https://github.com/ImageMagick/ImageMagick/issues/1602

diff --git a/coders/tiff.c b/coders/tiff.c
index 7efbb970b55f86c4c3de17cc5c1bf1bf3497e33c..97402f2cb37c11e280b248d9f5096d7b4ee0375d 100644 (file)
--- a/coders/tiff.c
+++ b/coders/tiff.c
@@ -258,6 +258,12 @@ static MagickOffsetType TIFFSeekCustomStream(const MagickOffsetType offset,
     }
     case SEEK_CUR:
     {
+      if (((offset > 0) && (profile->offset > (SSIZE_MAX-offset))) ||
+          ((offset < 0) && (profile->offset < (-SSIZE_MAX-offset))))
+        {
+          errno=EOVERFLOW;
+          return(-1);
+        }
       if ((profile->offset+offset) < 0)
         return(-1);
       profile->offset+=offset;