From: Dirk Lemstra <dirk@lemstra.org>
Date: Thu, 18 Jul 2019 20:05:23 +0000 (+0200)
Subject: Read one byte less to make sure we get a null terminated buffer.
X-Git-Tag: 7.0.8-55~6
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=6d15222b066f82ad89e90cf07db08721ef53fe9a;p=imagemagick

Read one byte less to make sure we get a null terminated buffer.
---

diff --git a/coders/bytebuffer-private.h b/coders/bytebuffer-private.h
index c70219bc9..38b5467ba 100644
--- a/coders/bytebuffer-private.h
+++ b/coders/bytebuffer-private.h
@@ -35,14 +35,14 @@ static inline int ReadMagickByteBuffer(MagickByteBuffer *buffer)
 {
   if ((buffer->offset == buffer->count) && (buffer->offset > 0))
     {
-      if (buffer->count != (ssize_t) sizeof(buffer->data))
+      if (buffer->count != (ssize_t) sizeof(buffer->data)-1)
         return(EOF);
       buffer->offset=0;
       buffer->count=0;
     }
   if ((buffer->offset == 0) && (buffer->count == 0))
     {
-      buffer->count=ReadBlob(buffer->image,sizeof(buffer->data),buffer->data);
+      buffer->count=ReadBlob(buffer->image,sizeof(buffer->data)-1,buffer->data);
       if (buffer->count < 1)
         return(EOF);
     }
@@ -58,7 +58,7 @@ static inline char *GetMagickByteBufferDatum(MagickByteBuffer *buffer)
   i=0;
   while (buffer->offset < buffer->count)
     buffer->data[i++]=buffer->data[buffer->offset++];
-  count=ReadBlob(buffer->image,sizeof(buffer->data)-i,buffer->data+i);
+  count=ReadBlob(buffer->image,sizeof(buffer->data)-1-i,buffer->data+i);
   buffer->count=i;
   if (count > 0)
     buffer->count+=count;