From b6a2b1e6c2c3b387eefa24ccf7c9469b51080d17 Mon Sep 17 00:00:00 2001 From: cristy Date: Sun, 7 Dec 2014 12:52:08 +0000 Subject: [PATCH] Fix handling of corrupted sun and wpg file git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17165 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74 origin: http://trac.imagemagick.org/changeset/17165 --- coders/sun.c | 2 ++ coders/wpg.c | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/coders/sun.c b/coders/sun.c index ac8aba5..98631c9 100644 --- a/coders/sun.c +++ b/coders/sun.c @@ -305,6 +305,8 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception) sun_info.type=ReadBlobMSBLong(image); sun_info.maptype=ReadBlobMSBLong(image); sun_info.maplength=ReadBlobMSBLong(image); + if ((sun_info.height != 0) && (sun_info.width != extent/sun_info.height)) + ThrowReaderException(CorruptImageError,"ImproperImageHeader"); if ((sun_info.type != RT_STANDARD) && (sun_info.type != RT_ENCODED) && (sun_info.type != RT_FORMAT_RGB)) ThrowReaderException(CoderError,"ImproperImageHeader"); diff --git a/coders/wpg.c b/coders/wpg.c index 37cb2a1..8c1b900 100644 --- a/coders/wpg.c +++ b/coders/wpg.c @@ -458,7 +458,7 @@ static int UnpackWPGRaster(Image *image,int bpp) ldblk=(long) ((bpp*image->columns+7)/8); BImgBuff=(unsigned char *) AcquireQuantumMemory((size_t) ldblk, - sizeof(*BImgBuff)); + 4*sizeof(*BImgBuff)); if(BImgBuff==NULL) return(-2); while(y<(long) image->rows) -- 2.1.4