Fix rare but potential memory-leak

diff --git a/ChangeLog b/ChangeLog
index 5f67a666d2d08730bda786d7b45ae3b776cbb5eb..2d0a5fd6400e67b4d304b98259cb2661f449cdf1 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,7 @@
 2018-06-28  7.0.8-3 Cristy  <quetzlzacatenango@image...>
   * Small tweaks to compile under Cygwin.
+  * Fixed numerous use of uninitialized values, integer overflow, memory
+    exceeded, and timeouts (credit to OSS Fuzz).
 
 2018-06-24  7.0.8-3 Cristy  <quetzlzacatenango@image...>
   * Release ImageMagick version 7.0.8-3, GIT revision 14489:c63c504e8:20180624.

diff --git a/coders/aai.c b/coders/aai.c
index 37e185fadd2eaee303f80d7c390efacdb0b6dc89..a744ce4768542773563a2691697b406f91979ed1 100644 (file)
--- a/coders/aai.c
+++ b/coders/aai.c
@@ -224,8 +224,8 @@ static Image *ReadAAIImage(const ImageInfo *image_info,ExceptionInfo *exception)
         AcquireNextImage(image_info,image,exception);
         if (GetNextImageInList(image) == (Image *) NULL)
           {
-            image=DestroyImageList(image);
-            return((Image *) NULL);
+            status=MagickFalse;
+            break;
           }
         image=SyncNextImageInList(image);
         status=SetImageProgress(image,LoadImagesTag,TellBlob(image),
@@ -235,6 +235,8 @@ static Image *ReadAAIImage(const ImageInfo *image_info,ExceptionInfo *exception)
       }
   } while ((width != 0UL) && (height != 0UL));
   (void) CloseBlob(image);
+  if (status == MagickFalse)
+    return(DestroyImageList(image));
   return(GetFirstImageInList(image));
 }
 \f

diff --git a/coders/avs.c b/coders/avs.c
index 43ec043d179221705f3e399061e882b905262eed..c01e1679a9b0ee786e2b0fadaa57b83974529152 100644 (file)
--- a/coders/avs.c
+++ b/coders/avs.c
@@ -223,8 +223,8 @@ static Image *ReadAVSImage(const ImageInfo *image_info,ExceptionInfo *exception)
         AcquireNextImage(image_info,image,exception);
         if (GetNextImageInList(image) == (Image *) NULL)
           {
-            image=DestroyImageList(image);
-            return((Image *) NULL);
+            status=MagickFalse;
+            break;
           }
         image=SyncNextImageInList(image);
         status=SetImageProgress(image,LoadImagesTag,TellBlob(image),
@@ -234,6 +234,8 @@ static Image *ReadAVSImage(const ImageInfo *image_info,ExceptionInfo *exception)
       }
   } while ((width != 0UL) && (height != 0UL));
   (void) CloseBlob(image);
+  if (status == MagickFalse)
+    return(DestroyImageList(image));
   return(GetFirstImageInList(image));
 }
 \f

diff --git a/coders/bmp.c b/coders/bmp.c
index 78a6cbd7a3bdaf8f025ca62709879be2c6163046..8461e1a494aecbb11450ac8dc7951c0c95a08e46 100644 (file)
--- a/coders/bmp.c
+++ b/coders/bmp.c
@@ -1459,7 +1459,7 @@ static Image *ReadBMPImage(const ImageInfo *image_info,ExceptionInfo *exception)
         AcquireNextImage(image_info,image,exception);
         if (GetNextImageInList(image) == (Image *) NULL)
           {
-            image=DestroyImageList(image);
+            status=MagickFalse;
             return((Image *) NULL);
           }
         image=SyncNextImageInList(image);
@@ -1470,6 +1470,8 @@ static Image *ReadBMPImage(const ImageInfo *image_info,ExceptionInfo *exception)
       }
   } while (IsBMP(magick,2) != MagickFalse);
   (void) CloseBlob(image);
+  if (status == MagickFalse)
+    return(DestroyImageList(image));
   return(GetFirstImageInList(image));
 }
 \f

