Index: GraphicsMagick-1.2.5/coders/meta.c
===================================================================
--- GraphicsMagick-1.2.5.orig/coders/meta.c	2018-09-15 12:54:53.671382894 +0200
+++ GraphicsMagick-1.2.5/coders/meta.c	2018-09-15 12:59:19.800718516 +0200
@@ -1721,11 +1721,11 @@ iptc_find:
     info_length++;
     if (c & (unsigned char) 0x80)
       {
-	/* long format */
-	tag_length=0;
-	for (i=0; i < 4; i++)
+        /* long format */
+        tag_length=0;
+        for (i=0; i < 4; i++)
         {
-	  tag_length <<= 8;
+          tag_length <<= 8;
           tag_length |= (*p++);
           blob_length--;
           if (blob_length == 0)
@@ -1801,64 +1801,64 @@ typedef struct _tag_spec
   short
     id;
 
-  char
+  const char
     *name;
 } tag_spec;
 
-static tag_spec tags[] = {
-  { 5, (char *) "Image Name" },
-  { 7, (char *) "Edit Status" },
-  { 10, (char *) "Priority" },
-  { 15, (char *) "Category" },
-  { 20, (char *) "Supplemental Category" },
-  { 22, (char *) "Fixture Identifier" },
-  { 25, (char *) "Keyword" },
-  { 30, (char *) "Release Date" },
-  { 35, (char *) "Release Time" },
-  { 40, (char *) "Special Instructions" },
-  { 45, (char *) "Reference Service" },
-  { 47, (char *) "Reference Date" },
-  { 50, (char *) "Reference Number" },
-  { 55, (char *) "Created Date" },
-  { 60, (char *) "Created Time" },
-  { 65, (char *) "Originating Program" },
-  { 70, (char *) "Program Version" },
-  { 75, (char *) "Object Cycle" },
-  { 80, (char *) "Byline" },
-  { 85, (char *) "Byline Title" },
-  { 90, (char *) "City" },
-  { 95, (char *) "Province State" },
-  { 100, (char *) "Country Code" },
-  { 101, (char *) "Country" },
-  { 103, (char *) "Original Transmission Reference" },
-  { 105, (char *) "Headline" },
-  { 110, (char *) "Credit" },
-  { 115, (char *) "Source" },
-  { 116, (char *) "Copyright String" },
-  { 120, (char *) "Caption" },
-  { 121, (char *) "Image Orientation" },
-  { 122, (char *) "Caption Writer" },
-  { 131, (char *) "Local Caption" },
-  { 200, (char *) "Custom Field 1" },
-  { 201, (char *) "Custom Field 2" },
-  { 202, (char *) "Custom Field 3" },
-  { 203, (char *) "Custom Field 4" },
