File ImageMagick-CVE-2014-9833,9825.patch of Package ImageMagick.9293

Index: ImageMagick-6.8.8-1/coders/psd.c
===================================================================
--- ImageMagick-6.8.8-1.orig/coders/psd.c	2016-06-21 11:18:03.040443865 +0200
+++ ImageMagick-6.8.8-1/coders/psd.c	2016-06-21 11:19:22.989727418 +0200
@@ -48,6 +48,7 @@
 #include "magick/blob-private.h"
 #include "magick/cache.h"
 #include "magick/colormap.h"
+#include "magick/colormap-private.h"
 #include "magick/colorspace.h"
 #include "magick/colorspace-private.h"
 #include "magick/constitute.h"
@@ -691,7 +692,7 @@ static MagickStatusType ReadPSDChannelPi
             else
               SetPixelIndex(indexes+x,ScaleQuantumToShort(pixel));
             SetPixelRGBO(q,image->colormap+(ssize_t)
-              GetPixelIndex(indexes+x));
+              ConstrainColormapIndex(image,GetPixelIndex(indexes+x)));
             if (image->depth == 1)
               {
                 ssize_t
@@ -777,7 +778,7 @@ static MagickStatusType ReadPSDChannelRa
        "      layer data is RAW");
 
   row_size=GetPSDRowSize(image);
-  pixels=(unsigned char *) AcquireQuantumMemory(row_size,sizeof(*pixels));
+  pixels=(unsigned char *) AcquireQuantumMemory(row_size,8*sizeof(*pixels));
   if (pixels == (unsigned char *) NULL)
     ThrowBinaryException(ResourceLimitError,"MemoryAllocationFailed",
       image->filename);
@@ -846,7 +847,7 @@ static MagickStatusType ReadPSDChannelRL
        "      layer data is RLE compressed");
 
   row_size=GetPSDRowSize(image);
-  pixels=(unsigned char *) AcquireQuantumMemory(row_size,sizeof(*pixels));
+  pixels=(unsigned char *) AcquireQuantumMemory(row_size,8*sizeof(*pixels));
   if (pixels == (unsigned char *) NULL)
     ThrowBinaryException(ResourceLimitError,"MemoryAllocationFailed",
       image->filename);
@@ -857,7 +858,7 @@ static MagickStatusType ReadPSDChannelRL
       length=(size_t) offsets[y];
 
   compact_pixels=(unsigned char *) AcquireQuantumMemory(length,
-    sizeof(*pixels));
+    8*sizeof(*pixels));
   if (compact_pixels == (unsigned char *) NULL)
     {
       pixels=(unsigned char *) RelinquishMagickMemory(pixels);