From 635ce8f8837aecdbd86fb315dd9b2c7fa72353c9 Mon Sep 17 00:00:00 2001
From: Dirk Lemstra <dirk@git.imagemagick.org>
Date: Fri, 6 Apr 2018 22:07:14 +0200
Subject: [PATCH] Added early exit
 (https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7023)

---
 coders/mat.c | 26 +++++++++++++++++---------
 1 file changed, 17 insertions(+), 9 deletions(-)

diff --git a/coders/mat.c b/coders/mat.c
index ac7497e09..1cbb59696 100644
--- a/coders/mat.c
+++ b/coders/mat.c
@@ -1028,15 +1028,23 @@ MATLAB_KO:
              ThrowReaderException(CoderError,
                "MultidimensionalMatricesAreNotSupported");
            }
-         Frames = ReadBlobXXXLong(image2);
-         if (Frames == 0)
-           {
-             if (clone_info != (ImageInfo *) NULL)
-               clone_info=DestroyImageInfo(clone_info);
-             if ((image != image2) && (image2 != (Image *) NULL))
-               image2=DestroyImage(image2);
-             ThrowReaderException(CorruptImageError,"ImproperImageHeader");
-           }
+          Frames = ReadBlobXXXLong(image2);
+          if (Frames == 0)
+            {
+              if (clone_info != (ImageInfo *) NULL)
+                clone_info=DestroyImageInfo(clone_info);
+              if ((image != image2) && (image2 != (Image *) NULL))
+                image2=DestroyImage(image2);
+              ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+            }
+          if (AcquireMagickResource(ListLengthResource,Frames) == MagickFalse)
+            {
+              if (clone_info != (ImageInfo *) NULL)
+                clone_info=DestroyImageInfo(clone_info);
+              if ((image != image2) && (image2 != (Image *) NULL))
+                image2=DestroyImage(image2);
+              ThrowReaderException(ResourceLimitError,"ListLengthExceedsLimit");
+            }
          break;
       default:
         if (clone_info != (ImageInfo *) NULL)
-- 
2.40.0