From 1d3be430d3ce0f8a6ac06178d3064e4853b29f4c Mon Sep 17 00:00:00 2001 From: cristy Date: Wed, 7 Jan 2015 11:26:54 +0000 Subject: [PATCH] http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=26842 --- coders/miff.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/coders/miff.c b/coders/miff.c index 652392c80..dce2738d8 100644 --- a/coders/miff.c +++ b/coders/miff.c @@ -452,6 +452,7 @@ static Image *ReadMIFFImage(const ImageInfo *image_info, i; size_t + compress_extent, length, packet_size; @@ -1253,11 +1254,10 @@ static Image *ReadMIFFImage(const ImageInfo *image_info, packet_size+=quantum_info->depth/8; if (image->compression == RLECompression) packet_size++; - length=image->columns; - length=MagickMax(MagickMax(BZipMaxExtent(packet_size*image->columns), - LZMAMaxExtent(packet_size*image->columns)),ZipMaxExtent(packet_size* - image->columns)); - compress_pixels=(unsigned char *) AcquireQuantumMemory(length, + compress_extent=MagickMax(MagickMax(BZipMaxExtent(packet_size* + image->columns),LZMAMaxExtent(packet_size*image->columns)), + ZipMaxExtent(packet_size*image->columns)); + compress_pixels=(unsigned char *) AcquireQuantumMemory(compress_extent, sizeof(*compress_pixels)); if (compress_pixels == (unsigned char *) NULL) ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed"); @@ -1381,6 +1381,9 @@ static Image *ReadMIFFImage(const ImageInfo *image_info, length=(size_t) BZipMaxExtent(packet_size*image->columns); if (version != 0.0) length=(size_t) ReadBlobMSBLong(image); + if (length > compress_extent) + ThrowReaderException(CorruptImageError, + "UnableToReadImageData"); bzip_info.avail_in=(unsigned int) ReadBlob(image,length, (unsigned char *) bzip_info.next_in); } @@ -1406,6 +1409,9 @@ static Image *ReadMIFFImage(const ImageInfo *image_info, { lzma_info.next_in=compress_pixels; length=(size_t) ReadBlobMSBLong(image); + if (length > compress_extent) + ThrowReaderException(CorruptImageError, + "UnableToReadImageData"); lzma_info.avail_in=(unsigned int) ReadBlob(image,length, (unsigned char *) lzma_info.next_in); } @@ -1437,6 +1443,9 @@ static Image *ReadMIFFImage(const ImageInfo *image_info, length=(size_t) ZipMaxExtent(packet_size*image->columns); if (version != 0.0) length=(size_t) ReadBlobMSBLong(image); + if (length > compress_extent) + ThrowReaderException(CorruptImageError, + "UnableToReadImageData"); zip_info.avail_in=(unsigned int) ReadBlob(image,length, zip_info.next_in); } -- 2.40.0