From: Dirk Lemstra <dirk@lemstra.org>
Date: Tue, 2 Jul 2019 19:33:15 +0000 (+0200)
Subject: Added missing boundary check.
X-Git-Tag: 7.0.8-52~5
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=575243a7419fcbf89fc8ce136ef5da3b9c4cadd7;p=imagemagick

Added missing boundary check.
---

diff --git a/coders/pdf.c b/coders/pdf.c
index 19604bff7..e42ed408b 100644
--- a/coders/pdf.c
+++ b/coders/pdf.c
@@ -430,8 +430,8 @@ static char *MovePDFBuffer(PDFBuffer *buffer)
     i;
 
   i=1; /* Skip first to avoid reload of buffer; */
-  while ((ssize_t)buffer->offset != buffer->count)
-    buffer->data[i++] = buffer->data[buffer->offset++];
+  while ((ssize_t)buffer->offset < buffer->count)
+    buffer->data[i++]=buffer->data[buffer->offset++];
   buffer->count=ReadBlob(buffer->image,sizeof(buffer->data)-i,
     buffer->data+i);
   buffer->count+=i;
@@ -441,14 +441,15 @@ static char *MovePDFBuffer(PDFBuffer *buffer)
 
 static inline void CheckRemainingPDFBuffer(PDFBuffer *buffer,size_t length)
 {
-  if (buffer->offset + length > sizeof(buffer->data))
-    (void)MovePDFBuffer(buffer);
+  if (buffer->offset+length > sizeof(buffer->data))
+    (void) MovePDFBuffer(buffer);
 }
 
 static inline void SkipPDFBytes(PDFBuffer *buffer,size_t count)
 {
   CheckRemainingPDFBuffer(buffer,count);
-  buffer->offset+=count;
+  if (buffer->offset+count < buffer->count)
+    buffer->offset+=count;
 }
 
 static inline MagickBooleanType ComparePDFBuffer(const char *p,