...

diff --git a/coders/sun.c b/coders/sun.c
index 701cc5f4c1078ce560e20542404b6a8bf1bb986b..b485f74ed06d76f22966d09e54fa8c1f0440e282 100644 (file)
--- a/coders/sun.c
+++ b/coders/sun.c
@@ -435,6 +435,8 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
     if (HeapOverflowSanityCheck(sun_info.width,sun_info.depth) != MagickFalse)
       ThrowReaderException(CorruptImageError,"ImproperImageHeader");
     bytes_per_line=sun_info.width*sun_info.depth;
+    if (sun_info.length > GetBlobSize(image))
+      ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
     sun_data=(unsigned char *) AcquireQuantumMemory(sun_info.length,
       sizeof(*sun_data));
     if (sun_data == (unsigned char *) NULL)