https://github.com/ImageMagick/ImageMagick/issues/654

diff --git a/coders/wpg.c b/coders/wpg.c
index ae43f9cc364dcfdeae2b91dd17f872ad50dad965..4756dba3f4cc417c2fa3b3f6517110a9be6ffb4d 100644 (file)
--- a/coders/wpg.c
+++ b/coders/wpg.c
@@ -1035,6 +1035,8 @@ static Image *ReadWPGImage(const ImageInfo *image_info,
           if(i==EOF)
             break;
           Rd_WP_DWORD(image,&Rec.RecordLength);
+          if (Rec.RecordLength > GetBlobSize(image))
+            ThrowReaderException(CorruptImageError,"ImproperImageHeader");
           if(EOFBlob(image))
             break;