https://github.com/ImageMagick/ImageMagick/issues/705

diff --git a/coders/thumbnail.c b/coders/thumbnail.c
index 85f42a36f22d648ee59dd58bd59850b64a50a101..e129ff04e1c195ef6a5b8b4e7223ef30457785d0 100644 (file)
--- a/coders/thumbnail.c
+++ b/coders/thumbnail.c
@@ -193,6 +193,8 @@ static MagickBooleanType WriteTHUMBNAILImage(const ImageInfo *image_info,
   (void) ResetMagickMemory(magick,0,sizeof(magick));
   for (i=0; i < (ssize_t) length; i++)
   {
+    if ((offset+i) >= GetStringInfoLength(profile))
+      break;
     magick[0]=magick[1];
     magick[1]=magick[2];
     magick[2]=GetStringInfoDatum(profile)[offset+i];