https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17974

diff --git a/coders/jpeg.c b/coders/jpeg.c
index ecb021ffb89637efc12ae2a6af90d6fc7da2ad4c..82299885d327336ca498e48eee93b38df13e75be 100644 (file)
--- a/coders/jpeg.c
+++ b/coders/jpeg.c
@@ -805,26 +805,27 @@ static boolean ReadProfile(j_decompress_ptr jpeg_info)
       p=GetStringInfoDatum(profile);
       if ((length > 4) && (LocaleNCompare((char *) p,"exif",4) == 0))
         (void) CopyMagickString(name,"exif",MagickPathExtent);
-      else if ((length > XmpNamespaceExtent) &&
-          (LocaleNCompare((char *) p,xmp_namespace,XmpNamespaceExtent-1) == 0))
-        {
-          ssize_t
-            j;
-
-          /*
-            Extract namespace from XMP profile.
-          */
-          p=GetStringInfoDatum(profile)+XmpNamespaceExtent;
-          for (j=XmpNamespaceExtent; j < (ssize_t) GetStringInfoLength(profile); j++)
+      else
+        if ((length > XmpNamespaceExtent) &&
+            (LocaleNCompare((char *) p,xmp_namespace,XmpNamespaceExtent-1) == 0))
           {
-            if (*p == '\0')
-              break;
-            p++;
+            ssize_t
+              j;
+
+            /*
+              Extract namespace from XMP profile.
+            */
+            p=GetStringInfoDatum(profile)+XmpNamespaceExtent;
+            for (j=XmpNamespaceExtent; j < (ssize_t) GetStringInfoLength(profile); j++)
+            {
+              if (*p == '\0')
+                break;
+              p++;
+            }
+            if (j < (ssize_t) GetStringInfoLength(profile))
+              (void) DestroyStringInfo(SplitStringInfo(profile,(size_t) (j+1)));
+            (void) CopyMagickString(name,"xmp",MagickPathExtent);
           }
-          if (j < (ssize_t) GetStringInfoLength(profile))
-            (void) DestroyStringInfo(SplitStringInfo(profile,(size_t) (j+1)));
-          (void) CopyMagickString(name,"xmp",MagickPathExtent);
-        }
     }
   previous_profile=GetImageProfile(image,name);
   if ((previous_profile != (const StringInfo *) NULL) &&
@@ -842,6 +843,7 @@ static boolean ReadProfile(j_decompress_ptr jpeg_info)
       (void) memcpy(GetStringInfoDatum(profile),
         GetStringInfoDatum(previous_profile),
         GetStringInfoLength(previous_profile));
+      GetStringInfoDatum(profile)[GetStringInfoLength(profile)]='\0';
     }
   status=SetImageProfile(image,name,profile,exception);
   profile=DestroyStringInfo(profile);