https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7111

diff --git a/coders/tiff.c b/coders/tiff.c
index a9068011249d789984c4c8b0ca20a9fdc1b5ef15..72ea083132ddd19ab75d8d3d2ccdb20d88e693c3 100644 (file)
--- a/coders/tiff.c
+++ b/coders/tiff.c
@@ -1765,7 +1765,7 @@ RestoreMSCWarning
     tiff_pixels=(unsigned char *) AcquireMagickMemory(MagickMax(
       TIFFScanlineSize(tiff),MagickMax((ssize_t) image->columns*
       samples_per_pixel*pow(2.0,ceil(log(bits_per_sample)/log(2.0))),
-      rows_per_strip)*sizeof(uint32)));
+      image->columns*rows_per_strip)*sizeof(uint32)));
     if (tiff_pixels == (unsigned char *) NULL)
       ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed");
     switch (method)