]> granicus.if.org Git - imagemagick/blobdiff - coders/pict.c
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10774
[imagemagick] / coders / pict.c
index 0a221e2ada16293e471153ed1a0fe74d7e399fe2..9112be6f0492a44b6a6ff7d7ab1cc364335344ea 100644 (file)
 %                                 July 1992                                   %
 %                                                                             %
 %                                                                             %
-%  Copyright 1999-2015 ImageMagick Studio LLC, a non-profit organization      %
+%  Copyright 1999-2018 ImageMagick Studio LLC, a non-profit organization      %
 %  dedicated to making software imaging solutions freely available.           %
 %                                                                             %
 %  You may not use this file except in compliance with the License.  You may  %
 %  obtain a copy of the License at                                            %
 %                                                                             %
-%    http://www.imagemagick.org/script/license.php                            %
+%    https://www.imagemagick.org/script/license.php                           %
 %                                                                             %
 %  Unless required by applicable law or agreed to in writing, software        %
 %  distributed under the License is distributed on an "AS IS" BASIS,          %
 /*
   ImageMagick Macintosh PICT Methods.
 */
-#define ReadPixmap(pixmap) \
-{ \
-  pixmap.version=(short) ReadBlobMSBShort(image); \
-  pixmap.pack_type=(short) ReadBlobMSBShort(image); \
-  pixmap.pack_size=ReadBlobMSBLong(image); \
-  pixmap.horizontal_resolution=1UL*ReadBlobMSBShort(image); \
-  (void) ReadBlobMSBShort(image); \
-  pixmap.vertical_resolution=1UL*ReadBlobMSBShort(image); \
-  (void) ReadBlobMSBShort(image); \
-  pixmap.pixel_type=(short) ReadBlobMSBShort(image); \
-  pixmap.bits_per_pixel=(short) ReadBlobMSBShort(image); \
-  pixmap.component_count=(short) ReadBlobMSBShort(image); \
-  pixmap.component_size=(short) ReadBlobMSBShort(image); \
-  pixmap.plane_bytes=ReadBlobMSBLong(image); \
-  pixmap.table=ReadBlobMSBLong(image); \
-  pixmap.reserved=ReadBlobMSBLong(image); \
-  if ((EOFBlob(image) != MagickFalse) || (pixmap.bits_per_pixel <= 0) || \
-      (pixmap.bits_per_pixel > 32) || (pixmap.component_count <= 0) || \
-      (pixmap.component_count > 4) || (pixmap.component_size <= 0)) \
-    ThrowReaderException(CorruptImageError,"ImproperImageHeader"); \
-}
-
 typedef struct _PICTCode
 {
   const char
@@ -416,9 +394,11 @@ static unsigned char *ExpandBuffer(unsigned char *pixels,
 }
 
 static unsigned char *DecodeImage(Image *blob,Image *image,
-  size_t bytes_per_line,const unsigned int bits_per_pixel,size_t *extent,
-  ExceptionInfo *exception)
+  size_t bytes_per_line,const unsigned int bits_per_pixel,size_t *extent)
 {
+  MagickBooleanType
+    status;
+
   MagickSizeType
     number_pixels;
 
@@ -464,7 +444,7 @@ static unsigned char *DecodeImage(Image *blob,Image *image,
     bytes_per_line=width;
   row_bytes=(size_t) (image->columns | 0x8000);
   if (image->storage_class == DirectClass)
-    row_bytes=(size_t) ((4*image->columns) | 0x8000);
+    row_bytes=(size_t) (4*(image->columns | 0x8000));
   /*
     Allocate pixel and scanline buffer.
   */
@@ -473,11 +453,16 @@ static unsigned char *DecodeImage(Image *blob,Image *image,
   if (pixels == (unsigned char *) NULL)
     return((unsigned char *) NULL);
   *extent=row_bytes*image->rows*sizeof(*pixels);
-  (void) ResetMagickMemory(pixels,0,*extent);
+  (void) memset(pixels,0,*extent);
   scanline=(unsigned char *) AcquireQuantumMemory(row_bytes,2*
     sizeof(*scanline));
   if (scanline == (unsigned char *) NULL)
-    return((unsigned char *) NULL);
+    {
+      pixels=(unsigned char *) RelinquishMagickMemory(pixels);
+      return((unsigned char *) NULL);
+    }
+  (void) memset(scanline,0,2*row_bytes*sizeof(*scanline));
+  status=MagickTrue;
   if (bytes_per_line < 8)
     {
       /*
@@ -485,27 +470,25 @@ static unsigned char *DecodeImage(Image *blob,Image *image,
       */
       for (y=0; y < (ssize_t) image->rows; y++)
       {
-        q=pixels+y*width*GetPixelChannels(image);;
+        q=pixels+y*width*GetPixelChannels(image);
         number_pixels=bytes_per_line;
         count=ReadBlob(blob,(size_t) number_pixels,scanline);
         if (count != (ssize_t) number_pixels)
           {
-            (void) ThrowMagickException(exception,GetMagickModule(),
-              CorruptImageError,"UnableToUncompressImage","`%s'",
-              image->filename);
+            status=MagickFalse;
             break;
           }
         p=ExpandBuffer(scanline,&number_pixels,bits_per_pixel);
         if ((q+number_pixels) > (pixels+(*extent)))
           {
-            (void) ThrowMagickException(exception,GetMagickModule(),
-              CorruptImageError,"UnableToUncompressImage","`%s'",
-              image->filename);
+            status=MagickFalse;
             break;
           }
-        (void) CopyMagickMemory(q,p,(size_t) number_pixels);
+        (void) memcpy(q,p,(size_t) number_pixels);
       }
       scanline=(unsigned char *) RelinquishMagickMemory(scanline);
+      if (status == MagickFalse)
+        pixels=(unsigned char *) RelinquishMagickMemory(pixels);
       return(pixels);
     }
   /*
@@ -517,18 +500,16 @@ static unsigned char *DecodeImage(Image *blob,Image *image,
     if (bytes_per_line > 200)
