Fixed SEGV reported in #130

ImageMagick · Feb 14, 2016 · 02dadf1 · 02dadf1
1 parent 0ff89d1
commit 02dadf1
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/MagickCore/profile.c b/MagickCore/profile.c
@@ -1442,7 +1442,8 @@ static void WriteTo8BimProfile(Image *image,const char *name,
     count=(ssize_t) value;
     if ((count & 0x01) != 0)
       count++;
-    if ((p > (datum+length-count)) || (count > (ssize_t) length))
+    if ((count < 0) || (p > (datum+length-count)) ||
+        (count > (ssize_t) length))
       break;
     if (id != profile_id)
       p+=count;