sp;
png_uint_32
+ extent,
length,
nibbles;
13,14,15};
sp=text[ii].text+1;
- length=text[ii].text_length;
+ extent=text[ii].text_length;
/* look for newline */
- while ((*sp != '\n') && length--)
+ while ((*sp != '\n') && extent--)
sp++;
/* look for length */
- while (((*sp == '\0' || *sp == ' ' || *sp == '\n')) && length--)
+ while (((*sp == '\0' || *sp == ' ' || *sp == '\n')) && extent--)
sp++;
- if (length == 0)
+ if (extent == 0)
{
png_warning(ping,"invalid profile length");
return(MagickFalse);
(void) LogMagickEvent(CoderEvent,GetMagickModule(),
" length: %lu",(unsigned long) length);
- while (*sp != ' ' && *sp != '\n')
- sp++;
+ while ((*sp != ' ' && *sp != '\n') && extent--)
+ sp++;
+
+ if (extent == 0)
+ {
+ png_warning(ping,"invalid profile length");
+ return(MagickFalse);
+ }
/* allocate space */
if (length == 0)