From 94cb08785ca93986dca34a19c5ac95ddb96d53ef Mon Sep 17 00:00:00 2001 From: Cristy Date: Sat, 16 Jun 2018 16:39:08 -0400 Subject: [PATCH] ... --- coders/tiff.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/coders/tiff.c b/coders/tiff.c index e6af9d425..51f5f2b9e 100644 --- a/coders/tiff.c +++ b/coders/tiff.c @@ -1764,6 +1764,8 @@ RestoreMSCWarning method=ReadTileMethod; quantum_info->endian=LSBEndian; quantum_type=RGBQuantum; + if (TIFFScanlineSize(tiff) <= 0) + ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed"); if (((MagickSizeType) TIFFScanlineSize(tiff)) > GetBlobSize(image)) ThrowTIFFException(CorruptImageError,"InsufficientImageDataInFile"); number_pixels=MagickMax(TIFFScanlineSize(tiff),MagickMax((ssize_t) @@ -2961,6 +2963,11 @@ static MagickBooleanType GetTIFFInfo(const ImageInfo *image_info, (void) TIFFSetField(tiff,TIFFTAG_TILELENGTH,tile_rows); tiff_info->tile_geometry.width=tile_columns; tiff_info->tile_geometry.height=tile_rows; + if ((TIFFScanlineSize(tiff) <= 0) || (TIFFTileSize(tiff) <= 0)) + { + DestroyTIFFInfo(tiff_info); + return(MagickFalse); + } tiff_info->scanlines=(unsigned char *) AcquireQuantumMemory((size_t) tile_rows*TIFFScanlineSize(tiff),sizeof(*tiff_info->scanlines)); tiff_info->pixels=(unsigned char *) AcquireQuantumMemory((size_t) -- 2.40.0