diff -Nru imagemagick-6.8.9.9/debian/changelog imagemagick-6.8.9.9/debian/changelog
--- imagemagick-6.8.9.9/debian/changelog	2014-11-12 21:58:20.000000000 +0100
+++ imagemagick-6.8.9.9/debian/changelog	2014-12-23 22:39:22.000000000 +0100
@@ -1,3 +1,50 @@
+imagemagick (8:6.8.9.9-4) unstable; urgency=high
+
+  * Fix a few security bugs (Closes: #773834):
+  - Avoid a DOS in vision.c due to an infinite loop.
+  - Avoid a SEGV due to a corrupted pnm file.
+  - Do not leak fd due to corrupted file.
+  - Fix a double free in pdb coder.
+  - Fix a SEGV due to corrupted dpc and xwd images.
+  - Fix a SEGV in dpx file handler.
+  - Fix a SEGV in malformed xwd file handler.
+  - Avoid a NULL pointer dereference in ps file handling.
+  - Fix a crash with corrupted viff file.
+  - Fix a NULL pointer dereference in wpg file handling.
+  - Do not continue on corrupted wpg file.
+  - Avoid an out of bound access in viff image.
+  - Avoid a heap buffer overflow in pdb file handling.
+  - Avoid an out of bound acess on malformed sun file.
+  - Avoid heap overflow in palm, pnm and xpm files.
+  - Fix heap overflow in quantum, palm and psd file.
+  - Fix handling of corrupted of psd, sun and xpm file.
+  - Fix corrupted (too many colors) psd file.
+  - Fix an out of bound acess in sun file.
+  - Fix handling of corrupted sun and wpg file.
+  - Fix heap overflow in pcx file, psd, pict and wpf files
+    and DOS in xpm files.
+  - Add additional PNM sanity checks.
+  - Avoid a crash to out of memory in magick/cache.c
+  - Fix a theorical out of bound access in magick/colormap-private.h
+  - Fix an out of bound access in palm file.
+  - Fixed throwing of exceptions in psd handling and fix a memory leak.
+  - Fixed boundary checks in DecodePSDPixels.
+  - Fix another out of bound problem in rle file.
+  - Fix crash due to corrupted dib file.
+  - Added checks to prevent overflow in rle file.
+  - Impose a limit of 10 million columns or rows in an input PNG
+  - Don't try to handle a "previous" image in the JNG decoder.
+  - Avoid a memory leak in quantum management.
+  - Avoid a crash in png coder.
+  - Thread limit should be at least 1 in order to be efficient.
+  - In psd file handling fixed parsing resource block and
+    avoid a crash.
+  - In cache fix usage of object after it has been destroyed.
+  - Avoid a memory leak in rle file handling.
+  - During identification of image do not fill memory
+
+ -- Bastien Roucariès <roucaries.bastien+debian@gmail.com>  Tue, 23 Dec 2014 22:02:08 +0100
+
 imagemagick (8:6.8.9.9-3) unstable; urgency=high
 
   * Fix a security bug (DOS). Some special crafted JPEG
diff -Nru imagemagick-6.8.9.9/debian/patches/0001-Use-svg-instead-of-png-for-generating-class-diagram.patch imagemagick-6.8.9.9/debian/patches/0001-Use-svg-instead-of-png-for-generating-class-diagram.patch
--- imagemagick-6.8.9.9/debian/patches/0001-Use-svg-instead-of-png-for-generating-class-diagram.patch	2014-11-15 14:47:56.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0001-Use-svg-instead-of-png-for-generating-class-diagram.patch	2014-12-23 22:44:25.000000000 +0100
@@ -82,5 +82,5 @@
  # If DOT_IMAGE_FORMAT is set to svg, then this option can be set to YES to
  # enable generation of interactive SVG images that allow zooming and panning.
 -- 
-2.1.3
+2.0.1
 
diff -Nru imagemagick-6.8.9.9/debian/patches/0002-Fix-html-documents.patch imagemagick-6.8.9.9/debian/patches/0002-Fix-html-documents.patch
--- imagemagick-6.8.9.9/debian/patches/0002-Fix-html-documents.patch	2014-11-15 14:47:56.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0002-Fix-html-documents.patch	2014-12-23 22:44:25.000000000 +0100
@@ -5152,5 +5152,5 @@
 +<!-- Magick Cache 25th July 2014 04:06 -->
 +
 -- 
-2.1.3
+2.0.1
 
diff -Nru imagemagick-6.8.9.9/debian/patches/0003-Fix-meta-tag-damage-in-html-documentation.patch imagemagick-6.8.9.9/debian/patches/0003-Fix-meta-tag-damage-in-html-documentation.patch
--- imagemagick-6.8.9.9/debian/patches/0003-Fix-meta-tag-damage-in-html-documentation.patch	2014-11-15 14:47:57.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0003-Fix-meta-tag-damage-in-html-documentation.patch	2014-12-23 22:44:25.000000000 +0100
@@ -2290,5 +2290,5 @@
 \ No newline at end of file
 +<!-- Magick Cache 25th July 2014 05:32 -->
 -- 
-2.1.3
+2.0.1
 
diff -Nru imagemagick-6.8.9.9/debian/patches/0004-Fix-remaining-html-error.patch imagemagick-6.8.9.9/debian/patches/0004-Fix-remaining-html-error.patch
--- imagemagick-6.8.9.9/debian/patches/0004-Fix-remaining-html-error.patch	2014-11-15 14:47:57.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0004-Fix-remaining-html-error.patch	2014-12-23 22:44:25.000000000 +0100
@@ -162,5 +162,5 @@
  
  </div>
 -- 
-2.1.3
+2.0.1
 
diff -Nru imagemagick-6.8.9.9/debian/patches/0005-Avoid-crash-and-DOS-with-special-crafted-jpeg-file.patch imagemagick-6.8.9.9/debian/patches/0005-Avoid-crash-and-DOS-with-special-crafted-jpeg-file.patch
--- imagemagick-6.8.9.9/debian/patches/0005-Avoid-crash-and-DOS-with-special-crafted-jpeg-file.patch	2014-11-15 14:47:57.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0005-Avoid-crash-and-DOS-with-special-crafted-jpeg-file.patch	2014-12-23 22:44:25.000000000 +0100
@@ -29,5 +29,5 @@
              continue;  /* prevent overflow */
            if ((size_t) (offset+number_bytes) > length)
 -- 
-2.1.3
+2.0.1
 
diff -Nru imagemagick-6.8.9.9/debian/patches/0006-Avoid-an-infinite-loop.patch imagemagick-6.8.9.9/debian/patches/0006-Avoid-an-infinite-loop.patch
--- imagemagick-6.8.9.9/debian/patches/0006-Avoid-an-infinite-loop.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0006-Avoid-an-infinite-loop.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,64 @@
+From c504b8e1a1ca6f158f2d08bd33c62ce4865497ee Mon Sep 17 00:00:00 2001
+From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Tue, 28 Oct 2014 10:15:41 +0000
+Subject: [PATCH] Avoid an infinite loop
+
+Avoid an infinite loop if too many object in vision.c
+
+This could lead to a DOS.
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@16864 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin: http://trac.imagemagick.org/changeset/16864
+---
+ config/english.xml  | 3 +++
+ config/francais.xml | 3 +++
+ magick/vision.c     | 5 +++++
+ 3 files changed, 11 insertions(+)
+
+diff --git a/config/english.xml b/config/english.xml
+index c26749c..6c864f2 100644
+--- a/config/english.xml
++++ b/config/english.xml
+@@ -948,6 +948,9 @@
+           <message name="MemoryAllocationFailed">
+             memory allocation failed
+           </message>
++          <message name="TooManyObjects">
++            too many objects
++          </message>
+           <message name="UnableToAcquireString">
+             unable to acquire string
+           </message>
+diff --git a/config/francais.xml b/config/francais.xml
+index 6c217d6..b421ecb 100644
+--- a/config/francais.xml
++++ b/config/francais.xml
+@@ -936,6 +936,9 @@
+           <message name="MemoryAllocationFailed">
+             Échec allocation mémoire
+           </message>
++          <message name="TooManyObjects">
++            too many objects
++          </message>
+           <message name="UnableToAcquireString">
+             échec acquisition de la chaine
+           </message>
+diff --git a/magick/vision.c b/magick/vision.c
+index 4a42f5b..cdca011 100644
+--- a/magick/vision.c
++++ b/magick/vision.c
+@@ -453,6 +453,11 @@ MagickExport Image *ConnectedComponentsImage(const Image *image,
+   }
+   component_view=DestroyCacheView(component_view);
+   equivalences=DestroyMatrixInfo(equivalences);
++  if (n > QuantumRange)
++    {
++      component_image=DestroyImage(component_image);
++      ThrowImageException(ResourceLimitError,"TooManyObjects");
++    }
+   artifact=GetImageArtifact(image,"connected-components:verbose");
+   if (IsMagickTrue(artifact))
+     status=ConnectedComponentsStatistics(component_image,(size_t) n,exception);
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0007-Quit-earlier-in-case-of-corrupted-pnm-image.patch imagemagick-6.8.9.9/debian/patches/0007-Quit-earlier-in-case-of-corrupted-pnm-image.patch
--- imagemagick-6.8.9.9/debian/patches/0007-Quit-earlier-in-case-of-corrupted-pnm-image.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0007-Quit-earlier-in-case-of-corrupted-pnm-image.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,31 @@
+From 030c376fe4c97aea2178996e658b4c33aa9a736a Mon Sep 17 00:00:00 2001
+From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Tue, 28 Oct 2014 13:11:48 +0000
+Subject: [PATCH] Quit earlier in case of corrupted pnm image
+
+Do not try to read a corrupted pnm file. Bail early.
+
+Fix a segv and thus a DOS
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@16867 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin: http://trac.imagemagick.org/changeset/16867
+---
+ coders/pnm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/coders/pnm.c b/coders/pnm.c
+index 03f5fe5..1d6817e 100644
+--- a/coders/pnm.c
++++ b/coders/pnm.c
+@@ -411,7 +411,7 @@ static Image *ReadPNMImage(const ImageInfo *image_info,ExceptionInfo *exception)
+       }
+     if ((image->columns == 0) || (image->rows == 0))
+       ThrowReaderException(CorruptImageError,"NegativeOrZeroImageSize");
+-    if (max_value > 4294967295U)
++    if ((max_value == 0) || (max_value > 4294967295U))
+       ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+     for (depth=1; GetQuantumRange(depth) < max_value; depth++) ;
+     image->depth=depth;
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0008-Added-missing-calls-to-RelinquishUniqueFileResource.patch imagemagick-6.8.9.9/debian/patches/0008-Added-missing-calls-to-RelinquishUniqueFileResource.patch
--- imagemagick-6.8.9.9/debian/patches/0008-Added-missing-calls-to-RelinquishUniqueFileResource.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0008-Added-missing-calls-to-RelinquishUniqueFileResource.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,175 @@
+From 9fdb9bf2832a1aa2c79002ae5c2ba1e8018e4ff1 Mon Sep 17 00:00:00 2001
+From: dirk <dirk@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Thu, 6 Nov 2014 21:09:54 +0000
+Subject: [PATCH] Added missing calls to RelinquishUniqueFileResource.
+
+Avoid to leak fd in case of error.
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@16971 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin: http://trac.imagemagick.org/changeset/16971
+---
+ coders/dcm.c  | 28 +++++++++++++---------------
+ coders/dot.c  |  5 ++++-
+ coders/exr.c  | 10 +++++++++-
+ coders/pict.c |  2 ++
+ coders/pwp.c  |  6 +++++-
+ 5 files changed, 33 insertions(+), 18 deletions(-)
+
+diff --git a/coders/dcm.c b/coders/dcm.c
+index 88892ee..b8fe681 100644
+--- a/coders/dcm.c
++++ b/coders/dcm.c
+@@ -3563,34 +3563,32 @@ static Image *ReadDCMImage(const ImageInfo *image_info,ExceptionInfo *exception)
+         unsigned int
+           tag;
+ 
++        tag=(ReadBlobLSBShort(image) << 16) | ReadBlobLSBShort(image);
++        length=(size_t) ReadBlobLSBLong(image);
++        if (tag == 0xFFFEE0DD)
++          break; /* sequence delimiter tag */
++        if (tag != 0xFFFEE000)
++          ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+         file=(FILE *) NULL;
+         unique_file=AcquireUniqueFileResource(filename);
+         if (unique_file != -1)
+           file=fdopen(unique_file,"wb");
+-        if ((unique_file == -1) || (file == (FILE *) NULL))
++        if (file == (FILE *) NULL)
+           {
++            (void) RelinquishUniqueFileResource(filename);
+             ThrowFileException(exception,FileOpenError,
+               "UnableToCreateTemporaryFile",filename);
+             break;
+           }
+-        tag=(ReadBlobLSBShort(image) << 16) | ReadBlobLSBShort(image);
+-        length=(size_t) ReadBlobLSBLong(image);
+-        if (tag == 0xFFFEE0DD)
+-          {
+-            (void) fclose(file);
+-            break; /* sequence delimiter tag */
+-          }
+-        if (tag != 0xFFFEE000)
+-          {
+-            (void) fclose(file);
+-            ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+-          }
+         for ( ; length != 0; length--)
+         {
+           c=ReadBlobByte(image);
+           if (c == EOF)
+-            ThrowFileException(exception,CorruptImageError,
+-              "UnexpectedEndOfFile",image->filename);
++            {
++              ThrowFileException(exception,CorruptImageError,
++                "UnexpectedEndOfFile",image->filename);
++              break;
++            }
+           (void) fputc(c,file);
+         }
+         (void) fclose(file);
+diff --git a/coders/dot.c b/coders/dot.c
+index e60be46..32acb9e 100644
+--- a/coders/dot.c
++++ b/coders/dot.c
+@@ -142,7 +142,10 @@ static Image *ReadDOTImage(const ImageInfo *image_info,ExceptionInfo *exception)
+   graph=agread(GetBlobFileHandle(image),(Agdisc_t *) NULL);
+ #endif
+   if (graph == (graph_t *) NULL)
+-    return ((Image *) NULL);
++    {
++      (void) RelinquishUniqueFileResource(read_info->filename);
++      return ((Image *) NULL);
++    }
+   option=GetImageOption(image_info,"dot:layout-engine");
+   if (option == (const char *) NULL)
+     gvLayout(graphic_context,graph,(char *) "dot");
+diff --git a/coders/exr.c b/coders/exr.c
+index 11407f2..b12f956 100644
+--- a/coders/exr.c
++++ b/coders/exr.c
+@@ -192,6 +192,8 @@ static Image *ReadEXRImage(const ImageInfo *image_info,ExceptionInfo *exception)
+     {
+       ThrowFileException(exception,BlobError,"UnableToOpenBlob",
+         ImfErrorMessage());
++      if (LocaleCompare(image_info->filename,read_info->filename) != 0)
++        (void) RelinquishUniqueFileResource(read_info->filename);
+       read_info=DestroyImageInfo(read_info);
+       return((Image *) NULL);
+     }
+@@ -214,6 +216,9 @@ static Image *ReadEXRImage(const ImageInfo *image_info,ExceptionInfo *exception)
+   if (scanline == (ImfRgba *) NULL)
+     {
+       (void) ImfCloseInputFile(file);
++      if (LocaleCompare(image_info->filename,read_info->filename) != 0)
++        (void) RelinquishUniqueFileResource(read_info->filename);
++      read_info=DestroyImageInfo(read_info);
+       ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+     }
+   for (y=0; y < (ssize_t) image->rows; y++)
+@@ -417,15 +422,18 @@ static MagickBooleanType WriteEXRImage(const ImageInfo *image_info,Image *image)
+   ImfDeleteHeader(hdr_info);
+   if (file == (ImfOutputFile *) NULL)
+     {
++      (void) RelinquishUniqueFileResource(write_info->filename);
++      write_info=DestroyImageInfo(write_info);
+       ThrowFileException(&image->exception,BlobError,"UnableToOpenBlob",
+         ImfErrorMessage());
+-      write_info=DestroyImageInfo(write_info);
+       return(MagickFalse);
+     }
+   scanline=(ImfRgba *) AcquireQuantumMemory(image->columns,sizeof(*scanline));
+   if (scanline == (ImfRgba *) NULL)
+     {
+       (void) ImfCloseOutputFile(file);
++      (void) RelinquishUniqueFileResource(write_info->filename);
++      write_info=DestroyImageInfo(write_info);
+       ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
+     }
+   ResetMagickMemory(scanline,0,image->columns*sizeof(*scanline));
+diff --git a/coders/pict.c b/coders/pict.c
+index f47e06c..35fb56e 100644
+--- a/coders/pict.c
++++ b/coders/pict.c
+@@ -1388,6 +1388,7 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
+           {
+             if (file != (FILE *) NULL)
+               (void) fclose(file);
++            (void) RelinquishUniqueFileResource(read_info->filename);
+             (void) CopyMagickString(image->filename,read_info->filename,
+               MaxTextExtent);
+             ThrowFileException(exception,FileOpenError,
+@@ -1401,6 +1402,7 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
+         if (ReadRectangle(image,&frame) == MagickFalse)
+           {
+             (void) fclose(file);
++            (void) RelinquishUniqueFileResource(read_info->filename);
+             ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+           }
+         for (i=0; i < 122; i++)
+diff --git a/coders/pwp.c b/coders/pwp.c
+index a7dd842..991d4bb 100644
+--- a/coders/pwp.c
++++ b/coders/pwp.c
+@@ -192,7 +192,10 @@ static Image *ReadPWPImage(const ImageInfo *image_info,ExceptionInfo *exception)
+     if (c == EOF)
+       break;
+     if (LocaleNCompare((char *) (magick+12),"SFW94A",6) != 0)
+-      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
++      {
++        (void) RelinquishUniqueFileResource(read_info->filename);
++        ThrowReaderException(CorruptImageError,"ImproperImageHeader");
++      }
+     /*
+       Dump SFW image to a temporary file.
+     */
+@@ -201,6 +204,7 @@ static Image *ReadPWPImage(const ImageInfo *image_info,ExceptionInfo *exception)
+       file=fdopen(unique_file,"wb");
+     if ((unique_file == -1) || (file == (FILE *) NULL))
+       {
++        (void) RelinquishUniqueFileResource(read_info->filename);
+         ThrowFileException(exception,FileOpenError,"UnableToWriteFile",
+           image->filename);
+         image=DestroyImageList(image);
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0009-Fix-a-double-free-in-pdb-coder.patch imagemagick-6.8.9.9/debian/patches/0009-Fix-a-double-free-in-pdb-coder.patch
--- imagemagick-6.8.9.9/debian/patches/0009-Fix-a-double-free-in-pdb-coder.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0009-Fix-a-double-free-in-pdb-coder.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,183 @@
+From be644895456764f2c2670f297d9d9860ff0bdd75 Mon Sep 17 00:00:00 2001
+From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Thu, 20 Nov 2014 23:41:24 +0000
+Subject: [PATCH] Fix a double free in pdb coder
+
+Fix a double free and thus a DOS in pdb coder
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17080 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin: http://trac.imagemagick.org/changeset/17080
+---
+ coders/pdb.c | 58 +++++++++++++++++++++++++++++-----------------------------
+ 1 file changed, 29 insertions(+), 29 deletions(-)
+
+diff --git a/coders/pdb.c b/coders/pdb.c
+index 69490e0..117538d 100644
+--- a/coders/pdb.c
++++ b/coders/pdb.c
+@@ -34,13 +34,13 @@
+ %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ %
+ %
+-    20071202 TS * rewrote RLE decoder - old version could cause buffer overflows
+-                * failure of RLE decoding now thows error RLEDecoderError
+-                * fixed bug in RLE decoding - now all rows are decoded, not just
+-      the first one
+-    * fixed bug in reader - record offsets now handled correctly
+-    * fixed bug in reader - only bits 0..2 indicate compression type
+-                * in writer: now using image color count instead of depth
++%   20071202 TS * rewrote RLE decoder - old version could cause buffer overflows
++%               * failure of RLE decoding now thows error RLEDecoderError
++%               * fixed bug in RLE decoding - now all rows are decoded, not just
++%     the first one
++%   * fixed bug in reader - record offsets now handled correctly
++%   * fixed bug in reader - only bits 0..2 indicate compression type
++%               * in writer: now using image color count instead of depth
+ */
+ 
+ /*
+@@ -268,7 +268,7 @@ static MagickBooleanType IsPDB(const unsigned char *magick,const size_t length)
+ static Image *ReadPDBImage(const ImageInfo *image_info,ExceptionInfo *exception)
+ {
+   unsigned char
+-    attributes, /* TS */
++    attributes,
+     tag[3];
+ 
+   Image
+@@ -300,13 +300,13 @@ static Image *ReadPDBImage(const ImageInfo *image_info,ExceptionInfo *exception)
+ 
+   size_t
+     bits_per_pixel,
+-    num_pad_bytes, /* TS */
++    num_pad_bytes,
+     one,
+     packets;
+ 
+   ssize_t
+     count,
+-    img_offset, /* TS */
++    img_offset,
+     comment_offset = 0,
+     y;
+ 
+@@ -355,7 +355,7 @@ static Image *ReadPDBImage(const ImageInfo *image_info,ExceptionInfo *exception)
+   /*
+     Read record header.
+   */
+-  img_offset=(int) ReadBlobMSBLong(image); /* TS */
++  img_offset=(ssize_t) ((int) ReadBlobMSBLong(image));
+   attributes=(unsigned char) ReadBlobByte(image);
+   (void) attributes;
+   count=ReadBlob(image,3,(unsigned char *) tag);
+@@ -363,7 +363,7 @@ static Image *ReadPDBImage(const ImageInfo *image_info,ExceptionInfo *exception)
+     ThrowReaderException(CorruptImageError,"CorruptImage");
+   if (pdb_info.number_records > 1)
+     {
+-      comment_offset=(int) ReadBlobMSBLong(image);
++      comment_offset=(ssize_t) ((int) ReadBlobMSBLong(image));
+       attributes=(unsigned char) ReadBlobByte(image);
+       count=ReadBlob(image,3,(unsigned char *) tag);
+       if (count != 3  ||  memcmp(tag,"\x6f\x80\x01",3) != 0)
+@@ -376,7 +376,7 @@ static Image *ReadPDBImage(const ImageInfo *image_info,ExceptionInfo *exception)
+   */
+   count=ReadBlob(image,32,(unsigned char *) pdb_image.name);
+   pdb_image.version=ReadBlobByte(image);
+-  pdb_image.type=ReadBlobByte(image);
++  pdb_image.type=(unsigned char) ReadBlobByte(image);
+   pdb_image.reserved_1=ReadBlobMSBLong(image);
+   pdb_image.note=ReadBlobMSBLong(image);
+   pdb_image.x_last=(short) ReadBlobMSBShort(image);
+@@ -408,7 +408,7 @@ static Image *ReadPDBImage(const ImageInfo *image_info,ExceptionInfo *exception)
+   if (pixels == (unsigned char *) NULL)
+     ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+ 
+-  switch (pdb_image.version & 7) /* TS */
++  switch (pdb_image.version & 0x07)
+   {
+     case 0:
+     {
+@@ -420,7 +420,7 @@ static Image *ReadPDBImage(const ImageInfo *image_info,ExceptionInfo *exception)
+     {
+       image->compression=RLECompression;
+       if (!DecodeImage(image, pixels, packets * image -> rows))
+-        ThrowReaderException( CorruptImageError, "RLEDecoderError" ); /* TS */
++        ThrowReaderException( CorruptImageError, "RLEDecoderError" );
+       break;
+     }
+     default:
+@@ -533,7 +533,7 @@ static Image *ReadPDBImage(const ImageInfo *image_info,ExceptionInfo *exception)
+   if (EOFBlob(image) != MagickFalse)
+     ThrowFileException(exception,CorruptImageError,"UnexpectedEndOfFile",
+       image->filename);
+-  if (pdb_info.number_records > 1) /* TS */
++  if (pdb_info.number_records > 1)
+     {
+       char
+         *comment;
+@@ -742,16 +742,16 @@ static MagickBooleanType WritePDBImage(const ImageInfo *image_info,Image *image)
+   if (status == MagickFalse)
+     return(status);
+   (void) TransformImageColorspace(image,sRGBColorspace);
+-  if (image -> colors <= 2  ||  GetImageType( image, &image -> exception ) == BilevelType) { /* TS */
+-    bits_per_pixel = 1;
+-  } else if (image -> colors <= 4) {
+-    bits_per_pixel = 2;
+-  } else if (image -> colors <= 8) {
+-    bits_per_pixel = 3;
++  if ((image -> colors <= 2 ) ||
++      (GetImageType(image,&image->exception ) == BilevelType)) {
++    bits_per_pixel=1;
++  } else if (image->colors <= 4) {
++    bits_per_pixel=2;
++  } else if (image->colors <= 8) {
++    bits_per_pixel=3;
+   } else {
+-    bits_per_pixel = 4;
++    bits_per_pixel=4;
+   }
+-
+   (void) ResetMagickMemory(pdb_info.name,0,32);
+   (void) CopyMagickString(pdb_info.name,image_info->filename,32);
+   pdb_info.attributes=0;
+@@ -801,7 +801,7 @@ static MagickBooleanType WritePDBImage(const ImageInfo *image_info,Image *image)
+   if (image->columns % 16)
+     pdb_image.width=(short) (16*(image->columns/16+1));
+   pdb_image.height=(short) image->rows;
+-  packets=(bits_per_pixel*image->columns/8)*image->rows;
++  packets=(bits_per_pixel*image->columns/8+4)*image->rows;
+   runlength=(unsigned char *) AcquireQuantumMemory(2UL*packets,
+     sizeof(*runlength));
+   if (runlength == (unsigned char *) NULL)
+@@ -834,7 +834,7 @@ static MagickBooleanType WritePDBImage(const ImageInfo *image_info,Image *image)
+       break;
+     (void) ExportQuantumPixels(image,(const CacheView *) NULL,quantum_info,
+       GrayQuantum,scanline,&image->exception);
+-    for (x=0; x < pdb_image.width; x++)
++    for (x=0; x < (ssize_t) pdb_image.width; x++)
+     {
+       if (x < (ssize_t) image->columns)
+         buffer[literal+repeat]|=(0xff-scanline[x*packet_size]) >>
+@@ -882,7 +882,7 @@ static MagickBooleanType WritePDBImage(const ImageInfo *image_info,Image *image)
+       }
+     }
+     status=SetImageProgress(image,SaveImageTag,(MagickOffsetType) y,
+-                image->rows);
++      image->rows);
+     if (status == MagickFalse)
+       break;
+   }
+@@ -893,8 +893,8 @@ static MagickBooleanType WritePDBImage(const ImageInfo *image_info,Image *image)
+   /*
+     Write the Image record header.
