Added extra check for the number of elements

Credit to OSS-Fuzz

diff --git a/coders/dpx.c b/coders/dpx.c
index bc021bad73db896562156bd701c020ccf8a243b5..6c73c3d4a2525a5246eddcf6d7563f44615c1ea9 100644 (file)
--- a/coders/dpx.c
+++ b/coders/dpx.c
@@ -803,7 +803,8 @@ static Image *ReadDPXImage(const ImageInfo *image_info,ExceptionInfo *exception)
     case 7: image->orientation=RightBottomOrientation; break;
   }
   dpx.image.number_elements=ReadBlobShort(image);
-  if (dpx.image.number_elements > MaxNumberImageElements)
+  if ((dpx.image.number_elements < 1) ||
+      (dpx.image.number_elements > MaxNumberImageElements))
     ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   offset+=2;
   dpx.image.pixels_per_line=ReadBlobLong(image);