(no commit message)

diff --git a/coders/png.c b/coders/png.c
index 686fc777354d80d9b9e02af3a4738a8c1f8b71d1..9be177d7c3aa9b41dea8227f7c1b14d4603a156f 100644 (file)
--- a/coders/png.c
+++ b/coders/png.c
@@ -2296,7 +2296,14 @@ static Image *ReadOnePNGImage(MngInfo *mng_info,
           if (logging != MagickFalse)
             (void) LogMagickEvent(CoderEvent,GetMagickModule(),
               "    Reading PNG iCCP chunk.");
-          profile=AcquireStringInfo(profile_length);
+          profile=BlobToStringInfo(info,profile_length);
+          if (profile == (StringInfo *) NULL)
+          {
+            (void) ThrowMagickException(&image->exception,GetMagickModule(),
+              ResourceLimitError,"MemoryAllocationFailed","`%s'",
+              "unable to copy profile");
+            return(MagickFalse);
+          }
           SetStringInfoDatum(profile,(const unsigned char *) info);
           (void) SetImageProfile(image,"icc",profile);
           profile=DestroyStringInfo(profile);

diff --git a/coders/tiff.c b/coders/tiff.c
index a6b53dba0fecbd220a456a4eda58ea69a62909da..b8d4aaa3ef44eaec35ff161872fdaa56c250bb57 100644 (file)
--- a/coders/tiff.c
+++ b/coders/tiff.c
@@ -459,8 +459,10 @@ static MagickBooleanType ReadProfile(Image *image,const char *name,
       if (length < 4)
         return(MagickFalse);
     }
-  profile=AcquireStringInfo((size_t) length);
-  SetStringInfoDatum(profile,datum+i);
+  profile=BlobToStringInfo(datum+i,(size_t) length);
+  if (profile == (StringInfo *) NULL)
+    ThrowBinaryException(ResourceLimitError,"MemoryAllocationFailed",
+      image->filename);
   status=SetImageProfile(image,name,profile);
   profile=DestroyStringInfo(profile);
   if (status == MagickFalse)