https://github.com/ImageMagick/ImageMagick/issues/471

diff --git a/coders/xwd.c b/coders/xwd.c
index 702370337e228d914b05952d8ad6a794f1a5b013..59e770d35abb9d5faa4c52408d9f24466cffc661 100644 (file)
--- a/coders/xwd.c
+++ b/coders/xwd.c
@@ -322,6 +322,8 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)
         color;
 
       length=(size_t) header.ncolors;
+      if (length > ((~0UL)/sizeof(*colors)))
+        ThrowReaderException(CorruptImageError,"ImproperImageHeader");
       colors=(XColor *) AcquireQuantumMemory(length,sizeof(*colors));
       if (colors == (XColor *) NULL)
         {