(no commit message)

diff --git a/coders/dpx.c b/coders/dpx.c
index 783c00732331469f32ca0088c4fc48136fac1d3a..c86a3754c666be262d690ae898a762e7148131e8 100644 (file)
--- a/coders/dpx.c
+++ b/coders/dpx.c
@@ -66,6 +66,11 @@
 #include "MagickCore/string_.h"
 #include "MagickCore/string-private.h"
 \f
+/*
+  Define declaration.
+*/
+#define MaxNumberImageElements  8
+\f
 /*
   Typedef declaration.
 */
@@ -230,7 +235,7 @@ typedef struct _DPXImageInfo
     lines_per_element;
 
   DPXImageElement
-    image_element[8];
+    image_element[MaxNumberImageElements];
 
   unsigned char
     reserve[52];
@@ -773,6 +778,8 @@ static Image *ReadDPXImage(const ImageInfo *image_info,ExceptionInfo *exception)
     Read DPX image header.
   */
   dpx.image.orientation=ReadBlobShort(image);
+  if (dpx.image.orientation > 7)
+    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   offset+=2;
   if (dpx.image.orientation != (unsigned short) ~0)
     (void) FormatImageProperty(image,"dpx:image.orientation","%d",
@@ -790,7 +797,7 @@ static Image *ReadDPXImage(const ImageInfo *image_info,ExceptionInfo *exception)
     case 7: image->orientation=RightBottomOrientation; break;
   }
   dpx.image.number_elements=ReadBlobShort(image);
-  if (dpx.image.number_elements > 8)
+  if (dpx.image.number_elements > MaxNumberImageElements)
     ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   offset+=2;
   dpx.image.pixels_per_line=ReadBlobLong(image);