https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6107

diff --git a/coders/ps.c b/coders/ps.c
index 3f5f99c6d923a8020d2c4394131f7163321e83c6..6856456de7e06cffc9ba12a0a98111e16e3774ce 100644 (file)
--- a/coders/ps.c
+++ b/coders/ps.c
@@ -448,6 +448,9 @@ static Image *ReadPSImage(const ImageInfo *image_info,ExceptionInfo *exception)
     c,
     file;
 
+  LinkedListInfo
+    *profiles;
+
   MagickBooleanType
     cmyk,
     fitPage,
@@ -581,6 +584,7 @@ static Image *ReadPSImage(const ImageInfo *image_info,ExceptionInfo *exception)
   (void) ResetMagickMemory(command,0,sizeof(command));
   cmyk=image_info->colorspace == CMYKColorspace ? MagickTrue : MagickFalse;
   (void) ResetMagickMemory(&hires_bounds,0,sizeof(hires_bounds));
+  profiles=(LinkedListInfo *) NULL;
   columns=0;
   rows=0;
   priority=0;
@@ -643,7 +647,9 @@ static Image *ReadPSImage(const ImageInfo *image_info,ExceptionInfo *exception)
           datum[i]=(unsigned char) c;
         }
         SetStringInfoLength(profile,(size_t) i+1);
-        (void) SetImageProfile(image,"icc",profile,exception);
+        if (profiles == (LinkedListInfo *) NULL)
+          profiles=NewLinkedList(0);
+        (void) AppendValueToLinkedList(profiles,AcquireString("icc"));
         profile=DestroyStringInfo(profile);
         continue;
       }
@@ -659,7 +665,7 @@ static Image *ReadPSImage(const ImageInfo *image_info,ExceptionInfo *exception)
         if (count != 1)
           continue;
         length=extent;
-        if (length > GetBlobSize(image))
+        if ((MagickSizeType) length > GetBlobSize(image))
           ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
         profile=BlobToStringInfo((const void *) NULL,length);
         if (profile != (StringInfo *) NULL)
@@ -667,7 +673,9 @@ static Image *ReadPSImage(const ImageInfo *image_info,ExceptionInfo *exception)
             q=GetStringInfoDatum(profile);
             for (i=0; i < (ssize_t) length; i++)
               *q++=(unsigned char) ProfileInteger(image,hex_digits);
-            (void) SetImageProfile(image,"8bim",profile,exception);
+            if (profiles == (LinkedListInfo *) NULL)
+              profiles=NewLinkedList(0);
+            (void) AppendValueToLinkedList(profiles,AcquireString("8bim"));
             profile=DestroyStringInfo(profile);
           }
         continue;
@@ -679,9 +687,9 @@ static Image *ReadPSImage(const ImageInfo *image_info,ExceptionInfo *exception)
         */
         p=command;
         profile=StringToStringInfo(command);
-        for (i=GetStringInfoLength(profile)-1; c != EOF; i++)
+        for (i=(ssize_t) GetStringInfoLength(profile)-1; c != EOF; i++)
         {
-          SetStringInfoLength(profile,i+1);
+          SetStringInfoLength(profile,(size_t) i+1);
           c=ReadBlobByte(image);
           if (c == EOF)
             continue;
@@ -695,9 +703,13 @@ static Image *ReadPSImage(const ImageInfo *image_info,ExceptionInfo *exception)
           if (LocaleNCompare(EndXMPPacket,command,strlen(EndXMPPacket)) == 0)
             break;
         }
-        SetStringInfoLength(profile,i);
+        SetStringInfoLength(profile,(size_t) i);
         if (EOFBlob(image) == MagickFalse)
-          (void) SetImageProfile(image,"xmp",profile,exception);
+          {
+            if (profiles == (LinkedListInfo *) NULL)
+              profiles=NewLinkedList(0);
+            (void) AppendValueToLinkedList(profiles,AcquireString("xmp"));
+          }
         profile=DestroyStringInfo(profile);
         continue;
       }
@@ -819,6 +831,8 @@ static Image *ReadPSImage(const ImageInfo *image_info,ExceptionInfo *exception)
       {
         (void) ThrowMagickException(exception,GetMagickModule(),OptionError,
           "InvalidGeometry","`%s'",option);
+        if (profiles != (LinkedListInfo *) NULL)
+          profiles=DestroyLinkedList(profiles,RelinquishMagickMemory);
         image=DestroyImage(image);
         return((Image *) NULL);
       }
@@ -840,6 +854,8 @@ static Image *ReadPSImage(const ImageInfo *image_info,ExceptionInfo *exception)
     {
       ThrowFileException(exception,FileOpenError,"UnableToOpenFile",
         image_info->filename);
+      if (profiles != (LinkedListInfo *) NULL)
+        profiles=DestroyLinkedList(profiles,RelinquishMagickMemory);
       image=DestroyImageList(image);
       return((Image *) NULL);
     }
@@ -871,6 +887,8 @@ static Image *ReadPSImage(const ImageInfo *image_info,ExceptionInfo *exception)
   if (delegate_info == (const DelegateInfo *) NULL)
     {
       (void) RelinquishUniqueFileResource(postscript_filename);
+      if (profiles != (LinkedListInfo *) NULL)
+        profiles=DestroyLinkedList(profiles,RelinquishMagickMemory);
       image=DestroyImageList(image);
       return((Image *) NULL);
     }
@@ -961,6 +979,8 @@ static Image *ReadPSImage(const ImageInfo *image_info,ExceptionInfo *exception)
       if (*message != '\0')
         (void) ThrowMagickException(exception,GetMagickModule(),
           DelegateError,"PostscriptDelegateFailed","`%s'",message);
+      if (profiles != (LinkedListInfo *) NULL)
+        profiles=DestroyLinkedList(profiles,RelinquishMagickMemory);
       image=DestroyImageList(image);
       return((Image *) NULL);
     }
@@ -991,6 +1011,35 @@ static Image *ReadPSImage(const ImageInfo *image_info,ExceptionInfo *exception)
           PrependImageToList(&postscript_image,clone_image);
       }
     }
+  if (profiles != (LinkedListInfo *) NULL)
+    {
+      const char
+        *name;
+
+      const StringInfo
+        *profile;
+
+      /*
+        Read image profiles.
+      */
+      ResetLinkedListIterator(profiles);
+      name=(const char *) GetNextValueInLinkedList(profiles);
+      while (name != (const char *) NULL)
+      {
+        profile=GetImageProfile(image,name);
+        if (profile != (StringInfo *) NULL)
+          {
+            register unsigned char
+              *p;
+
+            p=GetStringInfoDatum(profile);
+            count=ReadBlob(image,GetStringInfoLength(profile),p);
+            (void) count;
+          }
+        name=(const char *) GetNextValueInLinkedList(profiles);
+      }
+      profiles=DestroyLinkedList(profiles,RelinquishMagickMemory);
+    }
   do
   {
     (void) CopyMagickString(postscript_image->filename,filename,