(no commit message)

diff --git a/coders/icon.c b/coders/icon.c
index 0ed47e42e57aef3a70cfb5144b94e72846822d42..81879ddee0c10dc1b2b8fb0340137adb4b6ba19a 100644 (file)
--- a/coders/icon.c
+++ b/coders/icon.c
@@ -253,8 +253,9 @@ static Image *ReadICONImage(const ImageInfo *image_info,
     icon_info.size=ReadBlobLSBLong(image);
     icon_info.width=(unsigned char) ((int) ReadBlobLSBLong(image));
     icon_info.height=(unsigned char) ((int) ReadBlobLSBLong(image)/2);
-    if ((icon_file.directory[i].width == 0) && 
-        (icon_file.directory[i].height == 0))
+    icon_info.planes=ReadBlobLSBShort(image);
+    icon_info.bits_per_pixel=ReadBlobLSBShort(image);
+    if ((icon_info.planes == 18505) && (icon_info.bits_per_pixel == 21060))
       {
         Image
           *icon_image;
@@ -272,12 +273,16 @@ static Image *ReadICONImage(const ImageInfo *image_info,
           Icon image encoded as a compressed PNG image.
         */
         length=icon_file.directory[i].size;
-        png=(unsigned char *) AcquireQuantumMemory(length+12,sizeof(*png));
+        png=(unsigned char *) AcquireQuantumMemory(length+16,sizeof(*png));
         if (png == (unsigned char *) NULL)
           ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
         (void) CopyMagickMemory(png,"\211PNG\r\n\032\n\000\000\000\015",12);
-        count=ReadBlob(image,length-12,png+12);
-        if (count != (ssize_t) (length-12))
+        png[12]=(unsigned char) icon_info.planes;
+        png[13]=(unsigned char) (icon_info.planes >> 8);
+        png[14]=(unsigned char) icon_info.bits_per_pixel;
+        png[15]=(unsigned char) (icon_info.bits_per_pixel >> 8);
+        count=ReadBlob(image,length-16,png+16);
+        if (count != (ssize_t) (length-16))
           {
             png=(unsigned char *) RelinquishMagickMemory(png);
             ThrowReaderException(CorruptImageError,
@@ -285,7 +290,7 @@ static Image *ReadICONImage(const ImageInfo *image_info,
           }
         read_info=CloneImageInfo(image_info);
         (void) CopyMagickString(read_info->magick,"PNG",MaxTextExtent);
-        icon_image=BlobToImage(read_info,png,length+12,exception);
+        icon_image=BlobToImage(read_info,png,length+16,exception);
         read_info=DestroyImageInfo(read_info);
         png=(unsigned char *) RelinquishMagickMemory(png);
         if (icon_image == (Image *) NULL)
@@ -299,8 +304,6 @@ static Image *ReadICONImage(const ImageInfo *image_info,
       }
     else
       {
-        icon_info.planes=ReadBlobLSBShort(image);
-        icon_info.bits_per_pixel=ReadBlobLSBShort(image);
         if (icon_info.bits_per_pixel > 32)
           ThrowReaderException(CorruptImageError,"ImproperImageHeader");
         icon_info.compression=ReadBlobLSBLong(image);
@@ -313,9 +316,13 @@ static Image *ReadICONImage(const ImageInfo *image_info,
         image->columns=(size_t) icon_file.directory[i].width;
         if ((ssize_t) image->columns > icon_info.width)
           image->columns=(size_t) icon_info.width;
+        if (image->columns == 0)
+          image->columns=256;
         image->rows=(size_t) icon_file.directory[i].height;
         if ((ssize_t) image->rows > icon_info.height)
           image->rows=(size_t) icon_info.height;
+        if (image->rows == 0)
+          image->rows=256;
         image->depth=icon_info.bits_per_pixel;
         if (image->debug != MagickFalse)
           {