       scanline_length=ReadBlobMSBShort(blob);
     else
-      scanline_length=1UL*ReadBlobByte(blob);
-    if (scanline_length >= row_bytes)
+      scanline_length=(size_t) ReadBlobByte(blob);
+    if ((scanline_length >= row_bytes) || (scanline_length == 0))
       {
-        (void) ThrowMagickException(exception,GetMagickModule(),
-          CorruptImageError,"UnableToUncompressImage","`%s'",image->filename);
+        status=MagickFalse;
         break;
       }
     count=ReadBlob(blob,scanline_length,scanline);
     if (count != (ssize_t) scanline_length)
       {
-        (void) ThrowMagickException(exception,GetMagickModule(),
-          CorruptImageError,"UnableToUncompressImage","`%s'",image->filename);
+        status=MagickFalse;
         break;
       }
     for (j=0; j < (ssize_t) scanline_length; )
@@ -538,7 +519,7 @@ static unsigned char *DecodeImage(Image *blob,Image *image,
           number_pixels=length*bytes_per_pixel;
           p=ExpandBuffer(scanline+j+1,&number_pixels,bits_per_pixel);
           if ((q-pixels+number_pixels) <= *extent)
-            (void) CopyMagickMemory(q,p,(size_t) number_pixels);
+            (void) memcpy(q,p,(size_t) number_pixels);
           q+=number_pixels;
           j+=(ssize_t) (length*bytes_per_pixel+1);
         }
@@ -550,13 +531,15 @@ static unsigned char *DecodeImage(Image *blob,Image *image,
           for (i=0; i < (ssize_t) length; i++)
           {
             if ((q-pixels+number_pixels) <= *extent)
-              (void) CopyMagickMemory(q,p,(size_t) number_pixels);
+              (void) memcpy(q,p,(size_t) number_pixels);
             q+=number_pixels;
           }
           j+=(ssize_t) bytes_per_pixel+1;
         }
   }
   scanline=(unsigned char *) RelinquishMagickMemory(scanline);
+  if (status == MagickFalse)
+    pixels=(unsigned char *) RelinquishMagickMemory(pixels);
   return(pixels);
 }
 \f
@@ -621,7 +604,7 @@ static size_t EncodeImage(Image *image,const unsigned char *scanline,
     Pack scanline.
   */
   assert(image != (Image *) NULL);
-  assert(image->signature == MagickSignature);
+  assert(image->signature == MagickCoreSignature);
   if (image->debug != MagickFalse)
     (void) LogMagickEvent(TraceEvent,GetMagickModule(),"%s",image->filename);
   assert(scanline != (unsigned char *) NULL);
@@ -790,14 +773,38 @@ static MagickBooleanType IsPICT(const unsigned char *magick,const size_t length)
 %
 */
 
+static MagickBooleanType ReadPixmap(Image *image,PICTPixmap *pixmap)
+{
+  pixmap->version=(short) ReadBlobMSBShort(image);
+  pixmap->pack_type=(short) ReadBlobMSBShort(image);
+  pixmap->pack_size=ReadBlobMSBLong(image);
+  pixmap->horizontal_resolution=1UL*ReadBlobMSBShort(image);
+  (void) ReadBlobMSBShort(image);
+  pixmap->vertical_resolution=1UL*ReadBlobMSBShort(image);
+  (void) ReadBlobMSBShort(image);
+  pixmap->pixel_type=(short) ReadBlobMSBShort(image);
+  pixmap->bits_per_pixel=(short) ReadBlobMSBShort(image);
+  pixmap->component_count=(short) ReadBlobMSBShort(image);
+  pixmap->component_size=(short) ReadBlobMSBShort(image);
+  pixmap->plane_bytes=ReadBlobMSBLong(image);
+  pixmap->table=ReadBlobMSBLong(image);
+  pixmap->reserved=ReadBlobMSBLong(image);
+  if ((EOFBlob(image) != MagickFalse) || (pixmap->bits_per_pixel <= 0) ||
+      (pixmap->bits_per_pixel > 32) || (pixmap->component_count <= 0) ||
+      (pixmap->component_count > 4) || (pixmap->component_size <= 0))
+    return(MagickFalse);
+  return(MagickTrue);
+}
+
 static MagickBooleanType ReadRectangle(Image *image,PICTRectangle *rectangle)
 {
   rectangle->top=(short) ReadBlobMSBShort(image);
   rectangle->left=(short) ReadBlobMSBShort(image);
   rectangle->bottom=(short) ReadBlobMSBShort(image);
   rectangle->right=(short) ReadBlobMSBShort(image);
-  if ((EOFBlob(image) != MagickFalse) || (rectangle->left > rectangle->right) ||
-      (rectangle->top > rectangle->bottom))
+  if ((EOFBlob(image) != MagickFalse) || 
+      ((rectangle->bottom-rectangle->top) <= 0) ||
+      ((rectangle->right-rectangle->left) <= 0))
     return(MagickFalse);
   return(MagickTrue);
 }
@@ -805,12 +812,25 @@ static MagickBooleanType ReadRectangle(Image *image,PICTRectangle *rectangle)
 static Image *ReadPICTImage(const ImageInfo *image_info,
   ExceptionInfo *exception)
 {
+#define ThrowPICTException(exception,message) \
+{ \
+  if (tile_image != (Image *) NULL) \
+    tile_image=DestroyImage(tile_image); \
+  if (read_info != (ImageInfo *) NULL) \
+    read_info=DestroyImageInfo(read_info); \
+  ThrowReaderException((exception),(message)); \
+}
+
   char
-    geometry[MaxTextExtent],
+    geometry[MagickPathExtent],
     header_ole[4];
 
   Image
-    *image;
+    *image,
+    *tile_image;
+
+  ImageInfo
+    *read_info;
 
   int
     c,
@@ -854,12 +874,12 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
     Open image file.
   */
   assert(image_info != (const ImageInfo *) NULL);
-  assert(image_info->signature == MagickSignature);
+  assert(image_info->signature == MagickCoreSignature);
   if (image_info->debug != MagickFalse)
     (void) LogMagickEvent(TraceEvent,GetMagickModule(),"%s",
       image_info->filename);
   assert(exception != (ExceptionInfo *) NULL);
-  assert(exception->signature == MagickSignature);
+  assert(exception->signature == MagickCoreSignature);
   image=AcquireImage(image_info,exception);
   status=OpenBlob(image_info,image,ReadBinaryBlobMode,exception);
   if (status == MagickFalse)
@@ -870,6 +890,8 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
   /*
     Read PICT header.
