https://github.com/ImageMagick/ImageMagick/issues/1386

diff --git a/coders/icon.c b/coders/icon.c
index fa35021cd5bae7ae12e268f5ef28e2bc31443ec5..e32c7392f8747e0d861b7971cf053122cf31e715 100644 (file)
--- a/coders/icon.c
+++ b/coders/icon.c
@@ -367,8 +367,8 @@ static Image *ReadICONImage(const ImageInfo *image_info,
         png[13]=(unsigned char) (icon_info.planes >> 8);
         png[14]=(unsigned char) icon_info.bits_per_pixel;
         png[15]=(unsigned char) (icon_info.bits_per_pixel >> 8);
-        count=ReadBlob(image,length,png+16);
-        if (count != (ssize_t) length)
+        count=ReadBlob(image,length-16,png+16);
+        if (count != (ssize_t) (length-16))
           {
             png=(unsigned char *) RelinquishMagickMemory(png);
             ThrowReaderException(CorruptImageError,