https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12467

diff --git a/coders/bmp.c b/coders/bmp.c
index d9b84a828d00a1df5904b10a854c0e6abf1ffe2d..e0724252ae23791393d2d4a1408ac337eca69952 100644 (file)
--- a/coders/bmp.c
+++ b/coders/bmp.c
@@ -839,16 +839,16 @@ static Image *ReadBMPImage(const ImageInfo *image_info,ExceptionInfo *exception)
     if ((bmp_info.bits_per_pixel != 1) && (bmp_info.bits_per_pixel != 4) &&
         (bmp_info.bits_per_pixel != 8) && (bmp_info.bits_per_pixel != 16) &&
         (bmp_info.bits_per_pixel != 24) && (bmp_info.bits_per_pixel != 32))
-      ThrowReaderException(CorruptImageError,"UnrecognizedBitsPerPixel");
+      ThrowReaderException(CorruptImageError,"UnsupportedBitsPerPixel");
     if (bmp_info.bits_per_pixel < 16 &&
         bmp_info.number_colors > (1U << bmp_info.bits_per_pixel))
       ThrowReaderException(CorruptImageError,"UnrecognizedNumberOfColors");
     if ((bmp_info.compression == 1) && (bmp_info.bits_per_pixel != 8))
-      ThrowReaderException(CorruptImageError,"UnrecognizedBitsPerPixel");
+      ThrowReaderException(CorruptImageError,"UnsupportedBitsPerPixel");
     if ((bmp_info.compression == 2) && (bmp_info.bits_per_pixel != 4))
-      ThrowReaderException(CorruptImageError,"UnrecognizedBitsPerPixel");
+      ThrowReaderException(CorruptImageError,"UnsupportedBitsPerPixel");
     if ((bmp_info.compression == 3) && (bmp_info.bits_per_pixel < 16))
-      ThrowReaderException(CorruptImageError,"UnrecognizedBitsPerPixel");
+      ThrowReaderException(CorruptImageError,"UnsupportedBitsPerPixel");
     switch (bmp_info.compression)
     {
       case BI_RGB:

diff --git a/coders/dib.c b/coders/dib.c
index a22554fd4fd5dfd0e927fc566303df982d602b1e..5208e8d6ea726c972941fd14c8bdb4e05a0183a5 100644 (file)
--- a/coders/dib.c
+++ b/coders/dib.c
@@ -559,16 +559,16 @@ static Image *ReadDIBImage(const ImageInfo *image_info,ExceptionInfo *exception)
   if ((dib_info.bits_per_pixel != 1) && (dib_info.bits_per_pixel != 4) &&
       (dib_info.bits_per_pixel != 8) && (dib_info.bits_per_pixel != 16) &&
       (dib_info.bits_per_pixel != 24) && (dib_info.bits_per_pixel != 32))
-    ThrowReaderException(CorruptImageError,"UnrecognizedBitsPerPixel");
+    ThrowReaderException(CorruptImageError,"UnsupportedBitsPerPixel");
   if ((dib_info.bits_per_pixel < 16) &&
       (dib_info.number_colors > (unsigned int) (1UL << dib_info.bits_per_pixel)))
     ThrowReaderException(CorruptImageError,"UnrecognizedNumberOfColors");
   if ((dib_info.compression == 1) && (dib_info.bits_per_pixel != 8))
-    ThrowReaderException(CorruptImageError,"UnrecognizedBitsPerPixel");
+    ThrowReaderException(CorruptImageError,"UnsupportedBitsPerPixel");
   if ((dib_info.compression == 2) && (dib_info.bits_per_pixel != 4))
-    ThrowReaderException(CorruptImageError,"UnrecognizedBitsPerPixel");
+    ThrowReaderException(CorruptImageError,"UnsupportedBitsPerPixel");
   if ((dib_info.compression == 3) && (dib_info.bits_per_pixel < 16))
-    ThrowReaderException(CorruptImageError,"UnrecognizedBitsPerPixel");
+    ThrowReaderException(CorruptImageError,"UnsupportedBitsPerPixel");
   switch (dib_info.compression)
   {
     case BI_RGB:

