@@ -132,6 +132,14 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
132132#define ByteDataOp 0x05
133133#define RunDataOp 0x06
134134#define EOFOp 0x07
135+ #define ThrowRLEException (exception ,message ) \
136+ { \
137+ if (colormap != (unsigned char *) NULL) \
138+ colormap=(unsigned char *) RelinquishMagickMemory(colormap); \
139+ if (pixel_info != (MemoryInfo *) NULL) \
140+ pixel_info=RelinquishVirtualMemory(pixel_info); \
141+ ThrowReaderException((exception),(message)); \
142+ }
135143
136144 char
137145 magick [12 ];
@@ -206,6 +214,8 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
206214 /*
207215 Determine if this a RLE file.
208216 */
217+ colormap = (unsigned char * ) NULL ;
218+ pixel_info = (MemoryInfo * ) NULL ;
209219 count = ReadBlob (image ,2 ,(unsigned char * ) magick );
210220 if ((count != 2 ) || (memcmp (magick ,"\122\314" ,2 ) != 0 ))
211221 ThrowReaderException (CorruptImageError ,"ImproperImageHeader" );
@@ -214,8 +224,8 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
214224 /*
215225 Read image header.
216226 */
217- image -> page .x = ReadBlobLSBShort (image );
218- image -> page .y = ReadBlobLSBShort (image );
227+ image -> page .x = ( ssize_t ) ReadBlobLSBShort (image );
228+ image -> page .y = ( ssize_t ) ReadBlobLSBShort (image );
219229 image -> columns = ReadBlobLSBShort (image );
220230 image -> rows = ReadBlobLSBShort (image );
221231 flags = (MagickStatusType ) ReadBlobByte (image );
@@ -226,6 +236,8 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
226236 map_length = (unsigned char ) ReadBlobByte (image );
227237 if (map_length >= 22 )
228238 ThrowReaderException (CorruptImageError ,"ImproperImageHeader" );
239+ if (EOFBlob (image ) != MagickFalse )
240+ ThrowRLEException (CorruptImageError ,"UnexpectedEndOfFile" );
229241 one = 1 ;
230242 map_length = one << map_length ;
231243 if ((number_planes == 0 ) || (number_planes == 2 ) ||
@@ -253,12 +265,7 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
253265 if ((number_planes & 0x01 ) == 0 )
254266 (void ) ReadBlobByte (image );
255267 if (EOFBlob (image ) != MagickFalse )
256- {
257- ThrowFileException (exception ,CorruptImageError ,"UnexpectedEndOfFile" ,
258- image -> filename );
259- break ;
260- }
261- colormap = (unsigned char * ) NULL ;
268+ ThrowRLEException (CorruptImageError ,"UnexpectedEndOfFile" );
262269 if (number_colormaps != 0 )
263270 {
264271 /*
@@ -271,8 +278,12 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
271278 p = colormap ;
272279 for (i = 0 ; i < (ssize_t ) number_colormaps ; i ++ )
273280 for (x = 0 ; x < (ssize_t ) map_length ; x ++ )
281+ {
274282 * p ++ = (unsigned char ) ScaleQuantumToChar (ScaleShortToQuantum (
275283 ReadBlobLSBShort (image )));
284+ if (EOFBlob (image ) != MagickFalse )
285+ ThrowRLEException (CorruptImageError ,"UnexpectedEndOfFile" );
286+ }
276287 }
277288 if ((flags & 0x08 ) != 0 )
278289 {
@@ -300,11 +311,7 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
300311 }
301312 }
302313 if (EOFBlob (image ) != MagickFalse )
303- {
304- ThrowFileException (exception ,CorruptImageError ,"UnexpectedEndOfFile" ,
305- image -> filename );
306- break ;
307- }
314+ ThrowRLEException (CorruptImageError ,"UnexpectedEndOfFile" );
308315 if ((image_info -> ping != MagickFalse ) && (image_info -> number_scenes != 0 ))
309316 if (image -> scene >= (image_info -> scene + image_info -> number_scenes - 1 ))
310317 break ;
@@ -359,22 +366,32 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
359366 x = 0 ;
360367 y = 0 ;
361368 opcode = ReadBlobByte (image );
369+ if (opcode == EOF )
370+ ThrowRLEException (CorruptImageError ,"UnexpectedEndOfFile" );
362371 do
363372 {
364373 switch (opcode & 0x3f )
365374 {
366375 case SkipLinesOp :
367376 {
368377 operand = ReadBlobByte (image );
378+ if (opcode == EOF )
379+ ThrowRLEException (CorruptImageError ,"UnexpectedEndOfFile" );
369380 if (opcode & 0x40 )
370- operand = ReadBlobLSBSignedShort (image );
381+ {
382+ operand = ReadBlobLSBSignedShort (image );
383+ if (opcode == EOF )
384+ ThrowRLEException (CorruptImageError ,"UnexpectedEndOfFile" );
385+ }
371386 x = 0 ;
372387 y += operand ;
373388 break ;
374389 }
375390 case SetColorOp :
376391 {
377392 operand = ReadBlobByte (image );
393+ if (opcode == EOF )