+   */
+-  (void) WriteBlobMSBLong(image,(unsigned int)
+-    (TellBlob(image)+8*pdb_info.number_records));
++  (void) WriteBlobMSBLong(image,(unsigned int) (TellBlob(image)+8*
++    pdb_info.number_records));
+   (void) WriteBlobByte(image,0x40);
+   (void) WriteBlobByte(image,0x6f);
+   (void) WriteBlobByte(image,0x80);
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0010-Fix-handling-of-corrupted-dpc-and-xwd-image.patch imagemagick-6.8.9.9/debian/patches/0010-Fix-handling-of-corrupted-dpc-and-xwd-image.patch
--- imagemagick-6.8.9.9/debian/patches/0010-Fix-handling-of-corrupted-dpc-and-xwd-image.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0010-Fix-handling-of-corrupted-dpc-and-xwd-image.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,82 @@
+From 82f779cbc24045af2eaecb95d0842ca7b97c71f4 Mon Sep 17 00:00:00 2001
+From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Sun, 23 Nov 2014 16:36:18 +0000
+Subject: [PATCH] Fix handling of corrupted dpc and xwd image
+
+Avoid a segv thus a DOS.
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17092 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin: http://trac.imagemagick.org/changeset/17092
+---
+ coders/dpx.c |  2 ++
+ coders/xwd.c | 17 +++++++----------
+ 2 files changed, 9 insertions(+), 10 deletions(-)
+
+diff --git a/coders/dpx.c b/coders/dpx.c
+index b7308aa..0352855 100644
+--- a/coders/dpx.c
++++ b/coders/dpx.c
+@@ -797,6 +797,8 @@ static Image *ReadDPXImage(const ImageInfo *image_info,ExceptionInfo *exception)
+     case 7: image->orientation=RightBottomOrientation; break;
+   }
+   dpx.image.number_elements=ReadBlobShort(image);
++  if (dpx.image.number_elements > 8)
++    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+   offset+=2;
+   dpx.image.pixels_per_line=ReadBlobLong(image);
+   offset+=4;
+diff --git a/coders/xwd.c b/coders/xwd.c
+index 7b16456..644afc7 100644
+--- a/coders/xwd.c
++++ b/coders/xwd.c
+@@ -275,6 +275,8 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)
+   if ((ximage->depth < 0) || (ximage->width < 0) || (ximage->height < 0) ||
+       (ximage->bitmap_pad < 0) || (ximage->bytes_per_line < 0))
+     ThrowReaderException(CorruptImageError,"ImproperImageHeader");
++  if ((ximage->width > 65535) || (ximage->height > 65535))
++    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+   if ((ximage->bits_per_pixel > 32) || (ximage->bitmap_unit > 32))
+     ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+   x_status=XInitImage(ximage);
+@@ -407,14 +409,12 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)
+             {
+               pixel=XGetPixel(ximage,(int) x,(int) y);
+               index=(IndexPacket) ((pixel >> red_shift) & red_mask);
+-              SetPixelRed(q,ScaleShortToQuantum(colors[(ssize_t)
+-                index].red));
++              SetPixelRed(q,ScaleShortToQuantum(colors[(ssize_t) index].red));
+               index=(IndexPacket) ((pixel >> green_shift) & green_mask);
+               SetPixelGreen(q,ScaleShortToQuantum(colors[(ssize_t)
+                 index].green));
+               index=(IndexPacket) ((pixel >> blue_shift) & blue_mask);
+-              SetPixelBlue(q,ScaleShortToQuantum(colors[(ssize_t)
+-                index].blue));
++              SetPixelBlue(q,ScaleShortToQuantum(colors[(ssize_t) index].blue));
+               q++;
+             }
+             if (SyncAuthenticPixels(image,exception) == MagickFalse)
+@@ -436,18 +436,15 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)
+               color=(pixel >> red_shift) & red_mask;
+               if (red_mask != 0)
+                 color=(color*65535UL)/red_mask;
+-              SetPixelRed(q,ScaleShortToQuantum((unsigned short)
+-                color));
++              SetPixelRed(q,ScaleShortToQuantum((unsigned short) color));
+               color=(pixel >> green_shift) & green_mask;
+               if (green_mask != 0)
+                 color=(color*65535UL)/green_mask;
+-              SetPixelGreen(q,ScaleShortToQuantum((unsigned short)
+-                color));
++              SetPixelGreen(q,ScaleShortToQuantum((unsigned short) color));
+               color=(pixel >> blue_shift) & blue_mask;
+               if (blue_mask != 0)
+                 color=(color*65535UL)/blue_mask;
+-              SetPixelBlue(q,ScaleShortToQuantum((unsigned short)
+-                color));
++              SetPixelBlue(q,ScaleShortToQuantum((unsigned short) color));
+               q++;
+             }
+             if (SyncAuthenticPixels(image,exception) == MagickFalse)
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0011-Bail-out-early-in-case-of-malformed-dpx-file.patch imagemagick-6.8.9.9/debian/patches/0011-Bail-out-early-in-case-of-malformed-dpx-file.patch
--- imagemagick-6.8.9.9/debian/patches/0011-Bail-out-early-in-case-of-malformed-dpx-file.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0011-Bail-out-early-in-case-of-malformed-dpx-file.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,59 @@
+From 68db5f601d4120170b91f5397e596c0b8f9d3a8e Mon Sep 17 00:00:00 2001
+From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Fri, 28 Nov 2014 14:26:06 +0000
+Subject: [PATCH] Bail out early in case of malformed dpx file
+
+Avoid a SEGV.
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17112 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin: http://trac.imagemagick.org/changeset/17112
+---
+ coders/dpx.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/coders/dpx.c b/coders/dpx.c
+index 0352855..30d2898 100644
+--- a/coders/dpx.c
++++ b/coders/dpx.c
+@@ -67,6 +67,11 @@
+ #include "magick/string-private.h"
+ 
+ /*
++  Define declaration.
++*/
++#define MaxNumberImageElements  8
++
++/*
+   Typedef declaration.
+ */
+ typedef enum
+@@ -230,7 +235,7 @@ typedef struct _DPXImageInfo
+     lines_per_element;
+ 
+   DPXImageElement
+-    image_element[8];
++    image_element[MaxNumberImageElements];
+ 
+   unsigned char
+     reserve[52];
+@@ -780,6 +785,8 @@ static Image *ReadDPXImage(const ImageInfo *image_info,ExceptionInfo *exception)
+     Read DPX image header.
+   */
+   dpx.image.orientation=ReadBlobShort(image);
++  if (dpx.image.orientation > 7)
++    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+   offset+=2;
+   if (dpx.image.orientation != (unsigned short) ~0)
+     (void) FormatImageProperty(image,"dpx:image.orientation","%d",
+@@ -797,7 +804,7 @@ static Image *ReadDPXImage(const ImageInfo *image_info,ExceptionInfo *exception)
+     case 7: image->orientation=RightBottomOrientation; break;
+   }
+   dpx.image.number_elements=ReadBlobShort(image);
+-  if (dpx.image.number_elements > 8)
++  if (dpx.image.number_elements > MaxNumberImageElements)
+     ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+   offset+=2;
+   dpx.image.pixels_per_line=ReadBlobLong(image);
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0012-Avoid-SEGV-in-malformed-xwd-file.patch imagemagick-6.8.9.9/debian/patches/0012-Avoid-SEGV-in-malformed-xwd-file.patch
--- imagemagick-6.8.9.9/debian/patches/0012-Avoid-SEGV-in-malformed-xwd-file.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0012-Avoid-SEGV-in-malformed-xwd-file.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,196 @@
+From 914da276f717b3e21e5af6614887af14af87a9b8 Mon Sep 17 00:00:00 2001
+From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Fri, 28 Nov 2014 15:01:26 +0000
+Subject: [PATCH] Avoid SEGV in malformed xwd file
+
+Check the malformed xwd file.
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17114 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin: http://trac.imagemagick.org/changeset/17114
+---
+ coders/xwd.c | 94 +++++++++++++++++++++++++++++++++++++++++++++++-------------
+ 1 file changed, 74 insertions(+), 20 deletions(-)
+
+diff --git a/coders/xwd.c b/coders/xwd.c
+index 644afc7..2949a17 100644
+--- a/coders/xwd.c
++++ b/coders/xwd.c
+@@ -223,11 +223,8 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)
+      Read in header information.
+   */
+   count=ReadBlob(image,sz_XWDheader,(unsigned char *) &header);
+-  if (count == 0)
++  if (count != sz_XWDheader)
+     ThrowReaderException(CorruptImageError,"UnableToReadImageHeader");
+-  image->columns=header.pixmap_width;
+-  image->rows=header.pixmap_height;
+-  image->depth=8;
+   /*
+     Ensure the header byte-order is most-significant byte first.
+   */
+@@ -241,6 +238,25 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)
+     ThrowReaderException(CorruptImageError,"FileFormatVersionMismatch");
+   if (header.header_size < sz_XWDheader)
+     ThrowReaderException(CorruptImageError,"CorruptImage");
++  switch (header.visual_class) {
++    case StaticGray:
++    case GrayScale:
++    case StaticColor:
++    case PseudoColor:
++    case TrueColor:
++    case DirectColor:
++      break;
++    default:
++      ThrowReaderException(CorruptImageError,"CorruptImage");
++    }
++  switch (header.pixmap_format) {
++    case XYBitmap:
++    case XYPixmap:
++    case ZPixmap:
++      break;
++    default:
++      ThrowReaderException(CorruptImageError,"CorruptImage");
++  }
+   length=(size_t) header.header_size-sz_XWDheader;
+   comment=(char *) AcquireQuantumMemory(length+1,sizeof(*comment));
+   if (comment == (char *) NULL)
+@@ -272,16 +288,30 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)
+   ximage->red_mask=header.red_mask;
+   ximage->green_mask=header.green_mask;
+   ximage->blue_mask=header.blue_mask;
+-  if ((ximage->depth < 0) || (ximage->width < 0) || (ximage->height < 0) ||
+-      (ximage->bitmap_pad < 0) || (ximage->bytes_per_line < 0))
+-    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
++  if ((ximage->width < 0) || (ximage->height < 0) || (ximage->depth < 0) || 
++      (ximage->format < 0) || (ximage->byte_order < 0) ||
++			(ximage->bitmap_bit_order < 0) || (ximage->bitmap_pad < 0) ||
++      (ximage->bytes_per_line < 0))
++    {
++      ximage=(XImage *) RelinquishMagickMemory(ximage);
++      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
++    }
+   if ((ximage->width > 65535) || (ximage->height > 65535))
+-    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
++    {
++      ximage=(XImage *) RelinquishMagickMemory(ximage);
++      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
++    }
+   if ((ximage->bits_per_pixel > 32) || (ximage->bitmap_unit > 32))
+-    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
++    {
++      ximage=(XImage *) RelinquishMagickMemory(ximage);
++      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
++    }
+   x_status=XInitImage(ximage);
+   if (x_status == 0)
+-    ThrowReaderException(CorruptImageError,"UnexpectedEndOfFile");
++    {
++      ximage=(XImage *) RelinquishMagickMemory(ximage);
++      ThrowReaderException(CorruptImageError,"UnexpectedEndOfFile");
++    }
+   /*
+     Read colormap.
+   */
+@@ -295,12 +325,18 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)
+       length=(size_t) header.ncolors;
+       colors=(XColor *) AcquireQuantumMemory(length,sizeof(*colors));
+       if (colors == (XColor *) NULL)
+-        ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
++        {
++          ximage=(XImage *) RelinquishMagickMemory(ximage);
++          ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
++        }
+       for (i=0; i < (ssize_t) header.ncolors; i++)
+       {
+         count=ReadBlob(image,sz_XWDColor,(unsigned char *) &color);
+         if (count == 0)
+-          ThrowReaderException(CorruptImageError,"UnexpectedEndOfFile");
++          {
++            ximage=(XImage *) RelinquishMagickMemory(ximage);
++            ThrowReaderException(CorruptImageError,"UnexpectedEndOfFile");
++          }
+         colors[i].pixel=color.pixel;
+         colors[i].red=color.red;
+         colors[i].green=color.green;
+@@ -327,7 +363,10 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)
+   */
+   length=(size_t) ximage->bytes_per_line*ximage->height;
+   if (CheckOverflowException(length,ximage->bytes_per_line,ximage->height))
+-    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
++    {
++      ximage=(XImage *) RelinquishMagickMemory(ximage);
++      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
++    }
+   if (ximage->format != ZPixmap)
+     {
+       size_t
+@@ -336,20 +375,31 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)
+       extent=length;
+       length*=ximage->depth;
+       if (CheckOverflowException(length,extent,ximage->depth))
+-        ThrowReaderException(CorruptImageError,"ImproperImageHeader");
++        {
++          ximage=(XImage *) RelinquishMagickMemory(ximage);
++          ThrowReaderException(CorruptImageError,"ImproperImageHeader");
++        }
+     }
+   ximage->data=(char *) AcquireQuantumMemory(length,sizeof(*ximage->data));
+   if (ximage->data == (char *) NULL)
+-    ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
++    {
++      ximage=(XImage *) RelinquishMagickMemory(ximage);
++      ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
++     }
+   count=ReadBlob(image,length,(unsigned char *) ximage->data);
+   if (count == 0)
+-    ThrowReaderException(CorruptImageError,"UnexpectedEndOfFile");
++    {
++      ximage->data=DestroyString(ximage->data);
++      ximage=(XImage *) RelinquishMagickMemory(ximage);
++      ThrowReaderException(CorruptImageError,"UnexpectedEndOfFile");
++    }
+   /*
+     Convert image to MIFF format.
+   */
+   image->columns=(size_t) ximage->width;
+   image->rows=(size_t) ximage->height;
+-  if ((colors == (XColor *) NULL) || (ximage->red_mask != 0) ||
++  image->depth=8;
++  if ((header.ncolors == 0U) || (ximage->red_mask != 0) ||
+       (ximage->green_mask != 0) || (ximage->blue_mask != 0))
+     image->storage_class=DirectClass;
+   else
+@@ -462,7 +512,11 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)
+           Convert X image to PseudoClass packets.
+         */
+         if (AcquireImageColormap(image,image->colors) == MagickFalse)
+-          ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
++          {
++            ximage->data=DestroyString(ximage->data);
++            ximage=(XImage *) RelinquishMagickMemory(ximage);
++            ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
++          }
+         for (i=0; i < (ssize_t) image->colors; i++)
+         {
+           image->colormap[i].red=ScaleShortToQuantum(colors[i].red);
+@@ -702,7 +756,7 @@ static MagickBooleanType WriteXWDImage(const ImageInfo *image_info,Image *image)
+   (void) WriteBlob(image,1,(const unsigned char *) "\0");
+   if (image->storage_class == PseudoClass)
+     {
+-      register unsigned int
++      register ssize_t
+         i;
+ 
+       XColor
+@@ -721,7 +775,7 @@ static MagickBooleanType WriteXWDImage(const ImageInfo *image_info,Image *image)
+         ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
+       for (i=0; i < (ssize_t) image->colors; i++)
+       {
+-        colors[i].pixel=i;
++        colors[i].pixel=(unsigned long) i;
+         colors[i].red=ScaleQuantumToShort(image->colormap[i].red);
+         colors[i].green=ScaleQuantumToShort(image->colormap[i].green);
+         colors[i].blue=ScaleQuantumToShort(image->colormap[i].blue);
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0013-Avoid-a-NULL-dereference-in-ps-handling.patch imagemagick-6.8.9.9/debian/patches/0013-Avoid-a-NULL-dereference-in-ps-handling.patch
--- imagemagick-6.8.9.9/debian/patches/0013-Avoid-a-NULL-dereference-in-ps-handling.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0013-Avoid-a-NULL-dereference-in-ps-handling.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,40 @@
+From f093a3119704fd6d349a9ee32b9f71cabe7d04c8 Mon Sep 17 00:00:00 2001
+From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Fri, 28 Nov 2014 17:13:45 +0000
+Subject: [PATCH] Avoid a NULL dereference in ps handling
+
+GetStringInfoDatum(NULL) will likely crash. Avoid it.
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17117 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin: http://trac.imagemagick.org/changeset/17117
+---
+ coders/ps.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/coders/ps.c b/coders/ps.c
+index d5e1e01..efcdac9 100644
+--- a/coders/ps.c
++++ b/coders/ps.c
+@@ -643,11 +643,14 @@ static Image *ReadPSImage(const ImageInfo *image_info,ExceptionInfo *exception)
+           continue;
+         length=extent;
+         profile=BlobToStringInfo((const void *) NULL,length);
+-        p=GetStringInfoDatum(profile);
+-        for (i=0; i < (ssize_t) length; i++)
+-          *p++=(unsigned char) ProfileInteger(image,hex_digits);
+-        (void) SetImageProfile(image,"8bim",profile);
+-        profile=DestroyStringInfo(profile);
++        if (profile != (StringInfo *) NULL)
++          {
++            p=GetStringInfoDatum(profile);
++            for (i=0; i < (ssize_t) length; i++)
++              *p++=(unsigned char) ProfileInteger(image,hex_digits);
++            (void) SetImageProfile(image,"8bim",profile);
++            profile=DestroyStringInfo(profile);
++          }
+         continue;
+       }
+     if (LocaleNCompare(BeginXMPPacket,command,strlen(BeginXMPPacket)) == 0)
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0014-Avoid-out-of-bound-access-in-xwd-file-handling.patch imagemagick-6.8.9.9/debian/patches/0014-Avoid-out-of-bound-access-in-xwd-file-handling.patch
--- imagemagick-6.8.9.9/debian/patches/0014-Avoid-out-of-bound-access-in-xwd-file-handling.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0014-Avoid-out-of-bound-access-in-xwd-file-handling.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,39 @@
+From 82a5bbdd47b9b3f43ce3c2aa18741aecc4a0f962 Mon Sep 17 00:00:00 2001
+From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Fri, 28 Nov 2014 17:21:53 +0000
+Subject: [PATCH] Avoid out of bound access in xwd file handling
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17119 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin: http://trac.imagemagick.org/changeset/17119
+---
+ coders/xwd.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/coders/xwd.c b/coders/xwd.c
+index 2949a17..19e4e71 100644
+--- a/coders/xwd.c
++++ b/coders/xwd.c
+@@ -459,12 +459,16 @@ static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)
+             {
+               pixel=XGetPixel(ximage,(int) x,(int) y);
+               index=(IndexPacket) ((pixel >> red_shift) & red_mask);
+-              SetPixelRed(q,ScaleShortToQuantum(colors[(ssize_t) index].red));
++              if (index < header.ncolors)
++                SetPixelRed(q,ScaleShortToQuantum(colors[(ssize_t) index].red));
+               index=(IndexPacket) ((pixel >> green_shift) & green_mask);
+-              SetPixelGreen(q,ScaleShortToQuantum(colors[(ssize_t)
+-                index].green));
++              if (index < header.ncolors)
++                SetPixelGreen(q,ScaleShortToQuantum(colors[(ssize_t)
++                  index].green));
+               index=(IndexPacket) ((pixel >> blue_shift) & blue_mask);
+-              SetPixelBlue(q,ScaleShortToQuantum(colors[(ssize_t) index].blue));
++              if (index < header.ncolors)
++                SetPixelBlue(q,ScaleShortToQuantum(colors[(ssize_t)
++                  index].blue));
+               q++;
+             }
+             if (SyncAuthenticPixels(image,exception) == MagickFalse)
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0015-Fix-a-SEGV-with-corrupted-viff-image.patch imagemagick-6.8.9.9/debian/patches/0015-Fix-a-SEGV-with-corrupted-viff-image.patch
--- imagemagick-6.8.9.9/debian/patches/0015-Fix-a-SEGV-with-corrupted-viff-image.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0015-Fix-a-SEGV-with-corrupted-viff-image.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,196 @@
+From ae8e15370f269a529623b762c1355ab1dbab712e Mon Sep 17 00:00:00 2001
+From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Fri, 28 Nov 2014 14:15:53 +0000
+Subject: [PATCH] Fix a SEGV with corrupted viff image
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17110 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin: http://trac.imagemagick.org/changeset/17110
+---
+ coders/viff.c | 115 ++++++++++++++++++++++++----------------------------------
+ 1 file changed, 47 insertions(+), 68 deletions(-)
+
+diff --git a/coders/viff.c b/coders/viff.c
+index 02620a8..51cdf5e 100644
+--- a/coders/viff.c
++++ b/coders/viff.c
+@@ -248,7 +248,6 @@ static Image *ReadVIFFImage(const ImageInfo *image_info,
+     y;
+ 
+   unsigned char
+-    buffer[7],
+     *pixels;
+ 
+   ViffInfo
+@@ -285,64 +284,42 @@ static Image *ReadVIFFImage(const ImageInfo *image_info,
+     /*
+       Initialize VIFF image.
+     */
+-    count=ReadBlob(image,7,buffer);
+-    viff_info.file_type=buffer[0];
+-    viff_info.release=buffer[1];
+-    viff_info.version=buffer[2];
+-    viff_info.machine_dependency=buffer[3];
++    (void) ReadBlob(image,sizeof(viff_info.file_type),&viff_info.file_type);
++    (void) ReadBlob(image,sizeof(viff_info.release),&viff_info.release);
++    (void) ReadBlob(image,sizeof(viff_info.version),&viff_info.version);
++    (void) ReadBlob(image,sizeof(viff_info.machine_dependency),
++      &viff_info.machine_dependency);
++    (void) ReadBlob(image,sizeof(viff_info.reserve),viff_info.reserve);
+     count=ReadBlob(image,512,(unsigned char *) viff_info.comment);
+     viff_info.comment[511]='\0';
+     if (strlen(viff_info.comment) > 4)
+       (void) SetImageProperty(image,"comment",viff_info.comment);
+     if ((viff_info.machine_dependency == VFF_DEP_DECORDER) ||
+         (viff_info.machine_dependency == VFF_DEP_NSORDER))
+-      {
+-        viff_info.rows=ReadBlobLSBLong(image);
+-        viff_info.columns=ReadBlobLSBLong(image);
+-        viff_info.subrows=ReadBlobLSBLong(image);
+-        viff_info.x_offset=(int) ReadBlobLSBLong(image);
+-        viff_info.y_offset=(int) ReadBlobLSBLong(image);
+-        viff_info.x_bits_per_pixel=(float) ReadBlobLSBLong(image);
+-        viff_info.y_bits_per_pixel=(float) ReadBlobLSBLong(image);
+-        viff_info.location_type=ReadBlobLSBLong(image);
+-        viff_info.location_dimension=ReadBlobLSBLong(image);
+-        viff_info.number_of_images=ReadBlobLSBLong(image);
+-        viff_info.number_data_bands=ReadBlobLSBLong(image);
+-        viff_info.data_storage_type=ReadBlobLSBLong(image);
+-        viff_info.data_encode_scheme=ReadBlobLSBLong(image);
+-        viff_info.map_scheme=ReadBlobLSBLong(image);
+-        viff_info.map_storage_type=ReadBlobLSBLong(image);
+-        viff_info.map_rows=ReadBlobLSBLong(image);
+-        viff_info.map_columns=ReadBlobLSBLong(image);
+-        viff_info.map_subrows=ReadBlobLSBLong(image);
+-        viff_info.map_enable=ReadBlobLSBLong(image);
+-        viff_info.maps_per_cycle=ReadBlobLSBLong(image);
+-        viff_info.color_space_model=ReadBlobLSBLong(image);
+-      }
++      image->endian=LSBEndian;
+     else
+-      {
+-        viff_info.rows=ReadBlobMSBLong(image);
+-        viff_info.columns=ReadBlobMSBLong(image);
+-        viff_info.subrows=ReadBlobMSBLong(image);
+-        viff_info.x_offset=(int) ReadBlobMSBLong(image);
+-        viff_info.y_offset=(int) ReadBlobMSBLong(image);
+-        viff_info.x_bits_per_pixel=(float) ReadBlobMSBLong(image);
+-        viff_info.y_bits_per_pixel=(float) ReadBlobMSBLong(image);
+-        viff_info.location_type=ReadBlobMSBLong(image);
+-        viff_info.location_dimension=ReadBlobMSBLong(image);
+-        viff_info.number_of_images=ReadBlobMSBLong(image);
+-        viff_info.number_data_bands=ReadBlobMSBLong(image);
+-        viff_info.data_storage_type=ReadBlobMSBLong(image);
+-        viff_info.data_encode_scheme=ReadBlobMSBLong(image);
+-        viff_info.map_scheme=ReadBlobMSBLong(image);
+-        viff_info.map_storage_type=ReadBlobMSBLong(image);
+-        viff_info.map_rows=ReadBlobMSBLong(image);
+-        viff_info.map_columns=ReadBlobMSBLong(image);
+-        viff_info.map_subrows=ReadBlobMSBLong(image);
+-        viff_info.map_enable=ReadBlobMSBLong(image);
+-        viff_info.maps_per_cycle=ReadBlobMSBLong(image);
+-        viff_info.color_space_model=ReadBlobMSBLong(image);
+-      }
++      image->endian=MSBEndian;
++    viff_info.rows=ReadBlobLong(image);
++    viff_info.columns=ReadBlobLong(image);
++    viff_info.subrows=ReadBlobLong(image);
++    viff_info.x_offset=(int) ReadBlobLong(image);
++    viff_info.y_offset=(int) ReadBlobLong(image);
++    viff_info.x_bits_per_pixel=(float) ReadBlobLong(image);
++    viff_info.y_bits_per_pixel=(float) ReadBlobLong(image);
++    viff_info.location_type=ReadBlobLong(image);
++    viff_info.location_dimension=ReadBlobLong(image);
++    viff_info.number_of_images=ReadBlobLong(image);
++    viff_info.number_data_bands=ReadBlobLong(image);
++    viff_info.data_storage_type=ReadBlobLong(image);
++    viff_info.data_encode_scheme=ReadBlobLong(image);
++    viff_info.map_scheme=ReadBlobLong(image);
++    viff_info.map_storage_type=ReadBlobLong(image);
++    viff_info.map_rows=ReadBlobLong(image);
++    viff_info.map_columns=ReadBlobLong(image);
++    viff_info.map_subrows=ReadBlobLong(image);
++    viff_info.map_enable=ReadBlobLong(image);
++    viff_info.maps_per_cycle=ReadBlobLong(image);
++    viff_info.color_space_model=ReadBlobLong(image);
+     for (i=0; i < 420; i++)
+       (void) ReadBlobByte(image);
+     image->columns=viff_info.rows;
+@@ -632,16 +609,16 @@ static Image *ReadVIFFImage(const ImageInfo *image_info,
+           {
+             for (bit=0; bit < 8; bit++)
+             {
+-              quantum=((*p) & (0x01 << bit) ? 0 : 1);
++              quantum=(size_t) ((*p) & (0x01 << bit) ? 0 : 1);
+               SetPixelIndex(indexes+x+bit,quantum);
+              }
+             p++;
+           }
+           if ((image->columns % 8) != 0)
+             {
+-              for (bit=0; bit < (ssize_t) (image->columns % 8); bit++)
++              for (bit=0; bit < (int) (image->columns % 8); bit++)
+               {
+-                quantum=((*p) & (0x01 << bit) ? 0 : 1);
++                quantum=(size_t) ((*p) & (0x01 << bit) ? 0 : 1);
+                 SetPixelIndex(indexes+x+bit,quantum);
+               }
+               p++;
+@@ -948,7 +925,6 @@ static MagickBooleanType WriteVIFFImage(const ImageInfo *image_info,
+     y;
+ 
+   unsigned char
+-    buffer[8],
+     *pixels;
+ 
+   ViffInfo
+@@ -1010,7 +986,7 @@ RestoreMSCWarning
+         /*
+           Full color VIFF raster.