-  { 204, (char *) "Custom Field 5" },
-  { 205, (char *) "Custom Field 6" },
-  { 206, (char *) "Custom Field 7" },
-  { 207, (char *) "Custom Field 8" },
-  { 208, (char *) "Custom Field 9" },
-  { 209, (char *) "Custom Field 10" },
-  { 210, (char *) "Custom Field 11" },
-  { 211, (char *) "Custom Field 12" },
-  { 212, (char *) "Custom Field 13" },
-  { 213, (char *) "Custom Field 14" },
-  { 214, (char *) "Custom Field 15" },
-  { 215, (char *) "Custom Field 16" },
-  { 216, (char *) "Custom Field 17" },
-  { 217, (char *) "Custom Field 18" },
-  { 218, (char *) "Custom Field 19" },
-  { 219, (char *) "Custom Field 20" }
+static const tag_spec tags[] = {
+  { 5, "Image Name" },
+  { 7, "Edit Status" },
+  { 10, "Priority" },
+  { 15, "Category" },
+  { 20, "Supplemental Category" },
+  { 22, "Fixture Identifier" },
+  { 25, "Keyword" },
+  { 30, "Release Date" },
+  { 35, "Release Time" },
+  { 40, "Special Instructions" },
+  { 45, "Reference Service" },
+  { 47, "Reference Date" },
+  { 50, "Reference Number" },
+  { 55, "Created Date" },
+  { 60, "Created Time" },
+  { 65, "Originating Program" },
+  { 70, "Program Version" },
+  { 75, "Object Cycle" },
+  { 80, "Byline" },
+  { 85, "Byline Title" },
+  { 90, "City" },
+  { 95, "Province State" },
+  { 100, "Country Code" },
+  { 101, "Country" },
+  { 103, "Original Transmission Reference" },
+  { 105, "Headline" },
+  { 110, "Credit" },
+  { 115, "Source" },
+  { 116, "Copyright String" },
+  { 120, "Caption" },
+  { 121, "Image Orientation" },
+  { 122, "Caption Writer" },
+  { 131, "Local Caption" },
+  { 200, "Custom Field 1" },
+  { 201, "Custom Field 2" },
+  { 202, "Custom Field 3" },
+  { 203, "Custom Field 4" },
+  { 204, "Custom Field 5" },
+  { 205, "Custom Field 6" },
+  { 206, "Custom Field 7" },
+  { 207, "Custom Field 8" },
+  { 208, "Custom Field 9" },
+  { 209, "Custom Field 10" },
+  { 210, "Custom Field 11" },
+  { 211, "Custom Field 12" },
+  { 212, "Custom Field 13" },
+  { 213, "Custom Field 14" },
+  { 214, "Custom Field 15" },
+  { 215, "Custom Field 16" },
+  { 216, "Custom Field 17" },
+  { 217, "Custom Field 18" },
+  { 218, "Custom Field 19" },
+  { 219, "Custom Field 20" }
 };
 
