https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7313

diff --git a/coders/heic.c b/coders/heic.c
index 82bc3b2ff6bf0e2d6394b29edb937df853738ef3..e4eb8af48763f0bbd290cc3a4f39247ba2cc5dc0 100644 (file)
--- a/coders/heic.c
+++ b/coders/heic.c
@@ -412,7 +412,7 @@ static MagickBooleanType ParseIpcoAtom(Image *image, DataBuffer *db,
       ThrowAndReturn("insufficient data");
     if (prop->data != (uint8_t *) NULL)
       prop->data=(uint8_t *) RelinquishMagickMemory(prop->data);
-    prop->data = (uint8_t *) AcquireCriticalMemory(prop->size);
+    prop->data = (uint8_t *) AcquireCriticalMemory(prop->size+4);
     if (DBChop(&propDb, db, prop->size) != MagickTrue) {
       ThrowAndReturn("incorrect read size");
     }