+         */
+-        viff_info.number_data_bands=image->matte ? 4UL : 3UL;
++        viff_info.number_data_bands=image->matte ? 4U : 3U;
+         viff_info.color_space_model=VFF_CM_genericRGB;
+         viff_info.data_storage_type=VFF_TYP_1_BYTE;
+         packets=viff_info.number_data_bands*number_pixels;
+@@ -1044,24 +1020,27 @@ RestoreMSCWarning
+     /*
+       Write VIFF image header (pad to 1024 bytes).
+     */
+-    buffer[0]=(unsigned char) viff_info.identifier;
+-    buffer[1]=(unsigned char) viff_info.file_type;
+-    buffer[2]=(unsigned char) viff_info.release;
+-    buffer[3]=(unsigned char) viff_info.version;
+-    buffer[4]=(unsigned char) viff_info.machine_dependency;
+-    buffer[5]=(unsigned char) viff_info.reserve[0];
+-    buffer[6]=(unsigned char) viff_info.reserve[1];
+-    buffer[7]=(unsigned char) viff_info.reserve[2];
+-    (void) WriteBlob(image,8,buffer);
++    (void) WriteBlob(image,sizeof(viff_info.identifier),(unsigned char *)
++      &viff_info.identifier);
++    (void) WriteBlob(image,sizeof(viff_info.file_type),(unsigned char *)
++      &viff_info.file_type);
++    (void) WriteBlob(image,sizeof(viff_info.release),(unsigned char *)
++      &viff_info.release);
++    (void) WriteBlob(image,sizeof(viff_info.version),(unsigned char *)
++      &viff_info.version);
++    (void) WriteBlob(image,sizeof(viff_info.machine_dependency),
++      (unsigned char *) &viff_info.machine_dependency);
++    (void) WriteBlob(image,sizeof(viff_info.reserve),(unsigned char *)
++      viff_info.reserve);
+     (void) WriteBlob(image,512,(unsigned char *) viff_info.comment);
+     (void) WriteBlobMSBLong(image,(unsigned int) viff_info.rows);
+     (void) WriteBlobMSBLong(image,(unsigned int) viff_info.columns);
+     (void) WriteBlobMSBLong(image,(unsigned int) viff_info.subrows);
+     (void) WriteBlobMSBLong(image,(unsigned int) viff_info.x_offset);
+     (void) WriteBlobMSBLong(image,(unsigned int) viff_info.y_offset);
+-    viff_info.x_bits_per_pixel=1U*(63 << 24) | (128 << 16);
++    viff_info.x_bits_per_pixel=(unsigned int) ((63 << 24) | (128 << 16));
+     (void) WriteBlobMSBLong(image,(unsigned int) viff_info.x_bits_per_pixel);
+-    viff_info.y_bits_per_pixel=1U*(63 << 24) | (128 << 16);
++    viff_info.y_bits_per_pixel=(unsigned int) ((63 << 24) | (128 << 16));
+     (void) WriteBlobMSBLong(image,(unsigned int) viff_info.y_bits_per_pixel);
+     (void) WriteBlobMSBLong(image,viff_info.location_type);
+     (void) WriteBlobMSBLong(image,viff_info.location_dimension);
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0016-Fix-a-null-pointer-dereference-in-wpg-file-handling.patch imagemagick-6.8.9.9/debian/patches/0016-Fix-a-null-pointer-dereference-in-wpg-file-handling.patch
--- imagemagick-6.8.9.9/debian/patches/0016-Fix-a-null-pointer-dereference-in-wpg-file-handling.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0016-Fix-a-null-pointer-dereference-in-wpg-file-handling.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,146 @@
+From fcced2ba626109d23186282d326427a0fc85fec0 Mon Sep 17 00:00:00 2001
+From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Fri, 28 Nov 2014 23:49:14 +0000
+Subject: [PATCH] Fix a null pointer dereference in wpg file handling
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17126 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin: http://trac.imagemagick.org/changeset/17126
+---
+ coders/wpg.c | 85 +++++++++++++++++++++++++++++++++++++++---------------------
+ 1 file changed, 55 insertions(+), 30 deletions(-)
+
+diff --git a/coders/wpg.c b/coders/wpg.c
+index a655c6b..0df9df3 100644
+--- a/coders/wpg.c
++++ b/coders/wpg.c
+@@ -920,8 +920,7 @@ static Image *ReadWPGImage(const ImageInfo *image_info,
+   */
+ 
+   Image
+-    *image,
+-    *rotated_image;
++    *image;
+ 
+   unsigned int
+     status;
+@@ -1151,30 +1150,46 @@ static Image *ReadWPGImage(const ImageInfo *image_info,
+                   /* flop command */
+                   if(BitmapHeader2.RotAngle & 0x8000)
+                     {
+-                      rotated_image = FlopImage(image, exception);
+-                      rotated_image->blob = image->blob;
+-                      DuplicateBlob(rotated_image,image);
+-                      (void) RemoveLastImageFromList(&image);
+-                      AppendImageToList(&image,rotated_image);
++                      Image
++                        *flop_image;
++
++                      flop_image = FlopImage(image, exception);
++                      if (flop_image != (Image *) NULL) {
++                        flop_image->blob = image->blob;
++                        DuplicateBlob(flop_image,image);
++                        (void) RemoveLastImageFromList(&image);
++                        AppendImageToList(&image,flop_image);
++                      }
+                     }
+                   /* flip command */
+                   if(BitmapHeader2.RotAngle & 0x2000)
+                     {
+-                      rotated_image = FlipImage(image, exception);
+-                      rotated_image->blob = image->blob;
+-                      DuplicateBlob(rotated_image,image);
+-                      (void) RemoveLastImageFromList(&image);
+-                      AppendImageToList(&image,rotated_image);
++                      Image
++                        *flip_image;
++
++                      flip_image = FlipImage(image, exception);
++                      if (flip_image != (Image *) NULL) {
++                        flip_image->blob = image->blob;
++                        DuplicateBlob(flip_image,image);
++                        (void) RemoveLastImageFromList(&image);
++                        AppendImageToList(&image,flip_image);
++                      }
+                     }
+ 
+       /* rotate command */
+                   if(BitmapHeader2.RotAngle & 0x0FFF)
+                     {
+-                      rotated_image = RotateImage(image, (BitmapHeader2.RotAngle & 0x0FFF), exception);
+-                      rotated_image->blob = image->blob;
+-                      DuplicateBlob(rotated_image,image);
+-                      (void) RemoveLastImageFromList(&image);
+-                      AppendImageToList(&image,rotated_image);
++                      Image
++                        *rotate_image;
++
++                      rotate_image=RotateImage(image,(BitmapHeader2.RotAngle &
++                        0x0FFF), exception);
++                      if (rotate_image != (Image *) NULL) {
++                        rotate_image->blob = image->blob;
++                        DuplicateBlob(rotate_image,image);
++                        (void) RemoveLastImageFromList(&image);
++                        AppendImageToList(&image,rotate_image);
++                      }
+                     }
+                 }
+ 
+@@ -1327,12 +1342,17 @@ static Image *ReadWPGImage(const ImageInfo *image_info,
+                 }
+ 
+               if(CTM[0][0]<0 && !image_info->ping)
+-    {    /*?? RotAngle=360-RotAngle;*/
+-      rotated_image = FlopImage(image, exception);
+-      rotated_image->blob = image->blob;
+-      DuplicateBlob(rotated_image,image);
+-      (void) RemoveLastImageFromList(&image);
+-      AppendImageToList(&image,rotated_image);
++                {    /*?? RotAngle=360-RotAngle;*/
++                  Image
++                    *flop_image;
++
++                  flop_image = FlopImage(image, exception);
++                  if (flop_image != (Image *) NULL) {
++                    flop_image->blob = image->blob;
++                    DuplicateBlob(flop_image,image);
++                    (void) RemoveLastImageFromList(&image);
++                    AppendImageToList(&image,flop_image);
++                  }
+                   /* Try to change CTM according to Flip - I am not sure, must be checked.
+                      Tx(0,0)=-1;      Tx(1,0)=0;   Tx(2,0)=0;
+                      Tx(0,1)= 0;      Tx(1,1)=1;   Tx(2,1)=0;
+@@ -1340,19 +1360,24 @@ static Image *ReadWPGImage(const ImageInfo *image_info,
+                      Tx(1,2)=0;   Tx(2,2)=1; */
+                 }
+               if(CTM[1][1]<0 && !image_info->ping)
+-    {    /*?? RotAngle=360-RotAngle;*/
+-      rotated_image = FlipImage(image, exception);
+-      rotated_image->blob = image->blob;
+-      DuplicateBlob(rotated_image,image);
+-      (void) RemoveLastImageFromList(&image);
+-      AppendImageToList(&image,rotated_image);
++                {    /*?? RotAngle=360-RotAngle;*/
++                  Image
++                    *flip_image;
++
++                  flip_image = FlipImage(image, exception);
++                  if (flip_image != (Image *) NULL) {
++                    flip_image->blob = image->blob;
++                    DuplicateBlob(flip_image,image);
++                    (void) RemoveLastImageFromList(&image);
++                    AppendImageToList(&image,flip_image);
++                  }
+                   /* Try to change CTM according to Flip - I am not sure, must be checked.
+                      float_matrix Tx(3,3);
+                      Tx(0,0)= 1;   Tx(1,0)= 0;   Tx(2,0)=0;
+                      Tx(0,1)= 0;   Tx(1,1)=-1;   Tx(2,1)=0;
+                      Tx(0,2)= 0;   Tx(1,2)=(WPG._2Rect.Y_ur+WPG._2Rect.Y_ll);
+                      Tx(2,2)=1; */
+-    }
++                }
+ 
+ 
+               /* Allocate next image structure. */
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0017-Do-not-continue-on-corrupted-wpg-file.patch imagemagick-6.8.9.9/debian/patches/0017-Do-not-continue-on-corrupted-wpg-file.patch
--- imagemagick-6.8.9.9/debian/patches/0017-Do-not-continue-on-corrupted-wpg-file.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0017-Do-not-continue-on-corrupted-wpg-file.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,145 @@
+From 1eb3064a9e4a81d0b8cd414e3dcd7fe9b158f241 Mon Sep 17 00:00:00 2001
+From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Sat, 29 Nov 2014 00:47:19 +0000
+Subject: [PATCH] Do not continue on corrupted wpg file
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17127 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin: http://trac.imagemagick.org/changeset/17127
+---
+ coders/wpg.c | 29 +++++++++++++++--------------
+ 1 file changed, 15 insertions(+), 14 deletions(-)
+
+diff --git a/coders/wpg.c b/coders/wpg.c
+index 0df9df3..f051e03 100644
+--- a/coders/wpg.c
++++ b/coders/wpg.c
+@@ -877,7 +877,7 @@ static Image *ReadWPGImage(const ImageInfo *image_info,
+   typedef struct
+   {
+     unsigned int Width;
+-    unsigned int Heigth;
++    unsigned int Height;
+     unsigned int Depth;
+     unsigned int HorzRes;
+     unsigned int VertRes;
+@@ -886,7 +886,7 @@ static Image *ReadWPGImage(const ImageInfo *image_info,
+   typedef struct
+   {
+     unsigned int Width;
+-    unsigned int Heigth;
++    unsigned int Height;
+     unsigned char Depth;
+     unsigned char Compression;
+   } WPG2BitmapType1;
+@@ -899,7 +899,7 @@ static Image *ReadWPGImage(const ImageInfo *image_info,
+     unsigned int UpRightX;
+     unsigned int UpRightY;
+     unsigned int Width;
+-    unsigned int Heigth;
++    unsigned int Height;
+     unsigned int Depth;
+     unsigned int HorzRes;
+     unsigned int VertRes;
+@@ -1025,7 +1025,9 @@ static Image *ReadWPGImage(const ImageInfo *image_info,
+             {
+             case 0x0B: /* bitmap type 1 */
+               BitmapHeader1.Width=ReadBlobLSBShort(image);
+-              BitmapHeader1.Heigth=ReadBlobLSBShort(image);
++              BitmapHeader1.Height=ReadBlobLSBShort(image);
++              if ((BitmapHeader1.Width == 0) || (BitmapHeader1.Height == 0))
++                ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+               BitmapHeader1.Depth=ReadBlobLSBShort(image);
+               BitmapHeader1.HorzRes=ReadBlobLSBShort(image);
+               BitmapHeader1.VertRes=ReadBlobLSBShort(image);
+@@ -1037,7 +1039,7 @@ static Image *ReadWPGImage(const ImageInfo *image_info,
+                   image->y_resolution=BitmapHeader1.VertRes/470.0;
+                 }
+               image->columns=BitmapHeader1.Width;
+-              image->rows=BitmapHeader1.Heigth;
++              image->rows=BitmapHeader1.Height;
+               bpp=BitmapHeader1.Depth;
+ 
+               goto UnpackRaster;
+@@ -1075,7 +1077,9 @@ static Image *ReadWPGImage(const ImageInfo *image_info,
+               BitmapHeader2.UpRightX=ReadBlobLSBShort(image);
+               BitmapHeader2.UpRightY=ReadBlobLSBShort(image);
+               BitmapHeader2.Width=ReadBlobLSBShort(image);
+-              BitmapHeader2.Heigth=ReadBlobLSBShort(image);
++              BitmapHeader2.Height=ReadBlobLSBShort(image);
++              if ((BitmapHeader2.Width == 0) || (BitmapHeader2.Height == 0))
++                ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+               BitmapHeader2.Depth=ReadBlobLSBShort(image);
+               BitmapHeader2.HorzRes=ReadBlobLSBShort(image);
+               BitmapHeader2.VertRes=ReadBlobLSBShort(image);
+@@ -1093,7 +1097,7 @@ static Image *ReadWPGImage(const ImageInfo *image_info,
+                   image->y_resolution=BitmapHeader2.VertRes/470.0;
+                 }
+               image->columns=BitmapHeader2.Width;
+-              image->rows=BitmapHeader2.Heigth;
++              image->rows=BitmapHeader2.Height;
+               bpp=BitmapHeader2.Depth;
+ 
+             UnpackRaster:
+@@ -1155,7 +1159,6 @@ static Image *ReadWPGImage(const ImageInfo *image_info,
+ 
+                       flop_image = FlopImage(image, exception);
+                       if (flop_image != (Image *) NULL) {
+-                        flop_image->blob = image->blob;
+                         DuplicateBlob(flop_image,image);
+                         (void) RemoveLastImageFromList(&image);
+                         AppendImageToList(&image,flop_image);
+@@ -1169,7 +1172,6 @@ static Image *ReadWPGImage(const ImageInfo *image_info,
+ 
+                       flip_image = FlipImage(image, exception);
+                       if (flip_image != (Image *) NULL) {
+-                        flip_image->blob = image->blob;
+                         DuplicateBlob(flip_image,image);
+                         (void) RemoveLastImageFromList(&image);
+                         AppendImageToList(&image,flip_image);
+@@ -1185,7 +1187,6 @@ static Image *ReadWPGImage(const ImageInfo *image_info,
+                       rotate_image=RotateImage(image,(BitmapHeader2.RotAngle &
+                         0x0FFF), exception);
+                       if (rotate_image != (Image *) NULL) {
+-                        rotate_image->blob = image->blob;
+                         DuplicateBlob(rotate_image,image);
+                         (void) RemoveLastImageFromList(&image);
+                         AppendImageToList(&image,rotate_image);
+@@ -1264,7 +1265,9 @@ static Image *ReadWPGImage(const ImageInfo *image_info,
+               break;
+             case 0x0E:
+               Bitmap2Header1.Width=ReadBlobLSBShort(image);
+-              Bitmap2Header1.Heigth=ReadBlobLSBShort(image);
++              Bitmap2Header1.Height=ReadBlobLSBShort(image);
++              if ((Bitmap2Header1.Width == 0) || (Bitmap2Header1.Height == 0))
++                ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+               Bitmap2Header1.Depth=ReadBlobByte(image);
+               Bitmap2Header1.Compression=ReadBlobByte(image);
+ 
+@@ -1291,7 +1294,7 @@ static Image *ReadWPGImage(const ImageInfo *image_info,
+                   continue;  /*Ignore raster with unknown depth*/
+                 }
+               image->columns=Bitmap2Header1.Width;
+-              image->rows=Bitmap2Header1.Heigth;
++              image->rows=Bitmap2Header1.Height;
+ 
+               if ((image->colors == 0) && (bpp != 24))
+                 {
+@@ -1348,7 +1351,6 @@ static Image *ReadWPGImage(const ImageInfo *image_info,
+ 
+                   flop_image = FlopImage(image, exception);
+                   if (flop_image != (Image *) NULL) {
+-                    flop_image->blob = image->blob;
+                     DuplicateBlob(flop_image,image);
+                     (void) RemoveLastImageFromList(&image);
+                     AppendImageToList(&image,flop_image);
+@@ -1366,7 +1368,6 @@ static Image *ReadWPGImage(const ImageInfo *image_info,
+ 
+                   flip_image = FlipImage(image, exception);
+                   if (flip_image != (Image *) NULL) {
+-                    flip_image->blob = image->blob;
+                     DuplicateBlob(flip_image,image);
+                     (void) RemoveLastImageFromList(&image);
+                     AppendImageToList(&image,flip_image);
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0018-Avoid-a-out-of-bound-acess-in-viff-image.patch imagemagick-6.8.9.9/debian/patches/0018-Avoid-a-out-of-bound-acess-in-viff-image.patch
--- imagemagick-6.8.9.9/debian/patches/0018-Avoid-a-out-of-bound-acess-in-viff-image.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0018-Avoid-a-out-of-bound-acess-in-viff-image.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,82 @@
+From 35aa01dd5511a2616a6427f7d5d49de0132aeb5f Mon Sep 17 00:00:00 2001
+From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Sat, 29 Nov 2014 15:28:37 +0000
+Subject: [PATCH] Avoid a out of bound acess in viff image
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17131 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin: http://trac.imagemagick.org/changeset/17131
+---
+ coders/viff.c | 36 +++++++++++++++++++++---------------
+ 1 file changed, 21 insertions(+), 15 deletions(-)
+
+diff --git a/coders/viff.c b/coders/viff.c
+index 51cdf5e..f05b20d 100644
+--- a/coders/viff.c
++++ b/coders/viff.c
+@@ -47,6 +47,7 @@
+ #include "magick/color.h"
+ #include "magick/color-private.h"
+ #include "magick/colormap.h"
++#include "magick/colormap-private.h"
+ #include "magick/colorspace.h"
+ #include "magick/colorspace-private.h"
+ #include "magick/exception.h"
+@@ -447,18 +448,18 @@ static Image *ReadVIFFImage(const ImageInfo *image_info,
+           if (i < (ssize_t) image->colors)
+             {
+               image->colormap[i].red=ScaleCharToQuantum((unsigned char) value);
+-              image->colormap[i].green=
+-                ScaleCharToQuantum((unsigned char) value);
++              image->colormap[i].green=ScaleCharToQuantum((unsigned char)
++                value);
+               image->colormap[i].blue=ScaleCharToQuantum((unsigned char) value);
+             }
+           else
+             if (i < (ssize_t) (2*image->colors))
+-              image->colormap[i % image->colors].green=
+-                ScaleCharToQuantum((unsigned char) value);
++              image->colormap[i % image->colors].green=ScaleCharToQuantum(
++                (unsigned char) value);
+             else
+               if (i < (ssize_t) (3*image->colors))
+-                image->colormap[i % image->colors].blue=
+-                  ScaleCharToQuantum((unsigned char) value);
++                image->colormap[i % image->colors].blue=ScaleCharToQuantum(
++                  (unsigned char) value);
+         }
+         viff_colormap=(unsigned char *) RelinquishMagickMemory(viff_colormap);
+         break;
+@@ -672,16 +673,21 @@ static Image *ReadVIFFImage(const ImageInfo *image_info,
+               SetPixelBlue(q,ScaleCharToQuantum(*(p+2*number_pixels)));
+               if (image->colors != 0)
+                 {
+-                  SetPixelRed(q,image->colormap[(ssize_t)
+-                    GetPixelRed(q)].red);
+-                  SetPixelGreen(q,image->colormap[(ssize_t)
+-                    GetPixelGreen(q)].green);
+-                  SetPixelBlue(q,image->colormap[(ssize_t)
+-                    GetPixelBlue(q)].blue);
++                  ssize_t
++                    index;
++
++                  index=(ssize_t) GetPixelRed(q);
++                  SetPixelRed(q,image->colormap[
++                    ConstrainColormapIndex(image,index)].red);
++                  index=(ssize_t) GetPixelGreen(q);
++                  SetPixelGreen(q,image->colormap[
++                    ConstrainColormapIndex(image,index)].green);
++                  index=(ssize_t) GetPixelRed(q);
++                  SetPixelBlue(q,image->colormap[
++                    ConstrainColormapIndex(image,index)].blue);
+                 }
+-              SetPixelOpacity(q,image->matte != MagickFalse ?
