...

diff --git a/coders/tga.c b/coders/tga.c
index 886150e0243a6d4843883e92f6eb00ecb66e2ca7..da22c712dbf6ef998aaefa053ddd7a4a5fb76106 100644 (file)
--- a/coders/tga.c
+++ b/coders/tga.c
@@ -271,6 +271,8 @@ static Image *ReadTGAImage(const ImageInfo *image_info,
 
           one=1;
           image->colors=one << tga_info.bits_per_pixel;
+          if (image->colors > ((~0UL)/sizeof(*image->colormap)))
+            ThrowReaderException(CorruptImageError,"ImproperImageHeader");
           if (AcquireImageColormap(image,image->colors,exception) == MagickFalse)
             ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
         }