https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6880

diff --git a/coders/wpg.c b/coders/wpg.c
index d179f7e49c9a5486ecb5d0dc64d6a986cc14042a..44749f9457699695bd976df7f46b3b9064d83d62 100644 (file)
--- a/coders/wpg.c
+++ b/coders/wpg.c
@@ -1329,6 +1329,8 @@ static Image *ReadWPGImage(const ImageInfo *image_info,
               if ((WPG_Palette.NumOfEntries-WPG_Palette.StartIndex) >
                   (Rec2.RecordLength-2-2) / 3)
                 ThrowReaderException(CorruptImageError,"InvalidColormapIndex");
+              if (WPG_Palette.StartIndex >= WPG_Palette.NumOfEntries)
+                ThrowReaderException(CorruptImageError,"InvalidColormapIndex");
               image->colors=WPG_Palette.NumOfEntries;
               if (AcquireImageColormap(image,image->colors,exception) == MagickFalse)
                 ThrowReaderException(ResourceLimitError,