https://github.com/ImageMagick/ImageMagick/issues/1295

diff --git a/coders/dib.c b/coders/dib.c
index 6b2ecc0616112d13580e7d975326452b0bd9bb9b..26257d9a66bba2fb46fa1a2cb44eb20b98e6bb0d 100644 (file)
--- a/coders/dib.c
+++ b/coders/dib.c
@@ -590,6 +590,8 @@ static Image *ReadDIBImage(const ImageInfo *image_info,ExceptionInfo *exception)
     UndefinedPixelTrait;
   if ((dib_info.number_colors > 256) || (dib_info.colors_important > 256))
     ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+  if ((dib_info.image_size != 0U) && (dib_info.image_size > GetBlobSize(image)))
+    ThrowReaderException(CorruptImageError,"UnexpectedEndOfFile");
   if ((dib_info.number_colors != 0) || (dib_info.bits_per_pixel < 16))
     {
       size_t
@@ -1016,6 +1018,7 @@ ModuleExport size_t RegisterDIBImage(void)
   entry->magick=(IsImageFormatHandler *) IsDIB;
   entry->flags^=CoderAdjoinFlag;
   entry->flags|=CoderStealthFlag;
+  entry->flags|=CoderDecoderSeekableStreamFlag;
   (void) RegisterMagickInfo(entry);
   entry=AcquireMagickInfo("DIB","ICODIB",
     "Microsoft Windows 3.X Packed Device-Independent Bitmap");
@@ -1023,6 +1026,7 @@ ModuleExport size_t RegisterDIBImage(void)
   entry->magick=(IsImageFormatHandler *) IsDIB;
   entry->flags^=CoderAdjoinFlag;
   entry->flags|=CoderStealthFlag;
+  entry->flags|=CoderDecoderSeekableStreamFlag;
   (void) RegisterMagickInfo(entry);
   return(MagickImageCoderSignature);
 }

diff --git a/coders/pcx.c b/coders/pcx.c
index 4609a41e3124e0d21d78a62bf5022d33c610d1b5..98425258815f8e986b7120a7be1b484fdefb4841 100644 (file)
--- a/coders/pcx.c
+++ b/coders/pcx.c
@@ -335,6 +335,8 @@ static Image *ReadPCXImage(const ImageInfo *image_info,ExceptionInfo *exception)
     pcx_info.bottom=ReadBlobLSBShort(image);
     pcx_info.horizontal_resolution=ReadBlobLSBShort(image);
     pcx_info.vertical_resolution=ReadBlobLSBShort(image);
+    if (EOFBlob(image) != MagickFalse)
+      ThrowPCXException(CorruptImageError,"UnexpectedEndOfFile");
     /*
       Read PCX raster colormap.
     */
@@ -354,6 +356,8 @@ static Image *ReadPCXImage(const ImageInfo *image_info,ExceptionInfo *exception)
     if ((image_info->ping != MagickFalse) && (image_info->number_scenes != 0))
       if (image->scene >= (image_info->scene+image_info->number_scenes-1))
         break;
+    if ((MagickOffsetType) (image->columns*image->rows/255) > GetBlobSize(image))
+      ThrowPCXException(CorruptImageError,"InsufficientImageDataInFile");
     status=SetImageExtent(image,image->columns,image->rows,exception);
     if (status == MagickFalse)
       ThrowPCXException(exception->severity,exception->reason);

