From d9ccd8227c4c88a907cda5278408b73552cb0c07 Mon Sep 17 00:00:00 2001 From: Cristy Date: Sat, 8 Jul 2017 08:16:22 -0400 Subject: [PATCH] https://github.com/ImageMagick/ImageMagick/issues/549 --- coders/png.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/coders/png.c b/coders/png.c index 0253c82fc..dc8be5220 100644 --- a/coders/png.c +++ b/coders/png.c @@ -4384,6 +4384,8 @@ static Image *ReadOneJNGImage(MngInfo *mng_info, if (length != 0) { + if (length > GetBlobSize(image)) + ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile"); chunk=(unsigned char *) AcquireQuantumMemory(length+MagickPathExtent, sizeof(*chunk)); @@ -5260,12 +5262,14 @@ static Image *ReadOneMNGImage(MngInfo* mng_info, const ImageInfo *image_info, if (length != 0) { + if (length > GetBlobSize(image)) + ThrowReaderException(CorruptImageError, + "InsufficientImageDataInFile"); chunk=(unsigned char *) AcquireQuantumMemory(length+ MagickPathExtent,sizeof(*chunk)); if (chunk == (unsigned char *) NULL) - ThrowReaderException(ResourceLimitError, - "MemoryAllocationFailed"); + ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed"); for (i=0; i < (ssize_t) length; i++) { -- 2.40.0