]> granicus.if.org Git - imagemagick/commitdiff
Added missing decrement of length
authorDirk Lemstra <dirk@git.imagemagick.org>
Sat, 3 Feb 2018 09:59:52 +0000 (10:59 +0100)
committerDirk Lemstra <dirk@git.imagemagick.org>
Sat, 3 Feb 2018 09:59:52 +0000 (10:59 +0100)
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5334
Credit OSS Fuzz

MagickCore/profile.c

index 4ad7245fc8fc6d5587ffff5a148437dfb2f45015..7133225d46b03126e6c8ba695207d9c56786430b 100644 (file)
@@ -1856,6 +1856,7 @@ static MagickBooleanType Sync8BimProfile(Image *image,StringInfo *profile)
     if ((count > (ssize_t) length) || (count < 0))
       return(MagickFalse);
     p+=count;
+    length-=count;
     if ((*p & 0x01) == 0)
       (void) ReadProfileByte(&p,&length);
     count=(ssize_t) ReadProfileMSBLong(&p,&length);