https://github.com/ImageMagick/ImageMagick/issues/1425

diff --git a/coders/bmp.c b/coders/bmp.c
index edc5cda546279ec543cead0e0b7352fd46534b03..d9b84a828d00a1df5904b10a854c0e6abf1ffe2d 100644 (file)
--- a/coders/bmp.c
+++ b/coders/bmp.c
@@ -1844,8 +1844,8 @@ static MagickBooleanType WriteBMPImage(const ImageInfo *image_info,Image *image,
     /*
       Convert MIFF to BMP raster pixels.
     */
-    pixel_info=AcquireVirtualMemory(image->rows,
-      MagickMax(bytes_per_line,image->columns+256UL)*sizeof(*pixels));
+    pixel_info=AcquireVirtualMemory(image->rows,MagickMax(bytes_per_line,
+      image->columns+256UL)*sizeof(*pixels));
     if (pixel_info == (MemoryInfo *) NULL)
       ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
     pixels=(unsigned char *) GetVirtualMemoryBlob(pixel_info);

diff --git a/coders/dib.c b/coders/dib.c
index 5ecb5f99f880c28cc9001444c8b01a5a440f5a24..a22554fd4fd5dfd0e927fc566303df982d602b1e 100644 (file)
--- a/coders/dib.c
+++ b/coders/dib.c
@@ -590,9 +590,11 @@ static Image *ReadDIBImage(const ImageInfo *image_info,ExceptionInfo *exception)
     UndefinedPixelTrait;
   if ((dib_info.number_colors > 256) || (dib_info.colors_important > 256))
     ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+  if ((dib_info.number_colors != 0) && (dib_info.bits_per_pixel > 8))
+    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   if ((dib_info.image_size != 0U) && (dib_info.image_size > GetBlobSize(image)))
     ThrowReaderException(CorruptImageError,"UnexpectedEndOfFile");
-  if ((dib_info.number_colors != 0) || (dib_info.bits_per_pixel < 16))
+  if ((dib_info.number_colors != 0) || (dib_info.bits_per_pixel < 8))
     {
       size_t
         one;

diff --git a/coders/pnm.c b/coders/pnm.c
index e3674286f84759692f71825ca880457ce8a54608..7c1aec8d0152735601d36b76d86bc9e950f90632 100644 (file)
--- a/coders/pnm.c
+++ b/coders/pnm.c
@@ -174,7 +174,7 @@ static int PNMComment(Image *image,CommentInfo *comment_info,
         p=comment_info->comment+strlen(comment_info->comment);
       }
     c=ReadBlobByte(image);
-    if ((c != EOF) && (c != (int) '\n') && (c != (int) '\r'))
+    if (c != EOF)
       {
         *p=(char) c;
         *(p+1)='\0';