Added boundary checks in DecodePSDPixels

diff --git a/coders/psd.c b/coders/psd.c
index 3a7e5b6dcf33206d903364e8b27396faf81a3183..64a0dbd700858155f089d515cd2b5e7e1b4fec90 100644 (file)
--- a/coders/psd.c
+++ b/coders/psd.c
@@ -332,13 +332,15 @@ static ssize_t DecodePSDPixels(const size_t number_compact_pixels,
   packets=(ssize_t) number_compact_pixels;
   for (i=0; (packets > 1) && (i < (ssize_t) number_pixels); )
   {
-    length=(*compact_pixels++);
+    length=(size_t) (*compact_pixels++);
     packets--;
     if (length == 128)
       continue;
     if (length > 128)
       {
         length=256-length+1;
+        if ((ssize_t) length + i > (ssize_t) number_pixels)
+          length=number_pixels-(size_t) i;
         pixel=(*compact_pixels++);
         packets--;
         for (j=0; j < (ssize_t) length; j++)
@@ -385,6 +387,8 @@ static ssize_t DecodePSDPixels(const size_t number_compact_pixels,
         continue;
       }
     length++;
+    if ((ssize_t) length + i > (ssize_t) number_pixels)
+      length=number_pixels-(size_t) i;
     for (j=0; j < (ssize_t) length; j++)
     {
       switch (depth)