@@ -238,6 +238,8 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)
238238 ThrowReaderException (CorruptImageError ,"FileFormatVersionMismatch" );
239239 if (header .header_size < sz_XWDheader )
240240 ThrowReaderException (CorruptImageError ,"ImproperImageHeader" );
241+ if ((MagickSizeType ) header .xoffset >= GetBlobSize (image ))
242+ ThrowReaderException (CorruptImageError ,"ImproperImageHeader" );
241243 switch (header .visual_class )
242244 {
243245 case StaticGray :
@@ -251,7 +253,7 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)
251253 case PseudoColor :
252254 {
253255 if ((header .bits_per_pixel < 1 ) || (header .bits_per_pixel > 15 ) ||
254- (header .ncolors == 0 ))
256+ (header .colormap_entries == 0 ))
255257 ThrowReaderException (CorruptImageError ,"ImproperImageHeader" );
256258 break ;
257259 }
@@ -318,8 +320,6 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)
318320 default :
319321 ThrowReaderException (CorruptImageError ,"ImproperImageHeader" );
320322 }
321- if (header .ncolors > 65535 )
322- ThrowReaderException (CorruptImageError ,"ImproperImageHeader" );
323323 if (((header .bitmap_pad % 8 ) != 0 ) || (header .bitmap_pad > 32 ))
324324 ThrowReaderException (CorruptImageError ,"ImproperImageHeader" );
325325 length = (size_t ) (header .header_size - sz_XWDheader );
@@ -387,8 +387,10 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)
387387 XWDColor
388388 color ;
389389
390- colors = (XColor * ) AcquireQuantumMemory ((size_t ) header .ncolors ,
391- sizeof (* colors ));
390+ length = (size_t ) header .ncolors ;
391+ if (length > ((~0UL )/sizeof (* colors )))
392+ ThrowReaderException (CorruptImageError ,"ImproperImageHeader" );
393+ colors = (XColor * ) AcquireQuantumMemory (length ,sizeof (* colors ));
392394 if (colors == (XColor * ) NULL )
393395 {
394396 ximage = (XImage * ) RelinquishMagickMemory (ximage );
@@ -689,6 +691,7 @@ ModuleExport size_t RegisterXWDImage(void)
689691 entry -> encoder = (EncodeImageHandler * ) WriteXWDImage ;
690692#endif
691693 entry -> magick = (IsImageFormatHandler * ) IsXWD ;
694+ entry -> flags |=CoderDecoderSeekableStreamFlag ;
692695 entry -> flags ^=CoderAdjoinFlag ;
693696 (void ) RegisterMagickInfo (entry );
694697 return (MagickImageCoderSignature );
0 commit comments