https://github.com/ImageMagick/ImageMagick/issues/519

diff --git a/coders/cin.c b/coders/cin.c
index d85be62dd1d297f2dd716d70758f5357d0e3f423..ff2fa9a4a63d5d7fdbb475f1a8ce428f50f0c3a9 100644 (file)
--- a/coders/cin.c
+++ b/coders/cin.c
@@ -706,7 +706,10 @@ static Image *ReadCINImage(const ImageInfo *image_info,ExceptionInfo *exception)
       /*
         User defined data.
       */
-      profile=BlobToStringInfo((const unsigned char *) NULL,cin.file.user_length);
+      if (cin.file.user_length > GetBlobSize(image))
+        ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+      profile=BlobToStringInfo((const unsigned char *) NULL,
+        cin.file.user_length);
       if (profile == (StringInfo *) NULL)
         ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
       offset+=ReadBlob(image,GetStringInfoLength(profile),
@@ -814,6 +817,7 @@ ModuleExport size_t RegisterCINImage(void)
   entry->decoder=(DecodeImageHandler *) ReadCINImage;
   entry->encoder=(EncodeImageHandler *) WriteCINImage;
   entry->magick=(IsImageFormatHandler *) IsCIN;
+  entry->flags|=CoderDecoderSeekableStreamFlag
   entry->flags^=CoderAdjoinFlag;
   (void) RegisterMagickInfo(entry);
   return(MagickImageCoderSignature);

diff --git a/coders/rle.c b/coders/rle.c
index 687247d00ee0b4f2d43cc94fc51273899ac9e5fe..93ad52180944fa150a79b6c368ff34c00037d5bb 100644 (file)
--- a/coders/rle.c
+++ b/coders/rle.c
@@ -739,7 +739,7 @@ ModuleExport size_t RegisterRLEImage(void)
   entry=AcquireMagickInfo("RLE","RLE","Utah Run length encoded image");
   entry->decoder=(DecodeImageHandler *) ReadRLEImage;
   entry->magick=(IsImageFormatHandler *) IsRLE;
-  entry->flags^=CoderBlobSupportFlag;
+  entry->flags|=CoderDecoderSeekableStreamFlag;
   entry->flags^=CoderAdjoinFlag;
   (void) RegisterMagickInfo(entry);
   return(MagickImageCoderSignature);