq!(buf, [0, 2]);
+
+        // Check relative seeks, this item is only two bytes long.
+        assert!(reader.seek(SeekFrom::End(-3)).is_err());
+
+        Ok(())
+    }
+}

src/decoder/ifd.rs

@@ -363,7 +363,7 @@ impl ::std::fmt::Debug for Entry {
     fn fmt(&self, fmt: &mut ::std::fmt::Formatter) -> Result<(), ::std::fmt::Error> {
         fmt.write_str(&format!(
             "Entry {{ type_: {:?}, count: {:?}, offset: {:?} }}",
-            self.type_, self.count, &self.offset
+            self.type_, self.count, self.offset
         ))
     }
 }
@@ -393,7 +393,7 @@ impl Entry {
         self.count
     }
 
-    pub(crate) fn offset(&self) -> &[u8] {
+    pub(crate) fn offset_raw(&self) -> &[u8; 8] {
         &self.offset
     }
 
@@ -583,19 +583,19 @@ impl Entry {
 
         match self.type_ {
             Type::BYTE | Type::UNDEFINED => {
-                v = Self::vec_with_capacity(self.count, limits)?;
+                v = Self::vec_with_capacity(self.count, self.type_, limits)?;
                 self.decode_values(self.count, self.type_, reader, |bytes| {
                     v.extend(bytes.iter().copied().map(Byte))
                 })
             }
             Type::SBYTE => {
-                v = Self::vec_with_capacity(self.count, limits)?;
+                v = Self::vec_with_capacity(self.count, self.type_, limits)?;
                 self.decode_values(self.count, self.type_, reader, |bytes| {
                     v.extend(bytes.iter().copied().map(|v| SignedByte(v as i8)))
                 })
             }
             Type::SHORT => {
-                v = Self::vec_with_capacity(self.count, limits)?;
+                v = Self::vec_with_capacity(self.count, self.type_, limits)?;
                 self.decode_values(self.count, self.type_, reader, |bytes| {
                     v.extend(
                         bytes
@@ -605,7 +605,7 @@ impl Entry {
                 })
             }
             Type::SSHORT => {
-                v = Self::vec_with_capacity(self.count, limits)?;
+                v = Self::vec_with_capacity(self.count, self.type_, limits)?;
                 self.decode_values(self.count, self.type_, reader, |bytes| {
                     v.extend(
                         bytes
@@ -615,7 +615,7 @@ impl Entry {
                 })
             }
             Type::LONG => {
-                v = Self::vec_with_capacity(self.count, limits)?;
+                v = Self::vec_with_capacity(self.count, self.type_, limits)?;
                 self.decode_values(self.count, self.type_, reader, |bytes| {
                     v.extend(
                         bytes
@@ -625,7 +625,7 @@ impl Entry {
                 })
             }
             Type::SLONG => {
-                v = Self::vec_with_capacity(self.count, limits)?;
+                v = Self::vec_with_capacity(self.count, self.type_, limits)?;
                 self.decode_values(self.count, self.type_, reader, |bytes| {
                     v.extend(
                         bytes
@@ -635,7 +635,7 @@ impl Entry {
                 })
             }
             Type::FLOAT => {
-                v = Self::vec_with_capacity(self.count, limits)?;
+                v = Self::vec_with_capacity(self.count, self.type_, limits)?;
                 self.decode_values(self.count, self.type_, reader, |bytes| {
                     v.extend(
                         bytes
@@ -645,7 +645,7 @@ impl Entry {
                 })
             }
             Type::DOUBLE => {
-                v = Self::vec_with_capacity(self.count, limits)?;
+                v = Self::vec_with_capacity(self.count, self.type_, limits)?;
                 self.decode_values(self.count, self.type_, reader, |bytes| {
                     v.extend(
                         bytes
@@ -655,7 +655,7 @@ impl Entry {
                 })
             }
             Type::RATIONAL => {
-                v = Self::vec_with_capacity(self.count, limits)?;
+                v = Self::vec_with_capacity(self.count, self.type_, limits)?;
                 self.decode_values(self.count, self.type_, reader, |bytes| {
                     v.extend(bytes.chunks_exact(8).map(|ch| {
                         Rational(
@@ -666,7 +666,7 @@ impl Entry {
                 })
             }
             Type::SRATIONAL => {
-                v = Self::vec_with_capacity(self.count, limits)?;
+                v = Self::vec_with_capacity(self.count, self.type_, limits)?;
                 self.decode_values(self.count, self.type_, reader, |bytes| {
                     v.extend(bytes.chunks_exact(8).map(|ch| {
                         SRational(
@@ -677,7 +677,7 @@ impl Entry {
                 })
             }
             Type::LONG8 => {
-                v = Self::vec_with_capacity(self.count, limits)?;
+                v = Self::vec_with_capacity(self.count, self.type_, limits)?;
                 self.decode_values(self.count, self.type_, reader, |bytes| {
                     v.extend(
                         bytes
@@ -687,7 +687,7 @@ impl Entry {
                 })
             }
             Type::SLONG8 => {
-                v = Self::vec_with_capacity(self.count, limits)?;
+                v = Self::vec_with_capacity(self.count, self.type_, limits)?;
                 self.decode_values(self.count, self.type_, reader, |bytes| {
                     v.extend(
                         bytes
@@ -697,7 +697,7 @@ impl Entry {
                 })
             }
             Type::IFD => {
-                v = Self::vec_with_capacity(self.count, limits)?;
+                v = Self::vec_with_capacity(self.count, self.type_, limits)?;
                 self.decode_values(self.count, self.type_, reader, |bytes| {
                     v.extend(
                         bytes
@@ -707,7 +707,7 @@ impl Entry {
                 })
             }
             Type::IFD8 => {
-                v = Self::vec_with_capacity(self.count, limits)?;
+                v = Self::vec_with_capacity(self.count, self.type_, limits)?;
                 self.decode_values(self.count, self.type_, reader, |bytes| {
                     v.extend(
                         bytes
@@ -719,8 +719,8 @@ impl Entry {
             Type::ASCII => {
                 let n = usize::try_from(self.count)?;
 
-                if n > limits.decoding_buffer_size {
-                    return Err(dbg!(TiffError::LimitsExceeded));
+                if n > limits.ifd_value_size {
+                    return Err(TiffError::LimitsExceeded);
                 }
 
                 let mut out = vec![0; n];
@@ -846,10 +846,20 @@ impl Entry {
 
     fn vec_with_capacity(
         value_count: u64,
+        type_: Type,
         limits: &super::Limits,
     ) -> Result<Vec<Value>, TiffError> {
-        let value_count = usize::try_from(value_count)?;
+        // Check raw file bytes against ifd_value_size.
+        if !type_
+            .value_bytes(value_count)
+            .and_then(|b| usize::try_from(b).map_err(|_| TiffError::LimitsExceeded))
+            .is_ok_and(|raw_len| raw_len <= limits.ifd_value_size)
+        {
+            return Err(TiffError::LimitsExceeded);
+        }
 
+        // Check in-memory Value representation against decoding_buffer_size.
+        let value_count = usize::try_from(value_count)?;
         if value_count > limits.decoding_buffer_size / mem::size_of::<Value>() {
             return Err(TiffError::LimitsExceeded);
         }

src/decoder/image.rs

@@ -1,17 +1,18 @@
 use super::ifd::Value;
-use super::stream::PackBitsReader;
+use super::stream::{PackBitsReader, ReadSamples};
 use super::tag_reader::TagReader;
 use super::ChunkType;
 use super::{predict_f16, predict_f32, predict_f64, ValueReader};
+use crate::decoder::stream::CompressionEngines;
 use crate::tags::{
-    CompressionMethod, ExtraSamples, PhotometricInterpretation, PlanarConfiguration, Predictor,
-    SampleFormat, Tag,
+    ByteOrder, CompressionMethod, ExtraSamples, PhotometricInterpretation, PlanarConfiguration,
+    Predictor, SampleFormat, Tag,
 };
 use crate::{
     ColorType, Directory, TiffError, TiffFormatError, TiffResult, TiffUnsupportedError, UsageError,
 };
 
-use std::io::{self, Cursor, Read, Seek};
+use std::io::{Cursor, Read, Seek};
 use std::sync::Arc;
 
 #[derive(Debug)]
@@ -64,7 +65,6 @@ impl TileAttributes {
 
 #[derive(Debug)]
 pub(crate) struct Image {
-    pub ifd: Option<Directory>,
     pub width: u32,
     pub height: u32,
     pub bits_per_sample: u8,
@@ -86,6 +86,19 @@ pub(crate) struct Image {
     pub chunk_offsets: Vec<u64>,
     pub chunk_bytes: Vec<u64>,
     pub chroma_subsampling: (u16, u16),
+    /// FillOrder: 1 = MSB-to-LSB (default), 2 = LSB-to-MSB (common in fax images)
+    pub fill_order: u16,
+    /// The color map (palette) for `PhotometricInterpretation::RGBPalette`.
+    /// Contains `3 * 2^BitsPerSample` u16 entries: R values, then G values, then B values.
+    pub color_map: Option<Vec<u16>>,
+    /// Will decompression yield host-endian samples?
+    ///
+    /// Standard compression algorithms run on pure bytes, taking the sample slice as it would be
+    /// encoded in the file. However some compression algorithms (currently only SGILog/SGILog24)
+    /// run on samples directly and thus skip the outer byte order entirely, except potentially
+    /// they have interior byte order treatment.
+    pub decompression_to_host_endian: bool,
+    pub lenient: bool,
 }
 
 /// Describes how to read a tile-aligned portion of the image.
@@ -126,6 +139,10 @@ pub(crate) struct ReadoutLayout {
 
     /// Bits per sample in the encoded data.
     pub tiff_bits_per_sample: u8,
+    /// Bits per sample in the output buffer, promoted to a standard width.
+    /// For sub-byte depths (1-8): same as tiff_bits_per_sample.
+    /// For 9-16: 16. For 17-32: 32. For 33-64: 64.
+    pub output_bits_per_sample: u8,
     /// Number of samples in the encoded data.
     pub tiff_samples: u16,
     /// Dimensions of the underlying rectangular chunks (tile or strips).
@@ -142,9 +159,10 @@ pub(crate) struct ReadoutLayout {
 impl Image {
     pub fn from_reader<R: Read + Seek>(
         decoder: &mut ValueReader<R>,
-        ifd: Directory,
+        ifd: &Directory,
+        lenient: bool,
     ) -> TiffResult<Image> {
-        let mut tag_reader = TagReader { decoder, ifd: &ifd };
+        let mut tag_reader = TagReader { decoder, ifd };
 
         let width = tag_reader.require_tag(Tag::ImageWidth)?.into_u32()?;
         let height = tag_reader.require_tag(Tag::ImageLength)?.into_u32()?;
@@ -295,23 +313,33 @@ impl Image {
             (2, 2)
         };
 
+        let fill_order = tag_reader
+            .find_tag(Tag::FillOrder)?
+            .map(Value::into_u16)
+            .transpose()?
+            .unwrap_or(1);
+
         let planes = match planar_config {
             PlanarConfiguration::Chunky => 1,
             PlanarConfiguration::Planar => samples,
         };
 
+        // Note: Not strictly according to specification. The specification says that tiled images
+        // must have their data encoded in `TileByteCounts` and `TileOffsets`. But `libtiff`
+        // processes tags one-by-one and with *either* of these it will set the flag for the image
+        // being tiled. Also it will just use whatever offsets are available. (I believe also using
+        // the first of the two tag pairs that's available—remember tags are encoded ascending).
+        let is_tiled = ifd.contains(Tag::TileWidth) || ifd.contains(Tag::TileLength);
+        let has_strips = ifd.contains(Tag::StripByteCounts) && ifd.contains(Tag::StripOffsets);
+        let has_tiles = ifd.contains(Tag::TileByteCounts) && ifd.contains(Tag::TileOffsets);
+
         let chunk_type;
         let chunk_offsets;
         let chunk_bytes;
         let strip_decoder;
         let tile_attributes;
-        match (
-            ifd.contains(Tag::StripByteCounts),
-            ifd.contains(Tag::StripOffsets),
-            ifd.contains(Tag::TileByteCounts),
-            ifd.contains(Tag::TileOffsets),
-        ) {
-            (true, true, false, false) => {
+
+        if !is_tiled && has_strips {
             chunk_type = ChunkType::Strip;
 
             chunk_offsets = tag_reader
@@ -330,24 +358,42 @@ impl Image {
             strip_decoder = Some(StripDecodeState { rows_per_strip });
             tile_attributes = None;
 
-                if chunk_offsets.len() != chunk_bytes.len()
-                    || rows_per_strip == 0
-                    || u32::try_from(chunk_offsets.len())?
-                        != (height.saturating_sub(1) / rows_per_strip + 1) * planes as u32
-                {
+            if chunk_offsets.len() != chunk_bytes.len() {
                 return Err(TiffError::FormatError(
                     TiffFormatError::InconsistentSizesEncountered,
                 ));
             }
+
+            if rows_per_strip == 0 {
+                return Err(TiffError::FormatError(
+                    TiffFormatError::InconsistentSizesEncountered,
+                ));
             }
-            (false, false, true, true) => {
+
+            if u32::try_from(chunk_offsets.len())?
+                != height.div_ceil(rows_per_strip) * planes as u32
+            {
+                return Err(TiffError::FormatError(
+                    TiffFormatError::IncorrectChunkCount {
+                        expected: height.div_ceil(rows_per_strip) * planes as u32,
+                        found: chunk_offsets.len() as u32,
+                    },
+                ));
+            }
+        } else if is_tiled && (has_strips || has_tiles) {
             chunk_type = ChunkType::Tile;
 
-                let tile_width =
-                    usize::try_from(tag_reader.require_tag(Tag::TileWidth)?.into_u32()?)?;
+            let tile_width = usize::try_from(tag_reader.require_tag(Tag::TileWidth)?.into_u32()?)?;
             let tile_length =
                 usize::try_from(tag_reader.require_tag(Tag::TileLength)?.into_u32()?)?;
 
+            // Prioritize tiles over strips, tiles are what we expect.
+            let (tag_offsets, tag_counts) = if has_tiles {
+                (Tag::TileOffsets, Tag::TileByteCounts)
+            } else {
+                (Tag::StripOffsets, Tag::StripByteCounts)
+            };
+
             if tile_width == 0 {
                 return Err(TiffFormatError::InvalidTagValueType(Tag::TileWidth).into());
             } else if tile_length == 0 {
@@ -361,37 +407,81 @@ impl Image {
                 tile_width,
                 tile_length,
             });
-                chunk_offsets = tag_reader
-                    .find_tag(Tag::TileOffsets)?
-                    .unwrap()
-                    .into_u64_vec()?;
-                chunk_bytes = tag_reader
-                    .find_tag(Tag::TileByteCounts)?
-                    .unwrap()
-                    .into_u64_vec()?;
+
+            chunk_offsets = tag_reader.find_tag(tag_offsets)?.unwrap().into_u64_vec()?;
+            chunk_bytes = tag_reader.find_tag(tag_counts)?.unwrap().into_u64_vec()?;
 
             let tile = tile_attributes.as_ref().unwrap();
-                if chunk_offsets.len() != chunk_bytes.len()
-                    || chunk_offsets.len()
-                        != tile.tiles_down() * tile.tiles_across() * planes as usize
-                {
+
+            if chunk_offsets.len() != chunk_bytes.len() {
                 return Err(TiffError::FormatError(
                     TiffFormatError::InconsistentSizesEncountered,
                 ));
             }
+
+            if chunk_offsets.len() != tile.tiles_down() * tile.tiles_across() * planes as usize {
+                return Err(TiffError::FormatError(
+                    TiffFormatError::IncorrectChunkCount {
+                        expected: (tile.tiles_down() * tile.tiles_across() * planes as usize)
+                            as u32,
+                        found: chunk_offsets.len() as u32,
+                    },
+                ));
             }
-            (_, _, _, _) => {
+        } else {
             return Err(TiffError::FormatError(
                 TiffFormatError::StripTileTagConflict,
-                ))
+            ));
+        };
+
+        let mut sample_format = sample_format;
+        let mut bits_per_sample = bits_per_sample[0];
+
+        // These compression methods only work for specific sample types. They pack each pixel into
+        // a pixel format. And when we decompress them we run an inverse transform inside the
+        // decompression step because that makes sense. (Even for 'raw' data you will not be able
+        // to handle the samples well otherwise). All we are doing is setting up the internal
+        // buffer here. There's an additional transform before the color readout as yo will receive
+        // the color as 32-bit floats (the encoding relies on very specific quantization so
+        // everything else would be very lossy).
+        if let CompressionMethod::SgiLog = compression_method {
+            sample_format = SampleFormat::IEEEFP;
+            bits_per_sample = 32;
+        } else if let CompressionMethod::SgiLog24 = compression_method {
+            sample_format = SampleFormat::IEEEFP;
+            bits_per_sample = 32;
         }
+
+        // Read ColorMap for palette images. The tag contains 3 * 2^BitsPerSample u16 entries.
+        let color_map = if photometric_interpretation == PhotometricInterpretation::RGBPalette {
+            match tag_reader.find_tag(Tag::ColorMap)? {
+                Some(v) => {
+                    let map = v.into_u16_vec()?;
+                    let expected_len = 1usize
+                        .checked_shl(bits_per_sample as u32)
+                        .and_then(|n| n.checked_mul(3))
+                        .ok_or(TiffError::LimitsExceeded)?;
+                    if map.len() != expected_len {
+                        return Err(TiffError::FormatError(
+                            TiffFormatError::InconsistentSizesEncountered,
+                        ));
+                    }
+                    Some(map)
+                }
+                None => {
+                    return Err(TiffError::FormatError(
+                        TiffFormatError::RequiredTagNotFound(Tag::ColorMap),
+                    ));
+                }
+            }
+        } else {
+            None
         };
 
         Ok(Image {
-            ifd: Some(ifd),
             width,
             height,
-            bits_per_sample: bits_per_sample[0],
+            bits_per_sample,
             samples,
             extra_samples,
             photometric_samples,
@@ -407,14 +497,35 @@ impl Image {
             chunk_offsets,
             chunk_bytes,
             chroma_subsampling,
+            fill_order,
+            color_map,
+            decompression_to_host_endian: matches!(
+                compression_method,
+                CompressionMethod::SgiLog | CompressionMethod::SgiLog24
+            ),
+            lenient,
         })
     }
 
+    pub(crate) fn check_chunk_type(&self, expected: ChunkType) -> TiffResult<()> {
+        if expected != self.chunk_type {
+            return Err(TiffError::UsageError(UsageError::InvalidChunkType(
+                expected,
+                self.chunk_type,
+            )));
+        }
+
+        Ok(())
+    }
+
     pub(crate) fn colortype(&self) -> TiffResult<ColorType> {
-        let is_alpha_extra_samples = matches!(
-            self.extra_samples.as_slice(),
-            [ExtraSamples::AssociatedAlpha, ..] | [ExtraSamples::UnassociatedAlpha, ..]
-        );
+        let is_alpha_extra_samples = match self.extra_samples.as_slice().first() {
+            Some(ExtraSamples::AssociatedAlpha) | Some(ExtraSamples::UnassociatedAlpha) => true,
+            // In lenient mode, keep unspecified alpha interpretation logic compatible with libtiff
+            // See Issue #341
+            Some(ExtraSamples::Unspecified) if self.lenient && self.samples > 3 => true,
+            _ => false,
+        };
 
         match self.photometric_interpretation {
             PhotometricInterpretation::RGB => match self.photometric_samples {
@@ -487,20 +598,70 @@ impl Image {
                     ),
                 )),
             },
-            // Unsupported due to inherently heterogeneous sample types. This is represented as:
-            // ```
-            // struct TiffLab /* Interpretation 8* {
-            //     pub L: u8, // SampleFormat::Uint
-            //     pub a: i8, // SampleFormat::Int
-            //     pub b: i8, // SampleFormat::Int
-            // }
-            // ```
-            PhotometricInterpretation::CIELab => Err(TiffError::UnsupportedError(
+            // CIE L*a*b* (TIFF6 Section 23, pp 110-115) encodes a/b as signed integers
+            // (int8 at 8-bit, int16 at 16-bit) with 0 neutral, while ICC L*a*b*
+            // (photometric=9) uses unsigned samples with the neutral at the middle of
+            // the range. `SampleFormat` applies uniformly to all samples, so it can't
+            // describe the L=unsigned + a/b=signed mix; instead we take a/b as signed
+            // from the photometric interpretation (requiring `SampleFormat::Uint`, like
+            // the ICCLab arm) and re-bias them to the unsigned ICCLab encoding in
+            // post-processing (see `cielab_to_icclab`). libtiff does the same, decoding
+            // both depths (`putcontig8bitCIELab8` / `putcontig8bitCIELab16`, selected by
+            // `initCIELabConversion` in tif_getimage.c line 2216
+            // @ 04884181e8903915038be553bfab404302d98ea0).
+            PhotometricInterpretation::CIELab => match self.photometric_samples {
+                3 if matches!(self.bits_per_sample, 8 | 16)
+                    && matches!(self.sample_format, SampleFormat::Uint) =>
+                {
+                    Ok(ColorType::Lab(self.bits_per_sample))
+                }
+                _ => Err(TiffError::UnsupportedError(
                     TiffUnsupportedError::InterpretationWithBits(
                         PhotometricInterpretation::CIELab,
                         vec![self.bits_per_sample; self.samples as usize],
                     ),
                 )),
+            },
+            PhotometricInterpretation::CIELogL => match self.samples {
+                1 if matches!(self.bits_per_sample, 32)
+                    && matches!(self.sample_format, SampleFormat::IEEEFP) =>
+                {
+                    // We do this transform internally while reading.
+                    Ok(ColorType::Gray(32))
+                }
+                _ => Err(TiffError::UnsupportedError(
+                    TiffUnsupportedError::InterpretationWithBits(
+                        self.photometric_interpretation,
+                        vec![self.bits_per_sample; self.samples as usize],
+                    ),
+                )),
+            },
+            PhotometricInterpretation::CIELogLuv => match self.samples {
+                // Only fully supported for the compression format `SGILog`/`SGILog24` which must
+                // be used with 16-bit per sample.
+                //
+                // It's actually an interesting point what we should output here. Note that in
+                // libtiff there is a RAW mode (a single unsigned sample per pixel) as well as a
+                // 32-bit floating point mode for XYZ data. The `Lu'v'` variant is a heavily
+                // customized quantization so we should not return it directly. The format itself
+                // describes being based off `xyY` so that may make sense but there is a pole in
+                // the relation to `XYZ` (at y=0) which is absent in the chosen quantization since
+                // we assume a bias of `.5` so `v >= 1/820` and thus `y >= 0.49/820` in practice.
+                // Also we lose a bit of accuracy with just 16-bit precision.
+                //
+                // In `libtiff` data is always transformed through XYZ. So let's do that.
+                3 if matches!(self.bits_per_sample, 32)
+                    && matches!(self.sample_format, SampleFormat::IEEEFP) =>
+                {
+                    Ok(ColorType::RGB(32))
+                }
+                _ => Err(TiffError::UnsupportedError(
+                    TiffUnsupportedError::InterpretationWithBits(
+                        self.photometric_interpretation,
+                        vec![self.bits_per_sample; self.samples as usize],
+                    ),
+                )),
+            },
             // Unsupported due to extra unfiltering and conversion steps. We need to find the
             // Decode tag (SRATIONAL; 2 * SamplesPerPixel) and apply the following conversion:
             //
@@ -515,34 +676,67 @@ impl Image {
                     vec![self.bits_per_sample; self.samples as usize],
                 ),
             )),
-            PhotometricInterpretation::RGBPalette | PhotometricInterpretation::TransparencyMask => {
-                Err(TiffError::UnsupportedError(
+            PhotometricInterpretation::RGBPalette => Ok(ColorType::Palette(self.bits_per_sample)),
+            // TransparencyMask is a single-channel mask, treat as grayscale.
+            PhotometricInterpretation::TransparencyMask => {
+                Ok(ColorType::Gray(self.bits_per_sample))
+            }
+            PhotometricInterpretation::Unknown(_) => Err(TiffError::UnsupportedError(
                 TiffUnsupportedError::InterpretationWithBits(
                     self.photometric_interpretation,
                     vec![self.bits_per_sample; self.samples as usize],
                 ),
-                ))
-            }
+            )),
         }
     }
 
-    fn create_reader<'r, R: 'r + Read>(
+    fn create_reader<'r, R: 'r + Read + Seek>(
         reader: R,
         compression_method: CompressionMethod,
         compressed_length: u64,
         // FIXME: these should be `expect` attributes or we choose another way of passing them.
         #[cfg_attr(not(feature = "jpeg"), allow(unused_variables))] jpeg_tables: Option<&[u8]>,
-        #[cfg_attr(not(feature = "fax"), allow(unused_variables))] dimensions: (u32, u32),
-    ) -> TiffResult<Box<dyn Read + 'r>> {
+        dimensions: (u32, u32),
+        samples: u16,
+        #[cfg_attr(not(feature = "fax"), allow(unused_variables))] fill_order: u16,
+        engines: &mut CompressionEngines,
+    ) -> TiffResult<Box<dyn ReadSamples + 'r>> {
         Ok(match compression_method {
             CompressionMethod::None => Box::new(reader),
+            CompressionMethod::SgiLog => match samples {
+                1 => Box::new(super::logluv::LogLuv16::new(
+                    reader,
+                    compressed_length,
+                    dimensions.0,
+                )?),
+                3 => Box::new(super::logluv::LogLuv32::new(
+                    reader,
+                    compressed_length,
+                    dimensions.0,
+                )?),
+                _ => {
+                    return Err(TiffError::UnsupportedError(
+                        TiffUnsupportedError::UnsupportedCompressionMethod(
+                            CompressionMethod::SgiLog,
+                        ),
+                    ))
+                }
+            },
+            CompressionMethod::SgiLog24 => Box::new(super::logluv::LogLuv24::new(
+                reader,
+                compressed_length,
+                dimensions.0,
+            )?),
             #[cfg(feature = "lzw")]
             CompressionMethod::LZW => Box::new(super::stream::LZWReader::new(
                 reader,
                 usize::try_from(compressed_length)?,
+                engines,
             )),
             #[cfg(feature = "zstd")]
             CompressionMethod::ZSTD => Box::new(zstd::Decoder::new(reader)?),
+            #[cfg(all(not(feature = "zstd"), feature = "zstd-safe-rust"))]
+            CompressionMethod::ZSTD => Box::new(zrip_decode::streaming::FrameDecoder::new(reader)),
             CompressionMethod::PackBits => Box::new(PackBitsReader::new(reader, compressed_length)),
             #[cfg(feature = "deflate")]
             CompressionMethod::Deflate | CompressionMethod::OldDeflate => {
@@ -602,11 +796,26 @@ impl Image {
                 Box::new(Cursor::new(data))
             }
             #[cfg(feature = "fax")]
+            CompressionMethod::Fax3 => Box::new(super::stream::Group3Reader::new(
+                dimensions,
+                reader,
+                compressed_length,
+                fill_order,
+            )?),
+            #[cfg(feature = "fax")]
             CompressionMethod::Fax4 => Box::new(super::stream::Group4Reader::new(
                 dimensions,
                 reader,
                 compressed_length,
+                fill_order,
             )?),
+            #[cfg(feature = "webp")]
+            CompressionMethod::WebP => Box::new(super::stream::WebPReader::new(
+                reader,
+                compressed_length,
+                samples,
+            )?),
+
             method => {
                 return Err(TiffError::UnsupportedError(
                     TiffUnsupportedError::UnsupportedCompressionMethod(method),
@@ -697,24 +906,40 @@ impl Image {
 
         let data_dimensions = (width, height);
 