   */
+  read_info=(ImageInfo *) NULL;
+  tile_image=(Image *) NULL;
   pixmap.bits_per_pixel=0;
   pixmap.component_count=0;
   /*
@@ -886,31 +908,31 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
         break;
   (void) ReadBlobMSBShort(image);  /* skip picture size */
   if (ReadRectangle(image,&frame) == MagickFalse)
-    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+    ThrowPICTException(CorruptImageError,"ImproperImageHeader");
   while ((c=ReadBlobByte(image)) == 0) ;
   if (c != 0x11)
-    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
-  version=ReadBlobByte(image);
+    ThrowPICTException(CorruptImageError,"ImproperImageHeader");
+  version=(ssize_t) ReadBlobByte(image);
   if (version == 2)
     {
       c=ReadBlobByte(image);
       if (c != 0xff)
-        ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+        ThrowPICTException(CorruptImageError,"ImproperImageHeader");
     }
   else
     if (version != 1)
-      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+      ThrowPICTException(CorruptImageError,"ImproperImageHeader");
   if ((frame.left < 0) || (frame.right < 0) || (frame.top < 0) ||
       (frame.bottom < 0) || (frame.left >= frame.right) ||
       (frame.top >= frame.bottom))
-    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+    ThrowPICTException(CorruptImageError,"ImproperImageHeader");
   /*
     Create black canvas.
   */
   flags=0;
   image->depth=8;
-  image->columns=1UL*(frame.right-frame.left);
-  image->rows=1UL*(frame.bottom-frame.top);
+  image->columns=(size_t) (frame.right-frame.left);
+  image->rows=(size_t) (frame.bottom-frame.top);
   image->resolution.x=DefaultResolution;
   image->resolution.y=DefaultResolution;
   image->units=UndefinedResolution;
@@ -921,6 +943,8 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
         return(GetFirstImageInList(image));
       }
   status=SetImageExtent(image,image->columns,image->rows,exception);
+  if (status != MagickFalse)
+    status=ResetImagePixels(image,exception);
   if (status == MagickFalse)
     return(DestroyImageList(image));
   /*
@@ -935,9 +959,11 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
     if ((version == 1) || ((TellBlob(image) % 2) != 0))
       code=ReadBlobByte(image);
     if (version == 2)
-      code=(int) ReadBlobMSBShort(image);
+      code=ReadBlobMSBSignedShort(image);
     if (code < 0)
       break;
+    if (code == 0)
+      continue;
     if (code > 0xa1)
       {
         if (image->debug != MagickFalse)
@@ -956,6 +982,9 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
               Clipping rectangle.
             */
             length=ReadBlobMSBShort(image);
+            if (length > GetBlobSize(image))
+              ThrowPICTException(CorruptImageError,
+                "InsufficientImageDataInFile");
             if (length != 0x000a)
               {
                 for (i=0; i < (ssize_t) (length-2); i++)
@@ -964,12 +993,16 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
                 break;
               }
             if (ReadRectangle(image,&frame) == MagickFalse)
-              ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+              ThrowPICTException(CorruptImageError,"ImproperImageHeader");
             if (((frame.left & 0x8000) != 0) || ((frame.top & 0x8000) != 0))
               break;
-            image->columns=1UL*(frame.right-frame.left);
-            image->rows=1UL*(frame.bottom-frame.top);
-            (void) SetImageBackgroundColor(image,exception);
+            image->columns=(size_t) (frame.right-frame.left);
+            image->rows=(size_t) (frame.bottom-frame.top);
+            status=SetImageExtent(image,image->columns,image->rows,exception);
+            if (status != MagickFalse)
+              status=ResetImagePixels(image,exception);
+            if (status == MagickFalse)
+              return(DestroyImageList(image));
             break;
           }
           case 0x12:
@@ -986,7 +1019,7 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
             /*
               Skip pattern definition.
             */
-            pattern=1L*ReadBlobMSBShort(image);
+            pattern=(ssize_t) ReadBlobMSBShort(image);
             for (i=0; i < 8; i++)
               if (ReadBlobByte(image) == EOF)
                 break;
@@ -998,22 +1031,29 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
                 break;
               }
             if (pattern != 1)
-              ThrowReaderException(CorruptImageError,"UnknownPatternType");
+              ThrowPICTException(CorruptImageError,"UnknownPatternType");
             length=ReadBlobMSBShort(image);
+            if (length > GetBlobSize(image))
+              ThrowPICTException(CorruptImageError,
+                "InsufficientImageDataInFile");
             if (ReadRectangle(image,&frame) == MagickFalse)
-              ThrowReaderException(CorruptImageError,"ImproperImageHeader");
-            ReadPixmap(pixmap);
-            image->depth=1UL*pixmap.component_size;
+              ThrowPICTException(CorruptImageError,"ImproperImageHeader");
+            if (ReadPixmap(image,&pixmap) == MagickFalse)
+              ThrowPICTException(CorruptImageError,"ImproperImageHeader");
+            image->depth=(size_t) pixmap.component_size;
             image->resolution.x=1.0*pixmap.horizontal_resolution;
             image->resolution.y=1.0*pixmap.vertical_resolution;
             image->units=PixelsPerInchResolution;
             (void) ReadBlobMSBLong(image);
-            flags=1L*ReadBlobMSBShort(image);
+            flags=(ssize_t) ReadBlobMSBShort(image);
             length=ReadBlobMSBShort(image);
+            if (length > GetBlobSize(image))
+              ThrowPICTException(CorruptImageError,
+                "InsufficientImageDataInFile");
             for (i=0; i <= (ssize_t) length; i++)
               (void) ReadBlobMSBLong(image);
-            width=1UL*(frame.bottom-frame.top);
-            height=1UL*(frame.right-frame.left);
+            width=(size_t) (frame.bottom-frame.top);
+            height=(size_t) (frame.right-frame.left);
             if (pixmap.bits_per_pixel <= 8)
               length&=0x7fff;
             if (pixmap.bits_per_pixel == 16)
@@ -1027,7 +1067,10 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
                     break;
               }
             else
-              for (j=0; j < (int) height; j++)
+              for (i=0; i < (ssize_t) height; i++)
+              {
+                if (EOFBlob(image) != MagickFalse)
+                  break;
                 if (length > 200)
                   {
                     for (j=0; j < (ssize_t) ReadBlobMSBShort(image); j++)
@@ -1038,6 +1081,7 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
                   for (j=0; j < (ssize_t) ReadBlobByte(image); j++)
                     if (ReadBlobByte(image) == EOF)
                       break;
+              }
             break;
           }
           case 0x1b:
@@ -1066,6 +1110,9 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
               Skip polygon or region.
