https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6628

diff --git a/coders/miff.c b/coders/miff.c
index 456bdb7e46de98a23491bfb9902ad7e77b231c93..c79e2b657782f0c6f74fb5a47260b9ec0f85f0f9 100644 (file)
--- a/coders/miff.c
+++ b/coders/miff.c
@@ -1180,6 +1180,8 @@ static Image *ReadMIFFImage(const ImageInfo *image_info,
           Create image colormap.
         */
         packet_size=(size_t) (3UL*image->depth/8UL);
+        if ((MagickSizeType) colors > GetBlobSize(image))
+          ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
         if (((MagickSizeType) packet_size*colors) > GetBlobSize(image))
           ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
         status=AcquireImageColormap(image,colors != 0 ? colors : 256,exception);