+        // Output bits per sample: sub-byte depths stay packed, supra-byte non-standard
+        // depths are promoted to the next standard width (matching sample_type() mapping).
+        let output_bits_per_sample: u8 = match tiff_bits_per_sample {
+            0..=8 => tiff_bits_per_sample,
+            9..=16 => 16,
+            17..=32 => 32,
+            _ => 64,
+        };
+
+        // Packed row size for reading from the file (uses tiff_bits_per_sample).
         let tiff_row_bits = (u64::from(tiff_chunk_dimensions.0) * u64::from(tiff_bits_per_sample))
             .checked_mul(u64::from(tiff_samples))
             .ok_or(TiffError::LimitsExceeded)?;
         let tiff_row_bytes: usize = tiff_row_bits.div_ceil(8).try_into()?;
 
-        let chunk_row_bits = (u64::from(tiff_chunk_dimensions.0) * u64::from(tiff_bits_per_sample))
+        // Output buffer sizes use output_bits_per_sample (the promoted width).
+        let chunk_row_bits = (u64::from(tiff_chunk_dimensions.0)
+            * u64::from(output_bits_per_sample))
         .checked_mul(u64::from(data_samples))
         .ok_or(TiffError::LimitsExceeded)?;
         let chunk_row_bytes: usize = chunk_row_bits.div_ceil(8).try_into()?;
 
-        let data_row_bits = (u64::from(data_dimensions.0) * u64::from(tiff_bits_per_sample))
+        let data_row_bits = (u64::from(data_dimensions.0) * u64::from(output_bits_per_sample))
             .checked_mul(u64::from(data_samples))
             .ok_or(TiffError::LimitsExceeded)?;
         let data_row_bytes: usize = data_row_bits.div_ceil(8).try_into()?;
 
+        // Clamp the chunk height to the image height: a chunk never contributes more
+        // rows than the image contains. Without this, RowsPerStrip = u32::MAX overflows
+        // usize on 32-bit platforms.
+        let clamped_chunk_height = tiff_chunk_dimensions.1.min(data_dimensions.1);
         let chunk_col_stride: usize = data_row_bits
             .div_ceil(8)
-            .checked_mul(u64::from(tiff_chunk_dimensions.1))
+            .checked_mul(u64::from(clamped_chunk_height))
             .ok_or(TiffError::LimitsExceeded)?
             .try_into()?;
 
@@ -763,6 +988,7 @@ impl Image {
             chunk_col_stride,
             plane_stride,
             tiff_bits_per_sample,
+            output_bits_per_sample,
             tiff_samples,
             tiff_chunk_dimensions,
             tiff_row_bytes,
@@ -805,10 +1031,12 @@ impl Image {
 
     pub(crate) fn expand_chunk(
         &self,
-        reader: &mut ValueReader<impl Read>,
+        reader: &mut ValueReader<impl Read + Seek>,
         buf: &mut [u8],
         layout: &ReadoutLayout,
         chunk_index: u32,
+        scratch: &mut Vec<u8>,
+        engines: &mut CompressionEngines,
     ) -> TiffResult<()> {
         let ValueReader {
             reader,
@@ -816,7 +1044,12 @@ impl Image {
             limits,
         } = reader;
 
-        let byte_order = reader.byte_order;
+        let decompressed_byte_order = if self.decompression_to_host_endian {
+            ByteOrder::native()
+        } else {
+            // Convert from the byte order of the file.
+            reader.byte_order
+        };
 
         // Validate that the color type is supported.
         let color_type = layout.color;
@@ -828,11 +1061,20 @@ impl Image {
             | ColorType::CMYKA(n)
             | ColorType::YCbCr(n)
             | ColorType::Gray(n)
+            | ColorType::Palette(n)
+            | ColorType::Lab(n)
             | ColorType::Multiband {
                 bit_depth: n,
                 num_samples: _,
             } if n == 8 || n == 16 || n == 32 || n == 64 => {}
-            ColorType::Gray(n)
+            ColorType::RGB(n)
+            | ColorType::RGBA(n)
+            | ColorType::CMYK(n)
+            | ColorType::CMYKA(n)
+            | ColorType::YCbCr(n)
+            | ColorType::Gray(n)
+            | ColorType::Palette(n)
+            | ColorType::Lab(n)
             | ColorType::Multiband {
                 bit_depth: n,
                 num_samples: _,
@@ -849,6 +1091,26 @@ impl Image {
                     ));
                 }
             },
+            // Extended bit depths (9-15, 17-31): packed N-bit samples unpacked to standard width.
+            // Horizontal predictor is supported (operates on unpacked standard-width samples).
+            // FloatingPoint predictor is not meaningful for non-standard integer depths.
+            ColorType::RGB(n)
+            | ColorType::RGBA(n)
+            | ColorType::CMYK(n)
+            | ColorType::CMYKA(n)
+            | ColorType::YCbCr(n)
+            | ColorType::Gray(n)
+            | ColorType::Multiband {
+                bit_depth: n,
+                num_samples: _,
+            } if n <= 32 => match self.predictor {
+                Predictor::None | Predictor::Horizontal => {}
+                Predictor::FloatingPoint => {
+                    return Err(TiffError::UnsupportedError(
+                        TiffUnsupportedError::FloatingPointPredictor(color_type),
+                    ));
+                }
+            },
             type_ => {
                 return Err(TiffError::UnsupportedError(
                     TiffUnsupportedError::UnsupportedColorType(type_),
@@ -919,9 +1181,66 @@ impl Image {
             *compressed_bytes,
             self.jpeg_tables.as_deref().map(|a| &**a),
             chunk_dims,
+            self.samples,
+            self.fill_order,
+            engines,
         )?;
 
-        if is_output_chunk_rows && is_all_bits {
+        // Extended bit depths (9-15, 17-31): packed N-bit samples must be unpacked to
+        // standard-width output samples before endianness fix and predictor.
+        let needs_unpacking = layout.tiff_bits_per_sample != layout.output_bits_per_sample
+            && layout.tiff_bits_per_sample > 8;
+
+        if needs_unpacking {
+            if !is_all_bits {
+                // Packed extended depths with extra samples to discard is not yet supported.
+                return Err(TiffError::UnsupportedError(
+                    TiffUnsupportedError::InterpretationWithBits(
+                        self.photometric_interpretation,
+                        vec![self.bits_per_sample; self.samples as usize],
+                    ),
+                ));
+            }
+
+            let tiff_bps = layout.tiff_bits_per_sample;
+            let out_bps = layout.output_bits_per_sample;
+            let samples_per_data_row = data_dims.0 as usize * samples as usize;
+
+            let mut packed = vec![0u8; chunk_row_bytes];
+
+            for row in buf.chunks_mut(layout.row_stride).take(data_dims.1 as usize) {
+                reader.read_exact(&mut packed)?;
+
+                let out_row = &mut row[..data_row_bytes];
+                unpack_bits(&packed, out_row, tiff_bps, samples_per_data_row, out_bps);
+
+                // Unpacked values are in native byte order, so pass native to skip
+                // endianness conversion while still applying the predictor.
+                super::fix_endianness_and_predict(
+                    out_row,
+                    color_type.bit_depth(),
+                    data_samples,
+                    ByteOrder::native(),
+                    predictor,
+                    scratch,
+                );
+
+                // An n-bit predictor delta is stored modulo 2^n, but the
+                // reconstruction above accumulated it in the promoted u16/u32
+                // storage width. Reduce back modulo the declared depth so both
+                // the inverted and non-inverted paths see exact, in-range
+                // values (2^n divides the storage modulus, so one mask after
+                // the row is exact).
+                super::mask_samples_to_bit_depth(out_row, tiff_bps, out_bps, self.sample_format);
+
+                super::post_process_row(
+                    out_row,
+                    photometric_interpretation,
+                    color_type,
+                    self.sample_format,
+                )?;
+            }
+        } else if is_output_chunk_rows && is_all_bits {
             // Here we can read directly into the output buffer itself.
             let tile = &mut buf[..chunk_row_bytes * data_dims.1 as usize];
             reader.read_exact(tile)?;
@@ -931,14 +1250,28 @@ impl Image {
                     row,
                     color_type.bit_depth(),
                     samples,
-                    byte_order,
+                    decompressed_byte_order,
                     predictor,
+                    scratch,
                 );
             }
 
-            if photometric_interpretation == PhotometricInterpretation::WhiteIsZero {
-                super::invert_colors(tile, color_type, self.sample_format)?;
-            }
+            // No-op in this branch: promoted layouts (declared depth < storage
+            // width) are handled exclusively by the unpacking branch above.
+            // Called in every integer branch so they cannot diverge.
+            super::mask_samples_to_bit_depth(
+                tile,
+                layout.tiff_bits_per_sample,
+                layout.output_bits_per_sample,
+                self.sample_format,
+            );
+
+            super::post_process_row(
+                tile,
+                photometric_interpretation,
+                color_type,
+                self.sample_format,
+            )?;
         } else if chunk_row_bytes > data_row_bytes && self.predictor == Predictor::FloatingPoint {
             // The floating point predictor shuffles the padding bytes into the encoded output, so
             // this case is handled specially when needed.
@@ -948,14 +1281,28 @@ impl Image {
 
                 let row = &mut row[..data_row_bytes];
                 match color_type.bit_depth() {
-                    16 => predict_f16(&mut encoded, row, samples),
-                    32 => predict_f32(&mut encoded, row, samples),
-                    64 => predict_f64(&mut encoded, row, samples),
+                    16 => {
+                        let (out, _) = row.as_chunks_mut::<2>();
+                        predict_f16(&mut encoded, out, samples);
+                    }
+                    32 => {
+                        let (out, _) = row.as_chunks_mut::<4>();
+                        predict_f32(&mut encoded, out, samples);
+                    }
+                    64 => {
+                        let (out, _) = row.as_chunks_mut::<8>();
+                        predict_f64(&mut encoded, out, samples);
+                    }
                     _ => unreachable!(),
                 }
-                if photometric_interpretation == PhotometricInterpretation::WhiteIsZero {
-                    super::invert_colors(row, color_type, self.sample_format)?;
-                }
+                // No masking here: the floating point predictor requires
+                // IEEEFP samples, which are never depth-promoted.
+                super::post_process_row(
+                    row,
+                    photometric_interpretation,
+                    color_type,
+                    self.sample_format,
+                )?;
             }
         } else if is_all_bits {
             // We read row-by-row but each row fits in its output buffer.
@@ -966,24 +1313,39 @@ impl Image {
                 // Two ways how we get here: we have more bytes in our chunk data than in the image
                 // we are to read. Then we need to skip the rest of the data. Or we have a bigger
                 // row stride than the chunk contains data, then we  need to fill only the front.
-                reader.read_exact(&mut row[..used])?;
-                // Skip horizontal padding
                 if chunk_row_bytes > data_row_bytes {
-                    let len = u64::try_from(chunk_row_bytes - data_row_bytes)?;
-                    io::copy(&mut reader.by_ref().take(len), &mut io::sink())?;
+                    // Skip horizontal padding
+                    let skip = u64::try_from(chunk_row_bytes - data_row_bytes)?;
+                    reader.read_padded_samples(&mut row[..used], skip)?;
+                } else {
+                    reader.read_exact(&mut row[..used])?;
                 }
 
                 super::fix_endianness_and_predict(
                     row,
                     color_type.bit_depth(),
                     samples,
-                    byte_order,
+                    decompressed_byte_order,
                     predictor,
+                    scratch,
                 );
 
-                if photometric_interpretation == PhotometricInterpretation::WhiteIsZero {
-                    super::invert_colors(row, color_type, self.sample_format)?;
-                }
+                // No-op in this branch: promoted layouts only occur in the
+                // unpacking branch. Called so the integer branches cannot
+                // diverge.
+                super::mask_samples_to_bit_depth(
+                    row,
+                    layout.tiff_bits_per_sample,
+                    layout.output_bits_per_sample,
+                    self.sample_format,
+                );
+
+                super::post_process_row(
+                    row,
+                    photometric_interpretation,
+                    color_type,
+                    self.sample_format,
+                )?;
             }
         } else {
             // The encoded data potentially takes up more space than the output data so we must be
@@ -998,7 +1360,7 @@ impl Image {
 
             debug_assert!(bits_per_pixel >= photometric_bit_end);
 
-            if bits_per_pixel % 8 != 0 || photometric_bit_end % 8 != 0 {
+            if !bits_per_pixel.is_multiple_of(8) || !photometric_bit_end.is_multiple_of(8) {
                 return Err(TiffError::UnsupportedError(
                     TiffUnsupportedError::InterpretationWithBits(
                         self.photometric_interpretation,
@@ -1010,6 +1372,10 @@ impl Image {
             let photo_range = photometric_bit_end / 8..bits_per_pixel / 8;
             let mut encoded = vec![0u8; chunk_row_bytes];
             for row in buf.chunks_mut(layout.row_stride).take(data_dims.1 as usize) {
+                // Clip to the chunk's data width: border chunks are stored at the full chunk
+                // width, and writing their horizontal padding would spill into the following
+                // output row (and predict/invert would run past the chunk's own columns).
+                let row = &mut row[..data_row_bytes];
                 reader.read_exact(&mut encoded)?;
 
                 Self::compact_photometric_bytes(&mut encoded, row, &photo_range);
@@ -1018,16 +1384,31 @@ impl Image {
                     row,
                     color_type.bit_depth(),
                     samples,
-                    byte_order,
+                    decompressed_byte_order,
                     predictor,
+                    scratch,
                 );
 
-                if photometric_interpretation == PhotometricInterpretation::WhiteIsZero {
-                    super::invert_colors(row, color_type, self.sample_format)?;
-                }
+                // No-op in this branch: promoted layouts only occur in the
+                // unpacking branch. Called so the integer branches cannot
+                // diverge.
+                super::mask_samples_to_bit_depth(
+                    row,
+                    layout.tiff_bits_per_sample,
+                    layout.output_bits_per_sample,
+                    self.sample_format,
+                );
+
+                super::post_process_row(
+                    row,
+                    photometric_interpretation,
+                    color_type,
+                    self.sample_format,
+                )?;
             }
         }
 
+        reader.cache_or_destroy(engines);
         Ok(())
     }
 
@@ -1046,6 +1427,108 @@ impl Image {
     }
 }
 
+/// Unpack N-bit packed samples (MSB-first) into standard-width output samples in native byte
+/// order. Packed bits are read from `src` and expanded samples are written to `dst`.
+///
+/// `bits_per_sample` is the packed depth (e.g. 10, 12, 14).
+/// `num_samples` is the number of samples to extract.
+/// `output_width` is the output sample width in bits (16 or 32).
+///
+/// # Panics
+///
+/// Panics if `dst` is too small for `num_samples` output samples.
+fn unpack_bits(
+    src: &[u8],
+    dst: &mut [u8],
+    bits_per_sample: u8,
+    num_samples: usize,
+    output_width: u8,
+) {
+    // Dispatch to const-generic specializations so the compiler can unroll the
+    // byte-gathering loop and precompute shift/mask constants.
+    macro_rules! dispatch {
+        ($($bps:literal),+) => {
+            match bits_per_sample {
+                $( $bps => unpack_bits_const::<$bps>(src, dst, num_samples, output_width), )+
+                _ => unpack_bits_const::<0>(src, dst, num_samples, output_width),
+            }
+        };
+    }
+    // Cover every bit depth from 9..=32 that could reach this path, plus 0 as fallback.
+    dispatch!(
+        9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31,
+        32
+    );
+}
+
+/// Inner loop with const BPS so the compiler can optimize the bit extraction.
+/// BPS=0 is the fallback for unexpected bit depths (uses runtime value).
+#[inline(always)]
+fn unpack_bits_const<const BPS: u8>(
+    src: &[u8],
+    dst: &mut [u8],
+    num_samples: usize,
+    output_width: u8,
+) {
+    debug_assert!(output_width == 16 || output_width == 32);
+
+    match output_width {
+        16 => {
+            debug_assert!(dst.len() >= num_samples * 2);
+            let mut bit_offset: usize = 0;
+            for i in 0..num_samples {
+                let val = if BPS > 0 {
+                    extract_bits_msb_const::<BPS>(src, bit_offset)
+                } else {
+                    extract_bits_msb_const::<16>(src, bit_offset) // unreachable fallback
+                };
+                dst[i * 2..i * 2 + 2].copy_from_slice(&(val as u16).to_ne_bytes());
+                bit_offset += if BPS > 0 { BPS as usize } else { 16 };
+            }
+        }
+        32 => {
+            debug_assert!(dst.len() >= num_samples * 4);
+            let mut bit_offset: usize = 0;
+            for i in 0..num_samples {
+                let val = if BPS > 0 {
+                    extract_bits_msb_const::<BPS>(src, bit_offset)
+                } else {
+                    extract_bits_msb_const::<32>(src, bit_offset) // unreachable fallback
+                };
+                dst[i * 4..i * 4 + 4].copy_from_slice(&val.to_ne_bytes());
+                bit_offset += if BPS > 0 { BPS as usize } else { 32 };
+            }
+        }
+        _ => unreachable!(),
+    }
+}
+
+/// Extract a value of `BPS` bits starting at `bit_offset` from an MSB-first packed byte stream.
+/// Uses a single wide read + shift/mask for branchless extraction.
+#[inline(always)]
+fn extract_bits_msb_const<const BPS: u8>(src: &[u8], bit_offset: usize) -> u32 {
+    let byte_idx = bit_offset / 8;
+    let bit_idx = bit_offset % 8;
+    let mask: u64 = (1u64 << BPS) - 1;
+
+    // Read a u64 from as many bytes as available, big-endian, without going out of bounds.
+    // For BPS <= 32 (+ up to 7 bits offset = 39 bits max), we need at most 5 bytes,
+    // but reading 8 at once is faster and the branch is only taken near row ends.
+    let remaining = src.len() - byte_idx;
+    let acc = if remaining >= 8 {
+        u64::from_be_bytes(src[byte_idx..byte_idx + 8].try_into().unwrap())
+    } else {
+        // Near the end of the buffer — read available bytes into the high bits of a u64.
+        let mut buf = [0u8; 8];
+        buf[..remaining].copy_from_slice(&src[byte_idx..]);
+        u64::from_be_bytes(buf)
+    };
+
+    // The value starts at bit_idx from the MSB of our u64. Shift it to the LSB and mask.
+    let shift = 64 - bit_idx - BPS as usize;
+    ((acc >> shift) & mask) as u32
+}
+
 impl ReadoutLayout {
     pub(crate) fn samples_per_out_texel(&self) -> u16 {
         match self.planar_config {
@@ -1058,7 +1541,7 @@ impl ReadoutLayout {
     // pixel data.
     pub(crate) fn chunk_row_bytes(&self, width: u32) -> TiffResult<usize> {
         let data_samples = self.samples_per_out_texel();
-        let data_row_bits = (u64::from(width) * u64::from(self.tiff_bits_per_sample))
+        let data_row_bits = (u64::from(width) * u64::from(self.output_bits_per_sample))
             .checked_mul(u64::from(data_samples))
             .ok_or(TiffError::LimitsExceeded)?;
         Ok(data_row_bits.div_ceil(8).try_into()?)
@@ -1076,8 +1559,12 @@ impl ReadoutLayout {
 
         let data_row_bytes = u64::try_from(row_stride)?;
 
+        // Use the original image height (from plane_stride / row_stride) to clamp
+        // the chunk height, matching the clamping in readout_for_size().
+        let image_height = self.plane_stride.checked_div(self.row_stride).unwrap_or(0) as u32;
+        let clamped_chunk_height = self.tiff_chunk_dimensions.1.min(image_height);
         let chunk_col_stride = data_row_bytes
-            .checked_mul(u64::from(self.tiff_chunk_dimensions.1))
+            .checked_mul(u64::from(clamped_chunk_height))
             .ok_or(TiffError::LimitsExceeded)?
             .try_into()?;
 

