--- a/coders/rle.c Fri Mar 25 18:25:51 2016 -0500
+++ b/coders/rle.c Sat Mar 26 14:39:41 2016 -0500
@@ -1,5 +1,5 @@
/*
-% Copyright (C) 2003-2015 GraphicsMagick Group
+% Copyright (C) 2003-2016 GraphicsMagick Group
% Copyright (C) 2002 ImageMagick Studio
% Copyright 1991-1999 E. I. du Pont de Nemours and Company
%
@@ -308,8 +308,9 @@
image->matte=rle_header.Flags & 0x04;
number_planes=rle_header.Ncolors;
number_colormaps=rle_header.Ncmap;
- map_length=(1 << rle_header.Cmaplen);
+ map_length=(1U << rle_header.Cmaplen);
+ (void) memset(background_color,0,sizeof(background_color));
if (rle_header.Flags & 0x02)
{
/*
@@ -339,17 +340,18 @@
if (number_colormaps != 0)
{
/*
- Read image colormaps.
+ Read image colormaps. Color map values are stored as 16 bit
+ quantities, left justified in the word.
*/
colormap=MagickAllocateArray(unsigned char *,number_colormaps,
map_length);
if (colormap == (unsigned char *) NULL)
ThrowRLEReaderException(ResourceLimitError,MemoryAllocationFailed,
image);
- p=colormap;
+ p=colormap; /* unsigned char * */
for (i=0; i < number_colormaps; i++)
for (x=0; x < map_length; x++)
- *p++=ScaleShortToQuantum(ReadBlobLSBShort(image));
+ *p++=(ReadBlobLSBShort(image) >> 8);
colormap_entries=number_colormaps*map_length;
}
if (rle_header.Flags & 0x08)
@@ -399,7 +401,8 @@
Max(number_planes,4));
if (rle_pixels == (unsigned char *) NULL)
ThrowRLEReaderException(ResourceLimitError,MemoryAllocationFailed,image);
- rle_bytes=number_pixels*Max(number_planes,4);
+ rle_bytes=MagickArraySize(number_pixels,Max(number_planes,4));
+ (void) memset(rle_pixels,0,rle_bytes);
if ((rle_header.Flags & 0x01) && !(rle_header.Flags & 0x02))
{
int
@@ -630,7 +633,10 @@
{
image->colormap[i].red=ScaleCharToQuantum(*p);
image->colormap[i].green=ScaleCharToQuantum(*(p+map_length));
- image->colormap[i].blue=ScaleCharToQuantum(*(p+map_length*2));
+ if (number_colormaps > 2)
+ image->colormap[i].blue=ScaleCharToQuantum(*(p+map_length*2));
+ else
+ image->colormap[i].blue=0U;
p++;
}
p=rle_pixels;