From: Cristy <urban-warrior@imagemagick.org>
Date: Tue, 29 Aug 2017 18:57:16 +0000 (-0400)
Subject: https://github.com/ImageMagick/ImageMagick/issues/705
X-Git-Tag: 7.0.7-0~39
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=45d342155b5e9b83904c695411d20f33cf9b524c;p=imagemagick

https://github.com/ImageMagick/ImageMagick/issues/705
---

diff --git a/coders/thumbnail.c b/coders/thumbnail.c
index e129ff04e..d61166fde 100644
--- a/coders/thumbnail.c
+++ b/coders/thumbnail.c
@@ -190,11 +190,11 @@ static MagickBooleanType WriteTHUMBNAILImage(const ImageInfo *image_info,
   if (property == (const char *) NULL)
     ThrowWriterException(CoderError,"ImageDoesNotHaveAThumbnail");
   length=(size_t) StringToLong(property);
+  if (((offset+length) < 2) || ((offset+length) > GetStringInfoLength(profile)))
+    ThrowWriterException(CoderError,"ImageDoesNotHaveAThumbnail");
   (void) ResetMagickMemory(magick,0,sizeof(magick));
   for (i=0; i < (ssize_t) length; i++)
   {
-    if ((offset+i) >= GetStringInfoLength(profile))
-      break;
     magick[0]=magick[1];
     magick[1]=magick[2];
     magick[2]=GetStringInfoDatum(profile)[offset+i];