From fcef1759cf383a82c89b0bc77de40c6cd37b140b Mon Sep 17 00:00:00 2001 From: dirk Date: Mon, 29 Dec 2014 21:43:36 +0000 Subject: [PATCH] Replaced ConstrainColormapIndex with IsValidColormapIndex. --- coders/bmp.c | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) diff --git a/coders/bmp.c b/coders/bmp.c index 1218d8921..79626d16a 100644 --- a/coders/bmp.c +++ b/coders/bmp.c @@ -1084,21 +1084,29 @@ static Image *ReadBMPImage(const ImageInfo *image_info,ExceptionInfo *exception) break; for (x=0; x < ((ssize_t) image->columns-1); x+=2) { - index=ConstrainColormapIndex(image,(*p >> 4) & 0x0f,exception); + if (IsValidColormapIndex(image,(*p >> 4) & 0x0f,&index,exception) + == MagickFalse) + break; SetPixelIndex(image,index,q); q+=GetPixelChannels(image); - index=ConstrainColormapIndex(image,*p & 0x0f,exception); + if (IsValidColormapIndex(image,*p & 0x0f,&index,exception) == + MagickFalse) + break; SetPixelIndex(image,index,q); q+=GetPixelChannels(image); p++; } if ((image->columns % 2) != 0) { - index=ConstrainColormapIndex(image,(*p >> 4) & 0xf,exception); + if (IsValidColormapIndex(image,(*p >> 4) & 0xf,&index,exception) + == MagickFalse) + break; SetPixelIndex(image,index,q); q+=GetPixelChannels(image); p++; } + if (x < image->columns) + break; if (SyncAuthenticPixels(image,exception) == MagickFalse) break; if (image->previous == (Image *) NULL) @@ -1128,10 +1136,14 @@ static Image *ReadBMPImage(const ImageInfo *image_info,ExceptionInfo *exception) break; for (x=(ssize_t) image->columns; x != 0; --x) { - index=ConstrainColormapIndex(image,*p++,exception); + if (IsValidColormapIndex(image,*p++,&index,exception) == + MagickFalse) + break; SetPixelIndex(image,index,q); q+=GetPixelChannels(image); } + if (x > 0) + break; if (SyncAuthenticPixels(image,exception) == MagickFalse) break; offset=(MagickOffsetType) (image->rows-y-1); @@ -1323,6 +1335,8 @@ static Image *ReadBMPImage(const ImageInfo *image_info,ExceptionInfo *exception) } } pixel_info=RelinquishVirtualMemory(pixel_info); + if (y > 0) + break; if (EOFBlob(image) != MagickFalse) { ThrowFileException(exception,CorruptImageError,"UnexpectedEndOfFile", -- 2.40.0