https://github.com/ImageMagick/ImageMagick/issues/906

diff --git a/coders/png.c b/coders/png.c
index 3b6b186bcc1c1465e044914d0a712c5b4882fbc0..e36b3cadf8422c89fe8bd72d01e2f0c326b73016 100644 (file)
--- a/coders/png.c
+++ b/coders/png.c
@@ -5882,7 +5882,7 @@ static Image *ReadOneMNGImage(MngInfo* mng_info, const ImageInfo *image_info,
 
                 p++; /* framing mode */
 
-                while (*p && ((p-chunk) < (ssize_t) length))
+                while (*p && ((p-chunk) < (ssize_t) length-1))
                   p++;  /* frame name */
 
                 p++;  /* frame name terminator */