https://github.com/ImageMagick/ImageMagick/issues/1472

diff --git a/coders/cin.c b/coders/cin.c
index 6b9b4e50b124963a6154a4335b1b24e81c146f5e..72d6138fd9ead14dff09ffbdc954b3b66e4efd26 100644 (file)
--- a/coders/cin.c
+++ b/coders/cin.c
@@ -726,6 +726,8 @@ static Image *ReadCINImage(const ImageInfo *image_info,ExceptionInfo *exception)
       (void) CloseBlob(image);
       return(image);
     }
+  if (((MagickSizeType) image->columns*image->rows) > GetBlobSize(image))
+    ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
   for ( ; offset < (MagickOffsetType) cin.file.image_offset; offset++)
   {
     int