Prevent buffer overflow (bug report from Ibrahim el-sayed)

diff --git a/MagickCore/property.c b/MagickCore/property.c
index 772f3d59fe14ab87ed211549c64beefe01eef4f6..0b4b75c4941eea2d9d09b40d2fbbacb6c9f32094 100644 (file)
--- a/MagickCore/property.c
+++ b/MagickCore/property.c
@@ -665,6 +665,11 @@ static MagickBooleanType Get8BIMProperty(const Image *image,const char *key,
     if ((count & 0x01) == 0)
       (void) ReadPropertyByte(&info,&length);
     count=(ssize_t) ReadPropertyMSBLong(&info,&length);
+    if ((count < 0) || ((size_t) count > length))
+      {
+        length=0; 
+        continue;
+      }
     if ((*name != '\0') && (*name != '#'))
       if ((resource == (char *) NULL) || (LocaleCompare(name,resource) != 0))
         {