From 575243a7419fcbf89fc8ce136ef5da3b9c4cadd7 Mon Sep 17 00:00:00 2001 From: Dirk Lemstra Date: Tue, 2 Jul 2019 21:33:15 +0200 Subject: [PATCH] Added missing boundary check. --- coders/pdf.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/coders/pdf.c b/coders/pdf.c index 19604bff7..e42ed408b 100644 --- a/coders/pdf.c +++ b/coders/pdf.c @@ -430,8 +430,8 @@ static char *MovePDFBuffer(PDFBuffer *buffer) i; i=1; /* Skip first to avoid reload of buffer; */ - while ((ssize_t)buffer->offset != buffer->count) - buffer->data[i++] = buffer->data[buffer->offset++]; + while ((ssize_t)buffer->offset < buffer->count) + buffer->data[i++]=buffer->data[buffer->offset++]; buffer->count=ReadBlob(buffer->image,sizeof(buffer->data)-i, buffer->data+i); buffer->count+=i; @@ -441,14 +441,15 @@ static char *MovePDFBuffer(PDFBuffer *buffer) static inline void CheckRemainingPDFBuffer(PDFBuffer *buffer,size_t length) { - if (buffer->offset + length > sizeof(buffer->data)) - (void)MovePDFBuffer(buffer); + if (buffer->offset+length > sizeof(buffer->data)) + (void) MovePDFBuffer(buffer); } static inline void SkipPDFBytes(PDFBuffer *buffer,size_t count) { CheckRemainingPDFBuffer(buffer,count); - buffer->offset+=count; + if (buffer->offset+count < buffer->count) + buffer->offset+=count; } static inline MagickBooleanType ComparePDFBuffer(const char *p, -- 2.40.0