+-                QuantumRange-ScaleCharToQuantum(*(p+number_pixels*3)) :
+-                OpaqueOpacity);
++              SetPixelOpacity(q,image->matte != MagickFalse ? QuantumRange-
++                ScaleCharToQuantum(*(p+number_pixels*3)) : OpaqueOpacity);
+               p++;
+               q++;
+             }
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0019-Avoid-a-heap-buffer-overflow-in-pdb-file-handling.patch imagemagick-6.8.9.9/debian/patches/0019-Avoid-a-heap-buffer-overflow-in-pdb-file-handling.patch
--- imagemagick-6.8.9.9/debian/patches/0019-Avoid-a-heap-buffer-overflow-in-pdb-file-handling.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0019-Avoid-a-heap-buffer-overflow-in-pdb-file-handling.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,49 @@
+From e24de96ab25b396ae914a7640ff4d61e58c40cf0 Mon Sep 17 00:00:00 2001
+From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Sat, 29 Nov 2014 17:16:15 +0000
+Subject: [PATCH] Avoid a heap buffer overflow in pdb file handling
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17132 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin: http://trac.imagemagick.org/changeset/17132
+---
+ coders/pdb.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/coders/pdb.c b/coders/pdb.c
+index 117538d..af6bfec 100644
+--- a/coders/pdb.c
++++ b/coders/pdb.c
+@@ -402,12 +402,11 @@ static Image *ReadPDBImage(const ImageInfo *image_info,ExceptionInfo *exception)
+       (void) CloseBlob(image);
+       return(GetFirstImageInList(image));
+     }
+-  packets=bits_per_pixel*image->columns/8;
++  packets=(bits_per_pixel*image->columns+7)/8;
+   pixels=(unsigned char *) AcquireQuantumMemory(packets+256UL,image->rows*
+     sizeof(*pixels));
+   if (pixels == (unsigned char *) NULL)
+     ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+-
+   switch (pdb_image.version & 0x07)
+   {
+     case 0:
+@@ -528,7 +527,6 @@ static Image *ReadPDBImage(const ImageInfo *image_info,ExceptionInfo *exception)
+     default:
+       ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+   }
+-
+   pixels=(unsigned char *) RelinquishMagickMemory(pixels);
+   if (EOFBlob(image) != MagickFalse)
+     ThrowFileException(exception,CorruptImageError,"UnexpectedEndOfFile",
+@@ -801,7 +799,7 @@ static MagickBooleanType WritePDBImage(const ImageInfo *image_info,Image *image)
+   if (image->columns % 16)
+     pdb_image.width=(short) (16*(image->columns/16+1));
+   pdb_image.height=(short) image->rows;
+-  packets=(bits_per_pixel*image->columns/8+4)*image->rows;
++  packets=((bits_per_pixel*image->columns+7)/8)*image->rows;
+   runlength=(unsigned char *) AcquireQuantumMemory(2UL*packets,
+     sizeof(*runlength));
+   if (runlength == (unsigned char *) NULL)
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0020-Avoid-an-out-of-bound-acess-on-malformed-sun-file.patch imagemagick-6.8.9.9/debian/patches/0020-Avoid-an-out-of-bound-acess-on-malformed-sun-file.patch
--- imagemagick-6.8.9.9/debian/patches/0020-Avoid-an-out-of-bound-acess-on-malformed-sun-file.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0020-Avoid-an-out-of-bound-acess-on-malformed-sun-file.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,112 @@
+From 8e72cbfca8db81132319af14d1f33a3e833666d7 Mon Sep 17 00:00:00 2001
+From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Sun, 30 Nov 2014 15:59:47 +0000
+Subject: [PATCH] Avoid an out of bound acess on malformed sun file
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17137 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin: http://trac.imagemagick.org/changeset/17137
+---
+ coders/sun.c | 36 +++++++++++++++++++++++++-----------
+ 1 file changed, 25 insertions(+), 11 deletions(-)
+
+diff --git a/coders/sun.c b/coders/sun.c
+index 165c17a..4cd4caf 100644
+--- a/coders/sun.c
++++ b/coders/sun.c
+@@ -308,10 +308,18 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
+     sun_info.type=ReadBlobMSBLong(image);
+     sun_info.maptype=ReadBlobMSBLong(image);
+     sun_info.maplength=ReadBlobMSBLong(image);
+-    image->columns=sun_info.width;
+-    image->rows=sun_info.height;
++    if ((sun_info.type != RT_STANDARD) && (sun_info.type != RT_ENCODED) &&
++        (sun_info.type != RT_FORMAT_RGB))
++      ThrowReaderException(CoderError,"ImproperImageHeader");
++    if ((sun_info.maptype == RMT_NONE) && (sun_info.maplength != 0))
++      ThrowReaderException(CoderError,"ImproperImageHeader");
+     if ((sun_info.depth == 0) || (sun_info.depth > 32))
+       ThrowReaderException(CorruptImageError,"ImproperImageHeader");
++    if ((sun_info.maptype != RMT_NONE) && (sun_info.maptype != RMT_EQUAL_RGB) &&
++        (sun_info.maptype != RMT_RAW))
++      ThrowReaderException(CoderError,"ColormapTypeNotSupported");
++    image->columns=sun_info.width;
++    image->rows=sun_info.height;
+     image->depth=sun_info.depth <= 8 ? sun_info.depth :
+       MAGICKCORE_QUANTUM_DEPTH;
+     if (sun_info.depth < 24)
+@@ -356,12 +364,18 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
+         if (sun_colormap == (unsigned char *) NULL)
+           ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+         count=ReadBlob(image,image->colors,sun_colormap);
++        if (count != (ssize_t) image->colors)
++          ThrowReaderException(CorruptImageError,"UnexpectedEndOfFile");
+         for (i=0; i < (ssize_t) image->colors; i++)
+           image->colormap[i].red=ScaleCharToQuantum(sun_colormap[i]);
+         count=ReadBlob(image,image->colors,sun_colormap);
++        if (count != (ssize_t) image->colors)
++          ThrowReaderException(CorruptImageError,"UnexpectedEndOfFile");
+         for (i=0; i < (ssize_t) image->colors; i++)
+           image->colormap[i].green=ScaleCharToQuantum(sun_colormap[i]);
+         count=ReadBlob(image,image->colors,sun_colormap);
++        if (count != (ssize_t) image->colors)
++          ThrowReaderException(CorruptImageError,"UnexpectedEndOfFile");
+         for (i=0; i < (ssize_t) image->colors; i++)
+           image->colormap[i].blue=ScaleCharToQuantum(sun_colormap[i]);
+         sun_colormap=(unsigned char *) RelinquishMagickMemory(sun_colormap);
+@@ -380,11 +394,13 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
+         if (sun_colormap == (unsigned char *) NULL)
+           ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+         count=ReadBlob(image,sun_info.maplength,sun_colormap);
++        if (count != (ssize_t) sun_info.maplength)
++          ThrowReaderException(CorruptImageError,"UnexpectedEndOfFile");
+         sun_colormap=(unsigned char *) RelinquishMagickMemory(sun_colormap);
+         break;
+       }
+       default:
+-        ThrowReaderException(CoderError,"ColormapTypeNotSupported");
++        break;
+     }
+     image->matte=sun_info.depth == 32 ? MagickTrue : MagickFalse;
+     image->columns=sun_info.width;
+@@ -406,7 +422,7 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
+     if (sun_data == (unsigned char *) NULL)
+       ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+     count=(ssize_t) ReadBlob(image,sun_info.length,sun_data);
+-    if ((count == 0) && (sun_info.type != RT_ENCODED))
++    if (count != (ssize_t) sun_info.length)
+       ThrowReaderException(CorruptImageError,"UnableToReadImageData");
+     sun_pixels=sun_data;
+     bytes_per_line=0;
+@@ -432,8 +448,8 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
+           bytes_per_line*sizeof(*sun_pixels));
+         if (sun_pixels == (unsigned char *) NULL)
+           ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+-        (void) DecodeImage(sun_data,sun_info.length,sun_pixels,
+-          bytes_per_line*height);
++        (void) DecodeImage(sun_data,sun_info.length,sun_pixels,bytes_per_line*
++          height);
+         sun_data=(unsigned char *) RelinquishMagickMemory(sun_data);
+       }
+     /*
+@@ -450,15 +466,13 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
+         for (x=0; x < ((ssize_t) image->columns-7); x+=8)
+         {
+           for (bit=7; bit >= 0; bit--)
+-            SetPixelIndex(indexes+x+7-bit,((*p) & (0x01 << bit) ?
+-              0x00 : 0x01));
++            SetPixelIndex(indexes+x+7-bit,((*p) & (0x01 << bit) ? 0x00 : 0x01));
+           p++;
+         }
+         if ((image->columns % 8) != 0)
+           {
+-            for (bit=7; bit >= (ssize_t) (8-(image->columns % 8)); bit--)
+-              SetPixelIndex(indexes+x+7-bit,(*p) & (0x01 << bit) ?
+-                0x00 : 0x01);
++            for (bit=7; bit >= (int) (8-(image->columns % 8)); bit--)
++              SetPixelIndex(indexes+x+7-bit,(*p) & (0x01 << bit) ? 0x00 : 0x01);
+             p++;
+           }
+         if ((((image->columns/8)+(image->columns % 8 ? 1 : 0)) % 2) != 0)
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0021-Avoid-heap-overflow-in-palm-pnm-and-xpm-files.patch imagemagick-6.8.9.9/debian/patches/0021-Avoid-heap-overflow-in-palm-pnm-and-xpm-files.patch
--- imagemagick-6.8.9.9/debian/patches/0021-Avoid-heap-overflow-in-palm-pnm-and-xpm-files.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0021-Avoid-heap-overflow-in-palm-pnm-and-xpm-files.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,263 @@
+From 0a89a1ccca6e7ee059b73f5cc924513383e8a330 Mon Sep 17 00:00:00 2001
+From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Sun, 30 Nov 2014 21:54:05 +0000
+Subject: [PATCH] Avoid heap overflow in palm, pnm and xpm files
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17140 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin: http://trac.imagemagick.org/changeset/17140
+---
+ coders/palm.c | 63 ++++++++++++++++++++++++++++-------------------------------
+ coders/pnm.c  |  2 +-
+ coders/xpm.c  | 51 +++++++++++++++++++++++++----------------------
+ 3 files changed, 59 insertions(+), 57 deletions(-)
+
+diff --git a/coders/palm.c b/coders/palm.c
+index ccdd353..0e58f91 100644
+--- a/coders/palm.c
++++ b/coders/palm.c
+@@ -189,7 +189,7 @@ static MagickBooleanType
+ %    o pixel: a pointer to the PixelPacket to be matched.
+ %
+ */
+-static int FindColor(PixelPacket *pixel)
++static ssize_t FindColor(PixelPacket *pixel)
+ {
+   register ssize_t
+     i;
+@@ -374,26 +374,26 @@ static Image *ReadPALMImage(const ImageInfo *image_info,
+             for (i=0; i < (ssize_t) count; i++)
+             {
+               ReadBlobByte(image);
+-              index=ConstrainColormapIndex(image,255-i);
+-              image->colormap[(int) index].red=
+-                ScaleCharToQuantum((unsigned char) ReadBlobByte(image));
+-              image->colormap[(int) index].green=
+-                ScaleCharToQuantum((unsigned char) ReadBlobByte(image));
+-              image->colormap[(int) index].blue=
+-                ScaleCharToQuantum((unsigned char) ReadBlobByte(image));
++              index=ConstrainColormapIndex(image,(size_t) (255-i));
++              image->colormap[(int) index].red=ScaleCharToQuantum(
++                (unsigned char) ReadBlobByte(image));
++              image->colormap[(int) index].green=ScaleCharToQuantum(
++                (unsigned char) ReadBlobByte(image));
++              image->colormap[(int) index].blue=ScaleCharToQuantum(
++                (unsigned char) ReadBlobByte(image));
+           }
+         }
+       else
+         {
+           for (i=0; i < (ssize_t) (1L << bits_per_pixel); i++)
+           {
+-            index=ConstrainColormapIndex(image,255-i);
+-            image->colormap[(int) index].red=
+-              ScaleCharToQuantum(PalmPalette[i][0]);
+-            image->colormap[(int) index].green=
+-              ScaleCharToQuantum(PalmPalette[i][1]);
+-            image->colormap[(int) index].blue=
+-              ScaleCharToQuantum(PalmPalette[i][2]);
++            index=ConstrainColormapIndex(image,(size_t) (255-i));
++            image->colormap[(int) index].red=ScaleCharToQuantum(
++              PalmPalette[i][0]);
++            image->colormap[(int) index].green=ScaleCharToQuantum(
++              PalmPalette[i][1]);
++            image->colormap[(int) index].blue=ScaleCharToQuantum(
++              PalmPalette[i][2]);
+           }
+         }
+       }
+@@ -406,18 +406,18 @@ static Image *ReadPALMImage(const ImageInfo *image_info,
+         image->storage_class=PseudoClass;
+         image->depth=8;
+       }
+-    one_row=(unsigned char *) AcquireQuantumMemory(bytes_per_row,
+-      sizeof(*one_row));
++    one_row=(unsigned char *) AcquireQuantumMemory(MagickMax(bytes_per_row,
++      2*image->columns),sizeof(*one_row));
+     if (one_row == (unsigned char *) NULL)
+       ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+     lastrow=(unsigned char *) NULL;
+     if (compressionType == PALM_COMPRESSION_SCANLINE) {
+-      lastrow=(unsigned char *) AcquireQuantumMemory(bytes_per_row,
+-        sizeof(*lastrow));
++      lastrow=(unsigned char *) AcquireQuantumMemory(MagickMax(bytes_per_row,
++        2*image->columns),sizeof(*lastrow));
+     if (lastrow == (unsigned char *) NULL)
+       ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+     }
+-    mask=(1l << bits_per_pixel)-1;
++    mask=(size_t) (1U << bits_per_pixel)-1;
+     for (y = 0; y < (ssize_t) image->rows; y++)
+     {
+       if ((flags & PALM_IS_COMPRESSED_FLAG) == 0)
+@@ -453,7 +453,7 @@ static Image *ReadPALMImage(const ImageInfo *image_info,
+               for (i=0; i < (ssize_t) bytes_per_row; i+=8)
+               {
+                 count=(ssize_t) ReadBlobByte(image);
+-                byte=1UL*MagickMin((ssize_t) bytes_per_row-i,8);
++                byte=(size_t) MagickMin((ssize_t) bytes_per_row-i,8);
+                 for (bit=0; bit < byte; bit++)
+                 {
+                   if ((y == 0) || (count & (one << (7 - bit))))
+@@ -478,12 +478,9 @@ static Image *ReadPALMImage(const ImageInfo *image_info,
+           {
+             color16=(*ptr++ << 8);
+             color16|=(*ptr++);
+-            SetPixelRed(q,(QuantumRange*((color16 >> 11) & 0x1f))/
+-              0x1f);
+-            SetPixelGreen(q,(QuantumRange*((color16 >> 5) & 0x3f))/
+-              0x3f);
+-            SetPixelBlue(q,(QuantumRange*((color16 >> 0) & 0x1f))/
+-              0x1f);
++            SetPixelRed(q,(QuantumRange*((color16 >> 11) & 0x1f))/0x1f);
++            SetPixelGreen(q,(QuantumRange*((color16 >> 5) & 0x3f))/0x3f);
++            SetPixelBlue(q,(QuantumRange*((color16 >> 0) & 0x1f))/0x1f);
+             SetPixelOpacity(q,OpaqueOpacity);
+             q++;
+           }
+@@ -660,9 +657,6 @@ ModuleExport void UnregisterPALMImage(void)
+ static MagickBooleanType WritePALMImage(const ImageInfo *image_info,
+   Image *image)
+ {
+-  int
+-    y;
+-
+   ExceptionInfo
+     *exception;
+ 
+@@ -692,6 +686,9 @@ static MagickBooleanType WritePALMImage(const ImageInfo *image_info,
+   register PixelPacket
+     *p;
+ 
++  ssize_t
++    y;
++
+   size_t
+     count,
+     bits_per_pixel,
+@@ -848,7 +845,7 @@ static MagickBooleanType WritePALMImage(const ImageInfo *image_info,
+       sizeof(*one_row));
+     if (one_row == (unsigned char *) NULL)
+       ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
+-    for (y=0; y < (int) image->rows; y++)
++    for (y=0; y < (ssize_t) image->rows; y++)
+     {
+       ptr=one_row;
+       (void) ResetMagickMemory(ptr,0,bytes_per_row);
+@@ -858,7 +855,7 @@ static MagickBooleanType WritePALMImage(const ImageInfo *image_info,
+       indexes=GetAuthenticIndexQueue(image);
+       if (bits_per_pixel == 16)
+         {
+-          for (x=0; x < (int) image->columns; x++)
++          for (x=0; x < (ssize_t) image->columns; x++)
+           {
+             color16=(unsigned short) ((((31*(size_t) GetPixelRed(p))/
+               (size_t) QuantumRange) << 11) |
+@@ -881,7 +878,7 @@ static MagickBooleanType WritePALMImage(const ImageInfo *image_info,
+         {
+           byte=0x00;
+           bit=(unsigned char) (8-bits_per_pixel);
+-          for (x=0; x < (int) image->columns; x++)
++          for (x=0; x < (ssize_t) image->columns; x++)
+           {
+             if (bits_per_pixel >= 8)
+               color=(unsigned char) GetPixelIndex(indexes+x);
+diff --git a/coders/pnm.c b/coders/pnm.c
+index 1d6817e..3fe0dec 100644
+--- a/coders/pnm.c
++++ b/coders/pnm.c
+@@ -155,7 +155,7 @@ static void PNMComment(Image *image)
+     Read comment.
+   */
+   comment=AcquireString(GetImageProperty(image,"comment"));
+-  extent=strlen(comment);
++  extent=MaxTextExtent;
+   p=comment+strlen(comment);
+   for (c='#'; (c != EOF) && (c != (int) '\n'); p++)
+   {
+diff --git a/coders/xpm.c b/coders/xpm.c
+index 6acd4e9..e48eb9c 100644
+--- a/coders/xpm.c
++++ b/coders/xpm.c
+@@ -152,12 +152,16 @@ static int CompareXPMColor(const void *target,const void *source)
+   return(strcmp(p,q));
+ }
+ 
+-static char *CopyXPMColor(char *destination,const char *source,size_t length)
++static size_t CopyXPMColor(char *destination,const char *source,size_t length)
+ {
+-  while (length-- && (*source != '\0'))
+-    *destination++=(*source++);
++  register char
++    *p;
++
++  p=source;
++  while (length-- && (*p != '\0'))
++    *destination++=(*p++);
+   *destination='\0';
+-  return(destination-length);
++  return((size_t) (p-source));
+ }
+ 
+ static char *NextXPMLine(char *p)
+@@ -307,24 +311,26 @@ static Image *ReadXPMImage(const ImageInfo *image_info,ExceptionInfo *exception)
+   */
+   length=MaxTextExtent;
+   xpm_buffer=(char *) AcquireQuantumMemory((size_t) length,sizeof(*xpm_buffer));
++  if (xpm_buffer == (char *) NULL)
++    ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
++  *xpm_buffer='\0';
+   p=xpm_buffer;
+-  if (xpm_buffer != (char *) NULL)
+-    while (ReadBlobString(image,p) != (char *) NULL)
+-    {
+-      if ((*p == '#') && ((p == xpm_buffer) || (*(p-1) == '\n')))
+-        continue;
+-      if ((*p == '}') && (*(p+1) == ';'))
+-        break;
+-      p+=strlen(p);
+-      if ((size_t) (p-xpm_buffer+MaxTextExtent) < length)
+-        continue;
+-      length<<=1;
+-      xpm_buffer=(char *) ResizeQuantumMemory(xpm_buffer,length+MaxTextExtent,
+-        sizeof(*xpm_buffer));
+-      if (xpm_buffer == (char *) NULL)
+-        break;
+-      p=xpm_buffer+strlen(xpm_buffer);
+-    }
++  while (ReadBlobString(image,p) != (char *) NULL)
++  {
++    if ((*p == '#') && ((p == xpm_buffer) || (*(p-1) == '\n')))
++      continue;
++    if ((*p == '}') && (*(p+1) == ';'))
++      break;
++    p+=strlen(p);
++    if ((size_t) (p-xpm_buffer+MaxTextExtent) < length)
++      continue;
++    length<<=1;
++    xpm_buffer=(char *) ResizeQuantumMemory(xpm_buffer,length+MaxTextExtent,
++      sizeof(*xpm_buffer));
++    if (xpm_buffer == (char *) NULL)
++      break;
++    p=xpm_buffer+strlen(xpm_buffer);
++  }
+   if (xpm_buffer == (char *) NULL)
+     ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+   /*
+@@ -438,13 +444,12 @@ static Image *ReadXPMImage(const ImageInfo *image_info,ExceptionInfo *exception)
+         indexes=GetAuthenticIndexQueue(image);
+         for (x=0; x < (ssize_t) image->columns; x++)
+         {
+-          (void) CopyXPMColor(key,p,(size_t) width);
++          p+=CopyXPMColor(key,p,MagickMin(width,MaxTextExtent));
+           j=(ssize_t) GetValueFromSplayTree(xpm_colors,key);
+           if (image->storage_class == PseudoClass)
+             SetPixelIndex(indexes+x,j);
+           *r=image->colormap[j];
+           r++;
+-          p+=width;
+         }
+         if (SyncAuthenticPixels(image,exception) == MagickFalse)
+           break;
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0022-Fix-heap-overflow-in-quantum.c-palm-image-handling-a.patch imagemagick-6.8.9.9/debian/patches/0022-Fix-heap-overflow-in-quantum.c-palm-image-handling-a.patch
--- imagemagick-6.8.9.9/debian/patches/0022-Fix-heap-overflow-in-quantum.c-palm-image-handling-a.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0022-Fix-heap-overflow-in-quantum.c-palm-image-handling-a.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,74 @@
+From 09561d37839dbfa04e017eea14811312985095d8 Mon Sep 17 00:00:00 2001
+From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Mon, 1 Dec 2014 01:13:14 +0000
+Subject: [PATCH] Fix heap overflow in quantum.c, palm image handling and psd
+ image handling.
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17142 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+Origin: http://trac.imagemagick.org/changeset/17142
+---
+ coders/palm.c    |  2 +-
+ coders/psd.c     |  2 +-
+ magick/quantum.c | 13 ++++++++-----
+ 3 files changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/coders/palm.c b/coders/palm.c
+index 0e58f91..864c706 100644
+--- a/coders/palm.c
++++ b/coders/palm.c
+@@ -332,7 +332,7 @@ static Image *ReadPALMImage(const ImageInfo *image_info,
+     bytes_per_row=ReadBlobMSBShort(image);
+     flags=ReadBlobMSBShort(image);
+     bits_per_pixel=(size_t) ReadBlobByte(image);
+-    if (bits_per_pixel > 16)
++    if ((bits_per_pixel == 0) || (bits_per_pixel > 16))
+       ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+     version=(size_t) ReadBlobByte(image);
+     (void) version;
+diff --git a/coders/psd.c b/coders/psd.c
+index 039dae1..985e32d 100644
+--- a/coders/psd.c
++++ b/coders/psd.c
+@@ -1741,7 +1741,7 @@ static Image *ReadPSDImage(const ImageInfo *image_info,
+         (void) LogMagickEvent(CoderEvent,GetMagickModule(),
+           "  reading image resource blocks - %.20g bytes",(double)
+           ((MagickOffsetType) length));
+-      blocks=(unsigned char *) AcquireQuantumMemory((size_t) length,
++      blocks=(unsigned char *) AcquireQuantumMemory((size_t) length+16,
+         sizeof(*blocks));
+       if (blocks == (unsigned char *) NULL)
+         ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+diff --git a/magick/quantum.c b/magick/quantum.c
+index bf44b5c..b94cd45 100644
+--- a/magick/quantum.c
++++ b/magick/quantum.c
+@@ -645,8 +645,9 @@ MagickExport void SetQuantumAlphaType(QuantumInfo *quantum_info,
+ MagickExport MagickBooleanType SetQuantumDepth(const Image *image,
+   QuantumInfo *quantum_info,const size_t depth)
+ {
+-  MagickBooleanType
+-    status;
++  size_t
++    extent,
++    quantum;
+ 
+   /*
+     Allocate the quantum pixel buffer.
+@@ -670,9 +671,11 @@ MagickExport MagickBooleanType SetQuantumDepth(const Image *image,
+     }
+   if (quantum_info->pixels != (unsigned char **) NULL)
+     DestroyQuantumPixels(quantum_info);
+-  status=AcquireQuantumPixels(quantum_info,(6+quantum_info->pad)*image->columns*
+-    ((quantum_info->depth+7)/8));  /* allow for CMYKA + RLE byte + pad */
+-  return(status);
++  quantum=(quantum_info->pad+6)*(quantum_info->depth+7)/8;
++  extent=image->columns*quantum;
++  if (quantum != (extent/image->columns))
++    return(MagickFalse);
++  return(AcquireQuantumPixels(quantum_info,extent));
+ }
+ 
+ /*
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0023-Fix-compile-problem-due-to-previous-patch.patch imagemagick-6.8.9.9/debian/patches/0023-Fix-compile-problem-due-to-previous-patch.patch
--- imagemagick-6.8.9.9/debian/patches/0023-Fix-compile-problem-due-to-previous-patch.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0023-Fix-compile-problem-due-to-previous-patch.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,27 @@
+From 6ac5719fd35183c45e12bfc8decc66f2e74a315a Mon Sep 17 00:00:00 2001
+From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Mon, 1 Dec 2014 11:54:26 +0000
+Subject: [PATCH] Fix compile problem due to previous patch
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17144 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin: http://trac.imagemagick.org/changeset/17144
+---
+ coders/xpm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/coders/xpm.c b/coders/xpm.c
+index e48eb9c..98e95ce 100644
+--- a/coders/xpm.c
++++ b/coders/xpm.c
+@@ -154,7 +154,7 @@ static int CompareXPMColor(const void *target,const void *source)
+ 
+ static size_t CopyXPMColor(char *destination,const char *source,size_t length)
+ {
+-  register char
++  register const char
+     *p;
+ 
+   p=source;
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0024-Do-not-try-to-read-corrupted-sun-image.patch imagemagick-6.8.9.9/debian/patches/0024-Do-not-try-to-read-corrupted-sun-image.patch
--- imagemagick-6.8.9.9/debian/patches/0024-Do-not-try-to-read-corrupted-sun-image.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0024-Do-not-try-to-read-corrupted-sun-image.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,69 @@
+From ca3be0f660bffee571dbaf1761ab6330fd89a112 Mon Sep 17 00:00:00 2001
+From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Mon, 1 Dec 2014 23:10:02 +0000
+Subject: [PATCH] Do not try to read corrupted sun image
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17146 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin: http://trac.imagemagick.org/changeset/17146
+---
+ coders/sun.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/coders/sun.c b/coders/sun.c
+index 4cd4caf..02251b3 100644
+--- a/coders/sun.c
++++ b/coders/sun.c
+@@ -256,6 +256,7 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
+     *p;
+ 
+   size_t
++    bytes_per_line,
+     length;
+ 
+   ssize_t
+@@ -269,9 +270,6 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
+     *sun_data,
+     *sun_pixels;
+ 
+-  unsigned int
+-    bytes_per_line;
+-
+   /*
+     Open image file.
