Fix for erroneous encoded ccitt lines

The ccitt tiff is missing a terminating huffman code on a line end. The following EOL is misinterpreted and the codestream read till an ArrayIndexOutOfBoundsException occurs.
Now reading the line is aborted as soon as an EOL is found.

imageio/imageio-tiff/src/main/java/com/twelvemonkeys/imageio/plugins/tiff/CCITTFaxDecoderStream.java

@@ -355,11 +355,14 @@ final class CCITTFaxDecoderStream extends FilterInputStream {
 
             if (n.isLeaf) {
                 total += n.value;
-                if (n.value < 64) {
+                if (n.value >= 64) {
+                    n = tree.root;
+                }
+                else if (n.value >= 0) {
                     return total;
                 }
                 else {
-                    n = tree.root;
+                    return columns;
                 }
             }
         }

imageio/imageio-tiff/src/test/java/com/twelvemonkeys/imageio/plugins/tiff/CCITTFaxDecoderStreamTest.java

@@ -261,4 +261,24 @@ public class CCITTFaxDecoderStreamTest {
         byte decoded = (byte) inputStream.read();
         assertEquals((byte) 0b10101010, decoded);
     }
+
+    @Test
+    public void testG3AOE() throws IOException {
+        InputStream inputStream = getClass().getResourceAsStream("/tiff/ccitt/g3aoe.tif");
+
+        // Skip until StripOffsets: 8
+        for (int i = 0; i < 8; i++) {
+            inputStream.read();
+        }
+
+        // Read until StripByteCounts: 20050
+        byte[] data = new byte[20050];
+        new DataInputStream(inputStream).readFully(data);
+
+        InputStream stream = new CCITTFaxDecoderStream(new ByteArrayInputStream(data),
+                1728, TIFFExtension.COMPRESSION_CCITT_T4, 1, TIFFExtension.GROUP3OPT_FILLBITS);
+
+        byte[] bytes = new byte[216 * 1168]; // 1728 x 1168 pixel, 1 bpp => 216 bytes * 1168
+        new DataInputStream(stream).readFully(bytes);
+    }
 }