From d072ed6aff835c174e856ce3a428163c0da9e8f4 Mon Sep 17 00:00:00 2001
From: Glenn Randers-Pehrson <glennrp@gmail.com>
Date: Sun, 9 Jul 2017 22:42:32 -0400
Subject: [PATCH] Skip MNG CLIP chunk with out-of-range object IDs

---
 coders/png.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/coders/png.c b/coders/png.c
index d6d33ee36..ea6dce6ab 100644
--- a/coders/png.c
+++ b/coders/png.c
@@ -5899,6 +5899,9 @@ static Image *ReadOneMNGImage(MngInfo* mng_info, const ImageInfo *image_info,
 
                 for (i=(int) first_object; i <= (int) last_object; i++)
                 {
+                  if ((i < 0) || (i >= MNG_MAX_OBJECTS))
+                    continue;
+
                   if (mng_info->exists[i] && !mng_info->frozen[i])
                     {
                       MngBox
-- 
2.40.0