From: Glenn Randers-Pehrson <glennrp@gmail.com>
Date: Tue, 25 Jul 2017 18:29:36 +0000 (-0400)
Subject: More checking for length!= 0 in coders/png.c
X-Git-Tag: 7.0.6-4~14
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=e8b62c68eaf0b0f8f5dca8d25ac8b9dc3804741d;p=imagemagick

More checking for length!= 0 in coders/png.c
---

diff --git a/coders/png.c b/coders/png.c
index 325a4462e..c4b8d01ad 100644
--- a/coders/png.c
+++ b/coders/png.c
@@ -4694,7 +4694,8 @@ static Image *ReadOneJNGImage(MngInfo *mng_info,
             image->background_color.blue=ScaleCharToQuantum(p[5]);
           }
 
-        chunk=(unsigned char *) RelinquishMagickMemory(chunk);
+        if (length != 0)
+          chunk=(unsigned char *) RelinquishMagickMemory(chunk);
         continue;
       }
 
@@ -4703,7 +4704,8 @@ static Image *ReadOneJNGImage(MngInfo *mng_info,
         if (length == 4)
           image->gamma=((float) mng_get_long(p))*0.00001;
 
-        chunk=(unsigned char *) RelinquishMagickMemory(chunk);
+        if (length != 0)
+          chunk=(unsigned char *) RelinquishMagickMemory(chunk);
         continue;
       }
 
@@ -4721,7 +4723,8 @@ static Image *ReadOneJNGImage(MngInfo *mng_info,
             image->chromaticity.blue_primary.y=0.00001*mng_get_long(&p[28]);
           }
 
-        chunk=(unsigned char *) RelinquishMagickMemory(chunk);
+        if (length != 0)
+          chunk=(unsigned char *) RelinquishMagickMemory(chunk);
         continue;
       }
 
@@ -4742,7 +4745,8 @@ static Image *ReadOneJNGImage(MngInfo *mng_info,
             image->chromaticity.white_point.y=0.3290f;
           }
 
-        chunk=(unsigned char *) RelinquishMagickMemory(chunk);
+        if (length != 0)
+          chunk=(unsigned char *) RelinquishMagickMemory(chunk);
         continue;
       }
 
@@ -4780,7 +4784,8 @@ static Image *ReadOneJNGImage(MngInfo *mng_info,
               }
           }
 
-        chunk=(unsigned char *) RelinquishMagickMemory(chunk);
+        if (length != 0)
+          chunk=(unsigned char *) RelinquishMagickMemory(chunk);
         continue;
       }