Index: GraphicsMagick-1.2.5/coders/tiff.c
===================================================================
--- GraphicsMagick-1.2.5.orig/coders/tiff.c	2018-01-30 11:47:22.693437977 +0100
+++ GraphicsMagick-1.2.5/coders/tiff.c	2018-01-30 11:49:23.007419277 +0100
@@ -1283,6 +1283,10 @@ static Image *ReadTIFFImage(const ImageI
   TIFF
     *tiff;
 
+  magick_off_t
+    file_size,
+    max_compress_ratio=70; /* Maximum compression ratio */
+
   uint16
     compress_tag,
     bits_per_sample,
@@ -1335,6 +1339,7 @@ static Image *ReadTIFFImage(const ImageI
   status=OpenBlob(image_info,image,ReadBinaryBlobMode,exception);
   if (status == MagickFail)
     ThrowReaderException(FileOpenError,UnableToOpenFile,image);
+  file_size = GetBlobSize(image);
   (void) MagickTsdSetSpecific(tsd_key,(void *) exception);
   (void) TIFFSetErrorHandler((TIFFErrorHandler) TIFFErrors);
   (void) TIFFSetWarningHandler((TIFFErrorHandler) TIFFWarnings);
@@ -1839,6 +1844,20 @@ static Image *ReadTIFFImage(const ImageI
                 break;
               }
 
+            /*
+              Rationalize memory request based on file size
+            */
+            if (scanline_size > file_size*max_compress_ratio)
+              {
+                (void) LogMagickEvent(CoderEvent,GetMagickModule(),
+                                      "Unreasonable allocation size "
+                                      "(ratio of alloc to file size %g)",
+                                      (double) scanline_size/file_size);
+                TIFFClose(tiff);
+                ThrowReaderException(CorruptImageError,InsufficientImageDataInFile,
+                                     image);
+              }
+
             scanline=MagickAllocateMemory(unsigned char *,(size_t) scanline_size);
             if (scanline == (unsigned char *) NULL)
               {
@@ -1983,6 +2002,20 @@ static Image *ReadTIFFImage(const ImageI
                 break;
               }
 
+            /*
+              Rationalize memory request based on file size
+            */
+            if (strip_size_max > file_size*max_compress_ratio)
+              {
+                (void) LogMagickEvent(CoderEvent,GetMagickModule(),
+                                      "Unreasonable allocation size "
+                                      "(ratio of alloc to file size %g)",
+                                      (double) strip_size_max/file_size);
+                TIFFClose(tiff);
+                ThrowReaderException(CorruptImageError,InsufficientImageDataInFile,
+                                     image);
+              }
+
             strip=MagickAllocateMemory(unsigned char *,(size_t) strip_size_max);
             if (strip == (unsigned char *) NULL)
               {
@@ -2137,7 +2170,7 @@ static Image *ReadTIFFImage(const ImageI
             QuantumType
               quantum_type;
 
-            unsigned long
+            size_t
               tile_total_pixels;
         
             if (logging)
@@ -2167,15 +2200,33 @@ static Image *ReadTIFFImage(const ImageI
             /*
               Compute the total number of pixels in one tile
             */
-            tile_total_pixels=tile_columns*tile_rows;
+            tile_total_pixels=MagickArraySize(tile_columns,tile_rows);
             if (logging)
               {
                 (void) LogMagickEvent(CoderEvent,GetMagickModule(),
-                                      "TIFF tile geometry %ux%u, %lu pixels",
+                                      "TIFF tile geometry %ux%u, "
+                                      "%lu pixels"
+                                      " (%lu bytes max)",
                                       (unsigned int)tile_columns,
                                       (unsigned int)tile_rows,
-                                      tile_total_pixels);
+                                      tile_total_pixels,
+                                      tile_size_max);
               }
+
+            /*
+              Rationalize memory request based on file size
+            */
+            if (tile_size_max > file_size*max_compress_ratio)
+              {
+                (void) LogMagickEvent(CoderEvent,GetMagickModule(),
+                                      "Unreasonable allocation size "
+                                      "(ratio of alloc to file size %g)",
+                                      (double) tile_size_max/file_size);
+                TIFFClose(tiff);
+                ThrowReaderException(CorruptImageError,InsufficientImageDataInFile,
+                                     image);
+              }
+
             /*
               Allocate tile buffer
             */
@@ -2356,6 +2407,20 @@ static Image *ReadTIFFImage(const ImageI
                 ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,
                                      image);
               }
+            /*
+              Rationalize memory request based on file size
+            */
+            if ((magick_off_t) (number_pixels*sizeof(uint32)) >
+                file_size*max_compress_ratio)
+              {
+                (void) LogMagickEvent(CoderEvent,GetMagickModule(),
+                                      "Unreasonable allocation size "
+                                      "(ratio of alloc to file size %g)",
+                                      (double) (number_pixels*sizeof(uint32))/file_size);
+                TIFFClose(tiff);
+                ThrowReaderException(CorruptImageError,InsufficientImageDataInFile,
+                                     image);
+              }
             strip_pixels=MagickAllocateMemory(uint32 *, MagickArraySize(number_pixels,sizeof(uint32)));
             if (strip_pixels == (uint32 *) NULL)
               {
