From a3d8722a56502f1d9b0423be6e7300fea364f874 Mon Sep 17 00:00:00 2001 From: Cristy Date: Sun, 18 Mar 2018 20:46:49 -0400 Subject: [PATCH] ... --- coders/bmp.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/coders/bmp.c b/coders/bmp.c index 7cf8b7d24..3ba5348c4 100644 --- a/coders/bmp.c +++ b/coders/bmp.c @@ -232,7 +232,7 @@ static MagickBooleanType DecodeImage(Image *image,const size_t compression, MagickBooleanType status; - if ((p < pixels) || (p > q)) + if ((p < pixels) || (p >= q)) break; count=ReadBlobByte(image); if (count == EOF) @@ -286,8 +286,14 @@ static MagickBooleanType DecodeImage(Image *image,const size_t compression, /* Delta mode. */ - x+=ReadBlobByte(image); - y+=ReadBlobByte(image); + byte=ReadBlobByte(image); + if (byte == EOF) + break; + x+=byte; + byte=ReadBlobByte(image); + if (byte == EOF) + break; + y+=byte; p=pixels+y*image->columns+x; break; } @@ -297,6 +303,8 @@ static MagickBooleanType DecodeImage(Image *image,const size_t compression, Absolute mode. */ count=(int) MagickMin((ssize_t) count,(ssize_t) (q-p)); + if (count < 0) + break; if (compression == BI_RLE8) for (i=0; i < (ssize_t) count; i++) { -- 2.40.0