Check "count" return while reading the JNG signature.

diff --git a/coders/png.c b/coders/png.c
index 5ae188c1aa271396a5693441e81bb5177ba75942..4cdd673fb813b4cb3e3b069e9845922c721436d2 100644 (file)
--- a/coders/png.c
+++ b/coders/png.c
@@ -3965,9 +3965,8 @@ static Image *ReadJNGImage(const ImageInfo *image_info,ExceptionInfo *exception)
   /* Verify JNG signature.  */
 
   count=(size_t) ReadBlob(image,8,(unsigned char *) magic_number);
-  (void) count;
 
-  if (memcmp(magic_number,"\213JNG\r\n\032\n",8) != 0)
+  if (count < 8 || memcmp(magic_number,"\213JNG\r\n\032\n",8) != 0)
     ThrowReaderException(CorruptImageError,"ImproperImageHeader");
 
   /* Allocate a MngInfo structure.  */