diff --git a/coders/pnm.c b/coders/pnm.c
index 9fbadd539258c980ccf485b2cacefc99c2c6dbca..09eee0dac7e5cbc0a7b7c1e3e568868449d9b9cf 100644 (file)
--- a/coders/pnm.c
+++ b/coders/pnm.c
@@ -440,6 +440,8 @@ static Image *ReadPNMImage(const ImageInfo *image_info,ExceptionInfo *exception)
     if ((image_info->ping != MagickFalse) && (image_info->number_scenes != 0))
       if (image->scene >= (image_info->scene+image_info->number_scenes-1))
         break;
+    if ((MagickOffsetType) (image->columns*image->rows/8) > GetBlobSize(image))
+      ThrowPNMException(CorruptImageError,"InsufficientImageDataInFile");
     status=SetImageExtent(image,image->columns,image->rows,exception);
     if (status == MagickFalse)
       {
@@ -1423,33 +1425,39 @@ ModuleExport size_t RegisterPNMImage(void)
   entry->decoder=(DecodeImageHandler *) ReadPNMImage;
   entry->encoder=(EncodeImageHandler *) WritePNMImage;
   entry->mime_type=ConstantString("image/x-portable-pixmap");
+  entry->flags|=CoderDecoderSeekableStreamFlag;
   (void) RegisterMagickInfo(entry);
   entry=AcquireMagickInfo("PNM","PBM",
     "Portable bitmap format (black and white)");
   entry->decoder=(DecodeImageHandler *) ReadPNMImage;
   entry->encoder=(EncodeImageHandler *) WritePNMImage;
   entry->mime_type=ConstantString("image/x-portable-bitmap");
+  entry->flags|=CoderDecoderSeekableStreamFlag;
   (void) RegisterMagickInfo(entry);
   entry=AcquireMagickInfo("PNM","PFM","Portable float format");
   entry->decoder=(DecodeImageHandler *) ReadPNMImage;
   entry->encoder=(EncodeImageHandler *) WritePNMImage;
   entry->flags|=CoderEndianSupportFlag;
+  entry->flags|=CoderDecoderSeekableStreamFlag;
   (void) RegisterMagickInfo(entry);
   entry=AcquireMagickInfo("PNM","PGM","Portable graymap format (gray scale)");
   entry->decoder=(DecodeImageHandler *) ReadPNMImage;
   entry->encoder=(EncodeImageHandler *) WritePNMImage;
   entry->mime_type=ConstantString("image/x-portable-greymap");
+  entry->flags|=CoderDecoderSeekableStreamFlag;
   (void) RegisterMagickInfo(entry);
   entry=AcquireMagickInfo("PNM","PNM","Portable anymap");
   entry->decoder=(DecodeImageHandler *) ReadPNMImage;
   entry->encoder=(EncodeImageHandler *) WritePNMImage;
   entry->magick=(IsImageFormatHandler *) IsPNM;
   entry->mime_type=ConstantString("image/x-portable-pixmap");
+  entry->flags|=CoderDecoderSeekableStreamFlag;
   (void) RegisterMagickInfo(entry);
   entry=AcquireMagickInfo("PNM","PPM","Portable pixmap format (color)");
   entry->decoder=(DecodeImageHandler *) ReadPNMImage;
   entry->encoder=(EncodeImageHandler *) WritePNMImage;
   entry->mime_type=ConstantString("image/x-portable-pixmap");
+  entry->flags|=CoderDecoderSeekableStreamFlag;
   (void) RegisterMagickInfo(entry);
   return(MagickImageCoderSignature);
 }

diff --git a/coders/sgi.c b/coders/sgi.c
index ce051a10b898f98f4f3815d88122b892f4df0a16..38fd2b152229adb93890b0715fa9d43ee9948701 100644 (file)
--- a/coders/sgi.c
+++ b/coders/sgi.c
@@ -373,6 +373,8 @@ static Image *ReadSGIImage(const ImageInfo *image_info,ExceptionInfo *exception)
     if ((image_info->ping != MagickFalse) && (image_info->number_scenes != 0))
       if (image->scene >= (image_info->scene+image_info->number_scenes-1))
         break;
+    if ((MagickOffsetType) (image->columns*image->rows/255) > GetBlobSize(image))
+      ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
     status=SetImageExtent(image,image->columns,image->rows,exception);
     if (status != MagickFalse)
       status=ResetImagePixels(image,exception);