diff --git a/coders/dcm.c b/coders/dcm.c
index cd0133278827dce87f66910ac1122c3474bcbb92..cbfd37662a6f01d407f36a529e505d7eaabac294 100644 (file)
--- a/coders/dcm.c
+++ b/coders/dcm.c
@@ -4227,8 +4227,8 @@ static Image *ReadDCMImage(const ImageInfo *image_info,ExceptionInfo *exception)
           AcquireNextImage(image_info,image,exception);
           if (GetNextImageInList(image) == (Image *) NULL)
             {
-              image=DestroyImageList(image);
-              return((Image *) NULL);
+              status=MagickFalse;
+              break;
             }
           image=SyncNextImageInList(image);
           status=SetImageProgress(image,LoadImagesTag,TellBlob(image),
@@ -4245,8 +4245,8 @@ static Image *ReadDCMImage(const ImageInfo *image_info,ExceptionInfo *exception)
         AcquireNextImage(image_info,image,exception);
         if (GetNextImageInList(image) == (Image *) NULL)
           {
-            image=DestroyImageList(image);
-            return((Image *) NULL);
+            status=MagickFalse;
+            break;
           }
         image=SyncNextImageInList(image);
         status=SetImageProgress(image,LoadImagesTag,TellBlob(image),
@@ -4273,6 +4273,8 @@ static Image *ReadDCMImage(const ImageInfo *image_info,ExceptionInfo *exception)
   if (redmap != (int *) NULL)
     redmap=(int *) RelinquishMagickMemory(redmap);
   (void) CloseBlob(image);
+  if (status == MagickFalse)
+    return(DestroyImageList(image));
   return(GetFirstImageInList(image));
 }
 \f

diff --git a/coders/dpx.c b/coders/dpx.c
index fda1a1e9d0c6570e48e2adba6eae573d506ab328..194e8d82f6216d38bb08d98356debea9d0ca3892 100644 (file)
--- a/coders/dpx.c
+++ b/coders/dpx.c
@@ -1303,8 +1303,8 @@ static Image *ReadDPXImage(const ImageInfo *image_info,ExceptionInfo *exception)
         AcquireNextImage(image_info,image,exception);
         if (GetNextImageInList(image) == (Image *) NULL)
           {
-            image=DestroyImageList(image);
-            return((Image *) NULL);
+            status=MagickFalse;
+            break;
           }
         image=SyncNextImageInList(image);
         status=SetImageProgress(image,LoadImagesTag,TellBlob(image),
@@ -1314,6 +1314,8 @@ static Image *ReadDPXImage(const ImageInfo *image_info,ExceptionInfo *exception)
       }
   }
   (void) CloseBlob(image);
+  if (status == MagickFalse)
+    return(DestroyImageList(image));
   return(GetFirstImageInList(image));
 }
 \f

diff --git a/coders/fits.c b/coders/fits.c
index 2ebeeb594a5e6f07bed0e387815d10ee6359b4ac..db74a486e1197ab2860b67cb77d79692ec2010b9 100644 (file)
--- a/coders/fits.c
+++ b/coders/fits.c
@@ -500,8 +500,8 @@ static Image *ReadFITSImage(const ImageInfo *image_info,
         AcquireNextImage(image_info,image,exception);
         if (GetNextImageInList(image) == (Image *) NULL)
           {
-            image=DestroyImageList(image);
-            return((Image *) NULL);
+            status=MagickFalse;
+            break;
           }
         image=SyncNextImageInList(image);
         status=SetImageProgress(image,LoadImagesTag,TellBlob(image),
@@ -511,6 +511,8 @@ static Image *ReadFITSImage(const ImageInfo *image_info,
       }
   }
   (void) CloseBlob(image);
+  if (status == MagickFalse)
+    return(DestroyImageList(image));
   return(GetFirstImageInList(image));
 }
 \f

diff --git a/coders/flif.c b/coders/flif.c
index 5c0b770ed680a6eca1e477fe1281a523da3f718d..4fed84d6ccb50940c92171f3234278089d3b7c90 100644 (file)
--- a/coders/flif.c
+++ b/coders/flif.c
@@ -196,10 +196,8 @@ static Image *ReadFLIFImage(const ImageInfo *image_info,
         AcquireNextImage(image_info,image,exception);
         if (GetNextImageInList(image) == (Image *) NULL)
           {
-            image=DestroyImageList(image);
-            flif_destroy_decoder(flifdec);
-            pixels=(unsigned short *) RelinquishMagickMemory(pixels);
-            return((Image *) NULL);
+            status=MagickFalse;
+            break;
           }
         image=SyncNextImageInList(image);
       }
@@ -238,6 +236,8 @@ static Image *ReadFLIFImage(const ImageInfo *image_info,
   }
   flif_destroy_decoder(flifdec);
   pixels=(unsigned short *) RelinquishMagickMemory(pixels);
+  if (status == MagickFalse)
+    return(DestroyImageList(image));
   return(image);
 }
 #endif

