From: Cristy <urban-warrior@imagemagick.org>
Date: Thu, 31 May 2018 14:32:44 +0000 (-0400)
Subject: ...
X-Git-Tag: 7.0.7-38~9
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=977afae0a68131886ef351adb2d5170ce2f31a27;p=imagemagick

...
---

diff --git a/coders/png.c b/coders/png.c
index db4cdd704..96b9c65f0 100644
--- a/coders/png.c
+++ b/coders/png.c
@@ -5657,7 +5657,7 @@ static Image *ReadOneMNGImage(MngInfo* mng_info, const ImageInfo *image_info,
                 CoderError,"Nonzero object_id in MNG-LC datastream","`%s'",
                 image->filename);
 
-            if (object_id > MNG_MAX_OBJECTS)
+            if (object_id >= MNG_MAX_OBJECTS)
               {
                 /*
                   Instead of using a warning we should allocate a larger
@@ -5665,7 +5665,7 @@ static Image *ReadOneMNGImage(MngInfo* mng_info, const ImageInfo *image_info,
                 */
                 (void) ThrowMagickException(exception,GetMagickModule(),
                   CoderError,"object id too large","`%s'",image->filename);
-                object_id=MNG_MAX_OBJECTS;
+                object_id=MNG_MAX_OBJECTS-1;
               }
 
             if (mng_info->exists[object_id])