From: Cristy <urban-warrior@imagemagick.org>
Date: Mon, 7 Aug 2017 19:12:56 +0000 (-0400)
Subject: https://github.com/ImageMagick/ImageMagick/issues/652
X-Git-Tag: 7.0.6-6~20
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=75fcbf5d649bba046c6a0db650a518f7bfc0fb3f;p=imagemagick

https://github.com/ImageMagick/ImageMagick/issues/652
---

diff --git a/coders/bmp.c b/coders/bmp.c
index 207118ed1..618f9870d 100644
--- a/coders/bmp.c
+++ b/coders/bmp.c
@@ -942,6 +942,8 @@ static Image *ReadBMPImage(const ImageInfo *image_info,ExceptionInfo *exception)
       bmp_info.bits_per_pixel<<=1;
     bytes_per_line=4*((image->columns*bmp_info.bits_per_pixel+31)/32);
     length=(size_t) bytes_per_line*image->rows;
+    if (length > GetBlobSize(image))
+      ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
     pixel_info=AcquireVirtualMemory((size_t) image->rows,
       MagickMax(bytes_per_line,image->columns+256UL)*sizeof(*pixels));
     if (pixel_info == (MemoryInfo *) NULL)