https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6874

diff --git a/coders/rle.c b/coders/rle.c
index 54a3421910646b8e81d3c61184913c32f2080ce2..03258073b425e664aeab922c898357d0fbcccee6 100644 (file)
--- a/coders/rle.c
+++ b/coders/rle.c
@@ -315,8 +315,11 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
             if (comment == (char *) NULL)
               ThrowRLEException(ResourceLimitError,"MemoryAllocationFailed");
             count=ReadBlob(image,length-1,(unsigned char *) comment);
-            comment[length-1]='\0';
-            (void) SetImageProperty(image,"comment",comment,exception);
+            if (count == (length-1))
+              {
+                comment[length-1]='\0';
+                (void) SetImageProperty(image,"comment",comment,exception);
+              }
             comment=DestroyString(comment);
             if ((length & 0x01) == 0)
               (void) ReadBlobByte(image);