...

diff --git a/coders/png.c b/coders/png.c
index db4cdd704c4f2061df92382cbfaedcff1dd81851..96b9c65f0662f6a5eb31238a5222803ec46150c9 100644 (file)
--- a/coders/png.c
+++ b/coders/png.c
@@ -5657,7 +5657,7 @@ static Image *ReadOneMNGImage(MngInfo* mng_info, const ImageInfo *image_info,
                 CoderError,"Nonzero object_id in MNG-LC datastream","`%s'",
                 image->filename);
 
-            if (object_id > MNG_MAX_OBJECTS)
+            if (object_id >= MNG_MAX_OBJECTS)
               {
                 /*
                   Instead of using a warning we should allocate a larger
@@ -5665,7 +5665,7 @@ static Image *ReadOneMNGImage(MngInfo* mng_info, const ImageInfo *image_info,
                 */
                 (void) ThrowMagickException(exception,GetMagickModule(),
                   CoderError,"object id too large","`%s'",image->filename);
-                object_id=MNG_MAX_OBJECTS;
+                object_id=MNG_MAX_OBJECTS-1;
               }
 
             if (mng_info->exists[object_id])