Fixed length check.

diff --git a/coders/psd.c b/coders/psd.c
index eb107f47e57f1e3826cf97a4d35ab5bc551da86b..a516f37c7c5e2e993fd97c0cdf4c414ec2f6e77b 100644 (file)
--- a/coders/psd.c
+++ b/coders/psd.c
@@ -2566,11 +2566,14 @@ static void RemoveICCProfileFromResourceBlock(StringInfo *bim_profile)
     p=PushLongPixel(MSBEndian,p,&count);
     if (id == 0x0000040f)
       {
-        if ((q+PSDQuantum(count)+12) < (datum+length-16))
+        ssize_t
+          quantum;
+
+        quantum=PSDQuantum(count)+12;
+        if ((quantum >= 12) && (q+quantum < (datum+length-16)))
           {
-            (void) CopyMagickMemory(q,q+PSDQuantum(count)+12,length-
-              (PSDQuantum(count)+12)-(q-datum));
-            SetStringInfoLength(bim_profile,length-(PSDQuantum(count)+12));
+            (void) CopyMagickMemory(q,q+quantum,length-quantum-(q-datum));
+            SetStringInfoLength(bim_profile,length-quantum);
           }
         break;
       }