More buffer overflow checks

diff --git a/coders/meta.c b/coders/meta.c
index 96ad6c8f19d53cd89ea8bec5c4c481d78ae72efc..11fec1f00487b4dbb9166c10105996815c793b3d 100644 (file)
--- a/coders/meta.c
+++ b/coders/meta.c
@@ -194,49 +194,48 @@ static int stringnicmp(const char *p,const char *q,size_t n)
   return(toupper((int) *p)-toupper((int) *q));
 }
 
-static int convertHTMLcodes(char *s, int len)
+static size_t convertHTMLcodes(char *s, const size_t len)
 {
-  if (len <=0 || s==(char*) NULL || *s=='\0')
-    return 0;
+  int
+    value;
 
-  if (s[1] == '#')
+  if ((len == 0) || (s == (char*) NULL) || (*s=='\0'))
+    return(0);
+  if ((len > 3) && (s[1] == '#') && (strchr(s,';') != (char *) NULL) &&
+      (sscanf(s,"&#%d;",&value) == 1))
     {
-      int val, o;
-
-      if (sscanf(s,"&#%d;",&val) == 1)
+      size_t o = 3;
+      while (s[o] != ';')
       {
-        o = 3;
-        while (s[o] != ';')
-        {
-          o++;
-          if (o > 5)
-            break;
-        }
-        if (o < 6)
-          (void) memmove(s+1,s+1+o,strlen(s+1+o)+1);
-        *s = val;
-        return o;
+        o++;
+        if (o > 5)
+          break;
       }
+      if (o < 6)
+        (void) memmove(s+1,s+1+o,strlen(s+1+o)+1);
+      *s=value;
+      return(o);
     }
   else
     {
       int
         i,
-        codes = (int) (sizeof(html_codes) / sizeof(html_code));
+        codes;
 
+      codes=sizeof(html_codes)/sizeof(html_code);
       for (i=0; i < codes; i++)
       {
         if (html_codes[i].len <= len)
-          if (stringnicmp(s,html_codes[i].code,(size_t) html_codes[i].len) == 0)
+          if (stringnicmp(s, html_codes[i].code,(size_t) (html_codes[i].len)) == 0)
             {
               (void) memmove(s+1,s+html_codes[i].len,
                 strlen(s+html_codes[i].len)+1);
               *s=html_codes[i].val;
-              return html_codes[i].len-1;
+              return(html_codes[i].len-1);
             }
       }
     }
-  return 0;
+  return(0);
 }
 
 static char *super_fgets(char **b, int *blen, Image *file)
@@ -404,7 +403,7 @@ static ssize_t parse8BIM(Image *ifile, Image *ofile)
                   char
                     *s = &token[next-1];
 
-                  len -= (ssize_t) convertHTMLcodes(s,(int) strlen(s));
+                  len -= (ssize_t) convertHTMLcodes(s,strlen(s));
                 }
             }
 
@@ -700,7 +699,7 @@ static ssize_t parse8BIMW(Image *ifile, Image *ofile)
                   char
                     *s = &token[next-1];
 
-                  len -= (ssize_t) convertHTMLcodes(s,(int) strlen(s));
+                  len -= (ssize_t) convertHTMLcodes(s,strlen(s));
                 }
             }
 

diff --git a/coders/pdb.c b/coders/pdb.c
index 67a4c45cd9276681c03056d425908914674804b0..e205fb0e7559c3fda40e863ee507c92f728b24a6 100644 (file)
--- a/coders/pdb.c
+++ b/coders/pdb.c
@@ -823,7 +823,7 @@ static MagickBooleanType WritePDBImage(const ImageInfo *image_info,Image *image,
     image->rows*sizeof(*runlength));
   if (runlength == (unsigned char *) NULL)
     ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
-  buffer=(unsigned char *) AcquireQuantumMemory(257,sizeof(*buffer));
+  buffer=(unsigned char *) AcquireQuantumMemory(512,sizeof(*buffer));
   if (buffer == (unsigned char *) NULL)
     ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
   packet_size=(size_t) (image->depth > 8 ? 2: 1);

diff --git a/coders/rle.c b/coders/rle.c
index cc1ce594ee9e16340cf0a278596833c2d554b747..c16d9eb5fe0db42d27626cbc796a666ce7291019 100644 (file)
--- a/coders/rle.c
+++ b/coders/rle.c
@@ -228,7 +228,8 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
       ThrowReaderException(CorruptImageError,"ImproperImageHeader");
     one=1;
     map_length=one << map_length;
-    if ((number_planes == 0) || (number_planes == 2) || (bits_per_pixel != 8) ||
+    if ((number_planes == 0) || (number_planes == 2) ||
+        ((flags & 0x04) && (number_colors > 254)) || (bits_per_pixel != 8) ||
         (image->columns == 0))
       ThrowReaderException(CorruptImageError,"ImproperImageHeader");
     if (flags & 0x02)