No space to read TIFF directory

I am getting this error when trying to convert a pbm to pdf using Fax
compression:

; convert -compress Fax pbm.pbm pbm.pdf
/var/tmp/magick-u6Rx2MCh: No space to read TIFF directory.
/var/tmp/magick-FsJldk07: No space to read TIFF directory.
convert: unable to open file `pbm.pdf': No such file or directory @ compress.c/Huffman2DEncodeImage/1000.

And no, I don't think I am really running out of space, since I the
image I am trying to convert is very small:

; identify pbm.pbm
pbm.pbm PNM 550x359 550x359+0+0 1-bit Bilevel DirectClass 24.2kb

and I have very generous process limits. Besides, I can successfully
convert much larger images using different compressions, just not Fax
or Group4.

After poking around a bit in the source, I think the problem may lie
in libtiff, so perhaps I am at the wrong mailing list. But I am far
from sure about this.

Version info first: This is ImageMagick 6.5.1-1 2009-04-12 Q16
http://www.imagemagick.org, on FreeBSD 7.2-PRERELEASE and tifflib
3.8.2. Oh, and the machine and OS are 64 bits, if it matters. Also,
this may not matter at all, but I am using zfs on the machine. And
with zfs, stat()ing a file that has just been written may produce a
too small file size.

I managed to get this backtrace from TIFFErrorExt:

#0  0x0000000800f634e0 in TIFFErrorExt () from /usr/local/lib/libtiff.so.4
#1  0x0000000800f588b1 in _TIFFCheckMalloc () from /usr/local/lib/libtiff.so.4
#2  0x0000000800f5fdc3 in TIFFReadDirectory () from /usr/local/lib/libtiff.so.4
#3  0x0000000800f78f4e in TIFFClientOpen () from /usr/local/lib/libtiff.so.4
#4  0x0000000800f81b09 in TIFFFdOpen () from /usr/local/lib/libtiff.so.4
#5  0x0000000800f81b79 in TIFFOpen () from /usr/local/lib/libtiff.so.4
#6  0x00000008006c5857 in Huffman2DEncodeImage ()
   from /usr/local/lib/libMagickCore.so.2
#7  0x0000000800839061 in RegisterPDFImage ()
   from /usr/local/lib/libMagickCore.so.2
#8  0x00000008006c9022 in WriteImage () from /usr/local/lib/libMagickCore.so.2
#9  0x00000008006c94af in WriteImages () from /usr/local/lib/libMagickCore.so.2
#10 0x0000000800b46534 in ConvertImageCommand ()
   from /usr/local/lib/libMagickWand.so.2

But I couldn't examine local variables since that information seems to
be stripped out of the libraries.

Now, at this point I could look at the temporary tiff file in /var/tmp
and see that it was corrupt. Even more interestingly, trying to open
this corrupt tiff file using any ImageMagick program or xv (which also
uses tifflib) produces the "No space to read TIFF directory"
message. Opening other tiff files goes just fine. So I speculate that
the bug lies in the writing of this temporary tiff file, not in its
reading (and that the error message is actually a red herring).

- Harald