...

diff --git a/coders/meta.c b/coders/meta.c
index 11fb53a0098aaef672fe046c00d8fee5f4c5e3de..ec4d5d49f6d4efda7c98e672017623f2a4c74bd5 100644 (file)
--- a/coders/meta.c
+++ b/coders/meta.c
@@ -2198,12 +2198,12 @@ static int format8BIM(Image *ifile, Image *ofile)
       }
     }
     count=(ssize_t) ReadBlobMSBSignedLong(ifile);
-    if (count < 0)
+    if ((count < 0) || (count > GetBlobSize(ifile)))
       {
         PString=(unsigned char *) RelinquishMagickMemory(PString);
         return -1;
       }
-    /* make a buffer to hold the datand snag it from the input stream */
+    /* make a buffer to hold the data and snag it from the input stream */
     str=(unsigned char *) AcquireQuantumMemory((size_t) count,sizeof(*str));
     if (str == (unsigned char *) NULL)
       {