From: Cristy <urban-warrior@imagemagick.org>
Date: Thu, 29 Sep 2016 23:38:34 +0000 (-0400)
Subject: ...
X-Git-Tag: 7.0.3-2~12
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=59f4513aeb62ae95323b5beaf199b669238457de;p=imagemagick

...
---

diff --git a/coders/xcf.c b/coders/xcf.c
index 4c708a0d8..f5ea575cd 100644
--- a/coders/xcf.c
+++ b/coders/xcf.c
@@ -645,7 +645,9 @@ static MagickBooleanType load_level(Image *image,XCFDocInfo *inDocInfo,
     if (offset2 == 0)
       offset2=(MagickOffsetType) (offset + TILE_WIDTH * TILE_WIDTH * 4* 1.5);
     /* seek to the tile offset */
-    offset=SeekBlob(image, offset, SEEK_SET);
+    if (SeekBlob(image, offset, SEEK_SET) != offset)
+      ThrowBinaryException(CorruptImageError,"InsufficientImageDataInFile",
+        image->filename);
 
       /*
         Allocate the image for the tile.  NOTE: the last tile in a row or
@@ -748,7 +750,9 @@ static MagickBooleanType load_hierarchy(Image *image,XCFDocInfo *inDocInfo,
   saved_pos=TellBlob(image);
 
   /* seek to the level offset */
-  offset=SeekBlob(image, offset, SEEK_SET);
+  if (SeekBlob(image, offset, SEEK_SET) != offset)
+    ThrowBinaryException(CorruptImageError,"InsufficientImageDataInFile",
+      image->filename);
 
   /* read in the level */
   if (load_level (image, inDocInfo, inLayer, exception) == 0)
@@ -792,6 +796,9 @@ static MagickBooleanType ReadOneLayer(const ImageInfo *image_info,Image* image,
   outLayer->type = ReadBlobMSBLong(image);
   (void) ReadBlobStringWithLongSize(image, outLayer->name,
     sizeof(outLayer->name),exception);
+  if (EOFBlob(image) != MagickFalse)
+    ThrowBinaryException(CorruptImageError,"InsufficientImageDataInFile",
+      image->filename);
   /* read the layer properties! */
   foundPropEnd = 0;
   while ( (foundPropEnd == MagickFalse) && (EOFBlob(image) == MagickFalse) ) {
@@ -925,7 +932,7 @@ static MagickBooleanType ReadOneLayer(const ImageInfo *image_info,Image* image,
 
   /* read in the hierarchy */
   offset=SeekBlob(image, (MagickOffsetType) hierarchy_offset, SEEK_SET);
-  if (offset < 0)
+  if (offset != (MagickOffsetType) hierarchy_offset)
     (void) ThrowMagickException(exception,GetMagickModule(),
       CorruptImageError,"InvalidImageHeader","`%s'",image->filename);
   if (load_hierarchy (image, inDocInfo, outLayer, exception) == 0)
@@ -1318,7 +1325,9 @@ static Image *ReadXCFImage(const ImageInfo *image_info,ExceptionInfo *exception)
       */
       saved_pos=TellBlob(image);
       /* seek to the layer offset */
-      offset=SeekBlob(image,offset,SEEK_SET);
+      if (SeekBlob(image,offset,SEEK_SET) != offset)
+        ThrowBinaryException(CorruptImageError,"NotEnoughPixelData",
+          image->filename);
       /* read in the layer */
       layer_ok=ReadOneLayer(image_info,image,&doc_info,
         &layer_info[current_layer],current_layer,exception);