From: Cristy <urban-warrior@imagemagick.org>
Date: Thu, 3 May 2018 16:57:33 +0000 (-0400)
Subject: ...
X-Git-Tag: 7.0.7-31~29
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=af7d0343abfedff01c6ed97524d4a170897e8c06;p=imagemagick

...
---

diff --git a/coders/meta.c b/coders/meta.c
index 3aeeffe80..121dc682b 100644
--- a/coders/meta.c
+++ b/coders/meta.c
@@ -1208,16 +1208,31 @@ static Image *ReadMETAImage(const ImageInfo *image_info,
           buff=DestroyImage(buff);
           ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
         }
+      (void) memset(blob,0,length);
       AttachBlob(buff->blob,blob,length);
       if (LocaleCompare(image_info->magick,"8BIMTEXT") == 0)
         {
           length=(size_t) parse8BIM(image, buff);
+          if (length == 0)
+            {
+              blob=DetachBlob(buff->blob);
+              blob=(unsigned char *) RelinquishMagickMemory(blob);
+              buff=DestroyImage(buff);
+              ThrowReaderException(CorruptImageError,"CorruptImage");
+            }
           if (length & 1)
             (void) WriteBlobByte(buff,0x0);
         }
       else if (LocaleCompare(image_info->magick,"8BIMWTEXT") == 0)
         {
           length=(size_t) parse8BIMW(image, buff);
+          if (length == 0)
+            {
+              blob=DetachBlob(buff->blob);
+              blob=(unsigned char *) RelinquishMagickMemory(blob);
+              buff=DestroyImage(buff);
+              ThrowReaderException(CorruptImageError,"CorruptImage");
+            }
           if (length & 1)
             (void) WriteBlobByte(buff,0x0);
         }