From 62a3eb7b8f250e5252093826b03b4f83094af293 Mon Sep 17 00:00:00 2001 From: cristy Date: Sun, 7 Dec 2014 12:52:02 +0000 Subject: [PATCH] --- coders/sun.c | 2 ++ coders/wpg.c | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/coders/sun.c b/coders/sun.c index 86ec0bc12..15763db1c 100644 --- a/coders/sun.c +++ b/coders/sun.c @@ -303,6 +303,8 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception) sun_info.type=ReadBlobMSBLong(image); sun_info.maptype=ReadBlobMSBLong(image); sun_info.maplength=ReadBlobMSBLong(image); + if ((sun_info.height != 0) && (sun_info.width != extent/sun_info.height)) + ThrowReaderException(CorruptImageError,"ImproperImageHeader"); if ((sun_info.type != RT_STANDARD) && (sun_info.type != RT_ENCODED) && (sun_info.type != RT_FORMAT_RGB)) ThrowReaderException(CorruptImageError,"ImproperImageHeader"); diff --git a/coders/wpg.c b/coders/wpg.c index 31801f191..a584c9f10 100644 --- a/coders/wpg.c +++ b/coders/wpg.c @@ -465,7 +465,7 @@ static int UnpackWPGRaster(Image *image,int bpp,ExceptionInfo *exception) ldblk=(ssize_t) ((bpp*image->columns+7)/8); BImgBuff=(unsigned char *) AcquireQuantumMemory((size_t) ldblk, - sizeof(*BImgBuff)); + 4*sizeof(*BImgBuff)); if(BImgBuff==NULL) return(-2); while(y<(ssize_t) image->rows) -- 2.40.0