From 3997bca2e5f812b9e6d7d9c2264e5bc7fc3b2734 Mon Sep 17 00:00:00 2001
From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
Date: Fri, 19 Dec 2014 00:26:33 +0000
Subject: [PATCH] Fix another out of bound problem in rle file

git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17336 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
origin:  http://trac.imagemagick.org/changeset/17336
---
 coders/rle.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/coders/rle.c b/coders/rle.c
index 767d61c..fdc58c9 100644
--- a/coders/rle.c
+++ b/coders/rle.c
@@ -413,6 +413,9 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
     } while (((opcode & 0x3f) != EOFOp) && (opcode != EOF));
     if (number_colormaps != 0)
       {
+        IndexPacket
+          index;
+
         MagickStatusType
           mask;
 
@@ -424,7 +427,8 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
         if (number_colormaps == 1)
           for (i=0; i < (long) number_pixels; i++)
           {
-            *p=colormap[*p & mask];
+            index=ConstrainColormapIndex(image,*p & mask);
+            *p=colormap[index];
             p++;
           }
         else
@@ -432,7 +436,8 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
             for (i=0; i < (long) number_pixels; i++)
               for (x=0; x < (long) number_planes; x++)
               {
-                *p=colormap[x*map_length+(*p & mask)];
+                index=ConstrainColormapIndex(image,x*map_length+(*p & mask));
+                *p=colormap[index];
                 p++;
               }
       }
-- 
2.1.4