averello/ImageMagick-mirror
1
0
Fork 0
mirror of https://github.com/ImageMagick/ImageMagick.git synced 2026-06-08 15:37:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Added overflow checks.

Browse Source
This commit is contained in:
Dirk Lemstra
2026-01-20 22:38:36 +01:00
parent 887a187860
commit 0d0752cf4b
1 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
coders/pcd.c
+8 -3
View File
@@ -509,6 +509,7 @@ static Image *ReadPCDImage(const ImageInfo *image_info,ExceptionInfo *exception)
number_pixels,
rotate,
scene,
size,
width;
ssize_t
@@ -608,11 +609,15 @@ static Image *ReadPCDImage(const ImageInfo *image_info,ExceptionInfo *exception)
/*
Allocate luma and chroma memory.
*/
pixel_info=AcquireVirtualMemory(image->columns+1UL,30*image->rows*
sizeof(*luma));
if (HeapOverflowSanityCheckGetSize(image->columns+1UL,image->rows,&size) != MagickFalse)
ThrowReaderException(CorruptImageError,"ImproperImageHeader");
if (HeapOverflowSanityCheckGetSize(size,10,&number_pixels) != MagickFalse)
ThrowReaderException(CorruptImageError,"ImproperImageHeader");
if (HeapOverflowSanityCheckGetSize(size,30,&size) != MagickFalse)
ThrowReaderException(CorruptImageError,"ImproperImageHeader");
pixel_info=AcquireVirtualMemory(size,sizeof(*luma));
if (pixel_info == (MemoryInfo *) NULL)
ThrowPCDException(ResourceLimitError,"MemoryAllocationFailed");
number_pixels=(image->columns+1UL)*10*image->rows*sizeof(*luma);
luma=(unsigned char *) GetVirtualMemoryBlob(pixel_info);
chroma1=(unsigned char *) GetVirtualMemoryBlob(pixel_info)+number_pixels;
chroma2=(unsigned char *) GetVirtualMemoryBlob(pixel_info)+2*number_pixels;