restrict rows/columns to one keyword

ImageMagick · Jul 2, 2022 · 5dcfcf4 · 5dcfcf4
1 parent 7615041
commit 5dcfcf4
Showing 1 changed file with 11 additions and 5 deletions.
diff --git a/coders/miff.c b/coders/miff.c
@@ -727,6 +727,14 @@ static Image *ReadMIFFImage(const ImageInfo *image_info,
                     image->colorspace=(ColorspaceType) colorspace;
                     break;
                   }
+                if (LocaleCompare(keyword,"columns") == 0)
+                  {
+                    if (image->columns != 0)
+                      ThrowReaderException(CorruptImageError,
+                        "ImproperImageHeader");
+                    image->columns=StringToUnsignedLong(options);
+                    break;
+                  }
                 if (LocaleCompare(keyword,"compression") == 0)
                   {
                     ssize_t
@@ -739,11 +747,6 @@ static Image *ReadMIFFImage(const ImageInfo *image_info,
                     image->compression=(CompressionType) compression;
                     break;
                   }
-                if (LocaleCompare(keyword,"columns") == 0)
-                  {
-                    image->columns=StringToUnsignedLong(options);
-                    break;
-                  }
                 (void) SetImageProperty(image,keyword,options);
                 break;
               }
@@ -1003,6 +1006,9 @@ static Image *ReadMIFFImage(const ImageInfo *image_info,
                   }
                 if (LocaleCompare(keyword,"rows") == 0)
                   {
+                    if (image->rows != 0)
+                      ThrowReaderException(CorruptImageError,
+                        "ImproperImageHeader");
                     image->rows=StringToUnsignedLong(options);
                     break;
                   }