src/decoder/logluv.rs

@@ -0,0 +1,569 @@
+use std::io::{Read, Take};
+
+use crate::TiffError;
+
+pub struct LogLuv24<R> {
+    reader: Take<R>,
+    /// The required buffer size. We only decompressed all samples at once.
+    chunk_sz: usize,
+}
+
+impl<R> LogLuv24<R> {
+    pub fn new(reader: R, n: u64, npixels: u32) -> Result<Self, TiffError>
+    where
+        R: Read,
+    {
+        let chunk_sz = usize::try_from(
+            u64::from(npixels)
+                .checked_mul(4 * 3)
+                .ok_or(TiffError::LimitsExceeded)?,
+        )?;
+
+        let reader = reader.take(n);
+        Ok(LogLuv24 { reader, chunk_sz })
+    }
+
+    fn expand_buf(buf: &mut [u8]) {
+        let data_len = buf.len() / 4;
+
+        for i in (0..data_len / 3).rev() {
+            let ch = buf.as_chunks_mut::<3>().0[i];
+            let [a, b, c] = ch.map(u32::from);
+
+            let raw = a << 16 | b << 8 | c;
+            let l = (raw >> 14) & 0x3ff;
+            let uv = decode_quantized_uv(raw & 0x3fff);
+
+            let by = dequantize_24_luma(l);
+            let (u, v) = dequantize_24(uv);
+
+            let s = 1. / (6. * u - 16. * v + 12.);
+            let x = 9. * u * s;
+            let y = 4. * v * s;
+
+            let bx = x / y * by;
+            let bz = (1. - x - y) / y * by;
+
+            let [r, g, b] = xyz_to_rgb([bx, by, bz]);
+
+            let into = &mut buf.as_chunks_mut::<12>().0[i];
+            into[0..4].copy_from_slice(&f32::to_ne_bytes(r));
+            into[4..8].copy_from_slice(&f32::to_ne_bytes(g));
+            into[8..12].copy_from_slice(&f32::to_ne_bytes(b));
+        }
+    }
+}
+
+impl<R: Read> Read for LogLuv24<R> {
+    fn read(&mut self, buf: &mut [u8]) -> std::io::Result<usize> {
+        self.read_exact(buf)?;
+        Ok(buf.len())
+    }
+
+    // FIXME: this is the interface we have for compressed chunks but it is not optimal for what we
+    // want. Note `fill_buf` is not super helpful since it does not guarantee any size of the
+    // filled buffer but we need 24-bits at a time. Two code paths is even more awkward.
+    fn read_exact(&mut self, buf: &mut [u8]) -> std::io::Result<()> {
+        if !buf.len().is_multiple_of(self.chunk_sz) {
+            return Err(std::io::Error::new(
+                std::io::ErrorKind::InvalidInput,
+                format!(
+                    "buffer size {0} must match the chunk size for compression method SGILog24 {1}",
+                    buf.len(),
+                    self.chunk_sz,
+                ),
+            ));
+        }
+
+        let data_len = buf.len() / 4;
+        self.reader.read_exact(&mut buf[..data_len])?;
+        Self::expand_buf(buf);
+
+        Ok(())
+    }
+}
+
+impl<R: Read> super::stream::ReadSamples for LogLuv24<R> {
+    fn read_padded_samples(&mut self, buf: &mut [u8], discard: u64) -> std::io::Result<()> {
+        self.read_exact(buf)?;
+        std::io::copy(&mut self.by_ref().take(discard), &mut std::io::sink())?;
+        Ok(())
+    }
+}
+
+fn packbits_decode<R: Read, const N: usize>(
+    reader: &mut R,
+    buf: &mut [[u8; N]],
+) -> std::io::Result<()> {
+    let expected = buf.len();
+    for offset in (0..N).rev() {
+        let mut i = 0;
+        let mut code = [0u8; 1];
+
+        while let Some(pixels) = buf.get_mut(i..) {
+            if pixels.is_empty() {
+                break;
+            }
+
+            let pixels = pixels.iter_mut();
+            reader.read_exact(&mut code)?;
+            let [repeat] = code;
+
+            if repeat >= 128 {
+                reader.read_exact(&mut code)?;
+                let [value] = code;
+                let rc = (repeat - 128) + 2;
+
+                for (_, px) in (0..rc).zip(pixels) {
+                    px[offset] = value;
+                }
+
+                i += usize::from(rc);
+            } else {
+                for (_, px) in (0..repeat).zip(pixels) {
+                    reader.read_exact(&mut code)?;
+                    let [value] = code;
+                    px[offset] = value;
+                }
+
+                i += usize::from(repeat);
+            }
+        }
+
+        if i < expected {
+            return Err(std::io::Error::new(
+                std::io::ErrorKind::UnexpectedEof,
+                "PackBits RLE decoded fewer pixels than expected",
+            ));
+        }
+    }
+
+    Ok(())
+}
+
+pub struct LogLuv32<R> {
+    reader: Take<R>,
+    /// The required buffer size. We only decompressed all samples at once.
+    chunk_sz: usize,
+}
+
+impl<R: Read> LogLuv32<R> {
+    pub fn new(reader: R, n: u64, npixels: u32) -> Result<Self, TiffError> {
+        let chunk_sz = usize::try_from(
+            u64::from(npixels)
+                .checked_mul(4 * 3)
+                .ok_or(TiffError::LimitsExceeded)?,
+        )?;
+
+        let reader = reader.take(n);
+        Ok(LogLuv32 { reader, chunk_sz })
+    }
+
+    fn decode_rle_row(&mut self, row: &mut [u8]) -> std::io::Result<()>
+    where
+        R: Read,
+    {
+        // 32-bit per pixel format.
+        let n_pixels = self.chunk_sz / 12;
+        // buffer for reading (using only 32-bit per pixel)
+        let raw = &mut row.as_chunks_mut::<4>().0[..n_pixels];
+        packbits_decode::<_, 4>(&mut self.reader, raw)?;
+
+        Ok(())
+    }
+
+    fn expand_row(row: &mut [u8]) {
+        let uvscale = 1.0 / 410.0;
+        let n_pixels = row.len() / 12;
+
+        // Work backwards, the 32-bit compressed raw data is at the front of the row buffer and
+        // this avoids overwriting data before we read it.
+        for i in (0..n_pixels).rev() {
+            let raw = row.as_chunks_mut::<4>().0[i];
+
+            let l = u16::from(raw[0]) << 8 | u16::from(raw[1]);
+            let by = log16_to_y(l);
+
+            let u = uvscale * (f32::from(raw[2]) + 0.5);
+            let v = uvscale * (f32::from(raw[3]) + 0.5);
+
+            let s = 1. / (6. * u - 16. * v + 12.);
+            let x = 9. * u * s;
+            let y = 4. * v * s;
+
+            let bx = x / y * by;
+            let bz = (1. - x - y) / y * by;
+
+            let [r, g, b] = xyz_to_rgb([bx, by, bz]);
+            let into = &mut row.as_chunks_mut::<12>().0[i];
+            into[0..4].copy_from_slice(&f32::to_ne_bytes(r));
+            into[4..8].copy_from_slice(&f32::to_ne_bytes(g));
+            into[8..12].copy_from_slice(&f32::to_ne_bytes(b));
+        }
+    }
+}
+
+impl<R: Read> Read for LogLuv32<R> {
+    fn read(&mut self, buf: &mut [u8]) -> std::io::Result<usize> {
+        self.read_exact(buf)?;
+        Ok(buf.len())
+    }
+
+    // FIXME: See `LogLuv24::read_exact`
+    fn read_exact(&mut self, buf: &mut [u8]) -> std::io::Result<()> {
+        for row in buf.chunks_exact_mut(self.chunk_sz) {
+            self.decode_rle_row(row)?;
+            Self::expand_row(row);
+        }
+
+        Ok(())
+    }
+}
+
+impl<R: Read> super::stream::ReadSamples for LogLuv32<R> {
+    fn read_padded_samples(&mut self, buf: &mut [u8], discard: u64) -> std::io::Result<()> {
+        self.read_exact(buf)?;
+        std::io::copy(&mut self.by_ref().take(discard), &mut std::io::sink())?;
+        Ok(())
+    }
+}
+
+/// Pack-Bits like encoding for a single 16-bit log-L sample.
+pub struct LogLuv16<R> {
+    reader: Take<R>,
+    /// The required buffer size. We only decompressed all samples at once.
+    chunk_sz: usize,
+}
+
+impl<R: Read> LogLuv16<R> {
+    pub fn new(reader: R, n: u64, npixels: u32) -> Result<Self, TiffError> {
+        let chunk_sz = usize::try_from(
+            u64::from(npixels)
+                .checked_mul(4)
+                .ok_or(TiffError::LimitsExceeded)?,
+        )?;
+
+        let reader = reader.take(n);
+        Ok(LogLuv16 { reader, chunk_sz })
+    }
+
+    fn decode_rle_row(&mut self, row: &mut [u8]) -> std::io::Result<()>
+    where
+        R: Read,
+    {
+        // 32-bit per pixel format.
+        let n_pixels = self.chunk_sz / 4;
+        // buffer for reading (16-bit per pixel)
+        let raw = &mut row.as_chunks_mut::<2>().0[..n_pixels];
+        packbits_decode::<_, 2>(&mut self.reader, raw)?;
+
+        Ok(())
+    }
+
+    fn expand_row(row: &mut [u8]) {
+        let n_pixels = row.len() / 4;
+
+        // Work backwards, the 32-bit compressed raw data is at the front of the row buffer and
+        // this avoids overwriting data before we read it.
+        for i in (0..n_pixels).rev() {
+            let raw = row.as_chunks_mut::<2>().0[i];
+
+            let l = u16::from(raw[0]) << 8 | u16::from(raw[1]);
+            let by = log16_to_y(l);
+
+            let into = &mut row.as_chunks_mut::<4>().0[i];
+            into[0..4].copy_from_slice(&f32::to_ne_bytes(by));
+        }
+    }
+}
+
+impl<R: Read> Read for LogLuv16<R> {
+    fn read(&mut self, buf: &mut [u8]) -> std::io::Result<usize> {
+        self.read_exact(buf)?;
+        Ok(buf.len())
+    }
+
+    // FIXME: See `LogLuv24::read_exact`
+    fn read_exact(&mut self, buf: &mut [u8]) -> std::io::Result<()> {
+        for row in buf.chunks_exact_mut(self.chunk_sz) {
+            self.decode_rle_row(row)?;
+            Self::expand_row(row);
+        }
+
+        Ok(())
+    }
+}
+
+impl<R: Read> super::stream::ReadSamples for LogLuv16<R> {
+    fn read_padded_samples(&mut self, buf: &mut [u8], discard: u64) -> std::io::Result<()> {
+        self.read_exact(buf)?;
+        std::io::copy(&mut self.by_ref().take(discard), &mut std::io::sink())?;
+        Ok(())
+    }
+}
+
+// Table information from: `libtiff`, 1997 by Greg Ward Larson, SGI
+#[doc(alias = "UV_SQSIZ")]
+const UV_QUANTIZATION_WIDTH: f32 = 0.003500;
+
+// The `v` value corresonding to the bottom most row (quantized v' = 0).
+const UV_VSTART: f32 = 0.016940;
+
+/// Number of distinct 'u' rows, each at a different v level. Each is quantized individually with
+/// the first quantization level starting at its `ustart` and `UV_QUANTIZATION_WIDTH` wide.
+const UV_NVS: usize = 163;
+
+/// Contrary to the original C code we calculate the dependent values (cumulative sum).
+struct UvRow {
+    ustart: f32,
+    num_us: u16,
+}
+
+#[rustfmt::skip]
+const UV_ROWS: [UvRow; UV_NVS] = [
+    UvRow { ustart: 0.247663, num_us: 4, },
+    UvRow { ustart: 0.243779, num_us: 6, },
+    UvRow { ustart: 0.241684, num_us: 7, },
+    UvRow { ustart: 0.237874, num_us: 9, },
+    UvRow { ustart: 0.235906, num_us: 10, },
+    UvRow { ustart: 0.232153, num_us: 12, },
+    UvRow { ustart: 0.228352, num_us: 14, },
+    UvRow { ustart: 0.226259, num_us: 15, },
+    UvRow { ustart: 0.222371, num_us: 17, },
+    UvRow { ustart: 0.220410, num_us: 18, },
+    UvRow { ustart: 0.214710, num_us: 21, },
+    UvRow { ustart: 0.212714, num_us: 22, },
+    UvRow { ustart: 0.210721, num_us: 23, },
+    UvRow { ustart: 0.204976, num_us: 26, },
+    UvRow { ustart: 0.202986, num_us: 27, },
+    UvRow { ustart: 0.199245, num_us: 29, },
+    UvRow { ustart: 0.195525, num_us: 31, },
+    UvRow { ustart: 0.193560, num_us: 32, },
+    UvRow { ustart: 0.189878, num_us: 34, },
+    UvRow { ustart: 0.186216, num_us: 36, },
+    UvRow { ustart: 0.186216, num_us: 36, },
+    UvRow { ustart: 0.182592, num_us: 38, },
+    UvRow { ustart: 0.179003, num_us: 40, },
+    UvRow { ustart: 0.175466, num_us: 42, },
+    UvRow { ustart: 0.172001, num_us: 44, },
+    UvRow { ustart: 0.172001, num_us: 44, },
+    UvRow { ustart: 0.168612, num_us: 46, },
+    UvRow { ustart: 0.168612, num_us: 46, },
+    UvRow { ustart: 0.163575, num_us: 49, },
+    UvRow { ustart: 0.158642, num_us: 52, },
+    UvRow { ustart: 0.158642, num_us: 52, },
+    UvRow { ustart: 0.158642, num_us: 52, },
+    UvRow { ustart: 0.153815, num_us: 55, },
+    UvRow { ustart: 0.153815, num_us: 55, },
+    UvRow { ustart: 0.149097, num_us: 58, },
+    UvRow { ustart: 0.149097, num_us: 58, },
+    UvRow { ustart: 0.142746, num_us: 62, },
+    UvRow { ustart: 0.142746, num_us: 62, },
+    UvRow { ustart: 0.142746, num_us: 62, },
+    UvRow { ustart: 0.138270, num_us: 65, },
+    UvRow { ustart: 0.138270, num_us: 65, },
+    UvRow { ustart: 0.138270, num_us: 65, },
+    UvRow { ustart: 0.132166, num_us: 69, },
+    UvRow { ustart: 0.132166, num_us: 69, },
+    UvRow { ustart: 0.126204, num_us: 73, },
+    UvRow { ustart: 0.126204, num_us: 73, },
+    UvRow { ustart: 0.126204, num_us: 73, },
+    UvRow { ustart: 0.120381, num_us: 77, },
+    UvRow { ustart: 0.120381, num_us: 77, },
+    UvRow { ustart: 0.120381, num_us: 77, },
+    UvRow { ustart: 0.120381, num_us: 77, },
+    UvRow { ustart: 0.112962, num_us: 82, },
+    UvRow { ustart: 0.112962, num_us: 82, },
+    UvRow { ustart: 0.112962, num_us: 82, },
+    UvRow { ustart: 0.107450, num_us: 86, },
+    UvRow { ustart: 0.107450, num_us: 86, },
+    UvRow { ustart: 0.107450, num_us: 86, },
+    UvRow { ustart: 0.107450, num_us: 86, },
+    UvRow { ustart: 0.100343, num_us: 91, },
+    UvRow { ustart: 0.100343, num_us: 91, },
+    UvRow { ustart: 0.100343, num_us: 91, },
+    UvRow { ustart: 0.095126, num_us: 95, },
+    UvRow { ustart: 0.095126, num_us: 95, },
+    UvRow { ustart: 0.095126, num_us: 95, },
+    UvRow { ustart: 0.095126, num_us: 95, },
+    UvRow { ustart: 0.088276, num_us: 100, },
+    UvRow { ustart: 0.088276, num_us: 100, },
+    UvRow { ustart: 0.088276, num_us: 100, },
+    UvRow { ustart: 0.088276, num_us: 100, },
+    UvRow { ustart: 0.081523, num_us: 105, },
+    UvRow { ustart: 0.081523, num_us: 105, },
+    UvRow { ustart: 0.081523, num_us: 105, },
+    UvRow { ustart: 0.081523, num_us: 105, },
+    UvRow { ustart: 0.074861, num_us: 110, },
+    UvRow { ustart: 0.074861, num_us: 110, },
+    UvRow { ustart: 0.074861, num_us: 110, },
+    UvRow { ustart: 0.074861, num_us: 110, },
+    UvRow { ustart: 0.068290, num_us: 115, },
+    UvRow { ustart: 0.068290, num_us: 115, },
+    UvRow { ustart: 0.068290, num_us: 115, },
+    UvRow { ustart: 0.068290, num_us: 115, },
+    UvRow { ustart: 0.063573, num_us: 119, },
+    UvRow { ustart: 0.063573, num_us: 119, },
+    UvRow { ustart: 0.063573, num_us: 119, },
+    UvRow { ustart: 0.063573, num_us: 119, },
+    UvRow { ustart: 0.057219, num_us: 124, },
+    UvRow { ustart: 0.057219, num_us: 124, },
+    UvRow { ustart: 0.057219, num_us: 124, },
+    UvRow { ustart: 0.057219, num_us: 124, },
+    UvRow { ustart: 0.050985, num_us: 129, },
+    UvRow { ustart: 0.050985, num_us: 129, },
+    UvRow { ustart: 0.050985, num_us: 129, },
+    UvRow { ustart: 0.050985, num_us: 129, },
+    UvRow { ustart: 0.050985, num_us: 129, },
+    UvRow { ustart: 0.044859, num_us: 134, },
+    UvRow { ustart: 0.044859, num_us: 134, },
+    UvRow { ustart: 0.044859, num_us: 134, },
+    UvRow { ustart: 0.044859, num_us: 134, },
+    UvRow { ustart: 0.040571, num_us: 138, },
+    UvRow { ustart: 0.040571, num_us: 138, },
+    UvRow { ustart: 0.040571, num_us: 138, },
+    UvRow { ustart: 0.040571, num_us: 138, },
+    UvRow { ustart: 0.036339, num_us: 142, },
+    UvRow { ustart: 0.036339, num_us: 142, },
+    UvRow { ustart: 0.036339, num_us: 142, },
+    UvRow { ustart: 0.036339, num_us: 142, },
+    UvRow { ustart: 0.032139, num_us: 146, },
+    UvRow { ustart: 0.032139, num_us: 146, },
+    UvRow { ustart: 0.032139, num_us: 146, },
+    UvRow { ustart: 0.032139, num_us: 146, },
+    UvRow { ustart: 0.027947, num_us: 150, },
+    UvRow { ustart: 0.027947, num_us: 150, },
+    UvRow { ustart: 0.027947, num_us: 150, },
+    UvRow { ustart: 0.023739, num_us: 154, },
+    UvRow { ustart: 0.023739, num_us: 154, },
+    UvRow { ustart: 0.023739, num_us: 154, },
+    UvRow { ustart: 0.023739, num_us: 154, },
+    UvRow { ustart: 0.019504, num_us: 158, },
+    UvRow { ustart: 0.019504, num_us: 158, },
+    UvRow { ustart: 0.019504, num_us: 158, },
+    UvRow { ustart: 0.016976, num_us: 161, },
+    UvRow { ustart: 0.016976, num_us: 161, },
+    UvRow { ustart: 0.016976, num_us: 161, },
+    UvRow { ustart: 0.016976, num_us: 161, },
+    UvRow { ustart: 0.012639, num_us: 165, },
+    UvRow { ustart: 0.012639, num_us: 165, },
+    UvRow { ustart: 0.012639, num_us: 165, },
+    UvRow { ustart: 0.009991, num_us: 168, },
+    UvRow { ustart: 0.009991, num_us: 168, },
+    UvRow { ustart: 0.009991, num_us: 168, },
+    UvRow { ustart: 0.009016, num_us: 170, },
+    UvRow { ustart: 0.009016, num_us: 170, },
+    UvRow { ustart: 0.009016, num_us: 170, },
+    UvRow { ustart: 0.006217, num_us: 173, },
+    UvRow { ustart: 0.006217, num_us: 173, },
+    UvRow { ustart: 0.005097, num_us: 175, },
+    UvRow { ustart: 0.005097, num_us: 175, },
+    UvRow { ustart: 0.005097, num_us: 175, },
+    UvRow { ustart: 0.003909, num_us: 177, },
+    UvRow { ustart: 0.003909, num_us: 177, },
+    UvRow { ustart: 0.002340, num_us: 177, },
+    UvRow { ustart: 0.002389, num_us: 170, },
+    UvRow { ustart: 0.001068, num_us: 164, },
+    UvRow { ustart: 0.001653, num_us: 157, },
+    UvRow { ustart: 0.000717, num_us: 150, },
+    UvRow { ustart: 0.001614, num_us: 143, },
+    UvRow { ustart: 0.000270, num_us: 136, },
+    UvRow { ustart: 0.000484, num_us: 129, },
+    UvRow { ustart: 0.001103, num_us: 123, },
+    UvRow { ustart: 0.001242, num_us: 115, },
+    UvRow { ustart: 0.001188, num_us: 109, },
+    UvRow { ustart: 0.001011, num_us: 103, },
+    UvRow { ustart: 0.000709, num_us: 97, },
+    UvRow { ustart: 0.000301, num_us: 89, },
+    UvRow { ustart: 0.002416, num_us: 82, },
+    UvRow { ustart: 0.003251, num_us: 76, },
+    UvRow { ustart: 0.003246, num_us: 69, },
+    UvRow { ustart: 0.004141, num_us: 62, },
+    UvRow { ustart: 0.005963, num_us: 55, },
+    UvRow { ustart: 0.008839, num_us: 47, },
+    UvRow { ustart: 0.010490, num_us: 40, },
+    UvRow { ustart: 0.016994, num_us: 31, },
+    UvRow { ustart: 0.023659, num_us: 21, },
+];
+
+const UV_CUMULATIVE: [u16; UV_NVS] = {
+    let mut arr = [0u16; UV_NVS];
+    let mut sum = 0;
+    let mut i = 0;
+    while i < UV_NVS {
+        arr[i] = sum;
+        sum += UV_ROWS[i].num_us;
+        i += 1;
+    }
+    arr
+};
+
+const UV_NDIVS: u16 = UV_CUMULATIVE[UV_NVS - 1] + UV_ROWS[UV_NVS - 1].num_us;
+
+fn decode_quantized_uv(uv: u32) -> (u8, u8) {
+    if uv >= UV_NDIVS as u32 {
+        return (0, 0);
+    }
+
+    // Find the start of the row, or the index after that.
+    let v_index = match UV_CUMULATIVE.binary_search(&(uv as u16)) {
+        Ok(n) => n,
+        Err(n) => n - 1,
+    };
+
+    let u_index = uv as u16 - UV_CUMULATIVE[v_index];
+    (u_index as u8, v_index as u8)
+}
+
+fn dequantize_24_luma(l: u32) -> f32 {
+    if l == 0 {
+        0.0
+    } else {
+        let le = (l & 0x3ff) as f32;
+        let exponent = ((le / 64.0).floor() as i32) - 24;
+        let mantissa = le - (exponent as f32 + 24.0) * 64.0;
+        (mantissa + 64.0) / 64.0 * 2f32.powi(exponent)
+    }
+}
+
+fn dequantize_24((u, v): (u8, u8)) -> (f32, f32) {
+    let v_f = UV_VSTART + (v as f32) * UV_QUANTIZATION_WIDTH;
+    let u_row = &UV_ROWS[v as usize];
+    let u_f = u_row.ustart + (u as f32) * UV_QUANTIZATION_WIDTH;
+    (u_f, v_f)
+}
+
+fn log16_to_y(l: u16) -> f32 {
+    if l == 0 {
+        return 0.0;
+    }
+
+    let le = f32::from(l & 0x7fff);
+    //     Y = exp(M_LN2 / 256. * (Le + .5) - M_LN2 * 64.);
+    let y = (std::f32::consts::LN_2 / 256.0 * (le + 0.5) - std::f32::consts::LN_2 * 64.0).exp();
+
+    if l & 0x8000 != 0 {
+        -y
+    } else {
+        y
+    }
+}
+
+fn xyz_to_rgb([l, u, v]: [f32; 3]) -> [f32; 3] {
+    // XYZ to sRGB primaries at D65
+    let r = 3.2404542 * l + -1.5371385 * u + -0.4985314 * v;
+    let g = -0.969266 * l + 1.8760108 * u + 0.0415560 * v;
+    let b = 0.0556434 * l + -0.2040259 * u + 1.0572252 * v;
+    [r, g, b]
+}
+
+#[test]
+fn test_decode_quantized_uv() {
+    // Test some known values from the original C code.
+    assert_eq!(decode_quantized_uv(0), (0, 0));
+    assert_eq!(decode_quantized_uv(3), (3, 0));
+    assert_eq!(decode_quantized_uv(4), (0, 1));
+    assert_eq!(decode_quantized_uv(9), (5, 1));
+    assert_eq!(decode_quantized_uv(16288), (20, 162));
+    assert_eq!(decode_quantized_uv(16289), (0, 0)); // Out of range
+}

src/decoder/stream.rs

@@ -1,4 +1,6 @@
 //! All IO functionality needed for TIFF decoding
+#[cfg(feature = "webp")]
+use std::io::Cursor;
 use std::io::{self, BufRead, BufReader, Read, Seek, Take};
 
 pub use crate::tags::ByteOrder;
@@ -120,9 +122,86 @@ impl<R: Read> EndianReader<R> {
 // # READERS
 //
 
+#[derive(Default)]
+pub(crate) struct CompressionEngines {
+    #[cfg(feature = "lzw")]
+    lzw: Option<weezl::decode::Decoder>,
+}
+
+impl core::fmt::Debug for CompressionEngines {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        let mut dbg = f.debug_struct("CompressionEngines");
+        #[cfg(feature = "lzw")]
+        dbg.field("lzw", &self.lzw.is_some().then_some("<weezl>"));
+        dbg.finish()
+    }
+}
+
+/// A variant of `io::Read` that takes one block to the end.
+///
+/// This is derived from `Read` so that any special optimization done by `std` (or any nightly crate
+/// for that matter) surely remains usable.
+///
+/// We want our decompression engines to be much more specialized than the standard library trait.
+/// Firstly there is more information available to communicate (the tiff Type, known decompressed
+/// size, …) and secondly they can potentially *reset*. This could be solved with an extension trait
+/// but since we want to avoid `read` in favor of `read_exact` (or an equivalent if we want to pass
+/// in a strided block buffer) a separate trait that's auto derived is favored.
+///
+/// FIXME: Also consider that we will want to read subsets of samples. Via IO this is done by
+/// discarding data *after* it is put into the output buffer. Yet, for some decompression that write
+/// alone is considerable work where it could simply skip bits more efficiently. So the reader would
+/// likely want to know about a sample mask.
+pub trait ReadSamples: Read {
+    /// Read a row of samples and throw away some additional padding samples at the end.
+    ///
+    /// This is automatically implemented for `Self: Read` as a copy into `io::Sink`.
+    fn read_padded_samples(&mut self, buf: &mut [u8], discard: u64) -> io::Result<()>;
+
+    /// Put this back into our cache of compression engines.
+    fn cache_or_destroy(self: Box<Self>, _: &mut CompressionEngines) {}
+}
+
+/// Note: the `Seek` bound ensures this does not overlap actual decompression.. This is an odd
+/// design problem born out of wanting both the underlying `Read` for uncompressed streams due to
+/// performance as well as the override to `cache_or_destroy` for all compressed streams.
+impl<R: Read + Seek> ReadSamples for R {
+    fn read_padded_samples(&mut self, buf: &mut [u8], discard: u64) -> io::Result<()> {
+        self.read_exact(buf)?;
+        if discard > 0 {
+            std::io::copy(&mut self.by_ref().take(discard), &mut std::io::sink())?;
+        }
+        Ok(())
+    }
+}
+
 /// Type alias for the deflate Reader
 #[cfg(feature = "deflate")]
-pub type DeflateReader<R> = flate2::read::ZlibDecoder<R>;
+pub struct DeflateReader<R> {
+    inner: flate2::read::ZlibDecoder<R>,
+}
+
+impl<R: Read> DeflateReader<R> {
+    pub fn new(inner: R) -> Self {
+        DeflateReader {
+            inner: flate2::read::ZlibDecoder::new(inner),
+        }
+    }
+}
+
+impl<R: Read> Read for DeflateReader<R> {
+    fn read(&mut self, buf: &mut [u8]) -> io::Result<usize> {
+        self.inner.read(buf)
+    }
+}
+
+impl<R: Read> ReadSamples for DeflateReader<R> {
+    fn read_padded_samples(&mut self, buf: &mut [u8], discard: u64) -> io::Result<()> {
+        self.read_exact(buf)?;
+        std::io::copy(&mut self.by_ref().take(discard), &mut std::io::sink())?;
+        Ok(())
+    }
+}
 
 //
 // ## LZW Reader
@@ -133,31 +212,103 @@ pub type DeflateReader<R> = flate2::read::ZlibDecoder<R>;
 pub struct LZWReader<R: Read> {
     reader: BufReader<Take<R>>,
     decoder: weezl::decode::Decoder,
+    is_old_style: bool,
 }
 
 #[cfg(feature = "lzw")]
 impl<R: Read> LZWReader<R> {
     /// Wraps a reader
-    pub fn new(reader: R, compressed_length: usize) -> LZWReader<R> {
-        let configuration =
-            weezl::decode::Configuration::with_tiff_size_switch(weezl::BitOrder::Msb, 8)
-                .with_yield_on_full_buffer(true);
-        Self {
-            reader: BufReader::with_capacity(
+    pub fn new(
+        reader: R,
+        compressed_length: usize,
+        engine: &mut CompressionEngines,
+    ) -> LZWReader<R> {
+        let mut buffered = BufReader::with_capacity(
             (32 * 1024).min(compressed_length),
             reader.take(u64::try_from(compressed_length).unwrap()),
-            ),
-            decoder: configuration.build(),
+        );
+
+        // `Compression = 5` covers both the current LZW variant and the pre-TIFF-6.0
+        // "old-style" one, with no tag to distinguish them. New-style is MSB-first with
+        // the "early change" code-size switch, and its stream begins with the Clear code
+        // (256) -> first byte 0x80. Old-style is LSB-first *without* the early change
+        // (GIF-style increment timing), and begins with 0x00 followed by a byte with bit
+        // 0 set. This is the heuristic libtiff uses to select its compatibility decoder;
+        // on a short/failed peek we default to the modern variant.
+        let old_style = matches!(
+            buffered.fill_buf(),
+            Ok(head) if head.len() >= 2 && head[0] == 0x00 && head[1] & 0x01 != 0
+        );
+
+        let decoder = if old_style {
+            weezl::decode::Configuration::new(weezl::BitOrder::Lsb, 8)
+                .with_yield_on_full_buffer(true)
+                .build()
+        } else {
+            // All standard LZW decoders have the same configuration. We can thus reuse any that we
+            // have previously constructed, skipping internal buffer allocation. We only need to
+            // reset them to a new stream.
+            if let Some(mut lzw) = engine.lzw.take() {
+                lzw.reset();
+                lzw
+            } else {
+                weezl::decode::Configuration::with_tiff_size_switch(weezl::BitOrder::Msb, 8)
+                    .with_yield_on_full_buffer(true)
+                    .build()
             }
+        };
+
+        Self {
+            reader: buffered,
+            decoder: decoder,
+            is_old_style: old_style,
+        }
+    }
+
+    fn discard_n(&mut self, mut n: u64) -> io::Result<()> {
+        let mut buf = [0u8; 2048];
+
+        while n > 0 {
+            let limit = n.min(2048) as usize;
+            let result = self
+                .decoder
+                .decode_bytes(self.reader.fill_buf()?, &mut buf[..limit]);
+
+            self.reader.consume(result.consumed_in);
+            n -= result.consumed_out as u64;
+
+            match result.status {
+                Ok(weezl::LzwStatus::Ok) => {
+                    continue;
+                }
+                Ok(weezl::LzwStatus::NoProgress) => {
+                    return Err(io::Error::new(
+                        io::ErrorKind::UnexpectedEof,
+                        "no lzw end code found",
+                    ));
+                }
+                Ok(weezl::LzwStatus::Done) => {
+                    if n != 0 {
+                        // stream is too short.
+                        return Err(std::io::ErrorKind::UnexpectedEof)?;
+                    }
+                }
+                Err(err) => return Err(io::Error::new(io::ErrorKind::InvalidData, err)),
+            }
+        }
+
+        Ok(())
     }
 }
 
