https://github.com/ImageMagick/ImageMagick/issues/1857

ImageMagick · Mar 2, 2020 · b466a96 · b466a96
1 parent f7d9c71
commit b466a96
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 0 deletions.
diff --git a/ChangeLog b/ChangeLog
@@ -4,6 +4,8 @@
 2020-03-01  6.9.11-0 Cristy  <quetzlzacatenango@image...>
   * Label text no longer gets cut-off (reference
     https://imagemagick.org/discourse-server/viewtopic.php?f=1&t=37621).
+  * Prevent heap overflow (reference
+    https://github.com/ImageMagick/ImageMagick/issues/1857).
 
 2020-02-29  6.9.10-97 Cristy  <quetzlzacatenango@image...>
   * Release ImageMagick version 6.9.10-97, GIT revision 15453:0537c847b:20200229

diff --git a/coders/tiff.c b/coders/tiff.c
@@ -1834,6 +1834,8 @@ RestoreMSCWarning
           Convert stripped TIFF image.
         */
         extent=TIFFStripSize(tiff)+sizeof(uint32);
+        if (photometric == PHOTOMETRIC_YCBCR)
+          extent<<=1;
         strip_pixels=(unsigned char *) AcquireQuantumMemory(extent,
           sizeof(*strip_pixels));
         if (strip_pixels == (unsigned char *) NULL)