https://github.com/ImageMagick/ImageMagick/issues/1613

ImageMagick · Jun 22, 2019 · 5c7fbf9 · 5c7fbf9
1 parent cb5ec7d
commit 5c7fbf9
Showing 1 changed file with 6 additions and 6 deletions.
diff --git a/coders/pnm.c b/coders/pnm.c
@@ -1830,14 +1830,14 @@ static MagickBooleanType WritePNMImage(const ImageInfo *image_info,Image *image)
                 count=(ssize_t) FormatLocaleString(buffer,MaxTextExtent,"%u ",
                   ScaleQuantumToLong(index));
             extent=(size_t) count;
-            (void) strncpy((char *) q,buffer,extent);
-            q+=extent;
-            if ((q-pixels+extent+2) >= sizeof(pixels))
+            if ((q-pixels+extent+1) >= sizeof(pixels))
               {
                 *q++='\n';
                 (void) WriteBlob(image,q-pixels,pixels);
                 q=pixels;
               }
+            (void) strncpy((char *) q,buffer,extent);
+            q+=extent;
             p++;
           }
           *q++='\n';
@@ -1905,14 +1905,14 @@ static MagickBooleanType WritePNMImage(const ImageInfo *image_info,Image *image)
                   ScaleQuantumToLong(GetPixelGreen(p)),
                   ScaleQuantumToLong(GetPixelBlue(p)));
             extent=(size_t) count;
-            (void) strncpy((char *) q,buffer,extent);
-            q+=extent;
-            if ((q-pixels+extent+2) >= sizeof(pixels))
+            if ((q-pixels+extent+1) >= sizeof(pixels))
               {
                 *q++='\n';
                 (void) WriteBlob(image,q-pixels,pixels);
                 q=pixels;
               }
+            (void) strncpy((char *) q,buffer,extent);
+            q+=extent;
             p++;
           }
           *q++='\n';