Skip to content
Permalink
Browse files

Lowered max map_length to prevent an overflow (#271).

  • Loading branch information...
dlemstra committed Nov 21, 2016
1 parent 60116ee commit ab2c9d6a8dd6d71b161ec9cc57a588b116b52322
Showing with 1 addition and 1 deletion.
  1. +1 −1 coders/rle.c
@@ -224,7 +224,7 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
bits_per_pixel=(size_t) ReadBlobByte(image);
number_colormaps=(size_t) ReadBlobByte(image);
map_length=(unsigned char) ReadBlobByte(image);
if (map_length >= 32)
if (map_length >= 22)
ThrowReaderException(CorruptImageError,"ImproperImageHeader");
one=1;
map_length=one << map_length;

0 comments on commit ab2c9d6

Please sign in to comment.
You can’t perform that action at this time.