From 833908d4cf871e4104728dfd375eecde76a346f1 Mon Sep 17 00:00:00 2001
From: dirk <dirk@git.imagemagick.org>
Date: Tue, 28 Jan 2014 19:26:32 +0000
Subject: [PATCH] A couple of fixes in the icon reader.

---
 coders/icon.c | 31 ++++++++++++++-----------------
 1 file changed, 14 insertions(+), 17 deletions(-)

diff --git a/coders/icon.c b/coders/icon.c
index af09c3d44..98042408b 100644
--- a/coders/icon.c
+++ b/coders/icon.c
@@ -323,7 +323,8 @@ static Image *ReadICONImage(const ImageInfo *image_info,
     icon_info.height=(unsigned char) ((int) ReadBlobLSBLong(image)/2);
     icon_info.planes=ReadBlobLSBShort(image);
     icon_info.bits_per_pixel=ReadBlobLSBShort(image);
-    if ((icon_info.planes == 18505) && (icon_info.bits_per_pixel == 21060))
+    if ((icon_info.planes == 18505) && (icon_info.bits_per_pixel == 21060) || 
+         icon_info.size == 0x474e5089)
       {
         Image
           *icon_image;
@@ -350,19 +351,20 @@ static Image *ReadICONImage(const ImageInfo *image_info,
         png[14]=(unsigned char) icon_info.bits_per_pixel;
         png[15]=(unsigned char) (icon_info.bits_per_pixel >> 8);
         count=ReadBlob(image,length-16,png+16);
-        if (count != (ssize_t) (length-16))
+        icon_image=(Image *) NULL;
+        if (count > 0)
           {
-            png=(unsigned char *) RelinquishMagickMemory(png);
-            ThrowReaderException(CorruptImageError,
-              "InsufficientImageDataInFile");
+            read_info=CloneImageInfo(image_info);
+            (void) CopyMagickString(read_info->magick,"PNG",MaxTextExtent);
+            icon_image=BlobToImage(read_info,png,length+16,exception);
+            read_info=DestroyImageInfo(read_info);
           }
-        read_info=CloneImageInfo(image_info);
-        (void) CopyMagickString(read_info->magick,"PNG",MaxTextExtent);
-        icon_image=BlobToImage(read_info,png,length+16,exception);
-        read_info=DestroyImageInfo(read_info);
         png=(unsigned char *) RelinquishMagickMemory(png);
         if (icon_image == (Image *) NULL)
           {
+            if (count != (ssize_t) (length-16))
+              ThrowReaderException(CorruptImageError,
+                "InsufficientImageDataInFile");
             image=DestroyImageList(image);
             return((Image *) NULL);
           }
@@ -409,7 +411,7 @@ static Image *ReadICONImage(const ImageInfo *image_info,
             (void) LogMagickEvent(CoderEvent,GetMagickModule(),
               "   bpp    = %.20g",(double) icon_info.bits_per_pixel);
           }
-      if ((icon_info.number_colors != 0) || (icon_info.bits_per_pixel <= 16))
+      if (icon_info.bits_per_pixel <= 16)
         {
           image->storage_class=PseudoClass;
           image->colors=icon_info.number_colors;
@@ -421,19 +423,14 @@ static Image *ReadICONImage(const ImageInfo *image_info,
           register ssize_t
             i;
 
-          size_t
-            number_colors,
-            one;
-
           unsigned char
             *icon_colormap;
 
           /*
             Read Icon raster colormap.
           */
-          one=1;
-          number_colors=one << icon_info.bits_per_pixel;
-          if (AcquireImageColormap(image,number_colors,exception) == MagickFalse)
+          if (AcquireImageColormap(image,image->colors,exception) ==
+              MagickFalse)
             ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
           icon_colormap=(unsigned char *) AcquireQuantumMemory((size_t)
             image->colors,4UL*sizeof(*icon_colormap));
-- 
2.40.0