https://github.com/ImageMagick/ImageMagick/issues/1178

diff --git a/coders/dib.c b/coders/dib.c
index f6399bf2095a4b4fcc6530536ec88b9860bd4f82..6b2ecc0616112d13580e7d975326452b0bd9bb9b 100644 (file)
--- a/coders/dib.c
+++ b/coders/dib.c
@@ -663,8 +663,8 @@ static Image *ReadDIBImage(const ImageInfo *image_info,ExceptionInfo *exception)
     dib_info.bits_per_pixel<<=1;
   bytes_per_line=4*((image->columns*dib_info.bits_per_pixel+31)/32);
   length=bytes_per_line*image->rows;
-  pixel_info=AcquireVirtualMemory((size_t) image->rows,MagickMax(
-    bytes_per_line,image->columns+256UL)*sizeof(*pixels));
+  pixel_info=AcquireVirtualMemory(image->rows,MagickMax(bytes_per_line,
+    image->columns+256UL)*sizeof(*pixels));
   if (pixel_info == (MemoryInfo *) NULL)
     ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
   pixels=(unsigned char *) GetVirtualMemoryBlob(pixel_info);
@@ -1178,8 +1178,8 @@ static MagickBooleanType WriteDIBImage(const ImageInfo *image_info,Image *image,
   /*
     Convert MIFF to DIB raster pixels.
   */
-  pixels=(unsigned char *) AcquireQuantumMemory(dib_info.image_size,
-    sizeof(*pixels));
+  pixels=(unsigned char *) AcquireQuantumMemory(image->rows,MagickMax(
+    bytes_per_line,image->columns+256UL)*sizeof(*pixels));
   if (pixels == (unsigned char *) NULL)
     ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
   (void) memset(pixels,0,dib_info.image_size);