Skip to content

Commit 7779f1f

Browse files
committed
Added extra check to avoid an overflow on 32-bit machines (GHSA-6hjr-v6g4-3fm8)
1 parent 3af9a95 commit 7779f1f

File tree

1 file changed

+4
-1
lines changed

1 file changed

+4
-1
lines changed

coders/tim.c

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -234,7 +234,10 @@ static Image *ReadTIMImage(const ImageInfo *image_info,ExceptionInfo *exception)
234234
(void) ReadBlobLSBShort(image);
235235
width=ReadBlobLSBShort(image);
236236
height=ReadBlobLSBShort(image);
237-
image_size=2*width*height;
237+
if (HeapOverflowSanityCheckGetSize(2*width,height,&image_size) != MagickFalse)
238+
ThrowReaderException(CorruptImageError,"ImproperImageHeader");
239+
if (image_size > GetBlobSize(image))
240+
ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
238241
bytes_per_line=width*2;
239242
width=(width*16)/bits_per_pixel;
240243
image->columns=width;

0 commit comments

Comments
 (0)