Skip to content
Permalink
Browse files Browse the repository at this point in the history
https://github.com/ImageMagick/ImageMagick/issues/1554
  • Loading branch information
Cristy committed Apr 27, 2019
1 parent 3183a88 commit f720661
Showing 1 changed file with 5 additions and 3 deletions.
8 changes: 5 additions & 3 deletions coders/mat.c
Expand Up @@ -641,6 +641,7 @@ static Image *ReadMATImageV4(const ImageInfo *image_info,Image *image,
Object parser loop.
*/
ldblk=ReadBlobLSBLong(image);
if(EOFBlob(image)) break;
if ((ldblk > 9999) || (ldblk < 0))
break;
HDR.Type[3]=ldblk % 10; ldblk /= 10; /* T digit */
Expand Down Expand Up @@ -961,10 +962,10 @@ static Image *ReadMATImage(const ImageInfo *image_info,ExceptionInfo *exception)
}

filepos = TellBlob(image);
while(!EOFBlob(image)) /* object parser loop */
while(filepos < GetBlobSize(image) && !EOFBlob(image)) /* object parser loop */
{
Frames = 1;
if (filepos != (unsigned int) filepos)
if(filepos > GetBlobSize(image) || filepos < 0)
break;
if(SeekBlob(image,filepos,SEEK_SET) != filepos) break;
/* printf("pos=%X\n",TellBlob(image)); */
Expand All @@ -973,7 +974,7 @@ static Image *ReadMATImage(const ImageInfo *image_info,ExceptionInfo *exception)
if(EOFBlob(image)) break;
MATLAB_HDR.ObjectSize = ReadBlobXXXLong(image);
if(EOFBlob(image)) break;
if((MagickSizeType) (MATLAB_HDR.ObjectSize+filepos) > GetBlobSize(image))
if((MagickSizeType) (MATLAB_HDR.ObjectSize+filepos) >= GetBlobSize(image))
goto MATLAB_KO;
filepos += (MagickOffsetType) MATLAB_HDR.ObjectSize + 4 + 4;

Expand Down Expand Up @@ -1276,6 +1277,7 @@ RestoreMSCWarning
{
if (logging) (void)LogMagickEvent(CoderEvent,GetMagickModule(),
" MAT cannot read scanrow %u from a file.", (unsigned)(MATLAB_HDR.SizeY-i-1));
ThrowReaderException(CorruptImageError,"UnexpectedEndOfFile");
goto ExitLoop;
}
if((CellType==miINT8 || CellType==miUINT8) && (MATLAB_HDR.StructureFlag & FLAG_LOGICAL))
Expand Down

0 comments on commit f720661

Please sign in to comment.