From: cristy <urban-warrior@git.imagemagick.org>
Date: Tue, 30 Dec 2014 23:48:22 +0000 (+0000)
Subject: (no commit message)
X-Git-Tag: 7.0.1-0~1515
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=29d4033ce05787ac6e266a9e63d9e8e6d0030d44;p=imagemagick

---

diff --git a/coders/meta.c b/coders/meta.c
index 5f9c5f7d6..385093b0e 100644
--- a/coders/meta.c
+++ b/coders/meta.c
@@ -213,7 +213,7 @@ static int convertHTMLcodes(char *s, int len)
             break;
         }
         if (o < 6)
-          (void) strcpy(s+1,s+1+o);
+          (void) memmove(s+1,s+1+o,strlen(s+1+o)+1);
         *s = val;
         return o;
       }
@@ -229,8 +229,9 @@ static int convertHTMLcodes(char *s, int len)
         if (html_codes[i].len <= len)
           if (stringnicmp(s,html_codes[i].code,(size_t) html_codes[i].len) == 0)
             {
-              (void) strcpy(s+1,s+html_codes[i].len);
-              *s = html_codes[i].val;
+              (void) memmove(s+1,s+html_codes[i].len,
+                strlen(s+html_codes[i].len)+1);
+              *s=html_codes[i].val;
               return html_codes[i].len-1;
             }
       }
diff --git a/coders/pcx.c b/coders/pcx.c
index 57fcb1758..e580bad88 100644
--- a/coders/pcx.c
+++ b/coders/pcx.c
@@ -89,7 +89,9 @@ typedef struct _PCXInfo
 
   unsigned short
     bytes_per_line,
-    palette_info;
+    palette_info,
+    horizontal_screensize,
+    vertical_screensize;
 
   unsigned char
     colormap_signature;
@@ -313,7 +315,7 @@ static Image *ReadPCXImage(const ImageInfo *image_info,ExceptionInfo *exception)
       Verify PCX identifier.
     */
     pcx_info.version=(unsigned char) ReadBlobByte(image);
-    if ((count == 0) || (pcx_info.identifier != 0x0a))
+    if ((count != 1) || (pcx_info.identifier != 0x0a))
       ThrowReaderException(CorruptImageError,"ImproperImageHeader");
     pcx_info.encoding=(unsigned char) ReadBlobByte(image);
     bits_per_pixel=ReadBlobByte(image);
@@ -334,14 +336,19 @@ static Image *ReadPCXImage(const ImageInfo *image_info,ExceptionInfo *exception)
     image->rows=(size_t) MagickAbsoluteValue((ssize_t) pcx_info.bottom-
       pcx_info.top)+1UL;
     if ((image->columns == 0) || (image->rows == 0) ||
-        (pcx_info.bits_per_pixel == 0))
+        ((pcx_info.bits_per_pixel != 1) &&
+         (pcx_info.bits_per_pixel != 2) &&
+         (pcx_info.bits_per_pixel != 4) &&
+         (pcx_info.bits_per_pixel != 8)))
       ThrowReaderException(CorruptImageError,"ImproperImageHeader");
-    image->depth=pcx_info.bits_per_pixel <= 8 ? 8U : MAGICKCORE_QUANTUM_DEPTH;
+    image->depth=pcx_info.bits_per_pixel;
     image->units=PixelsPerInchResolution;
     image->resolution.x=(double) pcx_info.horizontal_resolution;
     image->resolution.y=(double) pcx_info.vertical_resolution;
     image->colors=16;
     count=ReadBlob(image,3*image->colors,pcx_colormap);
+    if (count != (3*image->colors))
+      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
     pcx_info.reserved=(unsigned char) ReadBlobByte(image);
     pcx_info.planes=(unsigned char) ReadBlobByte(image);
     if ((pcx_info.bits_per_pixel*pcx_info.planes) >= 64)
@@ -365,7 +372,9 @@ static Image *ReadPCXImage(const ImageInfo *image_info,ExceptionInfo *exception)
     }
     pcx_info.bytes_per_line=ReadBlobLSBShort(image);
     pcx_info.palette_info=ReadBlobLSBShort(image);
-    for (i=0; i < 58; i++)
+    pcx_info.horizontal_screensize=ReadBlobLSBShort(image);
+    pcx_info.vertical_screensize=ReadBlobLSBShort(image);
+    for (i=0; i < 54; i++)
       (void) ReadBlobByte(image);
     if ((image_info->ping != MagickFalse) && (image_info->number_scenes != 0))
       if (image->scene >= (image_info->scene+image_info->number_scenes-1))
diff --git a/coders/pdb.c b/coders/pdb.c
index 36d3a9b1c..75224a922 100644
--- a/coders/pdb.c
+++ b/coders/pdb.c
@@ -472,7 +472,7 @@ static Image *ReadPDBImage(const ImageInfo *image_info,ExceptionInfo *exception)
         q=QueueAuthenticPixels(image,0,y,image->columns,1,exception);
         if (q == (Quantum *) NULL)
           break;
-        for (x=0; x < (ssize_t) image->columns; x+=4)
+        for (x=0; x < (ssize_t) image->columns-3; x+=4)
         {
           index=ConstrainColormapIndex(image,3UL-((*p >> 6) & 0x03),exception);
           SetPixelIndex(image,index,q);
@@ -508,7 +508,7 @@ static Image *ReadPDBImage(const ImageInfo *image_info,ExceptionInfo *exception)
         q=QueueAuthenticPixels(image,0,y,image->columns,1,exception);
         if (q == (Quantum *) NULL)
           break;
-        for (x=0; x < (ssize_t) image->columns; x+=2)
+        for (x=0; x < (ssize_t) image->columns-1; x+=2)
         {
           index=ConstrainColormapIndex(image,15UL-((*p >> 4) & 0x0f),exception);
           SetPixelIndex(image,index,q);