(no commit message)

diff --git a/coders/palm.c b/coders/palm.c
index 96dda90044c55a07f5fa73d6bf2823de1b2eb476..aa7f7aa6892d3723f0c7aa92fe3c21b62f0fb3a2 100644 (file)
--- a/coders/palm.c
+++ b/coders/palm.c
@@ -322,7 +322,8 @@ static Image *ReadPALMImage(const ImageInfo *image_info,
         (bits_per_pixel != 16))
       ThrowReaderException(CorruptImageError,"UnrecognizedBitsPerPixel");
     version=(size_t) ReadBlobByte(image);
-    (void) version;
+    if ((version != 0) && (version != 1) && (version != 2))
+      ThrowReaderException(CorruptImageError,"FileFormatVersionMismatch");
     nextDepthOffset=(size_t) ReadBlobMSBShort(image);
     transparentIndex=(size_t) ReadBlobByte(image);
     compressionType=(size_t) ReadBlobByte(image);
@@ -375,17 +376,15 @@ static Image *ReadPALMImage(const ImageInfo *image_info,
           }
         }
       else
+        for (i=0; i < (ssize_t) (1L << bits_per_pixel); i++)
         {
-          for (i=0; i < (ssize_t) (1L << bits_per_pixel); i++)
-          {
-            index=ConstrainColormapIndex(image,255-i,exception);
-            image->colormap[index].red=(MagickRealType)
-              ScaleCharToQuantum(PalmPalette[i][0]);
-            image->colormap[index].green=(MagickRealType)
-              ScaleCharToQuantum(PalmPalette[i][1]);
-            image->colormap[index].blue=(MagickRealType)
-              ScaleCharToQuantum(PalmPalette[i][2]);
-          }
+          index=ConstrainColormapIndex(image,255-i,exception);
+          image->colormap[index].red=(MagickRealType)
+            ScaleCharToQuantum(PalmPalette[i][0]);
+          image->colormap[index].green=(MagickRealType)
+            ScaleCharToQuantum(PalmPalette[i][1]);
+          image->colormap[index].blue=(MagickRealType)
+            ScaleCharToQuantum(PalmPalette[i][2]);
         }
       }
     if (flags & PALM_IS_COMPRESSED_FLAG)
@@ -417,13 +416,15 @@ static Image *ReadPALMImage(const ImageInfo *image_info,
       ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
     }
     mask=(size_t) (1U << bits_per_pixel)-1;
-    for (y = 0; y < (ssize_t) image->rows; y++)
+    for (y=0; y < (ssize_t) image->rows; y++)
     {
       if ((flags & PALM_IS_COMPRESSED_FLAG) == 0)
         {
           /* TODO move out of loop! */
           image->compression=NoCompression;
           count=ReadBlob(image,bytes_per_row,one_row);
+          if (count != (ssize_t) bytes_per_row)
+            break;
         }
       else
         {
@@ -454,6 +455,8 @@ static Image *ReadPALMImage(const ImageInfo *image_info,
               for (i=0; i < (ssize_t) bytes_per_row; i+=8)
               {
                 count=(ssize_t) ReadBlobByte(image);
+                if (count < 0)
+                  break;
                 byte=(size_t) MagickMin((ssize_t) bytes_per_row-i,8);
                 for (bit=0; bit < byte; bit++)
                 {
@@ -549,13 +552,9 @@ static Image *ReadPALMImage(const ImageInfo *image_info,
         */
         totalOffset+=(MagickOffsetType) (nextDepthOffset*4);
         if (totalOffset >= (MagickOffsetType) GetBlobSize(image))
-          {
-            ThrowReaderException(CorruptImageError,"ImproperImageHeader");
-          }
+          ThrowReaderException(CorruptImageError,"ImproperImageHeader")
         else
-          {
-            seekNextDepth=SeekBlob(image,totalOffset,SEEK_SET);
-          }
+          seekNextDepth=SeekBlob(image,totalOffset,SEEK_SET);
         if (seekNextDepth != totalOffset)
           ThrowReaderException(CorruptImageError,"ImproperImageHeader");
         /*