...

diff --git a/coders/tiff.c b/coders/tiff.c
index 6335f5ac0371ee41d47f4fb8b41ec35fd05aa61e..d051e1e666555a57f3122797b2617730cbd47b73 100644 (file)
--- a/coders/tiff.c
+++ b/coders/tiff.c
@@ -1887,9 +1887,6 @@ RestoreMSCWarning
           columns,
           rows;
 
-        size_t
-          number_pixels;
-
         /*
           Convert tiled TIFF image to DirectClass MIFF image.
         */
@@ -1900,9 +1897,15 @@ RestoreMSCWarning
             ThrowReaderException(CoderError,"ImageIsNotTiled");
           }
         (void) SetImageStorageClass(image,DirectClass,exception);
-        number_pixels=columns*rows;
-        tile_pixels=(uint32 *) AcquireQuantumMemory(number_pixels,
-          sizeof(*tile_pixels));
+        number_pixels=(MagickSizeType) columns*rows;
+        if ((number_pixels*sizeof(uint32)) != (MagickSizeType) ((size_t)
+            (number_pixels*sizeof(uint32))))
+          {
+            TIFFClose(tiff);
+            ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+          }
+        tile_pixels=(uint32 *) AcquireQuantumMemory(columns,
+          rows*sizeof(*tile_pixels));
         if (tile_pixels == (uint32 *) NULL)
           {
             TIFFClose(tiff);