https://github.com/ImageMagick/ImageMagick/issues/1607

diff --git a/coders/pcx.c b/coders/pcx.c
index a8cbd5797774f778f0e117549fe16b1f0ab4c048..600603c693bc0febc67d6573a6fd62c55252699f 100644 (file)
--- a/coders/pcx.c
+++ b/coders/pcx.c
@@ -914,8 +914,6 @@ static MagickBooleanType WritePCXImage(const ImageInfo *image_info,Image *image,
   status=OpenBlob(image_info,image,WriteBinaryBlobMode,exception);
   if (status == MagickFalse)
     return(status);
-  if ((image->columns > 65535UL) || (image->rows > 65535UL))
-    ThrowWriterException(ImageError,"WidthOrHeightExceedsLimit");
   page_table=(MagickOffsetType *) NULL;
   if ((LocaleCompare(image_info->magick,"DCX") == 0) ||
       ((GetNextImageInList(image) != (Image *) NULL) &&
@@ -982,7 +980,8 @@ static MagickBooleanType WritePCXImage(const ImageInfo *image_info,Image *image,
           pcx_info.planes++;
       }
     length=(((size_t) image->columns*pcx_info.bits_per_pixel+7)/8);
-    if (length > 65535UL)
+    if ((image->columns > 65535UL) || (image->rows > 65535UL) ||
+        (length > 65535UL))
       {
         if (page_table != (MagickOffsetType *) NULL)
           page_table=(MagickOffsetType *) RelinquishMagickMemory(page_table);