Undo temporary overallocation in the MNG decoder

diff --git a/coders/png.c b/coders/png.c
index 04730f47dcb81a4008970ffe0f21d95e6a15080e..60e072f7911e0fe409421bedb6eeffdfc9ca7924 100644 (file)
--- a/coders/png.c
+++ b/coders/png.c
@@ -4392,8 +4392,7 @@ static Image *ReadOneJNGImage(MngInfo *mng_info,
       {
         if (length > GetBlobSize(image))
           ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
-        chunk=(unsigned char *) AcquireQuantumMemory(length+MagickPathExtent,
-          sizeof(*chunk));
+        chunk=(unsigned char *) AcquireQuantumMemory(length,sizeof(*chunk));
 
         if (chunk == (unsigned char *) NULL)
           ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
@@ -5271,8 +5270,7 @@ static Image *ReadOneMNGImage(MngInfo* mng_info, const ImageInfo *image_info,
             if (length > GetBlobSize(image))
               ThrowReaderException(CorruptImageError,
                 "InsufficientImageDataInFile");
-            chunk=(unsigned char *) AcquireQuantumMemory(length+
-             MagickPathExtent,sizeof(*chunk));
+            chunk=(unsigned char *) AcquireQuantumMemory(length,sizeof(*chunk));
 
             if (chunk == (unsigned char *) NULL)
               ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");