https://github.com/ImageMagick/ImageMagick/issues/523

diff --git a/coders/dpx.c b/coders/dpx.c
index cb9870dade4692af11a50ce098fd8eb90ce0e1d7..0d569497226636b5bb68287753b84dd80c86cb27 100644 (file)
--- a/coders/dpx.c
+++ b/coders/dpx.c
@@ -1106,6 +1106,8 @@ static Image *ReadDPXImage(const ImageInfo *image_info,ExceptionInfo *exception)
           StringInfo
             *profile;
 
+           if (dpx.file.user_size > GetBlobSize(image))
+             ThrowReaderException(CorruptImageError,"ImproperImageHeader");
            profile=BlobToStringInfo((const unsigned char *) NULL,
              dpx.file.user_size-sizeof(dpx.user.id));
            if (profile == (StringInfo *) NULL)