             */
             length=ReadBlobMSBShort(image);
+            if (length > GetBlobSize(image))
+              ThrowPICTException(CorruptImageError,
+                "InsufficientImageDataInFile");
             for (i=0; i < (ssize_t) (length-2); i++)
               if (ReadBlobByte(image) == EOF)
                 break;
@@ -1078,9 +1125,6 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
           case 0x9a:
           case 0x9b:
           {
-            Image
-              *tile_image;
-
             PICTRectangle
               source,
               destination;
@@ -1102,7 +1146,7 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
             */
             bytes_per_line=0;
             if ((code != 0x9a) && (code != 0x9b))
-              bytes_per_line=1L*ReadBlobMSBShort(image);
+              bytes_per_line=(ssize_t) ReadBlobMSBShort(image);
             else
               {
                 (void) ReadBlobMSBShort(image);
@@ -1110,26 +1154,27 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
                 (void) ReadBlobMSBShort(image);
               }
             if (ReadRectangle(image,&frame) == MagickFalse)
-              ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+              ThrowPICTException(CorruptImageError,"ImproperImageHeader");
             /*
               Initialize tile image.
             */
-            tile_image=CloneImage(image,1UL*(frame.right-frame.left),
-              1UL*(frame.bottom-frame.top),MagickTrue,exception);
+            tile_image=CloneImage(image,(size_t) (frame.right-frame.left),
+              (size_t) (frame.bottom-frame.top),MagickTrue,exception);
             if (tile_image == (Image *) NULL)
-              return((Image *) NULL);
+              ThrowPICTException(CorruptImageError,"ImproperImageHeader");
             if ((code == 0x9a) || (code == 0x9b) ||
                 ((bytes_per_line & 0x8000) != 0))
               {
-                ReadPixmap(pixmap);
-                tile_image->depth=1UL*pixmap.component_size;
+                if (ReadPixmap(image,&pixmap) == MagickFalse)
+                  ThrowPICTException(CorruptImageError,"ImproperImageHeader");
+                tile_image->depth=(size_t) pixmap.component_size;
                 tile_image->alpha_trait=pixmap.component_count == 4 ?
                   BlendPixelTrait : UndefinedPixelTrait;
                 tile_image->resolution.x=(double) pixmap.horizontal_resolution;
                 tile_image->resolution.y=(double) pixmap.vertical_resolution;
                 tile_image->units=PixelsPerInchResolution;
                 if (tile_image->alpha_trait != UndefinedPixelTrait)
-                  image->alpha_trait=tile_image->alpha_trait;
+                  (void) SetImageAlpha(tile_image,OpaqueAlpha,exception);
               }
             if ((code != 0x9a) && (code != 0x9b))
               {
@@ -1140,17 +1185,14 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
                 if ((bytes_per_line & 0x8000) != 0)
                   {
                     (void) ReadBlobMSBLong(image);
-                    flags=1L*ReadBlobMSBShort(image);
+                    flags=(ssize_t) ReadBlobMSBShort(image);
                     tile_image->colors=1UL*ReadBlobMSBShort(image)+1;
                   }
                 status=AcquireImageColormap(tile_image,tile_image->colors,
                   exception);
                 if (status == MagickFalse)
-                  {
-                    tile_image=DestroyImage(tile_image);
-                    ThrowReaderException(ResourceLimitError,
-                      "MemoryAllocationFailed");
-                  }
+                  ThrowPICTException(ResourceLimitError,
+                    "MemoryAllocationFailed");
                 if ((bytes_per_line & 0x8000) != 0)
                   {
                     for (i=0; i < (ssize_t) tile_image->colors; i++)
@@ -1179,10 +1221,13 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
                     }
                   }
               }
+            if (EOFBlob(image) != MagickFalse)
+              ThrowPICTException(CorruptImageError,
+                "InsufficientImageDataInFile");
             if (ReadRectangle(image,&source) == MagickFalse)
-              ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+              ThrowPICTException(CorruptImageError,"ImproperImageHeader");
             if (ReadRectangle(image,&destination) == MagickFalse)
-              ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+              ThrowPICTException(CorruptImageError,"ImproperImageHeader");
             (void) ReadBlobMSBShort(image);
             if ((code == 0x91) || (code == 0x99) || (code == 0x9b))
               {
@@ -1190,23 +1235,22 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
                   Skip region.
                 */
                 length=ReadBlobMSBShort(image);
+                if (length > GetBlobSize(image))
+                  ThrowPICTException(CorruptImageError,
+                    "InsufficientImageDataInFile");
                 for (i=0; i < (ssize_t) (length-2); i++)
                   if (ReadBlobByte(image) == EOF)
                     break;
               }
             if ((code != 0x9a) && (code != 0x9b) &&
                 (bytes_per_line & 0x8000) == 0)
-              pixels=DecodeImage(image,tile_image,1UL*bytes_per_line,1,&extent,
-                exception);
+              pixels=DecodeImage(image,tile_image,(size_t) bytes_per_line,1,
+                &extent);
             else
-              pixels=DecodeImage(image,tile_image,1UL*bytes_per_line,1U*
-                pixmap.bits_per_pixel,&extent,exception);
+              pixels=DecodeImage(image,tile_image,(size_t) bytes_per_line,
+                (unsigned int) pixmap.bits_per_pixel,&extent);
             if (pixels == (unsigned char *) NULL)
-              {
-                tile_image=DestroyImage(tile_image);
-                ThrowReaderException(ResourceLimitError,
-                  "MemoryAllocationFailed");
-              }
+              ThrowPICTException(CorruptImageError,"UnableToUncompressImage");
             /*
               Convert PICT tile image to pixel packets.
