From 6379e165ee53a658d7f0605391a097c7ed4fd64e Mon Sep 17 00:00:00 2001
From: Cristy <urban-warrior@imagemagick.org>
Date: Sat, 10 Feb 2018 08:15:07 -0500
Subject: [PATCH] https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6192

---
 MagickCore/list.c | 13 +++++++++++++
 coders/mat.c      |  2 +-
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/MagickCore/list.c b/MagickCore/list.c
index 54e758fc1..c6e62c3f0 100644
--- a/MagickCore/list.c
+++ b/MagickCore/list.c
@@ -135,10 +135,14 @@ MagickExport Image *CloneImageList(const Image *images,ExceptionInfo *exception)
     return((Image *) NULL);
   assert(images->signature == MagickCoreSignature);
   while (images->previous != (Image *) NULL)
+  {
+    assert(images != images->previous);
     images=images->previous;
+  }
   image=(Image *) NULL;
   for (p=(Image *) NULL; images != (Image *) NULL; images=images->next)
   {
+    assert(images != images->next);
     clone=CloneImage(images,0,0,MagickTrue,exception);
     if (clone == (Image *) NULL)
       {
@@ -650,7 +654,10 @@ MagickExport ssize_t GetImageIndexInList(const Image *images)
     return(-1);
   assert(images->signature == MagickCoreSignature);
   for (i=0; images->previous != (Image *) NULL; i++)
+  {
+    assert(images != images->previous);
     images=images->previous;
+  }
   return(i);
 }
 
@@ -689,7 +696,10 @@ MagickExport size_t GetImageListLength(const Image *images)
     (void) LogMagickEvent(TraceEvent,GetMagickModule(),"%s",images->filename);
   images=GetLastImageInList(images);
   for (i=0; images != (Image *) NULL; images=images->previous)
+  {
+    assert(images != images->previous);
     i++;
+  }
   return((size_t) i);
 }
 
@@ -846,7 +856,10 @@ MagickExport Image **ImageListToArray(const Image *images,
     }
   images=GetFirstImageInList(images);
   for (i=0; images != (Image *) NULL; images=images->next)
+  {
+    assert(images != images->next);
     group[i++]=(Image *) images;
+  }
   group[i]=(Image *) NULL;
   return(group);
 }
diff --git a/coders/mat.c b/coders/mat.c
index 7194c6efa..ae1874635 100644
--- a/coders/mat.c
+++ b/coders/mat.c
@@ -686,7 +686,6 @@ static Image *ReadMATImageV4(const ImageInfo *image_info,Image *image,
     }
     image->columns=(size_t) HDR.nRows;
     image->rows=(size_t) HDR.nCols;
-    SetImageColorspace(image,GRAYColorspace,exception);
     if (image_info->ping != MagickFalse)
       {
         Swap(image->columns,image->rows);
@@ -698,6 +697,7 @@ static Image *ReadMATImageV4(const ImageInfo *image_info,Image *image,
     if (status == MagickFalse)
       return((Image *) NULL);
     (void) SetImageBackgroundColor(image,exception);
+    (void) SetImageColorspace(image,GRAYColorspace,exception);
     quantum_info=AcquireQuantumInfo(image_info,image);
     if (quantum_info == (QuantumInfo *) NULL)
       return((Image *) NULL);
-- 
2.40.0