(no commit message)

diff --git a/coders/dpx.c b/coders/dpx.c
index 8a77f335e027671cd8d00eebbec5f55bd947ef7a..8f18e0a3871d1ffe7c9bcfd831454f34511536cb 100644 (file)
--- a/coders/dpx.c
+++ b/coders/dpx.c
@@ -790,6 +790,8 @@ static Image *ReadDPXImage(const ImageInfo *image_info,ExceptionInfo *exception)
     case 7: image->orientation=RightBottomOrientation; break;
   }
   dpx.image.number_elements=ReadBlobShort(image);
+  if (dpx.image.number_elements > 8)
+    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   offset+=2;
   dpx.image.pixels_per_line=ReadBlobLong(image);
   offset+=4;

diff --git a/coders/xwd.c b/coders/xwd.c
index 01c950d3f7efb4130b8f54001418dfbb0446ba39..bd3fa487b6726dddc342ef8fc74f61dc56a8677a 100644 (file)
--- a/coders/xwd.c
+++ b/coders/xwd.c
@@ -272,6 +272,8 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)
   if ((ximage->depth < 0) || (ximage->width < 0) || (ximage->height < 0) ||
       (ximage->bitmap_pad < 0) || (ximage->bytes_per_line < 0))
     ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+  if ((ximage->width > 65535) || (ximage->height > 65535))
+    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   if ((ximage->bits_per_pixel > 32) || (ximage->bitmap_unit > 32))
     ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   x_status=XInitImage(ximage);