https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6077

diff --git a/coders/viff.c b/coders/viff.c
index 34d7d2b7477599faa18fac8b8be584b843a88de6..4cbf264c8920c3795a9a4246497c5ce4ddebcbe3 100644 (file)
--- a/coders/viff.c
+++ b/coders/viff.c
@@ -418,6 +418,8 @@ static Image *ReadVIFFImage(const ImageInfo *image_info,
           ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
         if (AcquireImageColormap(image,image->colors,exception) == MagickFalse)
           ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+        if ((MagickSizeType) viff_info.map_rows > GetBlobSize(image))
+          ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
         if ((MagickSizeType) viff_info.map_rows >
             (viff_info.map_rows*bytes_per_pixel*sizeof(*viff_colormap)))
           ThrowReaderException(CorruptImageError,"ImproperImageHeader");