diff --git a/coders/gif.c b/coders/gif.c
index 21de0823c043368c6c2751b7d2fa0445772432a3..701ffd58b1f610c34a8a34ea773115b2b5697836 100644 (file)
--- a/coders/gif.c
+++ b/coders/gif.c
@@ -1238,12 +1238,8 @@ static Image *ReadGIFImage(const ImageInfo *image_info,ExceptionInfo *exception)
         AcquireNextImage(image_info,image,exception);
         if (GetNextImageInList(image) == (Image *) NULL)
           {
-            if (profiles != (LinkedListInfo *) NULL)
-              profiles=DestroyLinkedList(profiles,DestroyGIFProfile);
-            image=DestroyImageList(image);
-            global_colormap=(unsigned char *) RelinquishMagickMemory(
-              global_colormap);
-            return((Image *) NULL);
+            status=MagickFalse;
+            break;
           }
         image=SyncNextImageInList(image);
       }
@@ -1393,6 +1389,8 @@ static Image *ReadGIFImage(const ImageInfo *image_info,ExceptionInfo *exception)
   if ((image->columns == 0) || (image->rows == 0))
     ThrowReaderException(CorruptImageError,"NegativeOrZeroImageSize");
   (void) CloseBlob(image);
+  if (status == MagickFalse)
+    return(DestroyImageList(image));
   return(GetFirstImageInList(image));
 }
 \f

diff --git a/coders/heic.c b/coders/heic.c
index f9ed658d62406851aae8f7b7a51ae5e329dcea5c..16375ecc715673719063f4ce8e526a4d01aec03f 100644 (file)
--- a/coders/heic.c
+++ b/coders/heic.c
@@ -620,7 +620,10 @@ static MagickBooleanType WriteHEICImage(const ImageInfo *image_info,Image *image
     if (status == MagickFalse)
       break;
     if (GetNextImageInList(image) == (Image *) NULL)
-      break;
+      {
+        status=MagickFalse;
+        break;
+      }
     image=SyncNextImageInList(image);
     status=SetImageProgress(image,SaveImagesTag,scene,
       GetImageListLength(image));

diff --git a/coders/html.c b/coders/html.c
index 511ba15d990600c7bd596d9442d52a84389e7c97..9b4f5d6800d692a5d766f2d58c4251ff6e400551 100644 (file)
--- a/coders/html.c
+++ b/coders/html.c
@@ -271,7 +271,8 @@ static MagickBooleanType WriteHTMLImage(const ImageInfo *image_info,
   AppendImageFormat("map",filename);
   GetPathComponent(filename,BasePath,basename);
   (void) CopyMagickString(mapname,basename,MagickPathExtent);
-  (void) CopyMagickString(image->filename,image_info->filename,MagickPathExtent);
+  (void) CopyMagickString(image->filename,image_info->filename,
+    MagickPathExtent);
   (void) CopyMagickString(filename,image->filename,MagickPathExtent);
   write_info=CloneImageInfo(image_info);
   *write_info->magick='\0';

diff --git a/coders/icon.c b/coders/icon.c
index 277cc45af54f159e90cb85735fc554abcbbe1bb7..7df403acac82c1f1d46ccfc8f4c4147a31879d08 100644 (file)
--- a/coders/icon.c
+++ b/coders/icon.c
@@ -738,8 +738,8 @@ static Image *ReadICONImage(const ImageInfo *image_info,
         AcquireNextImage(image_info,image,exception);
         if (GetNextImageInList(image) == (Image *) NULL)
           {
-            image=DestroyImageList(image);
-            return((Image *) NULL);
+            status=MagickFalse;
+            break;
           }
         image=SyncNextImageInList(image);
         status=SetImageProgress(image,LoadImagesTag,TellBlob(image),
@@ -749,6 +749,8 @@ static Image *ReadICONImage(const ImageInfo *image_info,
       }
   }
   (void) CloseBlob(image);
+  if (status == MagickFalse)
+    return(DestroyImageList(image));
   return(GetFirstImageInList(image));
 }
 \f

