From 27411f1d1d3a0b328cede4a808525ee237cb415b Mon Sep 17 00:00:00 2001 From: Cristy Date: Sat, 7 Oct 2023 10:48:39 +0800 Subject: [PATCH] check for BMP file size, poc provided by Hardik Shah of Vehere (Dawn Treaders team) --- coders/bmp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/coders/bmp.c b/coders/bmp.c index 6f9b57b..5e6dac3 100644 --- a/coders/bmp.c +++ b/coders/bmp.c @@ -635,6 +635,9 @@ static Image *ReadBMPImage(const ImageInfo *image_info,ExceptionInfo *exception) " BMP header size: %u",bmp_info.size); if (bmp_info.size > 124) ThrowReaderException(CorruptImageError,"ImproperImageHeader"); + if ((bmp_info.file_size != 0) && + ((MagickSizeType) bmp_info.file_size > GetBlobSize(image))) + ThrowReaderException(CorruptImageError,"ImproperImageHeader"); if (bmp_info.offset_bits < bmp_info.size) ThrowReaderException(CorruptImageError,"ImproperImageHeader"); profile_data=0; -- 2.27.0