Temporary over-allocation until Glenn applies a proper fix:

  https://github.com/ImageMagick/ImageMagick/issues/538
  https://github.com/ImageMagick/ImageMagick/issues/540
  https://github.com/ImageMagick/ImageMagick/issues/541

diff --git a/coders/png.c b/coders/png.c
index 8c8f0c69fa4d1ebdfc534453f04a0c251f9b6d7c..dfe6843ac1cc8bfdb501e091a86ec3bea57924ed 100644 (file)
--- a/coders/png.c
+++ b/coders/png.c
@@ -4384,7 +4384,8 @@ static Image *ReadOneJNGImage(MngInfo *mng_info,
 
     if (length != 0)
       {
-        chunk=(unsigned char *) AcquireQuantumMemory(length,sizeof(*chunk));
+        chunk=(unsigned char *) AcquireQuantumMemory(length+MagickPathExtent,
+          sizeof(*chunk));
 
         if (chunk == (unsigned char *) NULL)
           ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
@@ -5259,8 +5260,8 @@ static Image *ReadOneMNGImage(MngInfo* mng_info, const ImageInfo *image_info,
 
         if (length != 0)
           {
-            chunk=(unsigned char *) AcquireQuantumMemory(length,
-             sizeof(*chunk));
+            chunk=(unsigned char *) AcquireQuantumMemory(length_
+             MagickPathExtent,sizeof(*chunk));
 
             if (chunk == (unsigned char *) NULL)
               ThrowReaderException(ResourceLimitError,