--- ImageMagick/coders/dcm.c.orig	2007-04-03 18:27:57.000000000 +0200
+++ ImageMagick/coders/dcm.c	2007-04-03 18:31:16.000000000 +0200
@@ -2902,6 +2902,8 @@ static Image *ReadDCMImage(const ImageIn
             {
               data=(unsigned char *)
                 AcquireMagickMemory((size_t) quantum*(length+1));
+              if (length > ((~0UL)/quantum))
+                ThrowReaderException(CorruptImageError,"ImproperImageHeader");
               if (data == (unsigned char *) NULL)
                 ThrowReaderException(ResourceLimitError,
                   "MemoryAllocationFailed");
--- ImageMagick/coders/xwd.c.orig	2007-04-03 19:21:18.000000000 +0200
+++ ImageMagick/coders/xwd.c	2007-04-03 19:24:36.000000000 +0200
@@ -236,7 +236,9 @@ static Image *ReadXWDImage(const ImageIn
   if (header.header_size < sz_XWDheader)
     ThrowReaderException(CorruptImageError,"CorruptImage");
   length=(size_t) header.header_size-sz_XWDheader;
-  comment=(char *) AcquireMagickMemory(length+MaxTextExtent);
+  if (length > ((~0UL)/sizeof(*comment)))
+    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+  comment=(char *) AcquireMagickMemory((length+1)*sizeof(*comment));
   if (comment == (char *) NULL)
     ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
   count=ReadBlob(image,length,(unsigned char *) comment);
@@ -278,8 +281,10 @@ static Image *ReadXWDImage(const ImageIn
       XWDColor
         color;
 
-      colors=(XColor *)
-        AcquireMagickMemory((size_t) header.ncolors*sizeof(*colors));
+      length=(size_t) header.ncolors;
+      if (length > ((~0UL)/sizeof(*colors)))
+        ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+      colors=(XColor *) AcquireMagickMemory(length*sizeof(*colors));
       if (colors == (XColor *) NULL)
         ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
       for (i=0; i < (long) header.ncolors; i++)