From 68db5f601d4120170b91f5397e596c0b8f9d3a8e Mon Sep 17 00:00:00 2001
From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
Date: Fri, 28 Nov 2014 14:26:06 +0000
Subject: Bail out early in case of malformed dpx file

Avoid a SEGV.

git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17112 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
origin: http://trac.imagemagick.org/changeset/17112

diff --git a/coders/dpx.c b/coders/dpx.c
index 0352855..30d2898 100644
--- a/coders/dpx.c
+++ b/coders/dpx.c
@@ -67,6 +67,11 @@
 #include "magick/string-private.h"
 
 /*
+  Define declaration.
+*/
+#define MaxNumberImageElements  8
+
+/*
   Typedef declaration.
 */
 typedef enum
@@ -230,7 +235,7 @@ typedef struct _DPXImageInfo
     lines_per_element;
 
   DPXImageElement
-    image_element[8];
+    image_element[MaxNumberImageElements];
 
   unsigned char
     reserve[52];
@@ -780,6 +785,8 @@ static Image *ReadDPXImage(const ImageInfo *image_info,ExceptionInfo *exception)
     Read DPX image header.
   */
   dpx.image.orientation=ReadBlobShort(image);
+  if (dpx.image.orientation > 7)
+    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   offset+=2;
   if (dpx.image.orientation != (unsigned short) ~0)
     (void) FormatImageProperty(image,"dpx:image.orientation","%d",
@@ -797,7 +804,7 @@ static Image *ReadDPXImage(const ImageInfo *image_info,ExceptionInfo *exception)
     case 7: image->orientation=RightBottomOrientation; break;
   }
   dpx.image.number_elements=ReadBlobShort(image);
-  if (dpx.image.number_elements > 8)
+  if (dpx.image.number_elements > MaxNumberImageElements)
     ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   offset+=2;
   dpx.image.pixels_per_line=ReadBlobLong(image);
-- 
cgit v0.10.2