From: Cristy <urban-warrior@imagemagick.org>
Date: Sat, 24 Jun 2017 12:23:11 +0000 (-0400)
Subject: https://github.com/ImageMagick/ImageMagick/issues/524
X-Git-Tag: 7.0.6-1~123
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=a14e7f1f78d99891132e061c05f83aefc59e049a;p=imagemagick

https://github.com/ImageMagick/ImageMagick/issues/524
---

diff --git a/coders/ept.c b/coders/ept.c
index 41382426c..1ef06c867 100644
--- a/coders/ept.c
+++ b/coders/ept.c
@@ -196,10 +196,14 @@ static Image *ReadEPTImage(const ImageInfo *image_info,ExceptionInfo *exception)
     ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   ept_info.postscript_offset=(MagickOffsetType) ReadBlobLSBLong(image);
   ept_info.postscript_length=ReadBlobLSBLong(image);
+  if (ept_info.postscript_length > GetBlobSize(image))
+    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   (void) ReadBlobLSBLong(image);
   (void) ReadBlobLSBLong(image);
   ept_info.tiff_offset=(MagickOffsetType) ReadBlobLSBLong(image);
   ept_info.tiff_length=ReadBlobLSBLong(image);
+  if (ept_info.tiff_length > GetBlobSize(image))
+    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   (void) ReadBlobLSBShort(image);
   ept_info.postscript=(unsigned char *) AcquireQuantumMemory(
     ept_info.postscript_length+1,sizeof(*ept_info.postscript));