Prevent buffer overflow in BMP & SGI coders (bug report from pwchen&rayzhong of tencent)

diff --git a/ChangeLog b/ChangeLog
index 3a9c38e2b225ac6ebd09e98113ff59268207920c..ff89b2021c6d82d80dad5472fcc9d5fa4cf74040 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,5 @@
 2016-08-15  7.0.2-10 Cristy  <quetzlzacatenango@image...>
-  * Prevent buffer overflow in BMP coder (bug report from
+  * Prevent buffer overflow in BMP & SGI coders (bug report from
     pwchen&rayzhong of tencent).
 
 2016-08-14  7.0.2-9 Cristy  <quetzlzacatenango@image...>

diff --git a/coders/sgi.c b/coders/sgi.c
index cd8c2b69e108da994e83b37ba8e743a616488e0c..1fe65e604f3e04eb9fca0783c3b927a4c2ffea5a 100644 (file)
--- a/coders/sgi.c
+++ b/coders/sgi.c
@@ -354,13 +354,15 @@ static Image *ReadSGIImage(const ImageInfo *image_info,ExceptionInfo *exception)
     image->rows=iris_info.rows;
     image->depth=(size_t) MagickMin(iris_info.depth,MAGICKCORE_QUANTUM_DEPTH);
     if (iris_info.pixel_format == 0)
-      image->depth=(size_t) MagickMin((size_t) 8*
-        iris_info.bytes_per_pixel,MAGICKCORE_QUANTUM_DEPTH);
+      image->depth=(size_t) MagickMin((size_t) 8*iris_info.bytes_per_pixel,
+        MAGICKCORE_QUANTUM_DEPTH);
     if (iris_info.depth < 3)
       {
         image->storage_class=PseudoClass;
         image->colors=iris_info.bytes_per_pixel > 1 ? 65535 : 256;
       }
+    if (EOFBlob(image) != MagickFalse)
+      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
     if ((image_info->ping != MagickFalse)  && (image_info->number_scenes != 0))
       if (image->scene >= (image_info->scene+image_info->number_scenes-1))
         break;