Check the type of the field before performing the multiplication (det…

…ails in #2132)
ImageMagick · Jun 13, 2020 · 824f344 · 824f344
1 parent 4b0098f
commit 824f344
Showing 1 changed file with 8 additions and 1 deletion.
diff --git a/coders/tiff.c b/coders/tiff.c
@@ -694,9 +694,16 @@ static MagickBooleanType TIFFGetProfiles(TIFF *tiff,Image *image,
   if ((TIFFGetField(tiff,TIFFTAG_RICHTIFFIPTC,&length,&profile) == 1) &&
       (profile != (unsigned char *) NULL))
     {
+      const TIFFField
+        *field;
+
       if (TIFFIsByteSwapped(tiff) != 0)
         TIFFSwabArrayOfLong((uint32 *) profile,(size_t) length);
-      status=ReadProfile(image,"iptc",profile,4L*length,exception);
+      field=TIFFFieldWithTag(tiff,TIFFTAG_RICHTIFFIPTC);
+      if (TIFFFieldDataType(field) == TIFF_LONG)
+        status=ReadProfile(image,"iptc",profile,4L*length,exception);
+      else
+        status=ReadProfile(image,"iptc",profile,length,exception);
     }
 #endif
 #if defined(TIFFTAG_XMLPACKET)