https://mail.google.com/mail/#inbox/1618795878d3300a

diff --git a/coders/viff.c b/coders/viff.c
index 4cbf264c8920c3795a9a4246497c5ce4ddebcbe3..93854fad7335e1834e6b379314da270fb20e54fe 100644 (file)
--- a/coders/viff.c
+++ b/coders/viff.c
@@ -414,7 +414,7 @@ static Image *ReadVIFFImage(const ImageInfo *image_info,
           default: bytes_per_pixel=1; break;
         }
         image->colors=viff_info.map_columns;
-        if ((MagickSizeType) image->colors > GetBlobSize(image))
+        if ((MagickSizeType) (viff_info.map_rows*image->colors) > GetBlobSize(image))
           ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
         if (AcquireImageColormap(image,image->colors,exception) == MagickFalse)
           ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");