===================================================================
RCS file: /GraphicsMagick/GraphicsMagick/coders/palm.c,v
retrieving revision 1.62
retrieving revision 1.62.2.1
diff -u -p -r1.62 -r1.62.2.1
--- GraphicsMagick/coders/palm.c	2003/10/11 18:38:35	1.62
+++ GraphicsMagick/coders/palm.c	2006/11/02 14:24:05	1.62.2.1
@@ -541,7 +541,7 @@ static Image *ReadPALMImage(const ImageI
         image->compression = RLECompression;
         for (i = 0; i < (long) bytes_per_row; )
           {
-          count = ReadBlobByte(image);
+          count = Min(ReadBlobByte(image), bytes_per_row-i);
           byte = ReadBlobByte(image);
           memset(one_row + i, (int) byte, count);
           i += count;
@@ -579,6 +579,8 @@ static Image *ReadPALMImage(const ImageI
     indexes=GetIndexes(image);
     if(bits_per_pixel == 16)
       {
+      if (image->columns > 2*bytes_per_row)
+        ThrowReaderException(CorruptImageError,CorruptImage,image);
       for (x=0; x < (long) image->columns; x++)
         {
         color16 = (*ptr++ << 8);
@@ -595,6 +597,8 @@ static Image *ReadPALMImage(const ImageI
       bit = 8 - bits_per_pixel;
       for(x = 0; x < (long) image->columns; x++)
         {
+	if (ptr - one_row >= bytes_per_row)
+          ThrowReaderException(CorruptImageError,CorruptImage,image);
         index =(IndexPacket) (mask - (((*ptr) & (mask << bit)) >> bit));
         indexes[x] = index;
         *q++ = image->colormap[index];