Skip to content
Permalink
Browse files Browse the repository at this point in the history
https://github.com/ImageMagick/ImageMagick/issues/129
  • Loading branch information
Cristy committed Feb 14, 2016
1 parent 1bc1fd0 commit 134463b
Show file tree
Hide file tree
Showing 3 changed files with 30 additions and 4 deletions.
1 change: 1 addition & 0 deletions MagickCore/memory.c
Expand Up @@ -233,6 +233,7 @@ static MagickBooleanType
% o quantum: the number of bytes in each quantum.
%
*/

static MagickBooleanType CheckMemoryOverflow(const size_t count,
const size_t quantum)
{
Expand Down
1 change: 1 addition & 0 deletions MagickCore/quantum-import.c
Expand Up @@ -2024,6 +2024,7 @@ static void ImportGrayQuantum(const Image *image,QuantumInfo *quantum_info,

assert(image != (Image *) NULL);
assert(image->signature == MagickCoreSignature);
pixel=0;
switch (quantum_info->depth)
{
case 1:
Expand Down
32 changes: 28 additions & 4 deletions coders/viff.c
Expand Up @@ -137,6 +137,22 @@ static MagickBooleanType IsVIFF(const unsigned char *magick,const size_t length)
% o exception: return any errors or warnings in this structure.
%
*/

static MagickBooleanType CheckMemoryOverflow(const size_t count,
const size_t quantum)
{
size_t
size;

size=count*quantum;
if ((count == 0) || (quantum != (size/count)))
{
errno=ENOMEM;
return(MagickTrue);
}
return(MagickFalse);
}

static Image *ReadVIFFImage(const ImageInfo *image_info,
ExceptionInfo *exception)
{
Expand Down Expand Up @@ -475,7 +491,7 @@ static Image *ReadVIFFImage(const ImageInfo *image_info,
/*
Initialize image structure.
*/
image->alpha_trait=viff_info.number_data_bands == 4 ? BlendPixelTrait :
image->alpha_trait=viff_info.number_data_bands == 4 ? BlendPixelTrait :
UndefinedPixelTrait;
image->storage_class=(viff_info.number_data_bands < 3 ? PseudoClass :
DirectClass);
Expand All @@ -499,9 +515,17 @@ static Image *ReadVIFFImage(const ImageInfo *image_info,
default: bytes_per_pixel=1; break;
}
if (viff_info.data_storage_type == VFF_TYP_BIT)
max_packets=((image->columns+7UL) >> 3UL)*image->rows;
{
if (CheckMemoryOverflow((image->columns+7UL) >> 3UL,image->rows) != MagickFalse)
ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
max_packets=((image->columns+7UL) >> 3UL)*image->rows;
}
else
max_packets=(size_t) (number_pixels*viff_info.number_data_bands);
{
if (CheckMemoryOverflow(number_pixels,viff_info.number_data_bands) != MagickFalse)
ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
max_packets=(size_t) (number_pixels*viff_info.number_data_bands);
}
pixels=(unsigned char *) AcquireQuantumMemory(MagickMax(number_pixels,
max_packets),bytes_per_pixel*sizeof(*pixels));
if (pixels == (unsigned char *) NULL)
Expand Down Expand Up @@ -695,7 +719,7 @@ static Image *ReadVIFFImage(const ImageInfo *image_info,
{
ssize_t
index;

index=(ssize_t) GetPixelRed(image,q);
SetPixelRed(image,image->colormap[
ConstrainColormapIndex(image,index,exception)].red,q);
Expand Down

0 comments on commit 134463b

Please sign in to comment.