heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell)

ImageMagick · Jul 26, 2021 · 35b88c9 · 35b88c9
1 parent e1fbcdf
commit 35b88c9
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/coders/tiff.c b/coders/tiff.c
@@ -1894,9 +1894,9 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
           ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed");
         extent=TIFFTileSize(tiff);
 #if defined(TIFF_VERSION_BIG)
-        extent+=columns*sizeof(uint64);
+        extent=MagickMax(rows*columns*sizeof(uint64),extent);
 #else
-        extent+=columns*sizeof(uint32);
+        extent=MagickMax(rows*columns*sizeof(uint32),extent);
 #endif
         tile_pixels=(unsigned char *) AcquireQuantumMemory(extent,
           sizeof(*tile_pixels));