From d76a932355d0ef20061381c48f8a97842bb6dbe0 Mon Sep 17 00:00:00 2001 From: Dirk Lemstra Date: Thu, 24 Aug 2017 21:23:43 +0200 Subject: [PATCH] Fixed issue with negative offset reported in #692 --- coders/psd.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/coders/psd.c b/coders/psd.c index e5bdd622a..80df869c6 100644 --- a/coders/psd.c +++ b/coders/psd.c @@ -1309,10 +1309,12 @@ static MagickBooleanType ReadPSDChannel(Image *image, channel_image=image; mask=(Image *) NULL; - if (layer_info->channel_info[channel].type < -1) + if ((layer_info->channel_info[channel].type < -1) && + (layer_info->mask.page.width > 0) && (layer_info->mask.page.height > 0)) { const char *option; + /* Ignore mask that is not a user supplied layer mask, if the mask is disabled or if the flags have unsupported values. @@ -1656,9 +1658,9 @@ static MagickBooleanType ReadPSDLayersInternal(Image *image, */ layer_info[i].mask.page.y=ReadBlobSignedLong(image); layer_info[i].mask.page.x=ReadBlobSignedLong(image); - layer_info[i].mask.page.height=(size_t) (ReadBlobLong(image)- + layer_info[i].mask.page.height=(size_t) (ReadBlobSignedLong(image)- layer_info[i].mask.page.y); - layer_info[i].mask.page.width=(size_t) (ReadBlobLong(image)- + layer_info[i].mask.page.width=(size_t) (ReadBlobSignedLong(image)- layer_info[i].mask.page.x); layer_info[i].mask.background=(unsigned char) ReadBlobByte( image); @@ -3388,9 +3390,9 @@ static MagickBooleanType WritePSDImage(const ImageInfo *image_info, size+=WriteBlobMSBLong(image,20); size+=WriteBlobMSBSignedLong(image,mask->page.y); size+=WriteBlobMSBSignedLong(image,mask->page.x); - size+=WriteBlobMSBLong(image,(const unsigned int) mask->rows+ + size+=WriteBlobMSBSignedLong(image,(const signed int) mask->rows+ mask->page.y); - size+=WriteBlobMSBLong(image,(const unsigned int) mask->columns+ + size+=WriteBlobMSBSignedLong(image,(const signed int) mask->columns+ mask->page.x); size+=WriteBlobByte(image,default_color); size+=WriteBlobByte(image,mask->compose == NoCompositeOp ? 2 : 0); -- 2.50.1