             */
@@ -1214,7 +1258,10 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
             for (y=0; y < (ssize_t) tile_image->rows; y++)
             {
               if (p > (pixels+extent+image->columns))
-                ThrowReaderException(CorruptImageError,"NotEnoughPixelData");
+                {
+                  pixels=(unsigned char *) RelinquishMagickMemory(pixels);
+                  ThrowPICTException(CorruptImageError,"NotEnoughPixelData");
+                }
               q=QueueAuthenticPixels(tile_image,0,y,tile_image->columns,1,
                 exception);
               if (q == (Quantum *) NULL)
@@ -1223,7 +1270,8 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
               {
                 if (tile_image->storage_class == PseudoClass)
                   {
-                    index=ConstrainColormapIndex(tile_image,*p,exception);
+                    index=(Quantum) ConstrainColormapIndex(tile_image,(ssize_t)
+                      *p,exception);
                     SetPixelIndex(tile_image,index,q);
                     SetPixelRed(tile_image,
                       tile_image->colormap[(ssize_t) index].red,q);
@@ -1236,8 +1284,8 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
                   {
                     if (pixmap.bits_per_pixel == 16)
                       {
-                        i=(*p++);
-                        j=(*p);
+                        i=(ssize_t) (*p++);
+                        j=(size_t) (*p);
                         SetPixelRed(tile_image,ScaleCharToQuantum(
                           (unsigned char) ((i & 0x7c) << 1)),q);
                         SetPixelGreen(tile_image,ScaleCharToQuantum(
@@ -1250,7 +1298,7 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
                       if (tile_image->alpha_trait == UndefinedPixelTrait)
                         {
                           if (p > (pixels+extent+2*image->columns))
-                            ThrowReaderException(CorruptImageError,
+                            ThrowPICTException(CorruptImageError,
                               "NotEnoughPixelData");
                           SetPixelRed(tile_image,ScaleCharToQuantum(*p),q);
                           SetPixelGreen(tile_image,ScaleCharToQuantum(
@@ -1261,7 +1309,7 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
                       else
                         {
                           if (p > (pixels+extent+3*image->columns))
-                            ThrowReaderException(CorruptImageError,
+                            ThrowPICTException(CorruptImageError,
                               "NotEnoughPixelData");
                           SetPixelAlpha(tile_image,ScaleCharToQuantum(*p),q);
                           SetPixelRed(tile_image,ScaleCharToQuantum(
@@ -1284,16 +1332,18 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
                   if (p < pixels)
                     break;
                 }
-              status=SetImageProgress(image,LoadImageTag,y,tile_image->rows);
+              status=SetImageProgress(image,LoadImageTag,(MagickOffsetType) y,
+                tile_image->rows);
               if (status == MagickFalse)
                 break;
             }
             pixels=(unsigned char *) RelinquishMagickMemory(pixels);
-            if (jpeg == MagickFalse)
+            if ((jpeg == MagickFalse) && (EOFBlob(image) == MagickFalse))
               if ((code == 0x9a) || (code == 0x9b) ||
                   ((bytes_per_line & 0x8000) != 0))
                 (void) CompositeImage(image,tile_image,CopyCompositeOp,
-                  MagickTrue,destination.left,destination.top,exception);
+                  MagickTrue,(ssize_t) destination.left,(ssize_t)
+                  destination.top,exception);
             tile_image=DestroyImage(tile_image);
             break;
           }
@@ -1310,10 +1360,13 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
             */
             type=ReadBlobMSBShort(image);
             length=ReadBlobMSBShort(image);
+            if (length > GetBlobSize(image))
+              ThrowPICTException(CorruptImageError,
+                "InsufficientImageDataInFile");
             if (length == 0)
               break;
             (void) ReadBlobMSBLong(image);
-            length-=4;
+            length-=MagickMin(length,4);
             if (length == 0)
               break;
             info=(unsigned char *) AcquireQuantumMemory(length,sizeof(*info));
@@ -1321,32 +1374,37 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
               break;
             count=ReadBlob(image,length,info);
             if (count != (ssize_t) length)
-              ThrowReaderException(ResourceLimitError,"UnableToReadImageData");
+              {
+                info=(unsigned char *) RelinquishMagickMemory(info);
+                ThrowPICTException(ResourceLimitError,"UnableToReadImageData");
+              }
             switch (type)
             {
               case 0xe0:
               {
-                if (length == 0)
-                  break;
                 profile=BlobToStringInfo((const void *) NULL,length);
                 SetStringInfoDatum(profile,info);
                 status=SetImageProfile(image,"icc",profile,exception);
                 profile=DestroyStringInfo(profile);
                 if (status == MagickFalse)
-                  ThrowReaderException(ResourceLimitError,
-                    "MemoryAllocationFailed");
+                  {
+                    info=(unsigned char *) RelinquishMagickMemory(info);
+                    ThrowPICTException(ResourceLimitError,
+                      "MemoryAllocationFailed");
+                  }
                 break;
               }
               case 0x1f2:
               {
-                if (length == 0)
-                  break;
                 profile=BlobToStringInfo((const void *) NULL,length);
                 SetStringInfoDatum(profile,info);
                 status=SetImageProfile(image,"iptc",profile,exception);
                 if (status == MagickFalse)
-                  ThrowReaderException(ResourceLimitError,
-                    "MemoryAllocationFailed");
+                  {
+                    info=(unsigned char *) RelinquishMagickMemory(info);
+                    ThrowPICTException(ResourceLimitError,
+                      "MemoryAllocationFailed");
+                  }
                 profile=DestroyStringInfo(profile);
                 break;
               }
@@ -1361,8 +1419,6 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
             /*
               Skip to next op code.
