From 3b48d20df53ad048af05107aa1850c344466b082 Mon Sep 17 00:00:00 2001 From: Cristy Date: Sun, 1 Jul 2018 17:11:51 -0400 Subject: [PATCH] Fix rare but potential memory-leak --- ChangeLog | 2 ++ coders/aai.c | 6 ++++-- coders/avs.c | 6 ++++-- coders/bmp.c | 4 +++- coders/dcm.c | 10 ++++++---- coders/dpx.c | 6 ++++-- coders/fits.c | 6 ++++-- coders/flif.c | 8 ++++---- coders/gif.c | 10 ++++------ coders/heic.c | 5 ++++- coders/html.c | 3 ++- coders/icon.c | 6 ++++-- coders/ipl.c | 13 ++++++++----- coders/mat.c | 7 ++++++- coders/miff.c | 6 ++++-- coders/mpc.c | 2 ++ coders/mtv.c | 6 ++++-- coders/palm.c | 6 ++++-- coders/pcd.c | 9 +++++---- coders/pcx.c | 6 ++++-- coders/pix.c | 6 ++++-- coders/pnm.c | 6 ++++-- coders/raw.c | 4 ++-- coders/rgb.c | 2 +- coders/rle.c | 6 ++++-- coders/sgi.c | 6 ++++-- coders/sun.c | 6 ++++-- coders/tiff.c | 26 ++++++++++++-------------- coders/tim.c | 6 ++++-- coders/txt.c | 6 ++++-- coders/viff.c | 2 ++ coders/yuv.c | 5 ++--- 32 files changed, 129 insertions(+), 79 deletions(-) diff --git a/ChangeLog b/ChangeLog index 5f67a666d..2d0a5fd64 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,7 @@ 2018-06-28 7.0.8-3 Cristy * Small tweaks to compile under Cygwin. + * Fixed numerous use of uninitialized values, integer overflow, memory + exceeded, and timeouts (credit to OSS Fuzz). 2018-06-24 7.0.8-3 Cristy * Release ImageMagick version 7.0.8-3, GIT revision 14489:c63c504e8:20180624. diff --git a/coders/aai.c b/coders/aai.c index 37e185fad..a744ce476 100644 --- a/coders/aai.c +++ b/coders/aai.c @@ -224,8 +224,8 @@ static Image *ReadAAIImage(const ImageInfo *image_info,ExceptionInfo *exception) AcquireNextImage(image_info,image,exception); if (GetNextImageInList(image) == (Image *) NULL) { - image=DestroyImageList(image); - return((Image *) NULL); + status=MagickFalse; + break; } image=SyncNextImageInList(image); status=SetImageProgress(image,LoadImagesTag,TellBlob(image), @@ -235,6 +235,8 @@ static Image *ReadAAIImage(const ImageInfo *image_info,ExceptionInfo *exception) } } while ((width != 0UL) && (height != 0UL)); (void) CloseBlob(image); + if (status == MagickFalse) + return(DestroyImageList(image)); return(GetFirstImageInList(image)); } diff --git a/coders/avs.c b/coders/avs.c index 43ec043d1..c01e1679a 100644 --- a/coders/avs.c +++ b/coders/avs.c @@ -223,8 +223,8 @@ static Image *ReadAVSImage(const ImageInfo *image_info,ExceptionInfo *exception) AcquireNextImage(image_info,image,exception); if (GetNextImageInList(image) == (Image *) NULL) { - image=DestroyImageList(image); - return((Image *) NULL); + status=MagickFalse; + break; } image=SyncNextImageInList(image); status=SetImageProgress(image,LoadImagesTag,TellBlob(image), @@ -234,6 +234,8 @@ static Image *ReadAVSImage(const ImageInfo *image_info,ExceptionInfo *exception) } } while ((width != 0UL) && (height != 0UL)); (void) CloseBlob(image); + if (status == MagickFalse) + return(DestroyImageList(image)); return(GetFirstImageInList(image)); } diff --git a/coders/bmp.c b/coders/bmp.c index 78a6cbd7a..8461e1a49 100644 --- a/coders/bmp.c +++ b/coders/bmp.c @@ -1459,7 +1459,7 @@ static Image *ReadBMPImage(const ImageInfo *image_info,ExceptionInfo *exception) AcquireNextImage(image_info,image,exception); if (GetNextImageInList(image) == (Image *) NULL) { - image=DestroyImageList(image); + status=MagickFalse; return((Image *) NULL); } image=SyncNextImageInList(image); @@ -1470,6 +1470,8 @@ static Image *ReadBMPImage(const ImageInfo *image_info,ExceptionInfo *exception) } } while (IsBMP(magick,2) != MagickFalse); (void) CloseBlob(image); + if (status == MagickFalse) + return(DestroyImageList(image)); return(GetFirstImageInList(image)); } diff --git a/coders/dcm.c b/coders/dcm.c index cd0133278..cbfd37662 100644 --- a/coders/dcm.c +++ b/coders/dcm.c @@ -4227,8 +4227,8 @@ static Image *ReadDCMImage(const ImageInfo *image_info,ExceptionInfo *exception) AcquireNextImage(image_info,image,exception); if (GetNextImageInList(image) == (Image *) NULL) { - image=DestroyImageList(image); - return((Image *) NULL); + status=MagickFalse; + break; } image=SyncNextImageInList(image); status=SetImageProgress(image,LoadImagesTag,TellBlob(image), @@ -4245,8 +4245,8 @@ static Image *ReadDCMImage(const ImageInfo *image_info,ExceptionInfo *exception) AcquireNextImage(image_info,image,exception); if (GetNextImageInList(image) == (Image *) NULL) { - image=DestroyImageList(image); - return((Image *) NULL); + status=MagickFalse; + break; } image=SyncNextImageInList(image); status=SetImageProgress(image,LoadImagesTag,TellBlob(image), @@ -4273,6 +4273,8 @@ static Image *ReadDCMImage(const ImageInfo *image_info,ExceptionInfo *exception) if (redmap != (int *) NULL) redmap=(int *) RelinquishMagickMemory(redmap); (void) CloseBlob(image); + if (status == MagickFalse) + return(DestroyImageList(image)); return(GetFirstImageInList(image)); } diff --git a/coders/dpx.c b/coders/dpx.c index fda1a1e9d..194e8d82f 100644 --- a/coders/dpx.c +++ b/coders/dpx.c @@ -1303,8 +1303,8 @@ static Image *ReadDPXImage(const ImageInfo *image_info,ExceptionInfo *exception) AcquireNextImage(image_info,image,exception); if (GetNextImageInList(image) == (Image *) NULL) { - image=DestroyImageList(image); - return((Image *) NULL); + status=MagickFalse; + break; } image=SyncNextImageInList(image); status=SetImageProgress(image,LoadImagesTag,TellBlob(image), @@ -1314,6 +1314,8 @@ static Image *ReadDPXImage(const ImageInfo *image_info,ExceptionInfo *exception) } } (void) CloseBlob(image); + if (status == MagickFalse) + return(DestroyImageList(image)); return(GetFirstImageInList(image)); } diff --git a/coders/fits.c b/coders/fits.c index 2ebeeb594..db74a486e 100644 --- a/coders/fits.c +++ b/coders/fits.c @@ -500,8 +500,8 @@ static Image *ReadFITSImage(const ImageInfo *image_info, AcquireNextImage(image_info,image,exception); if (GetNextImageInList(image) == (Image *) NULL) { - image=DestroyImageList(image); - return((Image *) NULL); + status=MagickFalse; + break; } image=SyncNextImageInList(image); status=SetImageProgress(image,LoadImagesTag,TellBlob(image), @@ -511,6 +511,8 @@ static Image *ReadFITSImage(const ImageInfo *image_info, } } (void) CloseBlob(image); + if (status == MagickFalse) + return(DestroyImageList(image)); return(GetFirstImageInList(image)); } diff --git a/coders/flif.c b/coders/flif.c index 5c0b770ed..4fed84d6c 100644 --- a/coders/flif.c +++ b/coders/flif.c @@ -196,10 +196,8 @@ static Image *ReadFLIFImage(const ImageInfo *image_info, AcquireNextImage(image_info,image,exception); if (GetNextImageInList(image) == (Image *) NULL) { - image=DestroyImageList(image); - flif_destroy_decoder(flifdec); - pixels=(unsigned short *) RelinquishMagickMemory(pixels); - return((Image *) NULL); + status=MagickFalse; + break; } image=SyncNextImageInList(image); } @@ -238,6 +236,8 @@ static Image *ReadFLIFImage(const ImageInfo *image_info, } flif_destroy_decoder(flifdec); pixels=(unsigned short *) RelinquishMagickMemory(pixels); + if (status == MagickFalse) + return(DestroyImageList(image)); return(image); } #endif diff --git a/coders/gif.c