(no commit message)

diff --git a/coders/png.c b/coders/png.c
index aa074359d5e056b4846aaf25ea9bcc690cf2a5fd..c51b96a64d4571cf96ab1843b52f36756958b624 100644 (file)
--- a/coders/png.c
+++ b/coders/png.c
@@ -4357,9 +4357,11 @@ static Image *ReadOneJNGImage(MngInfo *mng_info,
         if (length == 16)
           {
             jng_width=(size_t) ((p[0] << 24) | (p[1] << 16) |
-                (p[2] << 8) | p[3]);
+              (p[2] << 8) | p[3]);
             jng_height=(size_t) ((p[4] << 24) | (p[5] << 16) |
-                (p[6] << 8) | p[7]);
+              (p[6] << 8) | p[7]);
+            if ((jng_width == 0) || (jng_height == 0))
+              ThrowReaderException(CorruptImageError,"NegativeOrZeroImageSize");
             jng_color_type=p[8];
             jng_image_sample_depth=p[9];
             jng_image_compression_method=p[10];