+   */
+@@ -490,11 +488,13 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
+     else
+       if (image->storage_class == PseudoClass)
+         {
++          if (bytes_per_line == 0)
++            bytes_per_line=image->columns;
+           length=image->rows*(image->columns+image->columns % 2);
+           if (((sun_info.type == RT_ENCODED) &&
+                (length > (bytes_per_line*image->rows))) ||
+               ((sun_info.type != RT_ENCODED) && (length > sun_info.length)))
+-            ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
++            ThrowReaderException(CorruptImageError,"UnableToReadImageData");
+           for (y=0; y < (ssize_t) image->rows; y++)
+           {
+             q=QueueAuthenticPixels(image,0,y,image->columns,1,exception);
+@@ -524,12 +524,14 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
+           bytes_per_pixel=3;
+           if (image->matte != MagickFalse)
+             bytes_per_pixel++;
+-          length=image->rows*((bytes_per_line*image->columns)+
+-            image->columns % 2);
++          if (bytes_per_line == 0)
++            bytes_per_line=bytes_per_pixel*image->columns;
++          length=image->rows*((bytes_per_line*image->columns)+image->columns %
++            2);
+           if (((sun_info.type == RT_ENCODED) &&
+                (length > (bytes_per_line*image->rows))) ||
+               ((sun_info.type != RT_ENCODED) && (length > sun_info.length)))
+-            ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
++            ThrowReaderException(CorruptImageError,"UnableToReadImageData");
+           for (y=0; y < (ssize_t) image->rows; y++)
+           {
+             q=QueueAuthenticPixels(image,0,y,image->columns,1,exception);
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0025-Fix-handling-of-corrupted-of-psd-sun-and-xpm-file.patch imagemagick-6.8.9.9/debian/patches/0025-Fix-handling-of-corrupted-of-psd-sun-and-xpm-file.patch
--- imagemagick-6.8.9.9/debian/patches/0025-Fix-handling-of-corrupted-of-psd-sun-and-xpm-file.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0025-Fix-handling-of-corrupted-of-psd-sun-and-xpm-file.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,170 @@
+From 69490f5cffbda612e15a2985699455bb0b45e276 Mon Sep 17 00:00:00 2001
+From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Tue, 2 Dec 2014 02:11:59 +0000
+Subject: [PATCH] Fix handling of corrupted of psd, sun and xpm file
+
+Fix a heap overflow in psd file.
+
+Bail early in xpm file.
+
+Fix error handling in sun file.
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17149 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin: http://trac.imagemagick.org/changeset/17149
+---
+ coders/psd.c        |  4 ++--
+ coders/sun.c        |  4 ++--
+ coders/xpm.c        | 33 +++++++++++++++------------------
+ config/english.xml  |  6 +++---
+ config/francais.xml |  6 +++---
+ 5 files changed, 25 insertions(+), 28 deletions(-)
+
+diff --git a/coders/psd.c b/coders/psd.c
+index 985e32d..d818fe3 100644
+--- a/coders/psd.c
++++ b/coders/psd.c
+@@ -799,7 +799,7 @@ static MagickStatusType ReadPSDChannelRaw(Image *image,const size_t channels,
+        "      layer data is RAW");
+ 
+   row_size=GetPSDRowSize(image);
+-  pixels=(unsigned char *) AcquireQuantumMemory(row_size,sizeof(*pixels));
++  pixels=(unsigned char *) AcquireQuantumMemory(8*row_size,sizeof(*pixels));
+   if (pixels == (unsigned char *) NULL)
+     ThrowBinaryException(ResourceLimitError,"MemoryAllocationFailed",
+       image->filename);
+@@ -868,7 +868,7 @@ static MagickStatusType ReadPSDChannelRLE(Image *image,const PSDInfo *psd_info,
+        "      layer data is RLE compressed");
+ 
+   row_size=GetPSDRowSize(image);
+-  pixels=(unsigned char *) AcquireQuantumMemory(row_size,sizeof(*pixels));
++  pixels=(unsigned char *) AcquireQuantumMemory(8*row_size,sizeof(*pixels));
+   if (pixels == (unsigned char *) NULL)
+     ThrowBinaryException(ResourceLimitError,"MemoryAllocationFailed",
+       image->filename);
+diff --git a/coders/sun.c b/coders/sun.c
+index 02251b3..9ab412b 100644
+--- a/coders/sun.c
++++ b/coders/sun.c
+@@ -308,9 +308,9 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
+     sun_info.maplength=ReadBlobMSBLong(image);
+     if ((sun_info.type != RT_STANDARD) && (sun_info.type != RT_ENCODED) &&
+         (sun_info.type != RT_FORMAT_RGB))
+-      ThrowReaderException(CoderError,"ImproperImageHeader");
++      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+     if ((sun_info.maptype == RMT_NONE) && (sun_info.maplength != 0))
+-      ThrowReaderException(CoderError,"ImproperImageHeader");
++      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+     if ((sun_info.depth == 0) || (sun_info.depth > 32))
+       ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+     if ((sun_info.maptype != RMT_NONE) && (sun_info.maptype != RMT_EQUAL_RGB) &&
+diff --git a/coders/xpm.c b/coders/xpm.c
+index 98e95ce..0faaf2d 100644
+--- a/coders/xpm.c
++++ b/coders/xpm.c
+@@ -166,7 +166,7 @@ static size_t CopyXPMColor(char *destination,const char *source,size_t length)
+ 
+ static char *NextXPMLine(char *p)
+ {
+-  assert(p != (char*)NULL);
++  assert(p != (char *)NULL);
+   p=strchr(p,'\n');
+   if (p != (char *) NULL)
+     p++;
+@@ -223,24 +223,21 @@ static char *ParseXPMColor(char *color,MagickBooleanType search_start)
+       }
+       return((char *) NULL);
+     }
+-  else
++  for (p=color+1; *p != '\0'; p++)
++  {
++    if (*p == '\n')
++      break;
++    if (isspace((int) ((unsigned char) (*(p-1)))) == 0)
++      continue;
++    if (isspace((int) ((unsigned char) (*p))) != 0)
++      continue;
++    for (i=0; i < NumberTargets; i++)
+     {
+-      for (p=color+1; *p != '\0'; p++)
+-      {
+-        if (*p == '\n')
+-          break;
+-        if (isspace((int) ((unsigned char) (*(p-1)))) == 0)
+-          continue;
+-        if (isspace((int) ((unsigned char) (*p))) != 0)
+-          continue;
+-        for (i=0; i < NumberTargets; i++)
+-        {
+-          if (*p == *targets[i] && *(p+1) == *(targets[i]+1))
+-            return(p);
+-        }
+-      }
+-      return(p);
++      if ((*p == *targets[i]) && (*(p+1) == *(targets[i]+1)))
++        return(p);
+     }
++  }
++  return(p);
+ }
+ 
+ static Image *ReadXPMImage(const ImageInfo *image_info,ExceptionInfo *exception)
+@@ -381,7 +378,7 @@ static Image *ReadXPMImage(const ImageInfo *image_info,ExceptionInfo *exception)
+   */
+   image->depth=1;
+   next=NextXPMLine(xpm_buffer);
+-  for (j=0; (j < (ssize_t) image->colors) && (next != (char*) NULL); j++)
++  for (j=0; (j < (ssize_t) image->colors) && (next != (char *) NULL); j++)
+   {
+     MagickPixelPacket
+       pixel;
+diff --git a/config/english.xml b/config/english.xml
+index 6c864f2..9ef56c2 100644
+--- a/config/english.xml
++++ b/config/english.xml
+@@ -122,6 +122,9 @@
+         <message name="ImageIsNotTiled">
+           image is not tiled
+         </message>
++        <message name="ImproperImageHeader">
++          improper image header
++        </message>
+         <message name="IrregularChannelGeometryNotSupported">
+           irregular channel geometry not supported
+         </message>
+@@ -255,9 +258,6 @@
+           <message name="ImageTypeNotSupported">
+             image type not supported
+           </message>
+-          <message name="ImproperImageHeader">
+-            improper image header
+-          </message>
+           <message name="InsufficientImageDataInFile">
+             insufficient image data in file
+           </message>
+diff --git a/config/francais.xml b/config/francais.xml
+index b421ecb..1a270f7 100644
+--- a/config/francais.xml
++++ b/config/francais.xml
+@@ -116,6 +116,9 @@
+         <message name="ImageDoesNotHaveAAlphaChannel">
+           l'image n'a pas de canal de transparence
+         </message>
++        <message name="ImproperImageHeader">
++          En-tête d'image incorrect
++        </message>
+         <message name="ImageIsNotTiled">
+           l'image n'a pas tiled
+         </message>
+@@ -255,9 +258,6 @@
+           <message name="ImageTypeNotSupported">
+             type d'image non supporté
+           </message>
+-          <message name="ImproperImageHeader">
+-            En-tête d'image incorrect
+-          </message>
+           <message name="InsufficientImageDataInFile">
+             Pas assez de données d'image dans le fichier
+           </message>
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0026-Fix-corrupted-too-many-colors-psd-file.patch imagemagick-6.8.9.9/debian/patches/0026-Fix-corrupted-too-many-colors-psd-file.patch
--- imagemagick-6.8.9.9/debian/patches/0026-Fix-corrupted-too-many-colors-psd-file.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0026-Fix-corrupted-too-many-colors-psd-file.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,36 @@
+From 460547be494cc8c039b99b65e64a1fa2eb08ab5c Mon Sep 17 00:00:00 2001
+From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Tue, 2 Dec 2014 23:44:17 +0000
+Subject: [PATCH] Fix corrupted (too many colors) psd file
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17151 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin: http://trac.imagemagick.org/changeset/17151
+---
+ coders/psd.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/coders/psd.c b/coders/psd.c
+index d818fe3..2aff362 100644
+--- a/coders/psd.c
++++ b/coders/psd.c
+@@ -1710,10 +1710,16 @@ static Image *ReadPSDImage(const ImageInfo *image_info,
+         }
+       else
+         {
++          size_t
++            number_colors;
++
+           /*
+             Read PSD raster colormap.
+           */
+-          if (AcquireImageColormap(image,(size_t) (length/3)) == MagickFalse)
++          number_colors=length/3;
++          if (number_colors > 65536)
++            ThrowReaderException(CorruptImageError,"ImproperImageHeader");
++          if (AcquireImageColormap(image,number_colors) == MagickFalse)
+             ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+           for (i=0; i < (ssize_t) image->colors; i++)
+             image->colormap[i].red=ScaleCharToQuantum((unsigned char)
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0027-Fix-out-of-bound-access-in-sun-image-handling.patch imagemagick-6.8.9.9/debian/patches/0027-Fix-out-of-bound-access-in-sun-image-handling.patch
--- imagemagick-6.8.9.9/debian/patches/0027-Fix-out-of-bound-access-in-sun-image-handling.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0027-Fix-out-of-bound-access-in-sun-image-handling.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,29 @@
+From 52f6d868f1c37bb5cc3a9226efc0e95acc2ab2a3 Mon Sep 17 00:00:00 2001
+From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Thu, 4 Dec 2014 00:19:57 +0000
+Subject: [PATCH] Fix out of bound access in sun image handling
+
+It the merge of rev 17153 and rev 17155
+
+Origin: http://trac.imagemagick.org/changeset/17153 and  http://trac.imagemagick.org/changeset/17155
+---
+ coders/sun.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/coders/sun.c b/coders/sun.c
+index 9ab412b..1d974db 100644
+--- a/coders/sun.c
++++ b/coders/sun.c
+@@ -526,8 +526,7 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
+             bytes_per_pixel++;
+           if (bytes_per_line == 0)
+             bytes_per_line=bytes_per_pixel*image->columns;
+-          length=image->rows*((bytes_per_line*image->columns)+image->columns %
+-            2);
++          length=image->rows*(bytes_per_line+image->columns % 2);
+           if (((sun_info.type == RT_ENCODED) &&
+                (length > (bytes_per_line*image->rows))) ||
+               ((sun_info.type != RT_ENCODED) && (length > sun_info.length)))
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0028-Fix-ImageMagick-crashes-while-read-EXIF-from-TIFF.patch imagemagick-6.8.9.9/debian/patches/0028-Fix-ImageMagick-crashes-while-read-EXIF-from-TIFF.patch
--- imagemagick-6.8.9.9/debian/patches/0028-Fix-ImageMagick-crashes-while-read-EXIF-from-TIFF.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0028-Fix-ImageMagick-crashes-while-read-EXIF-from-TIFF.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,62 @@
+From 89ba2d70d6f1d2fe7ecfb5ec87a3ee5dc35cbe71 Mon Sep 17 00:00:00 2001
+From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Fri, 5 Dec 2014 11:12:58 +0000
+Subject: [PATCH] Fix ImageMagick crashes while read EXIF from TIFF
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17157 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin:  http://trac.imagemagick.org/changeset/17157
+---
+ coders/tiff.c | 28 ++++++++++++++++------------
+ 1 file changed, 16 insertions(+), 12 deletions(-)
+
+diff --git a/coders/tiff.c b/coders/tiff.c
+index 67b57b3..1fe12fe 100644
+--- a/coders/tiff.c
++++ b/coders/tiff.c
+@@ -713,7 +713,16 @@ static void TIFFGetEXIFProperties(TIFF *tiff,Image *image)
+       }
+       case TIFF_SHORT:
+       {
+-        if (exif_info[i].variable_length != 0)
++        if (exif_info[i].variable_length == 0)
++          {
++            uint16
++              shorty;
++
++            shorty=0;
++            if (TIFFGetField(tiff,exif_info[i].tag,&shorty,&sans,&sans) == 1)
++              (void) FormatLocaleString(value,MaxTextExtent,"%d",shorty);
++          }
++        else
+           {
+             int
+               tiff_status;
+@@ -721,19 +730,14 @@ static void TIFFGetEXIFProperties(TIFF *tiff,Image *image)
+             uint16
+               *shorty;
+ 
+-            tiff_status=TIFFGetField(tiff,exif_info[i].tag,&sans,&shorty,&sans,
+-              &sans);
+-            if (tiff_status == 1)
+-              (void) FormatLocaleString(value,MaxTextExtent,"%d",shorty[0]);
+-          }
+-        else
+-          {
+             uint16
+-              shorty;
++              shorty_num;
+ 
+-            shorty=0;
+-            if (TIFFGetField(tiff,exif_info[i].tag,&shorty,&sans,&sans) == 1)
+-              (void) FormatLocaleString(value,MaxTextExtent,"%d",shorty);
++            tiff_status=TIFFGetField(tiff,exif_info[i].tag,&shorty_num,&shorty,
++              &sans,&sans);
++            if (tiff_status == 1)
++              (void) FormatLocaleString(value,MaxTextExtent,"%d",
++                shorty_num != 0 ? shorty[0] : 0);
+           }
+         break;
+       }
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0029-Fix-handling-of-corrupted-sun-and-wpg-file.patch imagemagick-6.8.9.9/debian/patches/0029-Fix-handling-of-corrupted-sun-and-wpg-file.patch
--- imagemagick-6.8.9.9/debian/patches/0029-Fix-handling-of-corrupted-sun-and-wpg-file.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0029-Fix-handling-of-corrupted-sun-and-wpg-file.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,91 @@
+From b68b78e2625122d9f6b6d88ba4df7e85b47b556f Mon Sep 17 00:00:00 2001
+From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Sun, 7 Dec 2014 12:52:08 +0000
+Subject: [PATCH] Fix handling of corrupted sun and wpg file
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17165 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin:  http://trac.imagemagick.org/changeset/17165
+---
+ coders/sun.c        | 2 ++
+ coders/wpg.c        | 2 +-
+ config/english.xml  | 6 +++---
+ config/francais.xml | 6 +++---
+ 4 files changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/coders/sun.c b/coders/sun.c
+index 1d974db..07234b7 100644
+--- a/coders/sun.c
++++ b/coders/sun.c
+@@ -306,6 +306,8 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
+     sun_info.type=ReadBlobMSBLong(image);
+     sun_info.maptype=ReadBlobMSBLong(image);
+     sun_info.maplength=ReadBlobMSBLong(image);
++    if ((sun_info.height != 0) && (sun_info.width != extent/sun_info.height))
++      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+     if ((sun_info.type != RT_STANDARD) && (sun_info.type != RT_ENCODED) &&
+         (sun_info.type != RT_FORMAT_RGB))
+       ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+diff --git a/coders/wpg.c b/coders/wpg.c
+index f051e03..24430c7 100644
+--- a/coders/wpg.c
++++ b/coders/wpg.c
+@@ -474,7 +474,7 @@ static int UnpackWPGRaster(Image *image,int bpp)
+ 
+   ldblk=(ssize_t) ((bpp*image->columns+7)/8);
+   BImgBuff=(unsigned char *) AcquireQuantumMemory((size_t) ldblk,
+-    sizeof(*BImgBuff));
++    4*sizeof(*BImgBuff));
+   if(BImgBuff==NULL) return(-2);
+ 
+   while(y<(ssize_t) image->rows)
+diff --git a/config/english.xml b/config/english.xml
+index 9ef56c2..6c864f2 100644
+--- a/config/english.xml
++++ b/config/english.xml
+@@ -122,9 +122,6 @@
+         <message name="ImageIsNotTiled">
+           image is not tiled
+         </message>
+-        <message name="ImproperImageHeader">
+-          improper image header
+-        </message>
+         <message name="IrregularChannelGeometryNotSupported">
+           irregular channel geometry not supported
+         </message>
+@@ -258,6 +255,9 @@
+           <message name="ImageTypeNotSupported">
+             image type not supported
+           </message>
++          <message name="ImproperImageHeader">
++            improper image header
++          </message>
+           <message name="InsufficientImageDataInFile">
+             insufficient image data in file
+           </message>
+diff --git a/config/francais.xml b/config/francais.xml
+index 1a270f7..b421ecb 100644
+--- a/config/francais.xml
++++ b/config/francais.xml
+@@ -116,9 +116,6 @@
+         <message name="ImageDoesNotHaveAAlphaChannel">
+           l'image n'a pas de canal de transparence
+         </message>
+-        <message name="ImproperImageHeader">
+-          En-tête d'image incorrect
+-        </message>
+         <message name="ImageIsNotTiled">
+           l'image n'a pas tiled
+         </message>
+@@ -258,6 +255,9 @@
+           <message name="ImageTypeNotSupported">
+             type d'image non supporté
+           </message>
++          <message name="ImproperImageHeader">
++            En-tête d'image incorrect
++          </message>
+           <message name="InsufficientImageDataInFile">
+             Pas assez de données d'image dans le fichier
+           </message>
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0030-Fix-heap-overflow-in-pcx-file-psd-pict-and-wpf-files.patch imagemagick-6.8.9.9/debian/patches/0030-Fix-heap-overflow-in-pcx-file-psd-pict-and-wpf-files.patch
--- imagemagick-6.8.9.9/debian/patches/0030-Fix-heap-overflow-in-pcx-file-psd-pict-and-wpf-files.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0030-Fix-heap-overflow-in-pcx-file-psd-pict-and-wpf-files.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,132 @@
+From c264f9c466f22736c9fd9f8a7051f6b71ecb2c0d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bastien=20ROUCARI=C3=88S?= <roucaries.bastien@gmail.com>
+Date: Tue, 23 Dec 2014 14:53:08 +0100
+Subject: [PATCH] Fix heap overflow in pcx file, psd, pict and wpf files and
+ DOS in xpm file
+
+The rest of the upstream patch is only whitespace change. Do not commit it.
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17166 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin:  http://trac.imagemagick.org/changeset/17166
+---
+ coders/pcx.c  |  2 +-
+ coders/pict.c |  3 ++-
+ coders/psd.c  | 10 ++++++----
+ coders/wpg.c  |  2 +-
+ coders/xpm.c  |  4 +++-
+ 5 files changed, 13 insertions(+), 8 deletions(-)
+
+diff --git a/coders/pcx.c b/coders/pcx.c
+index 2257c71..c899bf0 100644
+--- a/coders/pcx.c
++++ b/coders/pcx.c
+@@ -404,7 +404,7 @@ static Image *ReadPCXImage(const ImageInfo *image_info,ExceptionInfo *exception)
+       ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+     scanline=(unsigned char *) AcquireQuantumMemory(MagickMax(image->columns,
+       pcx_info.bytes_per_line),MagickMax(8,pcx_info.planes)*sizeof(*scanline));
+-    pixel_info=AcquireVirtualMemory(pcx_packets,sizeof(*pixels));
++    pixel_info=AcquireVirtualMemory(pcx_packets,2*sizeof(*pixels));
+     if ((scanline == (unsigned char *) NULL) ||
+         (pixel_info == (MemoryInfo *) NULL))
+       {
+diff --git a/coders/pict.c b/coders/pict.c
+index 35fb56e..f6165a4 100644
+--- a/coders/pict.c
++++ b/coders/pict.c
+@@ -473,7 +473,8 @@ static unsigned char *DecodeImage(Image *blob,Image *image,
+     return((unsigned char *) NULL);
+   *extent=row_bytes*image->rows*sizeof(*pixels);
+   (void) ResetMagickMemory(pixels,0,*extent);
+-  scanline=(unsigned char *) AcquireQuantumMemory(row_bytes,sizeof(*scanline));
++  scanline=(unsigned char *) AcquireQuantumMemory(row_bytes,2*
++    sizeof(*scanline));
+   if (scanline == (unsigned char *) NULL)
+     return((unsigned char *) NULL);
+   if (bytes_per_line < 8)
+diff --git a/coders/psd.c b/coders/psd.c
+index 2aff362..f4dec69 100644
+--- a/coders/psd.c
++++ b/coders/psd.c
+@@ -50,6 +50,7 @@
+ #include "magick/cache.h"
+ #include "magick/channel.h"
+ #include "magick/colormap.h"
++#include "magick/colormap-private.h"
+ #include "magick/colorspace.h"
+ #include "magick/colorspace-private.h"
+ #include "magick/constitute.h"
+@@ -711,7 +712,7 @@ static MagickStatusType ReadPSDChannelPixels(Image *image,const size_t channels,
+             else
+               SetPixelIndex(indexes+x,ScaleQuantumToShort(pixel))
+             SetPixelRGBO(q,image->colormap+(ssize_t)
+-              GetPixelIndex(indexes+x));
++              ConstrainColormapIndex(image,GetPixelIndex(indexes+x)));
+             if (image->depth == 1)
+               {
+                 ssize_t
+@@ -799,7 +800,7 @@ static MagickStatusType ReadPSDChannelRaw(Image *image,const size_t channels,
+        "      layer data is RAW");
+ 
+   row_size=GetPSDRowSize(image);
+-  pixels=(unsigned char *) AcquireQuantumMemory(8*row_size,sizeof(*pixels));
++  pixels=(unsigned char *) AcquireQuantumMemory(row_size,8*sizeof(*pixels));
+   if (pixels == (unsigned char *) NULL)
+     ThrowBinaryException(ResourceLimitError,"MemoryAllocationFailed",
+       image->filename);
+@@ -868,7 +869,7 @@ static MagickStatusType ReadPSDChannelRLE(Image *image,const PSDInfo *psd_info,
+        "      layer data is RLE compressed");
+ 
+   row_size=GetPSDRowSize(image);
+-  pixels=(unsigned char *) AcquireQuantumMemory(8*row_size,sizeof(*pixels));
++  pixels=(unsigned char *) AcquireQuantumMemory(row_size,8*sizeof(*pixels));
+   if (pixels == (unsigned char *) NULL)
+     ThrowBinaryException(ResourceLimitError,"MemoryAllocationFailed",
+       image->filename);
+@@ -884,7 +885,8 @@ static MagickStatusType ReadPSDChannelRLE(Image *image,const PSDInfo *psd_info,
+       ThrowBinaryException(CoderError,"InvalidLength",
+         image->filename);
+     }
+-  compact_pixels=(unsigned char *) AcquireQuantumMemory(length,sizeof(*pixels));
++  compact_pixels=(unsigned char *) AcquireQuantumMemory(length,8*
++    sizeof(*pixels));
+   if (compact_pixels == (unsigned char *) NULL)
+     {
+       pixels=(unsigned char *) RelinquishMagickMemory(pixels);
+diff --git a/coders/wpg.c b/coders/wpg.c
+index 24430c7..edcf4c2 100644
+--- a/coders/wpg.c
++++ b/coders/wpg.c
+@@ -474,7 +474,7 @@ static int UnpackWPGRaster(Image *image,int bpp)
+ 
+   ldblk=(ssize_t) ((bpp*image->columns+7)/8);
+   BImgBuff=(unsigned char *) AcquireQuantumMemory((size_t) ldblk,
+-    4*sizeof(*BImgBuff));
++    8*sizeof(*BImgBuff));
+   if(BImgBuff==NULL) return(-2);
+ 
+   while(y<(ssize_t) image->rows)
+diff --git a/coders/xpm.c b/coders/xpm.c
+index 0faaf2d..34d3511 100644
+--- a/coders/xpm.c
++++ b/coders/xpm.c
+@@ -166,7 +166,7 @@ static size_t CopyXPMColor(char *destination,const char *source,size_t length)
+ 
+ static char *NextXPMLine(char *p)
+ {
+-  assert(p != (char *)NULL);
++  assert(p != (char *) NULL);
+   p=strchr(p,'\n');
+   if (p != (char *) NULL)
+     p++;
+@@ -396,6 +396,8 @@ static Image *ReadXPMImage(const ImageInfo *image_info,ExceptionInfo *exception)
+       {
+         while ((isspace((int) ((unsigned char) *q)) == 0) && (*q != '\0'))
+           q++;
++        if ((next-q) < 0)
++          break;
+         if (next != (char *) NULL)
+           (void) CopyXPMColor(target,q,MagickMin((size_t) (next-q),
+             MaxTextExtent));
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0031-Fix-compile-error-in-previous-fix-of-sun-file.patch imagemagick-6.8.9.9/debian/patches/0031-Fix-compile-error-in-previous-fix-of-sun-file.patch
--- imagemagick-6.8.9.9/debian/patches/0031-Fix-compile-error-in-previous-fix-of-sun-file.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0031-Fix-compile-error-in-previous-fix-of-sun-file.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,34 @@
+From 2d74929c4e84524a6d625bb9aba3007b5cef9151 Mon Sep 17 00:00:00 2001
+From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Sun, 7 Dec 2014 18:17:22 +0000
+Subject: [PATCH] Fix compile error in previous fix of sun file
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17171 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin:  http://trac.imagemagick.org/changeset/17171
+---
+ coders/sun.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/coders/sun.c b/coders/sun.c
+index 07234b7..91445ec 100644
+--- a/coders/sun.c
++++ b/coders/sun.c
+@@ -257,6 +257,7 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
+ 
+   size_t
+     bytes_per_line,
++    extent,
+     length;
+ 
+   ssize_t
+@@ -306,6 +307,7 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
+     sun_info.type=ReadBlobMSBLong(image);
+     sun_info.maptype=ReadBlobMSBLong(image);
+     sun_info.maplength=ReadBlobMSBLong(image);
++    extent=sun_info.height*sun_info.width;
+     if ((sun_info.height != 0) && (sun_info.width != extent/sun_info.height))
+       ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+     if ((sun_info.type != RT_STANDARD) && (sun_info.type != RT_ENCODED) &&
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0032-Additional-PNM-sanity-checks.patch imagemagick-6.8.9.9/debian/patches/0032-Additional-PNM-sanity-checks.patch
--- imagemagick-6.8.9.9/debian/patches/0032-Additional-PNM-sanity-checks.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0032-Additional-PNM-sanity-checks.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,54 @@
+From 7a7119c6fe19324ee17b8f756dae60c16e470ab2 Mon Sep 17 00:00:00 2001
+From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Sat, 13 Dec 2014 22:14:04 +0000
+Subject: [PATCH] Additional PNM sanity checks
+
+bug: http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=26682
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17200 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin:  http://trac.imagemagick.org/changeset/17200 and http://trac.imagemagick.org/changeset/17202 and http://trac.imagemagick.org/changeset/17237
+---
+ coders/pnm.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/coders/pnm.c b/coders/pnm.c
+index 3fe0dec..505a37f 100644
+--- a/coders/pnm.c
++++ b/coders/pnm.c
+@@ -181,12 +181,12 @@ static void PNMComment(Image *image)
+   comment=DestroyString(comment);
+ }
+ 
+-static size_t PNMInteger(Image *image,const unsigned int base)
++static unsigned int PNMInteger(Image *image,const unsigned int base)
+ {
+   int
+     c;
+ 
+-  size_t
++  unsigned int
+     value;
+ 
+   /*
+@@ -201,14 +201,18 @@ static size_t PNMInteger(Image *image,const unsigned int base)
+       PNMComment(image);
+   } while (isdigit(c) == MagickFalse);
+   if (base == 2)
+-    return((size_t) (c-(int) '0'));
++    return((unsigned int) (c-(int) '0'));
+   /*
+     Evaluate number.
