From: Dirk Lemstra <dirk@git.imagemagick.org>
Date: Fri, 6 Apr 2018 20:07:14 +0000 (+0200)
Subject: Added early exit (https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7023)
X-Git-Tag: 7.0.7-29~182
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=635ce8f8837aecdbd86fb315dd9b2c7fa72353c9;p=imagemagick

Added early exit (https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7023)
---

diff --git a/coders/mat.c b/coders/mat.c
index ac7497e09..1cbb59696 100644
--- a/coders/mat.c
+++ b/coders/mat.c
@@ -1028,15 +1028,23 @@ MATLAB_KO:
              ThrowReaderException(CoderError,
                "MultidimensionalMatricesAreNotSupported");
            }
-         Frames = ReadBlobXXXLong(image2);
-         if (Frames == 0)
-           {
-             if (clone_info != (ImageInfo *) NULL)
-               clone_info=DestroyImageInfo(clone_info);
-             if ((image != image2) && (image2 != (Image *) NULL))
-               image2=DestroyImage(image2);
-             ThrowReaderException(CorruptImageError,"ImproperImageHeader");
-           }
+          Frames = ReadBlobXXXLong(image2);
+          if (Frames == 0)
+            {
+              if (clone_info != (ImageInfo *) NULL)
+                clone_info=DestroyImageInfo(clone_info);
+              if ((image != image2) && (image2 != (Image *) NULL))
+                image2=DestroyImage(image2);
+              ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+            }
+          if (AcquireMagickResource(ListLengthResource,Frames) == MagickFalse)
+            {
+              if (clone_info != (ImageInfo *) NULL)
+                clone_info=DestroyImageInfo(clone_info);
+              if ((image != image2) && (image2 != (Image *) NULL))
+                image2=DestroyImage(image2);
+              ThrowReaderException(ResourceLimitError,"ListLengthExceedsLimit");
+            }
          break;
       default:
         if (clone_info != (ImageInfo *) NULL)