...

diff --git a/coders/xwd.c b/coders/xwd.c
index 0074811a060df64305a41632b0ecca116ad2349f..b5f09e0907923c769f0ae033a1e2df69984d2b49 100644 (file)
--- a/coders/xwd.c
+++ b/coders/xwd.c
@@ -238,7 +238,12 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)
     ThrowReaderException(CorruptImageError,"FileFormatVersionMismatch");
   if (header.header_size < sz_XWDheader)
     ThrowReaderException(CorruptImageError,"ImproperImageHeader");
-  if ((MagickSizeType) header.xoffset >= GetBlobSize(image))
+  if (header.xoffset >= header.pixmap_width)
+    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+  if (((header.pixmap_depth | header.pixmap_format | header.xoffset | 
+        header.pixmap_width | header.pixmap_height | header.bitmap_pad | 
+        header.bytes_per_line | header.byte_order | header.bitmap_unit | 
+        header.bitmap_bit_order | header.bits_per_pixel) >> 31) != 0)
     ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   switch (header.visual_class)
   {
@@ -353,10 +358,11 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)
   ximage->red_mask=header.red_mask;
   ximage->green_mask=header.green_mask;
   ximage->blue_mask=header.blue_mask;
-  if ((ximage->width < 0) || (ximage->height < 0) || (ximage->depth < 0) ||
-      (ximage->format < 0) || (ximage->byte_order < 0) ||
-      (ximage->bitmap_bit_order < 0) || (ximage->bitmap_pad < 0) ||
-      (ximage->bytes_per_line < 0))
+  if ((ximage->depth < 0) || (ximage->format < 0) || (ximage->xoffset < 0) ||
+      (ximage->width < 0) || (ximage->height < 0) || (ximage->bitmap_pad < 0) ||
+      (ximage->bytes_per_line < 0) || (ximage->byte_order < 0) ||
+      (ximage->bitmap_unit < 0) || (ximage->bitmap_bit_order < 0) ||
+      (ximage->bits_per_pixel < 0))
     {
       ximage=(XImage *) RelinquishMagickMemory(ximage);
       ThrowReaderException(CorruptImageError,"ImproperImageHeader");
@@ -691,7 +697,6 @@ ModuleExport size_t RegisterXWDImage(void)
   entry->encoder=(EncodeImageHandler *) WriteXWDImage;
 #endif
   entry->magick=(IsImageFormatHandler *) IsXWD;
-  entry->flags|=CoderDecoderSeekableStreamFlag;
   entry->flags^=CoderAdjoinFlag;
   (void) RegisterMagickInfo(entry);
   return(MagickImageCoderSignature);