From aa673b2e4defc7cad5bec16c4fc8324f71e531f1 Mon Sep 17 00:00:00 2001
From: Cristy <urban-warrior@imagemagick.org>
Date: Sun, 24 Sep 2023 07:28:19 -0400
Subject: [PATCH] check for BMP file size, poc provided by Hardik Shah of
 Vehere (Dawn Treaders team)

CVE: CVE-2023-5341
Upstream-Status: Backport [https://github.com/ImageMagick/ImageMagick/commit/aa673b2e4defc7cad5bec16c4fc8324f71e531f1.patch]
Comment: Refresh hunk as per codebase
Signed-off-by: Sana Kazi Sana.Kazi@kpit.com
---
 coders/bmp.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/coders/bmp.c b/coders/bmp.c
index 94ec6628fdf..7e36d4f481b 100644
--- a/coders/bmp.c
+++ b/coders/bmp.c
@@ -625,6 +625,9 @@ static Image *ReadBMPImage(const ImageIn
     if (image->debug != MagickFalse)
       (void) LogMagickEvent(CoderEvent,GetMagickModule(),"  BMP size: %u",
         bmp_info.size);
+    if ((bmp_info.file_size != 0) &&
+        ((MagickSizeType) bmp_info.file_size > GetBlobSize(image)))
+      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
     profile_data=0;
     profile_size=0;
     if (bmp_info.size == 12)
