]> granicus.if.org Git - imagemagick/commitdiff
Fixed length check.
authordirk <dirk@git.imagemagick.org>
Thu, 2 Jun 2016 19:32:29 +0000 (21:32 +0200)
committerdirk <dirk@git.imagemagick.org>
Thu, 2 Jun 2016 19:33:18 +0000 (21:33 +0200)
coders/psd.c

index eb107f47e57f1e3826cf97a4d35ab5bc551da86b..a516f37c7c5e2e993fd97c0cdf4c414ec2f6e77b 100644 (file)
@@ -2566,11 +2566,14 @@ static void RemoveICCProfileFromResourceBlock(StringInfo *bim_profile)
     p=PushLongPixel(MSBEndian,p,&count);
     if (id == 0x0000040f)
       {
-        if ((q+PSDQuantum(count)+12) < (datum+length-16))
+        ssize_t
+          quantum;
+
+        quantum=PSDQuantum(count)+12;
+        if ((quantum >= 12) && (q+quantum < (datum+length-16)))
           {
-            (void) CopyMagickMemory(q,q+PSDQuantum(count)+12,length-
-              (PSDQuantum(count)+12)-(q-datum));
-            SetStringInfoLength(bim_profile,length-(PSDQuantum(count)+12));
+            (void) CopyMagickMemory(q,q+quantum,length-quantum-(q-datum));
+            SetStringInfoLength(bim_profile,length-quantum);
           }
         break;
       }