diff --git a/src/decoder/image.rs b/src/decoder/image.rs
index 59c7521..1b51b51 100644
--- a/src/decoder/image.rs
+++ b/src/decoder/image.rs
@@ -454,8 +454,9 @@ impl Image {
             match tag_reader.find_tag(Tag::ColorMap)? {
                 Some(v) => {
                     let map = v.into_u16_vec()?;
-                    let expected_len = 3usize
-                        .checked_mul(1usize << bits_per_sample)
+                    let expected_len = 1usize
+                        .checked_shl(bits_per_sample as u32)
+                        .and_then(|n| n.checked_mul(3))
                         .ok_or(TiffError::LimitsExceeded)?;
                     if map.len() != expected_len {
                         return Err(TiffError::FormatError(
diff --git a/tests/fuzz_images/oor_panic/colormap-shl-overflow.tiff b/tests/fuzz_images/oor_panic/colormap-shl-overflow.tiff
new file mode 100644
index 0000000..d2905df
Binary files /dev/null and b/tests/fuzz_images/oor_panic/colormap-shl-overflow.tiff differ