 #[cfg(feature = "lzw")]
 impl<R: Read> Read for LZWReader<R> {
-    fn read(&mut self, buf: &mut [u8]) -> io::Result<usize> {
+    fn read(&mut self, mut buf: &mut [u8]) -> io::Result<usize> {
         loop {
             let result = self.decoder.decode_bytes(self.reader.fill_buf()?, buf);
+
             self.reader.consume(result.consumed_in);
+            let _ = buf.split_off_mut(..result.consumed_out);
 
             match result.status {
                 Ok(weezl::LzwStatus::Ok) => {
@@ -182,6 +333,24 @@ impl<R: Read> Read for LZWReader<R> {
     }
 }
 
+impl<R: Read> ReadSamples for LZWReader<R> {
+    fn read_padded_samples(&mut self, buf: &mut [u8], discard: u64) -> io::Result<()> {
+        self.read_exact(buf)?;
+
+        if discard > 0 {
+            self.discard_n(discard)?;
+        }
+
+        Ok(())
+    }
+
+    fn cache_or_destroy(self: Box<Self>, engines: &mut CompressionEngines) {
+        if !self.is_old_style && engines.lzw.is_none() {
+            engines.lzw = Some(self.decoder);
+        }
+    }
+}
+
 //
 // ## PackBits Reader
 //
@@ -254,13 +423,36 @@ impl<R: Read> Read for PackBitsReader<R> {
     }
 }
 
+impl<R: Read> ReadSamples for PackBitsReader<R> {
+    fn read_padded_samples(&mut self, buf: &mut [u8], discard: u64) -> io::Result<()> {
+        self.read_exact(buf)?;
+        std::io::copy(&mut self.by_ref().take(discard), &mut std::io::sink())?;
+        Ok(())
+    }
+}
+
+/// Iterator adapter that reverses bits in each byte for FillOrder=2 (LSB-to-MSB).
+#[cfg(feature = "fax")]
+type FaxBytes<R> =
+    core::iter::Map<io::Bytes<io::BufReader<io::Take<R>>>, fn(io::Result<u8>) -> io::Result<u8>>;
+
+#[cfg(feature = "fax")]
+fn fax_byte_iter<R: Read>(reader: R, len: u64, fill_order: u16) -> FaxBytes<R> {
+    let map_fn: fn(io::Result<u8>) -> io::Result<u8> = if fill_order == 2 {
+        |r| r.map(u8::reverse_bits)
+    } else {
+        |r| r
+    };
+    io::BufReader::new(reader.take(len)).bytes().map(map_fn)
+}
+
 #[cfg(feature = "fax")]
 pub struct Group4Reader<R: Read> {
-    decoder: fax34::decoder::Group4Decoder<io::Bytes<io::BufReader<io::Take<R>>>>,
+    decoder: fax34::decoder::Group4Decoder<FaxBytes<R>>,
     line_buf: io::Cursor<Vec<u8>>,
-    height: u16,
+    height: u32,
     width: u16,
-    y: u16,
+    y: u32,
 }
 
 #[cfg(feature = "fax")]
@@ -269,13 +461,14 @@ impl<R: Read> Group4Reader<R> {
         dimensions: (u32, u32),
         reader: R,
         compressed_length: u64,
+        fill_order: u16,
     ) -> crate::TiffResult<Self> {
         let width = u16::try_from(dimensions.0)?;
-        let height = u16::try_from(dimensions.1)?;
+        let height = dimensions.1;
 
         Ok(Self {
             decoder: fax34::decoder::Group4Decoder::new(
-                io::BufReader::new(reader.take(compressed_length)).bytes(),
+                fax_byte_iter(reader, compressed_length, fill_order),
                 width,
             )?,
             line_buf: io::Cursor::new(Vec::with_capacity(width.into())),
@@ -354,6 +547,224 @@ impl<R: Read> Read for Group4Reader<R> {
     }
 }
 
+impl<R: Read> ReadSamples for Group4Reader<R> {
+    fn read_padded_samples(&mut self, buf: &mut [u8], discard: u64) -> io::Result<()> {
+        self.read_exact(buf)?;
+        std::io::copy(&mut self.by_ref().take(discard), &mut std::io::sink())?;
+        Ok(())
+    }
+}
+
+/// Owning byte reader for Group 3 decoding: the compressed data is consumed
+/// into an iterator so the reader doesn't borrow the buffer.
+#[cfg(feature = "fax")]
+type OwnedBitReader = fax34::ByteReader<
+    core::iter::Map<std::vec::IntoIter<u8>, fn(u8) -> Result<u8, std::convert::Infallible>>,
+>;
+
+/// Decodes CCITT Group 3 (T.4) 1D compressed data line by line.
+///
+/// The fax crate's `Group3Decoder` has a bug where `new()` doesn't consume the
+/// initial EOL marker, causing its lookup tables to destructively consume bits
+/// from the EOL when trying to decode run-length codes. We work around this by
+/// using the crate's lower-level `white::decode` / `black::decode` functions
+/// and handling EOL markers ourselves.
+#[cfg(feature = "fax")]
+pub struct Group3Reader {
+    reader: OwnedBitReader,
+    line_buf: io::Cursor<Vec<u8>>,
+    height: u32,
+    width: u16,
+    y: u32,
+}
+
+#[cfg(feature = "fax")]
+impl Group3Reader {
+    pub fn new<R: Read>(
+        dimensions: (u32, u32),
+        reader: R,
+        compressed_length: u64,
+        fill_order: u16,
+    ) -> crate::TiffResult<Self> {
+        let width = u16::try_from(dimensions.0)?;
+        let height = dimensions.1;
+
+        // Buffer all compressed data and apply FillOrder bit reversal
+        let mut compressed = vec![0u8; compressed_length as usize];
+        reader.take(compressed_length).read_exact(&mut compressed)?;
+        if fill_order == 2 {
+            for b in &mut compressed {
+                *b = b.reverse_bits();
+            }
+        }
+
+        // Create an owning bit reader (Vec consumed by into_iter, no borrow issues)
+        let map_fn: fn(u8) -> Result<u8, std::convert::Infallible> = Ok;
+        let mut bit_reader = fax34::ByteReader::new(compressed.into_iter().map(map_fn)).unwrap();
+
+        // Skip fill bits + initial EOL marker
+        Self::skip_eol(&mut bit_reader);
+
+        Ok(Self {
+            reader: bit_reader,
+            line_buf: io::Cursor::new(Vec::with_capacity(width.into())),
+            width,
+            height,
+            y: 0,
+        })
+    }
+
+    /// Skip zero fill bits followed by the terminating '1' bit of an EOL code.
+    fn skip_eol(reader: &mut impl fax34::BitReader) {
+        while reader.peek(1) == Some(0) {
+            let _ = reader.consume(1);
+        }
+        if reader.peek(1) == Some(1) {
+            let _ = reader.consume(1);
+        }
+    }
+
+    /// Decode a full run-length value (terminal + optional makeup codes).
+    fn with_markup<R: fax34::BitReader>(
+        decoder: fn(&mut R) -> Option<u16>,
+        reader: &mut R,
+    ) -> Option<u16> {
+        let mut sum = 0u16;
+        while let Some(n) = decoder(reader) {
+            sum = sum.checked_add(n)?;
+            if n < 64 {
+                return Some(sum);
+            }
+        }
+        None
+    }
+}
+
+#[cfg(feature = "fax")]
+impl Read for Group3Reader {
+    fn read(&mut self, buf: &mut [u8]) -> io::Result<usize> {
+        if self.line_buf.position() as usize == self.line_buf.get_ref().len()
+            && self.y < self.height
+        {
+            // Decode one line of alternating white/black run-lengths
+            let mut transitions = Vec::new();
+            let mut a0 = 0u16;
+            let mut is_white = true;
+            loop {
+                let run = if is_white {
+                    Self::with_markup(fax34::maps::white::decode, &mut self.reader)
+                } else {
+                    Self::with_markup(fax34::maps::black::decode, &mut self.reader)
+                };
+                match run {
+                    Some(len) => {
+                        a0 = match a0.checked_add(len) {
+                            Some(v) => v,
+                            None => break, // overflow = corrupt data
+                        };
+                        transitions.push(a0);
+                        is_white = !is_white;
+                    }
+                    None => break,
+                }
+            }
+
+            self.y += 1;
+
+            // Convert transitions to packed bilevel output
+            let bytes_per_line = usize::from(self.width).div_ceil(8);
+            let buffer = self.line_buf.get_mut();
+            buffer.clear();
+            buffer.resize(bytes_per_line, 0u8);
+
+            let pels = fax34::decoder::pels(&transitions, self.width);
+            for (i, c) in pels.enumerate() {
+                if c == fax34::Color::Black {
+                    buffer[i / 8] |= 1 << (7 - (i % 8));
+                }
+            }
+            self.line_buf.set_position(0);
+
+            // Skip fill bits + line-ending EOL
+            Self::skip_eol(&mut self.reader);
+        }
+
+        self.line_buf.read(buf)
+    }
+}
+
+impl ReadSamples for Group3Reader {
+    fn read_padded_samples(&mut self, buf: &mut [u8], discard: u64) -> io::Result<()> {
+        self.read_exact(buf)?;
+        std::io::copy(&mut self.by_ref().take(discard), &mut std::io::sink())?;
+        Ok(())
+    }
+}
+
+#[cfg(feature = "webp")]
+pub struct WebPReader {
+    inner: Cursor<Vec<u8>>,
+}
+
+#[cfg(feature = "webp")]
+impl WebPReader {
+    pub fn new<R: Read + Seek>(
+        reader: R,
+        compressed_length: u64,
+        samples: u16,
+    ) -> crate::TiffResult<Self> {
+        let mut decoder =
+            image_webp::WebPDecoder::new(io::BufReader::new(reader.take(compressed_length)))
+                .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;
+
+        if !(samples == 4 || (samples == 3 && !decoder.has_alpha())) {
+            return Err(io::Error::new(
+                io::ErrorKind::InvalidData,
+                "bad sample count for WebP compressed data",
+            )
+            .into());
+        }
+
+        let total_bytes =
+            samples as usize * decoder.dimensions().0 as usize * decoder.dimensions().1 as usize;
+        let mut data = vec![0; total_bytes];
+
+        decoder
+            .read_image(&mut data)
+            .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;
+
+        // Add a fully opaque alpha channel if needed
+        if samples == 4 && !decoder.has_alpha() {
+            for i in (0..(total_bytes / 4)).rev() {
+                data[i * 4 + 3] = 255;
+                data[i * 4 + 2] = data[i * 3 + 2];
+                data[i * 4 + 1] = data[i * 3 + 1];
+                data[i * 4] = data[i * 3];
+            }
+        }
+
+        Ok(Self {
+            inner: Cursor::new(data),
+        })
+    }
+}
+
+#[cfg(feature = "webp")]
+impl Read for WebPReader {
+    fn read(&mut self, buf: &mut [u8]) -> io::Result<usize> {
+        self.inner.read(buf)
+    }
+}
+
+#[cfg(feature = "webp")]
+impl ReadSamples for WebPReader {
+    fn read_padded_samples(&mut self, buf: &mut [u8], discard: u64) -> io::Result<()> {
+        self.read_exact(buf)?;
+        std::io::copy(&mut self.by_ref().take(discard), &mut std::io::sink())?;
+        Ok(())
+    }
+}
+
 #[cfg(test)]
 mod test {
     use super::*;

src/directory.rs

@@ -18,6 +18,7 @@ use crate::{
 /// [`Decoder::read_directory_tags`](crate::decoder::Decoder::read_directory_tags) to read the
 /// values associated with tags from an underlying file.
 #[doc(alias = "IFD")]
+#[derive(Clone)]
 pub struct Directory {
     /// There are at most `u16::MAX` entries in any single directory, the count is stored as a
     /// 2-byte value. The order in the file is implied to be ascending by tag value (the decoder

src/encoder/colortype.rs

@@ -1,5 +1,97 @@
 use crate::tags::{PhotometricInterpretation, SampleFormat};
 
+/// Apply floating-point predictor encoding to a row of floating-point samples.
+///
+/// The floating-point predictor works by:
+/// 1. Converting each value to big-endian bytes
+/// 2. Shuffling bytes so all first bytes are together, all second bytes, etc.
+/// 3. Applying byte-level horizontal difference (wrapping_sub) across the entire buffer
+///
+/// The decoder reverses this by:
+/// 1. Applying cumulative sum (wrapping_add) on the entire byte stream
+/// 2. De-shuffling bytes back into float values
+macro_rules! fp_predict {
+    ($name:ident, $float_type:ty) => {
+        fn $name(row: &[$float_type], samples: usize, result: &mut Vec<u8>) {
+            const BYTE_SIZE: usize = core::mem::size_of::<$float_type>();
+            let num_values = row.len();
+            let byte_count = num_values * BYTE_SIZE;
+            let start_len = result.len();
+
+            // Allocate zeroed space so we can write to arbitrary positions
+            result.resize(start_len + byte_count, 0);
+            let output = &mut result[start_len..];
+
+            // Step 1 & 2: Convert to big-endian and scatter bytes
+            for (i, &value) in row.iter().enumerate() {
+                let bytes = value.to_be_bytes();
+                for b in 0..BYTE_SIZE {
+                    output[b * num_values + i] = bytes[b];
+                }
+            }
+
+            // Step 3: Apply byte-level horizontal difference across the entire buffer.
+            // The prediction spans across quarter boundaries, just like the decoder's cumulative sum.
+            //
+            // We process elements in reverse in batches of 16 to enable autovectorization.
+            // Reverse order ensures that when we compute output[i] - output[i-samples],
+            // the value at output[i-samples] hasn't been overwritten yet (critical when
+            // samples < 16, which is the common case: 1, 3, 4, 5).
+            //
+            // 8 bits * 16 = 128 bits, the width of a typical SIMD register.
+            // Even if the target has no vector instructions, this still benefits from
+            // instruction-level parallelism, since unlike in decoding, all subtractions
+            // within a chunk are truly independent of each other.
+            let output = &mut result[start_len..byte_count + start_len];
+            let diff_len = byte_count - samples;
+            let remainder_len = diff_len % 16;
+            // Process full 16-byte chunks in reverse.
+            // We iterate from the end so that predecessor values (at lower indices)
+            // are still in their original state when we read them.
+            let mut chunk_end = byte_count;
+            while chunk_end >= samples + remainder_len + 16 {
+                let chunk_start = chunk_end - 16;
+                let prev_start = chunk_start - samples;
+
+                // Read all values in the chunk and their predecessors first.
+                // This makes all subtractions below independent, enabling vectorization.
+                let curr: [u8; 16] = output[chunk_start..chunk_end].try_into().unwrap();
+                let prev: [u8; 16] = output[prev_start..prev_start + 16].try_into().unwrap();
+
+                let chunk = &mut output[chunk_start..chunk_end];
+                chunk[0] = curr[0].wrapping_sub(prev[0]);
+                chunk[1] = curr[1].wrapping_sub(prev[1]);
+                chunk[2] = curr[2].wrapping_sub(prev[2]);
+                chunk[3] = curr[3].wrapping_sub(prev[3]);
+                chunk[4] = curr[4].wrapping_sub(prev[4]);
+                chunk[5] = curr[5].wrapping_sub(prev[5]);
+                chunk[6] = curr[6].wrapping_sub(prev[6]);
+                chunk[7] = curr[7].wrapping_sub(prev[7]);
+                chunk[8] = curr[8].wrapping_sub(prev[8]);
+                chunk[9] = curr[9].wrapping_sub(prev[9]);
+                chunk[10] = curr[10].wrapping_sub(prev[10]);
+                chunk[11] = curr[11].wrapping_sub(prev[11]);
+                chunk[12] = curr[12].wrapping_sub(prev[12]);
+                chunk[13] = curr[13].wrapping_sub(prev[13]);
+                chunk[14] = curr[14].wrapping_sub(prev[14]);
+                chunk[15] = curr[15].wrapping_sub(prev[15]);
+
+                chunk_end = chunk_start;
+            }
+            // Handle the leading remainder that doesn't fill a complete chunk of 16.
+            // This must be done last (after the reverse chunk loop) because these are
+            // the lowest indices, and the chunks above may read predecessor values
+            // from this range.
+            for i in (samples..samples + remainder_len).rev() {
+                output[i] = output[i].wrapping_sub(output[i - samples]);
+            }
+        }
+    };
+}
+
+fp_predict!(fp_predict_f32, f32);
+fp_predict!(fp_predict_f64, f64);
+
 macro_rules! integer_horizontal_predict {
     () => {
         fn horizontal_predict(row: &[Self::Inner], result: &mut Vec<Self::Inner>) {
@@ -23,6 +115,10 @@ macro_rules! integer_horizontal_predict {
                     .map(|(prev, current)| current.wrapping_sub(*prev)),
             );
         }
+
+        fn floating_point_predict(_: &[Self::Inner], _: &mut Vec<u8>) {
+            unreachable!("floating-point predictor is only valid for floating-point sample types")
+        }
     };
 }
 
@@ -38,6 +134,10 @@ pub trait ColorType {
     const SAMPLE_FORMAT: &'static [SampleFormat];
 
     fn horizontal_predict(row: &[Self::Inner], result: &mut Vec<Self::Inner>);
+
+    /// Apply floating-point predictor encoding to a row of samples.
+    /// This is only implemented for floating-point types; integer types will panic.
+    fn floating_point_predict(row: &[Self::Inner], result: &mut Vec<u8>);
 }
 
 pub struct Gray8;
@@ -108,7 +208,11 @@ impl ColorType for Gray32Float {
     const SAMPLE_FORMAT: &'static [SampleFormat] = &[SampleFormat::IEEEFP];
 
     fn horizontal_predict(_: &[Self::Inner], _: &mut Vec<Self::Inner>) {
-        unreachable!()
+        unreachable!("horizontal predictor is not valid for floating-point sample types")
+    }
+
+    fn floating_point_predict(row: &[Self::Inner], result: &mut Vec<u8>) {
+        fp_predict_f32(row, Self::SAMPLE_FORMAT.len(), result)
     }
 }
 
@@ -140,7 +244,11 @@ impl ColorType for Gray64Float {
     const SAMPLE_FORMAT: &'static [SampleFormat] = &[SampleFormat::IEEEFP];
 
     fn horizontal_predict(_: &[Self::Inner], _: &mut Vec<Self::Inner>) {
-        unreachable!()
+        unreachable!("horizontal predictor is not valid for floating-point sample types")
+    }
+
+    fn floating_point_predict(row: &[Self::Inner], result: &mut Vec<u8>) {
+        fp_predict_f64(row, Self::SAMPLE_FORMAT.len(), result)
     }
 }
 
@@ -180,8 +288,13 @@ impl ColorType for RGB32Float {
     const TIFF_VALUE: PhotometricInterpretation = PhotometricInterpretation::RGB;
     const BITS_PER_SAMPLE: &'static [u16] = &[32, 32, 32];
     const SAMPLE_FORMAT: &'static [SampleFormat] = &[SampleFormat::IEEEFP; 3];
+
     fn horizontal_predict(_: &[Self::Inner], _: &mut Vec<Self::Inner>) {
-        unreachable!()
+        unreachable!("horizontal predictor is not valid for floating-point sample types")
+    }
+
+    fn floating_point_predict(row: &[Self::Inner], result: &mut Vec<u8>) {
+        fp_predict_f32(row, Self::SAMPLE_FORMAT.len(), result)
     }
 }
 
@@ -201,8 +314,13 @@ impl ColorType for RGB64Float {
     const TIFF_VALUE: PhotometricInterpretation = PhotometricInterpretation::RGB;
     const BITS_PER_SAMPLE: &'static [u16] = &[64, 64, 64];
     const SAMPLE_FORMAT: &'static [SampleFormat] = &[SampleFormat::IEEEFP; 3];
+
     fn horizontal_predict(_: &[Self::Inner], _: &mut Vec<Self::Inner>) {
-        unreachable!()
+        unreachable!("horizontal predictor is not valid for floating-point sample types")
+    }
+
+    fn floating_point_predict(row: &[Self::Inner], result: &mut Vec<u8>) {
+        fp_predict_f64(row, Self::SAMPLE_FORMAT.len(), result)
     }
 }
 
@@ -242,8 +360,13 @@ impl ColorType for RGBA32Float {
     const TIFF_VALUE: PhotometricInterpretation = PhotometricInterpretation::RGB;
     const BITS_PER_SAMPLE: &'static [u16] = &[32, 32, 32, 32];
     const SAMPLE_FORMAT: &'static [SampleFormat] = &[SampleFormat::IEEEFP; 4];
+
     fn horizontal_predict(_: &[Self::Inner], _: &mut Vec<Self::Inner>) {
-        unreachable!()
+        unreachable!("horizontal predictor is not valid for floating-point sample types")
+    }
+
+    fn floating_point_predict(row: &[Self::Inner], result: &mut Vec<u8>) {
+        fp_predict_f32(row, Self::SAMPLE_FORMAT.len(), result)
     }
 }
 
@@ -263,8 +386,13 @@ impl ColorType for RGBA64Float {
     const TIFF_VALUE: PhotometricInterpretation = PhotometricInterpretation::RGB;
     const BITS_PER_SAMPLE: &'static [u16] = &[64, 64, 64, 64];
     const SAMPLE_FORMAT: &'static [SampleFormat] = &[SampleFormat::IEEEFP; 4];
+
     fn horizontal_predict(_: &[Self::Inner], _: &mut Vec<Self::Inner>) {
-        unreachable!()
+        unreachable!("horizontal predictor is not valid for floating-point sample types")
+    }
+
+    fn floating_point_predict(row: &[Self::Inner], result: &mut Vec<u8>) {
+        fp_predict_f64(row, Self::SAMPLE_FORMAT.len(), result)
     }
 }
 
@@ -306,7 +434,11 @@ impl ColorType for CMYK32Float {
     const SAMPLE_FORMAT: &'static [SampleFormat] = &[SampleFormat::IEEEFP; 4];
 
     fn horizontal_predict(_: &[Self::Inner], _: &mut Vec<Self::Inner>) {
-        unreachable!()
+        unreachable!("horizontal predictor is not valid for floating-point sample types")
+    }
+
+    fn floating_point_predict(row: &[Self::Inner], result: &mut Vec<u8>) {
+        fp_predict_f32(row, Self::SAMPLE_FORMAT.len(), result)
     }
 }
 
@@ -328,7 +460,11 @@ impl ColorType for CMYK64Float {
     const SAMPLE_FORMAT: &'static [SampleFormat] = &[SampleFormat::IEEEFP; 4];
 
     fn horizontal_predict(_: &[Self::Inner], _: &mut Vec<Self::Inner>) {
-        unreachable!()
+        unreachable!("horizontal predictor is not valid for floating-point sample types")
+    }
+
+    fn floating_point_predict(row: &[Self::Inner], result: &mut Vec<u8>) {
+        fp_predict_f64(row, Self::SAMPLE_FORMAT.len(), result)
     }
 }
 

src/encoder/compression/deflate.rs

@@ -7,24 +7,15 @@ pub struct Deflate {
     level: FlateCompression,
 }
 
-/// The level of compression used by the Deflate algorithm.
-/// It allows trading compression ratio for compression speed.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
-#[non_exhaustive]
-#[derive(Default)]
-pub enum DeflateLevel {
-    /// The fastest possible compression mode.
-    Fast = 1,
-    /// The conserative choice between speed and ratio.
-    #[default]
-    Balanced = 6,
-    /// The best compression available with Deflate.
-    Best = 9,
-}
-
 impl Deflate {
     /// Create a new deflate compressor with a specific level of compression.
-    pub fn with_level(level: DeflateLevel) -> Self {
+    ///
+    /// The valid levels are 1 through 9 inclusive. The default level is 6.
+    ///
+    /// - `1` stands for light but fast compression
+    /// - `6` is the recommended balanced default
+    /// - `9` is maximum compression ratio at the cost of slow encoding
+    pub fn with_level(level: u8) -> Self {
         Self {
             level: FlateCompression::new(level as u32),
         }
@@ -33,7 +24,7 @@ impl Deflate {
 
 impl Default for Deflate {
     fn default() -> Self {
-        Self::with_level(DeflateLevel::default())
+        Self::with_level(6)
     }
 }
 

src/encoder/compression/mod.rs

@@ -9,7 +9,7 @@ mod packbits;
 mod uncompressed;
 
 #[cfg(feature = "deflate")]
-pub use self::deflate::{Deflate, DeflateLevel};
+pub use self::deflate::Deflate;
 
 #[cfg(feature = "lzw")]
 pub use self::lzw::Lzw;

src/encoder/mod.rs

@@ -35,19 +35,29 @@ use self::writer::*;
 /// compression, where using [Predictor::Horizontal] we see a 35% improvement in compression
 /// ratio over the unpredicted compression!
 ///
-/// [Predictor::FloatingPoint] is currently not supported.
+/// [Predictor::Horizontal] is for integer sample types.
+/// [Predictor::FloatingPoint] is for floating-point sample types (f32, f64).
 pub type Predictor = crate::tags::Predictor;
-#[cfg(feature = "deflate")]
-pub type DeflateLevel = compression::DeflateLevel;
 
