http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=26843

diff --git a/coders/miff.c b/coders/miff.c
index dce2738d8ecc6d87a567e7ab5a1fc0ebf09c361b..68825abfe5ea5c2a72bbaae27550b2ee84aca6de 100644 (file)
--- a/coders/miff.c
+++ b/coders/miff.c
@@ -561,6 +561,7 @@ static Image *ReadMIFFImage(const ImageInfo *image_info,
             /*
               Get the keyword.
             */
+            length=MaxTextExtent;
             p=keyword;
             do
             {
@@ -592,9 +593,6 @@ static Image *ReadMIFFImage(const ImageInfo *image_info,
                         break;
                       p=options+strlen(options);
                     }
-                  if (options == (char *) NULL)
-                    ThrowReaderException(ResourceLimitError,
-                      "MemoryAllocationFailed");
                   *p++=(char) c;
                   c=ReadBlobByte(image);
                   if (c == '\\')
@@ -609,7 +607,11 @@ static Image *ReadMIFFImage(const ImageInfo *image_info,
                   if (*options != '{')
                     if (isspace((int) ((unsigned char) c)) != 0)
                       break;
-                } }
+                }
+                if (options == (char *) NULL)
+                  ThrowReaderException(ResourceLimitError,
+                    "MemoryAllocationFailed");
+              }
             *p='\0';
             if (*options == '{')
               (void) CopyMagickString(options,options+1,strlen(options));

diff --git a/coders/mpc.c b/coders/mpc.c
index b29657b6246fd8c81cd62f4d7a66bb71524c9bdc..8abd0607f3aa0045015ff0b2dfd92ea8e39f9ed8 100644 (file)
--- a/coders/mpc.c
+++ b/coders/mpc.c
@@ -276,6 +276,7 @@ static Image *ReadMPCImage(const ImageInfo *image_info,ExceptionInfo *exception)
             /*
               Get the keyword.
             */
+            length=MaxTextExtent;
             p=keyword;
             do
             {
@@ -307,9 +308,6 @@ static Image *ReadMPCImage(const ImageInfo *image_info,ExceptionInfo *exception)
                         break;
                       p=options+strlen(options);
                     }
-                  if (options == (char *) NULL)
-                    ThrowReaderException(ResourceLimitError,
-                      "MemoryAllocationFailed");
                   *p++=(char) c;
                   c=ReadBlobByte(image);
                   if (c == '\\')
@@ -325,6 +323,9 @@ static Image *ReadMPCImage(const ImageInfo *image_info,ExceptionInfo *exception)
                     if (isspace((int) ((unsigned char) c)) != 0)
                       break;
                 }
+                if (options == (char *) NULL)
+                  ThrowReaderException(ResourceLimitError,
+                    "MemoryAllocationFailed");
               }
             *p='\0';
             if (*options == '{')