             */
-            if (code < 0)
-              break;
             if (codes[code].length == -1)
               (void) ReadBlobMSBShort(image);
             else
@@ -1387,15 +1443,12 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
       continue;
     if (code == 0x8200)
       {
+        char
+          filename[MaxTextExtent];
+
         FILE
           *file;
 
-        Image
-          *tile_image;
-
-        ImageInfo
-          *read_info;
-
         int
           unique_file;
 
@@ -1406,20 +1459,22 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
         read_info=CloneImageInfo(image_info);
         SetImageInfoBlob(read_info,(void *) NULL,0);
         file=(FILE *) NULL;
-        unique_file=AcquireUniqueFileResource(read_info->filename);
+        unique_file=AcquireUniqueFileResource(filename);
+        (void) FormatLocaleString(read_info->filename,MaxTextExtent,"jpeg:%s",
+          filename);
         if (unique_file != -1)
           file=fdopen(unique_file,"wb");
         if ((unique_file == -1) || (file == (FILE *) NULL))
           {
             (void) RelinquishUniqueFileResource(read_info->filename);
             (void) CopyMagickString(image->filename,read_info->filename,
-              MaxTextExtent);
-            ThrowFileException(exception,FileOpenError,
-              "UnableToCreateTemporaryFile",image->filename);
-            image=DestroyImageList(image);
-            return((Image *) NULL);
+              MagickPathExtent);
+            ThrowPICTException(FileOpenError,"UnableToCreateTemporaryFile");
           }
         length=ReadBlobMSBLong(image);
+        if (length > GetBlobSize(image))
+          ThrowPICTException(CorruptImageError,
+            "InsufficientImageDataInFile");
         if (length > 154)
           {
             for (i=0; i < 6; i++)
@@ -1428,7 +1483,7 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
               {
                 (void) fclose(file);
                 (void) RelinquishUniqueFileResource(read_info->filename);
-                ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+                ThrowPICTException(CorruptImageError,"ImproperImageHeader");
               }
             for (i=0; i < 122; i++)
               if (ReadBlobByte(image) == EOF)
@@ -1438,17 +1493,18 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
               c=ReadBlobByte(image);
               if (c == EOF)
                 break;
-              (void) fputc(c,file);
+              if (fputc(c,file) != c)
+                break;
             }
           }
         (void) fclose(file);
         (void) close(unique_file);
         tile_image=ReadImage(read_info,exception);
-        (void) RelinquishUniqueFileResource(read_info->filename);
+        (void) RelinquishUniqueFileResource(filename);
         read_info=DestroyImageInfo(read_info);
         if (tile_image == (Image *) NULL)
           continue;
-        (void) FormatLocaleString(geometry,MaxTextExtent,"%.20gx%.20g",
+        (void) FormatLocaleString(geometry,MagickPathExtent,"%.20gx%.20g",
           (double) MagickMax(image->columns,tile_image->columns),
           (double) MagickMax(image->rows,tile_image->rows));
         (void) SetImageExtent(image,
@@ -1456,7 +1512,7 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
           MagickMax(image->rows,tile_image->rows),exception);
         (void) TransformImageColorspace(image,tile_image->colorspace,exception);
         (void) CompositeImage(image,tile_image,CopyCompositeOp,MagickTrue,
-          frame.left,frame.right,exception);
+          (ssize_t) frame.left,(ssize_t) frame.right,exception);
         image->compression=tile_image->compression;
         tile_image=DestroyImage(tile_image);
         continue;
@@ -1470,6 +1526,9 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
           Skip reserved.
         */
         length=ReadBlobMSBShort(image);
+        if (length > GetBlobSize(image))
+          ThrowPICTException(CorruptImageError,
+            "InsufficientImageDataInFile");
         for (i=0; i < (ssize_t) length; i++)
           if (ReadBlobByte(image) == EOF)
             break;
@@ -1481,6 +1540,9 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
           Skip reserved.
         */
         length=(size_t) ((code >> 7) & 0xff);
+        if (length > GetBlobSize(image))
+          ThrowPICTException(CorruptImageError,
+            "InsufficientImageDataInFile");
         for (i=0; i < (ssize_t) length; i++)
           if (ReadBlobByte(image) == EOF)
             break;
@@ -1520,23 +1582,19 @@ ModuleExport size_t RegisterPICTImage(void)
   MagickInfo
     *entry;
 
-  entry=SetMagickInfo("PCT");
+  entry=AcquireMagickInfo("PICT","PCT","Apple Macintosh QuickDraw/PICT");
   entry->decoder=(DecodeImageHandler *) ReadPICTImage;
   entry->encoder=(EncodeImageHandler *) WritePICTImage;
   entry->flags^=CoderAdjoinFlag;
-  entry->flags|=CoderSeekableStreamFlag;
-  entry->description=ConstantString("Apple Macintosh QuickDraw/PICT");
+  entry->flags|=CoderEncoderSeekableStreamFlag;
   entry->magick=(IsImageFormatHandler *) IsPICT;
-  entry->module=ConstantString("PICT");
   (void) RegisterMagickInfo(entry);
-  entry=SetMagickInfo("PICT");
+  entry=AcquireMagickInfo("PICT","PICT","Apple Macintosh QuickDraw/PICT");
   entry->decoder=(DecodeImageHandler *) ReadPICTImage;
   entry->encoder=(EncodeImageHandler *) WritePICTImage;
   entry->flags^=CoderAdjoinFlag;
-  entry->flags|=CoderSeekableStreamFlag;
-  entry->description=ConstantString("Apple Macintosh QuickDraw/PICT");
+  entry->flags|=CoderEncoderSeekableStreamFlag;
   entry->magick=(IsImageFormatHandler *) IsPICT;
-  entry->module=ConstantString("PICT");
   (void) RegisterMagickInfo(entry);
   return(MagickImageCoderSignature);
 }
@@ -1641,6 +1699,7 @@ static MagickBooleanType WritePICTImage(const ImageInfo *image_info,
   size_t
     bytes_per_line,
     count,
+    row_bytes,
     storage_class;
 
   ssize_t
@@ -1653,22 +1712,21 @@ static MagickBooleanType WritePICTImage(const ImageInfo *image_info,
 
   unsigned short
     base_address,
-    row_bytes,
     transfer_mode;
 
   /*
     Open output image file.
