https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6269

diff --git a/coders/dcm.c b/coders/dcm.c
index 3e8fd15dcc79fb18d9f76f03f2458104aca0f29e..a1a0a89534c541ee9ae5d0aa8a087114be5d6e22 100644 (file)
--- a/coders/dcm.c
+++ b/coders/dcm.c
@@ -3816,7 +3816,8 @@ static Image *ReadDCMImage(const ImageInfo *image_info,ExceptionInfo *exception)
         unsigned int
           tag;
 
-        tag=(ReadBlobLSBShort(image) << 16) | ReadBlobLSBShort(image);
+        tag=((unsigned int) ReadBlobLSBShort(image) << 16) |
+          ReadBlobLSBShort(image);
         length=(size_t) ReadBlobLSBLong(image);
         if (tag == 0xFFFEE0DD)
           break; /* sequence delimiter tag */
@@ -3911,7 +3912,8 @@ static Image *ReadDCMImage(const ImageInfo *image_info,ExceptionInfo *exception)
         if (c == EOF)
           break;
       }
-      tag=(ReadBlobLSBShort(image) << 16) | ReadBlobLSBShort(image);
+      tag=((unsigned int) ReadBlobLSBShort(image) << 16) |
+        ReadBlobLSBShort(image);
       (void) tag;
       length=(size_t) ReadBlobLSBLong(image);
       if (length > GetBlobSize(image))
@@ -4016,7 +4018,8 @@ static Image *ReadDCMImage(const ImageInfo *image_info,ExceptionInfo *exception)
           if (c == EOF)
             break;
         }
-        tag=(ReadBlobLSBShort(image) << 16) | ReadBlobLSBShort(image);
+        tag=((unsigned int) ReadBlobLSBShort(image) << 16) |
+          ReadBlobLSBShort(image);
         stream_info->remaining=(size_t) ReadBlobLSBLong(image);
         if ((tag != 0xFFFEE000) || (stream_info->remaining <= 64) ||
             (EOFBlob(image) != MagickFalse))