https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5924

diff --git a/coders/dcm.c b/coders/dcm.c
index 2e339fc9b8a897791139d2f76690b4eddd1cf45d..cc211c5250d897c4f8c534f5072ae7e26ae89893 100644 (file)
--- a/coders/dcm.c
+++ b/coders/dcm.c
@@ -3557,10 +3557,12 @@ static Image *ReadDCMImage(const ImageInfo *image_info,ExceptionInfo *exception)
             datum=(int) colors;
             if (graymap != (int *) NULL)
               graymap=(int *) RelinquishMagickMemory(graymap);
-            graymap=(int *) AcquireQuantumMemory((size_t) colors,
+            graymap=(int *) AcquireQuantumMemory(MagickMax(colors,65536),
               sizeof(*graymap));
             if (graymap == (int *) NULL)
               ThrowDCMException(ResourceLimitError,"MemoryAllocationFailed");
+            (void) ResetMagickMemory(graymap,0,MagickMax(colors,65536)*
+              sizeof(*graymap));
             for (i=0; i < (ssize_t) colors; i++)
               if (info.bytes_per_pixel == 1)
                 graymap[i]=(int) data[i];
@@ -3582,10 +3584,12 @@ static Image *ReadDCMImage(const ImageInfo *image_info,ExceptionInfo *exception)
             datum=(int) colors;
             if (redmap != (int *) NULL)
               redmap=(int *) RelinquishMagickMemory(redmap);
-            redmap=(int *) AcquireQuantumMemory((size_t) colors,
+            redmap=(int *) AcquireQuantumMemory(MagickMax(colors,65536),
               sizeof(*redmap));
             if (redmap == (int *) NULL)
               ThrowDCMException(ResourceLimitError,"MemoryAllocationFailed");
+            (void) ResetMagickMemory(redmap,0,MagickMax(colors,65536)*
+              sizeof(*redmap));
             p=data;
             for (i=0; i < (ssize_t) colors; i++)
             {
@@ -3612,10 +3616,12 @@ static Image *ReadDCMImage(const ImageInfo *image_info,ExceptionInfo *exception)
             datum=(int) colors;
             if (greenmap != (int *) NULL)
               greenmap=(int *) RelinquishMagickMemory(greenmap);
-            greenmap=(int *) AcquireQuantumMemory((size_t) colors,
+            greenmap=(int *) AcquireQuantumMemory(MagickMax(colors,65536),
               sizeof(*greenmap));
             if (greenmap == (int *) NULL)
               ThrowDCMException(ResourceLimitError,"MemoryAllocationFailed");
+            (void) ResetMagickMemory(greenmap,0,MagickMax(colors,65536)*
+              sizeof(*greenmap));
             p=data;
             for (i=0; i < (ssize_t) colors; i++)
             {
@@ -3642,10 +3648,12 @@ static Image *ReadDCMImage(const ImageInfo *image_info,ExceptionInfo *exception)
             datum=(int) colors;
             if (bluemap != (int *) NULL)
               bluemap=(int *) RelinquishMagickMemory(bluemap);
-            bluemap=(int *) AcquireQuantumMemory((size_t) colors,
+            bluemap=(int *) AcquireQuantumMemory(MagickMax(colors,65536),
               sizeof(*bluemap));
             if (bluemap == (int *) NULL)
               ThrowDCMException(ResourceLimitError,"MemoryAllocationFailed");
+            (void) ResetMagickMemory(bluemap,0,MagickMax(colors,65536)*
+              sizeof(*bluemap));
             p=data;
             for (i=0; i < (ssize_t) colors; i++)
             {