(no commit message)

diff --git a/coders/pcx.c b/coders/pcx.c
index b27cf961a3a7d865ec17e49872dae46c74493a62..cf262dd867cd04ee9efc60cb76ee2201825c94b8 100644 (file)
--- a/coders/pcx.c
+++ b/coders/pcx.c
@@ -364,6 +364,8 @@ static Image *ReadPCXImage(const ImageInfo *image_info,ExceptionInfo *exception)
     count=ReadBlob(image,3*image->colors,pcx_colormap);
     pcx_info.reserved=(unsigned char) ReadBlobByte(image);
     pcx_info.planes=(unsigned char) ReadBlobByte(image);
+    if ((pcx_info.bits_per_pixel*pcx_info.planes) >= 64)
+      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
     one=1;
     if ((pcx_info.bits_per_pixel != 8) || (pcx_info.planes == 1))
       if ((pcx_info.version == 3) || (pcx_info.version == 5) ||

diff --git a/coders/pict.c b/coders/pict.c
index 01240cdc8277d17a591ed6f3bebbd9650035c156..26b8793974701be7d41b7b7cd0b5ae22eb0748c2 100644 (file)
--- a/coders/pict.c
+++ b/coders/pict.c
@@ -1335,6 +1335,8 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
             /*
               Skip to next op code.
             */
+            if (code < 0)
+              break;
             if (codes[code].length == -1)
               (void) ReadBlobMSBShort(image);
             else