+   */
+   value=0;
+   do
+   {
++    if (value > (unsigned int) (INT_MAX/10))
++      break;
+     value*=10;
++    if (value > (INT_MAX-c))
++      break;
+     value+=c-(int) '0';
+     c=ReadBlobByte(image);
+     if (c == EOF)
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0033-Robustify-xmp-and-pnm-reader.patch imagemagick-6.8.9.9/debian/patches/0033-Robustify-xmp-and-pnm-reader.patch
--- imagemagick-6.8.9.9/debian/patches/0033-Robustify-xmp-and-pnm-reader.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0033-Robustify-xmp-and-pnm-reader.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,173 @@
+From 7f7b0f8e5eb8f4180e31ed93c65f0e1dd20050cb Mon Sep 17 00:00:00 2001
+From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Mon, 15 Dec 2014 01:32:48 +0000
+Subject: [PATCH] Robustify xmp and pnm reader
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17240 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin: http://trac.imagemagick.org/changeset/17245 and http://trac.imagemagick.org/changeset/17240 and  http://trac.imagemagick.org/changeset/17248
+---
+ coders/pnm.c |  8 +++----
+ coders/xbm.c | 73 +++++++++++++++++++++++++++++++-----------------------------
+ 2 files changed, 41 insertions(+), 40 deletions(-)
+
+diff --git a/coders/pnm.c b/coders/pnm.c
+index 505a37f..64da096 100644
+--- a/coders/pnm.c
++++ b/coders/pnm.c
+@@ -199,7 +199,7 @@ static unsigned int PNMInteger(Image *image,const unsigned int base)
+       return(0);
+     if (c == (int) '#')
+       PNMComment(image);
+-  } while (isdigit(c) == MagickFalse);
++  } while (isdigit(c) == 0);
+   if (base == 2)
+     return((unsigned int) (c-(int) '0'));
+   /*
+@@ -211,13 +211,11 @@ static unsigned int PNMInteger(Image *image,const unsigned int base)
+     if (value > (unsigned int) (INT_MAX/10))
+       break;
+     value*=10;
+-    if (value > (INT_MAX-c))
++    if (value > (INT_MAX-(c-(int) '0')))
+       break;
+     value+=c-(int) '0';
+     c=ReadBlobByte(image);
+-    if (c == EOF)
+-      return(value);
+-  } while (isdigit(c) != MagickFalse);
++  } while (isdigit(c) != 0);
+   return(value);
+ }
+ 
+diff --git a/coders/xbm.c b/coders/xbm.c
+index ad5ab6a..d8045fc 100644
+--- a/coders/xbm.c
++++ b/coders/xbm.c
+@@ -131,33 +131,38 @@ static MagickBooleanType IsXBM(const unsigned char *magick,const size_t length)
+ %
+ */
+ 
+-static int XBMInteger(Image *image,short int *hex_digits)
+-{
++static unsigned int XBMInteger(Image *image,short int *hex_digits)
++{ 
+   int
+-    c,
+-    flag,
++    c;
++  
++  unsigned int
+     value;
+-
+-  value=0;
+-  flag=0;
+-  for ( ; ; )
+-  {
++  
++  /*
++    Skip any leading whitespace.
++  */
++  do
++  { 
+     c=ReadBlobByte(image);
+     if (c == EOF)
+-      {
+-        value=(-1);
+-        break;
+-      }
++      return(0);
++  } while (hex_digits[c] < 0);
++  /*
++    Evaluate number.
++  */
++  value=0;
++  do
++  { 
++    if (value > (unsigned int) (INT_MAX/10))
++      break;
++    value*=16;
+     c&=0xff;
+-    if (isxdigit(c) != MagickFalse)
+-      {
+-        value=(int) ((size_t) value << 4)+hex_digits[c];
+-        flag++;
+-        continue;
+-      }
+-    if ((hex_digits[c]) < 0 && (flag != 0))
++    if (value > (INT_MAX-hex_digits[c]))
+       break;
+-  }
++    value+=hex_digits[c];
++    c=ReadBlobByte(image);
++  } while (hex_digits[c] >= 0);
+   return(value);
+ }
+ 
+@@ -189,23 +194,21 @@ static Image *ReadXBMImage(const ImageInfo *image_info,ExceptionInfo *exception)
+   short int
+     hex_digits[256];
+ 
+-  size_t
+-    bit,
+-    byte,
+-    bytes_per_line,
+-    length,
+-    padding,
+-    value,
+-    version;
+-
+   ssize_t
+     y;
+ 
+   unsigned char
+     *data;
+ 
+-  unsigned long
++  unsigned int
++    bit,
++    byte,
++    bytes_per_line,
+     height,
++    length,
++    padding,
++    value,
++    version,
+     width;
+ 
+   /*
+@@ -231,12 +234,12 @@ static Image *ReadXBMImage(const ImageInfo *image_info,ExceptionInfo *exception)
+   width=0;
+   height=0;
+   while (ReadBlobString(image,buffer) != (char *) NULL)
+-    if (sscanf(buffer,"#define %s %lu",name,&width) == 2)
++    if (sscanf(buffer,"#define %s %u",name,&width) == 2)
+       if ((strlen(name) >= 6) &&
+           (LocaleCompare(name+strlen(name)-6,"_width") == 0))
+         break;
+   while (ReadBlobString(image,buffer) != (char *) NULL)
+-    if (sscanf(buffer,"#define %s %lu",name,&height) == 2)
++    if (sscanf(buffer,"#define %s %u",name,&height) == 2)
+       if ((strlen(name) >= 7) &&
+           (LocaleCompare(name+strlen(name)-7,"_height") == 0))
+         break;
+@@ -339,7 +342,7 @@ static Image *ReadXBMImage(const ImageInfo *image_info,ExceptionInfo *exception)
+   if (version == 10)
+     for (i=0; i < (ssize_t) (bytes_per_line*image->rows); (i+=2))
+     {
+-      value=(size_t) XBMInteger(image,hex_digits);
++      value=XBMInteger(image,hex_digits);
+       *p++=(unsigned char) value;
+       if ((padding == 0) || (((i+2) % bytes_per_line) != 0))
+         *p++=(unsigned char) (value >> 8);
+@@ -347,7 +350,7 @@ static Image *ReadXBMImage(const ImageInfo *image_info,ExceptionInfo *exception)
+   else
+     for (i=0; i < (ssize_t) (bytes_per_line*image->rows); i++)
+     {
+-      value=(size_t) XBMInteger(image,hex_digits);
++      value=XBMInteger(image,hex_digits);
+       *p++=(unsigned char) value;
+     }
+   /*
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0034-Detect-allocation-error-earlier.patch imagemagick-6.8.9.9/debian/patches/0034-Detect-allocation-error-earlier.patch
--- imagemagick-6.8.9.9/debian/patches/0034-Detect-allocation-error-earlier.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0034-Detect-allocation-error-earlier.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,30 @@
+From 18d9fc3af3a8d10a03c8f0b3caadc1bfa77f86dc Mon Sep 17 00:00:00 2001
+From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Mon, 15 Dec 2014 02:50:44 +0000
+Subject: [PATCH] Detect allocation error earlier
+
+Avoid a segv due to NULL pointer dereference
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17243 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin:  http://trac.imagemagick.org/changeset/17243
+---
+ magick/cache.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/magick/cache.c b/magick/cache.c
+index 20afea3..129b769 100644
+--- a/magick/cache.c
++++ b/magick/cache.c
+@@ -3559,7 +3559,8 @@ static MagickBooleanType OpenPixelCache(Image *image,const MapMode mode,
+     packet_size+=sizeof(IndexPacket);
+   length=number_pixels*packet_size;
+   columns=(size_t) (length/cache_info->rows/packet_size);
+-  if (cache_info->columns != columns)
++  if ((cache_info->columns != columns) || ((ssize_t) cache_info->columns < 0) ||
++      ((ssize_t) cache_info->rows < 0))
+     ThrowBinaryException(ResourceLimitError,"PixelCacheAllocationFailed",
+       image->filename);
+   cache_info->length=length;
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0035-Avoid-a-crash-in-coders-rle.c.patch imagemagick-6.8.9.9/debian/patches/0035-Avoid-a-crash-in-coders-rle.c.patch
--- imagemagick-6.8.9.9/debian/patches/0035-Avoid-a-crash-in-coders-rle.c.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0035-Avoid-a-crash-in-coders-rle.c.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,81 @@
+From 74b6cb6000b678e3e7bac553177052cb15b02cb6 Mon Sep 17 00:00:00 2001
+From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Mon, 15 Dec 2014 11:30:43 +0000
+Subject: [PATCH] Avoid a crash in coders/rle.c
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17255 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin:  http://trac.imagemagick.org/changeset/17255
+---
+ coders/rle.c | 24 ++++++++++++++++++------
+ 1 file changed, 18 insertions(+), 6 deletions(-)
+
+diff --git a/coders/rle.c b/coders/rle.c
+index b690826..fcc718b 100644
+--- a/coders/rle.c
++++ b/coders/rle.c
+@@ -40,11 +40,11 @@
+   Include declarations.
+ */
+ #include "magick/studio.h"
+-#include "magick/property.h"
+ #include "magick/blob.h"
+ #include "magick/blob-private.h"
+ #include "magick/cache.h"
+ #include "magick/colormap.h"
++#include "magick/colormap-private.h"
+ #include "magick/exception.h"
+ #include "magick/exception-private.h"
+ #include "magick/image.h"
+@@ -57,6 +57,7 @@
+ #include "magick/pixel-accessor.h"
+ #include "magick/quantum-private.h"
+ #include "magick/pixel.h"
++#include "magick/property.h"
+ #include "magick/static.h"
+ #include "magick/string_.h"
+ #include "magick/module.h"
+@@ -123,6 +124,14 @@ static MagickBooleanType IsRLE(const unsigned char *magick,const size_t length)
+ %
+ %
+ */
++
++static inline size_t MagickMax(const size_t x,const size_t y)
++{
++  if (x > y)
++    return(x);
++  return(y);
++}
++
+ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
+ {
+ #define SkipLinesOp  0x01
+@@ -301,8 +310,8 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
+     number_pixels=(MagickSizeType) image->columns*image->rows;
+     if ((number_pixels*number_planes) != (size_t) (number_pixels*number_planes))
+       ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+-    pixel_info=AcquireVirtualMemory(image->columns,image->rows*number_planes*
+-      sizeof(*pixels));
++    pixel_info=AcquireVirtualMemory(image->columns,image->rows*
++      MagickMax(number_planes,4)*sizeof(*pixels));
+     if (pixel_info == (MemoryInfo *) NULL)
+       ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+     pixels=(unsigned char *) GetVirtualMemoryBlob(pixel_info);
+@@ -537,9 +546,12 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
+                 break;
+               for (x=0; x < (ssize_t) image->columns; x++)
+               {
+-                SetPixelRed(q,image->colormap[*p++].red);
+-                SetPixelGreen(q,image->colormap[*p++].green);
+-                SetPixelBlue(q,image->colormap[*p++].blue);
++                SetPixelRed(q,image->colormap[(ssize_t)
++                  ConstrainColormapIndex(image,*p++)].red);
++                SetPixelGreen(q,image->colormap[(ssize_t)
++                  ConstrainColormapIndex(image,*p++)].green);
++                SetPixelBlue(q,image->colormap[(ssize_t)
++                  ConstrainColormapIndex(image,*p++)].blue);
+                 SetPixelAlpha(q,ScaleCharToQuantum(*p++));
+                 q++;
+               }
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0036-Avoid-an-overflow-in-ConstrainColormapIndex.patch imagemagick-6.8.9.9/debian/patches/0036-Avoid-an-overflow-in-ConstrainColormapIndex.patch
--- imagemagick-6.8.9.9/debian/patches/0036-Avoid-an-overflow-in-ConstrainColormapIndex.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0036-Avoid-an-overflow-in-ConstrainColormapIndex.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,28 @@
+From 5482197c8fd23e8545ed53c6088523c58702fcb3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bastien=20ROUCARI=C3=88S?= <roucaries.bastien@gmail.com>
+Date: Tue, 23 Dec 2014 15:39:55 +0100
+Subject: [PATCH] Avoid an overflow in ConstrainColormapIndex
+
+ConstrainColormapIndex is used like array[ConstrainColormapIndex]. Test if cast to ssize_t render it negative and thus crash later
+
+Origin:  http://trac.imagemagick.org/changeset/17291
+---
+ magick/colormap-private.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/magick/colormap-private.h b/magick/colormap-private.h
+index 0e96157..03c0b67 100644
+--- a/magick/colormap-private.h
++++ b/magick/colormap-private.h
+@@ -29,7 +29,7 @@ extern "C" {
+ static inline IndexPacket ConstrainColormapIndex(Image *image,
+   const size_t index)
+ {
+-  if (index < image->colors)
++  if ((index < image->colors) && ((ssize_t) index >= 0))
+     return((IndexPacket) index);
+   (void) ThrowMagickException(&image->exception,GetMagickModule(),
+     CorruptImageError,"InvalidColormapIndex","`%s'",image->filename);
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0037-Avoid-an-out-of-bound-access-in-palm-file.patch imagemagick-6.8.9.9/debian/patches/0037-Avoid-an-out-of-bound-access-in-palm-file.patch
--- imagemagick-6.8.9.9/debian/patches/0037-Avoid-an-out-of-bound-access-in-palm-file.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0037-Avoid-an-out-of-bound-access-in-palm-file.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,29 @@
+From 1fe9bcf765411cd8c173443a698659bfe5ed5c8c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bastien=20ROUCARI=C3=88S?= <roucaries.bastien@gmail.com>
+Date: Tue, 23 Dec 2014 15:41:32 +0100
+Subject: [PATCH] Avoid an out of bound access in palm file
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17291 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+Origin:  http://trac.imagemagick.org/changeset/17291
+---
+ coders/palm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/coders/palm.c b/coders/palm.c
+index 864c706..968e38d 100644
+--- a/coders/palm.c
++++ b/coders/palm.c
+@@ -517,8 +517,9 @@ static Image *ReadPALMImage(const ImageInfo *image_info,
+       }
+     if (flags & PALM_HAS_TRANSPARENCY_FLAG)
+       {
++        IndexPacket index=ConstrainColormapIndex(image,(mask-transparentIndex));
+         if (bits_per_pixel != 16)
+-          SetMagickPixelPacket(image,image->colormap+(mask-transparentIndex),
++          SetMagickPixelPacket(image,image->colormap+index,
+             (const IndexPacket *) NULL,&transpix);
+         (void) TransparentPaintImage(image,&transpix,(Quantum)
+           TransparentOpacity,MagickFalse);
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0038-Fix-another-crash-in-pnm-and-xpm-parser.patch imagemagick-6.8.9.9/debian/patches/0038-Fix-another-crash-in-pnm-and-xpm-parser.patch
--- imagemagick-6.8.9.9/debian/patches/0038-Fix-another-crash-in-pnm-and-xpm-parser.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0038-Fix-another-crash-in-pnm-and-xpm-parser.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,42 @@
+From fcf54f0b0f1a277f2e480ac37d731c6a0e5eb473 Mon Sep 17 00:00:00 2001
+From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Tue, 16 Dec 2014 19:43:22 +0000
+Subject: [PATCH] Fix another crash in pnm and xpm parser
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17297 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+Origin:  http://trac.imagemagick.org/changeset/17297
+---
+ coders/pnm.c | 2 +-
+ coders/xpm.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/coders/pnm.c b/coders/pnm.c
+index 64da096..44e9ffe 100644
+--- a/coders/pnm.c
++++ b/coders/pnm.c
+@@ -155,8 +155,8 @@ static void PNMComment(Image *image)
+     Read comment.
+   */
+   comment=AcquireString(GetImageProperty(image,"comment"));
+-  extent=MaxTextExtent;
+   p=comment+strlen(comment);
++  extent=strlen(comment)+MaxTextExtent;
+   for (c='#'; (c != EOF) && (c != (int) '\n'); p++)
+   {
+     if ((size_t) (p-comment+1) >= extent)
+diff --git a/coders/xpm.c b/coders/xpm.c
+index 34d3511..2f43834 100644
+--- a/coders/xpm.c
++++ b/coders/xpm.c
+@@ -158,7 +158,7 @@ static size_t CopyXPMColor(char *destination,const char *source,size_t length)
+     *p;
+ 
+   p=source;
+-  while (length-- && (*p != '\0'))
++  while (--length && (*p != '\0'))
+     *destination++=(*p++);
+   *destination='\0';
+   return((size_t) (p-source));
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0039-Fixed-throwing-of-exceptions-in-psd-handling-and-fix.patch imagemagick-6.8.9.9/debian/patches/0039-Fixed-throwing-of-exceptions-in-psd-handling-and-fix.patch
--- imagemagick-6.8.9.9/debian/patches/0039-Fixed-throwing-of-exceptions-in-psd-handling-and-fix.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0039-Fixed-throwing-of-exceptions-in-psd-handling-and-fix.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,85 @@
+From f9ef11671c41da4cf973d0d880af1cdfbd127860 Mon Sep 17 00:00:00 2001
+From: dirk <dirk@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Tue, 16 Dec 2014 23:15:01 +0000
+Subject: [PATCH] Fixed throwing of exceptions in psd handling and fix a memory
+ leak
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17308 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin:  http://trac.imagemagick.org/changeset/17308
+---
+ coders/psd.c | 24 ++++++++++++++----------
+ 1 file changed, 14 insertions(+), 10 deletions(-)
+
+diff --git a/coders/psd.c b/coders/psd.c
+index f4dec69..8c99dc9 100644
+--- a/coders/psd.c
++++ b/coders/psd.c
+@@ -1218,9 +1218,10 @@ static MagickStatusType ReadPSDLayers(Image *image,const ImageInfo *image_info,
+       count=ReadBlob(image,4,(unsigned char *) type);
+       if ((count == 0) || (LocaleNCompare(type,"8BIM",4) != 0))
+         {
+-          if (DiscardBlobBytes(image,(MagickSizeType) (size-quantum-8)) == MagickFalse)
+-            ThrowFileException(exception,CorruptImageError,
+-              "UnexpectedEndOfFile",image->filename);
++          if (DiscardBlobBytes(image,(MagickSizeType) (size-quantum-8)) ==
++              MagickFalse)
++            ThrowBinaryException(CorruptImageError,"UnexpectedEndOfFile",
++              image->filename);
+         }
+       else
+         {
+@@ -1228,9 +1229,10 @@ static MagickStatusType ReadPSDLayers(Image *image,const ImageInfo *image_info,
+           if ((count != 0) && (LocaleNCompare(type,"Lr16",4) == 0))
+             size=GetPSDSize(psd_info,image);
+           else
+-            if (DiscardBlobBytes(image,(MagickSizeType) (size-quantum-12)) == MagickFalse)
+-              ThrowFileException(exception,CorruptImageError,
+-                "UnexpectedEndOfFile",image->filename);
++            if (DiscardBlobBytes(image,(MagickSizeType) (size-quantum-12)) ==
++                MagickFalse)
++              ThrowBinaryException(CorruptImageError,"UnexpectedEndOfFile",
++                image->filename);
+         }
+     }
+ 
+@@ -1261,7 +1263,8 @@ static MagickStatusType ReadPSDLayers(Image *image,const ImageInfo *image_info,
+           "  image contains %.20g layers",(double) number_layers);
+ 
+       if (number_layers == 0)
+-        return(MagickFalse);
++        ThrowBinaryException(CorruptImageError,"InvalidNumberOfLayers",
++          image->filename);
+ 
+       layer_info=(LayerInfo *) AcquireQuantumMemory((size_t) number_layers,
+         sizeof(*layer_info));
+@@ -1296,7 +1299,7 @@ static MagickStatusType ReadPSDLayers(Image *image,const ImageInfo *image_info,
+           {
+             layer_info=DestroyLayerInfo(layer_info,number_layers);
+             ThrowBinaryException(CorruptImageError,"MaximumChannelsExceeded",
+-            image->filename);
++              image->filename);
+           }
+         if (image->debug != MagickFalse)
+           (void) LogMagickEvent(CoderEvent,GetMagickModule(),
+@@ -1375,8 +1378,8 @@ static MagickStatusType ReadPSDLayers(Image *image,const ImageInfo *image_info,
+                 if (DiscardBlobBytes(image,(MagickSizeType) (length-16)) == MagickFalse)
+                   {
+                     layer_info=DestroyLayerInfo(layer_info,number_layers);
+-                    ThrowFileException(exception,CorruptImageError,
+-                      "UnexpectedEndOfFile",image->filename);
++                    ThrowBinaryException(CorruptImageError,"UnexpectedEndOfFile",
++                      image->filename);
+                   }
+               }
+             length=ReadBlobMSBLong(image);
+@@ -1808,6 +1811,7 @@ static Image *ReadPSDImage(const ImageInfo *image_info,
+   if (image_info->ping != MagickFalse)
+     {
+       (void) CloseBlob(image);
++      image=DestroyImageList(image);
+       return(image);
+     }
+   /*
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0040-Fixed-boundary-checks-in-DecodePSDPixels.patch imagemagick-6.8.9.9/debian/patches/0040-Fixed-boundary-checks-in-DecodePSDPixels.patch
--- imagemagick-6.8.9.9/debian/patches/0040-Fixed-boundary-checks-in-DecodePSDPixels.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0040-Fixed-boundary-checks-in-DecodePSDPixels.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,194 @@
+From b8df15144d91a19ed545893ea492363635a1cb29 Mon Sep 17 00:00:00 2001
+From: dirk <dirk@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Wed, 17 Dec 2014 07:25:30 +0000
+Subject: [PATCH] Fixed boundary checks in DecodePSDPixels.
