From: cristy <urban-warrior@git.imagemagick.org>
Date: Mon, 24 May 2010 18:32:05 +0000 (+0000)
Subject: (no commit message)
X-Git-Tag: 7.0.1-0~9397
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=2093a780a2fceb34bbb17b3137e626914743f0d0;p=imagemagick

---

diff --git a/coders/psd.c b/coders/psd.c
index f33aad8b1..1565b6244 100644
--- a/coders/psd.c
+++ b/coders/psd.c
@@ -969,6 +969,10 @@ static Image *ReadPSDImage(const ImageInfo *image_info,ExceptionInfo *exception)
               (ReadBlobMSBLong(image)-layer_info[i].page.y);
             layer_info[i].page.width=(unsigned long)
               (ReadBlobMSBLong(image)-layer_info[i].page.x);
+            if (layer_info[i].page.height > 300000)
+              layer_info[i].page.height+=4294967295UL;
+            if (layer_info[i].page.width > 300000)
+              layer_info[i].page.width+=4294967295UL;
             layer_info[i].channels=ReadBlobMSBShort(image);
             if (layer_info[i].channels > MaxPSDChannels)
               ThrowReaderException(CorruptImageError,"MaximumChannelsExceeded");
@@ -1030,6 +1034,10 @@ static Image *ReadPSDImage(const ImageInfo *image_info,ExceptionInfo *exception)
                       (ReadBlobMSBLong(image)-layer_info[i].mask.y);
                     layer_info[i].mask.width=(unsigned long)
                       (ReadBlobMSBLong(image)-layer_info[i].mask.x);
+                    if (layer_info[i].mask.height > 300000)
+                      layer_info[i].mask.height+=4294967295UL;
+                    if (layer_info[i].mask.width > 300000)
+                      layer_info[i].mask.width+=4294967295UL;
                     if (image->debug != MagickFalse)
                       (void) LogMagickEvent(CoderEvent,GetMagickModule(),
                         "      layer mask: offset(%ld,%ld), size(%ld,%ld), length=%ld",