Merge the android-9.0.0_r55 release tag
Android 9.0.0 Release 55 (6197209)
* tag 'android-9.0.0_r55':
https://github.com/ImageMagick/ImageMagick/issues/1554
Change-Id: I4f3201c523d8f960aa2ace3b665457d9bcaeb9be
diff --git a/coders/mat.c b/coders/mat.c
index 515fc58..be7abaf 100644
--- a/coders/mat.c
+++ b/coders/mat.c
@@ -628,6 +628,7 @@
(void) SeekBlob(image,0,SEEK_SET);
ldblk=ReadBlobLSBLong(image);
+ if(EOFBlob(image)) return((Image *) NULL);
if ((ldblk > 9999) || (ldblk < 0))
return((Image *) NULL);
HDR.Type[3]=ldblk % 10; ldblk /= 10; /* T digit */
@@ -887,16 +888,20 @@
MATLAB_KO: ThrowReaderException(CorruptImageError,"ImproperImageHeader");
filepos = TellBlob(image);
- while(!EOFBlob(image)) /* object parser loop */
+ while(filepos < GetBlobSize(image) && !EOFBlob(image)) /* object parser loop */
{
Frames = 1;
(void) SeekBlob(image,filepos,SEEK_SET);
+ if(filepos > GetBlobSize(image) || filepos < 0)
+ break;
/* printf("pos=%X\n",TellBlob(image)); */
MATLAB_HDR.DataType = ReadBlobXXXLong(image);
if(EOFBlob(image)) break;
MATLAB_HDR.ObjectSize = ReadBlobXXXLong(image);
if(EOFBlob(image)) break;
+ if((MagickSizeType) (MATLAB_HDR.ObjectSize+filepos) >= GetBlobSize(image))
+ goto MATLAB_KO;
filepos += MATLAB_HDR.ObjectSize + 4 + 4;
image2 = image;
@@ -1105,6 +1110,7 @@
{
if (logging) (void)LogMagickEvent(CoderEvent,GetMagickModule(),
" MAT cannot read scanrow %u from a file.", (unsigned)(MATLAB_HDR.SizeY-i-1));
+ ThrowReaderException(CorruptImageError,"UnexpectedEndOfFile");
goto ExitLoop;
}
if((CellType==miINT8 || CellType==miUINT8) && (MATLAB_HDR.StructureFlag & FLAG_LOGICAL))