commit eb6f00e059ba657811f224367c22e593d9589035
author Dirk Lemstra <dirk@git.imagemagick.org> Sat Jan 13 01:00:40 2018 +0100
committer Dirk Lemstra <dirk@git.imagemagick.org> Sat Jan 13 01:00:40 2018 +0100
tree 64d190c1fe813f8336b65f4e60fd72f6a3e1a060
parent 9fbc20decdf02beb8a7f8d732a95116192b40582

Added extra check for the number of elements
Credit to OSS-Fuzz

coders/dpx.c

diff --git a/coders/dpx.c b/coders/dpx.c
index bc021ba..6c73c3d 100644
--- a/coders/dpx.c
+++ b/coders/dpx.c
@@ -803,7 +803,8 @@
     case 7: image->orientation=RightBottomOrientation; break;
   }
   dpx.image.number_elements=ReadBlobShort(image);
-  if (dpx.image.number_elements > MaxNumberImageElements)
+  if ((dpx.image.number_elements < 1) ||
+      (dpx.image.number_elements > MaxNumberImageElements))
     ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   offset+=2;
   dpx.image.pixels_per_line=ReadBlobLong(image);