From eb6f00e059ba657811f224367c22e593d9589035 Mon Sep 17 00:00:00 2001 From: Dirk Lemstra Date: Sat, 13 Jan 2018 01:00:40 +0100 Subject: [PATCH] Added extra check for the number of elements Credit to OSS-Fuzz --- coders/dpx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/coders/dpx.c b/coders/dpx.c index bc021bad7..6c73c3d4a 100644 --- a/coders/dpx.c +++ b/coders/dpx.c @@ -803,7 +803,8 @@ static Image *ReadDPXImage(const ImageInfo *image_info,ExceptionInfo *exception) case 7: image->orientation=RightBottomOrientation; break; } dpx.image.number_elements=ReadBlobShort(image); - if (dpx.image.number_elements > MaxNumberImageElements) + if ((dpx.image.number_elements < 1) || + (dpx.image.number_elements > MaxNumberImageElements)) ThrowReaderException(CorruptImageError,"ImproperImageHeader"); offset+=2; dpx.image.pixels_per_line=ReadBlobLong(image); -- 2.40.0