The number of colors is limited to 65535

diff --git a/coders/xpm.c b/coders/xpm.c
index 6de6c0b345fcf82c1098291600a450d1f24f5873..7d9021c376e7225b7e0799f4dd27af92c3c27726 100644 (file)
--- a/coders/xpm.c
+++ b/coders/xpm.c
@@ -336,9 +336,13 @@ static Image *ReadXPMImage(const ImageInfo *image_info,ExceptionInfo *exception)
     if (count == 4)
       break;
   }
-  if ((count != 4) || (width == 0) || (width > 10) || (image->columns == 0) ||
-      (image->rows == 0) || (image->colors == 0))
-    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+  if ((count != 4) || (width == 0) || (width > 2) ||
+      (image->columns == 0) || (image->rows == 0) ||
+      (image->colors == 0) || (image->colors > MaxColormapSize))
+    {
+      xpm_buffer=DestroyString(xpm_buffer);
+      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+    }
   /*
     Remove unquoted characters.
   */