https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6900

diff --git a/coders/wpg.c b/coders/wpg.c
index 44749f9457699695bd976df7f46b3b9064d83d62..8b7b090392a2bfbaf016010220be0c503381444e 100644 (file)
--- a/coders/wpg.c
+++ b/coders/wpg.c
@@ -478,8 +478,10 @@ static int UnpackWPGRaster(Image *image,int bpp,ExceptionInfo *exception)
           {
             for(i=0;i < (int) RunCount;i++)
               {
-                bbuf=ReadBlobByte(image);
-                InsertByte(bbuf);
+                c=ReadBlobByte(image);
+                if (c < 0)
+                  break;
+                InsertByte(c);
               }
           }
         else {  /* repeat previous line runcount* */