diff --git a/coders/pict.c b/coders/pict.c
index dafac52..c6a71b5 100644
--- a/coders/pict.c
+++ b/coders/pict.c
@@ -89,9 +89,9 @@
pixmap.plane_bytes=ReadBlobMSBLong(image); \
pixmap.table=ReadBlobMSBLong(image); \
pixmap.reserved=ReadBlobMSBLong(image); \
- if ((pixmap.bits_per_pixel <= 0) || (pixmap.bits_per_pixel > 32) || \
- (pixmap.component_count <= 0) || (pixmap.component_count > 4) || \
- (pixmap.component_size <= 0)) \
+ if ((EOFBlob(image) != MagickFalse) || (pixmap.bits_per_pixel <= 0) || \
+ (pixmap.bits_per_pixel > 32) || (pixmap.component_count <= 0) || \
+ (pixmap.component_count > 4) || (pixmap.component_size <= 0)) \
ThrowReaderException(CorruptImageError,"ImproperImageHeader"); \
}
@@ -488,7 +488,13 @@
q=pixels+y*width*GetPixelChannels(image);;
number_pixels=bytes_per_line;
count=ReadBlob(blob,(size_t) number_pixels,scanline);
- (void) count;
+ if (count != (ssize_t) number_pixels)
+ {
+ (void) ThrowMagickException(exception,GetMagickModule(),
+ CorruptImageError,"UnableToUncompressImage","`%s'",
+ image->filename);
+ break;
+ }
p=ExpandBuffer(scanline,&number_pixels,bits_per_pixel);
if ((q+number_pixels) > (pixels+(*extent)))
{
@@ -519,6 +525,12 @@
break;
}
count=ReadBlob(blob,scanline_length,scanline);
+ if (count != (ssize_t) scanline_length)
+ {
+ (void) ThrowMagickException(exception,GetMagickModule(),
+ CorruptImageError,"UnableToUncompressImage","`%s'",image->filename);
+ break;
+ }
for (j=0; j < (ssize_t) scanline_length; )
if ((scanline[j] & 0x80) == 0)
{
@@ -784,7 +796,7 @@
rectangle->left=(short) ReadBlobMSBShort(image);
rectangle->bottom=(short) ReadBlobMSBShort(image);
rectangle->right=(short) ReadBlobMSBShort(image);
- if ((rectangle->left > rectangle->right) ||
+ if ((EOFBlob(image) != MagickFalse) || (rectangle->left > rectangle->right) ||
(rectangle->top > rectangle->bottom))
return(MagickFalse);
return(MagickTrue);
@@ -1297,7 +1309,8 @@
if (info == (unsigned char *) NULL)
break;
count=ReadBlob(image,length,info);
- (void) count;
+ if (count != (ssize_t) length)
+ ThrowReaderException(ResourceLimitError,"UnableToReadImageData");
switch (type)
{
case 0xe0: