From: Cristy <urban-warrior@imagemagick.org>
Date: Sat, 3 Mar 2018 00:53:45 +0000 (-0500)
Subject: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6677
X-Git-Tag: 7.0.7-25~21
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=8aec657c0e0977b00ace2ad11c642f9a780fa6c5;p=imagemagick

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6677
---

diff --git a/coders/mpc.c b/coders/mpc.c
index f497af9e9..ee95e6f84 100644
--- a/coders/mpc.c
+++ b/coders/mpc.c
@@ -781,8 +781,11 @@ static Image *ReadMPCImage(const ImageInfo *image_info,ExceptionInfo *exception)
     */
     if ((LocaleCompare(id,"MagickCache") != 0) ||
         (image->storage_class == UndefinedClass) ||
-        (image->compression == UndefinedCompression) || (image->columns == 0) ||
-        (image->rows == 0))
+        (image->compression == UndefinedCompression) ||
+        (image->columns == 0) || (image->rows == 0) ||
+        (image->number_channels > MaxPixelChannels) ||
+        (image->number_meta_channels > MaxPixelChannels) ||
+        ((image->number_channels+image->number_meta_channels) >= MaxPixelChannels))
       {
         if (profiles != (LinkedListInfo *) NULL)
           profiles=DestroyLinkedList(profiles,RelinquishMagickMemory);