b/coders/gif.c index 21de0823c..701ffd58b 100644 --- a/coders/gif.c +++ b/coders/gif.c @@ -1238,12 +1238,8 @@ static Image *ReadGIFImage(const ImageInfo *image_info,ExceptionInfo *exception) AcquireNextImage(image_info,image,exception); if (GetNextImageInList(image) == (Image *) NULL) { - if (profiles != (LinkedListInfo *) NULL) - profiles=DestroyLinkedList(profiles,DestroyGIFProfile); - image=DestroyImageList(image); - global_colormap=(unsigned char *) RelinquishMagickMemory( - global_colormap); - return((Image *) NULL); + status=MagickFalse; + break; } image=SyncNextImageInList(image); } @@ -1393,6 +1389,8 @@ static Image *ReadGIFImage(const ImageInfo *image_info,ExceptionInfo *exception) if ((image->columns == 0) || (image->rows == 0)) ThrowReaderException(CorruptImageError,"NegativeOrZeroImageSize"); (void) CloseBlob(image); + if (status == MagickFalse) + return(DestroyImageList(image)); return(GetFirstImageInList(image)); } diff --git a/coders/heic.c b/coders/heic.c index f9ed658d6..16375ecc7 100644 --- a/coders/heic.c +++ b/coders/heic.c @@ -620,7 +620,10 @@ static MagickBooleanType WriteHEICImage(const ImageInfo *image_info,Image *image if (status == MagickFalse) break; if (GetNextImageInList(image) == (Image *) NULL) - break; + { + status=MagickFalse; + break; + } image=SyncNextImageInList(image); status=SetImageProgress(image,SaveImagesTag,scene, GetImageListLength(image)); diff --git a/coders/html.c b/coders/html.c index 511ba15d9..9b4f5d680 100644 --- a/coders/html.c +++ b/coders/html.c @@ -271,7 +271,8 @@ static MagickBooleanType WriteHTMLImage(const ImageInfo *image_info, AppendImageFormat("map",filename); GetPathComponent(filename,BasePath,basename); (void) CopyMagickString(mapname,basename,MagickPathExtent); - (void) CopyMagickString(image->filename,image_info->filename,MagickPathExtent); + (void) CopyMagickString(image->filename,image_info->filename, + MagickPathExtent); (void) CopyMagickString(filename,image->filename,MagickPathExtent); write_info=CloneImageInfo(image_info); *write_info->magick='\0'; diff --git a/coders/icon.c b/coders/icon.c index 277cc45af..7df403aca 100644 --- a/coders/icon.c +++ b/coders/icon.c @@ -738,8 +738,8 @@ static Image *ReadICONImage(const ImageInfo *image_info, AcquireNextImage(image_info,image,exception); if (GetNextImageInList(image) == (Image *) NULL) { - image=DestroyImageList(image); - return((Image *) NULL); + status=MagickFalse; + break; } image=SyncNextImageInList(image); status=SetImageProgress(image,LoadImagesTag,TellBlob(image), @@ -749,6 +749,8 @@ static Image *ReadICONImage(const ImageInfo *image_info, } } (void) CloseBlob(image); + if (status == MagickFalse) + return(DestroyImageList(image)); return(GetFirstImageInList(image)); } diff --git a/coders/ipl.c b/coders/ipl.c index e19f72c3e..e6680c399 100644 --- a/coders/ipl.c +++ b/coders/ipl.c @@ -403,16 +403,17 @@ static Image *ReadIPLImage(const ImageInfo *image_info,ExceptionInfo *exception) image->filename); break; } - if(t_count < ipl_info.z * ipl_info.time){ + if (t_count < ipl_info.z * ipl_info.time) + { /* Proceed to next image. */ AcquireNextImage(image_info,image,exception); if (GetNextImageInList(image) == (Image *) NULL) - { - image=DestroyImageList(image); - return((Image *) NULL); - } + { + status=MagickFalse; + break; + } image=SyncNextImageInList(image); status=SetImageProgress(image,LoadImagesTag,TellBlob(image), GetBlobSize(image)); @@ -421,6 +422,8 @@ static Image *ReadIPLImage(const ImageInfo *image_info,ExceptionInfo *exception) } } while (t_count < ipl_info.z*ipl_info.time); CloseBlob(image); + if (status == MagickFalse) + return(DestroyImageList(image)); return(GetFirstImageInList(image)); } diff --git a/coders/mat.c b/coders/mat.c index 43e9bfac1..3be3bcbb8 100644 --- a/coders/mat.c +++ b/coders/mat.c @@ -814,7 +814,10 @@ static Image *ReadMATImageV4(const ImageInfo *image_info,Image *image, skip_reading_current: AcquireNextImage(image_info,image,exception); if (GetNextImageInList(image) == (Image *) NULL) - return(DestroyImageList(image)); + { + status=MagickFalse; + break; + } image=SyncNextImageInList(image); status=SetImageProgress(image,LoadImagesTag,TellBlob(image), GetBlobSize(image)); @@ -822,6 +825,8 @@ skip_reading_current: break; } (void) CloseBlob(image); + if (status == MagickFalse) + return(DestroyImageList(image)); return(GetFirstImageInList(image)); } diff --git a/coders/miff.c b/coders/miff.c index cb529ea70..2dd480861 100644 --- a/coders/miff.c +++ b/coders/miff.c @@ -1695,8 +1695,8 @@ static Image *ReadMIFFImage(const ImageInfo *image_info, AcquireNextImage(image_info,image,exception); if (GetNextImageInList(image) == (Image *) NULL) { - image=DestroyImageList(image); - return((Image *) NULL); + status=MagickFalse; + break; } image=SyncNextImageInList(image); status=SetImageProgress(image,LoadImagesTag,TellBlob(image), @@ -1706,6 +1706,8 @@ static Image *ReadMIFFImage(const ImageInfo *image_info, } } while (c != EOF); (void) CloseBlob(image); + if (status == MagickFalse) + return(DestroyImageList(image)); return(GetFirstImageInList(image)); } diff --git a/coders/mpc.c b/coders/mpc.c index 16bb1b9b1..a118d2a83 100644 --- a/coders/mpc.c +++ b/coders/mpc.c @@ -1022,6 +1022,8 @@ static Image *ReadMPCImage(const ImageInfo *image_info,ExceptionInfo *exception) } } while (c != EOF); (void) CloseBlob(image); + if (status == MagickFalse) + return(DestroyImageList(image)); return(GetFirstImageInList(image)); } diff --git a/coders/mtv.c b/coders/mtv.c index 04895567f..1faf6f034 100644 --- a/coders/mtv.c +++ b/coders/mtv.c @@ -224,8 +224,8 @@ static Image *ReadMTVImage(const ImageInfo *image_info,ExceptionInfo *exception) AcquireNextImage(image_info,image,exception); if (GetNextImageInList(image) == (Image *) NULL) { - image=DestroyImageList(image); - return((Image *) NULL); + status=MagickFalse; + break; } image=SyncNextImageInList(image); status=SetImageProgress(image,LoadImagesTag,TellBlob(image), @@ -235,6 +235,8 @@ static Image *ReadMTVImage(const ImageInfo *image_info,ExceptionInfo *exception) } } while (count > 0); (void) CloseBlob(image); + if (status == MagickFalse) + return(DestroyImageList(image)); return(GetFirstImageInList(image)); } diff --git a/coders/palm.c b/coders/palm.c index c7aa8b0ea..cc5d42a9d 100644 --- a/coders/palm.c +++ b/coders/palm.c @@ -582,8 +582,8 @@ static Image *ReadPALMImage(const ImageInfo *image_info, AcquireNextImage(image_info,image,exception); if (GetNextImageInList(image) == (Image *) NULL) { - (void) DestroyImageList(image); - return((Image *) NULL); + status=MagickFalse; + break; } image=SyncNextImageInList(image); status=SetImageProgress(image,LoadImagesTag,TellBlob(image), @@ -593,6 +593,8 @@ static Image *ReadPALMImage(const ImageInfo *image_info, } } while (nextDepthOffset != 0); (void) CloseBlob(image); + if (status == MagickFalse) + return(DestroyImageList(image)); return(GetFirstImageInList(image)); } diff --git a/coders/pcd.c b/coders/pcd.c index a28cc6b85..42941a937 100644 --- a/coders/pcd.c +++ b/coders/pcd.c @@ -722,8 +722,8 @@ static Image *ReadPCDImage(const ImageInfo *image_info,ExceptionInfo *exception) AcquireNextImage(image_info,image,exception); if (GetNextImageInList(image) == (Image *) NULL) { - image=DestroyImageList(image); - return((Image *) NULL); + status=MagickFalse; + break; } image=SyncNextImageInList(image); } @@ -739,8 +739,9 @@ static Image *ReadPCDImage(const ImageInfo *image_info,ExceptionInfo *exception) chroma2=(unsigned char *) RelinquishMagickMemory(chroma2); chroma1=(unsigned char *) RelinquishMagickMemory(chroma1); luma=(unsigned char *) RelinquishMagickMemory(luma); - image=GetFirstImageInList(image); - return(OverviewImage(image_info,image,exception)); + if (status == MagickFalse) + return(DestroyImageList(image)); + return(OverviewImage(image_info,GetFirstImageInList(image),exception)); } /* Read interleaved image. diff --git a/coders/pcx.c b/coders/pcx.c index 60e6233a0..f4dc9207e 100644 --- a/coders/pcx.c +++ b/coders/pcx.c @@ -684,8 +684,8 @@ static Image *ReadPCXImage(const ImageInfo *image_info,ExceptionInfo *exception) AcquireNextImage(image_info,image,exception); if (GetNextImageInList(image) == (Image *) NULL) { - image=DestroyImageList(image); - return((Image *) NULL); + status=MagickFalse; + break; } image=SyncNextImageInList(image); status=SetImageProgress(image,LoadImagesTag,TellBlob(image), @@ -697,6 +697,8 @@ static Image *ReadPCXImage(const ImageInfo *image_info,ExceptionInfo *exception) if (page_table != (MagickOffsetType *) NULL) page_table=(MagickOffsetType *) RelinquishMagickMemory(page_table); (void) CloseBlob(image); + if (status == MagickFalse) + return(DestroyImageList(image)); return(GetFirstImageInList(image)); } diff --git a/coders/pix.c b/coders/pix.c index cc2b9eb8d..c5ba3e722 100644 --- a/coders/pix.c +++ b/coders/pix.c @@ -244,8 +244,8 @@ static Image *ReadPIXImage(const ImageInfo *image_info,ExceptionInfo *exception) AcquireNextImage(image_info,image,exception); if (GetNextImageInList(image) == (Image *) NULL) { - image=DestroyImageList(image); - return((Image *) NULL); + status=MagickFalse; + break; } image=SyncNextImageInList(image); status=SetImageProgress(image,LoadImagesTag,TellBlob(image), @@ -255,6 +255,8 @@ static Image *ReadPIXImage(const ImageInfo *image_info,ExceptionInfo *exception) } } while (status != MagickFalse); (void) CloseBlob(image); + if (status == MagickFalse) + return(DestroyImageList(image)); return(GetFirstImageInList(image)); } diff --git a/coders/pnm.c b/coders/pnm.c index 6d9bec6d6..9fbadd539 100644 --- a/coders/pnm.c +++ b/coders/pnm.c @@ -1375,8 +1375,8 @@ static Image *ReadPNMImage(const ImageInfo *image_info,ExceptionInfo *exception) AcquireNextImage(image_info,image,exception); if (GetNextImageInList(image) == (Image *) NULL) { - image=DestroyImageList(image); - return((Image *) NULL); + status=MagickFalse; + break; } image=SyncNextImageInList(image); status=SetImageProgress(image,LoadImagesTag,TellBlob(image), @@ -1386,6 +1386,8 @@ static Image *ReadPNMImage(const ImageInfo *image_info,ExceptionInfo *exception) } } while ((count == 1) && (format == 'P')); (void) CloseBlob(image); + if (status == MagickFalse) + return(DestroyImageList(image)); return(GetFirstImageInList(image)); } diff --git a/coders/raw.c b/coders/raw.c index 446c525c5..17ac37a64 100644 --- a/coders/raw.c +++ b/coders/raw.c @@ -275,8 +275,8 @@ static Image *ReadRAWImage(const ImageInfo *image_info,ExceptionInfo *exception) AcquireNextImage(image_info,image,exception); if (GetNextImageInList(image) == (Image *) NULL) { - image=DestroyImageList(image); - return((Image *) NULL); + status=MagickFalse; + break; } image=SyncNextImageInList(image); status=SetImageProgress(image,LoadImagesTag,TellBlob(image), diff --git a/coders/rgb.c b/coders/rgb.c index f4f28548f..005440f2c 100644 --- a/coders/rgb.c +++ b/coders/rgb.c @@ -982,7 +982,7 @@ static Image *ReadRGBImage(const ImageInfo *image_info,ExceptionInfo *exception) canvas_image=DestroyImage(canvas_image); (void) CloseBlob(image); if (status == MagickFalse) - return(DestroyImageList(image)); + return(DestroyImageList(image)); return(GetFirstImageInList(image)); } diff --git a/coders/rle.c b/coders/rle.c index 583593a6c..64b8a41a2 100644 --- a/coders/rle.c +++ b/coders/rle.c @@ -701,8 +701,8 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception) AcquireNextImage(image_info,image,exception); if (GetNextImageInList(image) == (Image *) NULL) { - image=DestroyImageList(image); - return((Image *) NULL); + status=MagickFalse; + break; } image=SyncNextImageInList(image); status=SetImageProgress(image,LoadImagesTag,TellBlob(image), @@ -712,6 +712,8 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception) } } while ((count != 0) && (memcmp(magick,"\122\314",2) == 0)); (void) CloseBlob(image); + if (status == MagickFalse) + return(DestroyImageList(image)); return(GetFirstImageInList(image)); } diff --git a/coders/sgi.c b/coders/sgi.c index e45792dfc..374eb2d32 100644 --- a/coders/sgi.c +++ b/coders/sgi.c @@ -738,8 +738,8 @@ static Image *ReadSGIImage(const ImageInfo *image_info,ExceptionInfo *exception) AcquireNextImage(image_info,image,exception); if (GetNextImageInList(image) == (Image *) NULL) { - image=DestroyImageList(image); - return((Image *) NULL); + status=MagickFalse; + break; } image=SyncNextImageInList(image); status=SetImageProgress(image,LoadImagesTag,TellBlob(image), @@ -749,6 +749,8 @@ static Image *ReadSGIImage(const ImageInfo *image_info,ExceptionInfo *exception) } } while (iris_info.magic == 0x01DA); (void) CloseBlob(image); + if (status == MagickFalse) + return(DestroyImageList(image)); return(GetFirstImageInList(image)); } diff --git a/coders/sun.c b/coders/sun.c index edf5a8397..ff029d39c 100644 --- a/coders/sun.c +++ b/coders/sun.c @@ -649,8 +649,8 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception) AcquireNextImage(image_info,image,exception); if (GetNextImageInList(image) == (Image *) NULL) { - image=DestroyImageList(image); - return((Image *) NULL); + status=MagickFalse; + break; } image=SyncNextImageInList(image); status=SetImageProgress(image,LoadImagesTag,TellBlob(image), @@ -660,6 +660,8 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception) } } while (sun_info.magic == 0x59a66a95); (void) CloseBlob(image); + if (status == MagickFalse) + return(DestroyImageList(image)); return(GetFirstImageInList(image)); } diff --git a/coders/tiff.c b/coders/tiff.c index 51f5f2b9e..2d52addc0 100644 --- a/coders/tiff.c +++ b/coders/tiff.c @@ -1250,6 +1250,7 @@ static Image *ReadTIFFImage(const ImageInfo *image_info, tiff_status; MagickBooleanType + more_frames, status; MagickSizeType @@ -1356,6 +1357,7 @@ static Image *ReadTIFFImage(const ImageInfo *image_info, } } } + more_frames=MagickTrue; do { DisableMSCWarning(4127) @@ -2232,8 +2234,8 @@ RestoreMSCWarning if (image_info->number_scenes != 0) if (image->scene >= (image_info->scene+image_info->number_scenes-1)) break; - status=TIFFReadDirectory(tiff) != 0 ? MagickTrue : MagickFalse; - if (status != MagickFalse) + more_frames=TIFFReadDirectory(tiff) != 0 ? MagickTrue : MagickFalse; + if (more_frames != MagickFalse) { /* Allocate next image