diff --git a/coders/ipl.c b/coders/ipl.c
index e19f72c3e2787917bbd3ec967a33dcc63caaa42f..e6680c39988106e1a6eb21d242f1765ff3c84d43 100644 (file)
--- a/coders/ipl.c
+++ b/coders/ipl.c
@@ -403,16 +403,17 @@ static Image *ReadIPLImage(const ImageInfo *image_info,ExceptionInfo *exception)
                  image->filename);
       break;
     }
-   if(t_count < ipl_info.z * ipl_info.time){
+   if (t_count < ipl_info.z * ipl_info.time)
+     {
       /*
        Proceed to next image.
        */
       AcquireNextImage(image_info,image,exception);
       if (GetNextImageInList(image) == (Image *) NULL)
-      {
-        image=DestroyImageList(image);
-        return((Image *) NULL);
-      }
+        {
+          status=MagickFalse;
+          break;
+        }
       image=SyncNextImageInList(image); 
       status=SetImageProgress(image,LoadImagesTag,TellBlob(image),
         GetBlobSize(image));
@@ -421,6 +422,8 @@ static Image *ReadIPLImage(const ImageInfo *image_info,ExceptionInfo *exception)
     }
   } while (t_count < ipl_info.z*ipl_info.time);
   CloseBlob(image);
+  if (status == MagickFalse)
+    return(DestroyImageList(image));
   return(GetFirstImageInList(image));
 }
 \f

diff --git a/coders/mat.c b/coders/mat.c
index 43e9bfac19cc2c1447daf822f0de3296c6f9bc52..3be3bcbb86164ae6f23549c559890dc5023ebabc 100644 (file)
--- a/coders/mat.c
+++ b/coders/mat.c
@@ -814,7 +814,10 @@ static Image *ReadMATImageV4(const ImageInfo *image_info,Image *image,
 skip_reading_current:
     AcquireNextImage(image_info,image,exception);
     if (GetNextImageInList(image) == (Image *) NULL)
-      return(DestroyImageList(image));
+      {
+        status=MagickFalse;
+        break;
+      }
     image=SyncNextImageInList(image);
     status=SetImageProgress(image,LoadImagesTag,TellBlob(image),
       GetBlobSize(image));
@@ -822,6 +825,8 @@ skip_reading_current:
       break;
   }
   (void) CloseBlob(image);
+  if (status == MagickFalse)
+    return(DestroyImageList(image));
   return(GetFirstImageInList(image));
 }
 \f

diff --git a/coders/miff.c b/coders/miff.c
index cb529ea7060e27f4c5403a7a8044d49b8498dd81..2dd48086169075f5a18404d151fa9b755b8c1fef 100644 (file)
--- a/coders/miff.c
+++ b/coders/miff.c
@@ -1695,8 +1695,8 @@ static Image *ReadMIFFImage(const ImageInfo *image_info,
         AcquireNextImage(image_info,image,exception);
         if (GetNextImageInList(image) == (Image *) NULL)
           {
-            image=DestroyImageList(image);
-            return((Image *) NULL);
+            status=MagickFalse;
+            break;
           }
         image=SyncNextImageInList(image);
         status=SetImageProgress(image,LoadImagesTag,TellBlob(image),
@@ -1706,6 +1706,8 @@ static Image *ReadMIFFImage(const ImageInfo *image_info,
       }
   } while (c != EOF);
   (void) CloseBlob(image);
+  if (status == MagickFalse)
+    return(DestroyImageList(image));
   return(GetFirstImageInList(image));
 }
 \f

diff --git a/coders/mpc.c b/coders/mpc.c
index 16bb1b9b1ddf0bc8bb451023b5d58ce942ca82c8..a118d2a83212067b98142a515aa8933bc82f5a43 100644 (file)
--- a/coders/mpc.c
+++ b/coders/mpc.c
@@ -1022,6 +1022,8 @@ static Image *ReadMPCImage(const ImageInfo *image_info,ExceptionInfo *exception)
       }
   } while (c != EOF);
   (void) CloseBlob(image);
+  if (status == MagickFalse)
+    return(DestroyImageList(image));
   return(GetFirstImageInList(image));
 }
 \f

