From: dirk <dirk@git.imagemagick.org>
Date: Mon, 3 Feb 2014 21:29:38 +0000 (+0000)
Subject: Added boundary checks in DecodePSDPixels
X-Git-Tag: 7.0.1-0~2706
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=40084fae9e39c89210ccb4a80dcdd32fc16e640e;p=imagemagick

Added boundary checks in DecodePSDPixels
---

diff --git a/coders/psd.c b/coders/psd.c
index 3a7e5b6dc..64a0dbd70 100644
--- a/coders/psd.c
+++ b/coders/psd.c
@@ -332,13 +332,15 @@ static ssize_t DecodePSDPixels(const size_t number_compact_pixels,
   packets=(ssize_t) number_compact_pixels;
   for (i=0; (packets > 1) && (i < (ssize_t) number_pixels); )
   {
-    length=(*compact_pixels++);
+    length=(size_t) (*compact_pixels++);
     packets--;
     if (length == 128)
       continue;
     if (length > 128)
       {
         length=256-length+1;
+        if ((ssize_t) length + i > (ssize_t) number_pixels)
+          length=number_pixels-(size_t) i;
         pixel=(*compact_pixels++);
         packets--;
         for (j=0; j < (ssize_t) length; j++)
@@ -385,6 +387,8 @@ static ssize_t DecodePSDPixels(const size_t number_compact_pixels,
         continue;
       }
     length++;
+    if ((ssize_t) length + i > (ssize_t) number_pixels)
+      length=number_pixels-(size_t) i;
     for (j=0; j < (ssize_t) length; j++)
     {
       switch (depth)