@@ -131,7 +131,7 @@ static MagickBooleanType IsXBM(const unsigned char *magick,const size_t length)
131131%
132132*/
133133
134- static unsigned int XBMInteger (Image * image ,short int * hex_digits )
134+ static int XBMInteger (Image * image ,short int * hex_digits )
135135{
136136 int
137137 c ;
@@ -146,7 +146,7 @@ static unsigned int XBMInteger(Image *image,short int *hex_digits)
146146 {
147147 c = ReadBlobByte (image );
148148 if (c == EOF )
149- return (0 );
149+ return (-1 );
150150 } while ((c == ' ' ) || (c == '\t' ) || (c == '\n' ) || (c == '\r' ));
151151 /*
152152 Evaluate number.
@@ -163,9 +163,9 @@ static unsigned int XBMInteger(Image *image,short int *hex_digits)
163163 value += hex_digits [c ];
164164 c = ReadBlobByte (image );
165165 if (c == EOF )
166- return (0 );
166+ return (-1 );
167167 } while (hex_digits [c ] >= 0 );
168- return (value );
168+ return (( int ) value );
169169}
170170
171171static Image * ReadXBMImage (const ImageInfo * image_info ,ExceptionInfo * exception )
@@ -177,6 +177,9 @@ static Image *ReadXBMImage(const ImageInfo *image_info,ExceptionInfo *exception)
177177 Image
178178 * image ;
179179
180+ int
181+ c ;
182+
180183 MagickBooleanType
181184 status ;
182185
@@ -206,7 +209,6 @@ static Image *ReadXBMImage(const ImageInfo *image_info,ExceptionInfo *exception)
206209 height ,
207210 length ,
208211 padding ,
209- value ,
210212 version ,
211213 width ;
212214
@@ -282,12 +284,12 @@ static Image *ReadXBMImage(const ImageInfo *image_info,ExceptionInfo *exception)
282284 /*
283285 Initialize colormap.
284286 */
285- image -> colormap [0 ].red = QuantumRange ;
286- image -> colormap [0 ].green = QuantumRange ;
287- image -> colormap [0 ].blue = QuantumRange ;
288- image -> colormap [1 ].red = ( Quantum ) 0 ;
289- image -> colormap [1 ].green = ( Quantum ) 0 ;
290- image -> colormap [1 ].blue = ( Quantum ) 0 ;
287+ image -> colormap [0 ].red = ( MagickRealType ) QuantumRange ;
288+ image -> colormap [0 ].green = ( MagickRealType ) QuantumRange ;
289+ image -> colormap [0 ].blue = ( MagickRealType ) QuantumRange ;
290+ image -> colormap [1 ].red = 0. 0 ;
291+ image -> colormap [1 ].green = 0. 0 ;
292+ image -> colormap [1 ].blue = 0. 0 ;
291293 if (image_info -> ping != MagickFalse )
292294 {
293295 (void ) CloseBlob (image );
@@ -344,16 +346,25 @@ static Image *ReadXBMImage(const ImageInfo *image_info,ExceptionInfo *exception)
344346 if (version == 10 )
345347 for (i = 0 ; i < (ssize_t ) (bytes_per_line * image -> rows ); (i += 2 ))
346348 {
347- value = XBMInteger (image ,hex_digits );
348- * p ++ = (unsigned char ) value ;
349+ c = XBMInteger (image ,hex_digits );
350+ if (c < 0 )
351+ break ;
352+ * p ++ = (unsigned char ) c ;
349353 if ((padding == 0 ) || (((i + 2 ) % bytes_per_line ) != 0 ))
350- * p ++ = (unsigned char ) (value >> 8 );
354+ * p ++ = (unsigned char ) (c >> 8 );
351355 }
352356 else
353357 for (i = 0 ; i < (ssize_t ) (bytes_per_line * image -> rows ); i ++ )
354358 {
355- value = XBMInteger (image ,hex_digits );
356- * p ++ = (unsigned char ) value ;
359+ c = XBMInteger (image ,hex_digits );
360+ if (c < 0 )
361+ break ;
362+ * p ++ = (unsigned char ) c ;
363+ }
364+ if (EOFBlob (image ) != MagickFalse )
365+ {
366+ data = (unsigned char * ) RelinquishMagickMemory (data );
367+ ThrowReaderException (CorruptImageError ,"UnexpectedEndOfFile" );
357368 }
358369 /*
359370 Convert X bitmap image to pixel packets.
@@ -369,7 +380,7 @@ static Image *ReadXBMImage(const ImageInfo *image_info,ExceptionInfo *exception)
369380 for (x = 0 ; x < (ssize_t ) image -> columns ; x ++ )
370381 {
371382 if (bit == 0 )
372- byte = (size_t ) (* p ++ );
383+ byte = (unsigned int ) (* p ++ );
373384 SetPixelIndex (image ,(Quantum ) ((byte & 0x01 ) != 0 ? 0x01 : 0x00 ),q );
374385 bit ++ ;
375386 byte >>=1 ;
0 commit comments