(no commit message)

diff --git a/MagickCore/profile.c b/MagickCore/profile.c
index a046c708ae5bf21e3ba6462ad47836e220f99b8c..901ce2c456204196c75eb53c16a830f5618b50f1 100644 (file)
--- a/MagickCore/profile.c
+++ b/MagickCore/profile.c
@@ -6658,7 +6658,7 @@ MagickPrivate MagickBooleanType SyncImageProfiles(Image *image)
     This the offset to the first IFD.
   */
   offset=(ssize_t) ((int) ReadProfileLong(endian,exif+4));
-  if ((size_t) offset >= length)
+  if ((offset < 0) || (size_t) offset >= length)
     return(MagickFalse);
   directory=exif+offset;
   level=0;

diff --git a/MagickCore/property.c b/MagickCore/property.c
index 07e201a4e84a916fbd996e24c52778143fab829a..ecd6c5a203666f4bf0a9075725181a6831d65af0 100644 (file)
--- a/MagickCore/property.c
+++ b/MagickCore/property.c
@@ -1257,7 +1257,7 @@ static MagickBooleanType GetEXIFProperty(const Image *image,
     This the offset to the first IFD.
   */
   offset=(ssize_t) ((int) ReadPropertyLong(endian,exif+4));
-  if ((size_t) offset >= length)
+  if ((offset < 0) || (size_t) offset >= length)
     return(MagickFalse);
   /*
     Set the pointer to the first IFD and follow it were it leads.