File ImageMagick-CVE-2014-9833,9825.patch of Package ImageMagick.6152

Index: ImageMagick-6.8.9-8/coders/psd.c
===================================================================
--- ImageMagick-6.8.9-8.orig/coders/psd.c	2016-06-21 11:08:07.266877994 +0200
+++ ImageMagick-6.8.9-8/coders/psd.c	2016-06-21 11:17:13.247644477 +0200
@@ -50,6 +50,7 @@
 #include "magick/cache.h"
 #include "magick/channel.h"
 #include "magick/colormap.h"
+#include "magick/colormap-private.h"
 #include "magick/colorspace.h"
 #include "magick/colorspace-private.h"
 #include "magick/constitute.h"
@@ -722,7 +723,7 @@ static MagickStatusType ReadPSDChannelPi
             else
               SetPixelIndex(indexes+x,ScaleQuantumToShort(pixel))
             SetPixelRGBO(q,image->colormap+(ssize_t)
-              GetPixelIndex(indexes+x));
+              ConstrainColormapIndex(image,GetPixelIndex(indexes+x)));
             if (image->depth == 1)
               {
                 ssize_t
@@ -810,7 +811,7 @@ static MagickStatusType ReadPSDChannelRa
        "      layer data is RAW");
 
   row_size=GetPSDRowSize(image);
-  pixels=(unsigned char *) AcquireQuantumMemory(row_size,sizeof(*pixels));
+  pixels=(unsigned char *) AcquireQuantumMemory(row_size,8*sizeof(*pixels));
   if (pixels == (unsigned char *) NULL)
     ThrowBinaryException(ResourceLimitError,"MemoryAllocationFailed",
       image->filename);
@@ -879,7 +880,7 @@ static MagickStatusType ReadPSDChannelRL
        "      layer data is RLE compressed");
 
   row_size=GetPSDRowSize(image);
-  pixels=(unsigned char *) AcquireQuantumMemory(row_size,sizeof(*pixels));
+  pixels=(unsigned char *) AcquireQuantumMemory(row_size,8*sizeof(*pixels));
   if (pixels == (unsigned char *) NULL)
     ThrowBinaryException(ResourceLimitError,"MemoryAllocationFailed",
       image->filename);
@@ -889,7 +890,7 @@ static MagickStatusType ReadPSDChannelRL
     if ((MagickOffsetType) length < offsets[y])
       length=(size_t) offsets[y];
 
-  compact_pixels=(unsigned char *) AcquireQuantumMemory(length,sizeof(*pixels));
+  compact_pixels=(unsigned char *) AcquireQuantumMemory(length,8*sizeof(*pixels));
   if (compact_pixels == (unsigned char *) NULL)
     {
       pixels=(unsigned char *) RelinquishMagickMemory(pixels);