https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6677

diff --git a/coders/mpc.c b/coders/mpc.c
index f497af9e9ba141d43fc7dd6390b698f2fac243d9..ee95e6f84c30eab147729b840827410aed9f1ca4 100644 (file)
--- a/coders/mpc.c
+++ b/coders/mpc.c
@@ -781,8 +781,11 @@ static Image *ReadMPCImage(const ImageInfo *image_info,ExceptionInfo *exception)
     */
     if ((LocaleCompare(id,"MagickCache") != 0) ||
         (image->storage_class == UndefinedClass) ||
-        (image->compression == UndefinedCompression) || (image->columns == 0) ||
-        (image->rows == 0))
+        (image->compression == UndefinedCompression) ||
+        (image->columns == 0) || (image->rows == 0) ||
+        (image->number_channels > MaxPixelChannels) ||
+        (image->number_meta_channels > MaxPixelChannels) ||
+        ((image->number_channels+image->number_meta_channels) >= MaxPixelChannels))
       {
         if (profiles != (LinkedListInfo *) NULL)
           profiles=DestroyLinkedList(profiles,RelinquishMagickMemory);