Eliminate out-of-memory for DDS coder

Credit Fuzz OSS

diff --git a/coders/dds.c b/coders/dds.c
index b82e5f119b74a652d1b27d0caf9ae7906e24cdd4..92e3a80d01ca84181a5f267b9e824efb634e7887 100644 (file)
--- a/coders/dds.c
+++ b/coders/dds.c
@@ -1792,7 +1792,7 @@ static Image *ReadDDSImage(const ImageInfo *image_info,ExceptionInfo *exception)
   if (volume)
     num_images = dds_info.depth;
 
-  if (num_images < 1)
+  if ((num_images == 0) || (num_images > GetBlobSize(image)))
     ThrowReaderException(CorruptImageError,"ImproperImageHeader");
 
   option=GetImageOption(image_info,"dds:skip-mipmaps");