From: Cristy <urban-warrior@imagemagick.org>
Date: Sat, 3 Feb 2018 14:57:25 +0000 (-0500)
Subject: ...
X-Git-Tag: 7.0.7-23~169
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=409701b58ec91f8a13b2f43c367d2b02bb3db101;p=imagemagick

...
---

diff --git a/coders/mpc.c b/coders/mpc.c
index 41b469b94..55fd83d47 100644
--- a/coders/mpc.c
+++ b/coders/mpc.c
@@ -184,9 +184,6 @@ static Image *ReadMPCImage(const ImageInfo *image_info,ExceptionInfo *exception)
   ssize_t
     count;
 
-  StringInfo
-    *profile;
-
   unsigned int
     signature;
 
@@ -628,21 +625,19 @@ static Image *ReadMPCImage(const ImageInfo *image_info,ExceptionInfo *exception)
                 if ((LocaleNCompare(keyword,"profile:",8) == 0) ||
                     (LocaleNCompare(keyword,"profile-",8) == 0))
                   {
-                    size_t
-                      length;
+                    StringInfo
+                      *profile;
 
-                    if (profiles == (LinkedListInfo *) NULL)
-                      profiles=NewLinkedList(0);
-                    (void) AppendValueToLinkedList(profiles,
-                      AcquireString(keyword+8));
-                    if (length > sizeof(keyword)-8)
+                    if ((MagickSizeType) StringToLong(options) > GetBlobSize(image))
                       {
                         options=DestroyString(options);
-                        profiles=DestroyLinkedList(profiles,
-                          RelinquishMagickMemory);
                         ThrowReaderException(CorruptImageError,
-                          "ImproperImageHeader");
+                          "InsufficientImageDataInFile");
                       }
+                    if (profiles == (LinkedListInfo *) NULL)
+                      profiles=NewLinkedList(0);
+                    (void) AppendValueToLinkedList(profiles,
+                      AcquireString(keyword+8));
                     profile=BlobToStringInfo((const void *) NULL,length);
                     if (profile == (StringInfo *) NULL)
                       {