 static int formatIPTC(Image *ifile, Image *ofile)
@@ -2128,9 +2128,12 @@ static int format8BIM(Image *ifile, Imag
     *PString=0,
     *str=0;
 
-  resCount = 0;
+  magick_off_t
+    file_size;
 
-  c =ReadBlobByte(ifile);
+  file_size=GetBlobSize(ifile);
+  resCount = 0;
+  c = ReadBlobByte(ifile);
   while (c != EOF)
     {
       if (c == '8')
@@ -2144,8 +2147,9 @@ static int format8BIM(Image *ifile, Imag
               c=ReadBlobByte(ifile);
               if (c == EOF)
                 {
-                  Format8BIMLiberate();
-                  return -1;
+                  ThrowException(&ofile->exception,CorruptImageError,UnexpectedEndOfFile,
+                                 ofile->filename);
+                  goto format8BIMError;
                 }
               buffer[i] = (unsigned char) c;
             }
@@ -2163,8 +2167,9 @@ static int format8BIM(Image *ifile, Imag
       ID = ReadBlobMSBShort(ifile);
       if (ID < 0)
         {
-          Format8BIMLiberate();
-          return -1;
+          ThrowException(&ofile->exception,CorruptImageError,ImproperImageHeader,
+                         ofile->filename);
+          goto format8BIMError;
         }
       {
         unsigned char
@@ -2173,24 +2178,26 @@ static int format8BIM(Image *ifile, Imag
         c=ReadBlobByte(ifile);
         if (c == EOF)
           {
-            Format8BIMLiberate();
-            return -1;
+            ThrowException(&ofile->exception,CorruptImageError,UnexpectedEndOfFile,
+                           ofile->filename);
+            goto format8BIMError;
           }
         plen = (unsigned char) c;
         PString=MagickAllocateMemory(unsigned char *,(unsigned int) (plen+1));
         if (PString == (unsigned char *) NULL)
           {
-            (void) printf("MemoryAllocationFailed");
-            Format8BIMLiberate();
-            return 0;
+            ThrowException(&ofile->exception,ResourceLimitError,MemoryAllocationFailed,
+                           ofile->filename);
+            goto format8BIMError;
           }
         for (i=0; i<plen; i++)
           {
             c=ReadBlobByte(ifile);
             if (c == EOF)
               {
-                Format8BIMLiberate();
-                return -1;
+                ThrowException(&ofile->exception,CorruptImageError,UnexpectedEndOfFile,
+                               ofile->filename);
+                goto format8BIMError;
               }
             PString[i] = (unsigned char) c;
           }
@@ -2200,35 +2207,41 @@ static int format8BIM(Image *ifile, Imag
             c=ReadBlobByte(ifile);
             if (c == EOF)
               {
-                Format8BIMLiberate();
-                return -1;
+                ThrowException(&ofile->exception,CorruptImageError,UnexpectedEndOfFile,
+                               ofile->filename);
+                goto format8BIMError;
               }
           }
       }
       Size = ReadBlobMSBLong(ifile);
-      if (Size < 0)
+      if ((Size <= 0) || (Size > (file_size - TellBlob(ifile))))
         {
-          Format8BIMLiberate();
-          return -1;
+          (void) LogMagickEvent(CoderEvent,GetMagickModule(),
+                                "Invalid chunk size: %ld", Size);
+          ThrowException(&ofile->exception,CorruptImageError,ImproperImageHeader,
+                         ofile->filename);
+          goto format8BIMError;
         }
       /* make a buffer to hold the data and snag it from the input stream */
-      str=MagickAllocateMemory(unsigned char *,(size_t) Size);
+      str=MagickAllocateMemory(unsigned char *,(size_t) Size+1);
       if (str == (unsigned char *) NULL)
         {
-          (void) printf("MemoryAllocationFailed");
-          Format8BIMLiberate();
-          return 0;
+          ThrowException(&ofile->exception,ResourceLimitError,MemoryAllocationFailed,
+                           ofile->filename);
+          goto format8BIMError;
         }
-      for (i=0; i<Size; i++)
+      for (i=0; i < Size; i++)
         {
           c=ReadBlobByte(ifile);
           if (c == EOF)
             {
-              Format8BIMLiberate();
-              return -1;
+              ThrowException(&ofile->exception,CorruptImageError,UnexpectedEndOfFile,
+                             ofile->filename);
+              goto format8BIMError;
             }
           str[i] = (unsigned char) c;
         }
+      str[i] = '\0';
 
       /* we currently skip thumbnails, since it does not make
        * any sense preserving them in a real world application
@@ -2258,9 +2271,15 @@ static int format8BIM(Image *ifile, Imag
       c=ReadBlobByte(ifile);
     }
   return resCount;
+
+  /* Error return path */
+ format8BIMError:
+
+  Format8BIMLiberate();
+  return -1;
 }
 
-static unsigned int WriteMETAImage(const ImageInfo *image_info,Image *image)
+static MagickPassFail WriteMETAImage(const ImageInfo *image_info,Image *image)
 {
   const unsigned char
     *profile;
@@ -2268,7 +2287,7 @@ static unsigned int WriteMETAImage(const
   size_t
     profile_length;
 
-  unsigned int
+  MagickPassFail
     status;
 
