--- ImageMagick-5.5.6/coders/psd.c.psdoverflow 2003-03-13 15:45:04.000000000 -0500 +++ ImageMagick-5.5.6/coders/psd.c 2005-01-19 15:57:51.226499240 -0500 @@ -448,6 +448,8 @@ static Image *ReadPSDImage(const ImageInfo *image_info,ExceptionInfo *exception) { +#define MaxPSDChannels 24 + typedef struct _ChannelInfo { short int @@ -467,7 +469,7 @@ channels; ChannelInfo - channel_info[24]; + channel_info[MaxPSDChannels]; char blendkey[4]; @@ -595,16 +597,13 @@ count=ReadBlob(image,4,(char *) psd_info.signature); psd_info.version=ReadBlobMSBShort(image); if ((count == 0) || (LocaleNCompare(psd_info.signature,"8BPS",4) != 0) || - (psd_info.version != 1)) { - if (logging) - { - (void) LogMagickEvent(CoderEvent,GetMagickModule()," File signature was %.4s instead of '8BPS'", psd_info.signature ); - (void) LogMagickEvent(CoderEvent,GetMagickModule(),"return"); - } + (psd_info.version != 1)) ThrowReaderException(CorruptImageError,"NotAPSDImageFile",image) - } + (void) ReadBlob(image,6,(char *) psd_info.reserved); psd_info.channels=ReadBlobMSBShort(image); + if (psd_info.channels > MaxPSDChannels) + ThrowReaderException(CorruptImageError,"MaximumChannelsExceeded",image); psd_info.rows=ReadBlobMSBLong(image); psd_info.columns=ReadBlobMSBLong(image); psd_info.depth=ReadBlobMSBShort(image);