From c944c57caeab82363fa22fe33dab407def968946 Mon Sep 17 00:00:00 2001
From: cristy <urban-warrior@git.imagemagick.org>
Date: Mon, 12 May 2014 00:19:16 +0000
Subject: [PATCH]

---
 coders/pict.c | 47 +++++++++++++++++++++++++++++------------------
 1 file changed, 29 insertions(+), 18 deletions(-)

diff --git a/coders/pict.c b/coders/pict.c
index 19aeb83f6..98804d687 100644
--- a/coders/pict.c
+++ b/coders/pict.c
@@ -95,17 +95,6 @@
     ThrowReaderException(CorruptImageError,"ImproperImageHeader"); \
 }
 
-#define ReadRectangle(image,rectangle) \
-{ \
-  rectangle.top=(short) ReadBlobMSBShort(image); \
-  rectangle.left=(short) ReadBlobMSBShort(image); \
-  rectangle.bottom=(short) ReadBlobMSBShort(image); \
-  rectangle.right=(short) ReadBlobMSBShort(image); \
-  if ((rectangle.left > rectangle.right) || \
-      (rectangle.top > rectangle.bottom)) \
-    ThrowReaderException(CorruptImageError,"ImproperImageHeader"); \
-}
-
 typedef struct _PICTCode
 {
   const char
@@ -796,6 +785,18 @@ static inline size_t MagickMax(const size_t x,
   return(y);
 }
 
+static MagickBooleanType ReadRectangle(Image *image,PICTRectangle *rectangle)
+{
+  rectangle->top=(short) ReadBlobMSBShort(image);
+  rectangle->left=(short) ReadBlobMSBShort(image);
+  rectangle->bottom=(short) ReadBlobMSBShort(image);
+  rectangle->right=(short) ReadBlobMSBShort(image);
+  if ((rectangle->left > rectangle->right) ||
+      (rectangle->top > rectangle->bottom))
+    return(MagickFalse);
+  return(MagickTrue);
+}
+
 static Image *ReadPICTImage(const ImageInfo *image_info,
   ExceptionInfo *exception)
 {
@@ -878,7 +879,8 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
     for (i=0; i < 508; i++)
       (void) ReadBlobByte(image);
   (void) ReadBlobMSBShort(image);  /* skip picture size */
-  ReadRectangle(image,frame);
+  if (ReadRectangle(image,&frame) == MagickFalse)
+    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   while ((c=ReadBlobByte(image)) == 0) ;
   if (c != 0x11)
     ThrowReaderException(CorruptImageError,"ImproperImageHeader");
@@ -943,7 +945,8 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
                   (void) ReadBlobByte(image);
                 break;
               }
-            ReadRectangle(image,frame);
+            if (ReadRectangle(image,&frame) == MagickFalse)
+              ThrowReaderException(CorruptImageError,"ImproperImageHeader");
             if (((frame.left & 0x8000) != 0) || ((frame.top & 0x8000) != 0))
               break;
             image->columns=1UL*(frame.right-frame.left);
@@ -977,7 +980,8 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
             if (pattern != 1)
               ThrowReaderException(CorruptImageError,"UnknownPatternType");
             length=ReadBlobMSBShort(image);
-            ReadRectangle(image,frame);
+            if (ReadRectangle(image,&frame) == MagickFalse)
+              ThrowReaderException(CorruptImageError,"ImproperImageHeader");
             ReadPixmap(pixmap);
             image->depth=1UL*pixmap.component_size;
             image->resolution.x=1.0*pixmap.horizontal_resolution;
@@ -1079,7 +1083,8 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
                 (void) ReadBlobMSBShort(image);
                 (void) ReadBlobMSBShort(image);
               }
-            ReadRectangle(image,frame);
+            if (ReadRectangle(image,&frame) == MagickFalse)
+              ThrowReaderException(CorruptImageError,"ImproperImageHeader");
             /*
               Initialize tile image.
             */
@@ -1148,8 +1153,10 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
                     }
                   }
               }
-            ReadRectangle(image,source);
-            ReadRectangle(image,destination);
+            if (ReadRectangle(image,&source) == MagickFalse)
+              ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+            if (ReadRectangle(image,&destination) == MagickFalse)
+              ThrowReaderException(CorruptImageError,"ImproperImageHeader");
             (void) ReadBlobMSBShort(image);
             if ((code == 0x91) || (code == 0x99) || (code == 0x9b))
               {
@@ -1384,7 +1391,11 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
         length=ReadBlobMSBLong(image);
         for (i=0; i < 6; i++)
           (void) ReadBlobMSBLong(image);
-        ReadRectangle(image,frame);
+        if (ReadRectangle(image,&frame) == MagickFalse)
+          {
+            (void) fclose(file);
+            ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+          }
         for (i=0; i < 122; i++)
           (void) ReadBlobByte(image);
         for (i=0; i < (ssize_t) (length-154); i++)
-- 
2.40.0