https://github.com/ImageMagick/ImageMagick/issues/104

diff --git a/coders/xcf.c b/coders/xcf.c
index 0fdc54656184df0c73e3bc29443da8a0519a8142..b8075bb682389650c8d2677f90fff10d1f46bf2c 100644 (file)
--- a/coders/xcf.c
+++ b/coders/xcf.c
@@ -347,7 +347,8 @@ static MagickBooleanType load_tile(Image *image,Image *tile_image,
     *xcfdata,
     *xcfodata;
 
-  xcfdata=(XCFPixelInfo *) AcquireQuantumMemory(data_length,sizeof(*xcfdata));
+  xcfdata=(XCFPixelInfo *) AcquireQuantumMemory(MagickMax(data_length,
+    tile_image->columns*tile_image->rows),sizeof(*xcfdata));
   if (xcfdata == (XCFPixelInfo *) NULL)
     ThrowBinaryException(ResourceLimitError,"MemoryAllocationFailed",
       image->filename);