Merged from emacs@sv.gnu.org

Patches applied:

 * emacs@sv.gnu.org/emacs--devo--0--patch-660
   Update from CVS

 * emacs@sv.gnu.org/emacs--devo--0--patch-661
   Merge from gnus--rel--5.10

 * emacs@sv.gnu.org/emacs--devo--0--patch-662
   Update from CVS

 * emacs@sv.gnu.org/emacs--devo--0--patch-663
   Update from CVS

 * emacs@sv.gnu.org/emacs--devo--0--patch-664
   Update from CVS

 * emacs@sv.gnu.org/emacs--devo--0--patch-665
   Update from CVS

 * emacs@sv.gnu.org/emacs--devo--0--patch-666
   Fix read-only prompt problem in isearch

 * emacs@sv.gnu.org/emacs--devo--0--patch-667
   Update from CVS

 * emacs@sv.gnu.org/emacs--devo--0--patch-668
   Update from CVS

 * emacs@sv.gnu.org/emacs--devo--0--patch-669
   Merge from gnus--rel--5.10

 * emacs@sv.gnu.org/emacs--devo--0--patch-670
   Update from CVS

 * emacs@sv.gnu.org/emacs--devo--0--patch-671
   Update from CVS

 * emacs@sv.gnu.org/emacs--devo--0--patch-672
   Update from CVS

 * emacs@sv.gnu.org/emacs--devo--0--patch-673
   Update from CVS

 * emacs@sv.gnu.org/gnus--rel--5.10--patch-206
   Merge from emacs--devo--0

 * emacs@sv.gnu.org/gnus--rel--5.10--patch-207
   Merge from emacs--devo--0

 * emacs@sv.gnu.org/gnus--rel--5.10--patch-208
   Update from CVS

git-archimport-id: lorentey@elte.hu--2004/emacs--multi-tty--0--patch-600

1 files changed, 8 insertions, 0 deletions

diff --git a/src/image.c b/src/image.c
index 49d25d819bc..198ffaf4651 100644
--- a/src/image.c
+++ b/src/image.c
@@ -5744,6 +5744,14 @@ pbm_load (f, img)
     }
   else
     {
+      if (raw_p && (p + 3 * height * width > end))
+        {
+          x_destroy_x_image (ximg);
+          image_error ("Invalid image size in image `%s'",
+                       img->spec, Qnil);
+          goto error;
+        }
+
       for (y = 0; y < height; ++y)
         for (x = 0; x < width; ++x)
           {