Attachment #490600 for bug #628188




                  mng_info->image=image;
                }

              if ((mng_info->mng_width > 65535L) ||
                  (mng_info->mng_height > 65535L))
                {
                  (void) LogMagickEvent(CoderEvent,GetMagickModule(),
                      "  MNG width or height is too large: %lu, %lu",
                      mng_info->mng_width,mng_info->mng_height);
                  MagickFreeMemory(chunk);
                  ThrowReaderException(CorruptImageError,
                     ImproperImageHeader,image);
                }

              FormatString(page_geometry,"%lux%lu+0+0",mng_info->mng_width,
                           mng_info->mng_height);
              mng_info->frame.left=0;

Return to bug 628188

Lines 4084-4094 Link Here

(-)a/coders/png.c (-5 / +11 lines)
4084	mng_info->image=image;	4084	mng_info->image=image;
4085	}	4085	}
4086		4086
4087	if ((mng_info->mng_width > 65535L) \|\| (mng_info->mng_height	4087	if ((mng_info->mng_width > 65535L) \|\|
4088	> 65535L))	4088	(mng_info->mng_height > 65535L))
4089	(void) ThrowException(&image->exception,ImageError,	4089	{
4090	WidthOrHeightExceedsLimit,	4090	(void) LogMagickEvent(CoderEvent,GetMagickModule(),
4091	image->filename);	4091	" MNG width or height is too large: %lu, %lu",
		4092	mng_info->mng_width,mng_info->mng_height);
		4093	MagickFreeMemory(chunk);
		4094	ThrowReaderException(CorruptImageError,
		4095	ImproperImageHeader,image);
		4096	}
		4097
4092	FormatString(page_geometry,"%lux%lu+0+0",mng_info->mng_width,	4098	FormatString(page_geometry,"%lux%lu+0+0",mng_info->mng_width,
4093	mng_info->mng_height);	4099	mng_info->mng_height);
4094	mng_info->frame.left=0;	4100	mng_info->frame.left=0;