From: cristy <urban-warrior@git.imagemagick.org>
Date: Sun, 23 Nov 2014 16:36:24 +0000 (+0000)
Subject: (no commit message)
X-Git-Tag: 7.0.1-0~1715
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=7d3fc13ab4a4198afa06826e7bc0fc323719f562;p=imagemagick

---

diff --git a/coders/dpx.c b/coders/dpx.c
index 8a77f335e..8f18e0a38 100644
--- a/coders/dpx.c
+++ b/coders/dpx.c
@@ -790,6 +790,8 @@ static Image *ReadDPXImage(const ImageInfo *image_info,ExceptionInfo *exception)
     case 7: image->orientation=RightBottomOrientation; break;
   }
   dpx.image.number_elements=ReadBlobShort(image);
+  if (dpx.image.number_elements > 8)
+    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   offset+=2;
   dpx.image.pixels_per_line=ReadBlobLong(image);
   offset+=4;
diff --git a/coders/xwd.c b/coders/xwd.c
index 01c950d3f..bd3fa487b 100644
--- a/coders/xwd.c
+++ b/coders/xwd.c
@@ -272,6 +272,8 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)
   if ((ximage->depth < 0) || (ximage->width < 0) || (ximage->height < 0) ||
       (ximage->bitmap_pad < 0) || (ximage->bytes_per_line < 0))
     ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+  if ((ximage->width > 65535) || (ximage->height > 65535))
+    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   if ((ximage->bits_per_pixel > 32) || (ximage->bitmap_unit > 32))
     ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   x_status=XInitImage(ximage);