diff --git a/coders/mtv.c b/coders/mtv.c
index 04895567fa2a41b09f2b186b257d864e4618e962..1faf6f034597adb7f1d6272b79e3844438a4e626 100644 (file)
--- a/coders/mtv.c
+++ b/coders/mtv.c
@@ -224,8 +224,8 @@ static Image *ReadMTVImage(const ImageInfo *image_info,ExceptionInfo *exception)
         AcquireNextImage(image_info,image,exception);
         if (GetNextImageInList(image) == (Image *) NULL)
           {
-            image=DestroyImageList(image);
-            return((Image *) NULL);
+            status=MagickFalse;
+            break;
           }
         image=SyncNextImageInList(image);
         status=SetImageProgress(image,LoadImagesTag,TellBlob(image),
@@ -235,6 +235,8 @@ static Image *ReadMTVImage(const ImageInfo *image_info,ExceptionInfo *exception)
       }
   } while (count > 0);
   (void) CloseBlob(image);
+  if (status == MagickFalse)
+    return(DestroyImageList(image));
   return(GetFirstImageInList(image));
 }
 \f

diff --git a/coders/palm.c b/coders/palm.c
index c7aa8b0ea8ee4fc28e021a2db606c2ab096ccade..cc5d42a9dc470a0bd19ae4fd9ad450f698e86aff 100644 (file)
--- a/coders/palm.c
+++ b/coders/palm.c
@@ -582,8 +582,8 @@ static Image *ReadPALMImage(const ImageInfo *image_info,
         AcquireNextImage(image_info,image,exception);
         if (GetNextImageInList(image) == (Image *) NULL)
           {
-            (void) DestroyImageList(image);
-            return((Image *) NULL);
+            status=MagickFalse;
+            break;
           }
         image=SyncNextImageInList(image);
         status=SetImageProgress(image,LoadImagesTag,TellBlob(image),
@@ -593,6 +593,8 @@ static Image *ReadPALMImage(const ImageInfo *image_info,
       }
   } while (nextDepthOffset != 0);
   (void) CloseBlob(image);
+  if (status == MagickFalse)
+    return(DestroyImageList(image));
   return(GetFirstImageInList(image));
 }
 \f

diff --git a/coders/pcd.c b/coders/pcd.c
index a28cc6b856ef343104b4e36a26c7388486c6f239..42941a937cacd44fdf58d38ba8ce67b2d1a9d225 100644 (file)
--- a/coders/pcd.c
+++ b/coders/pcd.c
@@ -722,8 +722,8 @@ static Image *ReadPCDImage(const ImageInfo *image_info,ExceptionInfo *exception)
             AcquireNextImage(image_info,image,exception);
             if (GetNextImageInList(image) == (Image *) NULL)
               {
-                image=DestroyImageList(image);
-                return((Image *) NULL);
+                status=MagickFalse;
+                break;
               }
             image=SyncNextImageInList(image);
           }
@@ -739,8 +739,9 @@ static Image *ReadPCDImage(const ImageInfo *image_info,ExceptionInfo *exception)
       chroma2=(unsigned char *) RelinquishMagickMemory(chroma2);
       chroma1=(unsigned char *) RelinquishMagickMemory(chroma1);
       luma=(unsigned char *) RelinquishMagickMemory(luma);
-      image=GetFirstImageInList(image);
-      return(OverviewImage(image_info,image,exception));
+      if (status == MagickFalse)
+        return(DestroyImageList(image));
+      return(OverviewImage(image_info,GetFirstImageInList(image),exception));
     }
   /*
     Read interleaved image.

diff --git a/coders/pcx.c b/coders/pcx.c
index 60e6233a03204ae85f9a6211c892b30a2f541e6c..f4dc9207eaf15ab6e2e30f1698c83f23fda7d946 100644 (file)
--- a/coders/pcx.c
+++ b/coders/pcx.c
@@ -684,8 +684,8 @@ static Image *ReadPCXImage(const ImageInfo *image_info,ExceptionInfo *exception)
         AcquireNextImage(image_info,image,exception);
         if (GetNextImageInList(image) == (Image *) NULL)
           {
-            image=DestroyImageList(image);
-            return((Image *) NULL);
+            status=MagickFalse;
+            break;
           }
         image=SyncNextImageInList(image);
         status=SetImageProgress(image,LoadImagesTag,TellBlob(image),
@@ -697,6 +697,8 @@ static Image *ReadPCXImage(const ImageInfo *image_info,ExceptionInfo *exception)
   if (page_table != (MagickOffsetType *) NULL)
     page_table=(MagickOffsetType *) RelinquishMagickMemory(page_table);
   (void) CloseBlob(image);
+  if (status == MagickFalse)
+    return(DestroyImageList(image));
   return(GetFirstImageInList(image));
 }
 \f

