From: Dirk Lemstra <dirk@git.imagemagick.org>
Date: Sun, 28 Jan 2018 22:19:21 +0000 (+0100)
Subject: Added check for the channel type.
X-Git-Tag: 7.0.7-23~226
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=8e414cb038fffc151e540e6b348a68ca20d26d90;p=imagemagick

Added check for the channel type.
Credit to OSS-Fuzz
---

diff --git a/coders/psd.c b/coders/psd.c
index 7fbe86c5f..3a25cd63a 100644
--- a/coders/psd.c
+++ b/coders/psd.c
@@ -955,11 +955,13 @@ static inline void SetPSDPixel(Image *image,const size_t channels,
       SetPixelRed(image,pixel,q);
       break;
     }
+    case -3:
     case 1:
     {
       SetPixelGreen(image,pixel,q);
       break;
     }
+    case -4:
     case 2:
     {
       SetPixelBlue(image,pixel,q);
@@ -1652,6 +1654,13 @@ static MagickBooleanType ReadPSDLayersInternal(Image *image,
         for (j=0; j < (ssize_t) layer_info[i].channels; j++)
         {
           layer_info[i].channel_info[j].type=(short) ReadBlobShort(image);
+          if ((layer_info[i].channel_info[j].type < -4) ||
+              (layer_info[i].channel_info[j].type > 4))
+            {
+              layer_info=DestroyLayerInfo(layer_info,number_layers);
+              ThrowBinaryException(CorruptImageError,"NoSuchImageChannel",
+                image->filename);
+            }
           layer_info[i].channel_info[j].size=(size_t) GetPSDSize(psd_info,
             image);
           if (image->debug != MagickFalse)