...

diff --git a/coders/mpc.c b/coders/mpc.c
index 41b469b94cdccd49d8e63a9ea85026da1263b7bc..55fd83d4734c4b0b58ba8688f44abaa5cea76cc8 100644 (file)
--- a/coders/mpc.c
+++ b/coders/mpc.c
@@ -184,9 +184,6 @@ static Image *ReadMPCImage(const ImageInfo *image_info,ExceptionInfo *exception)
   ssize_t
     count;
 
-  StringInfo
-    *profile;
-
   unsigned int
     signature;
 
@@ -628,21 +625,19 @@ static Image *ReadMPCImage(const ImageInfo *image_info,ExceptionInfo *exception)
                 if ((LocaleNCompare(keyword,"profile:",8) == 0) ||
                     (LocaleNCompare(keyword,"profile-",8) == 0))
                   {
-                    size_t
-                      length;
+                    StringInfo
+                      *profile;
 
-                    if (profiles == (LinkedListInfo *) NULL)
-                      profiles=NewLinkedList(0);
-                    (void) AppendValueToLinkedList(profiles,
-                      AcquireString(keyword+8));
-                    if (length > sizeof(keyword)-8)
+                    if ((MagickSizeType) StringToLong(options) > GetBlobSize(image))
                       {
                         options=DestroyString(options);
-                        profiles=DestroyLinkedList(profiles,
-                          RelinquishMagickMemory);
                         ThrowReaderException(CorruptImageError,
-                          "ImproperImageHeader");
+                          "InsufficientImageDataInFile");
                       }
+                    if (profiles == (LinkedListInfo *) NULL)
+                      profiles=NewLinkedList(0);
+                    (void) AppendValueToLinkedList(profiles,
+                      AcquireString(keyword+8));
                     profile=BlobToStringInfo((const void *) NULL,length);
                     if (profile == (StringInfo *) NULL)
                       {