https://github.com/ImageMagick/ImageMagick/issues/1249

diff --git a/coders/psd.c b/coders/psd.c
index 41456cd122588e221d87edde98d10373427befbd..2dff0ce3e17223a684ddf5cd3359c7509ecd64ca 100644 (file)
--- a/coders/psd.c
+++ b/coders/psd.c
@@ -790,7 +790,7 @@ static StringInfo *ParseImageResourceBlocks(Image *image,
     if (p > (blocks+length-4))
       break;
     p=PushLongPixel(MSBEndian,p,&count);
-    if ((p+count) > (blocks+length))
+    if (((p+count) < blocks) || ((p+count) > (blocks+length)))
       break;
     switch (id)
     {