(no commit message)

diff --git a/MagickCore/blob.c b/MagickCore/blob.c
index e8e40e08a7c64f183f7eb211eb1abeb2eb2a6f6f..dbc0b03678e8f1d7ff0336b245b10de3a223f864 100644 (file)
--- a/MagickCore/blob.c
+++ b/MagickCore/blob.c
@@ -797,6 +797,8 @@ MagickExport MagickBooleanType DiscardBlobBytes(Image *image,
 
   assert(image != (Image *) NULL);
   assert(image->signature == MagickSignature);
+  if (length != (MagickSizeType) ((MagickOffsetType) length))
+    return(MagickFalse);
   count=0;
   for (i=0; i < (MagickOffsetType) length; i+=count)
   {

diff --git a/coders/psd.c b/coders/psd.c
index 1efae89facccf8f25c07d3763be41ad5fc502bb3..fe7c58e854b97bffafa31ae568d90163f30ded4d 100644 (file)
--- a/coders/psd.c
+++ b/coders/psd.c
@@ -1254,10 +1254,12 @@ ModuleExport MagickStatusType ReadPSDLayers(Image *image,
       quantum=psd_info->version == 1 ? 4UL : 8UL;
       (void) ReadBlobMSBLong(image);
       count=ReadBlob(image,4,(unsigned char *) type);
+      status=MagickFalse;
       if ((count == 0) || (LocaleNCompare(type,"8BIM",4) != 0))
         {
-          if (DiscardBlobBytes(image,((MagickSizeType) size-quantum-8)) ==
-              MagickFalse)
+          if (size >= (quantum+8))
+            status=DiscardBlobBytes(image,(MagickSizeType) (size-quantum-8));
+          if (status == MagickFalse)
             ThrowBinaryException(CorruptImageError,"UnexpectedEndOfFile",
               image->filename);
         }
@@ -1267,10 +1269,13 @@ ModuleExport MagickStatusType ReadPSDLayers(Image *image,
           if ((count != 0) && (LocaleNCompare(type,"Lr16",4) == 0))
             size=GetPSDSize(psd_info,image);
           else
-            if (DiscardBlobBytes(image,((MagickSizeType) size-quantum-12)) ==
-                MagickFalse)
-              ThrowBinaryException(CorruptImageError,"UnexpectedEndOfFile",
-                image->filename);
+            {
+              if (size >= (quantum+12))
+                status=DiscardBlobBytes(image,(MagickSizeType) (size-quantum-12));
+              if (status == MagickFalse)
+                ThrowBinaryException(CorruptImageError,"UnexpectedEndOfFile",
+                  image->filename);
+            }
         }
     }
   status=MagickTrue;