diff --git a/coders/pix.c b/coders/pix.c
index cc2b9eb8da9d34d66a25510e67a38a43699153a1..c5ba3e7227528de00ee0db354754721b3be6c73f 100644 (file)
--- a/coders/pix.c
+++ b/coders/pix.c
@@ -244,8 +244,8 @@ static Image *ReadPIXImage(const ImageInfo *image_info,ExceptionInfo *exception)
         AcquireNextImage(image_info,image,exception);
         if (GetNextImageInList(image) == (Image *) NULL)
           {
-            image=DestroyImageList(image);
-            return((Image *) NULL);
+            status=MagickFalse;
+            break;
           }
         image=SyncNextImageInList(image);
         status=SetImageProgress(image,LoadImagesTag,TellBlob(image),
@@ -255,6 +255,8 @@ static Image *ReadPIXImage(const ImageInfo *image_info,ExceptionInfo *exception)
       }
   } while (status != MagickFalse);
   (void) CloseBlob(image);
+  if (status == MagickFalse)
+    return(DestroyImageList(image));
   return(GetFirstImageInList(image));
 }
 \f

diff --git a/coders/pnm.c b/coders/pnm.c
index 6d9bec6d6e2193a5b2f94d77e5e202f7cd6cac69..9fbadd539258c980ccf485b2cacefc99c2c6dbca 100644 (file)
--- a/coders/pnm.c
+++ b/coders/pnm.c
@@ -1375,8 +1375,8 @@ static Image *ReadPNMImage(const ImageInfo *image_info,ExceptionInfo *exception)
         AcquireNextImage(image_info,image,exception);
         if (GetNextImageInList(image) == (Image *) NULL)
           {
-            image=DestroyImageList(image);
-            return((Image *) NULL);
+            status=MagickFalse;
+            break;
           }
         image=SyncNextImageInList(image);
         status=SetImageProgress(image,LoadImagesTag,TellBlob(image),
@@ -1386,6 +1386,8 @@ static Image *ReadPNMImage(const ImageInfo *image_info,ExceptionInfo *exception)
       }
   } while ((count == 1) && (format == 'P'));
   (void) CloseBlob(image);
+  if (status == MagickFalse)
+    return(DestroyImageList(image));
   return(GetFirstImageInList(image));
 }
 \f

diff --git a/coders/raw.c b/coders/raw.c
index 446c525c539a775eda47c1a7c726d378f1e91a3a..17ac37a64af3c5ded9b2a251eef8942bc1f8fb99 100644 (file)
--- a/coders/raw.c
+++ b/coders/raw.c
@@ -275,8 +275,8 @@ static Image *ReadRAWImage(const ImageInfo *image_info,ExceptionInfo *exception)
         AcquireNextImage(image_info,image,exception);
         if (GetNextImageInList(image) == (Image *) NULL)
           {
-            image=DestroyImageList(image);
-            return((Image *) NULL);
+            status=MagickFalse;
+            break;
           }
         image=SyncNextImageInList(image);
         status=SetImageProgress(image,LoadImagesTag,TellBlob(image),

diff --git a/coders/rgb.c b/coders/rgb.c
index f4f28548f4ef9b0d887e10ceee3d36ba4470529e..005440f2cc48378f5b429e5a325a82103845f43d 100644 (file)
--- a/coders/rgb.c
+++ b/coders/rgb.c
@@ -982,7 +982,7 @@ static Image *ReadRGBImage(const ImageInfo *image_info,ExceptionInfo *exception)
   canvas_image=DestroyImage(canvas_image);
   (void) CloseBlob(image);
   if (status == MagickFalse)
-      return(DestroyImageList(image));
+    return(DestroyImageList(image));
   return(GetFirstImageInList(image));
 }
 \f

diff --git a/coders/rle.c b/coders/rle.c
index 583593a6ca258cfb76cfb3306ae33ff9d9970a3f..64b8a41a2f7c898ce2c38a566fb76804592f2bc8 100644 (file)
--- a/coders/rle.c
+++ b/coders/rle.c
@@ -701,8 +701,8 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
         AcquireNextImage(image_info,image,exception);
         if (GetNextImageInList(image) == (Image *) NULL)
           {
-            image=DestroyImageList(image);
-            return((Image *) NULL);
+            status=MagickFalse;
+            break;
           }
         image=SyncNextImageInList(image);
         status=SetImageProgress(image,LoadImagesTag,TellBlob(image),
@@ -712,6 +712,8 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
       }
   } while ((count != 0) && (memcmp(magick,"\122\314",2) == 0));
   (void) CloseBlob(image);
+  if (status == MagickFalse)
+    return(DestroyImageList(image));
   return(GetFirstImageInList(image));
 }
 \f

