Commit 623297e5 authored by Cristy's avatar Cristy

...

parent 2c3373ed
......@@ -238,7 +238,12 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)
ThrowReaderException(CorruptImageError,"FileFormatVersionMismatch");
if (header.header_size < sz_XWDheader)
ThrowReaderException(CorruptImageError,"ImproperImageHeader");
if ((MagickSizeType) header.xoffset >= GetBlobSize(image))
if (header.xoffset >= header.pixmap_width)
ThrowReaderException(CorruptImageError,"ImproperImageHeader");
if (((header.pixmap_depth | header.pixmap_format | header.xoffset |
header.pixmap_width | header.pixmap_height | header.bitmap_pad |
header.bytes_per_line | header.byte_order | header.bitmap_unit |
header.bitmap_bit_order | header.bits_per_pixel) >> 31) != 0)
ThrowReaderException(CorruptImageError,"ImproperImageHeader");
switch (header.visual_class)
{
......@@ -353,10 +358,11 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)
ximage->red_mask=header.red_mask;
ximage->green_mask=header.green_mask;
ximage->blue_mask=header.blue_mask;
if ((ximage->width < 0) || (ximage->height < 0) || (ximage->depth < 0) ||
(ximage->format < 0) || (ximage->byte_order < 0) ||
(ximage->bitmap_bit_order < 0) || (ximage->bitmap_pad < 0) ||
(ximage->bytes_per_line < 0))
if ((ximage->depth < 0) || (ximage->format < 0) || (ximage->xoffset < 0) ||
(ximage->width < 0) || (ximage->height < 0) || (ximage->bitmap_pad < 0) ||
(ximage->bytes_per_line < 0) || (ximage->byte_order < 0) ||
(ximage->bitmap_unit < 0) || (ximage->bitmap_bit_order < 0) ||
(ximage->bits_per_pixel < 0))
{
ximage=(XImage *) RelinquishMagickMemory(ximage);
ThrowReaderException(CorruptImageError,"ImproperImageHeader");
......@@ -691,7 +697,6 @@ ModuleExport size_t RegisterXWDImage(void)
entry->encoder=(EncodeImageHandler *) WriteXWDImage;
#endif
entry->magick=(IsImageFormatHandler *) IsXWD;
entry->flags|=CoderDecoderSeekableStreamFlag;
entry->flags^=CoderAdjoinFlag;
(void) RegisterMagickInfo(entry);
return(MagickImageCoderSignature);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment