https://github.com/ImageMagick/ImageMagick/issues/868

diff --git a/coders/pcx.c b/coders/pcx.c
index 22edbce16ed138654cba4363e9990d3505b0a6dd..888054940c9a5c57b1664285c4978c637e7ab807 100644 (file)
--- a/coders/pcx.c
+++ b/coders/pcx.c
@@ -399,6 +399,8 @@ static Image *ReadPCXImage(const ImageInfo *image_info,ExceptionInfo *exception)
     pcx_packets=(size_t) image->rows*pcx_info.bytes_per_line;
     if (HeapOverflowSanityCheck(pcx_packets, (size_t) pcx_info.planes) != MagickFalse)
       ThrowPCXException(CorruptImageError,"ImproperImageHeader");
+    if ((pcx_packets/8) > GetBlobSize(image))
+      ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
     pcx_packets=(size_t) pcx_packets*pcx_info.planes;
     if ((size_t) (pcx_info.bits_per_pixel*pcx_info.planes*image->columns) >
         (pcx_packets*8U))