https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9109

diff --git a/MagickCore/blob.c b/MagickCore/blob.c
index f5caebe512a43248cdb61d9976af924ca8e3767d..8a6b1632e9f858f3aac77ea5a403a00117bf1b12 100644 (file)
--- a/MagickCore/blob.c
+++ b/MagickCore/blob.c
@@ -1358,6 +1358,9 @@ MagickExport void *FileToBlob(const char *filename,const size_t extent,
   int
     file;
 
+  MagickBooleanType
+    status;
+
   MagickOffsetType
     offset;
 
@@ -1367,6 +1370,9 @@ MagickExport void *FileToBlob(const char *filename,const size_t extent,
   ssize_t
     count;
 
+  struct stat
+    attributes;
+
   unsigned char
     *blob;
 
@@ -1377,6 +1383,12 @@ MagickExport void *FileToBlob(const char *filename,const size_t extent,
   (void) LogMagickEvent(TraceEvent,GetMagickModule(),"%s",filename);
   assert(exception != (ExceptionInfo *) NULL);
   *length=0;
+  status=GetPathAttributes(filename,&attributes);
+  if ((status == MagickFalse) || (S_ISDIR(attributes.st_mode) != 0))
+    {
+      ThrowFileException(exception,BlobError,"UnableToReadBlob",filename);
+      return(NULL);
+    }
   file=fileno(stdin);
   if (LocaleCompare(filename,"-") != 0)
     file=open_utf8(filename,O_RDONLY | O_BINARY,0);