coders/rle.c
changeset 14750 0a5b75e019b6
parent 14729 c6a6ea253a35
child 14856 8711e07cdebe
child 14895 30043afadb10
--- a/coders/rle.c	Fri Mar 25 18:25:51 2016 -0500
+++ b/coders/rle.c	Sat Mar 26 14:39:41 2016 -0500
@@ -1,5 +1,5 @@
 /*
-% Copyright (C) 2003-2015 GraphicsMagick Group
+% Copyright (C) 2003-2016 GraphicsMagick Group
 % Copyright (C) 2002 ImageMagick Studio
 % Copyright 1991-1999 E. I. du Pont de Nemours and Company
 %
@@ -308,8 +308,9 @@
     image->matte=rle_header.Flags & 0x04;
     number_planes=rle_header.Ncolors;
     number_colormaps=rle_header.Ncmap;
-    map_length=(1 << rle_header.Cmaplen);
+    map_length=(1U << rle_header.Cmaplen);
 
+    (void) memset(background_color,0,sizeof(background_color));
     if (rle_header.Flags & 0x02)
       {
         /*
@@ -339,17 +340,18 @@
     if (number_colormaps != 0)
       {
         /*
-          Read image colormaps.
+          Read image colormaps.  Color map values are stored as 16 bit
+          quantities, left justified in the word.
         */
         colormap=MagickAllocateArray(unsigned char *,number_colormaps,
                                      map_length);
         if (colormap == (unsigned char *) NULL)
           ThrowRLEReaderException(ResourceLimitError,MemoryAllocationFailed,
             image);
-        p=colormap;
+        p=colormap; /* unsigned char * */
         for (i=0; i < number_colormaps; i++)
           for (x=0; x < map_length; x++)
-            *p++=ScaleShortToQuantum(ReadBlobLSBShort(image));
+            *p++=(ReadBlobLSBShort(image) >> 8);
         colormap_entries=number_colormaps*map_length;
       }
     if (rle_header.Flags & 0x08)
@@ -399,7 +401,8 @@
                                    Max(number_planes,4));
     if (rle_pixels == (unsigned char *) NULL)
       ThrowRLEReaderException(ResourceLimitError,MemoryAllocationFailed,image);
-    rle_bytes=number_pixels*Max(number_planes,4);
+    rle_bytes=MagickArraySize(number_pixels,Max(number_planes,4));
+    (void) memset(rle_pixels,0,rle_bytes);
     if ((rle_header.Flags & 0x01) && !(rle_header.Flags & 0x02))
       {
         int
@@ -630,7 +633,10 @@
             {
               image->colormap[i].red=ScaleCharToQuantum(*p);
               image->colormap[i].green=ScaleCharToQuantum(*(p+map_length));
-              image->colormap[i].blue=ScaleCharToQuantum(*(p+map_length*2));
+              if (number_colormaps > 2)
+                image->colormap[i].blue=ScaleCharToQuantum(*(p+map_length*2));
+              else
+                image->colormap[i].blue=0U;
               p++;
             }
         p=rle_pixels;