   */
   assert(image_info != (const ImageInfo *) NULL);
-  assert(image_info->signature == MagickSignature);
+  assert(image_info->signature == MagickCoreSignature);
   assert(image != (Image *) NULL);
-  assert(image->signature == MagickSignature);
+  assert(image->signature == MagickCoreSignature);
   if (image->debug != MagickFalse)
     (void) LogMagickEvent(TraceEvent,GetMagickModule(),"%s",image->filename);
   if ((image->columns > 65535L) || (image->rows > 65535L))
     ThrowWriterException(ImageError,"WidthOrHeightExceedsLimit");
   assert(exception != (ExceptionInfo *) NULL);
-  assert(exception->signature == MagickSignature);
+  assert(exception->signature == MagickCoreSignature);
   status=OpenBlob(image_info,image,WriteBinaryBlobMode,exception);
   if (status == MagickFalse)
     return(status);
@@ -1685,7 +1743,7 @@ static MagickBooleanType WritePICTImage(const ImageInfo *image_info,
   source_rectangle=size_rectangle;
   destination_rectangle=size_rectangle;
   base_address=0xff;
-  row_bytes=(unsigned short) (image->columns | 0x8000);
+  row_bytes=image->columns;
   bounds.top=0;
   bounds.left=0;
   bounds.bottom=(short) image->rows;
@@ -1715,28 +1773,37 @@ static MagickBooleanType WritePICTImage(const ImageInfo *image_info,
       pixmap.bits_per_pixel=32;
       pixmap.pack_type=0x04;
       transfer_mode=0x40;
-      row_bytes=(unsigned short) ((4*image->columns) | 0x8000);
+      row_bytes=4*image->columns;
     }
   /*
     Allocate memory.
   */
-  bytes_per_line=image->columns;
+  bytes_per_line=image->columns | 0x8000;
   if (storage_class == DirectClass)
     bytes_per_line*=image->alpha_trait != UndefinedPixelTrait ? 4 : 3;
   buffer=(unsigned char *) AcquireQuantumMemory(PictInfoSize,sizeof(*buffer));
   packed_scanline=(unsigned char *) AcquireQuantumMemory((size_t)
-   (row_bytes+MaxCount),sizeof(*packed_scanline));
+   (row_bytes+2*MaxCount),sizeof(*packed_scanline));
   scanline=(unsigned char *) AcquireQuantumMemory(row_bytes,sizeof(*scanline));
   if ((buffer == (unsigned char *) NULL) ||
       (packed_scanline == (unsigned char *) NULL) ||
       (scanline == (unsigned char *) NULL))
-    ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
-  (void) ResetMagickMemory(scanline,0,row_bytes);
-  (void) ResetMagickMemory(packed_scanline,0,(size_t) (row_bytes+MaxCount));
+    {
+      if (scanline != (unsigned char *) NULL)
+        scanline=(unsigned char *) RelinquishMagickMemory(scanline);
+      if (packed_scanline != (unsigned char *) NULL)
+        packed_scanline=(unsigned char *) RelinquishMagickMemory(
+          packed_scanline);
+      if (buffer != (unsigned char *) NULL)
+        buffer=(unsigned char *) RelinquishMagickMemory(buffer);
+      ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
+    }
+  (void) memset(scanline,0,row_bytes);
+  (void) memset(packed_scanline,0,(size_t) (row_bytes+2*MaxCount));
   /*
     Write header, header size, size bounding box, version, and reserved.
   */
-  (void) ResetMagickMemory(buffer,0,PictInfoSize);
+  (void) memset(buffer,0,PictInfoSize);
   (void) WriteBlob(image,PictInfoSize,buffer);
   (void) WriteBlobMSBShort(image,0);
   (void) WriteBlobMSBShort(image,(unsigned short) size_rectangle.top);
@@ -1746,7 +1813,7 @@ static MagickBooleanType WritePICTImage(const ImageInfo *image_info,
   (void) WriteBlobMSBShort(image,PictVersion);
   (void) WriteBlobMSBShort(image,0x02ff);  /* version #2 */
   (void) WriteBlobMSBShort(image,PictInfoOp);
-  (void) WriteBlobMSBLong(image,0xFFFE0000UL);
+  (void) WriteBlobMSBLong(image,0xFFFE0000U);
   /*
     Write full size of the file, resolution, frame bounding box, and reserved.
   */
@@ -1777,13 +1844,13 @@ static MagickBooleanType WritePICTImage(const ImageInfo *image_info,
       (void) WriteBlobMSBShort(image,0xe0);
       (void) WriteBlobMSBShort(image,(unsigned short)
         (GetStringInfoLength(profile)+4));
-      (void) WriteBlobMSBLong(image,0x00000000UL);
+      (void) WriteBlobMSBLong(image,0x00000000U);
       (void) WriteBlob(image,GetStringInfoLength(profile),
         GetStringInfoDatum(profile));
       (void) WriteBlobMSBShort(image,0xa1);
       (void) WriteBlobMSBShort(image,0xe0);
       (void) WriteBlobMSBShort(image,4);
-      (void) WriteBlobMSBLong(image,0x00000002UL);
+      (void) WriteBlobMSBLong(image,0x00000002U);
     }
   /*
     Write crop region opcode and crop bounding box.
