Added extra check to make sure we don't read after an empty string.

dlemstra · dlemstra · commit 3af9a95d319a · 2025-12-02T21:52:01.000+01:00
diff --git a/coders/png.c b/coders/png.c
@@ -8074,7 +8074,7 @@ Magick_png_write_raw_profile(const ImageInfo *image_info,png_struct *ping,
    unsigned char
      hex[16]={'0','1','2','3','4','5','6','7','8','9','a','b','c','d','e','f'};
 
-   if (length > 10)
+   if ((length > 10) && (*profile_type != '\0'))
      {
        if (LocaleNCompare((char *) profile_type+1, "ng-chunk-",9) == 0)
           return;

Original file line number	Diff line number	Diff line change
`@@ -8074,7 +8074,7 @@ Magick_png_write_raw_profile(const ImageInfo image_info,png_struct ping,`
`8074`	`8074`	`unsigned char`
`8075`	`8075`	`hex[16]={'0','1','2','3','4','5','6','7','8','9','a','b','c','d','e','f'};`
`8076`	`8076`
`8077`		`- if (length > 10)`
	`8077`	`+ if ((length > 10) && (*profile_type != '\0'))`
`8078`	`8078`	`{`
`8079`	`8079`	`if (LocaleNCompare((char *) profile_type+1, "ng-chunk-",9) == 0)`
`8080`	`8080`	`return;`