diff --git a/CHANGELOG.md b/CHANGELOG.md
index 286b7836..9ee46a87 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -20,6 +20,10 @@
 ### Deprecated
 ### Removed
 ### Fixed
+
+* Crash when overwriting a sixel and the row being overwritten did not
+  cover an entire cell.
+
 ### Security
 
 
diff --git a/sixel.c b/sixel.c
index 7dab1fcc..d45bc916 100644
--- a/sixel.c
+++ b/sixel.c
@@ -272,7 +272,7 @@ sixel_overwrite(struct terminal *term, struct sixel *six,
                 (six->pos.row + rel_above) & (term->grid->num_rows - 1)},
         };
         imgs[2].data = malloc(imgs[2].width * imgs[2].height * sizeof(uint32_t));
-        for (size_t i = 0; i < term->cell_height; i++)
+        for (size_t i = 0; i < imgs[2].height; i++)
             memcpy(
                 &((uint32_t *)imgs[2].data)[i * imgs[2].width],
                 &((const uint32_t *)six->data)[(rel_above * term->cell_height + i) * six->width],
@@ -290,7 +290,7 @@ sixel_overwrite(struct terminal *term, struct sixel *six,
                 (six->pos.row + rel_above) & (term->grid->num_rows - 1)},
         };
         imgs[3].data = malloc(imgs[3].width * imgs[3].height * sizeof(uint32_t));
-        for (size_t i = 0; i < term->cell_height; i++)
+        for (size_t i = 0; i < imgs[3].height; i++)
             memcpy(
                 &((uint32_t *)imgs[3].data)[i * imgs[3].width],
                 &((const uint32_t *)six->data)[(rel_above * term->cell_height + i) * six->width + rel_right * term->cell_width],