https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6535

diff --git a/coders/dcm.c b/coders/dcm.c
index 1f66bba6684d525fe09d55edf99a1e138c06aad9..00d7304854161ba0be292979df513884a7ccb101 100644 (file)
--- a/coders/dcm.c
+++ b/coders/dcm.c
@@ -3972,7 +3972,7 @@ static Image *ReadDCMImage(const ImageInfo *image_info,ExceptionInfo *exception)
           for (i=0; i < (ssize_t) colors; i++)
           {
             index=redmap[i];
-            if ((info.scale != (Quantum *) NULL) &&
+            if ((info.scale != (Quantum *) NULL) && (index >= 0) &&
                 (index <= (int) info.max_value))
               index=(int) info.scale[index];
             image->colormap[i].red=(MagickRealType) index;
@@ -3981,7 +3981,7 @@ static Image *ReadDCMImage(const ImageInfo *image_info,ExceptionInfo *exception)
           for (i=0; i < (ssize_t) colors; i++)
           {
             index=greenmap[i];
-            if ((info.scale != (Quantum *) NULL) &&
+            if ((info.scale != (Quantum *) NULL) && (index >= 0) &&
                 (index <= (int) info.max_value))
               index=(int) info.scale[index];
             image->colormap[i].green=(MagickRealType) index;
@@ -3990,7 +3990,7 @@ static Image *ReadDCMImage(const ImageInfo *image_info,ExceptionInfo *exception)
           for (i=0; i < (ssize_t) colors; i++)
           {
             index=bluemap[i];
-            if ((info.scale != (Quantum *) NULL) &&
+            if ((info.scale != (Quantum *) NULL) && (index >= 0) &&
                 (index <= (int) info.max_value))
               index=(int) info.scale[index];
             image->colormap[i].blue=(MagickRealType) index;
@@ -3999,7 +3999,7 @@ static Image *ReadDCMImage(const ImageInfo *image_info,ExceptionInfo *exception)
           for (i=0; i < (ssize_t) colors; i++)
           {
             index=graymap[i];
-            if ((info.scale != (Quantum *) NULL) &&
+            if ((info.scale != (Quantum *) NULL) && (index >= 0) &&
                 (index <= (int) info.max_value))
               index=(int) info.scale[index];
             image->colormap[i].red=(MagickRealType) index;