https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5545

diff --git a/coders/mat.c b/coders/mat.c
index 1fe03e5d80a393af426662a10b1b668303dd8c4a..312b1c125497b79b32564f4f09858514fb36eb5d 100644 (file)
--- a/coders/mat.c
+++ b/coders/mat.c
@@ -602,7 +602,7 @@ static Image *ReadMATImageV4(const ImageInfo *image_info,Image *image,
     endian;
 
   Image
-    *rotate_image;
+    *rotated_image;
 
   MagickBooleanType
     status;
@@ -783,11 +783,21 @@ static Image *ReadMATImageV4(const ImageInfo *image_info,Image *image,
           image->filename);
         break;
       }
-    rotate_image=RotateImage(image,90.0,exception);
-    if (rotate_image != (Image *) NULL)
+    rotated_image=RotateImage(image,90.0,exception);
+    if (rotated_image != (Image *) NULL)
       {
-        image=DestroyImage(image);
-        image=rotate_image;
+        void
+          *blob;
+        
+        rotated_image->page.x=0;
+        rotated_image->page.y=0;
+        blob = rotated_image->blob;
+        rotated_image->blob = image->blob;
+        rotated_image->colors = image->colors;
+        image->blob = blob;
+        AppendImageToList(&image,rotated_image);
+        DeleteImageFromList(&image->previous);
+        image = rotated_image;
       }
     /*
       Proceed to next image.