JNG is limited to 65535 columns / rows

diff --git a/MagickCore/cache.c b/MagickCore/cache.c
index 49edbde95d957f620b664faf54227295a743061a..5131918477393c61ff3e14a2c5c7da608062ebaa 100644 (file)
--- a/MagickCore/cache.c
+++ b/MagickCore/cache.c
@@ -1658,8 +1658,8 @@ MagickExport CacheType GetImagePixelCacheType(const Image *image)
 %
 */
 
-static inline MagickBooleanType CopyPixel(const Image *image,const Quantum *source,
-  Quantum *destination)
+static inline MagickBooleanType CopyPixel(const Image *image,
+  const Quantum *source,Quantum *destination)
 {
   register ssize_t
     i;
@@ -1667,10 +1667,14 @@ static inline MagickBooleanType CopyPixel(const Image *image,const Quantum *sour
   if (source == (const Quantum *) NULL)
     {
       destination[RedPixelChannel]=ClampToQuantum(image->background_color.red);
-      destination[GreenPixelChannel]=ClampToQuantum(image->background_color.green);
-      destination[BluePixelChannel]=ClampToQuantum(image->background_color.blue);
-      destination[BlackPixelChannel]=ClampToQuantum(image->background_color.black);
-      destination[AlphaPixelChannel]=ClampToQuantum(image->background_color.alpha);
+      destination[GreenPixelChannel]=ClampToQuantum(
+        image->background_color.green);
+      destination[BluePixelChannel]=ClampToQuantum(
+        image->background_color.blue);
+      destination[BlackPixelChannel]=ClampToQuantum(
+        image->background_color.black);
+      destination[AlphaPixelChannel]=ClampToQuantum(
+        image->background_color.alpha);
       return(MagickFalse);
     }
   for (i=0; i < (ssize_t) GetPixelChannels(image); i++)

diff --git a/coders/png.c b/coders/png.c
index 1b6ce618add06526b7520d92186518bd74f1f633..6b40d20fdef9187589436481de77a2495dcdfcad 100644 (file)
--- a/coders/png.c
+++ b/coders/png.c
@@ -2940,6 +2940,10 @@ static Image *ReadOnePNGImage(MngInfo *mng_info,
   image->columns=ping_width;
   image->rows=ping_height;
 
+  status=SetImageExtent(image,image->columns,image->rows,exception);
+  if (status == MagickFalse)
+    return(DestroyImageList(image));
+
   if (((int) ping_color_type == PNG_COLOR_TYPE_GRAY) ||
       ((int) ping_color_type == PNG_COLOR_TYPE_GRAY_ALPHA))
     {
@@ -4649,6 +4653,10 @@ static Image *ReadOneJNGImage(MngInfo *mng_info,
   image->rows=jng_height;
   image->columns=jng_width;
 
+  status=SetImageExtent(image,image->columns,image->rows,exception);
+  if (status == MagickFalse)
+    return(DestroyImageList(image));
+
   for (y=0; y < (ssize_t) image->rows; y++)
   {
     s=GetVirtualPixels(jng_image,0,y,image->columns,1,exception);
@@ -12798,6 +12806,8 @@ static MagickBooleanType WriteJNGImage(const ImageInfo *image_info,Image *image,
   status=OpenBlob(image_info,image,WriteBinaryBlobMode,exception);
   if (status == MagickFalse)
     return(status);
+  if ((image->columns > 65535UL) || (image->rows > 65535UL))
+    ThrowWriterException(ImageError,"WidthOrHeightExceedsLimit");
 
   /*
     Allocate a MngInfo structure.