Skip to content

Commit c78993d

Browse files
author
Cristy
committed
https://github.com/ImageMagick/ImageMagick/issues/1553
1 parent 112760b commit c78993d

File tree

1 file changed

+8
-5
lines changed

1 file changed

+8
-5
lines changed

Diff for: coders/xwd.c

+8-5
Original file line numberDiff line numberDiff line change
@@ -238,6 +238,8 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)
238238
ThrowReaderException(CorruptImageError,"FileFormatVersionMismatch");
239239
if (header.header_size < sz_XWDheader)
240240
ThrowReaderException(CorruptImageError,"ImproperImageHeader");
241+
if ((MagickSizeType) header.xoffset >= GetBlobSize(image))
242+
ThrowReaderException(CorruptImageError,"ImproperImageHeader");
241243
switch (header.visual_class)
242244
{
243245
case StaticGray:
@@ -251,7 +253,7 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)
251253
case PseudoColor:
252254
{
253255
if ((header.bits_per_pixel < 1) || (header.bits_per_pixel > 15) ||
254-
(header.ncolors == 0))
256+
(header.colormap_entries == 0))
255257
ThrowReaderException(CorruptImageError,"ImproperImageHeader");
256258
break;
257259
}
@@ -318,8 +320,6 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)
318320
default:
319321
ThrowReaderException(CorruptImageError,"ImproperImageHeader");
320322
}
321-
if (header.ncolors > 65535)
322-
ThrowReaderException(CorruptImageError,"ImproperImageHeader");
323323
if (((header.bitmap_pad % 8) != 0) || (header.bitmap_pad > 32))
324324
ThrowReaderException(CorruptImageError,"ImproperImageHeader");
325325
length=(size_t) (header.header_size-sz_XWDheader);
@@ -387,8 +387,10 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)
387387
XWDColor
388388
color;
389389

390-
colors=(XColor *) AcquireQuantumMemory((size_t) header.ncolors,
391-
sizeof(*colors));
390+
length=(size_t) header.ncolors;
391+
if (length > ((~0UL)/sizeof(*colors)))
392+
ThrowReaderException(CorruptImageError,"ImproperImageHeader");
393+
colors=(XColor *) AcquireQuantumMemory(length,sizeof(*colors));
392394
if (colors == (XColor *) NULL)
393395
{
394396
ximage=(XImage *) RelinquishMagickMemory(ximage);
@@ -689,6 +691,7 @@ ModuleExport size_t RegisterXWDImage(void)
689691
entry->encoder=(EncodeImageHandler *) WriteXWDImage;
690692
#endif
691693
entry->magick=(IsImageFormatHandler *) IsXWD;
694+
entry->flags|=CoderDecoderSeekableStreamFlag;
692695
entry->flags^=CoderAdjoinFlag;
693696
(void) RegisterMagickInfo(entry);
694697
return(MagickImageCoderSignature);

0 commit comments

Comments
 (0)