(no commit message)

diff --git a/coders/psd.c b/coders/psd.c
index f33aad8b1bc9f509dbaf67604bafd7f8686c0b87..1565b624414fc080f03e42e88757ead5d5611156 100644 (file)
--- a/coders/psd.c
+++ b/coders/psd.c
@@ -969,6 +969,10 @@ static Image *ReadPSDImage(const ImageInfo *image_info,ExceptionInfo *exception)
               (ReadBlobMSBLong(image)-layer_info[i].page.y);
             layer_info[i].page.width=(unsigned long)
               (ReadBlobMSBLong(image)-layer_info[i].page.x);
+            if (layer_info[i].page.height > 300000)
+              layer_info[i].page.height+=4294967295UL;
+            if (layer_info[i].page.width > 300000)
+              layer_info[i].page.width+=4294967295UL;
             layer_info[i].channels=ReadBlobMSBShort(image);
             if (layer_info[i].channels > MaxPSDChannels)
               ThrowReaderException(CorruptImageError,"MaximumChannelsExceeded");
@@ -1030,6 +1034,10 @@ static Image *ReadPSDImage(const ImageInfo *image_info,ExceptionInfo *exception)
                       (ReadBlobMSBLong(image)-layer_info[i].mask.y);
                     layer_info[i].mask.width=(unsigned long)
                       (ReadBlobMSBLong(image)-layer_info[i].mask.x);
+                    if (layer_info[i].mask.height > 300000)
+                      layer_info[i].mask.height+=4294967295UL;
+                    if (layer_info[i].mask.width > 300000)
+                      layer_info[i].mask.width+=4294967295UL;
                     if (image->debug != MagickFalse)
                       (void) LogMagickEvent(CoderEvent,GetMagickModule(),
                         "      layer mask: offset(%ld,%ld), size(%ld,%ld), length=%ld",