https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5858

diff --git a/coders/sixel.c b/coders/sixel.c
index 5f0f8072695fb0d83849e9c05ead99990d238669..0e7b7298319a21947b535e0045cf2ab9a03b8827 100644 (file)
--- a/coders/sixel.c
+++ b/coders/sixel.c
@@ -336,8 +336,8 @@ MagickBooleanType sixel_decode(unsigned char              /* in */  *p,
                     if (param[2] == 0) {
                         param[2] = 10;
                     }
-                    attributed_pan = attributed_pan * param[2] / 10;
-                    attributed_pad = attributed_pad * param[2] / 10;
+                    attributed_pan = (int) ((ssize_t) attributed_pan * param[2]) / 10;
+                    attributed_pad = (int) ((ssize_t) attributed_pad * param[2]) / 10;
                     if (attributed_pan <= 0) attributed_pan = 1;
                     if (attributed_pad <= 0) attributed_pad = 1;
                 }