https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6105

diff --git a/coders/icon.c b/coders/icon.c
index 71f1a4cd912ad276bf5df20dd7559834d3cce776..2a5d20462dcdccfac3f9b510ede383f2b7511b25 100644 (file)
--- a/coders/icon.c
+++ b/coders/icon.c
@@ -450,6 +450,9 @@ static Image *ReadICONImage(const ImageInfo *image_info,
           /*
             Read Icon raster colormap.
           */
+          if (image->colors > GetBlobSize(image))
+            ThrowReaderException(CorruptImageError,
+              "InsufficientImageDataInFile");
           if (AcquireImageColormap(image,image->colors,exception) ==
               MagickFalse)
             ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");