https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7106

diff --git a/coders/tiff.c b/coders/tiff.c
index b1508e7bfb55011dc9f3d6257f699a5a25123c8a..a9068011249d789984c4c8b0ca20a9fdc1b5ef15 100644 (file)
--- a/coders/tiff.c
+++ b/coders/tiff.c
@@ -1729,6 +1729,8 @@ RestoreMSCWarning
           (unsigned int) rows_per_strip);
         (void) SetImageProperty(image,"tiff:rows-per-strip",value,exception);
       }
+    if (rows_per_strip > (image->columns*image->rows))
+      ThrowTIFFException(CorruptImageError,"ImproperImageHeader");
     if ((samples_per_pixel >= 3) && (interlace == PLANARCONFIG_CONTIG))
       if ((image->alpha_trait == UndefinedPixelTrait) ||
           (samples_per_pixel >= 4))