(no commit message)

diff --git a/coders/xwd.c b/coders/xwd.c
index 6a9c8e1e67e9b464dd7b5e61cc2a00a4848bc186..e7534c1b43e6f2d030f17e3885b893a7d75da33e 100644 (file)
--- a/coders/xwd.c
+++ b/coders/xwd.c
@@ -220,11 +220,8 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)
      Read in header information.
   */
   count=ReadBlob(image,sz_XWDheader,(unsigned char *) &header);
-  if (count == 0)
+  if (count != sz_XWDheader)
     ThrowReaderException(CorruptImageError,"UnableToReadImageHeader");
-  image->columns=header.pixmap_width;
-  image->rows=header.pixmap_height;
-  image->depth=8;
   /*
     Ensure the header byte-order is most-significant byte first.
   */
@@ -238,6 +235,25 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)
     ThrowReaderException(CorruptImageError,"FileFormatVersionMismatch");
   if (header.header_size < sz_XWDheader)
     ThrowReaderException(CorruptImageError,"CorruptImage");
+  switch (header.visual_class) {
+    case StaticGray:
+    case GrayScale:
+    case StaticColor:
+    case PseudoColor:
+    case TrueColor:
+    case DirectColor:
+      break;
+    default:
+      ThrowReaderException(CorruptImageError,"CorruptImage");
+    }
+  switch (header.pixmap_format) {
+    case XYBitmap:
+    case XYPixmap:
+    case ZPixmap:
+      break;
+    default:
+      ThrowReaderException(CorruptImageError,"CorruptImage");
+  }
   length=(size_t) header.header_size-sz_XWDheader;
   comment=(char *) AcquireQuantumMemory(length+1,sizeof(*comment));
   if (comment == (char *) NULL)
@@ -269,16 +285,30 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)
   ximage->red_mask=header.red_mask;
   ximage->green_mask=header.green_mask;
   ximage->blue_mask=header.blue_mask;
-  if ((ximage->depth < 0) || (ximage->width < 0) || (ximage->height < 0) ||
-      (ximage->bitmap_pad < 0) || (ximage->bytes_per_line < 0))
-    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+  if ((ximage->width < 0) || (ximage->height < 0) || (ximage->depth < 0) ||    
+      (ximage->format < 0) || (ximage->byte_order < 0) || 
+      (ximage->bitmap_bit_order < 0) || (ximage->bitmap_pad < 0) || 
+      (ximage->bytes_per_line < 0))
+    {
+      ximage=(XImage *) RelinquishMagickMemory(ximage);
+      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+    }
   if ((ximage->width > 65535) || (ximage->height > 65535))
-    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+    {
+      ximage=(XImage *) RelinquishMagickMemory(ximage);
+      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+    }
   if ((ximage->bits_per_pixel > 32) || (ximage->bitmap_unit > 32))
-    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+    {
+      ximage=(XImage *) RelinquishMagickMemory(ximage);
+      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+    }
   x_status=XInitImage(ximage);
   if (x_status == 0)
-    ThrowReaderException(CorruptImageError,"UnexpectedEndOfFile");
+    {
+      ximage=(XImage *) RelinquishMagickMemory(ximage);
+      ThrowReaderException(CorruptImageError,"UnexpectedEndOfFile");
+    }
   /*
     Read colormap.
   */
@@ -292,19 +322,25 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)
       length=(size_t) header.ncolors;
       colors=(XColor *) AcquireQuantumMemory(length,sizeof(*colors));
       if (colors == (XColor *) NULL)
-        ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+        {
+          ximage=(XImage *) RelinquishMagickMemory(ximage);
+          ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+        }
       for (i=0; i < (ssize_t) header.ncolors; i++)
       {
         count=ReadBlob(image,sz_XWDColor,(unsigned char *) &color);
         if (count == 0)
-          ThrowReaderException(CorruptImageError,"UnexpectedEndOfFile");
+          {
+            ximage=(XImage *) RelinquishMagickMemory(ximage);
+            ThrowReaderException(CorruptImageError,"UnexpectedEndOfFile");
+          }
         colors[i].pixel=color.pixel;
         colors[i].red=color.red;
         colors[i].green=color.green;
         colors[i].blue=color.blue;
         colors[i].flags=(char) color.flags;
         if (color.flags != 0)
-         authentic_colormap=MagickTrue;
+          authentic_colormap=MagickTrue;
       }
       /*
         Ensure the header byte-order is most-significant byte first.
