https://github.com/ImageMagick/ImageMagick/issues/545

diff --git a/coders/miff.c b/coders/miff.c
index 7a0cdc7f24f98189351e23fe002dfa45a7bd44b1..6bac4b054c958f7051cda7b6edd8e83fd08266ea 100644 (file)
--- a/coders/miff.c
+++ b/coders/miff.c
@@ -1158,6 +1158,8 @@ static Image *ReadMIFFImage(const ImageInfo *image_info,
         /*
           Create image colormap.
         */
+        if ((colors*image->depth/8) > GetBlobSize(image))
+          ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
         status=AcquireImageColormap(image,colors != 0 ? colors : 256,exception);
         if (status == MagickFalse)
           ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");