https://github.com/ImageMagick/ImageMagick/issues/1286

diff --git a/coders/viff.c b/coders/viff.c
index 8b47d213589bc155b87e0d20059f6cd4a5b6505d..caec8c79184e1ab49d8fa8ca7de4b05f8dbc32ae 100644 (file)
--- a/coders/viff.c
+++ b/coders/viff.c
@@ -327,6 +327,13 @@ static Image *ReadVIFFImage(const ImageInfo *image_info,
       (void) ReadBlobByte(image);
     if (EOFBlob(image) != MagickFalse)
       ThrowReaderException(CorruptImageError,"UnexpectedEndOfFile");
+    number_pixels=(MagickSizeType) viff_info.columns*viff_info.rows;
+    if (number_pixels > GetBlobSize(image))
+      ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
+    if (number_pixels != (size_t) number_pixels)
+      ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+    if (number_pixels == 0)
+      ThrowReaderException(CoderError,"ImageColumnOrRowSizeIsNotSupported");
     image->columns=viff_info.rows;
     image->rows=viff_info.columns;
     image->depth=viff_info.x_bits_per_pixel <= 8 ? 8UL :
@@ -340,11 +347,6 @@ static Image *ReadVIFFImage(const ImageInfo *image_info,
     /*
       Verify that we can read this VIFF image.
     */
-    number_pixels=(MagickSizeType) viff_info.columns*viff_info.rows;
-    if (number_pixels != (size_t) number_pixels)
-      ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
-    if (number_pixels == 0)
-      ThrowReaderException(CoderError,"ImageColumnOrRowSizeIsNotSupported");
     if ((viff_info.number_data_bands < 1) || (viff_info.number_data_bands > 4))
       ThrowReaderException(CorruptImageError,"ImproperImageHeader");
     if ((viff_info.data_storage_type != VFF_TYP_BIT) &&

diff --git a/configure b/configure
index 722223e1e5f917ab1b47cc29c3fc6f4e0e625945..128452838863a901fdbdce038b26dfe72d71fe6b 100755 (executable)
--- a/configure
+++ b/configure
@@ -4555,7 +4555,7 @@ MAGICK_PATCHLEVEL_VERSION=12
 
 MAGICK_VERSION=7.0.8-12
 
-MAGICK_GIT_REVISION=14730:fffaf4148:20180829
+MAGICK_GIT_REVISION=14736:9df54d695:20180901
 
 
 # Substitute library versioning