-#[derive(Clone, Copy, PartialEq, Default)]
+#[non_exhaustive]
+#[derive(Debug, Clone, Copy, PartialEq, Default)]
 pub enum Compression {
+    /// No compression whatsoever. Fastest but produces large files.
     #[default]
     Uncompressed,
+    /// Legacy [LZW](https://en.wikipedia.org/wiki/Lempel%E2%80%93Ziv%E2%80%93Welch) algorithm. Not recommended, use DEFLATE instead.
     #[cfg(feature = "lzw")]
     Lzw,
+    /// [DEFLATE](https://en.wikipedia.org/wiki/DEFLATE) algorithm with the specified compression level.
+    ///
+    /// The valid levels are 1 through 9 inclusive. The default level is 6.
+    ///
+    /// - `1` stands for light but fast compression
+    /// - `6` is the recommended balanced default
+    /// - `9` is maximum compression ratio at the cost of slow encoding
     #[cfg(feature = "deflate")]
-    Deflate(DeflateLevel),
+    Deflate(u8),
+    /// [PackBits](https://en.wikipedia.org/wiki/PackBits) compression, a variant of RLE compression scheme. Fast, primitive compression with a poor compression ratio.
     Packbits,
 }
 
@@ -153,7 +163,15 @@ impl<W: Write + Seek, K: TiffKind> TiffEncoder<W, K> {
     /// Set the predictor to use
     ///
     /// A predictor is used to simplify the file before writing it. This is very
-    /// useful when writing a file compressed using LZW as it can improve efficiency
+    /// useful when writing a file compressed using LZW or DEFLATE as it can improve compression ratio
+    ///
+    /// The floating-point predictor is not universally supported. While most software can handle it,
+    /// Safari, Mac OS Preview and ImageJ Java library cannot. Don't use a predictor for float data
+    /// for maximum compatibility at the cost of compression ratio.
+    ///
+    /// The chosen predictor should match the data type being encoded.
+    /// Encoding floating-point data with `Predictor::Horizontal` is technically possible,
+    /// but rarely beneficial, and some decoders may reject such files.
     pub fn with_predictor(mut self, predictor: Predictor) -> Self {
         self.predictor = predictor;
 
@@ -403,7 +421,7 @@ impl<'a, W: 'a + Write + Seek, K: TiffKind> DirectoryEncoder<'a, W, K> {
     /// Returns an [`Entry`]. If the value is short enough it will *not* be written in the file but
     /// stored in the entry's offset field.
     pub fn write_entry_bytes(&mut self, ty: Type, data: &[u8]) -> TiffResult<Entry> {
-        if data.len() % usize::from(ty.byte_len()) != 0 {
+        if !data.len().is_multiple_of(usize::from(ty.byte_len())) {
             return Err(TiffError::UsageError(UsageError::MismatchedEntryLength {
                 ty,
                 found: data.len(),
@@ -470,7 +488,8 @@ impl<'a, W: 'a + Write + Seek, K: TiffKind> DirectoryEncoder<'a, W, K> {
             self.writer.write_u16(entry.field_type().to_u16())?;
             let count = K::convert_offset(entry.count())?;
             count.write(self.writer)?;
-            self.writer.write_bytes(&entry.offset()[..offset_bytes])?;
+            self.writer
+                .write_bytes(&entry.offset_raw()[..offset_bytes])?;
         }
 
         Ok(offset)
@@ -635,11 +654,14 @@ pub struct ImageEncoder<'a, W: 'a + Write + Seek, C: ColorType, K: TiffKind> {
 impl<'a, W: 'a + Write + Seek, T: ColorType, K: TiffKind> ImageEncoder<'a, W, T, K> {
     fn sanity_check(compression: Compression, predictor: Predictor) -> TiffResult<()> {
         match (predictor, compression, T::SAMPLE_FORMAT[0]) {
+            // Horizontal predictor is not valid for floating-point types
             (Predictor::Horizontal, _, SampleFormat::IEEEFP | SampleFormat::Void) => {
                 Err(TiffError::UsageError(UsageError::PredictorIncompatible))
             }
+            // Floating-point predictor is only valid for IEEEFP sample format
+            (Predictor::FloatingPoint, _, SampleFormat::IEEEFP) => Ok(()),
             (Predictor::FloatingPoint, _, _) => {
-                Err(TiffError::UsageError(UsageError::PredictorUnavailable))
+                Err(TiffError::UsageError(UsageError::PredictorIncompatible))
             }
             _ => Ok(()),
         }
@@ -773,7 +795,13 @@ impl<'a, W: 'a + Write + Seek, T: ColorType, K: TiffKind> ImageEncoder<'a, W, T,
                 }
                 self.encoder.write_data(row_result.as_slice())?
             }
-            _ => unimplemented!(),
+            Predictor::FloatingPoint => {
+                let mut row_result = Vec::with_capacity(std::mem::size_of_val(value));
+                for row in value.chunks_exact(self.row_samples as usize) {
+                    T::floating_point_predict(row, &mut row_result);
+                }
+                self.encoder.write_data(row_result.as_slice())?
+            }
         };
 
         let byte_count = self.encoder.last_written() as usize;
@@ -827,9 +855,7 @@ impl<'a, W: 'a + Write + Seek, T: ColorType, K: TiffKind> ImageEncoder<'a, W, T,
         self.encoder
             .write_tag(Tag::ResolutionUnit, unit.to_u16())
             .unwrap();
-        self.encoder
-            .write_tag(Tag::XResolution, value.clone())
-            .unwrap();
+        self.encoder.write_tag(Tag::XResolution, value).unwrap();
         self.encoder.write_tag(Tag::YResolution, value).unwrap();
     }
 

src/encoder/tiff_value.rs

@@ -665,22 +665,22 @@ impl_tiff_value_for_contiguous_sequence!(Rational; 8; Type::RATIONAL);
 impl_tiff_value_for_contiguous_sequence!(SRational; 8; Type::SRATIONAL);
 
 /// Type to represent tiff values of type `IFD`
-#[derive(Clone)]
+#[derive(Debug, Copy, Clone, PartialEq, Eq)]
 pub struct Ifd(pub u32);
 
 /// Type to represent tiff values of type `IFD8`
-#[derive(Clone)]
+#[derive(Debug, Copy, Clone, PartialEq, Eq)]
 pub struct Ifd8(pub u64);
 
 /// Type to represent tiff values of type `RATIONAL`
-#[derive(Clone)]
+#[derive(Debug, Copy, Clone)]
 pub struct Rational {
     pub n: u32,
     pub d: u32,
 }
 
 /// Type to represent tiff values of type `SRATIONAL`
-#[derive(Clone)]
+#[derive(Debug, Copy, Clone)]
 pub struct SRational {
     pub n: i32,
     pub d: i32,

src/encoder/writer.rs

@@ -172,7 +172,7 @@ impl<W: Write> TiffWriter<W> {
     }
 
     pub fn pad_word_boundary(&mut self) -> Result<(), io::Error> {
-        if self.offset % 4 != 0 {
+        if !self.offset.is_multiple_of(4) {
             let padding = [0, 0, 0];
             let padd_len = 4 - (self.offset % 4);
             self.writer.write_all(&padding[..padd_len as usize])?;
@@ -221,7 +221,7 @@ fn encoder_on_short_writes() {
     };
 
     let imgdata = vec![42u8; 100 * 100];
-    let mut data = crate::decoder::DecodingResult::U8(vec![]);
+    let mut data = crate::decoder::DecodingSampleBuffer::U8(vec![]);
 
     for comp in [
         super::Compression::Uncompressed,
@@ -241,11 +241,13 @@ fn encoder_on_short_writes() {
         }
 
         write.inner.set_position(0);
-        let mut tiff_reader = crate::decoder::Decoder::new(&mut write.inner).unwrap();
+
+        let mut tiff_reader = crate::decoder::Decoder::open(&mut write.inner).unwrap();
+        tiff_reader.next_image().unwrap();
         let _layout = tiff_reader.read_image_to_buffer(&mut data).unwrap();
 
         assert!(
-            matches!(&data, crate::decoder::DecodingResult::U8(v) if *v == imgdata),
+            matches!(&data, crate::decoder::DecodingSampleBuffer::U8(v) if *v == imgdata),
             "{data:?} @ {}",
             data.as_buffer(0).byte_len()
         );

src/error.rs

@@ -70,6 +70,9 @@ quick_error! {
         InconsistentSizesEncountered {
             display("inconsistent sizes encountered")
         }
+        IncorrectChunkCount {expected: u32, found: u32} {
+            display("incorrect number of chunk offsets encoded for the tile count of the image, expected {expected} but found {found}")
+        }
         InvalidDimensions(width: u32, height: u32) {
             display("invalid dimensions: {width}x{height}")
         }

src/tags.rs

@@ -1,4 +1,5 @@
 use crate::encoder::TiffValue;
+use core::fmt;
 
 macro_rules! tags {
     {
@@ -169,6 +170,18 @@ pub enum Tag(u16) unknown(
 // practice it just returns garbage and the validity does not matter greatly to us).
 pub struct IfdPointer(pub u64);
 
+impl fmt::LowerHex for IfdPointer {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        fmt::LowerHex::fmt(&self.0, f)
+    }
+}
+
+impl core::fmt::UpperHex for IfdPointer {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        fmt::UpperHex::fmt(&self.0, f)
+    }
+}
+
 tags! {
 /// The type of an IFD entry (a 2 byte field).
 pub enum Type(u16) {
@@ -267,11 +280,25 @@ pub enum CompressionMethod(u16) unknown(
 
     // Self-assigned by libtiff
     ZSTD = 0xC350,
+
+    // Self-assigned by libtiff
+    WebP = 0xC351,
+
+    // Self-assigned by libtiff/SGI
+    // A packbit like scheme on specific 32-bit samples (16 sint luma, 8 sint u,v). Only really
+    // compatible with PhotometricInterpretation CIELogLuv.
+    SgiLog = 34676,
+    // A packbit like scheme on specific 24-bit samples (10 packed bits luma, 14-bit uv index).
+    // Only really compatible with PhotometricInterpretation CIELogLuv.
+    SgiLog24 = 34677,
 }
 }
 
 tags! {
-pub enum PhotometricInterpretation(u16) {
+pub enum PhotometricInterpretation(u16) unknown(
+    /// A private or extension tag
+    unknown
+) {
     WhiteIsZero = 0,
     BlackIsZero = 1,
     RGB = 2,
@@ -279,9 +306,41 @@ pub enum PhotometricInterpretation(u16) {
     TransparencyMask = 4,
     CMYK = 5,
     YCbCr = 6,
+    /// Biased Lab with all coefficients stored as unsigned integers.
     CIELab = 8,
     IccLab = 9,
     ItuLab = 10,
+    /// Logarithmic L* color space,
+    ///
+    /// see: <https://web.archive.org/web/20250121120358/https://www.anyhere.com/gward/pixformat/tiffluv.html>
+    /// References: <https://doi.org/10.2352/CIC.1998.6.1.art00046>
+    ///
+    /// The `uv` coordinates are based on:
+    ///
+    /// ```text
+    /// (6*u - 16*v + 12) * (-2x + 12y + 3) = 36
+    ///
+    /// u' = 4x / ( -2x + 12y + 3 )
+    /// v' = 9y / ( -2x + 12y + 3 )
+    /// x = 9u' / (6u' - 16v' + 12)
+    /// y = 4v' / (6u' - 16v' + 12)
+    /// ```
+    ///
+    /// Since `(-2x + 12y + 3) <= 15` it holds `(6u' - 16v' + 12) >= 36/15` for all XYZ colors
+    /// which makes the back transform to `xyY` well-defined. Also `v' <= 9/15 = 0.6` and also
+    /// by practical means `u' <= 2/3`.
+    ///
+    /// The compression format that is supposed to be used with this constrains them as well. It
+    /// encodes each component as a 16-bit unsigned integer scaled and clamped to a quantization
+    /// using 256 out of 410 levels or an index into a table based on a quantization to 177 levels
+    /// each `0.0035` (~1/286) wide and 163 levels of `v` (same quantization width).
+    ///
+    /// > Larson, G.W., ``Overcoming Gamut and Dynamic Range Limitations in Digital Images,'' Proceedings of the Sixth Color Imaging Conference, November 1998.
+    CIELogL = 32844,
+    /// Logarithmic L*u'v' color space,
+    ///
+    /// See references under [`Self::CIELogL`].
+    CIELogLuv = 32845,
 }
 }
 
@@ -301,7 +360,9 @@ pub enum Predictor(u16) {
     /// This means that instead of having in order `[r1, g1. b1, r2, g2 ...]` you will find
     /// `[r1, g1, b1, r2-r1, g2-g1, b2-b1, r3-r2, g3-g2, ...]`
     Horizontal = 2,
-    /// Not currently supported
+    /// Floating-point predictor for IEEE floating-point sample types.
+    ///
+    /// This predictor byte-shuffles the data and applies byte-level horizontal differencing.
     FloatingPoint = 3,
 }
 }
@@ -368,7 +429,24 @@ impl ValueBuffer {
     }
 
     /// Create a value with native byte order from in-memory data.
-    pub fn from_value<T: TiffValue>(value: &T) -> Self {
+    ///
+    /// This is equivalent to calling [`Self::set_value`] on a newly created buffer.
+    ///
+    /// # Example
+    ///
+    /// Create a buffer representing a particular tag's value:
+    ///
+    /// ```
+    /// use tiff::tags::{ByteOrder, CompressionMethod, ValueBuffer};
+    ///
+    /// // A buffer with initial content, for instance a tag's value.
+    /// let buffer = ValueBuffer::from_value(&CompressionMethod::ModernJPEG);
+    /// assert_eq!(buffer.as_bytes().len(), 2);
+    ///
+    /// // Note that depends on host endianess which of these holds:
+    /// assert!(buffer.as_bytes() == [0, 7] || buffer.as_bytes() == [7, 0]);
+    /// ```
+    pub fn from_value<T: TiffValue + ?Sized>(value: &T) -> Self {
         ValueBuffer {
             bytes: value.data().into_owned(),
             ty: <T as TiffValue>::FIELD_TYPE,
@@ -377,6 +455,42 @@ impl ValueBuffer {
         }
     }
 
+    /// Set the buffer to the defined value.
+    ///
+    /// The previous data is erased. This converts the value's representation to the byte order of
+    /// the buffer in the process (which is a no-op if the buffer uses host byte order).
+    ///
+    /// # Example
+    ///
+    /// ```
+    /// use tiff::tags::{ByteOrder, CompressionMethod, ValueBuffer};
+    ///
+    /// // A buffer with initial content, for instance a tag's value.
+    /// let mut buffer = ValueBuffer::from_value(&CompressionMethod::JPEG);
+    /// assert_eq!(buffer.as_bytes().len(), 2);
+    ///
+    /// // Ensure a host-independent byte order for the following representation.
+    /// buffer.set_byte_order(ByteOrder::LittleEndian);
+    /// // slices and arrays of primitives are a possible `TiffValue`
+    /// buffer.set_value(&[0, 1, 42u16]);
+    ///
+    /// // The little endian representation of these numbers (2 bytes each)
+    /// assert_eq!(buffer.as_bytes(), [0, 0, 1, 0, 42, 0]);
+    /// ```
+    pub fn set_value<T: TiffValue + ?Sized>(&mut self, value: &T) {
+        self.bytes.clear();
+
+        match value.data() {
+            std::borrow::Cow::Borrowed(slice) => self.bytes.extend_from_slice(slice),
+            std::borrow::Cow::Owned(ref mut data) => self.bytes.append(data),
+        }
+
+        self.ty = <T as TiffValue>::FIELD_TYPE;
+        self.count = value.count() as u64;
+
+        ByteOrder::native().convert(self.ty, &mut self.bytes, self.byte_order);
+    }
+
     pub fn byte_order(&self) -> ByteOrder {
         self.byte_order
     }
@@ -456,6 +570,13 @@ impl ValueBuffer {
     }
 }
 
+/// Create an empty value buffer with `Byte` type. This type choice is arbitrary.
+impl Default for ValueBuffer {
+    fn default() -> Self {
+        ValueBuffer::empty(Type::BYTE)
+    }
+}
+
 /// Byte order of the TIFF file.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum ByteOrder {
@@ -531,3 +652,12 @@ pub(crate) enum EndianBytes {
     Four,
     Eight,
 }
+
+/// Defines how directories are laid out in the file.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum TiffVariant {
+    /// TIFF-V6.0 with 32-bit offsets and counts.
+    Standard,
+    /// Extended TIFF with 64-bit offsets and counts and long directories.
+    BigTiff,
+}

tests/COPYRIGHT

@@ -2,3 +2,11 @@ subsubifd.tif:
   url: https://data.kitware.com/api/v1/file/hashsum/sha512/372ca32735c8a8fdbe2286dabead9e779da63f10ba81eda84625e5273f76d74ca1a47a978f67e9c00c12f7f72009c7b2c07a641e643bb0c463812f4ae7f15d6e/download
   credit: https://github.com/DigitalSlideArchive/tifftools/commit/4d00c70dbce828262f86c1431f7c66b1748965ac
   license: CC0
+usda/*.tif
+  url: https://registry.opendata.aws/naip/index.html
+  credit: NAIP on AWS was accessed on 2026-01-28 from https://registry.opendata.aws/naip.
+  license: Public Domain
+libtiffpic/
+  url: https://download.osgeo.org/libtiff/
+  credit: libtiff
+  license: CC0

tests/decode_bigtiff_images.rs

@@ -15,7 +15,9 @@ fn test_big_tiff() {
     for filename in filenames.iter() {
         let path = PathBuf::from(TEST_IMAGE_DIR).join(filename);
         let img_file = File::open(path).expect("Cannot find test image!");
-        let mut decoder = Decoder::new(img_file).expect("Cannot create decoder");
+        let mut decoder = Decoder::open(img_file).expect("Cannot create decoder");
+        decoder.next_image().expect("Cannot read image");
+
         assert_eq!(
             decoder.dimensions().expect("Cannot get dimensions"),
             (64, 64)
@@ -24,21 +26,20 @@ fn test_big_tiff() {
             decoder.colortype().expect("Cannot get colortype"),
             ColorType::RGB(8)
         );
+
+        let mut ifd = decoder.current_ifd();
         assert_eq!(
-            decoder
-                .get_tag_u64(Tag::StripOffsets)
+            ifd.get_tag_u64(Tag::StripOffsets)
                 .expect("Cannot get StripOffsets"),
             16
         );
         assert_eq!(
-            decoder
-                .get_tag_u64(Tag::RowsPerStrip)
+            ifd.get_tag_u64(Tag::RowsPerStrip)
                 .expect("Cannot get RowsPerStrip"),
             64
         );
         assert_eq!(
-            decoder
-                .get_tag_u64(Tag::StripByteCounts)
+            ifd.get_tag_u64(Tag::StripByteCounts)
                 .expect("Cannot get StripByteCounts"),
             12288
         )

tests/decode_fp16_images.rs

@@ -1,6 +1,6 @@
 extern crate tiff;
 
-use tiff::decoder::{Decoder, DecodingResult};
+use tiff::decoder::{Decoder, DecodingSampleBuffer};
 use tiff::ColorType;
 
 use std::fs::File;
@@ -16,7 +16,9 @@ fn test_white_ieee_fp16() {
     for filename in filenames.iter() {
         let path = PathBuf::from(TEST_IMAGE_DIR).join(filename);
         let img_file = File::open(path).expect("Cannot find test image!");
-        let mut decoder = Decoder::new(img_file).expect("Cannot create decoder");
+        let mut decoder = Decoder::open(img_file).expect("Cannot create decoder");
+        decoder.next_image().expect("Cannot read image");
+
         assert_eq!(
             decoder.dimensions().expect("Cannot get dimensions"),
             (256, 256)
@@ -25,7 +27,8 @@ fn test_white_ieee_fp16() {
             decoder.colortype().expect("Cannot get colortype"),
             ColorType::Gray(16)
         );
-        if let DecodingResult::F16(img) = decoder.read_image().unwrap() {
+
+        if let DecodingSampleBuffer::F16(img) = decoder.read_image().unwrap() {
             for p in img {
                 assert!(p == half::f16::from_f32_const(1.0));
             }
@@ -43,7 +46,9 @@ fn test_one_black_pixel_ieee_fp16() {
     for filename in filenames.iter() {
         let path = PathBuf::from(TEST_IMAGE_DIR).join(filename);
         let img_file = File::open(path).expect("Cannot find test image!");
-        let mut decoder = Decoder::new(img_file).expect("Cannot create decoder");
+        let mut decoder = Decoder::open(img_file).expect("Cannot create decoder");
+        decoder.next_image().expect("Cannot read image");
+
         assert_eq!(
             decoder.dimensions().expect("Cannot get dimensions"),
             (256, 256)
@@ -52,7 +57,8 @@ fn test_one_black_pixel_ieee_fp16() {
             decoder.colortype().expect("Cannot get colortype"),
             ColorType::Gray(16)
         );
-        if let DecodingResult::F16(img) = decoder.read_image().unwrap() {
+
+        if let DecodingSampleBuffer::F16(img) = decoder.read_image().unwrap() {
             for (i, p) in img.iter().enumerate() {
                 if i == 0 {
                     assert!(p < &half::f16::from_f32_const(0.001));
@@ -74,7 +80,9 @@ fn test_pattern_horizontal_differencing_ieee_fp16() {
     for filename in filenames.iter() {
         let path = PathBuf::from(TEST_IMAGE_DIR).join(filename);
         let img_file = File::open(path).expect("Cannot find test image!");
-        let mut decoder = Decoder::new(img_file).expect("Cannot create decoder");
+        let mut decoder = Decoder::open(img_file).expect("Cannot create decoder");
+        decoder.next_image().expect("Cannot read image");
+
         assert_eq!(
             decoder.dimensions().expect("Cannot get dimensions"),
             (256, 256)
@@ -83,7 +91,8 @@ fn test_pattern_horizontal_differencing_ieee_fp16() {
             decoder.colortype().expect("Cannot get colortype"),
             ColorType::Gray(16)
         );
-        if let DecodingResult::F16(img) = decoder.read_image().unwrap() {
+
+        if let DecodingSampleBuffer::F16(img) = decoder.read_image().unwrap() {
             // 0, 2, 5, 8, 12, 16, 255 are black
             let black = [0, 2, 5, 8, 12, 16, 255];
             for (i, p) in img.iter().enumerate() {
@@ -107,7 +116,9 @@ fn test_pattern_predictor_ieee_fp16() {
     for filename in filenames.iter() {
         let path = PathBuf::from(TEST_IMAGE_DIR).join(filename);
         let img_file = File::open(path).expect("Cannot find test image!");
-        let mut decoder = Decoder::new(img_file).expect("Cannot create decoder");
+        let mut decoder = Decoder::open(img_file).expect("Cannot create decoder");
+        decoder.next_image().expect("Cannot read image");
+
         assert_eq!(
             decoder.dimensions().expect("Cannot get dimensions"),
             (256, 256)
@@ -116,7 +127,8 @@ fn test_pattern_predictor_ieee_fp16() {
             decoder.colortype().expect("Cannot get colortype"),
             ColorType::Gray(16)
         );
-        if let DecodingResult::F16(img) = decoder.read_image().unwrap() {
+
+        if let DecodingSampleBuffer::F16(img) = decoder.read_image().unwrap() {
             // 0, 2, 5, 8, 12, 16, 255 are black
             let black = [0, 2, 5, 8, 12, 16, 255];
             for (i, p) in img.iter().enumerate() {
@@ -175,7 +187,9 @@ fn test_predictor_ieee_fp16() {
     for filename in filenames.iter() {
         let path = PathBuf::from(TEST_IMAGE_DIR).join(filename);
         let img_file = File::open(path).expect("Cannot find test image!");
-        let mut decoder = Decoder::new(img_file).expect("Cannot create decoder");
+        let mut decoder = Decoder::open(img_file).expect("Cannot create decoder");
+        decoder.next_image().expect("Cannot read image");
+
         assert_eq!(
             decoder.dimensions().expect("Cannot get dimensions"),
             (16, 16)
@@ -184,7 +198,8 @@ fn test_predictor_ieee_fp16() {
             decoder.colortype().expect("Cannot get colortype"),
             ColorType::Gray(16)
         );
-        if let DecodingResult::F16(img) = decoder.read_image().unwrap() {
+
+        if let DecodingSampleBuffer::F16(img) = decoder.read_image().unwrap() {
             for (exp, found) in std::iter::zip(pnm_values.iter(), img.iter()) {
                 assert!((exp - found.to_f32()).abs() < 0.0001);
             }

tests/decode_geotiff_images.rs

@@ -1,13 +1,13 @@
 extern crate tiff;
 
-use tiff::decoder::{Decoder, DecodingResult};
+use tiff::decoder::{Decoder, DecodingSampleBuffer};
 use tiff::tags::Tag;
 use tiff::ColorType;
 
 use std::fs::File;
 use std::path::PathBuf;
 
-const TEST_IMAGE_DIR: &str = "./tests/images";
+const TEST_IMAGE_DIR: &str = "./tests/geotiff";
 
 #[test]
 fn test_geo_tiff() {
@@ -15,8 +15,9 @@ fn test_geo_tiff() {
     for filename in filenames.iter() {
         let path = PathBuf::from(TEST_IMAGE_DIR).join(filename);
         let img_file = File::open(path).expect("Cannot find test image!");
-        let mut decoder = Decoder::new(img_file).expect("Cannot create decoder");
+        let mut decoder = Decoder::open(img_file).expect("Cannot create decoder");
         decoder = decoder.with_limits(tiff::decoder::Limits::unlimited());
+        decoder.next_image().expect("Cannot read image");
 
         assert_eq!(
             decoder.dimensions().expect("Cannot get dimensions"),
@@ -29,35 +30,51 @@ fn test_geo_tiff() {
                 num_samples: 5
             }
         );
+
+        let mut ifd = decoder.current_ifd();
         assert_eq!(
-            decoder
-                .get_tag_u64(Tag::StripOffsets)
+            ifd.get_tag_u64(Tag::StripOffsets)
                 .expect("Cannot get StripOffsets"),
             418
         );
         assert_eq!(
-            decoder
-                .get_tag_u64(Tag::RowsPerStrip)
+            ifd.get_tag_u64(Tag::RowsPerStrip)
                 .expect("Cannot get RowsPerStrip"),
             10
         );
         assert_eq!(
-            decoder
-                .get_tag_u64(Tag::StripByteCounts)
+            ifd.get_tag_u64(Tag::StripByteCounts)
                 .expect("Cannot get StripByteCounts"),
             1000
         );
         assert_eq!(
-            decoder
-                .get_tag(Tag::ModelPixelScaleTag)
+            ifd.get_tag(Tag::ModelPixelScaleTag)
                 .expect("Cannot get pixel scale")
                 .into_f64_vec()
                 .expect("Cannot get pixel scale"),
             vec![60.0, 60.0, 0.0]
         );
-        let DecodingResult::I16(data) = decoder.read_image().unwrap() else {
+        let DecodingSampleBuffer::I16(data) = decoder.read_image().unwrap() else {
             panic!("Cannot read band data")
         };
         assert_eq!(data.len(), 500);
     }
 }
+
+#[cfg(feature = "webp")]
+#[test]
+fn test_webp_tiff() {
+    let filenames = ["usda_naip_256_webp_z3.tif"];
+    let mut buffer = DecodingSampleBuffer::U8(vec![]);
+
+    for filename in filenames.iter() {
+        let path = PathBuf::from(TEST_IMAGE_DIR).join(filename);
+        let img_file = File::open(path).expect("Cannot find test image!");
+        let mut decoder = Decoder::open(img_file).expect("Cannot create decoder");
+
+        while decoder.more_images() {
+            decoder.next_image().unwrap();
+            decoder.read_image_to_buffer(&mut buffer).unwrap();
+        }
+    }
+}

tests/decode_images.rs

@@ -1,25 +1,31 @@
 extern crate tiff;
 
