https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5680

diff --git a/coders/wpg.c b/coders/wpg.c
index 1c2788382b5d27979ab9ee94ddf885b62849c144..5d634decce83bdf59a3e9e0d655c8f88bd5087dc 100644 (file)
--- a/coders/wpg.c
+++ b/coders/wpg.c
@@ -1169,6 +1169,9 @@ static Image *ReadWPGImage(const ImageInfo *image_info,
               if ((image->storage_class != PseudoClass) && (bpp < 24))
                 {
                   image->colors=one << bpp;
+                  if (image->colors > GetBlobSize(image))
+                    ThrowReaderException(CorruptImageError,
+                      "InsufficientImageDataInFile");
                   if (!AcquireImageColormap(image,image->colors,exception))
                     {
                     NoMemory: