]> granicus.if.org Git - imagemagick/commitdiff
Fixed memory leak.
authorDirk Lemstra <dirk@git.imagemagick.org>
Thu, 18 Jan 2018 20:17:02 +0000 (21:17 +0100)
committerDirk Lemstra <dirk@git.imagemagick.org>
Thu, 18 Jan 2018 20:17:02 +0000 (21:17 +0100)
Credit to OSS-Fuzz

coders/miff.c
coders/mpc.c

index 4d80075c22078aaddb3db01c26d66d0261609e47..ea499ee0ef1716ac2215e22cc0075080bbfc1ff2 100644 (file)
@@ -899,8 +899,12 @@ static Image *ReadMIFFImage(const ImageInfo *image_info,
                     profile=BlobToStringInfo((const void *) NULL,(size_t)
                       StringToLong(options));
                     if (profile == (StringInfo *) NULL)
-                      ThrowReaderException(ResourceLimitError,
-                        "MemoryAllocationFailed");
+                      {
+                        profiles=DestroyLinkedList(profiles,
+                          RelinquishMagickMemory);
+                        ThrowReaderException(ResourceLimitError,
+                          "MemoryAllocationFailed");
+                      }
                     (void) SetImageProfile(image,keyword+8,profile,exception);
                     profile=DestroyStringInfo(profile);
                     break;
index 67695ecc6a5c17ff3b742da7257d21217928ba56..421bf545a81109a8e2977491c9c2e0e58fbba0a0 100644 (file)
@@ -631,8 +631,12 @@ static Image *ReadMPCImage(const ImageInfo *image_info,ExceptionInfo *exception)
                     profile=BlobToStringInfo((const void *) NULL,(size_t)
                       StringToLong(options));
                     if (profile == (StringInfo *) NULL)
-                      ThrowReaderException(ResourceLimitError,
-                        "MemoryAllocationFailed");
+                      {
+                        profiles=DestroyLinkedList(profiles,
+                          RelinquishMagickMemory);
+                        ThrowReaderException(ResourceLimitError,
+                          "MemoryAllocationFailed");
+                      }
                     (void) SetImageProfile(image,keyword+8,profile,exception);
                     profile=DestroyStringInfo(profile);
                     break;