https://github.com/ImageMagick/ImageMagick/issues/1269

diff --git a/coders/dcm.c b/coders/dcm.c
index d44cf80d0a715b72c6c3f1220bc66be556cc53b2..49a058a2d4d09462ff37d86341d6dee7cacd17fa 100644 (file)
--- a/coders/dcm.c
+++ b/coders/dcm.c
@@ -3853,6 +3853,8 @@ static Image *ReadDCMImage(const ImageInfo *image_info,ExceptionInfo *exception)
           tag=((unsigned int) ReadBlobLSBShort(image) << 16) |
             ReadBlobLSBShort(image);
           length=(size_t) ReadBlobLSBLong(image);
+          if (length > (size_t) GetBlobSize(image))
+            ThrowDCMException(CorruptImageError,"InsufficientImageDataInFile");
           if (tag == 0xFFFEE0DD)
             break; /* sequence delimiter tag */
           if (tag != 0xFFFEE000)