38 lines
1.9 KiB
Diff
38 lines
1.9 KiB
Diff
--- ImageMagick/coders/dcm.c.orig 2007-04-03 18:27:57.000000000 +0200
|
|
+++ ImageMagick/coders/dcm.c 2007-04-03 18:31:16.000000000 +0200
|
|
@@ -2902,6 +2902,8 @@ static Image *ReadDCMImage(const ImageIn
|
|
{
|
|
data=(unsigned char *)
|
|
AcquireMagickMemory((size_t) quantum*(length+1));
|
|
+ if (length > ((~0UL)/quantum))
|
|
+ ThrowReaderException(CorruptImageError,"ImproperImageHeader");
|
|
if (data == (unsigned char *) NULL)
|
|
ThrowReaderException(ResourceLimitError,
|
|
"MemoryAllocationFailed");
|
|
--- ImageMagick/coders/xwd.c.orig 2007-04-03 19:21:18.000000000 +0200
|
|
+++ ImageMagick/coders/xwd.c 2007-04-03 19:24:36.000000000 +0200
|
|
@@ -236,7 +236,9 @@ static Image *ReadXWDImage(const ImageIn
|
|
if (header.header_size < sz_XWDheader)
|
|
ThrowReaderException(CorruptImageError,"CorruptImage");
|
|
length=(size_t) header.header_size-sz_XWDheader;
|
|
- comment=(char *) AcquireMagickMemory(length+MaxTextExtent);
|
|
+ if (length > ((~0UL)/sizeof(*comment)))
|
|
+ ThrowReaderException(CorruptImageError,"ImproperImageHeader");
|
|
+ comment=(char *) AcquireMagickMemory((length+1)*sizeof(*comment));
|
|
if (comment == (char *) NULL)
|
|
ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
|
|
count=ReadBlob(image,length,(unsigned char *) comment);
|
|
@@ -278,8 +281,10 @@ static Image *ReadXWDImage(const ImageIn
|
|
XWDColor
|
|
color;
|
|
|
|
- colors=(XColor *)
|
|
- AcquireMagickMemory((size_t) header.ncolors*sizeof(*colors));
|
|
+ length=(size_t) header.ncolors;
|
|
+ if (length > ((~0UL)/sizeof(*colors)))
|
|
+ ThrowReaderException(CorruptImageError,"ImproperImageHeader");
|
|
+ colors=(XColor *) AcquireMagickMemory(length*sizeof(*colors));
|
|
if (colors == (XColor *) NULL)
|
|
ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
|
|
for (i=0; i < (long) header.ncolors; i++)
|