From: Cristy <urban-warrior@imagemagick.org>
Date: Sat, 16 Jun 2018 20:39:08 +0000 (-0400)
Subject: ...
X-Git-Tag: 7.0.8-1~1
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=94cb08785ca93986dca34a19c5ac95ddb96d53ef;p=imagemagick

...
---

diff --git a/coders/tiff.c b/coders/tiff.c
index e6af9d425..51f5f2b9e 100644
--- a/coders/tiff.c
+++ b/coders/tiff.c
@@ -1764,6 +1764,8 @@ RestoreMSCWarning
       method=ReadTileMethod;
     quantum_info->endian=LSBEndian;
     quantum_type=RGBQuantum;
+    if (TIFFScanlineSize(tiff) <= 0)
+      ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed");
     if (((MagickSizeType) TIFFScanlineSize(tiff)) > GetBlobSize(image))
       ThrowTIFFException(CorruptImageError,"InsufficientImageDataInFile");
     number_pixels=MagickMax(TIFFScanlineSize(tiff),MagickMax((ssize_t) 
@@ -2961,6 +2963,11 @@ static MagickBooleanType GetTIFFInfo(const ImageInfo *image_info,
   (void) TIFFSetField(tiff,TIFFTAG_TILELENGTH,tile_rows);
   tiff_info->tile_geometry.width=tile_columns;
   tiff_info->tile_geometry.height=tile_rows;
+  if ((TIFFScanlineSize(tiff) <= 0) || (TIFFTileSize(tiff) <= 0))
+    {
+      DestroyTIFFInfo(tiff_info);
+      return(MagickFalse);
+    }
   tiff_info->scanlines=(unsigned char *) AcquireQuantumMemory((size_t)
     tile_rows*TIFFScanlineSize(tiff),sizeof(*tiff_info->scanlines));
   tiff_info->pixels=(unsigned char *) AcquireQuantumMemory((size_t)