From 824f344ceb823e156ad6e85314d79c087933c2a0 Mon Sep 17 00:00:00 2001 From: Dirk Lemstra Date: Sat, 13 Jun 2020 17:53:45 +0200 Subject: [PATCH] Check the type of the field before performing the multiplication (details in #2132) --- coders/tiff.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/coders/tiff.c b/coders/tiff.c index 66eee571cef..eeb616ab8b7 100644 --- a/coders/tiff.c +++ b/coders/tiff.c @@ -694,9 +694,16 @@ static MagickBooleanType TIFFGetProfiles(TIFF *tiff,Image *image, if ((TIFFGetField(tiff,TIFFTAG_RICHTIFFIPTC,&length,&profile) == 1) && (profile != (unsigned char *) NULL)) { + const TIFFField + *field; + if (TIFFIsByteSwapped(tiff) != 0) TIFFSwabArrayOfLong((uint32 *) profile,(size_t) length); - status=ReadProfile(image,"iptc",profile,4L*length,exception); + field=TIFFFieldWithTag(tiff,TIFFTAG_RICHTIFFIPTC); + if (TIFFFieldDataType(field) == TIFF_LONG) + status=ReadProfile(image,"iptc",profile,4L*length,exception); + else + status=ReadProfile(image,"iptc",profile,length,exception); } #endif #if defined(TIFFTAG_XMLPACKET)