https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11614

diff --git a/coders/cube.c b/coders/cube.c
index 26eefa90abb5b6504d3828eb3c262c704d2aaf51..12ace853a8e244ebe319382e84995be12f3bd5b0 100644 (file)
--- a/coders/cube.c
+++ b/coders/cube.c
@@ -161,7 +161,7 @@ static Image *ReadCUBEImage(const ImageInfo *image_info,
     if (LocaleCompare(token,"LUT_1D_SIZE") == 0)
       {
         red_columns=(ssize_t) StringToLong(value);
-        if (red_columns > 65535)
+        if ((red_columns < 0) || (red_columns > 65535))
           {
             cube_buffer=DestroyString(cube_buffer);
             ThrowReaderException(CorruptImageError,"ImproperImageHeader");
@@ -172,7 +172,7 @@ static Image *ReadCUBEImage(const ImageInfo *image_info,
     if (LocaleCompare(token,"LUT_3D_SIZE") == 0)
       {
         red_columns=(ssize_t) StringToLong(value);
-        if (red_columns > 256)
+        if ((red_columns < 0) || (red_columns > 256))
           {
             cube_buffer=DestroyString(cube_buffer);
             ThrowReaderException(CorruptImageError,"ImproperImageHeader");