equal
deleted
inserted
replaced
|
1 This patch comes from upstream: |
|
2 https://github.com/ImageMagick/ImageMagick/commit/dd84447b63a71fa8c3f47071b09454efc667767b |
|
3 It can be removed once we upgrade to a release that has the fix, presumably |
|
4 version 6.9.5-4 or later. |
|
5 |
|
6 --- ImageMagick-6.9.5/magick/property.c.orig 2016-06-26 17:40:19.000000000 -0700 |
|
7 +++ ImageMagick-6.9.5/magick/property.c 2016-07-29 05:56:23.858967297 -0700 |
|
8 @@ -638,6 +638,11 @@ |
|
9 if ((count & 0x01) == 0) |
|
10 (void) ReadPropertyByte(&info,&length); |
|
11 count=(ssize_t) ReadPropertyMSBLong(&info,&length); |
|
12 + if ((count < 0) || ((size_t) count > length)) |
|
13 + { |
|
14 + length=0; |
|
15 + continue; |
|
16 + } |
|
17 if ((*name != '\0') && (*name != '#')) |
|
18 if ((resource == (char *) NULL) || (LocaleCompare(name,resource) != 0)) |
|
19 { |