From: cristy <urban-warrior@git.imagemagick.org>
Date: Sun, 14 Jun 2015 22:19:29 +0000 (+0000)
Subject: (no commit message)
X-Git-Tag: 7.0.1-0~894
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=908a35b19a313486d17de504738fc427595918d2;p=imagemagick

---

diff --git a/MagickCore/blob.c b/MagickCore/blob.c
index e8e40e08a..dbc0b0367 100644
--- a/MagickCore/blob.c
+++ b/MagickCore/blob.c
@@ -797,6 +797,8 @@ MagickExport MagickBooleanType DiscardBlobBytes(Image *image,
 
   assert(image != (Image *) NULL);
   assert(image->signature == MagickSignature);
+  if (length != (MagickSizeType) ((MagickOffsetType) length))
+    return(MagickFalse);
   count=0;
   for (i=0; i < (MagickOffsetType) length; i+=count)
   {
diff --git a/coders/psd.c b/coders/psd.c
index 1efae89fa..fe7c58e85 100644
--- a/coders/psd.c
+++ b/coders/psd.c
@@ -1254,10 +1254,12 @@ ModuleExport MagickStatusType ReadPSDLayers(Image *image,
       quantum=psd_info->version == 1 ? 4UL : 8UL;
       (void) ReadBlobMSBLong(image);
       count=ReadBlob(image,4,(unsigned char *) type);
+      status=MagickFalse;
       if ((count == 0) || (LocaleNCompare(type,"8BIM",4) != 0))
         {
-          if (DiscardBlobBytes(image,((MagickSizeType) size-quantum-8)) ==
-              MagickFalse)
+          if (size >= (quantum+8))
+            status=DiscardBlobBytes(image,(MagickSizeType) (size-quantum-8));
+          if (status == MagickFalse)
             ThrowBinaryException(CorruptImageError,"UnexpectedEndOfFile",
               image->filename);
         }
@@ -1267,10 +1269,13 @@ ModuleExport MagickStatusType ReadPSDLayers(Image *image,
           if ((count != 0) && (LocaleNCompare(type,"Lr16",4) == 0))
             size=GetPSDSize(psd_info,image);
           else
-            if (DiscardBlobBytes(image,((MagickSizeType) size-quantum-12)) ==
-                MagickFalse)
-              ThrowBinaryException(CorruptImageError,"UnexpectedEndOfFile",
-                image->filename);
+            {
+              if (size >= (quantum+12))
+                status=DiscardBlobBytes(image,(MagickSizeType) (size-quantum-12));
+              if (status == MagickFalse)
+                ThrowBinaryException(CorruptImageError,"UnexpectedEndOfFile",
+                  image->filename);
+            }
         }
     }
   status=MagickTrue;