-use tiff::decoder::{ifd, Decoder, DecodingResult};
+use tiff::decoder::{ifd, Decoder, DecodingSampleBuffer};
+use tiff::tags::{ByteOrder, PhotometricInterpretation, SampleFormat, Type};
 use tiff::ColorType;
 
 use std::fs::File;
-use std::io::{Read, Seek};
+use std::io::{Cursor, Read, Seek};
 use std::path::PathBuf;
 
 const TEST_IMAGE_DIR: &str = "./tests/images/";
+const SEQ_IMAGE_DIR: &str = "./tests/images/seq/";
 
 macro_rules! test_image_sum {
     ($name:ident, $buffer:ident, $sum_ty:ty) => {
         fn $name(file: &str, expected_type: ColorType, expected_sum: $sum_ty) {
             let path = PathBuf::from(TEST_IMAGE_DIR).join(file);
             let img_file = File::open(path).expect("Cannot find test image!");
-            let mut decoder = Decoder::new(img_file).expect("Cannot create decoder");
+            let mut decoder = Decoder::open(img_file)
+                .expect("Cannot create decoder")
+                .with_lenient(true);
+
+            decoder.next_image().expect("Cannot read image IFD");
             assert_eq!(decoder.colortype().unwrap(), expected_type);
             let img_res = decoder.read_image().unwrap();
 
             match img_res {
-                DecodingResult::$buffer(res) => {
+                DecodingSampleBuffer::$buffer(res) => {
                     let sum: $sum_ty = res.into_iter().map(<$sum_ty>::from).sum();
                     assert_eq!(sum, expected_sum);
                 }
@@ -38,13 +44,204 @@ test_image_sum!(test_image_sum_u64, U64, u64);
 test_image_sum!(test_image_sum_f32, F32, f32);
 test_image_sum!(test_image_sum_f64, F64, f64);
 
+/// Compute a CRC32 hash of the full decoded TIFF output including metadata.
+///
+/// Hashes: page count, and for each page: dimensions, color type, and decoded
+/// sample data (in little-endian byte order for multi-byte types). This catches
+/// wrong dimensions, wrong color type, byte-order errors, bit-alignment errors,
+/// stride/padding errors, and pixel value errors.
+fn compute_tiff_hash<R: Read + Seek>(reader: R) -> u32 {
+    let mut decoder = Decoder::open(reader).expect("Cannot create decoder");
+    let mut hasher = crc32fast::Hasher::new();
+
+    let mut page = 0u32;
+    loop {
+        decoder.next_image().expect("Cannot read image IFD");
+        let (width, height) = decoder.dimensions().unwrap();
+        let color_type = decoder.colortype().unwrap();
+        let mut result = decoder.read_image().unwrap();
+
+        // Hash page index + dimensions
+        hasher.update(&page.to_le_bytes());
+        hasher.update(&width.to_le_bytes());
+        hasher.update(&height.to_le_bytes());
+
+        // Hash color type (discriminant + fields)
+        match color_type {
+            ColorType::Gray(n) => hasher.update(&[0, n]),
+            ColorType::RGB(n) => hasher.update(&[1, n]),
+            ColorType::Palette(n) => hasher.update(&[2, n]),
+            ColorType::GrayA(n) => hasher.update(&[3, n]),
+            ColorType::RGBA(n) => hasher.update(&[4, n]),
+            ColorType::CMYK(n) => hasher.update(&[5, n]),
+            ColorType::CMYKA(n) => hasher.update(&[6, n]),
+            ColorType::YCbCr(n) => hasher.update(&[7, n]),
+            ColorType::Lab(n) => hasher.update(&[8, n]),
+            ColorType::Multiband {
+                bit_depth,
+                num_samples,
+            } => {
+                hasher.update(&[9, bit_depth]);
+                hasher.update(&num_samples.to_le_bytes());
+            }
+            other => panic!("compute_tiff_hash: unhandled ColorType {other:?}"),
+        }
+
+        // Hash decoded data: TIFF type tag (u16 repr) + LE sample bytes.
+        // Map each variant to the corresponding TIFF Type for byte-order normalization.
+        let sample_type = match &result {
+            DecodingSampleBuffer::U8(_) => Type::BYTE,
+            DecodingSampleBuffer::I8(_) => Type::SBYTE,
+            DecodingSampleBuffer::U16(_) => Type::SHORT,
+            DecodingSampleBuffer::I16(_) => Type::SSHORT,
+            DecodingSampleBuffer::U32(_) => Type::LONG,
+            DecodingSampleBuffer::I32(_) => Type::SLONG,
+            DecodingSampleBuffer::F32(_) => Type::FLOAT,
+            DecodingSampleBuffer::U64(_) => Type::LONG8,
+            DecodingSampleBuffer::I64(_) => Type::SLONG8,
+            DecodingSampleBuffer::F64(_) => Type::DOUBLE,
+            DecodingSampleBuffer::F16(_) => Type::SHORT, // f16 is 2 bytes like SHORT
+        };
+        hasher.update(&sample_type.to_u16().to_le_bytes());
+
+        let mut buf = result.as_buffer(0);
+        let bytes = buf.as_bytes_mut();
+        ByteOrder::native().convert(sample_type, bytes, ByteOrder::LittleEndian);
+        hasher.update(bytes);
+
+        page += 1;
+        if !decoder.more_images() {
+            break;
+        }
+    }
+
+    // Hash total page count at the end
+    hasher.update(&page.to_le_bytes());
+    hasher.finalize()
+}
+
+/// Verify all TIFF files in tests/images/seq/ against their filename-embedded CRC32 hash.
+///
+/// Each file is named `<description>-<8hex>.tiff` where the last segment before `.tiff`
+/// is the expected CRC32 hash of (dimensions, color type, decoded data) for all pages.
+#[test]
+fn verify_all_seq_images() {
+    let seq_dir = std::path::Path::new(SEQ_IMAGE_DIR);
+    if !seq_dir.is_dir() {
+        panic!("seq image directory not found: {}", seq_dir.display());
+    }
+
+    let mut files: Vec<_> = std::fs::read_dir(seq_dir)
+        .expect("Cannot read seq image directory")
+        .filter_map(|e| e.ok())
+        .filter(|e| {
+            e.path()
+                .extension()
+                .is_some_and(|ext| ext == "tiff" || ext == "tif")
+        })
+        .collect();
+    files.sort_by_key(|e| e.file_name());
+
+    assert!(
+        !files.is_empty(),
+        "No .tiff files found in {}",
+        seq_dir.display()
+    );
+
+    let mut failures = Vec::new();
+    for entry in &files {
+        let path = entry.path();
+        let stem = path.file_stem().unwrap().to_str().unwrap();
+
+        // Extract expected hash: last '-'-delimited segment
+        let expected_hash = stem
+            .rsplit('-')
+            .next()
+            .expect("filename must contain a '-' before the hash");
+
+        // Validate it looks like an 8-char hex string
+        if expected_hash.len() != 8 || !expected_hash.chars().all(|c| c.is_ascii_hexdigit()) {
+            failures.push(format!(
+                "{}: filename does not end with 8-char hex hash (got '{}')",
+                stem, expected_hash
+            ));
+            continue;
+        }
+
+        let file = File::open(&path).expect("Cannot open test image");
+        let actual_hash = format!("{:08x}", compute_tiff_hash(file));
+
+        if actual_hash != expected_hash {
+            failures.push(format!(
+                "{}: expected hash {} but got {}",
+                stem, expected_hash, actual_hash
+            ));
+        }
+    }
+
+    if !failures.is_empty() {
+        panic!(
+            "{} of {} seq images failed hash verification:\n  {}",
+            failures.len(),
+            files.len(),
+            failures.join("\n  ")
+        );
+    }
+
+    eprintln!("Verified {} seq images", files.len());
+}
+
+/// Helper: print the correct hash-suffixed filename for every *.tiff in tests/images/seq/.
+/// Run with: cargo test print_seq_hashes -- --ignored --nocapture
+#[test]
+#[ignore]
+fn print_seq_hashes() {
+    let dir = std::path::Path::new(SEQ_IMAGE_DIR);
+    let mut files: Vec<_> = std::fs::read_dir(dir)
+        .expect("Cannot read image directory")
+        .filter_map(|e| e.ok())
+        .filter(|e| {
+            e.file_name()
+                .to_str()
+                .is_some_and(|n| n.starts_with("seq-") && n.ends_with(".tiff"))
+        })
+        .collect();
+    files.sort_by_key(|e| e.file_name());
+
+    for entry in &files {
+        let path = entry.path();
+        let name = path.file_name().unwrap().to_str().unwrap();
+        let file = File::open(&path).expect("Cannot open test image");
+        let hash = format!("{:08x}", compute_tiff_hash(file));
+        // Strip the old hash (last -XXXXXXXX before .tiff) if present
+        let stem = path.file_stem().unwrap().to_str().unwrap();
+        let base = match stem.rsplit_once('-') {
+            Some((prefix, suffix))
+                if suffix.len() == 8 && suffix.chars().all(|c| c.is_ascii_hexdigit()) =>
+            {
+                prefix
+            }
+            _ => stem,
+        };
+        let new_name = format!("{base}-{hash}.tiff");
+        if new_name != name {
+            eprintln!("RENAME: {name} -> {new_name}");
+        } else {
+            eprintln!("OK: {name}");
+        }
+    }
+}
+
 /// Tests that a decoder can be constructed for an image and the color type
 /// read from the IFD and is of the appropriate type, but the type is
 /// unsupported.
+#[allow(dead_code)]
 fn test_image_color_type_unsupported(file: &str, expected_type: ColorType) {
     let path = PathBuf::from(TEST_IMAGE_DIR).join(file);
     let img_file = File::open(path).expect("Cannot find test image!");
-    let mut decoder = Decoder::new(img_file).expect("Cannot create decoder");
+    let mut decoder = Decoder::open(img_file).expect("Cannot create decoder");
+    decoder.next_image().expect("Cannot read image IFD");
+
     assert_eq!(decoder.colortype().unwrap(), expected_type);
     assert!(matches!(
         decoder.read_image(),
@@ -69,6 +266,47 @@ fn test_cmyk_f32() {
     test_image_sum_f32("cmyk-3c-32b-float.tiff", ColorType::CMYK(32), 496.0405);
 }
 
+#[test]
+fn test_palette_u1() {
+    test_image_sum_u8("palette-1c-1b.tiff", ColorType::Palette(1), 379313);
+}
+
+#[test]
+fn test_palette_u4() {
+    test_image_sum_u8("palette-1c-4b.tiff", ColorType::Palette(4), 1480490);
+}
+
+#[test]
+fn test_palette_u8() {
+    test_image_sum_u8("palette-1c-8b.tiff", ColorType::Palette(8), 2876948);
+}
+
+#[test]
+fn test_palette_color_map() {
+    let path = PathBuf::from(TEST_IMAGE_DIR).join("palette-1c-8b.tiff");
+    let img_file = File::open(path).expect("Cannot find test image!");
+    let mut decoder = Decoder::open(img_file).expect("Cannot create decoder");
+    decoder.next_image().expect("Cannot read image IFD");
+
+    assert_eq!(decoder.colortype().unwrap(), ColorType::Palette(8));
+
+    let color_map = decoder
+        .color_map()
+        .expect("Palette image should have a color map");
+    // 8-bit palette: 3 * 256 = 768 entries
+    assert_eq!(color_map.len(), 768);
+
+    // Each section (R, G, B) has 256 entries
+    let r = &color_map[..256];
+    let g = &color_map[256..512];
+    let b = &color_map[512..768];
+
+    // Verify all values are valid u16 (non-zero palette, at least some variation)
+    assert!(r.iter().any(|&v| v > 0));
+    assert!(g.iter().any(|&v| v > 0));
+    assert!(b.iter().any(|&v| v > 0));
+}
+
 #[test]
 fn test_gray_u8() {
     test_image_sum_u8("minisblack-1c-8b.tiff", ColorType::Gray(8), 2840893);
@@ -76,7 +314,7 @@ fn test_gray_u8() {
 
 #[test]
 fn test_gray_u12() {
-    test_image_color_type_unsupported("12bit.cropped.tiff", ColorType::Gray(12));
+    test_image_sum_u16("12bit.cropped.tiff", ColorType::Gray(12), 10973);
 }
 
 #[test]
@@ -115,7 +353,7 @@ fn test_rgb_u8() {
 
 #[test]
 fn test_rgb_u12() {
-    test_image_color_type_unsupported("12bit.cropped.rgb.tiff", ColorType::RGB(12));
+    test_image_sum_u16("12bit.cropped.rgb.tiff", ColorType::RGB(12), 32919);
 }
 
 #[test]
@@ -166,8 +404,12 @@ fn test_string_tags() {
     for filename in filenames.iter() {
         let path = PathBuf::from(TEST_IMAGE_DIR).join(filename);
         let img_file = File::open(path).expect("Cannot find test image!");
-        let mut decoder = Decoder::new(img_file).expect("Cannot create decoder");
-        let software = decoder.get_tag(tiff::tags::Tag::Software).unwrap();
+        let mut decoder = Decoder::open(img_file).expect("Cannot create decoder");
+        decoder.next_image().expect("Cannot read image IFD");
+        let software = decoder
+            .current_ifd()
+            .get_tag(tiff::tags::Tag::Software)
+            .unwrap();
         match software {
             ifd::Value::Ascii(s) => assert_eq!(
                 &s,
@@ -190,10 +432,11 @@ fn test_decode_data() {
         }
     }
     let file = File::open("./tests/decodedata-rgb-3c-8b.tiff").unwrap();
-    let mut decoder = Decoder::new(file).unwrap();
+    let mut decoder = Decoder::open(file).unwrap();
+    decoder.next_image().expect("Cannot read image IFD");
     assert_eq!(decoder.colortype().unwrap(), ColorType::RGB(8));
     assert_eq!(decoder.dimensions().unwrap(), (100, 100));
-    if let DecodingResult::U8(img_res) = decoder.read_image().unwrap() {
+    if let DecodingSampleBuffer::U8(img_res) = decoder.read_image().unwrap() {
         assert_eq!(image_data, img_res);
     } else {
         panic!("Wrong data type");
@@ -232,14 +475,47 @@ fn test_tiled_rect_rgb_u8() {
     test_image_sum_u8("tiled-rect-rgb-u8.tif", ColorType::RGB(8), 62081032);
 }
 
+#[test]
+fn test_tiled_extra_samples_border_u8() {
+    // Regression test for https://github.com/image-rs/image-tiff/issues/400
+    //
+    // A tiled image whose dimensions are not multiples of the tile size, with
+    // an extra sample that is discarded on decode. The horizontal padding of
+    // the right border tiles used to be written past the end of the output
+    // row, spilling into the leftmost columns of the following row. The
+    // fixture's tile padding is filled with 0xEE so any spill is visible.
+    let path = PathBuf::from(TEST_IMAGE_DIR).join("tiled-extra-samples-border-u8.tif");
+    let img_file = File::open(path).expect("Cannot find test image!");
+    let mut decoder = Decoder::open(img_file).expect("Cannot create decoder");
+    decoder.next_image().expect("Cannot read image IFD");
+    assert_eq!(decoder.dimensions().unwrap(), (40, 40));
+    assert_eq!(decoder.colortype().unwrap(), ColorType::RGB(8));
+
+    let DecodingSampleBuffer::U8(data) = decoder.read_image().unwrap() else {
+        panic!("Wrong bit depth")
+    };
+
+    let mut expected = Vec::with_capacity(40 * 40 * 3);
+    for y in 0..40u32 {
+        for x in 0..40u32 {
+            expected.push(((x * 3) % 251) as u8);
+            expected.push(((y * 7) % 251) as u8);
+            expected.push(((x + y) % 251) as u8);
+        }
+    }
+    assert_eq!(data, expected);
+}
+
 #[test]
 fn test_inner_access() {
     let path = PathBuf::from(TEST_IMAGE_DIR).join("tiled-rect-rgb-u8.tif");
     let img_file = File::open(path).expect("Cannot find test image!");
-    let mut decoder = Decoder::new(img_file).expect("Cannot create decoder");
+    let mut decoder = Decoder::open(img_file).expect("Cannot create decoder");
+    decoder.next_image().expect("Cannot read image IFD");
     assert_eq!(decoder.colortype().unwrap(), ColorType::RGB(8));
 
-    let c = decoder
+    let mut ifd = decoder.current_ifd();
+    let c = ifd
         .get_tag(tiff::tags::Tag::Compression)
         .unwrap()
         .into_u16()
@@ -248,13 +524,13 @@ fn test_inner_access() {
 
     // Because the image is uncompressed, reading the first tile directly with the inner reader
     // should yield the same result as reading it with the decoder's read_chunk method.
-    let first_offset = decoder
+    let first_offset = ifd
         .get_tag_u32_vec(tiff::tags::Tag::TileOffsets)
         .unwrap()
         .into_iter()
         .next()
         .unwrap();
-    let first_byte_count = decoder
+    let first_byte_count = ifd
         .get_tag_u32_vec(tiff::tags::Tag::TileByteCounts)
         .unwrap()
         .into_iter()
@@ -272,7 +548,7 @@ fn test_inner_access() {
     let raw_sum: u64 = buf.into_iter().map(<u64>::from).sum();
 
     match decoder.read_chunk(0).unwrap() {
-        DecodingResult::U8(chunk) => {
+        DecodingSampleBuffer::U8(chunk) => {
             let sum: u64 = chunk.into_iter().map(<u64>::from).sum();
             assert_eq!(sum, raw_sum);
         }
@@ -322,7 +598,8 @@ fn test_tiled_incremental() {
 
     let path = PathBuf::from(TEST_IMAGE_DIR).join(file);
     let img_file = File::open(path).expect("Cannot find test image!");
-    let mut decoder = Decoder::new(img_file).expect("Cannot create decoder");
+    let mut decoder = Decoder::open(img_file).expect("Cannot create decoder");
+    decoder.next_image().expect("Cannot read image IFD");
     assert_eq!(decoder.colortype().unwrap(), expected_type);
 
     let tiles = decoder.tile_count().unwrap();
@@ -330,7 +607,7 @@ fn test_tiled_incremental() {
 
     for tile in 0..tiles {
         match decoder.read_chunk(tile).unwrap() {
-            DecodingResult::U8(res) => {
+            DecodingSampleBuffer::U8(res) => {
                 let sum: u64 = res.into_iter().map(<u64>::from).sum();
                 assert_eq!(sum, sums[tile as usize]);
             }
@@ -352,7 +629,8 @@ fn test_read_planar_bands() {
 
     let path = PathBuf::from(TEST_IMAGE_DIR).join(file);
     let img_file = File::open(path).expect("Cannot find test image!");
-    let mut decoder = Decoder::new(img_file).expect("Cannot create decoder");
+    let mut decoder = Decoder::open(img_file).expect("Cannot create decoder");
+    decoder.next_image().expect("Cannot read image IFD");
     assert_eq!(decoder.colortype().unwrap(), expected_type);
 
     let chunks = decoder.strip_count().unwrap();
@@ -363,21 +641,21 @@ fn test_read_planar_bands() {
 
     // 1st band (red)
     match decoder.read_chunk(0).unwrap() {
-        DecodingResult::U8(chunk) => {
+        DecodingSampleBuffer::U8(chunk) => {
             assert_eq!(chunk[0], 73);
         }
         _ => panic!("Wrong bit depth"),
     }
     // 2nd band (green)
     match decoder.read_chunk(chunks / 3).unwrap() {
-        DecodingResult::U8(chunk) => {
+        DecodingSampleBuffer::U8(chunk) => {
             assert_eq!(chunk[0], 51);
         }
         _ => panic!("Wrong bit depth"),
     }
     // 3rd band (blue)
     match decoder.read_chunk(chunks / 3 * 2).unwrap() {
-        DecodingResult::U8(chunk) => {
+        DecodingSampleBuffer::U8(chunk) => {
             assert_eq!(chunk[0], 30);
         }
         _ => panic!("Wrong bit depth"),
@@ -396,7 +674,8 @@ fn test_div_zero() {
         178, 178, 178,
     ];
 
-    let err = tiff::decoder::Decoder::new(std::io::Cursor::new(&image)).unwrap_err();
+    let mut decoder = Decoder::open(std::io::Cursor::new(&image)).unwrap();
+    let err = decoder.next_image().unwrap_err();
 
     match err {
         TiffError::FormatError(TiffFormatError::StripTileTagConflict) => {}
@@ -414,7 +693,8 @@ fn test_too_many_value_bytes() {
         0, 89, 89, 89, 89, 89, 89, 89, 89, 96, 1, 20, 89, 89, 89, 89, 18,
     ];
 
-    let error = tiff::decoder::Decoder::new(std::io::Cursor::new(&image)).unwrap_err();
+    let mut decoder = Decoder::open(std::io::Cursor::new(&image)).unwrap();
+    let error = decoder.next_image().unwrap_err();
 
     match error {
         tiff::TiffError::LimitsExceeded => {}
@@ -432,7 +712,8 @@ fn fuzzer_testcase5() {
         178, 178, 178,
     ];
 
-    let _ = tiff::decoder::Decoder::new(std::io::Cursor::new(&image)).unwrap_err();
+    let mut decoder = Decoder::open(std::io::Cursor::new(&image)).unwrap();
+    let _ = decoder.next_image().unwrap_err();
 }
 
 #[test]
@@ -445,7 +726,8 @@ fn fuzzer_testcase1() {
         178,
     ];
 
-    let _ = tiff::decoder::Decoder::new(std::io::Cursor::new(&image)).unwrap_err();
+    let mut decoder = Decoder::open(std::io::Cursor::new(&image)).unwrap();
+    let _ = decoder.next_image().unwrap_err();
 }
 
 #[test]
@@ -458,7 +740,8 @@ fn fuzzer_testcase6() {
         178, 178,
     ];
 
-    let _ = tiff::decoder::Decoder::new(std::io::Cursor::new(&image)).unwrap_err();
+    let mut decoder = Decoder::open(std::io::Cursor::new(&image)).unwrap();
+    let _ = decoder.next_image().unwrap_err();
 }
 
 #[test]
@@ -470,7 +753,8 @@ fn oom() {
         0, 0, 0, 40, 0, 0, 0, 23, 1, 4, 0, 1, 0, 0, 0, 178, 48, 178, 178, 178, 178, 162, 178,
     ];
 
-    let _ = tiff::decoder::Decoder::new(std::io::Cursor::new(&image)).unwrap_err();
+    let mut decoder = Decoder::open(std::io::Cursor::new(&image)).unwrap();
+    let _ = decoder.next_image().unwrap_err();
 }
 
 #[test]
@@ -482,7 +766,8 @@ fn fuzzer_testcase4() {
         0, 0, 0, 40, 0, 0, 0, 23, 1, 4, 0, 1, 0, 0, 0, 48, 178, 178, 178, 0, 1, 0, 13, 13,
     ];
 
-    let _ = tiff::decoder::Decoder::new(std::io::Cursor::new(&image)).unwrap_err();
+    let mut decoder = Decoder::open(std::io::Cursor::new(&image)).unwrap();
+    let _ = decoder.next_image().unwrap_err();
 }
 
 #[test]
@@ -498,7 +783,8 @@ fn fuzzer_testcase2() {
         73,
     ];
 
-    let _ = tiff::decoder::Decoder::new(std::io::Cursor::new(&image)).unwrap_err();
+    let mut decoder = Decoder::open(std::io::Cursor::new(&image)).unwrap();
+    let _ = decoder.next_image().unwrap_err();
 }
 
 #[test]
@@ -514,7 +800,8 @@ fn invalid_jpeg_tag_2() {
         0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 36, 73, 73, 0, 42, 36, 36, 36, 36, 0, 0, 8, 0,
     ];
 
-    let _ = tiff::decoder::Decoder::new(std::io::Cursor::new(&image)).unwrap_err();
+    let mut decoder = Decoder::open(std::io::Cursor::new(&image)).unwrap();
+    let _ = decoder.next_image().unwrap_err();
 }
 
 #[test]
@@ -527,7 +814,8 @@ fn fuzzer_testcase3() {
         255, 255,
     ];
 
-    let _ = tiff::decoder::Decoder::new(std::io::Cursor::new(&image)).unwrap_err();
+    let mut decoder = Decoder::open(std::io::Cursor::new(&image)).unwrap();
+    let _ = decoder.next_image().unwrap_err();
 }
 
 #[test]
@@ -545,7 +833,8 @@ fn timeout() {
         0, 0, 73, 73, 42, 0, 8, 0, 0, 0, 0, 0, 32,
     ];
 
-    let error = tiff::decoder::Decoder::new(std::io::Cursor::new(&image)).unwrap_err();
+    let mut decoder = Decoder::open(std::io::Cursor::new(&image)).unwrap();
+    let error = decoder.next_image().unwrap_err();
 
     match error {
         TiffError::FormatError(TiffFormatError::CycleInOffsets) => {}
@@ -569,7 +858,7 @@ fn test_predictor_3_gray_f32() {
 }
 
