From: Cristy <urban-warrior@imagemagick.org>
Date: Wed, 26 Apr 2017 22:14:02 +0000 (-0400)
Subject: https://github.com/ImageMagick/ImageMagick/issues/454
X-Git-Tag: 7.0.5-6~43
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=a537c728561b7eedb17ee50c615e11dec005213a;p=imagemagick

https://github.com/ImageMagick/ImageMagick/issues/454
---

diff --git a/coders/pict.c b/coders/pict.c
index 1d80b73de..052eff67a 100644
--- a/coders/pict.c
+++ b/coders/pict.c
@@ -1183,9 +1183,15 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
                   }
               }
             if (ReadRectangle(image,&source) == MagickFalse)
-              ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+              {
+                tile_image=DestroyImage(tile_image);
+                ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+              }
             if (ReadRectangle(image,&destination) == MagickFalse)
-              ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+              {
+                tile_image=DestroyImage(tile_image);
+                ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+              }
             (void) ReadBlobMSBShort(image);
             if ((code == 0x91) || (code == 0x99) || (code == 0x9b))
               {
@@ -1217,7 +1223,10 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
             for (y=0; y < (ssize_t) tile_image->rows; y++)
             {
               if (p > (pixels+extent+image->columns))
-                ThrowReaderException(CorruptImageError,"NotEnoughPixelData");
+                {
+                  tile_image=DestroyImage(tile_image);
+                  ThrowReaderException(CorruptImageError,"NotEnoughPixelData");
+                }
               q=QueueAuthenticPixels(tile_image,0,y,tile_image->columns,1,
                 exception);
               if (q == (Quantum *) NULL)
@@ -1253,8 +1262,11 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
                       if (tile_image->alpha_trait == UndefinedPixelTrait)
                         {
                           if (p > (pixels+extent+2*image->columns))
-                            ThrowReaderException(CorruptImageError,
-                              "NotEnoughPixelData");
+                            {
+                              tile_image=DestroyImage(tile_image);
+                              ThrowReaderException(CorruptImageError,
+                                "NotEnoughPixelData");
+                            }
                           SetPixelRed(tile_image,ScaleCharToQuantum(*p),q);
                           SetPixelGreen(tile_image,ScaleCharToQuantum(
                             *(p+tile_image->columns)),q);
@@ -1264,8 +1276,11 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
                       else
                         {
                           if (p > (pixels+extent+3*image->columns))
-                            ThrowReaderException(CorruptImageError,
-                              "NotEnoughPixelData");
+                            {
+                              tile_image=DestroyImage(tile_image);
+                              ThrowReaderException(CorruptImageError,
+                                "NotEnoughPixelData");
+                            }
                           SetPixelAlpha(tile_image,ScaleCharToQuantum(*p),q);
                           SetPixelRed(tile_image,ScaleCharToQuantum(
                             *(p+tile_image->columns)),q);
@@ -1334,8 +1349,11 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
                 status=SetImageProfile(image,"icc",profile,exception);
                 profile=DestroyStringInfo(profile);
                 if (status == MagickFalse)
-                  ThrowReaderException(ResourceLimitError,
-                    "MemoryAllocationFailed");
+                  {
+                    info=(unsigned char *) RelinquishMagickMemory(info);
+                    ThrowReaderException(ResourceLimitError,
+                      "MemoryAllocationFailed");
+                  }
                 break;
               }
               case 0x1f2:
@@ -1344,8 +1362,11 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
                 SetStringInfoDatum(profile,info);
                 status=SetImageProfile(image,"iptc",profile,exception);
                 if (status == MagickFalse)
-                  ThrowReaderException(ResourceLimitError,
-                    "MemoryAllocationFailed");
+                  {
+                    info=(unsigned char *) RelinquishMagickMemory(info);
+                    ThrowReaderException(ResourceLimitError,
+                      "MemoryAllocationFailed");
+                  }
                 profile=DestroyStringInfo(profile);
                 break;
               }