From: Dirk Lemstra <dirk@git.imagemagick.org>
Date: Sat, 3 Feb 2018 17:26:15 +0000 (+0100)
Subject: Corrected checks.
X-Git-Tag: 7.0.7-23~165
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=b98d5523687d003695b0833be91ad79ed707789a;p=imagemagick

Corrected checks.
---

diff --git a/coders/miff.c b/coders/miff.c
index a1d3b8541..a4df93283 100644
--- a/coders/miff.c
+++ b/coders/miff.c
@@ -910,7 +910,8 @@ static Image *ReadMIFFImage(const ImageInfo *image_info,
                     StringInfo
                       *profile;
 
-                    if ((MagickSizeType) StringToLong(options) > GetBlobSize(image))
+                    length=(size_t) StringToLong(options);
+                    if ((MagickSizeType) length > GetBlobSize(image))
                       {
                         options=DestroyString(options);
                         ThrowReaderException(CorruptImageError,
@@ -920,15 +921,6 @@ static Image *ReadMIFFImage(const ImageInfo *image_info,
                       profiles=NewLinkedList(0);
                     (void) AppendValueToLinkedList(profiles,
                       AcquireString(keyword+8));
-                    length=(size_t) StringToLong(options);
-                    if (length > sizeof(keyword)-8)
-                      {
-                        options=DestroyString(options);
-                        profiles=DestroyLinkedList(profiles,
-                          RelinquishMagickMemory);
-                        ThrowReaderException(CorruptImageError,
-                          "ImproperImageHeader");
-                      }
                     profile=BlobToStringInfo((const void *) NULL,length);
                     if (profile == (StringInfo *) NULL)
                       {
diff --git a/coders/mpc.c b/coders/mpc.c
index 55fd83d47..e2b9e1c05 100644
--- a/coders/mpc.c
+++ b/coders/mpc.c
@@ -625,10 +625,14 @@ static Image *ReadMPCImage(const ImageInfo *image_info,ExceptionInfo *exception)
                 if ((LocaleNCompare(keyword,"profile:",8) == 0) ||
                     (LocaleNCompare(keyword,"profile-",8) == 0))
                   {
+                    size_t
+                      length;
+
                     StringInfo
                       *profile;
 
-                    if ((MagickSizeType) StringToLong(options) > GetBlobSize(image))
+                    length=StringToLong(options);
+                    if ((MagickSizeType) length > GetBlobSize(image))
                       {
                         options=DestroyString(options);
                         ThrowReaderException(CorruptImageError,