https://github.com/ImageMagick/ImageMagick/issues/280

diff --git a/MagickCore/profile.c b/MagickCore/profile.c
index ea76057700b987ad268adfb01dca1264bf59ccb0..4239d558c6e377159779e5fa927b5e8249abc44e 100644 (file)
--- a/MagickCore/profile.c
+++ b/MagickCore/profile.c
@@ -2032,7 +2032,7 @@ MagickBooleanType SyncExifProfile(Image *image,StringInfo *profile)
         break;  /* corrupt EXIF */
       tag_value=(ssize_t) ReadProfileShort(endian,q);
       format=(ssize_t) ReadProfileShort(endian,q+2);
-      if ((format-1) >= EXIF_NUM_FORMATS)
+      if ((format < 0) || ((format-1) >= EXIF_NUM_FORMATS))
         break;
       components=(ssize_t) ReadProfileLong(endian,q+4);
       if (components < 0)