From b68b78e2625122d9f6b6d88ba4df7e85b47b556f Mon Sep 17 00:00:00 2001
From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
Date: Sun, 7 Dec 2014 12:52:08 +0000
Subject: Fix handling of corrupted sun and wpg file

git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17165 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
origin:  http://trac.imagemagick.org/changeset/17165

diff --git a/coders/sun.c b/coders/sun.c
index 1d974db..07234b7 100644
--- a/coders/sun.c
+++ b/coders/sun.c
@@ -306,6 +306,8 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
     sun_info.type=ReadBlobMSBLong(image);
     sun_info.maptype=ReadBlobMSBLong(image);
     sun_info.maplength=ReadBlobMSBLong(image);
+    if ((sun_info.height != 0) && (sun_info.width != extent/sun_info.height))
+      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
     if ((sun_info.type != RT_STANDARD) && (sun_info.type != RT_ENCODED) &&
         (sun_info.type != RT_FORMAT_RGB))
       ThrowReaderException(CorruptImageError,"ImproperImageHeader");
diff --git a/coders/wpg.c b/coders/wpg.c
index f051e03..24430c7 100644
--- a/coders/wpg.c
+++ b/coders/wpg.c
@@ -474,7 +474,7 @@ static int UnpackWPGRaster(Image *image,int bpp)
 
   ldblk=(ssize_t) ((bpp*image->columns+7)/8);
   BImgBuff=(unsigned char *) AcquireQuantumMemory((size_t) ldblk,
-    sizeof(*BImgBuff));
+    4*sizeof(*BImgBuff));
   if(BImgBuff==NULL) return(-2);
 
   while(y<(ssize_t) image->rows)
diff --git a/config/english.xml b/config/english.xml
index 9ef56c2..6c864f2 100644
--- a/config/english.xml
+++ b/config/english.xml
@@ -122,9 +122,6 @@
         <message name="ImageIsNotTiled">
           image is not tiled
         </message>
-        <message name="ImproperImageHeader">
-          improper image header
-        </message>
         <message name="IrregularChannelGeometryNotSupported">
           irregular channel geometry not supported
         </message>
@@ -258,6 +255,9 @@
           <message name="ImageTypeNotSupported">
             image type not supported
           </message>
+          <message name="ImproperImageHeader">
+            improper image header
+          </message>
           <message name="InsufficientImageDataInFile">
             insufficient image data in file
           </message>
diff --git a/config/francais.xml b/config/francais.xml
index 1a270f7..b421ecb 100644
--- a/config/francais.xml
+++ b/config/francais.xml
@@ -116,9 +116,6 @@
         <message name="ImageDoesNotHaveAAlphaChannel">
           l'image n'a pas de canal de transparence
         </message>
-        <message name="ImproperImageHeader">
-          En-tête d'image incorrect
-        </message>
         <message name="ImageIsNotTiled">
           l'image n'a pas tiled
         </message>
@@ -258,6 +255,9 @@
           <message name="ImageTypeNotSupported">
             type d'image non supporté
           </message>
+          <message name="ImproperImageHeader">
+            En-tête d'image incorrect
+          </message>
           <message name="InsufficientImageDataInFile">
             Pas assez de données d'image dans le fichier
           </message>
-- 
cgit v0.10.2