http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=26787

diff --git a/coders/xpm.c b/coders/xpm.c
index 8c3e9d6e732953bbc406d60c3b3b0551f0c79383..ff92b040d7db17d52a40ae2c532cdfc96e92a695 100644 (file)
--- a/coders/xpm.c
+++ b/coders/xpm.c
@@ -159,8 +159,9 @@ static size_t CopyXPMColor(char *destination,const char *source,size_t length)
   p=source;
   while (length-- && (*p != '\0'))
     *destination++=(*p++);
-  *destination='\0';
-  return((size_t) (p-source));
+  if (length != 0)
+    *destination='\0';
+  return((size_t) (p-source-1));
 }
 
 static char *NextXPMLine(char *p)
@@ -371,7 +372,7 @@ static Image *ReadXPMImage(const ImageInfo *image_info,ExceptionInfo *exception)
   {
     p=next;
     next=NextXPMLine(p);
-    (void) CopyXPMColor(key,p,MagickMin((size_t) width,MaxTextExtent));
+    (void) CopyXPMColor(key,p,MagickMin((size_t) width,MaxTextExtent-1));
     status=AddValueToSplayTree(xpm_colors,ConstantString(key),(void *) j);
     /*
       Parse color.
@@ -386,7 +387,7 @@ static Image *ReadXPMImage(const ImageInfo *image_info,ExceptionInfo *exception)
           break;
         if (next != (char *) NULL)
           (void) CopyXPMColor(target,q,MagickMin((size_t) (next-q),
-            MaxTextExtent));
+            MaxTextExtent-1));
         else
           (void) CopyMagickString(target,q,MaxTextExtent);
         q=ParseXPMColor(target,MagickFalse);
@@ -430,7 +431,7 @@ static Image *ReadXPMImage(const ImageInfo *image_info,ExceptionInfo *exception)
           break;
         for (x=0; x < (ssize_t) image->columns; x++)
         {
-          p+=CopyXPMColor(key,p,MagickMin(width,MaxTextExtent));
+          p+=CopyXPMColor(key,p,MagickMin(width,MaxTextExtent-1));
           j=(ssize_t) GetValueFromSplayTree(xpm_colors,key);
           if (image->storage_class == PseudoClass)
             SetPixelIndex(image,(Quantum) j,r);