From: Cristy <urban-warrior@imagemagick.org>
Date: Fri, 23 Jun 2017 13:29:58 +0000 (-0400)
Subject: https://github.com/ImageMagick/ImageMagick/issues/519
X-Git-Tag: 7.0.6-1~129
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=fa3cf0b45980a4c2ea2345032fe43444dfb05bdb;p=imagemagick

https://github.com/ImageMagick/ImageMagick/issues/519
---

diff --git a/coders/cin.c b/coders/cin.c
index d85be62dd..ff2fa9a4a 100644
--- a/coders/cin.c
+++ b/coders/cin.c
@@ -706,7 +706,10 @@ static Image *ReadCINImage(const ImageInfo *image_info,ExceptionInfo *exception)
       /*
         User defined data.
       */
-      profile=BlobToStringInfo((const unsigned char *) NULL,cin.file.user_length);
+      if (cin.file.user_length > GetBlobSize(image))
+        ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+      profile=BlobToStringInfo((const unsigned char *) NULL,
+        cin.file.user_length);
       if (profile == (StringInfo *) NULL)
         ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
       offset+=ReadBlob(image,GetStringInfoLength(profile),
@@ -814,6 +817,7 @@ ModuleExport size_t RegisterCINImage(void)
   entry->decoder=(DecodeImageHandler *) ReadCINImage;
   entry->encoder=(EncodeImageHandler *) WriteCINImage;
   entry->magick=(IsImageFormatHandler *) IsCIN;
+  entry->flags|=CoderDecoderSeekableStreamFlag
   entry->flags^=CoderAdjoinFlag;
   (void) RegisterMagickInfo(entry);
   return(MagickImageCoderSignature);
diff --git a/coders/rle.c b/coders/rle.c
index 687247d00..93ad52180 100644
--- a/coders/rle.c
+++ b/coders/rle.c
@@ -739,7 +739,7 @@ ModuleExport size_t RegisterRLEImage(void)
   entry=AcquireMagickInfo("RLE","RLE","Utah Run length encoded image");
   entry->decoder=(DecodeImageHandler *) ReadRLEImage;
   entry->magick=(IsImageFormatHandler *) IsRLE;
-  entry->flags^=CoderBlobSupportFlag;
+  entry->flags|=CoderDecoderSeekableStreamFlag;
   entry->flags^=CoderAdjoinFlag;
   (void) RegisterMagickInfo(entry);
   return(MagickImageCoderSignature);