diff --git a/ChangeLog b/ChangeLog
index 9c0ab29c..db4ea186 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,10 +1,18 @@
+2016-08-15 Even Rouault <even.rouault at spatialys.com>
+
+	* libtiff/tif_pixarlog.c: Fix write buffer overflow in PixarLogEncode
+	if more input samples are provided than expected by PixarLogSetupEncode.
+	Idea based on libtiff-CVE-2016-3990.patch from
+	libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro, but with different and
+	simpler check. (bugzilla #2544)
+
 2016-08-15 Even Rouault <even.rouault at spatialys.com>
 
 	* tools/tiff2rgba.c: Fix integer overflow in size of allocated
 	buffer, when -b mode is enabled, that could result in out-of-bounds
 	write. Based initially on patch tiff-CVE-2016-3945.patch from
 	libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro, with correction for
-	invalid tests that rejected valid files.
+	invalid tests that rejected valid files. (bugzilla #2545)
 
 2016-07-11 Even Rouault <even.rouault at spatialys.com>
 
diff --git a/libtiff/tif_pixarlog.c b/libtiff/tif_pixarlog.c
index 9bffccfb..47df14ce 100644
--- a/libtiff/tif_pixarlog.c
+++ b/libtiff/tif_pixarlog.c
@@ -1,4 +1,4 @@
-/* $Id: tif_pixarlog.c,v 1.45 2016-06-28 15:37:33 erouault Exp $ */
+/* $Id: tif_pixarlog.c,v 1.46 2016-08-15 20:49:48 erouault Exp $ */
 
 /*
  * Copyright (c) 1996-1997 Sam Leffler
@@ -1141,6 +1141,13 @@ PixarLogEncode(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
 	}
 
 	llen = sp->stride * td->td_imagewidth;
+    /* Check against the number of elements (of size uint16) of sp->tbuf */
+    if( n > td->td_rowsperstrip * llen )
+    {
+        TIFFErrorExt(tif->tif_clientdata, module,
+                     "Too many input bytes provided");
+        return 0;
+    }
 
 	for (i = 0, up = sp->tbuf; i < n; i += llen, up += llen) {
 		switch (sp->user_datafmt)  {