...

2 files changed, 28 insertions, 8 deletions

diff --git a/coders/pict.c b/coders/pict.c
index e8ce3f719..8bcbfe930 100644
--- a/coders/pict.c
+++ b/coders/pict.c
@@ -1764,10 +1764,19 @@ static MagickBooleanType WritePICTImage(const ImageInfo *image_info,
   pixmap.table=0;
   pixmap.reserved=0;
   transfer_mode=0;
-  x_resolution=image->resolution.x != 0.0 ? image->resolution.x :
-    DefaultResolution;
-  y_resolution=image->resolution.y != 0.0 ? image->resolution.y :
-    DefaultResolution;
+  x_resolution=0.0;
+  y_resolution=0.0;
+  if ((image->resolution.x > MagickEpsilon) && 
+      (image->resolution.y > MagickEpsilon))
+    {
+      x_resolution=image->resolution.x;
+      y_resolution=image->resolution.y;
+      if (image->units == PixelsPerCentimeterResolution)
+        {
+          x_resolution*=2.54;
+          y_resolution*=2.54;
+        }
+    }
   storage_class=image->storage_class;
   if (image_info->compression == JPEGCompression)
     storage_class=DirectClass;
@@ -1786,7 +1795,8 @@ static MagickBooleanType WritePICTImage(const ImageInfo *image_info,
   bytes_per_line=image->columns;
   if (storage_class == DirectClass)
     bytes_per_line*=image->alpha_trait != UndefinedPixelTrait ? 4 : 3;
-  if ((bytes_per_line == 0) || (bytes_per_line > 0x7FFF))
+  if ((bytes_per_line == 0) || (bytes_per_line > 0x7FFFU) ||
+      ((row_bytes+MaxCount*2U) >= 0x7FFFU))
     ThrowWriterException(ImageError,"WidthOrHeightExceedsLimit");
   buffer=(unsigned char *) AcquireQuantumMemory(PictInfoSize,sizeof(*buffer));
   packed_scanline=(unsigned char *) AcquireQuantumMemory((size_t)
diff --git a/coders/png.c b/coders/png.c
index c838b7d57..346561623 100644
--- a/coders/png.c
+++ b/coders/png.c
@@ -12802,6 +12802,9 @@ static MagickBooleanType WriteOneJNGImage(MngInfo *mng_info,
   logging=LogMagickEvent(CoderEvent,GetMagickModule(),
     "  Enter WriteOneJNGImage()");
 
+  if ((image->columns > 65500U) || (image->rows > 65500U))
+    ThrowWriterException(ImageError,"WidthOrHeightExceedsLimit");
+
   blob=(unsigned char *) NULL;
   jpeg_image=(Image *) NULL;
   jpeg_image_info=(ImageInfo *) NULL;
@@ -12940,9 +12943,16 @@ static MagickBooleanType WriteOneJNGImage(MngInfo *mng_info,
           if (logging != MagickFalse)
             (void) LogMagickEvent(CoderEvent,GetMagickModule(),
               "  Creating blob.");
-          blob=(unsigned char *) ImageToBlob(jpeg_image_info,
-             jpeg_image,&length,
-           exception);
+          blob=(unsigned char *) ImageToBlob(jpeg_image_info,jpeg_image,
+            &length,exception);
+          if (blob == (unsigned char *) NULL)
+            {
+              if (jpeg_image != (Image *)NULL)
+                jpeg_image=DestroyImage(jpeg_image);
+              if (jpeg_image_info != (ImageInfo *)NULL)
+                jpeg_image_info=DestroyImageInfo(jpeg_image_info);
+              return(MagickFalse);
+            }
           jng_alpha_sample_depth=8;
 
           if (logging != MagickFalse)