https://github.com/ImageMagick/ImageMagick/issues/679

diff --git a/coders/xcf.c b/coders/xcf.c
index 8f7a67e1f0ac1072e7219639e23406f609dcce5f..7645b06363b677ba64e50694d4071c4da1bc3f0d 100644 (file)
--- a/coders/xcf.c
+++ b/coders/xcf.c
@@ -648,6 +648,9 @@ static MagickBooleanType load_level(Image *image,XCFDocInfo *inDocInfo,
     if (offset2 == 0)
       offset2=(MagickOffsetType) (offset + TILE_WIDTH * TILE_WIDTH * 4* 1.5);
     /* seek to the tile offset */
+    if (offset2 > GetBlobSize(image))
+      ThrowBinaryException(CorruptImageError,"InsufficientImageDataInFile",
+        image->filename);
     if (SeekBlob(image, offset, SEEK_SET) != offset)
       ThrowBinaryException(CorruptImageError,"InsufficientImageDataInFile",
         image->filename);