394+ ThrowRLEException (CorruptImageError ,"UnexpectedEndOfFile" );
378395 plane = (unsigned char ) operand ;
379396 if (plane == 255 )
380397 plane = (unsigned char ) (number_planes - 1 );
@@ -384,21 +401,33 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
384401 case SkipPixelsOp :
385402 {
386403 operand = ReadBlobByte (image );
404+ if (opcode == EOF )
405+ ThrowRLEException (CorruptImageError ,"UnexpectedEndOfFile" );
387406 if (opcode & 0x40 )
388- operand = ReadBlobLSBSignedShort (image );
407+ {
408+ operand = ReadBlobLSBSignedShort (image );
409+ if (opcode == EOF )
410+ ThrowRLEException (CorruptImageError ,"UnexpectedEndOfFile" );
411+ }
389412 x += operand ;
390413 break ;
391414 }
392415 case ByteDataOp :
393416 {
394417 operand = ReadBlobByte (image );
418+ if (opcode == EOF )
419+ ThrowRLEException (CorruptImageError ,"UnexpectedEndOfFile" );
395420 if (opcode & 0x40 )
396- operand = ReadBlobLSBSignedShort (image );
397- offset = ((image -> rows - y - 1 )* image -> columns * number_planes )+ x *
398- number_planes + plane ;
421+ {
422+ operand = ReadBlobLSBSignedShort (image );
423+ if (opcode == EOF )
424+ ThrowRLEException (CorruptImageError ,"UnexpectedEndOfFile" );
425+ }
426+ offset = (ssize_t ) (((image -> rows - y - 1 )* image -> columns * number_planes )+ x *
427+ number_planes + plane );
399428 operand ++ ;
400429 if ((offset < 0 ) ||
401- (offset + (( size_t ) operand * number_planes ) > pixel_info_length ))
430+ (( offset + operand * number_planes ) > ( ssize_t ) pixel_info_length ))
402431 {
403432 if (number_colormaps != 0 )
404433 colormap = (unsigned char * ) RelinquishMagickMemory (colormap );
@@ -422,15 +451,21 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
422451 case RunDataOp :
423452 {
424453 operand = ReadBlobByte (image );
454+ if (opcode == EOF )
455+ ThrowRLEException (CorruptImageError ,"UnexpectedEndOfFile" );
425456 if (opcode & 0x40 )
426- operand = ReadBlobLSBSignedShort (image );
457+ {
458+ operand = ReadBlobLSBSignedShort (image );
459+ if (opcode == EOF )
460+ ThrowRLEException (CorruptImageError ,"UnexpectedEndOfFile" );
461+ }
427462 pixel = (unsigned char ) ReadBlobByte (image );
428463 (void ) ReadBlobByte (image );
429- offset = ((image -> rows - y - 1 )* image -> columns * number_planes )+ x *
430- number_planes + plane ;
464+ offset = (ssize_t ) (( (image -> rows - y - 1 )* image -> columns * number_planes )+ x *
465+ number_planes + plane ) ;
431466 operand ++ ;
432467 if ((offset < 0 ) ||
433- (offset + (( size_t ) operand * number_planes ) > pixel_info_length ))
468+ (( offset + operand * number_planes ) > ( ssize_t ) pixel_info_length ))
434469 {
435470 if (number_colormaps != 0 )
436471 colormap = (unsigned char * ) RelinquishMagickMemory (colormap );
@@ -452,6 +487,8 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
452487 break ;
453488 }
454489 opcode = ReadBlobByte (image );
490+ if (opcode == EOF )
491+ ThrowRLEException (CorruptImageError ,"UnexpectedEndOfFile" );
455492 } while (((opcode & 0x3f ) != EOFOp ) && (opcode != EOF ));
456493 if (number_colormaps != 0 )
457494 {
@@ -467,7 +504,7 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
467504 if (number_colormaps == 1 )
468505 for (i = 0 ; i < (ssize_t ) number_pixels ; i ++ )
469506 {
470- ValidateColormapValue (image ,* p & mask ,& index ,exception );
507+ ValidateColormapValue (image ,( ssize_t ) ( * p & mask ) ,& index ,exception );
471508 * p = colormap [(ssize_t ) index ];
472509 p ++ ;
473510 }
@@ -476,7 +513,7 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
476513 for (i = 0 ; i < (ssize_t ) number_pixels ; i ++ )
477514 for (x = 0 ; x < (ssize_t ) number_planes ; x ++ )
478515 {
479- ValidateColormapValue (image ,(size_t ) (x * map_length +
516+ ValidateColormapValue (image ,(ssize_t ) (x * map_length +
480517 (* p & mask )),& index ,exception );
481518 * p = colormap [(ssize_t ) index ];
482519 p ++ ;
@@ -570,7 +607,7 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
570607 break ;
571608 for (x = 0 ; x < (ssize_t ) image -> columns ; x ++ )
572609 {
573- SetPixelIndex (image ,* p ++ ,q );
610+ SetPixelIndex (image ,( Quantum ) * p ++ ,q );
574611 q += GetPixelChannels (image );
575612 }
576613 if (SyncAuthenticPixels (image ,exception ) == MagickFalse )
0 commit comments