https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9879

diff --git a/coders/gradient.c b/coders/gradient.c
index 9901067b5228f50d2c739c23c0840263375e5120..2aad031a40b4623c7fdcd549d88d6308172591b0 100644 (file)
--- a/coders/gradient.c
+++ b/coders/gradient.c
@@ -92,6 +92,77 @@
 %    o exception: return any errors or warnings in this structure.
 %
 */
+
+static Image *ReadXCImage(const ImageInfo *image_info,ExceptionInfo *exception)
+{
+  Image
+    *image;
+
+  MagickBooleanType
+    status;
+
+  PixelInfo
+    pixel;
+
+  register ssize_t
+    x;
+
+  register Quantum
+    *q;
+
+  ssize_t
+    y;
+
+  /*
+    Initialize Image structure.
+  */
+  assert(image_info != (const ImageInfo *) NULL);
+  assert(image_info->signature == MagickCoreSignature);
+  if (image_info->debug != MagickFalse)
+    (void) LogMagickEvent(TraceEvent,GetMagickModule(),"%s",
+      image_info->filename);
+  assert(exception != (ExceptionInfo *) NULL);
+  assert(exception->signature == MagickCoreSignature);
+  image=AcquireImage(image_info,exception);
+  if (image->columns == 0)
+    image->columns=1;
+  if (image->rows == 0)
+    image->rows=1;
+  status=SetImageExtent(image,image->columns,image->rows,exception);
+  if (status == MagickFalse)
+    return(DestroyImageList(image));
+  (void) CopyMagickString(image->filename,image_info->filename,
+    MagickPathExtent);
+  if (*image_info->filename == '\0')
+    pixel=image->background_color;
+  else
+    {
+      status=QueryColorCompliance((char *) image_info->filename,AllCompliance,
+        &pixel,exception);
+      if (status == MagickFalse)
+        {
+          image=DestroyImage(image);
+          return((Image *) NULL);
+        }
+    }
+  (void) SetImageColorspace(image,pixel.colorspace,exception);
+  image->alpha_trait=pixel.alpha_trait;
+  for (y=0; y < (ssize_t) image->rows; y++)
+  {
+    q=QueueAuthenticPixels(image,0,y,image->columns,1,exception);
+    if (q == (Quantum *) NULL)
+      break;
+    for (x=0; x < (ssize_t) image->columns; x++)
+    {
+      SetPixelViaPixelInfo(image,&pixel,q);
+      q+=GetPixelChannels(image);
+    }
+    if (SyncAuthenticPixels(image,exception) == MagickFalse)
+      break;
+  }
+  return(GetFirstImageInList(image));
+}
+
 static Image *ReadGRADIENTImage(const ImageInfo *image_info,
   ExceptionInfo *exception)
 {
@@ -127,7 +198,7 @@ static Image *ReadGRADIENTImage(const ImageInfo *image_info,
   (void) sscanf(image_info->filename,"%[^-]",colorname);
   (void) FormatLocaleString(read_info->filename,MagickPathExtent,"xc:%s",
     colorname);
-  image=ReadImage(read_info,exception);
+  image=ReadXCImage(read_info,exception);
   read_info=DestroyImageInfo(read_info);
   if (image == (Image *) NULL)
     return((Image *) NULL);