From: Cristy <urban-warrior@imagemagick.org>
Date: Wed, 26 Apr 2017 21:25:37 +0000 (-0400)
Subject: https://github.com/ImageMagick/ImageMagick/issues/451
X-Git-Tag: 7.0.5-6~46
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=fa727001c2a11b5ddf4ee28d3f25ce9b24a87178;p=imagemagick

https://github.com/ImageMagick/ImageMagick/issues/451
---

diff --git a/coders/bmp.c b/coders/bmp.c
index e1738c62d..cc036a1f5 100644
--- a/coders/bmp.c
+++ b/coders/bmp.c
@@ -901,10 +901,17 @@ static Image *ReadBMPImage(const ImageInfo *image_info,ExceptionInfo *exception)
           packet_size=4;
         offset=SeekBlob(image,start_position+14+bmp_info.size,SEEK_SET);
         if (offset < 0)
-          ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+          {
+            bmp_colormap=(unsigned char *) RelinquishMagickMemory(bmp_colormap);
+            ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+          }
         count=ReadBlob(image,packet_size*image->colors,bmp_colormap);
         if (count != (ssize_t) (packet_size*image->colors))
-          ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
+          {
+            bmp_colormap=(unsigned char *) RelinquishMagickMemory(bmp_colormap);
+            ThrowReaderException(CorruptImageError,
+              "InsufficientImageDataInFile");
+          }
         p=bmp_colormap;
         for (i=0; i < (ssize_t) image->colors; i++)
         {