https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5364

diff --git a/coders/icon.c b/coders/icon.c
index 084f952c886926d8238019dd3a199e73d3e82e8a..71f1a4cd912ad276bf5df20dd7559834d3cce776 100644 (file)
--- a/coders/icon.c
+++ b/coders/icon.c
@@ -398,6 +398,8 @@ static Image *ReadICONImage(const ImageInfo *image_info,
         icon_info.x_pixels=ReadBlobLSBLong(image);
         icon_info.y_pixels=ReadBlobLSBLong(image);
         icon_info.number_colors=ReadBlobLSBLong(image);
+        if (icon_info.number_colors > GetBlobSize(image))
+          ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
         icon_info.colors_important=ReadBlobLSBLong(image);
         image->alpha_trait=BlendPixelTrait;
         image->columns=(size_t) icon_file.directory[i].width;