Index: GraphicsMagick-1.3.20/coders/wpg.c
===================================================================
--- GraphicsMagick-1.3.20.orig/coders/wpg.c	2016-10-11 16:03:37.403529387 +0200
+++ GraphicsMagick-1.3.20/coders/wpg.c	2016-10-11 16:14:19.285588643 +0200
@@ -881,6 +881,7 @@ static Image *ReadWPGImage(const ImageIn
 
   unsigned char
     *BImgBuff;
+  BlobInfo *TmpBlob;
 
   tCTM CTM;         /*current transform matrix*/
 
@@ -972,6 +973,9 @@ static Image *ReadWPGImage(const ImageIn
             case 0x0E:  /*Color palette */
               WPG_Palette.StartIndex=ReadBlobLSBShort(image);
               WPG_Palette.NumOfEntries=ReadBlobLSBShort(image);
+              /* Sanity check for amount of palette entries. */
+              if( (WPG_Palette.NumOfEntries-WPG_Palette.StartIndex) > (Rec2.RecordLength-2-2) / 3)
+                ThrowReaderException(CorruptImageError,InvalidColormapIndex,image);
 
               image->colors=WPG_Palette.NumOfEntries;
               if (!AllocateImageColormap(image,image->colors))
@@ -1083,10 +1087,10 @@ static Image *ReadWPGImage(const ImageIn
                     {
                       rotated_image = FlopImage(image, exception);
                       if (rotated_image != (Image *) NULL) {
+                      TmpBlob = rotated_image->blob;
                       rotated_image->blob = image->blob;
-                      image->blob = NULL;
-                      (void) RemoveLastImageFromList(&image);
-                      AppendImageToList(&image,rotated_image);
+                      image->blob = TmpBlob;
+                      ReplaceImageInList(&image,rotated_image);
                       }
                     }
                   /* flip command */
@@ -1094,10 +1098,10 @@ static Image *ReadWPGImage(const ImageIn
                     {
                       rotated_image = FlipImage(image, exception);
                       if (rotated_image != (Image *) NULL) {
+                      TmpBlob = rotated_image->blob;
                       rotated_image->blob = image->blob;
-                      image->blob = NULL;
-                      (void) RemoveLastImageFromList(&image);
-                      AppendImageToList(&image,rotated_image);		
+                      image->blob = TmpBlob;
+                      ReplaceImageInList(&image,rotated_image);
                       }   
                     }
 		
@@ -1106,10 +1110,10 @@ static Image *ReadWPGImage(const ImageIn
                     {
                       rotated_image = RotateImage(image, (BitmapHeader2.RotAngle & 0x0FFF), exception);
                       if (rotated_image != (Image *) NULL) {
+                      TmpBlob = rotated_image->blob;
                       rotated_image->blob = image->blob;
-                      image->blob = NULL;
-                      (void) RemoveLastImageFromList(&image);
-                      AppendImageToList(&image,rotated_image);		
+                      image->blob = TmpBlob;
+                      ReplaceImageInList(&image,rotated_image);
                       }
                     }                
                 }
@@ -1156,7 +1160,7 @@ static Image *ReadWPGImage(const ImageIn
 
           Header.DataOffset=TellBlob(image)+Rec2.RecordLength;
 
-          if (logging) (void)LogMagickEvent(CoderEvent,GetMagickModule(),
+          if(logging) (void)LogMagickEvent(CoderEvent,GetMagickModule(),
             "Parsing object: %X", Rec2.RecType);
 
           switch(Rec2.RecType)
@@ -1170,18 +1174,20 @@ static Image *ReadWPGImage(const ImageIn
               WPG_Palette.StartIndex=ReadBlobLSBShort(image);
               WPG_Palette.NumOfEntries=ReadBlobLSBShort(image);
 
+			/* Sanity check for amount of palette entries. */
+              if( (WPG_Palette.NumOfEntries-WPG_Palette.StartIndex) > (Rec2.RecordLength-2-2) / 3)
+                 ThrowReaderException(CorruptImageError,InvalidColormapIndex,image);                 
+ 
               image->colors=WPG_Palette.NumOfEntries;
               if (!AllocateImageColormap(image,image->colors))
                 ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,image);
+
               for (i=WPG_Palette.StartIndex;
                    i < (int)WPG_Palette.NumOfEntries; i++)
                 {
-                  image->colormap[i].red=
-                    ScaleCharToQuantum(ReadBlobByte(image));
-                  image->colormap[i].green=
-                    ScaleCharToQuantum(ReadBlobByte(image));
-                  image->colormap[i].blue=
-                    ScaleCharToQuantum(ReadBlobByte(image));
+                  image->colormap[i].red=ScaleCharToQuantum(ReadBlobByte(image));
+                  image->colormap[i].green=ScaleCharToQuantum(ReadBlobByte(image));
+                  image->colormap[i].blue=ScaleCharToQuantum(ReadBlobByte(image));
                   (void) ReadBlobByte(image);   /*Opacity??*/
                 }
               break;
@@ -1261,10 +1267,10 @@ static Image *ReadWPGImage(const ImageIn
 		{		/*?? RotAngle=360-RotAngle;*/
 		  rotated_image = FlopImage(image, exception);
       if (rotated_image != (Image *) NULL) {
+                  TmpBlob = rotated_image->blob;
 		  rotated_image->blob = image->blob;
-		  image->blob = NULL;
-		  (void) RemoveLastImageFromList(&image);
-		  AppendImageToList(&image,rotated_image);
+                  image->blob = TmpBlob;
+                  ReplaceImageInList(&image,rotated_image);
       }
                   /* Try to change CTM according to Flip - I am not sure, must be checked.		  
                      Tx(0,0)=-1;      Tx(1,0)=0;   Tx(2,0)=0;
@@ -1276,10 +1282,10 @@ static Image *ReadWPGImage(const ImageIn
 		{		/*?? RotAngle=360-RotAngle;*/
 		  rotated_image = FlipImage(image, exception);
       if (rotated_image != (Image *) NULL) {
+                  TmpBlob = rotated_image->blob;
 		  rotated_image->blob = image->blob;
-		  image->blob = NULL;
-		  (void) RemoveLastImageFromList(&image);
-		  AppendImageToList(&image,rotated_image);
+                  image->blob = TmpBlob;
+                  ReplaceImageInList(&image,rotated_image);
       }
                   /* Try to change CTM according to Flip - I am not sure, must be checked.
                      float_matrix Tx(3,3);