@@ -1815,7 +1882,7 @@ static MagickBooleanType WritePICTImage(const ImageInfo *image_info,
           return(MagickFalse);
         }
       jpeg_info=CloneImageInfo(image_info);
-      (void) CopyMagickString(jpeg_info->magick,"JPEG",MaxTextExtent);
+      (void) CopyMagickString(jpeg_info->magick,"JPEG",MagickPathExtent);
       length=0;
       blob=(unsigned char *) ImageToBlob(jpeg_info,jpeg_image,&length,
         exception);
@@ -1826,50 +1893,51 @@ static MagickBooleanType WritePICTImage(const ImageInfo *image_info,
       (void) WriteBlobMSBShort(image,PictJPEGOp);
       (void) WriteBlobMSBLong(image,(unsigned int) length+154);
       (void) WriteBlobMSBShort(image,0x0000);
-      (void) WriteBlobMSBLong(image,0x00010000UL);
-      (void) WriteBlobMSBLong(image,0x00000000UL);
-      (void) WriteBlobMSBLong(image,0x00000000UL);
-      (void) WriteBlobMSBLong(image,0x00000000UL);
-      (void) WriteBlobMSBLong(image,0x00010000UL);
-      (void) WriteBlobMSBLong(image,0x00000000UL);
-      (void) WriteBlobMSBLong(image,0x00000000UL);
-      (void) WriteBlobMSBLong(image,0x00000000UL);
-      (void) WriteBlobMSBLong(image,0x40000000UL);
-      (void) WriteBlobMSBLong(image,0x00000000UL);
-      (void) WriteBlobMSBLong(image,0x00000000UL);
-      (void) WriteBlobMSBLong(image,0x00000000UL);
-      (void) WriteBlobMSBLong(image,0x00400000UL);
+      (void) WriteBlobMSBLong(image,0x00010000U);
+      (void) WriteBlobMSBLong(image,0x00000000U);
+      (void) WriteBlobMSBLong(image,0x00000000U);
+      (void) WriteBlobMSBLong(image,0x00000000U);
+      (void) WriteBlobMSBLong(image,0x00010000U);
+      (void) WriteBlobMSBLong(image,0x00000000U);
+      (void) WriteBlobMSBLong(image,0x00000000U);
+      (void) WriteBlobMSBLong(image,0x00000000U);
+      (void) WriteBlobMSBLong(image,0x40000000U);
+      (void) WriteBlobMSBLong(image,0x00000000U);
+      (void) WriteBlobMSBLong(image,0x00000000U);
+      (void) WriteBlobMSBLong(image,0x00000000U);
+      (void) WriteBlobMSBLong(image,0x00400000U);
       (void) WriteBlobMSBShort(image,0x0000);
       (void) WriteBlobMSBShort(image,(unsigned short) image->rows);
       (void) WriteBlobMSBShort(image,(unsigned short) image->columns);
       (void) WriteBlobMSBShort(image,0x0000);
       (void) WriteBlobMSBShort(image,768);
       (void) WriteBlobMSBShort(image,0x0000);
-      (void) WriteBlobMSBLong(image,0x00000000UL);
-      (void) WriteBlobMSBLong(image,0x00566A70UL);
-      (void) WriteBlobMSBLong(image,0x65670000UL);
-      (void) WriteBlobMSBLong(image,0x00000000UL);
-      (void) WriteBlobMSBLong(image,0x00000001UL);
-      (void) WriteBlobMSBLong(image,0x00016170UL);
-      (void) WriteBlobMSBLong(image,0x706C0000UL);
-      (void) WriteBlobMSBLong(image,0x00000000UL);
+      (void) WriteBlobMSBLong(image,0x00000000U);
+      (void) WriteBlobMSBLong(image,0x00566A70U);
+      (void) WriteBlobMSBLong(image,0x65670000U);
+      (void) WriteBlobMSBLong(image,0x00000000U);
+      (void) WriteBlobMSBLong(image,0x00000001U);
+      (void) WriteBlobMSBLong(image,0x00016170U);
+      (void) WriteBlobMSBLong(image,0x706C0000U);
+      (void) WriteBlobMSBLong(image,0x00000000U);
       (void) WriteBlobMSBShort(image,768);
       (void) WriteBlobMSBShort(image,(unsigned short) image->columns);
       (void) WriteBlobMSBShort(image,(unsigned short) image->rows);
       (void) WriteBlobMSBShort(image,(unsigned short) x_resolution);
       (void) WriteBlobMSBShort(image,0x0000);
       (void) WriteBlobMSBShort(image,(unsigned short) y_resolution);
-      (void) WriteBlobMSBLong(image,0x00000000UL);
-      (void) WriteBlobMSBLong(image,0x87AC0001UL);
-      (void) WriteBlobMSBLong(image,0x0B466F74UL);
-      (void) WriteBlobMSBLong(image,0x6F202D20UL);
-      (void) WriteBlobMSBLong(image,0x4A504547UL);
-      (void) WriteBlobMSBLong(image,0x00000000UL);
-      (void) WriteBlobMSBLong(image,0x00000000UL);
-      (void) WriteBlobMSBLong(image,0x00000000UL);
-      (void) WriteBlobMSBLong(image,0x00000000UL);
-      (void) WriteBlobMSBLong(image,0x00000000UL);
-      (void) WriteBlobMSBLong(image,0x0018FFFFUL);
+      (void) WriteBlobMSBShort(image,0x0000);
+      (void) WriteBlobMSBLong(image,length);
+      (void) WriteBlobMSBShort(image,0x0001);
+      (void) WriteBlobMSBLong(image,0x0B466F74U);
+      (void) WriteBlobMSBLong(image,0x6F202D20U);
+      (void) WriteBlobMSBLong(image,0x4A504547U);
+      (void) WriteBlobMSBLong(image,0x00000000U);
+      (void) WriteBlobMSBLong(image,0x00000000U);
+      (void) WriteBlobMSBLong(image,0x00000000U);
+      (void) WriteBlobMSBLong(image,0x00000000U);
+      (void) WriteBlobMSBLong(image,0x00000000U);
+      (void) WriteBlobMSBLong(image,0x0018FFFFU);
       (void) WriteBlob(image,length,blob);
       if ((length & 0x01) != 0)
         (void) WriteBlobByte(image,'\0');
@@ -1883,7 +1951,7 @@ static MagickBooleanType WritePICTImage(const ImageInfo *image_info,
   else
     {
       (void) WriteBlobMSBShort(image,PictPixmapOp);
-      (void) WriteBlobMSBLong(image,(size_t) base_address);
+      (void) WriteBlobMSBLong(image,(unsigned int) base_address);
     }
   (void) WriteBlobMSBShort(image,(unsigned short) (row_bytes | 0x8000));
   (void) WriteBlobMSBShort(image,(unsigned short) bounds.top);
@@ -1969,7 +2037,7 @@ static MagickBooleanType WritePICTImage(const ImageInfo *image_info,
   else
     if (image_info->compression == JPEGCompression)
       {
-        (void) ResetMagickMemory(scanline,0,row_bytes);
+        (void) memset(scanline,0,row_bytes);
         for (y=0; y < (ssize_t) image->rows; y++)
           count+=EncodeImage(image,scanline,(size_t) (row_bytes & 0x7FFF),
             packed_scanline);
@@ -2010,8 +2078,7 @@ static MagickBooleanType WritePICTImage(const ImageInfo *image_info,
               *opacity++=ScaleQuantumToChar((Quantum) (GetPixelAlpha(image,p)));
             p+=GetPixelChannels(image);
           }
-          count+=EncodeImage(image,scanline,bytes_per_line & 0x7FFF,
-            packed_scanline);
+          count+=EncodeImage(image,scanline,bytes_per_line,packed_scanline);
           if (image->previous == (Image *) NULL)
             {
               status=SetImageProgress(image,SaveImageTag,(MagickOffsetType) y,