diff --git a/src/modules/Image/encodings/x.c b/src/modules/Image/encodings/x.c index 70f92b934b704faadb19a9ea4987ac42a7f5d511..ac615d1fdd6f8546b1d3c5b47ac22c9f502817a6 100644 --- a/src/modules/Image/encodings/x.c +++ b/src/modules/Image/encodings/x.c @@ -862,13 +862,20 @@ static void image_x_decode_truecolor(INT32 args) gpos=Bpp-1-gpos, bpos=Bpp-1-bpos; + n=width*height; + + if (n && ((rpos < 0 || gpos < 0 || bpos < 0) || + !((size_t)rpos < len && (size_t)gpos < len && (size_t)bpos < len))) + { + Pike_error("Image.X.decode_trucolor: Malformed X image data\n"); + } + push_int(width); push_int(height); o=clone_object(image_program,2); img=get_storage(o,image_program); d=img->img; - n=width*height; if (nct) while (n--)