structure. @@ -2241,8 +2243,8 @@ RestoreMSCWarning AcquireNextImage(image_info,image,exception); if (GetNextImageInList(image) == (Image *) NULL) { - image=DestroyImageList(image); - return((Image *) NULL); + status=MagickFalse; + break; } image=SyncNextImageInList(image); status=SetImageProgress(image,LoadImagesTag,image->scene-1, @@ -2250,18 +2252,14 @@ RestoreMSCWarning if (status == MagickFalse) break; } - } while (status != MagickFalse); + } while ((status != MagickFalse) && (more_frames != MagickFalse)); TIFFClose(tiff); TIFFReadPhotoshopLayers(image,image_info,exception); - if (image_info->number_scenes != 0) - { - if (image_info->scene >= GetImageListLength(image)) - { - /* Subimage was not found in the Photoshop layer */ - image=DestroyImageList(image); - return((Image *)NULL); - } - } + if ((image_info->number_scenes != 0) && + (image_info->scene >= GetImageListLength(image))) + status=MagickFalse; + if (status == MagickFalse) + return(DestroyImageList(image)); return(GetFirstImageInList(image)); } #endif diff --git a/coders/tim.c b/coders/tim.c index afccbc927..cb557b837 100644 --- a/coders/tim.c +++ b/coders/tim.c @@ -419,8 +419,8 @@ static Image *ReadTIMImage(const ImageInfo *image_info,ExceptionInfo *exception) AcquireNextImage(image_info,image,exception); if (GetNextImageInList(image) == (Image *) NULL) { - image=DestroyImageList(image); - return((Image *) NULL); + status=MagickFalse; + break; } image=SyncNextImageInList(image); status=SetImageProgress(image,LoadImagesTag,TellBlob(image), @@ -430,6 +430,8 @@ static Image *ReadTIMImage(const ImageInfo *image_info,ExceptionInfo *exception) } } while (tim_info.id == 0x00000010); (void) CloseBlob(image); + if (status == MagickFalse) + return(DestroyImageList(image)); return(GetFirstImageInList(image)); } diff --git a/coders/txt.c b/coders/txt.c index 42d2b8572..64aef8750 100644 --- a/coders/txt.c +++ b/coders/txt.c @@ -595,8 +595,8 @@ static Image *ReadTXTImage(const ImageInfo *image_info,ExceptionInfo *exception) AcquireNextImage(image_info,image,exception); if (GetNextImageInList(image) == (Image *) NULL) { - image=DestroyImageList(image); - return((Image *) NULL); + status=MagickFalse; + break; } image=SyncNextImageInList(image); status=SetImageProgress(image,LoadImagesTag,TellBlob(image), @@ -606,6 +606,8 @@ static Image *ReadTXTImage(const ImageInfo *image_info,ExceptionInfo *exception) } } while (LocaleNCompare((char *) text,MagickID,strlen(MagickID)) == 0); (void) CloseBlob(image); + if (status == MagickFalse) + return(DestroyImageList(image)); return(GetFirstImageInList(image)); } diff --git a/coders/viff.c b/coders/viff.c index 92809e4bc..8b47d2135 100644 --- a/coders/viff.c +++ b/coders/viff.c @@ -782,6 +782,8 @@ static Image *ReadVIFFImage(const ImageInfo *image_info, } } while ((count != 0) && (viff_info.identifier == 0xab)); (void) CloseBlob(image); + if (status == MagickFalse) + return(DestroyImageList(image)); return(GetFirstImageInList(image)); } diff --git a/coders/yuv.c b/coders/yuv.c index 8c6d79a8c..b2541481e 100644 --- a/coders/yuv.c +++ b/coders/yuv.c @@ -500,9 +500,8 @@ static Image *ReadYUVImage(const ImageInfo *image_info,ExceptionInfo *exception) AcquireNextImage(image_info,image,exception); if (GetNextImageInList(image) == (Image *) NULL) { - scanline=(unsigned char *) RelinquishMagickMemory(scanline); - image=DestroyImageList(image); - return((Image *) NULL); + status=MagickFalse; + break; } image=SyncNextImageInList(image); status=SetImageProgress(image,LoadImagesTag,TellBlob(image), -- 2.40.0