#1268 Fix submitted. Ben and Robin both discovered and fixed this independantly with the same fix!

src/image.cpp

@@ -398,7 +398,7 @@ namespace Exiv2 {
                 }
 
                 // if ( offset > io.size() ) offset = 0; // Denial of service?
-                DataBuf  buf(size*count + pad);  // allocate a buffer
+                DataBuf  buf(size*count + pad+20);  // allocate a buffer
                 std::memcpy(buf.pData_,dir.pData_+8,4);  // copy dir[8:11] into buffer (short strings)
                 if ( count*size > 4 ) {            // read into buffer
                     size_t   restore = io.tell();  // save