Added early exit (https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7023)

diff --git a/coders/mat.c b/coders/mat.c
index ac7497e09ac67a7259cf1ddf7ab7fd3d17a94bbd..1cbb59696e77da43eb85e6c19a27610b9e350c0d 100644 (file)
--- a/coders/mat.c
+++ b/coders/mat.c
@@ -1028,15 +1028,23 @@ MATLAB_KO:
              ThrowReaderException(CoderError,
                "MultidimensionalMatricesAreNotSupported");
            }
-         Frames = ReadBlobXXXLong(image2);
-         if (Frames == 0)
-           {
-             if (clone_info != (ImageInfo *) NULL)
-               clone_info=DestroyImageInfo(clone_info);
-             if ((image != image2) && (image2 != (Image *) NULL))
-               image2=DestroyImage(image2);
-             ThrowReaderException(CorruptImageError,"ImproperImageHeader");
-           }
+          Frames = ReadBlobXXXLong(image2);
+          if (Frames == 0)
+            {
+              if (clone_info != (ImageInfo *) NULL)
+                clone_info=DestroyImageInfo(clone_info);
+              if ((image != image2) && (image2 != (Image *) NULL))
+                image2=DestroyImage(image2);
+              ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+            }
+          if (AcquireMagickResource(ListLengthResource,Frames) == MagickFalse)
+            {
+              if (clone_info != (ImageInfo *) NULL)
+                clone_info=DestroyImageInfo(clone_info);
+              if ((image != image2) && (image2 != (Image *) NULL))
+                image2=DestroyImage(image2);
+              ThrowReaderException(ResourceLimitError,"ListLengthExceedsLimit");
+            }
          break;
       default:
         if (clone_info != (ImageInfo *) NULL)