Commit 1dc1fc931 for imagemagick.org
commit 1dc1fc93135a5ad8c7a8fe9c258d367ab4fbc185
Author: Dirk Lemstra <dirk@lemstra.org>
Date: Sun Dec 14 10:06:00 2025 +0100
Added extra checks to prevent overflows on 32-bit systems and do an earlier exit.
diff --git a/coders/ipl.c b/coders/ipl.c
index 7541adcde..823d430b6 100644
--- a/coders/ipl.c
+++ b/coders/ipl.c
@@ -300,7 +300,12 @@ static Image *ReadIPLImage(const ImageInfo *image_info,ExceptionInfo *exception)
quantum_format = UnsignedQuantumFormat;
break;
}
- extent=ipl_info.width*ipl_info.height*ipl_info.z*ipl_info.depth/8;
+ if (HeapOverflowSanityCheckGetSize(ipl_info.width,ipl_info.height,&extent) != MagickFalse)
+ ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+ if (HeapOverflowSanityCheckGetSize(extent,ipl_info.z,&extent) != MagickFalse)
+ ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+ if (HeapOverflowSanityCheckGetSize(extent,ipl_info.depth/8,&extent) != MagickFalse)
+ ThrowReaderException(CorruptImageError,"ImproperImageHeader");
if (extent > GetBlobSize(image))
ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");