@@ -324,7 +360,10 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)
   */
   length=(size_t) ximage->bytes_per_line*ximage->height;
   if (CheckOverflowException(length,ximage->bytes_per_line,ximage->height))
-    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+    {
+      ximage=(XImage *) RelinquishMagickMemory(ximage);
+      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+    }
   if (ximage->format != ZPixmap)
     {
       size_t
@@ -333,20 +372,31 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)
       extent=length;
       length*=ximage->depth;
       if (CheckOverflowException(length,extent,ximage->depth))
-        ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+        {
+          ximage=(XImage *) RelinquishMagickMemory(ximage);
+          ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+        }
     }
   ximage->data=(char *) AcquireQuantumMemory(length,sizeof(*ximage->data));
   if (ximage->data == (char *) NULL)
-    ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+    {
+      ximage=(XImage *) RelinquishMagickMemory(ximage);
+      ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+    }
   count=ReadBlob(image,length,(unsigned char *) ximage->data);
   if (count == 0)
-    ThrowReaderException(CorruptImageError,"UnexpectedEndOfFile");
+    {
+      ximage->data=DestroyString(ximage->data);
+      ximage=(XImage *) RelinquishMagickMemory(ximage);
+      ThrowReaderException(CorruptImageError,"UnexpectedEndOfFile");
+    }
   /*
     Convert image to MIFF format.
   */
   image->columns=(size_t) ximage->width;
   image->rows=(size_t) ximage->height;
-  if ((colors == (XColor *) NULL) || (ximage->red_mask != 0) ||
+  image->depth=8;
+  if ((header.ncolors == 0U) || (ximage->red_mask != 0) ||
       (ximage->green_mask != 0) || (ximage->blue_mask != 0))
     image->storage_class=DirectClass;
   else
@@ -462,12 +512,19 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)
           Convert X image to PseudoClass packets.
         */
         if (AcquireImageColormap(image,image->colors,exception) == MagickFalse)
-          ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+          {
+            ximage->data=DestroyString(ximage->data);
+            ximage=(XImage *) RelinquishMagickMemory(ximage);
+            ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+          }
         for (i=0; i < (ssize_t) image->colors; i++)
         {
-          image->colormap[i].red=ScaleShortToQuantum(colors[i].red);
-          image->colormap[i].green=ScaleShortToQuantum(colors[i].green);
-          image->colormap[i].blue=ScaleShortToQuantum(colors[i].blue);
+          image->colormap[i].red=(MagickRealType) ScaleShortToQuantum(
+            colors[i].red));
+          image->colormap[i].green=(MagickRealType) ScaleShortToQuantum(
+            colors[i].green));
+          image->colormap[i].blue=(MagickRealType) ScaleShortToQuantum(
+            colors[i].blue));
         }
         for (y=0; y < (ssize_t) image->rows; y++)
         {
@@ -704,7 +761,7 @@ static MagickBooleanType WriteXWDImage(const ImageInfo *image_info,Image *image,
   (void) WriteBlob(image,1,(const unsigned char *) "\0");
   if (image->storage_class == PseudoClass)
     {
-      register unsigned int
+      register ssize_t
         i;
 
       XColor
@@ -723,10 +780,13 @@ static MagickBooleanType WriteXWDImage(const ImageInfo *image_info,Image *image,
         ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
       for (i=0; i < (ssize_t) image->colors; i++)
       {
-        colors[i].pixel=i;
-        colors[i].red=ScaleQuantumToShort(image->colormap[i].red);
-        colors[i].green=ScaleQuantumToShort(image->colormap[i].green);
-        colors[i].blue=ScaleQuantumToShort(image->colormap[i].blue);
+        colors[i].pixel=(unsigned long) i;
+        colors[i].red=ScaleQuantumToShort(ClampToQuantum(
+          image->colormap[i].red));
+        colors[i].green=ScaleQuantumToShort(ClampToQuantum(
+          image->colormap[i].green));
+        colors[i].blue=ScaleQuantumToShort(ClampToQuantum(
+          image->colormap[i].blue));
         colors[i].flags=(char) (DoRed | DoGreen | DoBlue);
         colors[i].pad='\0';
         if ((int) (*(char *) &lsb_first) != 0)