 #[test]
-#[cfg(feature = "zstd")]
+#[cfg(any(feature = "zstd", feature = "zstd-safe-rust"))]
 fn test_zstd_compression() {
     // gdal_translate -co COMPRESS=ZSTD -co ZSTD_LEVEL=20 int16.tif int16_zstd.tif
     test_image_sum_i16("int16_zstd.tif", ColorType::Gray(16), 354396);
@@ -583,7 +872,8 @@ fn test_image_bytes(
 ) {
     let path = PathBuf::from(TEST_IMAGE_DIR).join(file);
     let img_file = File::open(path).expect("Cannot find test image!");
-    let mut decoder = Decoder::new(img_file).expect("Cannot create decoder");
+    let mut decoder = Decoder::open(img_file).expect("Cannot create decoder");
+    decoder.next_image().unwrap();
 
     let mut buffer = vec![0u8; 0];
     for (idx, &(expected_type, expected_crc)) in expected.iter().enumerate() {
@@ -718,5 +1008,377 @@ fn extra_bits_gray() {
 
 #[test]
 fn extra_bits_rgb() {
-    test_image_sum_u8("extra_bits_rgb_8b.tiff", ColorType::RGB(8), 0);
+    test_image_sum_u8("extra_bits_rgb_8b.tiff", ColorType::RGBA(8), 64);
+}
+
+#[test]
+#[cfg(feature = "fax")]
+fn test_decode_huge_g4() {
+    let path = PathBuf::from(TEST_IMAGE_DIR).join("big_g4.tif");
+    let img_file = File::open(path).expect("failed to open large G4 test image");
+    let mut decoder = Decoder::open(img_file).expect("failed to create decoder");
+
+    decoder.next_image().expect("failed to read image IFD");
+    let (width, height) = decoder.dimensions().expect("failed to get dimensions");
+
+    assert!(
+        height > u16::MAX as u32,
+        "Test image height {} is not large enough to test u16 overflow",
+        height
+    );
+
+    let result = decoder
+        .read_image()
+        .expect("failed to decode huge G4 image");
+
+    if let tiff::decoder::DecodingSampleBuffer::U8(data) = result {
+        assert_eq!(data.len(), (width as usize * height as usize));
+    } else {
+        panic!("Unexpected decoding result type");
+    }
+}
+
+// ---- WhiteIsZero tests across bit depths ----
+
+// WhiteIsZero + extended bit depth (12-bit gray, synthetic 4x2 image)
+#[test]
+fn test_gray_u12_white_is_zero() {
+    // Values: [0, 1000, 2000, 4095, 100, 500, 3000, 3500]
+    // After WhiteIsZero inversion: [4095, 3095, 2095, 0, 3995, 3595, 1095, 595]
+    test_image_sum_u16("miniswhite-1c-12b.tiff", ColorType::Gray(12), 18565);
+}
+
+// WhiteIsZero + non-standard sub-byte depths (3-bit and 6-bit, synthetic 8x2 images)
+// These verify per-sample inversion for packed depths where samples cross byte boundaries.
+#[test]
+fn test_gray_u3_white_is_zero() {
+    test_image_sum_u8("miniswhite-1c-3b.tiff", ColorType::Gray(3), 765);
+}
+
+#[test]
+fn test_gray_u6_white_is_zero() {
+    // Values: [0, 10, 20, 30, 40, 50, 60, 63] × 2 rows
+    // After inversion: [63, 53, 43, 33, 23, 13, 3, 0] × 2 rows
+    test_image_sum_u8("miniswhite-1c-6b.tiff", ColorType::Gray(6), 2124);
+}
+
+// ---- Non-standard sub-byte depths (BlackIsZero) ----
+// Verify that odd bit depths (3, 5, 7) decode without error.
+
+#[test]
+fn test_gray_u3() {
+    // 8x2 image, values [0..7, 7..0], packed to 6 bytes
+    test_image_sum_u8("minisblack-1c-3b.tiff", ColorType::Gray(3), 765);
+}
+
+#[test]
+fn test_gray_u5() {
+    // 8x2 image, packed to 10 bytes
+    test_image_sum_u8("minisblack-1c-5b.tiff", ColorType::Gray(5), 1275);
+}
+
+#[test]
+fn test_gray_u7() {
+    // 8x2 image, packed to 14 bytes
+    test_image_sum_u8("minisblack-1c-7b.tiff", ColorType::Gray(7), 1711);
+}
+
+// ---- Horizontal predictor + extended bit depth ----
+
+#[test]
+fn test_gray_u12_hpredict() {
+    // Delta-encoded 12-bit values: [100, 200, 300, 400, 1000, 2000, 3000, 4000]
+    test_image_sum_u16("hpredict-1c-12b.tiff", ColorType::Gray(12), 11000);
+}
+
+// ---- Old-style LZW ----
+
+#[test]
+fn test_old_style_lzw() {
+    // Pre-TIFF-6.0 "old-style" LZW: LSB-first bit order with no early-change size
+    // switch. Auto-detected from the stream (first byte 0x00, second byte odd).
+    // Same image as libtiffpic's quad-lzw.tif; the decoded pixels must match.
+    test_image_sum_u8("quad-lzw-compat.tiff", ColorType::RGB(8), 21048924);
+}
+
+// ---- TransparencyMask ----
+
+/// Build a minimal uncompressed 2x2 TIFF in memory, in the requested byte order,
+/// with the given photometric interpretation and the pixel data as a single strip.
+/// `sample_format` is emitted as a SampleFormat tag when `Some`; when `None` the
+/// tag is omitted (the decoder then defaults to unsigned). Pixel bytes must already
+/// be in `byte_order`.
+fn build_raw_tiff(
+    byte_order: ByteOrder,
+    photometric: PhotometricInterpretation,
+    bits_per_sample: u16,
+    samples_per_pixel: u16,
+    sample_format: Option<SampleFormat>,
+    pixel_data: &[u8],
+) -> Vec<u8> {
+    let le = matches!(byte_order, ByteOrder::LittleEndian);
+    let put16 = |buf: &mut Vec<u8>, v: u16| {
+        if le {
+            buf.extend_from_slice(&v.to_le_bytes());
+        } else {
+            buf.extend_from_slice(&v.to_be_bytes());
+        }
+    };
+    let put32 = |buf: &mut Vec<u8>, v: u32| {
+        if le {
+            buf.extend_from_slice(&v.to_le_bytes());
+        } else {
+            buf.extend_from_slice(&v.to_be_bytes());
+        }
+    };
+
+    let width: u16 = 2;
+    let height: u16 = 2;
+    let num_tags: u16 = if sample_format.is_some() { 9 } else { 8 };
+    let ifd_offset: u32 = 8;
+    let ifd_size = 2 + (num_tags as u32) * 12 + 4;
+    let strip_offset = 8 + ifd_size;
+
+    // IFD entries (must be ascending tag order). Tag IDs stay raw for the
+    // ascending-order property; the field type uses the `Type` enum.
+    let mut tags: Vec<(u16, Type, u32)> = vec![
+        (256, Type::SHORT, width as u32),                // ImageWidth
+        (257, Type::SHORT, height as u32),               // ImageLength
+        (258, Type::SHORT, bits_per_sample as u32),      // BitsPerSample
+        (259, Type::SHORT, 1),                           // Compression = None
+        (262, Type::SHORT, photometric.to_u16() as u32), // PhotometricInterpretation
+        (273, Type::LONG, strip_offset),                 // StripOffsets
+        (277, Type::SHORT, samples_per_pixel as u32),    // SamplesPerPixel
+        (279, Type::LONG, pixel_data.len() as u32),      // StripByteCounts
+    ];
+    if let Some(sf) = sample_format {
+        tags.push((339, Type::SHORT, sf.to_u16() as u32)); // SampleFormat (tag 339 > 279)
+    }
+
+    let mut buf = Vec::new();
+    buf.extend_from_slice(if le { b"II" } else { b"MM" });
+    put16(&mut buf, 42);
+    put32(&mut buf, ifd_offset);
+    put16(&mut buf, num_tags);
+
+    for (tag, typ, value) in tags {
+        put16(&mut buf, tag);
+        put16(&mut buf, typ.to_u16());
+        put32(&mut buf, 1); // count
+                            // A SHORT value is left-justified in the 4-byte value field (value in the
+                            // first two bytes, then padding); a LONG fills all four.
+        match typ {
+            Type::SHORT => {
+                put16(&mut buf, value as u16);
+                put16(&mut buf, 0);
+            }
+            _ => put32(&mut buf, value),
+        }
+    }
+
+    put32(&mut buf, 0); // next IFD = 0
+    buf.extend_from_slice(pixel_data);
+    buf
+}
+
+#[test]
+fn test_transparency_mask() {
+    // 2x2 mask: values 0, 255, 128, 64
+    let data = build_raw_tiff(
+        ByteOrder::LittleEndian,
+        PhotometricInterpretation::TransparencyMask,
+        8,
+        1,
+        None,
+        &[0, 255, 128, 64],
+    );
+    let mut decoder = Decoder::open(Cursor::new(&data)).unwrap();
+    decoder.next_image().unwrap();
+
+    assert_eq!(decoder.colortype().unwrap(), ColorType::Gray(8));
+
+    let result = decoder.read_image().unwrap();
+    match result {
+        DecodingSampleBuffer::U8(pixels) => {
+            // TransparencyMask is decoded as grayscale
+            assert_eq!(pixels.len(), 4);
+            assert_eq!(pixels[0], 0);
+            assert_eq!(pixels[1], 255);
+            assert_eq!(pixels[2], 128);
+            assert_eq!(pixels[3], 64);
+        }
+        _ => panic!("Expected U8 buffer"),
+    }
+}
+
+// ---- CIE L*a*b* ----
+
+#[test]
+fn test_cielab_decode() {
+    // 2x2 CIELab image: 3 bytes per pixel (L, a, b)
+    // L=128, a=0 (signed neutral), b=0 (signed neutral)
+    // After re-biasing: a=128 (unsigned neutral), b=128 (unsigned neutral)
+    let pixels: Vec<u8> = vec![
+        128, 0, 0, // pixel 0: L=128, a=0, b=0 (neutral gray)
+        255, 50, 50, // pixel 1: L=255, a=+50, b=+50
+        100, 206, 206, // pixel 2: L=100, a=-50 (as i8), b=-50 (as i8)
+        0, 128, 128, // pixel 3: L=0, a=-128 (as i8), b=-128 (as i8)
+    ];
+
+    let data = build_raw_tiff(
+        ByteOrder::LittleEndian,
+        PhotometricInterpretation::CIELab,
+        8,
+        3,
+        None,
+        &pixels,
+    );
+    let mut decoder = Decoder::open(Cursor::new(&data)).unwrap();
+    decoder.next_image().unwrap();
+
+    assert_eq!(decoder.colortype().unwrap(), ColorType::Lab(8));
+
+    let result = decoder.read_image().unwrap();
+    match result {
+        DecodingSampleBuffer::U8(decoded) => {
+            assert_eq!(decoded.len(), 12); // 4 pixels * 3 channels
+
+            // Pixel 0: L=128, a=0+128=128, b=0+128=128
+            assert_eq!(decoded[0], 128);
+            assert_eq!(decoded[1], 128);
+            assert_eq!(decoded[2], 128);
+
+            // Pixel 1: L=255, a=50+128=178, b=50+128=178
+            assert_eq!(decoded[3], 255);
+            assert_eq!(decoded[4], 178);
+            assert_eq!(decoded[5], 178);
+
+            // Pixel 2: L=100, a=206+128=78 (wrapping), b=206+128=78
+            assert_eq!(decoded[6], 100);
+            assert_eq!(decoded[7], 78);
+            assert_eq!(decoded[8], 78);
+
+            // Pixel 3: L=0, a=128+128=0 (wrapping), b=128+128=0
+            assert_eq!(decoded[9], 0);
+            assert_eq!(decoded[10], 0);
+            assert_eq!(decoded[11], 0);
+        }
+        _ => panic!("Expected U8 buffer"),
+    }
+}
+
+#[test]
+fn test_cielab_decode_16() {
+    // 2x2 16-bit CIELab image: 3 u16 samples per pixel (L, a, b), a/b signed.
+    // Re-biasing maps signed a/b to unsigned by adding 0x8000 (wrapping):
+    //   0 -> 32768, +1000 -> 33768, -1000 -> 31768, -32768 -> 0, +32767 -> 65535.
+    let samples: [u16; 12] = [
+        32768, 0, 0, // pixel 0: L, a=0, b=0 (neutral)
+        65535, 1000, 1000, // pixel 1: a=+1000, b=+1000
+        10000, 64536, 64536, // pixel 2: a=-1000, b=-1000 (as u16)
+        0, 32768, 32767, // pixel 3: a=-32768, b=+32767 (as u16)
+    ];
+    let mut pixels = Vec::new();
+    for s in samples {
+        pixels.extend_from_slice(&s.to_le_bytes());
+    }
+
+    let data = build_raw_tiff(
+        ByteOrder::LittleEndian,
+        PhotometricInterpretation::CIELab,
+        16,
+        3,
+        None,
+        &pixels,
+    );
+    let mut decoder = Decoder::open(Cursor::new(&data)).unwrap();
+    decoder.next_image().unwrap();
+
+    assert_eq!(decoder.colortype().unwrap(), ColorType::Lab(16));
+
+    let result = decoder.read_image().unwrap();
+    match result {
+        DecodingSampleBuffer::U16(decoded) => {
+            assert_eq!(decoded.len(), 12); // 4 pixels * 3 channels
+
+            // L unchanged; a/b re-biased by +0x8000 (wrapping).
+            let expected: [u16; 12] = [
+                32768, 32768, 32768, // pixel 0
+                65535, 33768, 33768, // pixel 1
+                10000, 31768, 31768, // pixel 2
+                0, 0, 65535, // pixel 3
+            ];
+            assert_eq!(decoded, expected);
+        }
+        _ => panic!("Expected U16 buffer"),
+    }
+}
+
+#[test]
+fn test_cielab_decode_16_big_endian() {
+    // Same image and expected output as `test_cielab_decode_16`, but stored as a
+    // big-endian ("MM") TIFF. 16-bit is the case where byte order matters: the
+    // decoder must swap to native before the a/b re-bias, so the result is
+    // identical to the little-endian case.
+    let samples: [u16; 12] = [
+        32768, 0, 0, // pixel 0
+        65535, 1000, 1000, // pixel 1
+        10000, 64536, 64536, // pixel 2
+        0, 32768, 32767, // pixel 3
+    ];
+    let mut pixels = Vec::new();
+    for s in samples {
+        pixels.extend_from_slice(&s.to_be_bytes());
+    }
+
+    let data = build_raw_tiff(
+        ByteOrder::BigEndian,
+        PhotometricInterpretation::CIELab,
+        16,
+        3,
+        None,
+        &pixels,
+    );
+    let mut decoder = Decoder::open(Cursor::new(&data)).unwrap();
+    decoder.next_image().unwrap();
+
+    assert_eq!(decoder.colortype().unwrap(), ColorType::Lab(16));
+
+    let result = decoder.read_image().unwrap();
+    match result {
+        DecodingSampleBuffer::U16(decoded) => {
+            let expected: [u16; 12] = [
+                32768, 32768, 32768, // pixel 0
+                65535, 33768, 33768, // pixel 1
+                10000, 31768, 31768, // pixel 2
+                0, 0, 65535, // pixel 3
+            ];
+            assert_eq!(decoded, expected);
+        }
+        _ => panic!("Expected U16 buffer"),
+    }
+}
+
+#[test]
+fn test_cielab_rejects_non_uint_sample_format() {
+    // CIELab treats a/b as signed via the photometric interpretation and requires
+    // SampleFormat::Uint (matching the ICCLab arm). A file declaring Int must be
+    // rejected rather than silently producing a signed output buffer.
+    let pixels = vec![0u8; 12]; // 2x2, 3 samples, 8-bit
+    let data = build_raw_tiff(
+        ByteOrder::LittleEndian,
+        PhotometricInterpretation::CIELab,
+        8,
+        3,
+        Some(SampleFormat::Int),
+        &pixels,
+    );
+
+    let mut decoder = Decoder::open(Cursor::new(&data)).unwrap();
+    // Rejection may surface at either next_image() or colortype().
+    let rejected = decoder.next_image().is_err() || decoder.colortype().is_err();
+    assert!(
+        rejected,
+        "CIELab with SampleFormat=Int must be rejected, not decoded"
+    );
 }

tests/decode_libtiffpic.rs

@@ -0,0 +1,364 @@
+use std::collections::HashMap;
+use std::{fs::File, path};
+
+use tiff::decoder::{Decoder, DecodingSampleBuffer};
+use tiff::tags::{ByteOrder, Type};
+use tiff::ColorType;
+
+use libtest_mimic::{Arguments, Failed, Trial};
+use walkdir::WalkDir;
+
+const REFERENCE_DIR: &str = "tests/libtiffpic";
+
+// `find test/libtiffpic -type f | sort`
+//
+// Each entry maps a file path to its expected behavior:
+//   None           = not a TIFF file, skip entirely
+//   Some(0)        = TIFF with unsupported features, decode-only smoke test
+//   Some(nonzero)  = TIFF with full CRC32 hash verification of decoded output
+const FILES: &[(&str, Option<u32>)] = &[
+    ("tests/libtiffpic/caspian.tif", Some(0x4ea8d4e4)),
+    ("tests/libtiffpic/cramps.tif", Some(0xdfa2fba4)),
+    ("tests/libtiffpic/cramps-tile.tif", Some(0xdfa2fba4)),
+    ("tests/libtiffpic/CVS/Entries", None),
+    ("tests/libtiffpic/CVS/Repository", None),
+    ("tests/libtiffpic/CVS/Root", None),
+    ("tests/libtiffpic/depth/CVS/Entries", None),
+    ("tests/libtiffpic/depth/CVS/Repository", None),
+    ("tests/libtiffpic/depth/CVS/Root", None),
+    (
+        "tests/libtiffpic/depth/flower-minisblack-02.tif",
+        Some(0x1c90f515),
+    ),
+    (
+        "tests/libtiffpic/depth/flower-minisblack-04.tif",
+        Some(0x0f4813cb),
+    ),
+    (
+        "tests/libtiffpic/depth/flower-minisblack-06.tif",
+        Some(0xf0c0a901),
+    ),
+    (
+        "tests/libtiffpic/depth/flower-minisblack-08.tif",
+        Some(0xe797b15b),
+    ),
+    (
+        "tests/libtiffpic/depth/flower-minisblack-10.tif",
+        Some(0xdee442ec),
+    ),
+    (
+        "tests/libtiffpic/depth/flower-minisblack-12.tif",
+        Some(0x4810c4e9),
+    ),
+    (
+        "tests/libtiffpic/depth/flower-minisblack-14.tif",
+        Some(0x7e03cf03),
+    ),
+    (
+        "tests/libtiffpic/depth/flower-minisblack-16.tif",
+        Some(0x8e0add32),
+    ),
+    (
+        "tests/libtiffpic/depth/flower-minisblack-24.tif",
+        Some(0x5cf29313),
+    ),
+    (
+        "tests/libtiffpic/depth/flower-minisblack-32.tif",
+        Some(0x80025eee),
+    ),
+    (
+        "tests/libtiffpic/depth/flower-palette-02.tif",
+        Some(0xaeb21cff),
+    ),
+    (
+        "tests/libtiffpic/depth/flower-palette-04.tif",
+        Some(0x339d428b),
+    ),
+    (
+        "tests/libtiffpic/depth/flower-palette-08.tif",
+        Some(0xb6b203e9),
+    ),
+    (
+        "tests/libtiffpic/depth/flower-palette-16.tif",
+        Some(0x4e02308f),
+    ),
+    (
+        "tests/libtiffpic/depth/flower-rgb-contig-02.tif",
+        Some(0x8f16cf35),
+    ),
+    (
+        "tests/libtiffpic/depth/flower-rgb-contig-04.tif",
+        Some(0x95e97f94),
+    ),
+    (
+        "tests/libtiffpic/depth/flower-rgb-contig-08.tif",
+        Some(0x98134e7c),
+    ),
+    (
+        "tests/libtiffpic/depth/flower-rgb-contig-10.tif",
+        Some(0xa2ad8f4d),
+    ),
+    (
+        "tests/libtiffpic/depth/flower-rgb-contig-12.tif",
+        Some(0xfad187fc),
+    ),
+    (
+        "tests/libtiffpic/depth/flower-rgb-contig-14.tif",
+        Some(0x93fdc170),
+    ),
+    (
+        "tests/libtiffpic/depth/flower-rgb-contig-16.tif",
+        Some(0x25e1066b),
+    ),
+    (
+        "tests/libtiffpic/depth/flower-rgb-contig-24.tif",
+        Some(0x25cdf743),
+    ),
+    (
+        "tests/libtiffpic/depth/flower-rgb-contig-32.tif",
+        Some(0x195dde9c),
+    ),
+    (
+        "tests/libtiffpic/depth/flower-rgb-planar-02.tif",
+        Some(0xcc0281ca),
+    ),
+    (
+        "tests/libtiffpic/depth/flower-rgb-planar-04.tif",
+        Some(0x867134b2),
+    ),
+    (
+        "tests/libtiffpic/depth/flower-rgb-planar-08.tif",
+        Some(0x2341af83),
+    ),
+    (
+        "tests/libtiffpic/depth/flower-rgb-planar-10.tif",
+        Some(0x79211047),
+    ),
+    (
+        "tests/libtiffpic/depth/flower-rgb-planar-12.tif",
+        Some(0x14a0ff72),
+    ),
+    (
+        "tests/libtiffpic/depth/flower-rgb-planar-14.tif",
+        Some(0xc077389d),
+    ),
+    (
+        "tests/libtiffpic/depth/flower-rgb-planar-16.tif",
+        Some(0xd0849282),
+    ),
+    (
+        "tests/libtiffpic/depth/flower-rgb-planar-24.tif",
+        Some(0x433d333b),
+    ),
+    (
+        "tests/libtiffpic/depth/flower-rgb-planar-32.tif",
+        Some(0xd0780b23),
+    ),
+    (
+        "tests/libtiffpic/depth/flower-separated-contig-08.tif",
+        Some(0x97fb03a6),
+    ),
+    (
+        "tests/libtiffpic/depth/flower-separated-contig-16.tif",
+        Some(0xb6ee0135),
+    ),
+    (
+        "tests/libtiffpic/depth/flower-separated-planar-08.tif",
+        Some(0x502e93fa),
+    ),
+    (
+        "tests/libtiffpic/depth/flower-separated-planar-16.tif",
+        Some(0x50e580d9),
+    ),
+    ("tests/libtiffpic/depth/genimages", None),
+    ("tests/libtiffpic/depth/README.txt", None),
+    ("tests/libtiffpic/depth/summary.txt", None),
+    ("tests/libtiffpic/dscf0013.tif", Some(0)), // unsupported YCbCr chroma subsampling
+    ("tests/libtiffpic/fax2d.tif", Some(0xc2f30c6f)),
+    // No support for direct CCITT Group 3 1D format
+    ("tests/libtiffpic/g3test.g3", None),
+    ("tests/libtiffpic/g3test.tif", Some(0x304b606b)),
+    ("tests/libtiffpic/jello.tif", Some(0xb03dbda9)),
+    ("tests/libtiffpic/jim___ah.tif", Some(0x81a27b7f)),
+    ("tests/libtiffpic/jim___cg.tif", Some(0xfd31747c)),
+    ("tests/libtiffpic/jim___dg.tif", Some(0x8c6a5e8f)),
+    ("tests/libtiffpic/jim___gg.tif", Some(0x8c6a5e8f)),
+    ("tests/libtiffpic/ladoga.tif", Some(0x9b118511)),
+    ("tests/libtiffpic/off_l16.tif", Some(0)), // LogLuv decoder output varies across platforms
+    ("tests/libtiffpic/off_luv24.tif", Some(0x2bee71a2)),
+    ("tests/libtiffpic/off_luv32.tif", Some(0)), // LogLuv decoder output varies across platforms
+    ("tests/libtiffpic/oxford.tif", Some(0x355d2e3e)),
+    ("tests/libtiffpic/pc260001.tif", Some(0xdb56b753)),
+    ("tests/libtiffpic/quad-jpeg.tif", Some(0xcba22475)),
+    ("tests/libtiffpic/quad-lzw.tif", Some(0x6055f9ee)), // old-style (LSB) LZW
+    ("tests/libtiffpic/quad-tile.tif", Some(0x6055f9ee)),
+    ("tests/libtiffpic/README", None),
+    ("tests/libtiffpic/smallliz.tif", Some(0)), // unsupported YCbCr chroma subsampling
+    ("tests/libtiffpic/strike.tif", Some(0x016b0f6a)),
+    ("tests/libtiffpic/text.tif", Some(0)), // unsupported compression
+    ("tests/libtiffpic/ycbcr-cat.tif", Some(0)), // unsupported YCbCr chroma subsampling
+    ("tests/libtiffpic/zackthecat.tif", Some(0)), // unsupported YCbCr chroma subsampling
+];
+
+fn main() {
+    let args: Vec<String> = std::env::args().collect();
+    if args.iter().any(|a| a == "--print-hashes") {
+        print_reference_hashes();
+        return;
+    }
+
+    let mut candidates: HashMap<_, _> = FILES.iter().copied().collect();
+    let mut trials = Vec::new();
+
+    for entry in WalkDir::new(REFERENCE_DIR) {
+        let entry = entry.unwrap();
+
+        if !entry.file_type().is_file() {
+            continue;
+        }
+
+        let Some(path) = entry.path().to_str() else {
+            continue;
+        };
+        let path = path.replace(std::path::MAIN_SEPARATOR, "/"); // always use UNIX path separators
+
+        // Mark this path as consumed in either case by removing it.
+        let Some(expected_hash) = candidates.remove(path.as_str()) else {
+            panic!("File {} not in reference list", path);
+        };
+
+        // None = non-image file, skip
+        let Some(expected_hash) = expected_hash else {
+            continue;
+        };
+
+        let path = path.to_string();
+        trials.push(Trial::test(
+            path.to_string(),
+            move || -> Result<(), Failed> { decode_and_verify(&path, expected_hash) },
+        ));
+    }
+
+    if !candidates.is_empty() {
+        for (path, _) in candidates {
+            eprintln!("Reference file {} not found in directory walk", path);
+        }
+
+        panic!("Some reference files were not found");
+    }
+
+    let args = Arguments::from_args();
+    libtest_mimic::run(&args, trials).exit();
+}
+
+/// Map DecodingResult variant to a TIFF Type for byte-order normalization.
+fn sample_type_of(result: &DecodingSampleBuffer) -> Type {
+    match result {
+        DecodingSampleBuffer::U8(_) => Type::BYTE,
+        DecodingSampleBuffer::I8(_) => Type::SBYTE,
+        DecodingSampleBuffer::U16(_) => Type::SHORT,
+        DecodingSampleBuffer::I16(_) => Type::SSHORT,
+        DecodingSampleBuffer::U32(_) => Type::LONG,
+        DecodingSampleBuffer::I32(_) => Type::SLONG,
+        DecodingSampleBuffer::F32(_) => Type::FLOAT,
+        DecodingSampleBuffer::U64(_) => Type::LONG8,
+        DecodingSampleBuffer::I64(_) => Type::SLONG8,
+        DecodingSampleBuffer::F64(_) => Type::DOUBLE,
+        DecodingSampleBuffer::F16(_) => Type::SHORT, // f16 is 2 bytes like SHORT
+    }
+}
+
+/// Hash color type into the hasher (discriminant + fields).
+fn hash_color_type(hasher: &mut crc32fast::Hasher, color_type: ColorType) {
+    match color_type {
+        ColorType::Gray(n) => hasher.update(&[0, n]),
+        ColorType::RGB(n) => hasher.update(&[1, n]),
+        ColorType::Palette(n) => hasher.update(&[2, n]),
+        ColorType::GrayA(n) => hasher.update(&[3, n]),
+        ColorType::RGBA(n) => hasher.update(&[4, n]),
+        ColorType::CMYK(n) => hasher.update(&[5, n]),
+        ColorType::CMYKA(n) => hasher.update(&[6, n]),
+        ColorType::YCbCr(n) => hasher.update(&[7, n]),
+        ColorType::Lab(n) => hasher.update(&[8, n]),
+        ColorType::Multiband {
+            bit_depth,
+            num_samples,
+        } => {
+            hasher.update(&[9, bit_depth]);
+            hasher.update(&num_samples.to_le_bytes());
+        }
+        other => panic!("compute_tiff_hash: unhandled ColorType {other:?}"),
+    }
+}
+
+/// Compute a CRC32 hash of the full decoded TIFF output using read_image_to_buffer.
+///
+/// Hashes per page: page index, dimensions, color type, TIFF sample type tag,
+/// and decoded sample data normalized to little-endian byte order.
+fn compute_hash(path: &std::path::Path) -> Result<u32, tiff::TiffError> {
+    let img_file = File::open(path)?;
+    let mut decoder = Decoder::open(img_file)?;
+    let mut hasher = crc32fast::Hasher::new();
+    let mut buffer = DecodingSampleBuffer::U8(vec![]);
+
+    let mut page = 0u32;
+    while decoder.more_images() {
+        decoder.next_image()?;
+        let (width, height) = decoder.dimensions()?;
+        let color_type = decoder.colortype()?;
+        let _layout = decoder.read_image_to_buffer(&mut buffer)?;
+
+        hasher.update(&page.to_le_bytes());
+        hasher.update(&width.to_le_bytes());
+        hasher.update(&height.to_le_bytes());
+        hash_color_type(&mut hasher, color_type);
+
+        let sample_type = sample_type_of(&buffer);
+        hasher.update(&sample_type.to_u16().to_le_bytes());
+
+        let mut buf = buffer.as_buffer(0);
+        let bytes = buf.as_bytes_mut();
+        ByteOrder::native().convert(sample_type, bytes, ByteOrder::LittleEndian);
+        hasher.update(bytes);
+
+        page += 1;
+    }
+
+    hasher.update(&page.to_le_bytes());
+    Ok(hasher.finalize())
+}
+
+fn decode_and_verify(path: &str, expected_hash: u32) -> Result<(), Failed> {
+    let full_path = path::PathBuf::from(env!("CARGO_MANIFEST_DIR")).join(path);
+
+    if expected_hash == 0 {
+        // Smoke test: try to decode, tolerate errors (unsupported formats)
+        let _ = compute_hash(&full_path);
+        return Ok(());
+    }
+
+    let actual_hash = compute_hash(&full_path)
+        .map_err(|e| Failed::from(format!("Decoding failed for {path}: {e}")))?;
+
+    if actual_hash != expected_hash {
+        return Err(Failed::from(format!(
+            "{path}: expected hash 0x{expected_hash:08x} but got 0x{actual_hash:08x}"
+        )));
+    }
+
+    Ok(())
+}
+
+/// Print reference hashes for all decodable files (use --print-hashes).
+fn print_reference_hashes() {
+    for &(path, expected) in FILES {
+        if expected.is_none() {
+            continue;
+        }
+        let full_path = path::PathBuf::from(env!("CARGO_MANIFEST_DIR")).join(path);
+        match compute_hash(&full_path) {
+            Ok(hash) => eprintln!("(\"{path}\", Some(0x{hash:08x})),"),
+            Err(e) => eprintln!("// {path}: FAILED: {e}"),
+        }
+    }
+}