diff --git a/coders/sgi.c b/coders/sgi.c
index e45792dfc43df5b958f803e24a05ad8427a97fa0..374eb2d32bb1725a860903673f8020885acb8b69 100644 (file)
--- a/coders/sgi.c
+++ b/coders/sgi.c
@@ -738,8 +738,8 @@ static Image *ReadSGIImage(const ImageInfo *image_info,ExceptionInfo *exception)
         AcquireNextImage(image_info,image,exception);
         if (GetNextImageInList(image) == (Image *) NULL)
           {
-            image=DestroyImageList(image);
-            return((Image *) NULL);
+            status=MagickFalse;
+            break;
           }
         image=SyncNextImageInList(image);
         status=SetImageProgress(image,LoadImagesTag,TellBlob(image),
@@ -749,6 +749,8 @@ static Image *ReadSGIImage(const ImageInfo *image_info,ExceptionInfo *exception)
       }
   } while (iris_info.magic == 0x01DA);
   (void) CloseBlob(image);
+  if (status == MagickFalse)
+    return(DestroyImageList(image));
   return(GetFirstImageInList(image));
 }
 \f

diff --git a/coders/sun.c b/coders/sun.c
index edf5a8397462b373fbc4cb4b11d97b0dfd4eb458..ff029d39c4b938066fb17738af727a1177c32218 100644 (file)
--- a/coders/sun.c
+++ b/coders/sun.c
@@ -649,8 +649,8 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
         AcquireNextImage(image_info,image,exception);
         if (GetNextImageInList(image) == (Image *) NULL)
           {
-            image=DestroyImageList(image);
-            return((Image *) NULL);
+            status=MagickFalse;
+            break;
           }
         image=SyncNextImageInList(image);
         status=SetImageProgress(image,LoadImagesTag,TellBlob(image),
@@ -660,6 +660,8 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
       }
   } while (sun_info.magic == 0x59a66a95);
   (void) CloseBlob(image);
+  if (status == MagickFalse)
+    return(DestroyImageList(image));
   return(GetFirstImageInList(image));
 }
 \f

diff --git a/coders/tiff.c b/coders/tiff.c
index 51f5f2b9e4a674c5ac5476e31290f7e0065fec34..2d52addc0ded72eb842a173b538ac0575d151847 100644 (file)
--- a/coders/tiff.c
+++ b/coders/tiff.c
@@ -1250,6 +1250,7 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
     tiff_status;
 
   MagickBooleanType
+    more_frames,
     status;
 
   MagickSizeType
@@ -1356,6 +1357,7 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
           }
       }
   }
+  more_frames=MagickTrue;
   do
   {
 DisableMSCWarning(4127)
@@ -2232,8 +2234,8 @@ RestoreMSCWarning
     if (image_info->number_scenes != 0)
       if (image->scene >= (image_info->scene+image_info->number_scenes-1))
         break;
-    status=TIFFReadDirectory(tiff) != 0 ? MagickTrue : MagickFalse;
-    if (status != MagickFalse)
+    more_frames=TIFFReadDirectory(tiff) != 0 ? MagickTrue : MagickFalse;
+    if (more_frames != MagickFalse)
       {
         /*
           Allocate next image structure.
@@ -2241,8 +2243,8 @@ RestoreMSCWarning
         AcquireNextImage(image_info,image,exception);
         if (GetNextImageInList(image) == (Image *) NULL)
           {
-            image=DestroyImageList(image);
-            return((Image *) NULL);
+            status=MagickFalse;
+            break;
           }
         image=SyncNextImageInList(image);
         status=SetImageProgress(image,LoadImagesTag,image->scene-1,
@@ -2250,18 +2252,14 @@ RestoreMSCWarning
         if (status == MagickFalse)
           break;
       }
-  } while (status != MagickFalse);
+  } while ((status != MagickFalse) && (more_frames != MagickFalse));
   TIFFClose(tiff);
   TIFFReadPhotoshopLayers(image,image_info,exception);
-  if (image_info->number_scenes != 0)
-    {
-      if (image_info->scene >= GetImageListLength(image))
-        {
-          /* Subimage was not found in the Photoshop layer */
-          image=DestroyImageList(image);
-          return((Image *)NULL);
-        }
-    }
+  if ((image_info->number_scenes != 0) &&
+      (image_info->scene >= GetImageListLength(image)))
+    status=MagickFalse;
+  if (status == MagickFalse)
+    return(DestroyImageList(image));
   return(GetFirstImageInList(image));
 }
 #endif

