(no commit message)

diff --git a/ChangeLog b/ChangeLog
index 8f05fbec791a822547a25d64ef0f6568a46b833e..9de12968cc78273657edf816a6c815c31f236c51 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,6 @@
+2011-06-18  6.7.0-9 Cristy  <quetzlzacatenango@image...>
+  * Defend against corrupt PSD resource blocks.
+
 2011-06-15  6.7.0-8 Cristy  <quetzlzacatenango@image...>
   * New version 6.7.0-8.
 

diff --git a/coders/psd.c b/coders/psd.c
index a25f245e446ae00239780696a7d9ac1c47d2f932..892a9d2b2756f1461e58ec2633476053c431374a 100644 (file)
--- a/coders/psd.c
+++ b/coders/psd.c
@@ -2024,7 +2024,7 @@ static void RemoveResolutionFromResourceBlock(StringInfo *bim_profile)
     p=PushShortPixel(MSBEndian,p,&id);
     p=PushShortPixel(MSBEndian,p,&short_sans);
     p=PushLongPixel(MSBEndian,p,&count);
-    if (id == 0x000003ed)
+    if ((id == 0x000003ed) && (PSDQuantum(count) < (length-12)))
       {
         (void) CopyMagickMemory(q,q+PSDQuantum(count)+12,length-
           (PSDQuantum(count)+12)-(q-datum));