From 27411f1d1d3a0b328cede4a808525ee237cb415b Mon Sep 17 00:00:00 2001
From: Cristy <urban-warrior@imagemagick.org>
Date: Sat, 7 Oct 2023 10:48:39 +0800
Subject: [PATCH] check for BMP file size, poc provided by Hardik Shah of
 Vehere (Dawn Treaders team)

---
 coders/bmp.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/coders/bmp.c b/coders/bmp.c
index 6f9b57b..5e6dac3 100644
--- a/coders/bmp.c
+++ b/coders/bmp.c
@@ -635,6 +635,9 @@ static Image *ReadBMPImage(const ImageInfo *image_info,ExceptionInfo *exception)
         "  BMP header size: %u",bmp_info.size);
     if (bmp_info.size > 124)
       ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+    if ((bmp_info.file_size != 0) &&
+        ((MagickSizeType) bmp_info.file_size > GetBlobSize(image)))
+      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
     if (bmp_info.offset_bits < bmp_info.size)
       ThrowReaderException(CorruptImageError,"ImproperImageHeader");
     profile_data=0;
-- 
2.27.0