tests/decode_planes.rs

@@ -1,4 +1,4 @@
-use tiff::decoder::{Decoder, DecodingResult, Limits, TiffCodingUnit};
+use tiff::decoder::{Decoder, DecodingSampleBuffer, Limits, TiffCodingUnit};
 
 use std::fs::File;
 use std::path::PathBuf;
@@ -10,8 +10,9 @@ fn read_all_planes() {
     let path = PathBuf::from(TEST_IMAGE_DIR).join("planar-rgb-u8.tif");
     let file = File::open(path).unwrap();
     let io = std::io::BufReader::new(file);
+    let mut tif = Decoder::open(io).unwrap();
 
-    let mut tif = Decoder::new(io).unwrap();
+    tif.next_image().unwrap();
     let layout = tif.image_buffer_layout().unwrap();
     assert_eq!(layout.planes, 3);
     let plane_stride = layout.plane_stride.map_or(0, |x| x.get());
@@ -36,8 +37,9 @@ fn read_first_coding_unit() {
     let path = PathBuf::from(TEST_IMAGE_DIR).join("planar-rgb-u8.tif");
     let file = File::open(path).unwrap();
     let io = std::io::BufReader::new(file);
+    let mut tif = Decoder::open(io).unwrap();
 
-    let mut tif = Decoder::new(io).unwrap();
+    tif.next_image().unwrap();
     let layout = tif.image_coding_unit_layout(TiffCodingUnit(0)).unwrap();
 
     assert_eq!(layout.planes, 3);
@@ -82,15 +84,16 @@ fn read_planes_by_limits() {
     let io = std::io::BufReader::new(file);
 
     let mut limits = Limits::default();
-    let mut buffer = DecodingResult::U8(vec![]);
+    let mut buffer = DecodingSampleBuffer::U8(vec![]);
 
     // Make room for 1 plane.
-    let mut tif = Decoder::new(io).unwrap();
+    let mut tif = Decoder::open(io).unwrap();
     tif = tif.with_limits({
         limits.decoding_buffer_size = 374 * 499;
         limits.clone()
     });
 
+    tif.next_image().unwrap();
     tif.read_image_to_buffer(&mut buffer).unwrap();
     assert_eq!(buffer.as_buffer(0).byte_len(), 374 * 499);
 

tests/encode_images.rs

@@ -1,7 +1,7 @@
 extern crate tiff;
 
-use tiff::decoder::{ifd, Decoder, DecodingResult};
-use tiff::encoder::{colortype, Ifd, Ifd8, SRational, TiffEncoder};
+use tiff::decoder::{ifd, Decoder, DecodingSampleBuffer};
+use tiff::encoder::{colortype, Ifd, Ifd8, Predictor, SRational, TiffEncoder};
 use tiff::tags::Tag;
 use tiff::ColorType;
 
@@ -33,11 +33,14 @@ fn encode_decode() {
     }
     {
         file.seek(SeekFrom::Start(0)).unwrap();
-        let mut decoder = Decoder::new(&mut file).unwrap();
+        let mut decoder = Decoder::open(&mut file).unwrap();
+        decoder.next_image().unwrap();
+
         assert_eq!(decoder.colortype().unwrap(), ColorType::RGB(8));
         assert_eq!(decoder.dimensions().unwrap(), (100, 100));
 
         let mut all_tags = decoder
+            .current_ifd()
             .tag_iter()
             .filter_map(Result::ok)
             .collect::<Vec<_>>();
@@ -78,13 +81,13 @@ fn encode_decode() {
         );
 
         assert_eq!(
-            decoder.get_tag(Tag::Artist).unwrap(),
+            decoder.current_ifd().get_tag(Tag::Artist).unwrap(),
             ifd::Value::Ascii("Image-tiff".into())
         );
 
-        let mut buffer = tiff::decoder::DecodingResult::U8(vec![]);
+        let mut buffer = tiff::decoder::DecodingSampleBuffer::U8(vec![]);
         let _layout = decoder.read_image_to_buffer(&mut buffer).unwrap();
-        if let tiff::decoder::DecodingResult::U8(img_res) = buffer {
+        if let tiff::decoder::DecodingSampleBuffer::U8(img_res) = buffer {
             assert_eq!(image_data, img_res);
         } else {
             panic!("Wrong data type");
@@ -116,11 +119,14 @@ fn encode_decode_big() {
     }
     {
         file.seek(SeekFrom::Start(0)).unwrap();
-        let mut decoder = Decoder::new(&mut file).unwrap();
+        let mut decoder = Decoder::open(&mut file).unwrap();
+        decoder.next_image().unwrap();
+
         assert_eq!(decoder.colortype().unwrap(), ColorType::RGB(8));
         assert_eq!(decoder.dimensions().unwrap(), (100, 100));
 
         let mut all_tags = decoder
+            .current_ifd()
             .tag_iter()
             .filter_map(Result::ok)
             .collect::<Vec<_>>();
@@ -161,12 +167,12 @@ fn encode_decode_big() {
         );
 
         assert_eq!(
-            decoder.get_tag(Tag::Artist).unwrap(),
+            decoder.current_ifd().get_tag(Tag::Artist).unwrap(),
             ifd::Value::Ascii("Image-tiff".into())
         );
-        let mut buffer = tiff::decoder::DecodingResult::U8(vec![]);
+        let mut buffer = tiff::decoder::DecodingSampleBuffer::U8(vec![]);
         let _layout = decoder.read_image_to_buffer(&mut buffer).unwrap();
-        if let DecodingResult::U8(img_res) = buffer {
+        if let DecodingSampleBuffer::U8(img_res) = buffer {
             assert_eq!(image_data, img_res);
         } else {
             panic!("Wrong data type");
@@ -207,8 +213,10 @@ fn test_encode_ifd() {
 
     // Rewind the cursor for reading
     data.set_position(0);
+
     {
-        let mut decoder = Decoder::new(&mut data).unwrap();
+        let mut decoder = Decoder::open(&mut data).unwrap();
+        decoder.next_image().unwrap();
 
         assert_eq!(decoder.assert_tag_u32(65000), 42);
         assert_eq!(decoder.assert_tag_u32_vec(65000), [42]);
@@ -247,14 +255,16 @@ macro_rules! test_roundtrip {
         ) {
             let path = PathBuf::from(TEST_IMAGE_DIR).join(file);
             let img_file = File::open(path).expect("Cannot find test image!");
-            let mut decoder = Decoder::new(img_file).expect("Cannot create decoder");
+            let mut decoder = Decoder::open(img_file).expect("Cannot create decoder");
+            decoder.next_image().unwrap();
+
             assert_eq!(decoder.colortype().unwrap(), expected_type);
 
-            let mut buffer = tiff::decoder::DecodingResult::U8(vec![]);
+            let mut buffer = tiff::decoder::DecodingSampleBuffer::U8(vec![]);
             decoder.read_image_to_buffer(&mut buffer).unwrap();
 
             let image_data = match buffer {
-                DecodingResult::$buffer(res) => res,
+                DecodingSampleBuffer::$buffer(res) => res,
                 _ => panic!("Wrong data type"),
             };
 
@@ -267,10 +277,11 @@ macro_rules! test_roundtrip {
             }
             file.seek(SeekFrom::Start(0)).unwrap();
             {
-                let mut buffer = tiff::decoder::DecodingResult::U8(vec![]);
-                let mut decoder = Decoder::new(&mut file).unwrap();
+                let mut buffer = tiff::decoder::DecodingSampleBuffer::U8(vec![]);
+                let mut decoder = Decoder::open(&mut file).unwrap();
+                decoder.next_image().unwrap();
                 decoder.read_image_to_buffer(&mut buffer).unwrap();
-                if let DecodingResult::$buffer(img_res) = buffer {
+                if let DecodingSampleBuffer::$buffer(img_res) = buffer {
                     assert_eq!(*image_data, img_res);
                 } else {
                     panic!("Wrong data type");
@@ -379,6 +390,144 @@ fn test_ycbcr_u8_roundtrip() {
     test_u8_roundtrip::<colortype::YCbCr8>("tiled-jpeg-ycbcr.tif", ColorType::YCbCr(8));
 }
 
+/// Test that encoding with the floating-point predictor works correctly
+/// and can be decoded back to the original data.
+#[test]
+fn test_gray_f32_floating_point_predictor() {
+    // Generate test data: a gradient of f32 values
+    let width = 32u32;
+    let height = 32u32;
+    let mut image_data: Vec<f32> = Vec::with_capacity((width * height) as usize);
+    for y in 0..height {
+        for x in 0..width {
+            // Create a gradient pattern
+            image_data.push((x as f32 + y as f32 * 0.1) / 100.0);
+        }
+    }
+
+    let mut file = Cursor::new(Vec::new());
+    {
+        let mut tiff = TiffEncoder::new(&mut file)
+            .unwrap()
+            .with_predictor(Predictor::FloatingPoint);
+        tiff.write_image::<colortype::Gray32Float>(width, height, &image_data)
+            .unwrap();
+    }
+
+    file.seek(SeekFrom::Start(0)).unwrap();
+    {
+        let mut decoder = Decoder::open(&mut file).unwrap();
+        decoder.next_image().unwrap();
+        assert_eq!(decoder.colortype().unwrap(), ColorType::Gray(32));
+
+        let mut buffer = DecodingSampleBuffer::F32(vec![]);
+        decoder.read_image_to_buffer(&mut buffer).unwrap();
+        if let DecodingSampleBuffer::F32(img_res) = buffer {
+            assert_eq!(image_data.len(), img_res.len());
+            for (orig, decoded) in image_data.iter().zip(img_res.iter()) {
+                assert_eq!(
+                    *orig, *decoded,
+                    "Mismatch at value: orig={}, decoded={}",
+                    orig, decoded
+                );
+            }
+        } else {
+            panic!("Wrong data type");
+        }
+    }
+}
+
+/// Test floating-point predictor with RGB f32 data
+#[test]
+fn test_rgb_f32_floating_point_predictor() {
+    let width = 16u32;
+    let height = 16u32;
+    let mut image_data: Vec<f32> = Vec::with_capacity((width * height * 3) as usize);
+    for y in 0..height {
+        for x in 0..width {
+            // RGB pattern
+            image_data.push(x as f32 / width as f32); // R
+            image_data.push(y as f32 / height as f32); // G
+            image_data.push((x + y) as f32 / (width + height) as f32); // B
+        }
+    }
+
+    let mut file = Cursor::new(Vec::new());
+    {
+        let mut tiff = TiffEncoder::new(&mut file)
+            .unwrap()
+            .with_predictor(Predictor::FloatingPoint);
+        tiff.write_image::<colortype::RGB32Float>(width, height, &image_data)
+            .unwrap();
+    }
+
+    file.seek(SeekFrom::Start(0)).unwrap();
+    {
+        let mut decoder = Decoder::open(&mut file).unwrap();
+        decoder.next_image().unwrap();
+        assert_eq!(decoder.colortype().unwrap(), ColorType::RGB(32));
+
+        let mut buffer = DecodingSampleBuffer::F32(vec![]);
+        decoder.read_image_to_buffer(&mut buffer).unwrap();
+        if let DecodingSampleBuffer::F32(img_res) = buffer {
+            assert_eq!(image_data.len(), img_res.len());
+            for (i, (orig, decoded)) in image_data.iter().zip(img_res.iter()).enumerate() {
+                assert_eq!(
+                    *orig, *decoded,
+                    "Mismatch at index {}: orig={}, decoded={}",
+                    i, orig, decoded
+                );
+            }
+        } else {
+            panic!("Wrong data type");
+        }
+    }
+}
+
+/// Test floating-point predictor with f64 data
+#[test]
+fn test_gray_f64_floating_point_predictor() {
+    let width = 16u32;
+    let height = 16u32;
+    let mut image_data: Vec<f64> = Vec::with_capacity((width * height) as usize);
+    for y in 0..height {
+        for x in 0..width {
+            image_data.push((x as f64 + y as f64 * 0.1) / 100.0);
+        }
+    }
+
+    let mut file = Cursor::new(Vec::new());
+    {
+        let mut tiff = TiffEncoder::new(&mut file)
+            .unwrap()
+            .with_predictor(Predictor::FloatingPoint);
+        tiff.write_image::<colortype::Gray64Float>(width, height, &image_data)
+            .unwrap();
+    }
+
+    file.seek(SeekFrom::Start(0)).unwrap();
+    {
+        let mut decoder = Decoder::open(&mut file).unwrap();
+        decoder.next_image().unwrap();
+        assert_eq!(decoder.colortype().unwrap(), ColorType::Gray(64));
+
+        let mut buffer = DecodingSampleBuffer::F64(vec![]);
+        decoder.read_image_to_buffer(&mut buffer).unwrap();
+        if let DecodingSampleBuffer::F64(img_res) = buffer {
+            assert_eq!(image_data.len(), img_res.len());
+            for (orig, decoded) in image_data.iter().zip(img_res.iter()) {
+                assert_eq!(
+                    *orig, *decoded,
+                    "Mismatch: orig={}, decoded={}",
+                    orig, decoded
+                );
+            }
+        } else {
+            panic!("Wrong data type");
+        }
+    }
+}
+
 trait AssertDecode {
     fn assert_tag_u32(&mut self, tag: u16) -> u32;
     fn assert_tag_u32_vec(&mut self, tag: u16) -> Vec<u32>;
@@ -392,37 +541,57 @@ trait AssertDecode {
 
 impl<R: std::io::Read + std::io::Seek> AssertDecode for Decoder<R> {
     fn assert_tag_u32(&mut self, tag: u16) -> u32 {
-        self.get_tag(Tag::Unknown(tag)).unwrap().into_u32().unwrap()
+        self.current_ifd()
+            .get_tag(Tag::Unknown(tag))
+            .unwrap()
+            .into_u32()
+            .unwrap()
     }
     fn assert_tag_u32_vec(&mut self, tag: u16) -> Vec<u32> {
-        self.get_tag(Tag::Unknown(tag))
+        self.current_ifd()
+            .get_tag(Tag::Unknown(tag))
             .unwrap()
             .into_u32_vec()
             .unwrap()
     }
     fn assert_tag_i32(&mut self, tag: u16) -> i32 {
-        self.get_tag(Tag::Unknown(tag)).unwrap().into_i32().unwrap()
+        self.current_ifd()
+            .get_tag(Tag::Unknown(tag))
+            .unwrap()
+            .into_i32()
+            .unwrap()
     }
     fn assert_tag_i32_vec(&mut self, tag: u16) -> Vec<i32> {
-        self.get_tag(Tag::Unknown(tag))
+        self.current_ifd()
+            .get_tag(Tag::Unknown(tag))
             .unwrap()
             .into_i32_vec()
             .unwrap()
     }
     fn assert_tag_u64(&mut self, tag: u16) -> u64 {
-        self.get_tag(Tag::Unknown(tag)).unwrap().into_u64().unwrap()
+        self.current_ifd()
+            .get_tag(Tag::Unknown(tag))
+            .unwrap()
+            .into_u64()
+            .unwrap()
     }
     fn assert_tag_u64_vec(&mut self, tag: u16) -> Vec<u64> {
-        self.get_tag(Tag::Unknown(tag))
+        self.current_ifd()
+            .get_tag(Tag::Unknown(tag))
             .unwrap()
             .into_u64_vec()
             .unwrap()
     }
     fn assert_tag_i64(&mut self, tag: u16) -> i64 {
-        self.get_tag(Tag::Unknown(tag)).unwrap().into_i64().unwrap()
+        self.current_ifd()
+            .get_tag(Tag::Unknown(tag))
+            .unwrap()
+            .into_i64()
+            .unwrap()
     }
     fn assert_tag_i64_vec(&mut self, tag: u16) -> Vec<i64> {
-        self.get_tag(Tag::Unknown(tag))
+        self.current_ifd()
+            .get_tag(Tag::Unknown(tag))
             .unwrap()
             .into_i64_vec()
             .unwrap()
@@ -456,7 +625,8 @@ fn test_multiple_byte() {
 
     data.set_position(0);
     {
-        let mut decoder = Decoder::new(&mut data).unwrap();
+        let mut decoder = Decoder::open(&mut data).unwrap();
+        decoder.next_image().unwrap();
 
         assert_eq!(decoder.assert_tag_u32_vec(65000), [1]);
         assert_eq!(decoder.assert_tag_u32_vec(65001), [1, 2]);
@@ -537,7 +707,8 @@ fn test_signed() {
     //Rewind the cursor for reading
     data.set_position(0);
     {
-        let mut decoder = Decoder::new(&mut data).unwrap();
+        let mut decoder = Decoder::open(&mut data).unwrap();
+        decoder.next_image().unwrap();
 
         assert_eq!(decoder.assert_tag_i32(65000), -1);
         assert_eq!(decoder.assert_tag_i32_vec(65001), [-1]);
@@ -589,13 +760,14 @@ fn test_multipage_image() {
     img_file.seek(SeekFrom::Start(0)).unwrap();
 
     {
-        let mut img_decoder = Decoder::new(&mut img_file).unwrap();
+        let mut decoder = Decoder::open(&mut img_file).unwrap();
+        decoder.next_image().unwrap();
 
         // check the dimensions of the image in the first page
-        assert_eq!(img_decoder.dimensions().unwrap(), (2, 2));
-        img_decoder.next_image().unwrap();
+        assert_eq!(decoder.dimensions().unwrap(), (2, 2));
+        decoder.next_image().unwrap();
         // check the dimensions of the image in the second page
-        assert_eq!(img_decoder.dimensions().unwrap(), (3, 3));
+        assert_eq!(decoder.dimensions().unwrap(), (3, 3));
     }
 }
 
@@ -624,14 +796,21 @@ fn test_rows_per_strip() {
 
     file.seek(SeekFrom::Start(0)).unwrap();
     {
-        let mut decoder = Decoder::new(&mut file).unwrap();
-        assert_eq!(decoder.get_tag_u64(Tag::RowsPerStrip).unwrap(), 2);
+        let mut decoder = Decoder::open(&mut file).unwrap();
+        decoder.next_image().unwrap();
+        assert_eq!(
+            decoder
+                .current_ifd()
+                .get_tag_u64(Tag::RowsPerStrip)
+                .unwrap(),
+            2
+        );
         assert_eq!(decoder.strip_count().unwrap(), 50);
 
         for i in 0..50 {
             let img2 = [i; 2 * 100];
             match decoder.read_chunk(i as u32).unwrap() {
-                DecodingResult::U8(data) => assert_eq!(&img2[..], &data[..]),
+                DecodingSampleBuffer::U8(data) => assert_eq!(&img2[..], &data[..]),
                 other => panic!("Incorrect strip type {other:?}"),
             }
         }
@@ -664,9 +843,10 @@ fn test_auxiliary_directory() {
     }
 
     data.set_position(0);
-    let mut decoder = Decoder::new(&mut data).unwrap();
+    let mut decoder = Decoder::open(&mut data).unwrap();
 
     {
+        decoder.next_image().unwrap();
         assert_eq!(decoder.dimensions().unwrap(), (1, 1));
         let _ = decoder.read_image().unwrap();
     }
@@ -677,6 +857,7 @@ fn test_auxiliary_directory() {
         let _ = decoder.read_image().unwrap();
 
         let exif_location = decoder
+            .current_ifd()
             .get_tag(Tag::ExifDirectory)
             .expect("second directory missing Exif")
             .into_ifd_pointer()

tests/encode_images_with_compression.rs

@@ -2,10 +2,9 @@ extern crate tiff;
 
 use std::io::{Cursor, Seek, Write};
 use tiff::{
-    decoder::{Decoder, DecodingResult},
+    decoder::{Decoder, DecodingSampleBuffer},
     encoder::{
         colortype::{self, ColorType},
-        compression::*,
         Compression, TiffEncoder, TiffValue,
     },
 };
@@ -110,12 +109,13 @@ fn encode_decode_with_compression(compression: Compression) {
     // Decode tiff
     data.set_position(0);
     {
-        let mut decoder = Decoder::new(data).unwrap();
+        let mut decoder = Decoder::open(data).unwrap();
+        decoder.next_image().unwrap();
 
         // Check the RGB image
         assert_eq!(
             match decoder.read_image() {
-                Ok(DecodingResult::U16(image_data)) => image_data,
+                Ok(DecodingSampleBuffer::U16(image_data)) => image_data,
                 unexpected => panic!("Descoding RGB failed: {unexpected:?}"),
             },
             image_rgb.reference_data()
@@ -125,7 +125,7 @@ fn encode_decode_with_compression(compression: Compression) {
         decoder.next_image().unwrap();
         assert_eq!(
             match decoder.read_image() {
-                Ok(DecodingResult::U8(image_data)) => image_data,
+                Ok(DecodingSampleBuffer::U8(image_data)) => image_data,
                 unexpected => panic!("Decoding grayscale failed: {unexpected:?}"),
             },
             image_grayscale.reference_data()
@@ -147,9 +147,9 @@ fn encode_decode_with_lzw() {
 #[test]
 #[cfg(feature = "deflate")]
 fn encode_decode_with_deflate() {
-    encode_decode_with_compression(Compression::Deflate(DeflateLevel::Fast));
-    encode_decode_with_compression(Compression::Deflate(DeflateLevel::Balanced));
-    encode_decode_with_compression(Compression::Deflate(DeflateLevel::Best));
+    encode_decode_with_compression(Compression::Deflate(1));
+    encode_decode_with_compression(Compression::Deflate(6));
+    encode_decode_with_compression(Compression::Deflate(9));
 }
 
 #[test]

tests/fuzz_tests.rs

@@ -13,7 +13,8 @@ fn test_directory<F: Fn(File) -> bool>(path: &str, f: F) {
 }
 
 fn decode_tiff(file: File) -> TiffResult<()> {
-    let mut decoder = Decoder::new(file)?;
+    let mut decoder = Decoder::open(file)?;
+    decoder.next_image()?;
     decoder.read_image()?;
     Ok(())
 }