File ImageMagick-CVE-2016-7538.patch of Package ImageMagick.29977
--- a/coders/psd.c
+++ b/coders/psd.c
@@ -2542,9 +2542,12 @@ static void RemoveICCProfileFromResourceBlock(StringInfo *bim_profile)
p=PushLongPixel(MSBEndian,p,&count);
if (id == 0x0000040f)
{
- (void) CopyMagickMemory(q,q+PSDQuantum(count)+12,length-
- (PSDQuantum(count)+12)-(q-datum));
- SetStringInfoLength(bim_profile,length-(PSDQuantum(count)+12));
+ if ((q+PSDQuantum(count)+12) < (datum+length-16))
+ {
+ (void) CopyMagickMemory(q,q+PSDQuantum(count)+12,length-
+ (PSDQuantum(count)+12)-(q-datum));
+ SetStringInfoLength(bim_profile,length-(PSDQuantum(count)+12));
+ }
break;
}
p+=count;