Fixed issue with negative offset reported in #692

diff --git a/coders/psd.c b/coders/psd.c
index e5bdd622a357b8d45643b7f34417aa23564ead1d..80df869c69c245ec6e0b372efd32061767dc4850 100644 (file)
--- a/coders/psd.c
+++ b/coders/psd.c
@@ -1309,10 +1309,12 @@ static MagickBooleanType ReadPSDChannel(Image *image,
 
   channel_image=image;
   mask=(Image *) NULL;
-  if (layer_info->channel_info[channel].type < -1)
+  if ((layer_info->channel_info[channel].type < -1) &&
+      (layer_info->mask.page.width > 0) && (layer_info->mask.page.height > 0))
     {
       const char
         *option;
+
       /*
         Ignore mask that is not a user supplied layer mask, if the mask is
         disabled or if the flags have unsupported values.
@@ -1656,9 +1658,9 @@ static MagickBooleanType ReadPSDLayersInternal(Image *image,
                 */
                 layer_info[i].mask.page.y=ReadBlobSignedLong(image);
                 layer_info[i].mask.page.x=ReadBlobSignedLong(image);
-                layer_info[i].mask.page.height=(size_t) (ReadBlobLong(image)-
+                layer_info[i].mask.page.height=(size_t) (ReadBlobSignedLong(image)-
                   layer_info[i].mask.page.y);
-                layer_info[i].mask.page.width=(size_t) (ReadBlobLong(image)-
+                layer_info[i].mask.page.width=(size_t) (ReadBlobSignedLong(image)-
                   layer_info[i].mask.page.x);
                 layer_info[i].mask.background=(unsigned char) ReadBlobByte(
                   image);
@@ -3388,9 +3390,9 @@ static MagickBooleanType WritePSDImage(const ImageInfo *image_info,
         size+=WriteBlobMSBLong(image,20);
         size+=WriteBlobMSBSignedLong(image,mask->page.y);
         size+=WriteBlobMSBSignedLong(image,mask->page.x);
-        size+=WriteBlobMSBLong(image,(const unsigned int) mask->rows+
+        size+=WriteBlobMSBSignedLong(image,(const signed int) mask->rows+
           mask->page.y);
-        size+=WriteBlobMSBLong(image,(const unsigned int) mask->columns+
+        size+=WriteBlobMSBSignedLong(image,(const signed int) mask->columns+
           mask->page.x);
         size+=WriteBlobByte(image,default_color);
         size+=WriteBlobByte(image,mask->compose == NoCompositeOp ? 2 : 0);