From: Cristy <urban-warrior@imagemagick.org>
Date: Mon, 19 Feb 2018 23:55:11 +0000 (-0500)
Subject: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6462
X-Git-Tag: 7.0.7-24~44
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=a8405a93de5a2aa42bd1b1f5f407f447514a2dca;p=imagemagick

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6462
---

diff --git a/coders/gif.c b/coders/gif.c
index a067a717a..70d319e32 100644
--- a/coders/gif.c
+++ b/coders/gif.c
@@ -1261,25 +1261,6 @@ static Image *ReadGIFImage(const ImageInfo *image_info,ExceptionInfo *exception)
     meta_image->scene=image->scene;
     (void) CloneImageProperties(image,meta_image);
     DestroyImageProperties(meta_image);
-    if (profiles != (LinkedListInfo *) NULL)
-      {
-        StringInfo
-          *profile;
-
-        /*
-          Set image profiles.
-        */
-        ResetLinkedListIterator(profiles);
-        profile=(StringInfo *) GetNextValueInLinkedList(profiles);
-        while (profile != (StringInfo *) NULL)
-        {
-          (void) SetImageProfile(image,GetStringInfoName(profile),profile,
-            exception);
-          profile=(StringInfo *) GetNextValueInLinkedList(profiles);
-        }
-      }
-    if (profiles != (LinkedListInfo *) NULL)
-      profiles=DestroyLinkedList(profiles,DestroyGIFProfile);
     image->storage_class=PseudoClass;
     image->compression=LZWCompression;
     image->columns=ReadBlobLSBShort(image);
@@ -1382,6 +1363,24 @@ static Image *ReadGIFImage(const ImageInfo *image_info,ExceptionInfo *exception)
       status=DecodeImage(image,opacity,exception);
     if ((image_info->ping == MagickFalse) && (status == MagickFalse))
       ThrowGIFException(CorruptImageError,"CorruptImage");
+    if (profiles != (LinkedListInfo *) NULL)
+      {
+        StringInfo
+          *profile;
+
+        /*
+          Set image profiles.
+        */
+        ResetLinkedListIterator(profiles);
+        profile=(StringInfo *) GetNextValueInLinkedList(profiles);
+        while (profile != (StringInfo *) NULL)
+        {
+          (void) SetImageProfile(image,GetStringInfoName(profile),profile,
+            exception);
+          profile=(StringInfo *) GetNextValueInLinkedList(profiles);
+        }
+        profiles=DestroyLinkedList(profiles,DestroyGIFProfile);
+      }
     duration+=image->delay*image->iterations;
     if (image_info->number_scenes != 0)
       if (image->scene >= (image_info->scene+image_info->number_scenes-1))