diff --git a/coders/palm.c b/coders/palm.c
index 536d0df415f4243dd000d7be8322d3276714335c..c8a85d83cc435fe8bcaa45e16d3724ef89eb5557 100644 (file)
--- a/coders/palm.c
+++ b/coders/palm.c
@@ -322,7 +322,7 @@ static Image *ReadPALMImage(const ImageInfo *image_info,
     if ((bits_per_pixel != 1) && (bits_per_pixel != 2) &&
         (bits_per_pixel != 4) && (bits_per_pixel != 8) &&
         (bits_per_pixel != 16))
-      ThrowReaderException(CorruptImageError,"UnrecognizedBitsPerPixel");
+      ThrowReaderException(CorruptImageError,"UnsupportedBitsPerPixel");
     version=(size_t) ReadBlobByte(image);
     if ((version != 0) && (version != 1) && (version != 2))
       ThrowReaderException(CorruptImageError,"FileFormatVersionMismatch");

diff --git a/coders/tiff.c b/coders/tiff.c
index 726b07ae093bd3ccdaaaa7209459b4f8e067131e..bfa162741a3d17db46c9495c9e2554c712d91e1c 100644 (file)
--- a/coders/tiff.c
+++ b/coders/tiff.c
@@ -1387,6 +1387,12 @@ RestoreMSCWarning
         TIFFClose(tiff);
         ThrowReaderException(CorruptImageError,"ImproperImageHeader");
       }
+    if (((sample_format != SAMPLEFORMAT_IEEEFP) || (bits_per_sample == 64)) &&
+        ((bits_per_sample <= 0) || (bits_per_sample > 32)))
+      {
+        TIFFClose(tiff);
+        ThrowReaderException(CorruptImageError,"UnsupportedBitsPerPixel");
+      }
     if (sample_format == SAMPLEFORMAT_IEEEFP)
       (void) SetImageProperty(image,"quantum:format","floating-point",
         exception);

diff --git a/config/english.xml b/config/english.xml
index 780b3f19bfd4e21365a2e1f82d3cf68205be9fca..17e83460d26c00f1086bfe7a627972e3f9c83fca 100644 (file)
--- a/config/english.xml
+++ b/config/english.xml
@@ -324,15 +324,15 @@
           <message name="UnrecognizedAlphaChannelOption">
             unrecognized alpha channel option
           </message>
-          <message name="UnrecognizedBitsPerPixel">
-            unrecognized bits per pixel
-          </message>
           <message name="UnrecognizedImageCompression">
             unrecognized compression
           </message>
           <message name="UnrecognizedNumberOfColors">
             unrecognized number of colors
           </message>
+          <message name="UnsupportedBitsPerPixel">
+            unsupported bits per pixel
+          </message>
         </error>
         <fatalerror>
           <message name="UnableToPersistKey">

diff --git a/config/francais.xml b/config/francais.xml
index 11126372fbb92fa6e3c24ca02ddc1cb4f3114df8..9f47196a1d8c1207dcaf58a7fa3765c0f7fc701b 100644 (file)
--- a/config/francais.xml
+++ b/config/francais.xml
@@ -324,15 +324,15 @@
           <message name="UnrecognizedAlphaChannelOption">
             alpha de canal l'option non reconnus
           </message>
-          <message name="UnrecognizedBitsPerPixel">
-            bits par pixel non reconnus
-          </message>
           <message name="UnrecognizedImageCompression">
             compression non reconnue
           </message>
           <message name="UnrecognizedNumberOfColors">
             nombre de couleurs non reconnu
           </message>
+          <message name="UnsupportedBitsPerPixel">
+            bits par pixel non supporté
+          </message>
         </error>
         <fatalerror>
           <message name="UnableToPersistKey">