pkg://ImageMagick-5.5.6-13.legacy.src.rpm:3566734/ImageMagick-5.5.6-psdchannels.patch  info  downloads

diff -Naur ImageMagick-5.5.6.ori/coders/psd.c ImageMagick-5.5.6/coders/psd.c
--- ImageMagick-5.5.6.ori/coders/psd.c	2003-03-13 15:45:04.000000000 -0500
+++ ImageMagick-5.5.6/coders/psd.c	2005-03-03 18:53:53.000000000 -0500
@@ -448,6 +448,8 @@
 
 static Image *ReadPSDImage(const ImageInfo *image_info,ExceptionInfo *exception)
 {
+#define MaxPSDChannels 24
+
   typedef struct _ChannelInfo
   {
     short int
@@ -467,7 +469,7 @@
       channels;
 
     ChannelInfo
-      channel_info[24];
+      channel_info[MaxPSDChannels];
 
     char
       blendkey[4];
@@ -595,16 +597,12 @@
   count=ReadBlob(image,4,(char *) psd_info.signature);
   psd_info.version=ReadBlobMSBShort(image);
   if ((count == 0) || (LocaleNCompare(psd_info.signature,"8BPS",4) != 0) ||
-      (psd_info.version != 1)) {
-      if (logging)
-        {
-          (void) LogMagickEvent(CoderEvent,GetMagickModule(),"  File signature was %.4s instead of '8BPS'", psd_info.signature );
-          (void) LogMagickEvent(CoderEvent,GetMagickModule(),"return");
-        }
-    ThrowReaderException(CorruptImageError,"NotAPSDImageFile",image)
-  }
+      (psd_info.version != 1))
+    ThrowReaderException(CorruptImageError,"NotAPSDImageFile",image);
   (void) ReadBlob(image,6,(char *) psd_info.reserved);
   psd_info.channels=ReadBlobMSBShort(image);
+  if (psd_info.channels > MaxPSDChannels)
+    ThrowReaderException(CorruptImageError,"MaximumChannelsExceeded",image);
   psd_info.rows=ReadBlobMSBLong(image);
   psd_info.columns=ReadBlobMSBLong(image);
   psd_info.depth=ReadBlobMSBShort(image);
@@ -811,6 +809,8 @@
         layer_info[i].page.height=(ReadBlobMSBLong(image)-layer_info[i].page.y);
         layer_info[i].page.width=(ReadBlobMSBLong(image)-layer_info[i].page.x);
         layer_info[i].channels=ReadBlobMSBShort(image);
+        if (layer_info[i].channels > MaxPSDChannels)
+          ThrowReaderException(CorruptImageError,"MaximumChannelsExceeded",image);
       if (logging)
       {
         (void) LogMagickEvent(CoderEvent,GetMagickModule(),"    offset(%ld,%ld), size(%ld,%ld), channels=%d",