...

ImageMagick · May 6, 2017 · ea03f17 · ea03f17
1 parent 5964475
commit ea03f17
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 1 deletion.
diff --git a/coders/tga.c b/coders/tga.c
@@ -274,6 +274,8 @@ static Image *ReadTGAImage(const ImageInfo *image_info,
 
           one=1;
           image->colors=one << tga_info.bits_per_pixel;
+          if (image->colors > ((~0UL)/sizeof(*image->colormap)))
+            ThrowReaderException(CorruptImageError,"ImproperImageHeader");
           if (AcquireImageColormap(image,image->colors) == MagickFalse)
             ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
         }

diff --git a/configure b/configure
@@ -4519,7 +4519,7 @@ MAGICK_PATCHLEVEL_VERSION=5
 
 MAGICK_VERSION=6.9.8-5
 
-MAGICK_GIT_REVISION=11522:ed5b4e8:20170425
+MAGICK_GIT_REVISION=11552:5964475:20170506
 
 
 # Substitute library versioning

diff --git a/magick/image.c b/magick/image.c
@@ -829,6 +829,8 @@ MagickExport Image *CloneImage(const Image *image,const size_t columns,
       */
       clone_image->colors=image->colors;
       length=(size_t) image->colors;
+      if (length > ((~0UL)/sizeof(*colors)))
+        ThrowReaderException(CorruptImageError,"ImproperImageHeader");
       clone_image->colormap=(PixelPacket *) AcquireQuantumMemory(length,
         sizeof(*clone_image->colormap));
       if (clone_image->colormap == (PixelPacket *) NULL)