...

diff --git a/coders/bmp.c b/coders/bmp.c
index 7cf8b7d24b60dc904061c51871d5815203a7c19e..3ba5348c4157a331d4f9d15bd4076dd1d2002777 100644 (file)
--- a/coders/bmp.c
+++ b/coders/bmp.c
@@ -232,7 +232,7 @@ static MagickBooleanType DecodeImage(Image *image,const size_t compression,
     MagickBooleanType
       status;
 
-    if ((p < pixels) || (p > q))
+    if ((p < pixels) || (p >= q))
       break;
     count=ReadBlobByte(image);
     if (count == EOF)
@@ -286,8 +286,14 @@ static MagickBooleanType DecodeImage(Image *image,const size_t compression,
             /*
               Delta mode.
             */
-            x+=ReadBlobByte(image);
-            y+=ReadBlobByte(image);
+            byte=ReadBlobByte(image);
+            if (byte == EOF)
+              break;
+            x+=byte;
+            byte=ReadBlobByte(image);
+            if (byte == EOF)
+              break;
+            y+=byte;
             p=pixels+y*image->columns+x;
             break;
           }
@@ -297,6 +303,8 @@ static MagickBooleanType DecodeImage(Image *image,const size_t compression,
               Absolute mode.
             */
             count=(int) MagickMin((ssize_t) count,(ssize_t) (q-p));
+            if (count < 0)
+              break;
             if (compression == BI_RLE8)
               for (i=0; i < (ssize_t) count; i++)
               {