https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6192

diff --git a/MagickCore/list.c b/MagickCore/list.c
index 54e758fc12848c87908734a369235a1d69bb2752..c6e62c3f07f122babfc99480cff5619aef7b912b 100644 (file)
--- a/MagickCore/list.c
+++ b/MagickCore/list.c
@@ -135,10 +135,14 @@ MagickExport Image *CloneImageList(const Image *images,ExceptionInfo *exception)
     return((Image *) NULL);
   assert(images->signature == MagickCoreSignature);
   while (images->previous != (Image *) NULL)
+  {
+    assert(images != images->previous);
     images=images->previous;
+  }
   image=(Image *) NULL;
   for (p=(Image *) NULL; images != (Image *) NULL; images=images->next)
   {
+    assert(images != images->next);
     clone=CloneImage(images,0,0,MagickTrue,exception);
     if (clone == (Image *) NULL)
       {
@@ -650,7 +654,10 @@ MagickExport ssize_t GetImageIndexInList(const Image *images)
     return(-1);
   assert(images->signature == MagickCoreSignature);
   for (i=0; images->previous != (Image *) NULL; i++)
+  {
+    assert(images != images->previous);
     images=images->previous;
+  }
   return(i);
 }
 \f
@@ -689,7 +696,10 @@ MagickExport size_t GetImageListLength(const Image *images)
     (void) LogMagickEvent(TraceEvent,GetMagickModule(),"%s",images->filename);
   images=GetLastImageInList(images);
   for (i=0; images != (Image *) NULL; images=images->previous)
+  {
+    assert(images != images->previous);
     i++;
+  }
   return((size_t) i);
 }
 \f
@@ -846,7 +856,10 @@ MagickExport Image **ImageListToArray(const Image *images,
     }
   images=GetFirstImageInList(images);
   for (i=0; images != (Image *) NULL; images=images->next)
+  {
+    assert(images != images->next);
     group[i++]=(Image *) images;
+  }
   group[i]=(Image *) NULL;
   return(group);
 }

diff --git a/coders/mat.c b/coders/mat.c
index 7194c6efa27bd860db439c58b0d83ba0147d2da1..ae1874635d4e262e9b2bc078fe2edc4fa608659d 100644 (file)
--- a/coders/mat.c
+++ b/coders/mat.c
@@ -686,7 +686,6 @@ static Image *ReadMATImageV4(const ImageInfo *image_info,Image *image,
     }
     image->columns=(size_t) HDR.nRows;
     image->rows=(size_t) HDR.nCols;
-    SetImageColorspace(image,GRAYColorspace,exception);
     if (image_info->ping != MagickFalse)
       {
         Swap(image->columns,image->rows);
@@ -698,6 +697,7 @@ static Image *ReadMATImageV4(const ImageInfo *image_info,Image *image,
     if (status == MagickFalse)
       return((Image *) NULL);
     (void) SetImageBackgroundColor(image,exception);
+    (void) SetImageColorspace(image,GRAYColorspace,exception);
     quantum_info=AcquireQuantumInfo(image_info,image);
     if (quantum_info == (QuantumInfo *) NULL)
       return((Image *) NULL);