https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9435

diff --git a/coders/dcm.c b/coders/dcm.c
index 4878fa13a39ff5413088e22010939167697e28b5..8a431c73c325315b9c3abff7d611c9157fff656a 100644 (file)
--- a/coders/dcm.c
+++ b/coders/dcm.c
@@ -3943,11 +3943,11 @@ static Image *ReadDCMImage(const ImageInfo *image_info,ExceptionInfo *exception)
           ThrowDCMException(CorruptImageError,"InsufficientImageDataInFile");
         if (info.scale != (Quantum *) NULL)
           info.scale=(Quantum *) RelinquishMagickMemory(info.scale);
-        info.scale=(Quantum *) AcquireQuantumMemory(MagickMax(length,256),
+        info.scale=(Quantum *) AcquireQuantumMemory(MagickMax(length,MaxMap)+1,
           sizeof(*info.scale));
         if (info.scale == (Quantum *) NULL)
           ThrowDCMException(ResourceLimitError,"MemoryAllocationFailed");
-        (void) memset(info.scale,0,MagickMax(length,256)*
+        (void) memset(info.scale,0,(MagickMax(length,MaxMap)+1)*
           sizeof(*info.scale));
         range=GetQuantumRange(info.depth);
         for (i=0; i <= (ssize_t) GetQuantumRange(info.depth); i++)