...

diff --git a/coders/xwd.c b/coders/xwd.c
index 5ecbc34c5c33926ff68cf353232ef247b9045459..b6f26ec7b84f524501c56d3454bf8e696a90e517 100644 (file)
--- a/coders/xwd.c
+++ b/coders/xwd.c
@@ -251,7 +251,7 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)
     case PseudoColor:
     {
       if ((header.bits_per_pixel < 1) || (header.bits_per_pixel > 15) ||
-          (header.colormap_entries == 0))
+          (header.ncolors == 0))
         ThrowReaderException(CorruptImageError,"ImproperImageHeader");
       break;
     }
@@ -318,6 +318,8 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)
     default:
       ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   }
+  if (header.ncolors > 65535)
+    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   if (((header.bitmap_pad % 8) != 0) || (header.bitmap_pad > 32))
     ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   length=(size_t) (header.header_size-sz_XWDheader);