https://github.com/ImageMagick/ImageMagick/issues/301

diff --git a/coders/sgi.c b/coders/sgi.c
index 6b0e9eb5a83bfbc6d6d826feddb582b732f89bf7..a0eebe97df822f4255b3778cb85654a0d95ff346 100644 (file)
--- a/coders/sgi.c
+++ b/coders/sgi.c
@@ -332,6 +332,8 @@ static Image *ReadSGIImage(const ImageInfo *image_info,ExceptionInfo *exception)
     if ((iris_info.bytes_per_pixel == 0) || (iris_info.bytes_per_pixel > 2))
       ThrowReaderException(CorruptImageError,"ImproperImageHeader");
     iris_info.dimension=ReadBlobMSBShort(image);
+    if ((iris_info.dimension == 0) || (iris_info.dimension > 3)) 
+      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
     iris_info.columns=ReadBlobMSBShort(image);
     iris_info.rows=ReadBlobMSBShort(image);
     iris_info.depth=ReadBlobMSBShort(image);