https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5522

diff --git a/Magick++/lib/Image.cpp b/Magick++/lib/Image.cpp
index 3629931687eb091523e2c6ce71d778748ebde2d9..9e4f7196af6c4cd6c04bffd9e0cc01ac15ff0e03 100644 (file)
--- a/Magick++/lib/Image.cpp
+++ b/Magick++/lib/Image.cpp
@@ -4877,6 +4877,8 @@ void Magick::Image::write(Blob *blob_)
   data=ImagesToBlob(constImageInfo(),image(),&length,exceptionInfo);
   if (length > 0)
     blob_->updateNoCopy(data,length,Blob::MallocAllocator);
+  if (data != NULL)
+    data=RelinquishMagickMemory(data);
   ThrowImageException;
 }
 
@@ -4894,6 +4896,8 @@ void Magick::Image::write(Blob *blob_,const std::string &magick_)
   data=ImagesToBlob(constImageInfo(),image(),&length,exceptionInfo);
   if (length > 0)
     blob_->updateNoCopy(data,length,Blob::MallocAllocator);
+  if (data != NULL)
+    data=RelinquishMagickMemory(data);
   ThrowImageException;
 }
 
@@ -4913,6 +4917,8 @@ void Magick::Image::write(Blob *blob_,const std::string &magick_,
   data=ImagesToBlob(constImageInfo(),image(),&length,exceptionInfo);
   if (length > 0)
     blob_->updateNoCopy(data,length,Blob::MallocAllocator);
+  if (data != NULL)
+    data=RelinquishMagickMemory(data);
   ThrowImageException;
 }
 

diff --git a/MagickCore/blob.c b/MagickCore/blob.c
index 226f03e91b7bc071c8f4eae48a148f5b81577c8a..85c91858d3351389096675d17bbfb039f2434fc6 100644 (file)
--- a/MagickCore/blob.c
+++ b/MagickCore/blob.c
@@ -1913,6 +1913,7 @@ MagickExport void *ImageToBlob(const ImageInfo *image_info,
           else
             blob=ResizeQuantumMemory(blob,*length+1,sizeof(unsigned char));
         }
+      blob_info->blob=RelinquishMagickMemory(blob_info->blob);
     }
   else
     {