From: Cristy <urban-warrior@imagemagick.org>
Date: Mon, 19 Mar 2018 00:46:49 +0000 (-0400)
Subject: ...
X-Git-Tag: 7.0.7-28~72
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=a3d8722a56502f1d9b0423be6e7300fea364f874;p=imagemagick

...
---

diff --git a/coders/bmp.c b/coders/bmp.c
index 7cf8b7d24..3ba5348c4 100644
--- a/coders/bmp.c
+++ b/coders/bmp.c
@@ -232,7 +232,7 @@ static MagickBooleanType DecodeImage(Image *image,const size_t compression,
     MagickBooleanType
       status;
 
-    if ((p < pixels) || (p > q))
+    if ((p < pixels) || (p >= q))
       break;
     count=ReadBlobByte(image);
     if (count == EOF)
@@ -286,8 +286,14 @@ static MagickBooleanType DecodeImage(Image *image,const size_t compression,
             /*
               Delta mode.
             */
-            x+=ReadBlobByte(image);
-            y+=ReadBlobByte(image);
+            byte=ReadBlobByte(image);
+            if (byte == EOF)
+              break;
+            x+=byte;
+            byte=ReadBlobByte(image);
+            if (byte == EOF)
+              break;
+            y+=byte;
             p=pixels+y*image->columns+x;
             break;
           }
@@ -297,6 +303,8 @@ static MagickBooleanType DecodeImage(Image *image,const size_t compression,
               Absolute mode.
             */
             count=(int) MagickMin((ssize_t) count,(ssize_t) (q-p));
+            if (count < 0)
+              break;
             if (compression == BI_RLE8)
               for (i=0; i < (ssize_t) count; i++)
               {