From 64de157be86ee1e0e8d7433619ff9ae5707e8ce9 Mon Sep 17 00:00:00 2001 From: cristy Date: Wed, 29 Feb 2012 02:44:11 +0000 Subject: [PATCH] --- MagickCore/profile.c | 2 +- MagickCore/property.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/MagickCore/profile.c b/MagickCore/profile.c index a046c708a..901ce2c45 100644 --- a/MagickCore/profile.c +++ b/MagickCore/profile.c @@ -6658,7 +6658,7 @@ MagickPrivate MagickBooleanType SyncImageProfiles(Image *image) This the offset to the first IFD. */ offset=(ssize_t) ((int) ReadProfileLong(endian,exif+4)); - if ((size_t) offset >= length) + if ((offset < 0) || (size_t) offset >= length) return(MagickFalse); directory=exif+offset; level=0; diff --git a/MagickCore/property.c b/MagickCore/property.c index 07e201a4e..ecd6c5a20 100644 --- a/MagickCore/property.c +++ b/MagickCore/property.c @@ -1257,7 +1257,7 @@ static MagickBooleanType GetEXIFProperty(const Image *image, This the offset to the first IFD. */ offset=(ssize_t) ((int) ReadPropertyLong(endian,exif+4)); - if ((size_t) offset >= length) + if ((offset < 0) || (size_t) offset >= length) return(MagickFalse); /* Set the pointer to the first IFD and follow it were it leads. -- 2.40.0