https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7176

diff --git a/coders/heic.c b/coders/heic.c
index e926cfbe8e5129cb032dd5d05b89d66f826cb8ee..fd30d1c6cafe124d0c6b6a0d0a041e94c613d90d 100644 (file)
--- a/coders/heic.c
+++ b/coders/heic.c
@@ -495,9 +495,9 @@ static MagickBooleanType ParseInfeAtom(Image *image, DataBuffer *db,
   /*
      item indicies starts from 1
   */
-  if (id > (ssize_t) ctx->idsCount) {
+  if ((id > (ssize_t) ctx->idsCount) ||
+      (ctx->itemInfo == (HEICItemInfo *) NULL))
     ThrowAndReturn("item id is incorrect");
-  }
 
   ctx->itemInfo[id].type = type;
 
@@ -533,9 +533,9 @@ static MagickBooleanType ParseIpmaAtom(Image *image, DataBuffer *db,
     /*
        item indicies starts from 1
        */
-    if (id > (ssize_t) ctx->idsCount) {
+    if ((id > (ssize_t) ctx->idsCount) ||
+        (ctx->itemInfo == (HEICItemInfo *) NULL))
       ThrowAndReturn("item id is incorrect");
-    }
 
     assoc_count = DBReadUChar(db);
 
@@ -594,9 +594,9 @@ static MagickBooleanType ParseIlocAtom(Image *image, DataBuffer *db,
     /*
        item indicies starts from 1
     */
-    if (id > (ssize_t) ctx->idsCount) {
+    if ((id > (ssize_t) ctx->idsCount) ||
+        (ctx->itemInfo == (HEICItemInfo *) NULL))
       ThrowAndReturn("item id is incorrect");
-    }
 
     item = &ctx->itemInfo[id];