From c6409227c430f114b6425337e64b848535b62e0b Mon Sep 17 00:00:00 2001 From: Cristy Date: Wed, 6 Sep 2017 08:43:38 -0400 Subject: [PATCH] https://github.com/ImageMagick/ImageMagick/issues/733 --- coders/pcx.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/coders/pcx.c b/coders/pcx.c index e610f0b0f..411c17d56 100644 --- a/coders/pcx.c +++ b/coders/pcx.c @@ -901,6 +901,8 @@ static MagickBooleanType WritePCXImage(const ImageInfo *image_info,Image *image, status=OpenBlob(image_info,image,WriteBinaryBlobMode,exception); if (status == MagickFalse) return(status); + if ((image->columns > 65535UL) || (image->rows > 65535UL)) + ThrowWriterException(ImageError,"WidthOrHeightExceedsLimit"); (void) TransformImageColorspace(image,sRGBColorspace,exception); page_table=(MagickOffsetType *) NULL; if ((LocaleCompare(image_info->magick,"DCX") == 0) || @@ -964,8 +966,10 @@ static MagickBooleanType WritePCXImage(const ImageInfo *image_info,Image *image, if (image->alpha_trait != UndefinedPixelTrait) pcx_info.planes++; } - pcx_info.bytes_per_line=(unsigned short) (((size_t) image->columns* - pcx_info.bits_per_pixel+7)/8); + length=(((size_t) image->columns*pcx_info.bits_per_pixel+7)/8); + if (length > 65535UL) + ThrowWriterException(ImageError,"WidthOrHeightExceedsLimit"); + pcx_info.bytes_per_line=(unsigned short) length; pcx_info.palette_info=1; pcx_info.colormap_signature=0x0c; /* -- 2.40.0