From f9aeba86b7572e433c798f9cb2210e014077d1b9 Mon Sep 17 00:00:00 2001
From: giraffedata <giraffedata@9d0c8265-081b-0410-96cb-a4ca84ce46f8>
Date: Wed, 7 Jun 2017 15:41:07 +0000
Subject: Release 10.78.05

git-svn-id: http://svn.code.sf.net/p/netpbm/code/advanced@2989 9d0c8265-081b-0410-96cb-a4ca84ce46f8
---
 converter/other/bmptopnm.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

(limited to 'converter/other')

diff --git a/converter/other/bmptopnm.c b/converter/other/bmptopnm.c
index 54868364..49e730fd 100644
--- a/converter/other/bmptopnm.c
+++ b/converter/other/bmptopnm.c
@@ -384,10 +384,17 @@ readWindowsBasic40ByteInfoHeader(FILE *                 const ifP,
 -----------------------------------------------------------------------------*/
     int colorsused;        /* ColorsUsed value from header */
     unsigned short planesField, bitCountField;
+    int32_t colsField;
 
-    headerP->cols = GetLong(ifP);
-    if (headerP->cols == 0)
+    pm_readlittlelong2(ifP, &colsField);
+
+    if (colsField == 0)
         pm_error("Invalid BMP file: says width is zero");
+    else if (colsField < 0)
+        pm_error("Invalid BMP file: says width is negative (%d)", colsField);
+    else
+        headerP->cols = (unsigned int)colsField;
+
     {
         long const cy = GetLong(ifP);
 
-- 
cgit 1.4.1