https://github.com/ImageMagick/ImageMagick/issues/536

diff --git a/MagickCore/memory.c b/MagickCore/memory.c
index aaa17a2c85bb6060f91a8229cf1d8f3d5bddd48a..dbf644fffd6e2cdfe9523c00db7469f8c3b891b7 100644 (file)
--- a/MagickCore/memory.c
+++ b/MagickCore/memory.c
@@ -667,11 +667,13 @@ MagickExport MemoryInfo *AcquireVirtualMemory(const size_t count,
         }
       RelinquishMagickResource(MapResource,extent);
     }
-  if (memory_info->blob == NULL)
+  if ((memory_info->blob == NULL) &&
+      (AcquireMagickResource(MemoryResource,extent) != MagickFalse))
     {
       memory_info->blob=AcquireMagickMemory(extent);
       if (memory_info->blob != NULL)
         memory_info->type=UnalignedVirtualMemory;
+      RelinquishMagickResource(MemoryResource,extent);
     }
   if (memory_info->blob == NULL)
     memory_info=RelinquishVirtualMemory(memory_info);

diff --git a/coders/pcx.c b/coders/pcx.c
index a441a40afa695dca57353ae10f03954b9c0c9bfd..0c0dda15a9d12525d8056f7a4a60d1fa2dd7a451 100644 (file)
--- a/coders/pcx.c
+++ b/coders/pcx.c
@@ -358,6 +358,8 @@ static Image *ReadPCXImage(const ImageInfo *image_info,ExceptionInfo *exception)
     pcx_info.planes=(unsigned char) ReadBlobByte(image);
     if (pcx_info.planes == 0)
       ThrowPCXException(CorruptImageError,"ImproperImageHeader");
+    if (pcx_info.planes > 6)
+      ThrowPCXException(CorruptImageError,"ImproperImageHeader");
     if ((pcx_info.bits_per_pixel*pcx_info.planes) >= 64)
       ThrowPCXException(CorruptImageError,"ImproperImageHeader");
     one=1;