From: cristy <urban-warrior@git.imagemagick.org>
Date: Wed, 29 Feb 2012 02:44:11 +0000 (+0000)
Subject: (no commit message)
X-Git-Tag: 7.0.1-0~6107
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=64de157be86ee1e0e8d7433619ff9ae5707e8ce9;p=imagemagick

---

diff --git a/MagickCore/profile.c b/MagickCore/profile.c
index a046c708a..901ce2c45 100644
--- a/MagickCore/profile.c
+++ b/MagickCore/profile.c
@@ -6658,7 +6658,7 @@ MagickPrivate MagickBooleanType SyncImageProfiles(Image *image)
     This the offset to the first IFD.
   */
   offset=(ssize_t) ((int) ReadProfileLong(endian,exif+4));
-  if ((size_t) offset >= length)
+  if ((offset < 0) || (size_t) offset >= length)
     return(MagickFalse);
   directory=exif+offset;
   level=0;
diff --git a/MagickCore/property.c b/MagickCore/property.c
index 07e201a4e..ecd6c5a20 100644
--- a/MagickCore/property.c
+++ b/MagickCore/property.c
@@ -1257,7 +1257,7 @@ static MagickBooleanType GetEXIFProperty(const Image *image,
     This the offset to the first IFD.
   */
   offset=(ssize_t) ((int) ReadPropertyLong(endian,exif+4));
-  if ((size_t) offset >= length)
+  if ((offset < 0) || (size_t) offset >= length)
     return(MagickFalse);
   /*
     Set the pointer to the first IFD and follow it were it leads.