diff --git a/src/modules/Image/encodings/x.c b/src/modules/Image/encodings/x.c index 323987a4aa52ae7f270c956e3e09f26afeeb9681..3739cad5af8546cb4d63bdaa965931955bdb341a 100644 --- a/src/modules/Image/encodings/x.c +++ b/src/modules/Image/encodings/x.c @@ -826,6 +826,13 @@ static void image_x_decode_truecolor(INT32 args) bshift>=bpp || bshift<0) Pike_error("Image.X.decode_truecolor: illegal colorshifts\n"); + if (rbits < 0 || gbits < 0 || bbits < 0 || + rbits > 24 || gbits > 24 || bbits > 24 || + rbits + gbits + bbits > 24) + { + Pike_error("Image.X.decode_truecolor: illegal colorbits\n"); + } + if (args>12) { if (TYPEOF(sp[12-args]) != T_OBJECT || @@ -930,9 +937,19 @@ static void image_x_decode_truecolor(INT32 args) else { int i,j; - COLORTYPE *rtbl=alloca(1<<rbits); - COLORTYPE *gtbl=alloca(1<<gbits); - COLORTYPE *btbl=alloca(1<<bbits); + COLORTYPE *rtbl; + COLORTYPE *gtbl; + COLORTYPE *btbl; + + if (!(rbits && gbits && bbits)) + Pike_error("Image.X.decode_truecolor: illegal colorshifts\n"); + + check_c_stack((1 << rbits) + (1 << gbits) + (1 << bbits)); + + *rtbl=alloca(1<<rbits); + *gtbl=alloca(1<<gbits); + *btbl=alloca(1<<bbits); + if (!rtbl || !gtbl || !btbl) SIMPLE_OUT_OF_MEMORY_ERROR("decode_truecolor", (1<<rbits)+(1<<rbits)+(1<<rbits));