...

diff --git a/coders/meta.c b/coders/meta.c
index 3aeeffe805805067e7e8dfa0d8364ee301b88443..121dc682bd630417460d6ae576eec29f836bd6b2 100644 (file)
--- a/coders/meta.c
+++ b/coders/meta.c
@@ -1208,16 +1208,31 @@ static Image *ReadMETAImage(const ImageInfo *image_info,
           buff=DestroyImage(buff);
           ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
         }
+      (void) memset(blob,0,length);
       AttachBlob(buff->blob,blob,length);
       if (LocaleCompare(image_info->magick,"8BIMTEXT") == 0)
         {
           length=(size_t) parse8BIM(image, buff);
+          if (length == 0)
+            {
+              blob=DetachBlob(buff->blob);
+              blob=(unsigned char *) RelinquishMagickMemory(blob);
+              buff=DestroyImage(buff);
+              ThrowReaderException(CorruptImageError,"CorruptImage");
+            }
           if (length & 1)
             (void) WriteBlobByte(buff,0x0);
         }
       else if (LocaleCompare(image_info->magick,"8BIMWTEXT") == 0)
         {
           length=(size_t) parse8BIMW(image, buff);
+          if (length == 0)
+            {
+              blob=DetachBlob(buff->blob);
+              blob=(unsigned char *) RelinquishMagickMemory(blob);
+              buff=DestroyImage(buff);
+              ThrowReaderException(CorruptImageError,"CorruptImage");
+            }
           if (length & 1)
             (void) WriteBlobByte(buff,0x0);
         }