Commit 62c229bb8 for imagemagick.org

commit 62c229bb8ffbb0a8e42c3654298494b4b16b39a2
Author: Cristy <urban-warrior@imagemagick.org>
Date:   Sun Jul 5 09:24:29 2026 -0400

    check for insufficient image data

diff --git a/coders/mat.c b/coders/mat.c
index 1da5cbd4f..e5eb6982f 100644
--- a/coders/mat.c
+++ b/coders/mat.c
@@ -712,6 +712,9 @@ static Image *ReadMATImageV4(const ImageInfo *image_info,Image *image,
             : image);
         goto skip_reading_current;
       }
+    if ((image->columns > GetBlobSize(image)) ||
+        (image->rows > GetBlobSize(image)))
+      ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
     status=SetImageExtent(image,image->columns,image->rows,exception);
     if (status == MagickFalse)
       return(DestroyImageList(image));
@@ -1236,6 +1239,9 @@ RestoreMSCWarning
       image->rows = temp;
       goto done_reading; /* !!!!!! BAD  !!!! */
     }
+    if ((image->columns > GetBlobSize(image)) ||
+        (image->rows > GetBlobSize(image)))
+      ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
     status=SetImageExtent(image,image->columns,image->rows,exception);
     if (status == MagickFalse)
       {
diff --git a/coders/wpg.c b/coders/wpg.c
index 80750f10b..126949d87 100644
--- a/coders/wpg.c
+++ b/coders/wpg.c
@@ -1234,6 +1234,10 @@ static Image *ReadWPGImage(const ImageInfo *image_info,ExceptionInfo *exception)
               bpp=(int) BitmapHeader2.Depth;

             UnpackRaster:
+              if ((image->columns > GetBlobSize(image)) ||
+                  (image->rows > GetBlobSize(image)))
+                ThrowReaderException(CorruptImageError,
+                  "InsufficientImageDataInFile");
               status=SetImageExtent(image,image->columns,image->rows,exception);
               if (status == MagickFalse)
                 break;