Index: GraphicsMagick-1.2.5/coders/gray.c
===================================================================
--- GraphicsMagick-1.2.5.orig/coders/gray.c	2018-02-14 08:34:46.092902356 +0100
+++ GraphicsMagick-1.2.5/coders/gray.c	2018-02-14 08:41:37.671923371 +0100
@@ -87,19 +87,22 @@ static Image *ReadGRAYImage(const ImageI
   Image
     *image;
 
+  unsigned long
+    j;
+
   long
-    j,
     y;
 
   register long
-    i,
-    x;
+    i;
 
   register PixelPacket
     *q;
 
   size_t
-    count;
+    count,
+    tile_packets,
+    x;
 
   unsigned char
     *scanline;
@@ -122,6 +125,27 @@ static Image *ReadGRAYImage(const ImageI
   image=AllocateImage(image_info);
   if ((image->columns == 0) || (image->rows == 0))
     ThrowReaderException(OptionError,MustSpecifyImageSize,image);
+  if (image->logging)
+    (void) LogMagickEvent(CoderEvent,GetMagickModule(),
+                          "Tile %lux%lu%+ld%+ld, Offset %lu",
+                          image->tile_info.width,image->tile_info.height,
+                          image->tile_info.x,image->tile_info.y,
+                          image->offset);
+  /*
+    There is the option to either require that the tile be within the
+    image bounds or to return only the portion of the tile which is
+    within the image bounds (returned image is smaller than requested
+    tile size).  For the moment we choose the former.
+  */
+  if ((image->tile_info.width > image->columns) ||
+      (image->tile_info.x < 0) ||
+      (image->tile_info.width+image->tile_info.x > image->columns) ||
+      (image->tile_info.height > image->rows) ||
+      (image->tile_info.y < 0) ||
+      (image->tile_info.height+image->tile_info.y > image->rows)
+      )
+    ThrowReaderException(CorruptImageError,ImproperImageHeader,image);
+
   status=OpenBlob(image_info,image,ReadBinaryBlobMode,exception);
   if (status == False)
     ThrowReaderException(FileOpenError,UnableToOpenFile,image);
@@ -154,6 +178,8 @@ static Image *ReadGRAYImage(const ImageI
   scanline=MagickAllocateMemory(unsigned char *,packet_size*image->tile_info.width);
   if (scanline == (unsigned char *) NULL)
     ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,image);
+  tile_packets=(size_t) packet_size*image->tile_info.width;
+  x=(size_t) (packet_size*image->tile_info.x);
   if (image_info->subrange != 0)
     while (image->scene < image_info->subimage)
     {
@@ -162,9 +188,9 @@ static Image *ReadGRAYImage(const ImageI
       */
       image->scene++;
       for (y=0; y < (long) image->rows; y++)
-        (void) ReadBlob(image,packet_size*image->tile_info.width,scanline);
+        if (ReadBlob(image,tile_packets,scanline) != tile_packets)
+          break;
     }
-  x=(long) (packet_size*image->tile_info.x);
   do
   {
     /*
@@ -174,11 +200,13 @@ static Image *ReadGRAYImage(const ImageI
       if (image->scene >= (image_info->subimage+image_info->subrange-1))
         break;
     for (y=0; y < image->tile_info.y; y++)
-      (void) ReadBlob(image,packet_size*image->tile_info.width,scanline);
+      if (ReadBlob(image,tile_packets,scanline) != tile_packets)
+        break;
     for (y=0; y < (long) image->rows; y++)
     {
       if ((y > 0) || (image->previous == (Image *) NULL))
-        (void) ReadBlob(image,packet_size*image->tile_info.width,scanline);
+        if (ReadBlob(image,tile_packets,scanline) != tile_packets)
+          break;
       q=SetImagePixels(image,0,y,image->columns,1);
       if (q == (PixelPacket *) NULL)
         break;
@@ -193,7 +221,8 @@ static Image *ReadGRAYImage(const ImageI
     image->is_grayscale=MagickTrue;
     count=image->tile_info.height-image->rows-image->tile_info.y;
     for (j=0; j < (long) count; j++)
-      (void) ReadBlob(image,packet_size*image->tile_info.width,scanline);
+      if (ReadBlob(image,tile_packets,scanline) != tile_packets)
+        break;
     if (EOFBlob(image))
       {
         ThrowException(exception,CorruptImageError,UnexpectedEndOfFile,
@@ -206,8 +235,8 @@ static Image *ReadGRAYImage(const ImageI
     if (image_info->subrange != 0)
       if (image->scene >= (image_info->subimage+image_info->subrange-1))
         break;
-    count=ReadBlob(image,packet_size*image->tile_info.width,scanline);
-    if (count != 0)
+    count=ReadBlob(image,tile_packets,scanline);
+    if (count == tile_packets)
       {
         /*
           Allocate next image structure.
