if ((num_images == 0) || (num_images > GetBlobSize(image)))
ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+ if (GetMagickResourceLimit(ListLengthResource) < (MagickSizeType) num_images)
+ ThrowReaderException(ImageError,"ListLengthExceedsLimit");
+
option=GetImageOption(image_info,"dds:skip-mipmaps");
if (IsStringFalse(option) != MagickFalse)
read_mipmaps=MagickTrue;
#include "MagickCore/property.h"
#include "MagickCore/quantize.h"
#include "MagickCore/quantum-private.h"
+#include "MagickCore/resource_.h"
#include "MagickCore/static.h"
#include "MagickCore/string_.h"
#include "MagickCore/string-private.h"
MagickBooleanType
status;
+ MagickSizeType
+ max_image_count;
+
register ssize_t
i;
duration=0;
opacity=(-1);
image_count=0;
+ max_image_count=GetMagickResourceLimit(ListLengthResource);
for ( ; ; )
{
count=ReadBlob(image,1,&c);
}
if (c != (unsigned char) ',')
continue;
- if (image_count != 0)
+ image_count++;
+ if (image_count != 1)
{
+ if ((MagickSizeType) image_count == max_image_count)
+ {
+ image=DestroyImageList(image);
+ global_colormap=(unsigned char *) RelinquishMagickMemory(
+ global_colormap);
+ ThrowReaderException(CorruptImageError,"ListLengthExceedsLimit");
+ }
/*
Allocate next image structure.
*/
}
image=SyncNextImageInList(image);
}
- image_count++;
/*
Read image attributes.
*/