Corrected checks.

diff --git a/coders/miff.c b/coders/miff.c
index a1d3b854150a8efb6e81ff14a252ec4a3e87c1ed..a4df93283c8fd7e496f2398da4f8f388a49f0bde 100644 (file)
--- a/coders/miff.c
+++ b/coders/miff.c
@@ -910,7 +910,8 @@ static Image *ReadMIFFImage(const ImageInfo *image_info,
                     StringInfo
                       *profile;
 
-                    if ((MagickSizeType) StringToLong(options) > GetBlobSize(image))
+                    length=(size_t) StringToLong(options);
+                    if ((MagickSizeType) length > GetBlobSize(image))
                       {
                         options=DestroyString(options);
                         ThrowReaderException(CorruptImageError,
@@ -920,15 +921,6 @@ static Image *ReadMIFFImage(const ImageInfo *image_info,
                       profiles=NewLinkedList(0);
                     (void) AppendValueToLinkedList(profiles,
                       AcquireString(keyword+8));
-                    length=(size_t) StringToLong(options);
-                    if (length > sizeof(keyword)-8)
-                      {
-                        options=DestroyString(options);
-                        profiles=DestroyLinkedList(profiles,
-                          RelinquishMagickMemory);
-                        ThrowReaderException(CorruptImageError,
-                          "ImproperImageHeader");
-                      }
                     profile=BlobToStringInfo((const void *) NULL,length);
                     if (profile == (StringInfo *) NULL)
                       {

diff --git a/coders/mpc.c b/coders/mpc.c
index 55fd83d4734c4b0b58ba8688f44abaa5cea76cc8..e2b9e1c0530e2f94fc86ee4e2eb4605577d5713c 100644 (file)
--- a/coders/mpc.c
+++ b/coders/mpc.c
@@ -625,10 +625,14 @@ static Image *ReadMPCImage(const ImageInfo *image_info,ExceptionInfo *exception)
                 if ((LocaleNCompare(keyword,"profile:",8) == 0) ||
                     (LocaleNCompare(keyword,"profile-",8) == 0))
                   {
+                    size_t
+                      length;
+
                     StringInfo
                       *profile;
 
-                    if ((MagickSizeType) StringToLong(options) > GetBlobSize(image))
+                    length=StringToLong(options);
+                    if ((MagickSizeType) length > GetBlobSize(image))
                       {
                         options=DestroyString(options);
                         ThrowReaderException(CorruptImageError,