   /*
@@ -2286,11 +2305,11 @@ static unsigned int WriteMETAImage(const
       if((profile=GetImageProfile(image,"8BIM",&profile_length)) == 0)
         ThrowWriterException(CoderError,No8BIMDataIsAvailable,image);
       status=OpenBlob(image_info,image,WriteBinaryBlobMode,&image->exception);
-      if (status == False)
+      if (status == MagickFail)
         ThrowWriterException(FileOpenError,UnableToOpenFile,image);
       (void) WriteBlob(image,profile_length,(void *) profile);
       CloseBlob(image);
-      return(True);
+      return MagickPass;
     }
   if (LocaleCompare(image_info->magick,"IPTC") == 0)
     {
@@ -2312,7 +2331,7 @@ static unsigned int WriteMETAImage(const
         }
       (void) WriteBlob(image,length,info);
       CloseBlob(image);
-      return(True);
+      return MagickPass;
     }
   if (LocaleCompare(image_info->magick,"8BIMTEXT") == 0)
     {
@@ -2322,7 +2341,7 @@ static unsigned int WriteMETAImage(const
       if((profile=GetImageProfile(image,"8BIM",&profile_length)) == 0)
         ThrowWriterException(CoderError,No8BIMDataIsAvailable,image);
       status=OpenBlob(image_info,image,WriteBinaryBlobMode,&image->exception);
-      if (status == False)
+      if (status == MagickFail)
         ThrowWriterException(FileOpenError,UnableToOpenFile,image);
       buff=AllocateImage((ImageInfo *) NULL);
       if (buff == (Image *) NULL)
@@ -2330,15 +2349,17 @@ static unsigned int WriteMETAImage(const
           ThrowWriterException(ResourceLimitError,MemoryAllocationFailed,image);
         }
       AttachBlob(buff->blob,profile,profile_length);
-      (void) format8BIM(buff,image);
+      status = MagickPass;
+      if (format8BIM(buff,image) <= 0)
+        status = MagickFail;
       DetachBlob(buff->blob);
       DestroyImage(buff);
       CloseBlob(image);
-      return(True);
+      return status;
     }
   if (LocaleCompare(image_info->magick,"8BIMWTEXT") == 0)
     {
-      return(False);
+      return(MagickFail);
     }
   if (LocaleCompare(image_info->magick,"IPTCTEXT") == 0)
     {
@@ -2359,7 +2380,7 @@ static unsigned int WriteMETAImage(const
       if (length == 0)
         ThrowWriterException(CoderError,NoIPTCInfoWasFound,image);
       status=OpenBlob(image_info,image,WriteBinaryBlobMode,&image->exception);
-      if (status == False)
+      if (status == MagickFail)
         ThrowWriterException(FileOpenError,UnableToOpenFile,image);
       buff=AllocateImage((ImageInfo *) NULL);
       if (buff == (Image *) NULL)
@@ -2371,11 +2392,11 @@ static unsigned int WriteMETAImage(const
       DetachBlob(buff->blob);
       DestroyImage(buff);
       CloseBlob(image);
-      return(True);
+      return MagickPass;
     }
   if (LocaleCompare(image_info->magick,"IPTCWTEXT") == 0)
     {
-      return(False);
+      return(MagickFail);
     }
   if ((LocaleCompare(image_info->magick,"APP1") == 0) ||
       (LocaleCompare(image_info->magick,"EXIF") == 0) ||
@@ -2387,11 +2408,11 @@ static unsigned int WriteMETAImage(const
       if((profile=GetImageProfile(image,image_info->magick,&profile_length)) == 0)
         ThrowWriterException(CoderError,NoAPP1DataIsAvailable,image);
       status=OpenBlob(image_info,image,WriteBinaryBlobMode,&image->exception);
-      if (status == False)
+      if (status == MagickFail)
         ThrowWriterException(FileOpenError,UnableToOpenFile,image);
       (void) WriteBlob(image,(int) profile_length, (char *) profile);
       CloseBlob(image);
-      return(True);
+      return MagickPass;
     }
   if ((LocaleCompare(image_info->magick,"ICC") == 0) ||
       (LocaleCompare(image_info->magick,"ICM") == 0))
@@ -2403,11 +2424,11 @@ static unsigned int WriteMETAImage(const
       if((profile=GetImageProfile(image,"ICM",&profile_length)) == 0)
         ThrowWriterException(CoderError,NoColorProfileAvailable,image);
       status=OpenBlob(image_info,image,WriteBinaryBlobMode,&image->exception);
-      if (status == False)
+      if (status == MagickFail)
         ThrowWriterException(FileOpenError,UnableToOpenFile,image);
       (void) WriteBlob(image,profile_length,(void *) profile);
       CloseBlob(image);
-      return(True);
+      return MagickPass;
     }
-  return(False);
+  return MagickFail;
 }
