From 623297e5f42fc19a95718f9d81db2f3672a6dc3a Mon Sep 17 00:00:00 2001 From: Cristy Date: Sat, 20 Apr 2019 12:18:03 -0400 Subject: [PATCH] ... --- coders/xwd.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/coders/xwd.c b/coders/xwd.c index 0074811a0..b5f09e090 100644 --- a/coders/xwd.c +++ b/coders/xwd.c @@ -238,7 +238,12 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception) ThrowReaderException(CorruptImageError,"FileFormatVersionMismatch"); if (header.header_size < sz_XWDheader) ThrowReaderException(CorruptImageError,"ImproperImageHeader"); - if ((MagickSizeType) header.xoffset >= GetBlobSize(image)) + if (header.xoffset >= header.pixmap_width) + ThrowReaderException(CorruptImageError,"ImproperImageHeader"); + if (((header.pixmap_depth | header.pixmap_format | header.xoffset | + header.pixmap_width | header.pixmap_height | header.bitmap_pad | + header.bytes_per_line | header.byte_order | header.bitmap_unit | + header.bitmap_bit_order | header.bits_per_pixel) >> 31) != 0) ThrowReaderException(CorruptImageError,"ImproperImageHeader"); switch (header.visual_class) { @@ -353,10 +358,11 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception) ximage->red_mask=header.red_mask; ximage->green_mask=header.green_mask; ximage->blue_mask=header.blue_mask; - if ((ximage->width < 0) || (ximage->height < 0) || (ximage->depth < 0) || - (ximage->format < 0) || (ximage->byte_order < 0) || - (ximage->bitmap_bit_order < 0) || (ximage->bitmap_pad < 0) || - (ximage->bytes_per_line < 0)) + if ((ximage->depth < 0) || (ximage->format < 0) || (ximage->xoffset < 0) || + (ximage->width < 0) || (ximage->height < 0) || (ximage->bitmap_pad < 0) || + (ximage->bytes_per_line < 0) || (ximage->byte_order < 0) || + (ximage->bitmap_unit < 0) || (ximage->bitmap_bit_order < 0) || + (ximage->bits_per_pixel < 0)) { ximage=(XImage *) RelinquishMagickMemory(ximage); ThrowReaderException(CorruptImageError,"ImproperImageHeader"); @@ -691,7 +697,6 @@ ModuleExport size_t RegisterXWDImage(void) entry->encoder=(EncodeImageHandler *) WriteXWDImage; #endif entry->magick=(IsImageFormatHandler *) IsXWD; - entry->flags|=CoderDecoderSeekableStreamFlag; entry->flags^=CoderAdjoinFlag; (void) RegisterMagickInfo(entry); return(MagickImageCoderSignature); -- 2.40.0