From c504b8e1a1ca6f158f2d08bd33c62ce4865497ee Mon Sep 17 00:00:00 2001
From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
Date: Tue, 28 Oct 2014 10:15:41 +0000
Subject: Avoid an infinite loop

Avoid an infinite loop if too many object in vision.c

This could lead to a DOS.

git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@16864 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
origin: http://trac.imagemagick.org/changeset/16864

diff --git a/config/english.xml b/config/english.xml
index c26749c..6c864f2 100644
--- a/config/english.xml
+++ b/config/english.xml
@@ -948,6 +948,9 @@
           <message name="MemoryAllocationFailed">
             memory allocation failed
           </message>
+          <message name="TooManyObjects">
+            too many objects
+          </message>
           <message name="UnableToAcquireString">
             unable to acquire string
           </message>
diff --git a/config/francais.xml b/config/francais.xml
index 6c217d6..b421ecb 100644
--- a/config/francais.xml
+++ b/config/francais.xml
@@ -936,6 +936,9 @@
           <message name="MemoryAllocationFailed">
             Échec allocation mémoire
           </message>
+          <message name="TooManyObjects">
+            too many objects
+          </message>
           <message name="UnableToAcquireString">
             échec acquisition de la chaine
           </message>
diff --git a/magick/vision.c b/magick/vision.c
index 4a42f5b..cdca011 100644
--- a/magick/vision.c
+++ b/magick/vision.c
@@ -453,6 +453,11 @@ MagickExport Image *ConnectedComponentsImage(const Image *image,
   }
   component_view=DestroyCacheView(component_view);
   equivalences=DestroyMatrixInfo(equivalences);
+  if (n > QuantumRange)
+    {
+      component_image=DestroyImage(component_image);
+      ThrowImageException(ResourceLimitError,"TooManyObjects");
+    }
   artifact=GetImageArtifact(image,"connected-components:verbose");
   if (IsMagickTrue(artifact))
     status=ConnectedComponentsStatistics(component_image,(size_t) n,exception);
-- 
cgit v0.10.2