https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5556

diff --git a/coders/dcm.c b/coders/dcm.c
index a4a1372b6d06b950adb6164e15be42923c226592..6189798502d125a84d6aab09168d8f80e3b0f5c2 100644 (file)
--- a/coders/dcm.c
+++ b/coders/dcm.c
@@ -3914,6 +3914,8 @@ static Image *ReadDCMImage(const ImageInfo *image_info,ExceptionInfo *exception)
       tag=(ReadBlobLSBShort(image) << 16) | ReadBlobLSBShort(image);
       (void) tag;
       length=(size_t) ReadBlobLSBLong(image);
+      if (length > GetBlobSize(image))
+        ThrowDCMException(CorruptImageError,"InsufficientImageDataInFile");
       stream_info->offset_count=length >> 2;
       if (stream_info->offset_count != 0)
         {