From 8dbbd491d8f9d1db16848eceac8451b7faf3e4a4 Mon Sep 17 00:00:00 2001 From: Cristy Date: Sun, 2 Oct 2016 09:02:56 -0400 Subject: [PATCH] ... --- coders/wpg.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/coders/wpg.c b/coders/wpg.c index f64744350..01d351c6a 100644 --- a/coders/wpg.c +++ b/coders/wpg.c @@ -1065,7 +1065,9 @@ static Image *ReadWPGImage(const ImageInfo *image_info, case 0x0E: /*Color palette */ WPG_Palette.StartIndex=ReadBlobLSBShort(image); WPG_Palette.NumOfEntries=ReadBlobLSBShort(image); - + if ((WPG_Palette.NumOfEntries-WPG_Palette.StartIndex) > + (Rec2.RecordLength-2-2) / 3) + ThrowReaderException(CorruptImageError,"InvalidColormapIndex"); image->colors=WPG_Palette.NumOfEntries; if (!AcquireImageColormap(image,image->colors,exception)) goto NoMemory; @@ -1266,7 +1268,9 @@ static Image *ReadWPGImage(const ImageInfo *image_info, case 0x0C: /* Color palette */ WPG_Palette.StartIndex=ReadBlobLSBShort(image); WPG_Palette.NumOfEntries=ReadBlobLSBShort(image); - + if ((WPG_Palette.NumOfEntries-WPG_Palette.StartIndex) > + (Rec2.RecordLength-2-2) / 3) + ThrowReaderException(CorruptImageError,"InvalidColormapIndex"); image->colors=WPG_Palette.NumOfEntries; if (AcquireImageColormap(image,image->colors,exception) == MagickFalse) ThrowReaderException(ResourceLimitError, -- 2.50.0