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17310 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+Origin:  http://trac.imagemagick.org/changeset/17310
+---
+ coders/psd.c | 72 ++++++++++++++++++++++++++++++------------------------------
+ 1 file changed, 36 insertions(+), 36 deletions(-)
+
+diff --git a/coders/psd.c b/coders/psd.c
+index 8c99dc9..eaeb6bc 100644
+--- a/coders/psd.c
++++ b/coders/psd.c
+@@ -326,6 +326,16 @@ static ssize_t DecodePSDPixels(const size_t number_compact_pixels,
+   const unsigned char *compact_pixels,const ssize_t depth,
+   const size_t number_pixels,unsigned char *pixels)
+ {
++#define CheckNumberCompactPixels \
++  if (packets == 0) \
++    return(i); \
++  packets--
++
++#define CheckNumberPixels(count) \
++  if (((ssize_t) i + count) > (ssize_t) number_pixels) \
++    return(i); \
++  i+=count
++
+   int
+     pixel;
+ 
+@@ -342,23 +352,22 @@ static ssize_t DecodePSDPixels(const size_t number_compact_pixels,
+   packets=(ssize_t) number_compact_pixels;
+   for (i=0; (packets > 1) && (i < (ssize_t) number_pixels); )
+   {
++    CheckNumberCompactPixels;
+     length=(size_t) (*compact_pixels++);
+-    packets--;
+     if (length == 128)
+       continue;
+     if (length > 128)
+       {
+         length=256-length+1;
+-        if (((ssize_t) length+i) > (ssize_t) number_pixels)
+-          length=number_pixels-(size_t) i;
++        CheckNumberCompactPixels;
+         pixel=(*compact_pixels++);
+-        packets--;
+         for (j=0; j < (ssize_t) length; j++)
+         {
+           switch (depth)
+           {
+             case 1:
+             {
++              CheckNumberPixels(8);
+               *pixels++=(pixel >> 7) & 0x01 ? 0U : 255U;
+               *pixels++=(pixel >> 6) & 0x01 ? 0U : 255U;
+               *pixels++=(pixel >> 5) & 0x01 ? 0U : 255U;
+@@ -367,29 +376,28 @@ static ssize_t DecodePSDPixels(const size_t number_compact_pixels,
+               *pixels++=(pixel >> 2) & 0x01 ? 0U : 255U;
+               *pixels++=(pixel >> 1) & 0x01 ? 0U : 255U;
+               *pixels++=(pixel >> 0) & 0x01 ? 0U : 255U;
+-              i+=8;
+-              break;
+-            }
+-            case 4:
+-            {
+-              *pixels++=(unsigned char) ((pixel >> 4) & 0xff);
+-              *pixels++=(unsigned char) ((pixel & 0x0f) & 0xff);
+-              i+=2;
+               break;
+             }
+             case 2:
+             {
++              CheckNumberPixels(4);
+               *pixels++=(unsigned char) ((pixel >> 6) & 0x03);
+               *pixels++=(unsigned char) ((pixel >> 4) & 0x03);
+               *pixels++=(unsigned char) ((pixel >> 2) & 0x03);
+               *pixels++=(unsigned char) ((pixel & 0x03) & 0x03);
+-              i+=4;
++              break;
++            }
++            case 4:
++            {
++              CheckNumberPixels(2);
++              *pixels++=(unsigned char) ((pixel >> 4) & 0xff);
++              *pixels++=(unsigned char) ((pixel & 0x0f) & 0xff);
+               break;
+             }
+             default:
+             {
++              CheckNumberPixels(1);
+               *pixels++=(unsigned char) pixel;
+-              i++;
+               break;
+             }
+           }
+@@ -397,14 +405,13 @@ static ssize_t DecodePSDPixels(const size_t number_compact_pixels,
+         continue;
+       }
+     length++;
+-    if (((ssize_t) length+i) > (ssize_t) number_pixels)
+-      length=number_pixels-(size_t) i;
+     for (j=0; j < (ssize_t) length; j++)
+     {
+       switch (depth)
+       {
+         case 1:
+         {
++          CheckNumberPixels(8);
+           *pixels++=(*compact_pixels >> 7) & 0x01 ? 0U : 255U;
+           *pixels++=(*compact_pixels >> 6) & 0x01 ? 0U : 255U;
+           *pixels++=(*compact_pixels >> 5) & 0x01 ? 0U : 255U;
+@@ -413,32 +420,32 @@ static ssize_t DecodePSDPixels(const size_t number_compact_pixels,
+           *pixels++=(*compact_pixels >> 2) & 0x01 ? 0U : 255U;
+           *pixels++=(*compact_pixels >> 1) & 0x01 ? 0U : 255U;
+           *pixels++=(*compact_pixels >> 0) & 0x01 ? 0U : 255U;
+-          i+=8;
+-          break;
+-        }
+-        case 4:
+-        {
+-          *pixels++=(*compact_pixels >> 4) & 0xff;
+-          *pixels++=(*compact_pixels & 0x0f) & 0xff;
+-          i+=2;
+           break;
+         }
+         case 2:
+         {
++          CheckNumberPixels(4);
+           *pixels++=(*compact_pixels >> 6) & 0x03;
+           *pixels++=(*compact_pixels >> 4) & 0x03;
+           *pixels++=(*compact_pixels >> 2) & 0x03;
+           *pixels++=(*compact_pixels & 0x03) & 0x03;
+-          i+=4;
++          break;
++        }
++        case 4:
++        {
++          CheckNumberPixels(2);
++          *pixels++=(*compact_pixels >> 4) & 0xff;
++          *pixels++=(*compact_pixels & 0x0f) & 0xff;
+           break;
+         }
+         default:
+         {
++          CheckNumberPixels(1);
+           *pixels++=(*compact_pixels);
+-          i++;
+           break;
+         }
+       }
++      CheckNumberCompactPixels;
+       compact_pixels++;
+     }
+   }
+@@ -800,7 +807,7 @@ static MagickStatusType ReadPSDChannelRaw(Image *image,const size_t channels,
+        "      layer data is RAW");
+ 
+   row_size=GetPSDRowSize(image);
+-  pixels=(unsigned char *) AcquireQuantumMemory(row_size,8*sizeof(*pixels));
++  pixels=(unsigned char *) AcquireQuantumMemory(row_size,sizeof(*pixels));
+   if (pixels == (unsigned char *) NULL)
+     ThrowBinaryException(ResourceLimitError,"MemoryAllocationFailed",
+       image->filename);
+@@ -869,7 +876,7 @@ static MagickStatusType ReadPSDChannelRLE(Image *image,const PSDInfo *psd_info,
+        "      layer data is RLE compressed");
+ 
+   row_size=GetPSDRowSize(image);
+-  pixels=(unsigned char *) AcquireQuantumMemory(row_size,8*sizeof(*pixels));
++  pixels=(unsigned char *) AcquireQuantumMemory(row_size,sizeof(*pixels));
+   if (pixels == (unsigned char *) NULL)
+     ThrowBinaryException(ResourceLimitError,"MemoryAllocationFailed",
+       image->filename);
+@@ -879,14 +886,7 @@ static MagickStatusType ReadPSDChannelRLE(Image *image,const PSDInfo *psd_info,
+     if ((MagickOffsetType) length < offsets[y])
+       length=(size_t) offsets[y];
+ 
+-  if (length > row_size + 256) // arbitrary number
+-    {
+-      pixels=(unsigned char *) RelinquishMagickMemory(pixels);
+-      ThrowBinaryException(CoderError,"InvalidLength",
+-        image->filename);
+-    }
+-  compact_pixels=(unsigned char *) AcquireQuantumMemory(length,8*
+-    sizeof(*pixels));
++  compact_pixels=(unsigned char *) AcquireQuantumMemory(length,sizeof(*pixels));
+   if (compact_pixels == (unsigned char *) NULL)
+     {
+       pixels=(unsigned char *) RelinquishMagickMemory(pixels);
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0041-Fix-another-out-of-bound-problem-in-rle-file.patch imagemagick-6.8.9.9/debian/patches/0041-Fix-another-out-of-bound-problem-in-rle-file.patch
--- imagemagick-6.8.9.9/debian/patches/0041-Fix-another-out-of-bound-problem-in-rle-file.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0041-Fix-another-out-of-bound-problem-in-rle-file.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,48 @@
+From 36ed9419a68cb1356b1843b48cc12788179cdaee Mon Sep 17 00:00:00 2001
+From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Fri, 19 Dec 2014 00:26:33 +0000
+Subject: [PATCH] Fix another out of bound problem in rle file
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17336 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin:  http://trac.imagemagick.org/changeset/17336
+---
+ coders/rle.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/coders/rle.c b/coders/rle.c
+index fcc718b..4cc6a96 100644
+--- a/coders/rle.c
++++ b/coders/rle.c
+@@ -422,6 +422,9 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
+     } while (((opcode & 0x3f) != EOFOp) && (opcode != EOF));
+     if (number_colormaps != 0)
+       {
++        IndexPacket
++          index;
++
+         MagickStatusType
+           mask;
+ 
+@@ -433,7 +436,8 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
+         if (number_colormaps == 1)
+           for (i=0; i < (ssize_t) number_pixels; i++)
+           {
+-            *p=colormap[*p & mask];
++            index=ConstrainColormapIndex(image,*p & mask);
++            *p=colormap[index];
+             p++;
+           }
+         else
+@@ -441,7 +445,8 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
+             for (i=0; i < (ssize_t) number_pixels; i++)
+               for (x=0; x < (ssize_t) number_planes; x++)
+               {
+-                *p=colormap[x*map_length+(*p & mask)];
++                index=ConstrainColormapIndex(image,x*map_length+(*p & mask));
++                *p=colormap[index];
+                 p++;
+               }
+       }
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0042-Fix-crash-due-to-corrupted-dib-file.patch imagemagick-6.8.9.9/debian/patches/0042-Fix-crash-due-to-corrupted-dib-file.patch
--- imagemagick-6.8.9.9/debian/patches/0042-Fix-crash-due-to-corrupted-dib-file.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0042-Fix-crash-due-to-corrupted-dib-file.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,73 @@
+From a7a7fd3ce95b7b8efb0ce1ce40f43dbbd20d8e03 Mon Sep 17 00:00:00 2001
+From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Fri, 19 Dec 2014 12:12:18 +0000
+Subject: [PATCH] Fix crash due to corrupted dib file
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17343 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin:  http://trac.imagemagick.org/changeset/17343
+---
+ coders/dib.c | 39 ++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 38 insertions(+), 1 deletion(-)
+
+diff --git a/coders/dib.c b/coders/dib.c
+index bc84b41..49213bd 100644
+--- a/coders/dib.c
++++ b/coders/dib.c
+@@ -159,6 +159,10 @@ static MagickBooleanType DecodeImage(Image *image,
+ #define BI_RLE8  1
+ #define BI_RLE4  2
+ #define BI_BITFIELDS  3
++#undef BI_JPEG
++#define BI_JPEG  4
++#undef BI_PNG
++#define BI_PNG  5
+ #endif
+ 
+   int
+@@ -542,9 +546,42 @@ static Image *ReadDIBImage(const ImageInfo *image_info,ExceptionInfo *exception)
+       dib_info.green_mask=ReadBlobLSBLong(image);
+       dib_info.blue_mask=ReadBlobLSBLong(image);
+     }
+-  image->matte=dib_info.bits_per_pixel == 32 ? MagickTrue : MagickFalse;
++  if (dib_info.width <= 0)
++    ThrowReaderException(CorruptImageError,"NegativeOrZeroImageSize");
++  if (dib_info.height == 0)
++    ThrowReaderException(CorruptImageError,"NegativeOrZeroImageSize");
++  if (dib_info.planes != 1)
++    ThrowReaderException(CorruptImageError,"StaticPlanesValueNotEqualToOne");
++  if ((dib_info.bits_per_pixel != 1) && (dib_info.bits_per_pixel != 4) &&
++      (dib_info.bits_per_pixel != 8) && (dib_info.bits_per_pixel != 16) &&
++      (dib_info.bits_per_pixel != 24) && (dib_info.bits_per_pixel != 32))
++    ThrowReaderException(CorruptImageError,"UnrecognizedBitsPerPixel");
++  if (dib_info.bits_per_pixel < 16 &&
++      dib_info.number_colors > (1U << dib_info.bits_per_pixel))
++    ThrowReaderException(CorruptImageError,"UnrecognizedNumberOfColors");
++  if ((dib_info.compression == 1) && (dib_info.bits_per_pixel != 8))
++    ThrowReaderException(CorruptImageError,"UnrecognizedBitsPerPixel");
++  if ((dib_info.compression == 2) && (dib_info.bits_per_pixel != 4))
++    ThrowReaderException(CorruptImageError,"UnrecognizedBitsPerPixel");
++  if ((dib_info.compression == 3) && (dib_info.bits_per_pixel < 16))
++    ThrowReaderException(CorruptImageError,"UnrecognizedBitsPerPixel");
++  switch (dib_info.compression)
++  {
++    case BI_RGB:
++    case BI_RLE8:
++    case BI_RLE4:
++    case BI_BITFIELDS:
++      break;
++    case BI_JPEG:
++      ThrowReaderException(CoderError,"JPEGCompressNotSupported");
++    case BI_PNG:
++      ThrowReaderException(CoderError,"PNGCompressNotSupported");
++    default:
++      ThrowReaderException(CorruptImageError,"UnrecognizedImageCompression");
++  }
+   image->columns=(size_t) MagickAbsoluteValue(dib_info.width);
+   image->rows=(size_t) MagickAbsoluteValue(dib_info.height);
++  image->matte=dib_info.bits_per_pixel == 32 ? MagickTrue : MagickFalse;
+   image->depth=8;
+   if ((dib_info.number_colors != 0) || (dib_info.bits_per_pixel < 16))
+     {
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0043-Added-checks-to-prevent-overflow-in-rle-file.patch imagemagick-6.8.9.9/debian/patches/0043-Added-checks-to-prevent-overflow-in-rle-file.patch
--- imagemagick-6.8.9.9/debian/patches/0043-Added-checks-to-prevent-overflow-in-rle-file.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0043-Added-checks-to-prevent-overflow-in-rle-file.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,79 @@
+From 2d90693af41a363a988a9db3a91a15f9ca7c7370 Mon Sep 17 00:00:00 2001
+From: dirk <dirk@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Sat, 20 Dec 2014 13:40:37 +0000
+Subject: [PATCH] Added checks to prevent overflow in rle file
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17348 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin:  http://trac.imagemagick.org/changeset/17348
+---
+ coders/rle.c | 32 +++++++++++++++++++++++++-------
+ 1 file changed, 25 insertions(+), 7 deletions(-)
+
+diff --git a/coders/rle.c b/coders/rle.c
+index 4cc6a96..7341919 100644
+--- a/coders/rle.c
++++ b/coders/rle.c
+@@ -181,7 +181,9 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
+     map_length,
+     number_colormaps,
+     number_planes,
+-    one;
++    one,
++    offset,
++    pixel_info_length;
+ 
+   ssize_t
+     count,
+@@ -310,8 +312,8 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
+     number_pixels=(MagickSizeType) image->columns*image->rows;
+     if ((number_pixels*number_planes) != (size_t) (number_pixels*number_planes))
+       ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+-    pixel_info=AcquireVirtualMemory(image->columns,image->rows*
+-      MagickMax(number_planes,4)*sizeof(*pixels));
++    pixel_info_length=image->columns*image->rows*MagickMax(number_planes,4);
++    pixel_info=AcquireVirtualMemory(pixel_info_length,sizeof(*pixels));
+     if (pixel_info == (MemoryInfo *) NULL)
+       ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+     pixels=(unsigned char *) GetVirtualMemoryBlob(pixel_info);
+@@ -379,9 +381,17 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
+           operand=ReadBlobByte(image);
+           if (opcode & 0x40)
+             operand=(int) ReadBlobLSBShort(image);
+-          p=pixels+((image->rows-y-1)*image->columns*number_planes)+
+-            x*number_planes+plane;
++          offset=((image->rows-y-1)*image->columns*number_planes)+x*
++            number_planes+plane;
+           operand++;
++          if (offset+((size_t) operand*number_planes) > pixel_info_length)
++            {
++              if (number_colormaps != 0)
++                colormap=(unsigned char *) RelinquishMagickMemory(colormap);
++              pixel_info=RelinquishVirtualMemory(pixel_info);
++              ThrowReaderException(CorruptImageError,"UnableToReadImageData");
++            }
++          p=pixels+offset;
+           for (i=0; i < (ssize_t) operand; i++)
+           {
+             pixel=(unsigned char) ReadBlobByte(image);
+@@ -403,8 +413,16 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
+           pixel=(unsigned char) ReadBlobByte(image);
+           (void) ReadBlobByte(image);
+           operand++;
+-          p=pixels+((image->rows-y-1)*image->columns*number_planes)+
+-            x*number_planes+plane;
++          offset=((image->rows-y-1)*image->columns*number_planes)+x*
++            number_planes+plane;
++          p=pixels+offset;
++          if (offset+((size_t) operand*number_planes) > pixel_info_length)
++            {
++              if (number_colormaps != 0)
++                colormap=(unsigned char *) RelinquishMagickMemory(colormap);
++              pixel_info=RelinquishVirtualMemory(pixel_info);
++              ThrowReaderException(CorruptImageError,"UnableToReadImageData");
++            }
+           for (i=0; i < (ssize_t) operand; i++)
+           {
+             if ((y < (ssize_t) image->rows) &&
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0044-Impose-a-limit-of-10-million-columns-or-rows-in-an-i.patch imagemagick-6.8.9.9/debian/patches/0044-Impose-a-limit-of-10-million-columns-or-rows-in-an-i.patch
--- imagemagick-6.8.9.9/debian/patches/0044-Impose-a-limit-of-10-million-columns-or-rows-in-an-i.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0044-Impose-a-limit-of-10-million-columns-or-rows-in-an-i.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,30 @@
+From ec550654499ce8035d70ac466a6f78965ca2642e Mon Sep 17 00:00:00 2001
+From: glennrp <glennrp@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Sun, 21 Dec 2014 17:18:01 +0000
+Subject: [PATCH] Impose a limit of 10 million columns or rows in an input PNG.
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17368 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin:  http://trac.imagemagick.org/changeset/17368
+---
+ coders/png.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/coders/png.c b/coders/png.c
+index e79a7d1..0057df2 100644
+--- a/coders/png.c
++++ b/coders/png.c
+@@ -2182,6 +2182,11 @@ static Image *ReadOnePNGImage(MngInfo *mng_info,
+   png_set_benign_errors(ping, 1);
+ #endif
+ 
++#ifdef PNG_SET_USER_LIMITS_SUPPORTED
++  /* Reject images with more than 10 million rows or columns */
++  png_set_user_limits(ping, 10000000L, 10000000L);
++#endif /* PNG_SET_USER_LIMITS_SUPPORTED */
++
+   /*
+     Prepare PNG for reading.
+   */
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0045-Avoid-heap-overflow-in-rle-file.patch imagemagick-6.8.9.9/debian/patches/0045-Avoid-heap-overflow-in-rle-file.patch
--- imagemagick-6.8.9.9/debian/patches/0045-Avoid-heap-overflow-in-rle-file.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0045-Avoid-heap-overflow-in-rle-file.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,27 @@
+From 90a405ba3e329e7e080addadac377dd4235671d3 Mon Sep 17 00:00:00 2001
+From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Sun, 21 Dec 2014 21:04:29 +0000
+Subject: [PATCH] Avoid heap overflow in rle file
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17372 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin:  http://trac.imagemagick.org/changeset/17372
+---
+ coders/rle.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/coders/rle.c b/coders/rle.c
+index 7341919..8d50b7e 100644
+--- a/coders/rle.c
++++ b/coders/rle.c
+@@ -268,7 +268,7 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
+           Read image colormaps.
+         */
+         colormap=(unsigned char *) AcquireQuantumMemory(number_colormaps,
+-          map_length*sizeof(*colormap));
++          3*map_length*sizeof(*colormap));
+         if (colormap == (unsigned char *) NULL)
+           ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+         p=colormap;
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0046-Don-t-try-to-handle-a-previous-image-in-the-JNG-deco.patch imagemagick-6.8.9.9/debian/patches/0046-Don-t-try-to-handle-a-previous-image-in-the-JNG-deco.patch
--- imagemagick-6.8.9.9/debian/patches/0046-Don-t-try-to-handle-a-previous-image-in-the-JNG-deco.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0046-Don-t-try-to-handle-a-previous-image-in-the-JNG-deco.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,56 @@
+From f4ece8c7c462c5449138f39401f66318b9ab0430 Mon Sep 17 00:00:00 2001
+From: glennrp <glennrp@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Thu, 20 Nov 2014 18:27:10 +0000
+Subject: [PATCH] Don't try to handle a "previous" image in the JNG decoder.
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17078 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+http://trac.imagemagick.org/changeset/17078
+---
+ coders/png.c | 12 ++----------
+ 1 file changed, 2 insertions(+), 10 deletions(-)
+
+diff --git a/coders/png.c b/coders/png.c
+index 0057df2..263d52b 100644
+--- a/coders/png.c
++++ b/coders/png.c
+@@ -4175,7 +4175,7 @@ static Image *ReadOneJNGImage(MngInfo *mng_info,
+         type[0],type[1],type[2],type[3],(double) length);
+ 
+     if (length > PNG_UINT_31_MAX || count == 0)
+-      ThrowReaderException(CorruptImageError,"CorruptImage");
++        ThrowReaderException(CorruptImageError,"CorruptImage");
+ 
+     p=NULL;
+     chunk=(unsigned char *) NULL;
+@@ -4735,8 +4735,7 @@ static Image *ReadOneJNGImage(MngInfo *mng_info,
+ static Image *ReadJNGImage(const ImageInfo *image_info,ExceptionInfo *exception)
+ {
+   Image
+-    *image,
+-    *previous;
++    *image;
+ 
+   MagickBooleanType
+     have_mng_structure,
+@@ -4792,18 +4791,11 @@ static Image *ReadJNGImage(const ImageInfo *image_info,ExceptionInfo *exception)
+   have_mng_structure=MagickTrue;
+ 
+   mng_info->image=image;
+-  previous=image;
+   image=ReadOneJNGImage(mng_info,image_info,exception);
+   MngInfoFreeStruct(mng_info,&have_mng_structure);
+ 
+   if (image == (Image *) NULL)
+     {
+-      if (IsImageObject(previous) != MagickFalse)
+-        {
+-          (void) CloseBlob(previous);
+-          (void) DestroyImageList(previous);
+-        }
+-
+       if (logging != MagickFalse)
+         (void) LogMagickEvent(CoderEvent,GetMagickModule(),
+           "exit ReadJNGImage() with error");
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0047-Avoid-a-memory-leak-in-quantum-management.patch imagemagick-6.8.9.9/debian/patches/0047-Avoid-a-memory-leak-in-quantum-management.patch
--- imagemagick-6.8.9.9/debian/patches/0047-Avoid-a-memory-leak-in-quantum-management.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0047-Avoid-a-memory-leak-in-quantum-management.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,60 @@
+From 44675e8e48977bbeb1cafade861db2d777a5c7ae Mon Sep 17 00:00:00 2001
+From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Sun, 14 Dec 2014 15:28:26 +0000
+Subject: [PATCH] Avoid a memory leak in quantum management
+
+Note that upstream magick/colormap-private.h patch is buggy and already applied in the patch queue.
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17207 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin:  http://trac.imagemagick.org/changeset/17207 and  http://trac.imagemagick.org/changeset/17228
+---
+ magick/quantum.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/magick/quantum.c b/magick/quantum.c
+index b94cd45..ff993bd 100644
+--- a/magick/quantum.c
++++ b/magick/quantum.c
+@@ -46,6 +46,7 @@
+ #include "magick/exception.h"
+ #include "magick/exception-private.h"
+ #include "magick/cache.h"
++#include "magick/cache-private.h"
+ #include "magick/constitute.h"
+ #include "magick/delegate.h"
+ #include "magick/geometry.h"
+@@ -112,6 +113,8 @@ MagickExport QuantumInfo *AcquireQuantumInfo(const ImageInfo *image_info,
+   QuantumInfo
+     *quantum_info;
+ 
++  if (SyncImagePixelCache(image,&image->exception) == MagickFalse)
++    return(MagickFalse);
+   quantum_info=(QuantumInfo *) AcquireMagickMemory(sizeof(*quantum_info));
+   if (quantum_info == (QuantumInfo *) NULL)
+     ThrowFatalException(ResourceLimitFatalError,"MemoryAllocationFailed");
+@@ -137,7 +140,7 @@ MagickExport QuantumInfo *AcquireQuantumInfo(const ImageInfo *image_info,
+ %                                                                             %
+ %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+ %
+-%  AcquireQuantumPixels() allocates the unsigned char structure.
++%  AcquireQuantumPixels() allocates the pixel staging area.
+ %
+ %  The format of the AcquireQuantumPixels method is:
+ %
+@@ -172,7 +175,12 @@ static MagickBooleanType AcquireQuantumPixels(QuantumInfo *quantum_info,
+     quantum_info->pixels[i]=(unsigned char *) AcquireQuantumMemory(extent+1,
+       sizeof(**quantum_info->pixels));
+     if (quantum_info->pixels[i] == (unsigned char *) NULL)
+-      return(MagickFalse);
++      {
++        while (--i >= 0)
++          quantum_info->pixels[i]=(unsigned char *) RelinquishMagickMemory(
++            quantum_info->pixels[i]);
++        return(MagickFalse);
++      }
+     (void) ResetMagickMemory(quantum_info->pixels[i],0,(extent+1)*
+       sizeof(**quantum_info->pixels));
+     quantum_info->pixels[i][extent]=QuantumSignature;
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0048-Avoid-a-crash-in-png-coder.patch imagemagick-6.8.9.9/debian/patches/0048-Avoid-a-crash-in-png-coder.patch
--- imagemagick-6.8.9.9/debian/patches/0048-Avoid-a-crash-in-png-coder.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0048-Avoid-a-crash-in-png-coder.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,70 @@
+From 6330ab1048b62ab34e957447d81e35e1dde60d2e Mon Sep 17 00:00:00 2001
+From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Sun, 14 Dec 2014 17:06:28 +0000
+Subject: [PATCH] Avoid a crash in png coder
+
+Move some code earlier in order to avoid non initialised pointer.
