https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6073

diff --git a/MagickCore/profile.c b/MagickCore/profile.c
index 15211745d31c9e96a6a2f7085c39661db20d3a51..f9257ea58a5ad3a0a5836589be411486cf9ee145 100644 (file)
--- a/MagickCore/profile.c
+++ b/MagickCore/profile.c
@@ -1834,7 +1834,7 @@ static MagickBooleanType Sync8BimProfile(Image *image,StringInfo *profile)
       return(MagickFalse);
     id=ReadProfileMSBShort(&p,&length);
     count=(ssize_t) ReadProfileByte(&p,&length);
-    if ((count > (ssize_t) length) || (count < 0))
+    if ((count >= (ssize_t) length) || (count < 0))
       return(MagickFalse);
     p+=count;
     length-=count;