https://github.com/ImageMagick/ImageMagick/issues/645

diff --git a/coders/psd.c b/coders/psd.c
index e7c4406af1bc074d1783c61fcb6de31abe7b8eb7..de5578bac5871f288751117d3612e6b412861742 100644 (file)
--- a/coders/psd.c
+++ b/coders/psd.c
@@ -1741,6 +1741,12 @@ static MagickBooleanType ReadPSDLayersInternal(Image *image,
                 unsigned char
                   *info;
 
+                if (length > GetBlobSize(image))
+                  {
+                    layer_info=DestroyLayerInfo(layer_info,number_layers);
+                    ThrowBinaryException(CorruptImageError,
+                      "InsufficientImageDataInFile",image->filename);
+                  }
                 layer_info[i].info=AcquireStringInfo((const size_t) length);
                 info=GetStringInfoDatum(layer_info[i].info);
                 (void) ReadBlob(image,(const size_t) length,info);