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17209 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin:  http://trac.imagemagick.org/changeset/17209
+---
+ coders/png.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/coders/png.c b/coders/png.c
+index 263d52b..ed6d613 100644
+--- a/coders/png.c
++++ b/coders/png.c
+@@ -3102,6 +3102,16 @@ static Image *ReadOnePNGImage(MngInfo *mng_info,
+ 
+   if (image->storage_class == DirectClass)
+     {
++      QuantumInfo
++        *quantum_info;
++
++      quantum_info=AcquireQuantumInfo(image_info,image);
++
++      if (quantum_info == (QuantumInfo *) NULL)
++        png_error(ping,"Failed to allocate quantum_info");
++
++      (void) SetQuantumEndian(image,quantum_info,MSBEndian);
++
+       for (pass=0; pass < num_passes; pass++)
+       {
+         /*
+@@ -3133,16 +3143,6 @@ static Image *ReadOnePNGImage(MngInfo *mng_info,
+ 
+           else
+           {
+-            QuantumInfo
+-              *quantum_info;
+-
+-            quantum_info=AcquireQuantumInfo(image_info,image);
+-
+-            if (quantum_info == (QuantumInfo *) NULL)
+-              png_error(ping,"Failed to allocate quantum_info");
+-
+-            (void) SetQuantumEndian(image,quantum_info,MSBEndian);
+-
+             if ((int) ping_color_type == PNG_COLOR_TYPE_GRAY)
+               (void) ImportQuantumPixels(image,(CacheView *) NULL,quantum_info,
+                 GrayQuantum,ping_pixels+row_offset,exception);
+@@ -3163,7 +3163,6 @@ static Image *ReadOnePNGImage(MngInfo *mng_info,
+               (void) ImportQuantumPixels(image,(CacheView *) NULL,quantum_info,
+                 RGBQuantum,ping_pixels+row_offset,exception);
+ 
+-            quantum_info=DestroyQuantumInfo(quantum_info);
+           }
+ 
+           if (found_transparent_pixel == MagickFalse)
+@@ -3224,6 +3223,7 @@ static Image *ReadOnePNGImage(MngInfo *mng_info,
+               break;
+           }
+       }
++      quantum_info=DestroyQuantumInfo(quantum_info);
+     }
+ 
+   else /* image->storage_class != DirectClass */
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0049-Avoid-heap-overflow.patch imagemagick-6.8.9.9/debian/patches/0049-Avoid-heap-overflow.patch
--- imagemagick-6.8.9.9/debian/patches/0049-Avoid-heap-overflow.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0049-Avoid-heap-overflow.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,106 @@
+From ac74497be613d3fb246ce3a17457d08ac81d12fe Mon Sep 17 00:00:00 2001
+From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Sun, 14 Dec 2014 17:43:28 +0000
+Subject: [PATCH] Avoid heap overflow
+
+Avoid to allocate too much memory
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17210 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin:  http://trac.imagemagick.org/changeset/17210
+---
+ coders/fits.c    |  2 +-
+ coders/pnm.c     | 14 ++++++++++----
+ magick/quantum.c |  4 ++--
+ 3 files changed, 13 insertions(+), 7 deletions(-)
+
+diff --git a/coders/fits.c b/coders/fits.c
+index 0ea0b13..2d75974 100644
+--- a/coders/fits.c
++++ b/coders/fits.c
+@@ -656,7 +656,7 @@ static MagickBooleanType WriteFITSImage(const ImageInfo *image_info,
+   */
+   image->depth=GetImageQuantumDepth(image,MagickFalse);
+   image->endian=MSBEndian;
+-  quantum_info=AcquireQuantumInfo((const ImageInfo *) NULL,image);
++  quantum_info=AcquireQuantumInfo(image_info,image);
+   if (quantum_info == (QuantumInfo *) NULL)
+     ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
+   offset=0;
+diff --git a/coders/pnm.c b/coders/pnm.c
+index 44e9ffe..90c0267 100644
+--- a/coders/pnm.c
++++ b/coders/pnm.c
+@@ -1930,9 +1930,10 @@ static MagickBooleanType WritePNMImage(const ImageInfo *image_info,Image *image)
+         */
+         (void) SetImageType(image,BilevelType);
+         image->depth=1;
+-        quantum_info=AcquireQuantumInfo((const ImageInfo *) NULL,image);
++        quantum_info=AcquireQuantumInfo(image_info,image);
+         if (quantum_info == (QuantumInfo *) NULL)
+           ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
++        (void) SetQuantumEndian(image,quantum_info,MSBEndian);
+         quantum_info->min_is_white=MagickTrue;
+         pixels=GetQuantumPixels(quantum_info);
+         for (y=0; y < (ssize_t) image->rows; y++)
+@@ -1969,9 +1970,10 @@ static MagickBooleanType WritePNMImage(const ImageInfo *image_info,Image *image)
+         (void) FormatLocaleString(buffer,MaxTextExtent,"%.20g\n",(double)
+           ((MagickOffsetType) GetQuantumRange(image->depth)));
+         (void) WriteBlobString(image,buffer);
+-        quantum_info=AcquireQuantumInfo((const ImageInfo *) NULL,image);
++        quantum_info=AcquireQuantumInfo(image_info,image);
+         if (quantum_info == (QuantumInfo *) NULL)
+           ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
++        (void) SetQuantumEndian(image,quantum_info,MSBEndian);
+         quantum_info->min_is_white=MagickTrue;
+         pixels=GetQuantumPixels(quantum_info);
+         extent=GetQuantumExtent(image,quantum_info,GrayQuantum);
+@@ -2083,10 +2085,11 @@ static MagickBooleanType WritePNMImage(const ImageInfo *image_info,Image *image)
+         (void) FormatLocaleString(buffer,MaxTextExtent,"%.20g\n",(double)
+           ((MagickOffsetType) GetQuantumRange(image->depth)));
+         (void) WriteBlobString(image,buffer);
+-        quantum_info=AcquireQuantumInfo((const ImageInfo *) NULL,image);
++        quantum_info=AcquireQuantumInfo(image_info,image);
+         if (quantum_info == (QuantumInfo *) NULL)
+           ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
+         (void) SetQuantumEndian(image,quantum_info,MSBEndian);
++        (void) SetQuantumEndian(image,quantum_info,MSBEndian);
+         pixels=GetQuantumPixels(quantum_info);
+         extent=GetQuantumExtent(image,quantum_info,quantum_type);
+         for (y=0; y < (ssize_t) image->rows; y++)
+@@ -2178,7 +2181,10 @@ static MagickBooleanType WritePNMImage(const ImageInfo *image_info,Image *image)
+         */
+         if (image->depth > 32)
+           image->depth=32;
+-        quantum_info=AcquireQuantumInfo((const ImageInfo *) NULL,image);
++        quantum_info=AcquireQuantumInfo(image_info,image);
++        if (quantum_info == (QuantumInfo *) NULL)
++          ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
++        (void) SetQuantumEndian(image,quantum_info,MSBEndian);
+         pixels=GetQuantumPixels(quantum_info);
+         for (y=0; y < (ssize_t) image->rows; y++)
+         {
+diff --git a/magick/quantum.c b/magick/quantum.c
+index ff993bd..b7b227a 100644
+--- a/magick/quantum.c
++++ b/magick/quantum.c
+@@ -113,8 +113,6 @@ MagickExport QuantumInfo *AcquireQuantumInfo(const ImageInfo *image_info,
+   QuantumInfo
+     *quantum_info;
+ 
+-  if (SyncImagePixelCache(image,&image->exception) == MagickFalse)
+-    return(MagickFalse);
+   quantum_info=(QuantumInfo *) AcquireMagickMemory(sizeof(*quantum_info));
+   if (quantum_info == (QuantumInfo *) NULL)
+     ThrowFatalException(ResourceLimitFatalError,"MemoryAllocationFailed");
+@@ -122,6 +120,8 @@ MagickExport QuantumInfo *AcquireQuantumInfo(const ImageInfo *image_info,
+   GetQuantumInfo(image_info,quantum_info);
+   if (image == (const Image *) NULL)
+     return(quantum_info);
++  if (SyncImagePixelCache(image,&image->exception) == MagickFalse)
++    return(DestroyQuantumInfo(quantum_info));
+   status=SetQuantumDepth(image,quantum_info,image->depth);
+   quantum_info->endian=image->endian;
+   if (status == MagickFalse)
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0050-Thread-limit-should-be-at-least-1.patch imagemagick-6.8.9.9/debian/patches/0050-Thread-limit-should-be-at-least-1.patch
--- imagemagick-6.8.9.9/debian/patches/0050-Thread-limit-should-be-at-least-1.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0050-Thread-limit-should-be-at-least-1.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,29 @@
+From 2257d1eadd02d89d225fce21013a1219d221dc7d Mon Sep 17 00:00:00 2001
+From: dirk <dirk@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Tue, 16 Dec 2014 12:17:20 +0000
+Subject: [PATCH] Thread limit should be at least 1.
+
+Limit thread when thread limit is 0. It is a logic error that could lead to ressource exhaustion.
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17282 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin:  http://trac.imagemagick.org/changeset/17282
+---
+ magick/resource.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/magick/resource.c b/magick/resource.c
+index 2f35520..2d79e6e 100644
+--- a/magick/resource.c
++++ b/magick/resource.c
+@@ -1193,6 +1193,8 @@ MagickExport MagickBooleanType SetMagickResourceLimit(const ResourceType type,
+           100.0));
+       if (resource_info.throttle_limit > GetOpenMPMaximumThreads())
+         resource_info.throttle_limit=GetOpenMPMaximumThreads();
++      else if (resource_info.thread_limit == 0)
++        resource_info.thread_limit=1;
+       break;
+     }
+     case TimeResource:
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0051-Fixed-parsing-resource-block.patch imagemagick-6.8.9.9/debian/patches/0051-Fixed-parsing-resource-block.patch
--- imagemagick-6.8.9.9/debian/patches/0051-Fixed-parsing-resource-block.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0051-Fixed-parsing-resource-block.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,77 @@
+From 33b2d377b94eb738011bc7d5e90ca0a16ce4d471 Mon Sep 17 00:00:00 2001
+From: dirk <dirk@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Tue, 16 Dec 2014 22:50:20 +0000
+Subject: [PATCH] Fixed parsing resource block.
+
+Avoid a crash
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17305 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin:  http://trac.imagemagick.org/changeset/17305
+---
+ coders/psd.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/coders/psd.c b/coders/psd.c
+index eaeb6bc..e0dc766 100644
+--- a/coders/psd.c
++++ b/coders/psd.c
+@@ -521,7 +521,7 @@ static const char *ModeToString(PSDImageType type)
+   }
+ }
+ 
+-static MagickBooleanType ParseImageResourceBlocks(Image *image,
++static void ParseImageResourceBlocks(Image *image,
+   const unsigned char *blocks,size_t length,
+   MagickBooleanType *has_merged_image)
+ {
+@@ -540,7 +540,7 @@ static MagickBooleanType ParseImageResourceBlocks(Image *image,
+     short_sans;
+ 
+   if (length < 16)
+-    return(MagickFalse);
++    return;
+   profile=BlobToStringInfo((const void *) NULL,length);
+   SetStringInfoDatum(profile,blocks);
+   (void) SetImageProfile(image,"8bim",profile);
+@@ -552,7 +552,9 @@ static MagickBooleanType ParseImageResourceBlocks(Image *image,
+     p=PushLongPixel(MSBEndian,p,&long_sans);
+     p=PushShortPixel(MSBEndian,p,&id);
+     p=PushShortPixel(MSBEndian,p,&short_sans);
+-    p=PushLongPixel(MSBEndian,p,&count);
++    p=PushLongPixel(MSBEndian,p,&count);
++    if (p+count > blocks+length)
++      return;
+     switch (id)
+     {
+       case 0x03ed:
+@@ -601,7 +603,7 @@ static MagickBooleanType ParseImageResourceBlocks(Image *image,
+     if ((count & 0x01) != 0)
+       p++;
+   }
+-  return(MagickTrue);
++  return;
+ }
+ 
+ static CompositeOperator PSDBlendModeToCompositeOperator(const char *mode)
+@@ -1752,7 +1754,7 @@ static Image *ReadPSDImage(const ImageInfo *image_info,
+         (void) LogMagickEvent(CoderEvent,GetMagickModule(),
+           "  reading image resource blocks - %.20g bytes",(double)
+           ((MagickOffsetType) length));
+-      blocks=(unsigned char *) AcquireQuantumMemory((size_t) length+16,
++      blocks=(unsigned char *) AcquireQuantumMemory((size_t) length,
+         sizeof(*blocks));
+       if (blocks == (unsigned char *) NULL)
+         ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+@@ -1763,8 +1765,7 @@ static Image *ReadPSDImage(const ImageInfo *image_info,
+           blocks=(unsigned char *) RelinquishMagickMemory(blocks);
+           ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+         }
+-      (void) ParseImageResourceBlocks(image,blocks,(size_t) length,
+-        &has_merged_image);
++      ParseImageResourceBlocks(image,blocks,(size_t) length,&has_merged_image);
+       blocks=(unsigned char *) RelinquishMagickMemory(blocks);
+     }
+   /*
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0052-Fixed-usage-of-object-after-it-has-been-destroyed-an.patch imagemagick-6.8.9.9/debian/patches/0052-Fixed-usage-of-object-after-it-has-been-destroyed-an.patch
--- imagemagick-6.8.9.9/debian/patches/0052-Fixed-usage-of-object-after-it-has-been-destroyed-an.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0052-Fixed-usage-of-object-after-it-has-been-destroyed-an.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,62 @@
+From 37ec7d53dcb99fbd1f5c33442594d5e279630563 Mon Sep 17 00:00:00 2001
+From: dirk <dirk@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Thu, 18 Dec 2014 20:37:35 +0000
+Subject: [PATCH] Fixed usage of object after it has been destroyed and removed
+ unused argument.
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17332 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin:  http://trac.imagemagick.org/changeset/17332 and http://trac.imagemagick.org/changeset/17334
+---
+ magick/distribute-cache.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/magick/distribute-cache.c b/magick/distribute-cache.c
+index 456d2eb..722314d 100644
+--- a/magick/distribute-cache.c
++++ b/magick/distribute-cache.c
+@@ -326,12 +326,15 @@ MagickPrivate DistributeCacheInfo *AcquireDistributeCacheInfo(
+   session_key=0;
+   server_info->file=ConnectPixelCacheServer(hostname,server_info->port,
+     &session_key,exception);
+-  server_info->session_key=session_key;
+-  (void) CopyMagickString(server_info->hostname,hostname,MaxTextExtent);
+-  hostname=DestroyString(hostname);
+   if (server_info->file == -1)
+     server_info=DestroyDistributeCacheInfo(server_info);
+-  server_info->debug=IsEventLogging();
++  else
++    {
++      server_info->session_key=session_key;
++      (void) CopyMagickString(server_info->hostname,hostname,MaxTextExtent);
++      server_info->debug=IsEventLogging();
++    }
++  hostname=DestroyString(hostname);
+   return(server_info);
+ }
+ 
+@@ -398,12 +401,11 @@ MagickPrivate DistributeCacheInfo *DestroyDistributeCacheInfo(
+ */
+ 
+ static MagickBooleanType DestroyDistributeCache(SplayTreeInfo *registry,
+-  int magick_unused(file),const size_t session_key)
++  const size_t session_key)
+ {
+   /*
+     Destroy distributed pixel cache.
+   */
+-  magick_unreferenced(file);
+   return(DeleteNodeFromSplayTree(registry,(const void *) session_key));
+ }
+ 
+@@ -829,7 +831,7 @@ static void *DistributePixelCacheClient(void *socket)
+       }
+       case 'd':
+       {
+-        status=DestroyDistributeCache(registry,client_socket,session_key);
++        status=DestroyDistributeCache(registry,session_key);
+         break;
+       }
+       default:
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0053-Create-IsValidColormapIndex-function.patch imagemagick-6.8.9.9/debian/patches/0053-Create-IsValidColormapIndex-function.patch
--- imagemagick-6.8.9.9/debian/patches/0053-Create-IsValidColormapIndex-function.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0053-Create-IsValidColormapIndex-function.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,41 @@
+From 56bd777c614253bc6ad4dca20e109be6ab61df48 Mon Sep 17 00:00:00 2001
+From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Sun, 21 Dec 2014 23:32:33 +0000
+Subject: [PATCH] Create IsValidColormapIndex function
+
+This function will be used to avoid a memory leak in rle.
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17379 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin: http://trac.imagemagick.org/changeset/17379 and http://trac.imagemagick.org/changeset/17382
+---
+ magick/colormap-private.h | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/magick/colormap-private.h b/magick/colormap-private.h
+index 03c0b67..41da718 100644
+--- a/magick/colormap-private.h
++++ b/magick/colormap-private.h
+@@ -36,6 +36,20 @@ static inline IndexPacket ConstrainColormapIndex(Image *image,
+   return((IndexPacket) 0);
+ }
+ 
++static inline MagickBooleanType IsValidColormapIndex(Image *image,
++  const ssize_t index,IndexPacket *target,ExceptionInfo *exception)
++{
++  if ((index < 0) || (index >= (ssize_t) image->colors))
++    {
++      (void) ThrowMagickException(exception,GetMagickModule(),CorruptImageError,
++        "InvalidColormapIndex","`%s'",image->filename);
++      *target=(IndexPacket) 0;
++      return(MagickFalse);
++    }
++  *target=(IndexPacket) index;
++  return(MagickTrue);
++}
++
+ #if defined(__cplusplus) || defined(c_plusplus)
+ }
+ #endif
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0054-Replaced-calls-to-ConstrainColormapIndex-with-IsVali.patch imagemagick-6.8.9.9/debian/patches/0054-Replaced-calls-to-ConstrainColormapIndex-with-IsVali.patch
--- imagemagick-6.8.9.9/debian/patches/0054-Replaced-calls-to-ConstrainColormapIndex-with-IsVali.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0054-Replaced-calls-to-ConstrainColormapIndex-with-IsVali.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,106 @@
+From 6055ec3af7254dc188ccbac418093cbc6f19344b Mon Sep 17 00:00:00 2001
+From: dirk <dirk@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Mon, 22 Dec 2014 01:26:10 +0000
+Subject: [PATCH] Replaced calls to ConstrainColormapIndex with
+ IsValidColormapIndex.
+
+Avoid a memory leak.
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17385 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin: http://trac.imagemagick.org/changeset/17385
+---
+ coders/rle.c | 41 ++++++++++++++++++++++++++++++-----------
+ 1 file changed, 30 insertions(+), 11 deletions(-)
+
+diff --git a/coders/rle.c b/coders/rle.c
+index 8d50b7e..74f4968 100644
+--- a/coders/rle.c
++++ b/coders/rle.c
+@@ -147,6 +147,9 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
+   Image
+     *image;
+ 
++  IndexPacket
++    index;
++
+   int
+     opcode,
+     operand,
+@@ -440,9 +443,6 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
+     } while (((opcode & 0x3f) != EOFOp) && (opcode != EOF));
+     if (number_colormaps != 0)
+       {
+-        IndexPacket
+-          index;
+-
+         MagickStatusType
+           mask;
+ 
+@@ -451,10 +451,13 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
+         */
+         mask=(MagickStatusType) (map_length-1);
+         p=pixels;
++        x=(ssize_t) number_planes;
+         if (number_colormaps == 1)
+           for (i=0; i < (ssize_t) number_pixels; i++)
+           {
+-            index=ConstrainColormapIndex(image,*p & mask);
++            if (IsValidColormapIndex(image,*p & mask,&index,exception) ==
++                MagickFalse)
++              break;
+             *p=colormap[index];
+             p++;
+           }
+@@ -463,10 +466,18 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
+             for (i=0; i < (ssize_t) number_pixels; i++)
+               for (x=0; x < (ssize_t) number_planes; x++)
+               {
+-                index=ConstrainColormapIndex(image,x*map_length+(*p & mask));
++                if (IsValidColormapIndex(image,(size_t) (x*map_length+
++                    (*p & mask)),&index,exception) == MagickFalse)
++                  break;
+                 *p=colormap[index];
+                 p++;
+               }
++        if ((i < (ssize_t) number_pixels) || (x < (ssize_t) number_planes))
++          {
++            colormap=(unsigned char *) RelinquishMagickMemory(colormap);
++            pixel_info=RelinquishVirtualMemory(pixel_info);
++            ThrowReaderException(CorruptImageError,"UnableToReadImageData");
++          }
+       }
+     /*
+       Initialize image structure.
+@@ -569,15 +580,23 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
+                 break;
+               for (x=0; x < (ssize_t) image->columns; x++)
+               {
+-                SetPixelRed(q,image->colormap[(ssize_t)
+-                  ConstrainColormapIndex(image,*p++)].red);
+-                SetPixelGreen(q,image->colormap[(ssize_t)
+-                  ConstrainColormapIndex(image,*p++)].green);
+-                SetPixelBlue(q,image->colormap[(ssize_t)
+-                  ConstrainColormapIndex(image,*p++)].blue);
++                if (IsValidColormapIndex(image,*p++,&index,exception) ==
++                    MagickFalse)
++                  break;
++                SetPixelRed(q,image->colormap[(ssize_t) index].red);
++                if (IsValidColormapIndex(image,*p++,&index,exception) ==
++                    MagickFalse)
++                  break;
++                SetPixelGreen(q,image->colormap[(ssize_t) index].green);
++                if (IsValidColormapIndex(image,*p++,&index,exception) ==
++                    MagickFalse)
++                  break;
++                SetPixelBlue(q,image->colormap[(ssize_t) index].blue);
+                 SetPixelAlpha(q,ScaleCharToQuantum(*p++));
+                 q++;
+               }
++              if (x < (ssize_t) image->columns)
++                break;
+               if (SyncAuthenticPixels(image,exception) == MagickFalse)
+                 break;
+               if (image->previous == (Image *) NULL)
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/0055-During-identification-of-image-do-not-fill-memory.patch imagemagick-6.8.9.9/debian/patches/0055-During-identification-of-image-do-not-fill-memory.patch
--- imagemagick-6.8.9.9/debian/patches/0055-During-identification-of-image-do-not-fill-memory.patch	1970-01-01 01:00:00.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/0055-During-identification-of-image-do-not-fill-memory.patch	2014-12-23 22:44:25.000000000 +0100
@@ -0,0 +1,30 @@
+From 5ee6f49297c8137cae527429e0267462c14ec3ed Mon Sep 17 00:00:00 2001
+From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
+Date: Tue, 23 Dec 2014 01:25:22 +0000
+Subject: [PATCH] During identification of image do not fill memory
+
+This create a security risk (DOS) by filling all memory during identification of image.
+
+git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17413 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
+origin: http://trac.imagemagick.org/changeset/17413
+---
+ coders/tiff.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/coders/tiff.c b/coders/tiff.c
+index 1fe12fe..79033a6 100644
+--- a/coders/tiff.c
++++ b/coders/tiff.c
+@@ -1134,7 +1134,8 @@ RestoreMSCWarning
+       SetImageColorspace(image,CMYKColorspace);
+     if (photometric == PHOTOMETRIC_CIELAB)
+       SetImageColorspace(image,LabColorspace);
+-    TIFFGetProfiles(tiff,image);
++    if (image_info->ping == MagickFalse)
++      TIFFGetProfiles(tiff,image);
+     TIFFGetProperties(tiff,image);
+     option=GetImageOption(image_info,"tiff:exif-properties");
+     if ((option == (const char *) NULL) ||
+-- 
+2.0.1
+
diff -Nru imagemagick-6.8.9.9/debian/patches/series imagemagick-6.8.9.9/debian/patches/series
--- imagemagick-6.8.9.9/debian/patches/series	2014-11-15 14:47:57.000000000 +0100
+++ imagemagick-6.8.9.9/debian/patches/series	2014-12-23 22:44:25.000000000 +0100
@@ -4,3 +4,53 @@
 0003-Fix-meta-tag-damage-in-html-documentation.patch
 0004-Fix-remaining-html-error.patch
 0005-Avoid-crash-and-DOS-with-special-crafted-jpeg-file.patch
+0006-Avoid-an-infinite-loop.patch
+0007-Quit-earlier-in-case-of-corrupted-pnm-image.patch
+0008-Added-missing-calls-to-RelinquishUniqueFileResource.patch
+0009-Fix-a-double-free-in-pdb-coder.patch
+0010-Fix-handling-of-corrupted-dpc-and-xwd-image.patch
+0011-Bail-out-early-in-case-of-malformed-dpx-file.patch
+0012-Avoid-SEGV-in-malformed-xwd-file.patch
+0013-Avoid-a-NULL-dereference-in-ps-handling.patch
+0014-Avoid-out-of-bound-access-in-xwd-file-handling.patch
+0015-Fix-a-SEGV-with-corrupted-viff-image.patch
+0016-Fix-a-null-pointer-dereference-in-wpg-file-handling.patch
+0017-Do-not-continue-on-corrupted-wpg-file.patch
+0018-Avoid-a-out-of-bound-acess-in-viff-image.patch
+0019-Avoid-a-heap-buffer-overflow-in-pdb-file-handling.patch
+0020-Avoid-an-out-of-bound-acess-on-malformed-sun-file.patch
+0021-Avoid-heap-overflow-in-palm-pnm-and-xpm-files.patch
+0022-Fix-heap-overflow-in-quantum.c-palm-image-handling-a.patch
+0023-Fix-compile-problem-due-to-previous-patch.patch
+0024-Do-not-try-to-read-corrupted-sun-image.patch
+0025-Fix-handling-of-corrupted-of-psd-sun-and-xpm-file.patch
+0026-Fix-corrupted-too-many-colors-psd-file.patch
+0027-Fix-out-of-bound-access-in-sun-image-handling.patch
+0028-Fix-ImageMagick-crashes-while-read-EXIF-from-TIFF.patch
+0029-Fix-handling-of-corrupted-sun-and-wpg-file.patch
+0030-Fix-heap-overflow-in-pcx-file-psd-pict-and-wpf-files.patch
+0031-Fix-compile-error-in-previous-fix-of-sun-file.patch
+0032-Additional-PNM-sanity-checks.patch
+0033-Robustify-xmp-and-pnm-reader.patch
+0034-Detect-allocation-error-earlier.patch
+0035-Avoid-a-crash-in-coders-rle.c.patch
+0036-Avoid-an-overflow-in-ConstrainColormapIndex.patch
+0037-Avoid-an-out-of-bound-access-in-palm-file.patch
+0038-Fix-another-crash-in-pnm-and-xpm-parser.patch
+0039-Fixed-throwing-of-exceptions-in-psd-handling-and-fix.patch
+0040-Fixed-boundary-checks-in-DecodePSDPixels.patch
+0041-Fix-another-out-of-bound-problem-in-rle-file.patch
+0042-Fix-crash-due-to-corrupted-dib-file.patch
+0043-Added-checks-to-prevent-overflow-in-rle-file.patch
+0044-Impose-a-limit-of-10-million-columns-or-rows-in-an-i.patch
+0045-Avoid-heap-overflow-in-rle-file.patch
+0046-Don-t-try-to-handle-a-previous-image-in-the-JNG-deco.patch
+0047-Avoid-a-memory-leak-in-quantum-management.patch
+0048-Avoid-a-crash-in-png-coder.patch
+0049-Avoid-heap-overflow.patch
+0050-Thread-limit-should-be-at-least-1.patch
+0051-Fixed-parsing-resource-block.patch
+0052-Fixed-usage-of-object-after-it-has-been-destroyed-an.patch
+0053-Create-IsValidColormapIndex-function.patch
+0054-Replaced-calls-to-ConstrainColormapIndex-with-IsVali.patch
+0055-During-identification-of-image-do-not-fill-memory.patch
