https://github.com/ImageMagick/ImageMagick/issues/998

diff --git a/coders/webp.c b/coders/webp.c
index 17e071b1240c06a15aafa1871b58ed29788dab18..fffccd77e937bc66df903de5b869cb38cb777e66 100644 (file)
--- a/coders/webp.c
+++ b/coders/webp.c
@@ -187,7 +187,7 @@ static MagickBooleanType IsWEBPImageLossless(const unsigned char *stream,
     Read extended header.
   */
   offset=RIFF_HEADER_SIZE+TAG_SIZE+CHUNK_SIZE_BYTES+VP8X_CHUNK_SIZE;
-  while (offset <= (ssize_t) length)
+  while (offset <= (ssize_t) (length-TAG_SIZE))
   {
     uint32_t
       chunk_size,