From b98d5523687d003695b0833be91ad79ed707789a Mon Sep 17 00:00:00 2001 From: Dirk Lemstra Date: Sat, 3 Feb 2018 18:26:15 +0100 Subject: [PATCH] Corrected checks. --- coders/miff.c | 12 ++---------- coders/mpc.c | 6 +++++- 2 files changed, 7 insertions(+), 11 deletions(-) diff --git a/coders/miff.c b/coders/miff.c index a1d3b8541..a4df93283 100644 --- a/coders/miff.c +++ b/coders/miff.c @@ -910,7 +910,8 @@ static Image *ReadMIFFImage(const ImageInfo *image_info, StringInfo *profile; - if ((MagickSizeType) StringToLong(options) > GetBlobSize(image)) + length=(size_t) StringToLong(options); + if ((MagickSizeType) length > GetBlobSize(image)) { options=DestroyString(options); ThrowReaderException(CorruptImageError, @@ -920,15 +921,6 @@ static Image *ReadMIFFImage(const ImageInfo *image_info, profiles=NewLinkedList(0); (void) AppendValueToLinkedList(profiles, AcquireString(keyword+8)); - length=(size_t) StringToLong(options); - if (length > sizeof(keyword)-8) - { - options=DestroyString(options); - profiles=DestroyLinkedList(profiles, - RelinquishMagickMemory); - ThrowReaderException(CorruptImageError, - "ImproperImageHeader"); - } profile=BlobToStringInfo((const void *) NULL,length); if (profile == (StringInfo *) NULL) { diff --git a/coders/mpc.c b/coders/mpc.c index 55fd83d47..e2b9e1c05 100644 --- a/coders/mpc.c +++ b/coders/mpc.c @@ -625,10 +625,14 @@ static Image *ReadMPCImage(const ImageInfo *image_info,ExceptionInfo *exception) if ((LocaleNCompare(keyword,"profile:",8) == 0) || (LocaleNCompare(keyword,"profile-",8) == 0)) { + size_t + length; + StringInfo *profile; - if ((MagickSizeType) StringToLong(options) > GetBlobSize(image)) + length=StringToLong(options); + if ((MagickSizeType) length > GetBlobSize(image)) { options=DestroyString(options); ThrowReaderException(CorruptImageError, -- 2.40.0