diff --git a/ImageMagick/magick/xwindow.c b/ImageMagick/magick/xwindow.c index c88b1eb..f91d1e7 100644 --- a/ImageMagick/magick/xwindow.c +++ b/ImageMagick/magick/xwindow.c @@ -5368,6 +5368,9 @@ MagickExport MagickBooleanType XMakeImage(Display *display, const XResourceInfo *resource_info,XWindowInfo *window,Image *image, unsigned int width,unsigned int height) { +#define CheckOverflowException(length,width,height) \ + (((height) != 0) && ((length)/((size_t) height) != ((size_t) width))) + int depth, format; @@ -5507,9 +5510,11 @@ MagickExport MagickBooleanType XMakeImage(Display *display, (char *) NULL,&segment_info[1],width,height); if (ximage == (XImage *) NULL) window->shared_memory=MagickFalse; + length=(size_t) ximage->bytes_per_line*ximage->height; + if (CheckOverflowException(length,ximage->bytes_per_line,ximage->height)) + window->shared_memory=MagickFalse; if (window->shared_memory != MagickFalse) - segment_info[1].shmid=shmget(IPC_PRIVATE,(unsigned int) - (ximage->bytes_per_line*ximage->height),IPC_CREAT | 0777); + segment_info[1].shmid=shmget(IPC_PRIVATE,length,IPC_CREAT | 0777); if (window->shared_memory != MagickFalse) segment_info[1].shmaddr=(char *) shmat(segment_info[1].shmid,0,0); if (segment_info[1].shmid < 0) @@ -5612,11 +5617,12 @@ MagickExport MagickBooleanType XMakeImage(Display *display, } if (window->shared_memory == MagickFalse) { - if (ximage->format == XYBitmap) - length=(size_t) ximage->bytes_per_line*ximage->height*ximage->depth; + if (ximage->format != XYBitmap) + ximage->data=(char *) AcquireQuantumMemory((size_t) + ximage->bytes_per_line,(size_t) ximage->height); else - length=(size_t) ximage->bytes_per_line*ximage->height; - ximage->data=(char *) malloc(length); + ximage->data=(char *) AcquireQuantumMemory((size_t) + ximage->bytes_per_line*ximage->depth,(size_t) ximage->height); } if (ximage->data == (char *) NULL) { @@ -5694,9 +5700,9 @@ MagickExport MagickBooleanType XMakeImage(Display *display, /* Allocate matte image pixel data. */ - length=(size_t) matte_image->bytes_per_line* - matte_image->height*matte_image->depth; - matte_image->data=(char *) malloc(length); + matte_image->data=(char *) AcquireQuantumMemory((size_t) + matte_image->bytes_per_line*matte_image->depth, + (size_t) matte_image->height); if (matte_image->data == (char *) NULL) { XDestroyImage(matte_image);