https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5819

diff --git a/coders/viff.c b/coders/viff.c
index b7f54e415219e29ece93e786bef20cf12e03c4e4..7f3c96886c8e1ccac02295a07a0041c99ac1fb6e 100644 (file)
--- a/coders/viff.c
+++ b/coders/viff.c
@@ -412,6 +412,8 @@ static Image *ReadVIFFImage(const ImageInfo *image_info,
           default: bytes_per_pixel=1; break;
         }
         image->colors=viff_info.map_columns;
+        if (image->colors > GetBlobSize(image))
+          ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
         if (AcquireImageColormap(image,image->colors,exception) == MagickFalse)
           ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
         if (viff_info.map_rows >