Index: GraphicsMagick-1.2.5/coders/xwd.c
===================================================================
--- GraphicsMagick-1.2.5.orig/coders/xwd.c	2016-06-14 12:55:31.246990802 +0200
+++ GraphicsMagick-1.2.5/coders/xwd.c	2016-06-14 13:37:25.632297832 +0200
@@ -189,11 +189,8 @@ static Image *ReadXWDImage(const ImageIn
      Read in header information.
   */
   count=ReadBlob(image,sz_XWDheader,(char *) &header);
-  if (count == 0)
+  if (count != sz_XWDheader)
     ThrowReaderException(CorruptImageError,UnableToReadImageHeader,image);
-  image->columns=header.pixmap_width;
-  image->rows=header.pixmap_height;
-  image->depth=8;
   /*
     Ensure the header byte-order is most-significant byte first.
   */
@@ -207,6 +204,25 @@ static Image *ReadXWDImage(const ImageIn
     ThrowReaderException(CorruptImageError,InvalidFileFormatVersion,image);
   if (header.header_size < sz_XWDheader)
     ThrowReaderException(CorruptImageError,CorruptImage,image);
+  switch (header.visual_class) {
+    case StaticGray:
+    case GrayScale:
+    case StaticColor:
+    case PseudoColor:
+    case TrueColor:
+    case DirectColor:
+      break;
+    default:
+      ThrowReaderException(CorruptImageError,CorruptImage,image);
+    }
+  switch (header.pixmap_format) {
+    case XYBitmap:
+    case XYPixmap:
+    case ZPixmap:
+      break;
+    default:
+      ThrowReaderException(CorruptImageError,CorruptImage,image);
+  }
   length=header.header_size-sz_XWDheader;
   if (length > ((~0UL)/sizeof(*comment)))
     ThrowReaderException(CorruptImageError,ImproperImageHeader,image);
@@ -243,16 +259,28 @@ static Image *ReadXWDImage(const ImageIn
   ximage->blue_mask=header.blue_mask;
   /* Why those are signed ints is beyond me. */
   if (ximage->depth < 0 || ximage->width < 0 || ximage->height < 0 ||
-      ximage->bitmap_pad < 0 || ximage->bytes_per_line < 0)
+      ximage->bitmap_pad < 0 || ximage->bytes_per_line < 0 || ximage->format < 0 || ximage->byte_order < 0 || ximage->bitmap_bit_order < 0)
+  {
+    MagickFreeMemory(ximage);
     ThrowReaderException(CorruptImageError,ImproperImageHeader,image);
+  }
   if ((ximage->width > 65535) || (ximage->height > 65535))
+  {
+    MagickFreeMemory(ximage);
     ThrowReaderException(CorruptImageError,ImproperImageHeader,image);
+  }
   /* Guard against buffer overflow in libX11. */
   if (ximage->bits_per_pixel > 32 || ximage->bitmap_unit > 32)
+  {
+    MagickFreeMemory(ximage);
     ThrowReaderException(CorruptImageError,ImproperImageHeader,image);
+  }
   status=XInitImage(ximage);
   if (status == False)
+  {
+    MagickFreeMemory(ximage);
     ThrowReaderException(CorruptImageError,UnrecognizedXWDHeader,image);
+  }
   /*
     Read colormap.
   */
@@ -267,7 +295,10 @@ static Image *ReadXWDImage(const ImageIn
         ThrowReaderException(CorruptImageError,ImproperImageHeader,image);
       colors=MagickAllocateArray(XColor *,length,sizeof(XColor));
       if (colors == (XColor *) NULL)
+      {
+        MagickFreeMemory(ximage);
         ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,image);
+      }
       for (i=0; i < (long) header.ncolors; i++)
       {
         count=ReadBlob(image,sz_XWDColor,(char *) &color);
@@ -298,27 +329,41 @@ static Image *ReadXWDImage(const ImageIn
 #define XWD_OVERFLOW(c,a,b) ((b) != 0 && ((c)/((size_t) b) != ((size_t) a)))
   length=ximage->bytes_per_line*ximage->height;
   if (XWD_OVERFLOW(length,ximage->bytes_per_line,ximage->height))
+  {
+    MagickFreeMemory(ximage);
     ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,image);
+  }
   if (ximage->format != ZPixmap)
     {
       size_t tmp=length;
       length*=ximage->depth;
       if (XWD_OVERFLOW(length,tmp,ximage->depth))
+      {
+        MagickFreeMemory(ximage);
         ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,image);
+      }
     }
   ximage->data=MagickAllocateMemory(char *,length);
   if (ximage->data == (char *) NULL)
+  {
+    MagickFreeMemory(ximage);
     ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,image);
+  }
   count=ReadBlob(image,length,ximage->data);
   if (count == 0)
+  {
+    MagickFreeMemory(ximage->data);
+    MagickFreeMemory(ximage);
     ThrowReaderException(CorruptImageError,UnableToReadPixmapFromDumpFile,
       image);
+  }
   /*
     Convert image to MIFF format.
   */
   image->columns=ximage->width;
   image->rows=ximage->height;
-  if ((colors == (XColor *) NULL) || (ximage->red_mask != 0) ||
+  image->depth=8;
+  if ((header.ncolors == (XColor *) NULL) || (ximage->red_mask != 0) ||
       (ximage->green_mask != 0) || (ximage->blue_mask != 0))
     image->storage_class=DirectClass;
   else
@@ -422,8 +467,12 @@ static Image *ReadXWDImage(const ImageIn
           Convert X image to PseudoClass packets.
         */
         if (!AllocateImageColormap(image,image->colors))
+        {
+          MagickFreeMemory(ximage->data);
+          MagickFreeMemory(ximage);
           ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,
             image);
+        }
         for (i=0; i < (long) image->colors; i++)
         {
           image->colormap[i].red=ScaleShortToQuantum(colors[i].red);
