https://github.com/ImageMagick/ImageMagick/issues/85

diff --git a/coders/wpg.c b/coders/wpg.c
index 6fbfe42664b1e97dc80ec71860f0c0c3fa3cf6e7..33c8b25a9117ba7c1d27ea3d7f6fecd23fa23be1 100644 (file)
--- a/coders/wpg.c
+++ b/coders/wpg.c
@@ -1050,7 +1050,9 @@ static Image *ReadWPGImage(const ImageInfo *image_info,
               WPG_Palette.StartIndex=ReadBlobLSBShort(image);
               WPG_Palette.NumOfEntries=ReadBlobLSBShort(image);
               if ((WPG_Palette.NumOfEntries-WPG_Palette.StartIndex) >
-                  (Rec2.RecordLength-2-2) / 3)
+                  (Rec2.RecordLength-2-2)/3)
+                ThrowReaderException(CorruptImageError,"InvalidColormapIndex");
+              if (WPG_Palette.StartIndex > WPG_Palette.NumOfEntries)
                 ThrowReaderException(CorruptImageError,"InvalidColormapIndex");
               image->colors=WPG_Palette.NumOfEntries;
               if (!AcquireImageColormap(image,image->colors,exception))