From 21923086e5269e970ef3f97d6c0e1e87bb49daaf Mon Sep 17 00:00:00 2001
From: dirk <dirk@git.imagemagick.org>
Date: Thu, 18 Aug 2016 20:07:27 +0200
Subject: [PATCH] Corrected length of APP1 profile that is written inside the
 JPEG encoder (#454).

Former-commit-id: ea696cd10090a17d6afeb9d12b75c6f13740f1d5
Former-commit-id: c8fb6d3e38f358174751efb09de068743844de82
Former-commit-id: 0be10012c38c1290af56e1d80d363ba21e94f899
---
 src/ImageProcessorCore/Formats/Jpg/JpegEncoderCore.cs | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/ImageProcessorCore/Formats/Jpg/JpegEncoderCore.cs b/src/ImageProcessorCore/Formats/Jpg/JpegEncoderCore.cs
index 2368a498d..cc7dfa7f9 100644
--- a/src/ImageProcessorCore/Formats/Jpg/JpegEncoderCore.cs
+++ b/src/ImageProcessorCore/Formats/Jpg/JpegEncoderCore.cs
@@ -595,10 +595,12 @@ namespace ImageProcessorCore.Formats
                 throw new ImageFormatException("Exif profile size exceeds limit.");
             }
 
+            int length = data.Length + 2;
+
             this.buffer[0] = JpegConstants.Markers.XFF;
             this.buffer[1] = JpegConstants.Markers.APP1; // Application Marker
-            this.buffer[2] = (byte)((data.Length >> 8) & 0xFF);
-            this.buffer[3] = (byte)(data.Length & 0xFF);
+            this.buffer[2] = (byte)((length >> 8) & 0xFF);
+            this.buffer[3] = (byte)(length & 0xFF);
 
             this.outputStream.Write(this.buffer, 0, 4);
             this.outputStream.Write(data, 0, data.Length);