diff --git a/coders/tim.c b/coders/tim.c
index afccbc9274da3aa5e83c73181d86b95315ad78ac..cb557b83733647638c02ebdd0d317e9f1fcb7c6e 100644 (file)
--- a/coders/tim.c
+++ b/coders/tim.c
@@ -419,8 +419,8 @@ static Image *ReadTIMImage(const ImageInfo *image_info,ExceptionInfo *exception)
         AcquireNextImage(image_info,image,exception);
         if (GetNextImageInList(image) == (Image *) NULL)
           {
-            image=DestroyImageList(image);
-            return((Image *) NULL);
+            status=MagickFalse;
+            break;
           }
         image=SyncNextImageInList(image);
         status=SetImageProgress(image,LoadImagesTag,TellBlob(image),
@@ -430,6 +430,8 @@ static Image *ReadTIMImage(const ImageInfo *image_info,ExceptionInfo *exception)
       }
   } while (tim_info.id == 0x00000010);
   (void) CloseBlob(image);
+  if (status == MagickFalse)
+    return(DestroyImageList(image));
   return(GetFirstImageInList(image));
 }
 \f

diff --git a/coders/txt.c b/coders/txt.c
index 42d2b8572d4906507ce4019fd028a70203dd2947..64aef87508cefca6b48047a065e7997de63e7a40 100644 (file)
--- a/coders/txt.c
+++ b/coders/txt.c
@@ -595,8 +595,8 @@ static Image *ReadTXTImage(const ImageInfo *image_info,ExceptionInfo *exception)
         AcquireNextImage(image_info,image,exception);
         if (GetNextImageInList(image) == (Image *) NULL)
           {
-            image=DestroyImageList(image);
-            return((Image *) NULL);
+            status=MagickFalse;
+            break;
           }
         image=SyncNextImageInList(image);
         status=SetImageProgress(image,LoadImagesTag,TellBlob(image),
@@ -606,6 +606,8 @@ static Image *ReadTXTImage(const ImageInfo *image_info,ExceptionInfo *exception)
       }
   } while (LocaleNCompare((char *) text,MagickID,strlen(MagickID)) == 0);
   (void) CloseBlob(image);
+  if (status == MagickFalse)
+    return(DestroyImageList(image));
   return(GetFirstImageInList(image));
 }
 \f

diff --git a/coders/viff.c b/coders/viff.c
index 92809e4bc6eac7805c04c735e36080b532def28a..8b47d213589bc155b87e0d20059f6cd4a5b6505d 100644 (file)
--- a/coders/viff.c
+++ b/coders/viff.c
@@ -782,6 +782,8 @@ static Image *ReadVIFFImage(const ImageInfo *image_info,
       }
   } while ((count != 0) && (viff_info.identifier == 0xab));
   (void) CloseBlob(image);
+  if (status == MagickFalse)
+    return(DestroyImageList(image));
   return(GetFirstImageInList(image));
 }
 \f

diff --git a/coders/yuv.c b/coders/yuv.c
index 8c6d79a8cd3636e16d4b864293727a329cf57139..b2541481ef2ba523c01ef5a98b4e024cf566e84d 100644 (file)
--- a/coders/yuv.c
+++ b/coders/yuv.c
@@ -500,9 +500,8 @@ static Image *ReadYUVImage(const ImageInfo *image_info,ExceptionInfo *exception)
         AcquireNextImage(image_info,image,exception);
         if (GetNextImageInList(image) == (Image *) NULL)
           {
-            scanline=(unsigned char *) RelinquishMagickMemory(scanline); 
-            image=DestroyImageList(image);
-            return((Image *) NULL);
+            status=MagickFalse;
+            break;
           }
         image=SyncNextImageInList(image);
         status=SetImageProgress(image,LoadImagesTag,TellBlob(image),