Avoid overflow when parsing PSD resource blocks

Cristy · Cristy · commit 15dd190dfd7e · 2016-05-06T10:03:01.000-04:00
diff --git a/coders/psd.c b/coders/psd.c
@@ -643,7 +643,7 @@ static void ParseImageResourceBlocks(Image *image,
     p=PushShortPixel(MSBEndian,p,&id);
     p=PushShortPixel(MSBEndian,p,&short_sans);
     p=PushLongPixel(MSBEndian,p,&count);
-    if (p+count > blocks+length)
+    if ((p+count) > (blocks+length-16))
       return;
     switch (id)
     {

Original file line number	Diff line number	Diff line change
`@@ -643,7 +643,7 @@ static void ParseImageResourceBlocks(Image *image,`
`643`	`643`	`p=PushShortPixel(MSBEndian,p,&id);`
`644`	`644`	`p=PushShortPixel(MSBEndian,p,&short_sans);`
`645`	`645`	`p=PushLongPixel(MSBEndian,p,&count);`
`646`		`- if (p+count > blocks+length)`
	`646`	`+ if ((p+count) > (blocks+length-16))`
`647`	`647`	`return;`
`648`	`648`	`switch (id)`
`649`	`649`	`{`