From cc705d8ea68dbfb15af37643754cebf7ab43604e Mon Sep 17 00:00:00 2001
From: Cristy <urban-warrior@imagemagick.org>
Date: Sun, 1 Oct 2017 09:09:25 -0400
Subject: [PATCH] ...

---
 coders/cut.c | 27 +++++++++++++++++++++++----
 1 file changed, 23 insertions(+), 4 deletions(-)

diff --git a/coders/cut.c b/coders/cut.c
index ac5b6a4c1..131223863 100644
--- a/coders/cut.c
+++ b/coders/cut.c
@@ -289,6 +289,15 @@ static int GetCutColors(Image *image,ExceptionInfo *exception)
 */
 static Image *ReadCUTImage(const ImageInfo *image_info,ExceptionInfo *exception)
 {
+#define ThrowCUTReaderException(severity,reason) \
+{ \
+  if (palette != NULL) \
+    palette=DestroyImage(palette); \
+  if (clone_info != NULL) \
+    clone_info=DestroyImageInfo(clone_info); \
+  ThrowReaderException(severity,reason); \
+}
+
   Image *image,*palette;
   ImageInfo *clone_info;
   MagickBooleanType status;
@@ -333,7 +342,7 @@ static Image *ReadCUTImage(const ImageInfo *image_info,ExceptionInfo *exception)
   Header.Reserved=ReadBlobLSBShort(image);
 
   if (Header.Width==0 || Header.Height==0 || Header.Reserved!=0)
-    CUT_KO:  ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+    CUT_KO:  ThrowCUTReaderException(CorruptImageError,"ImproperImageHeader");
 
   /*---This code checks first line of image---*/
   EncodedByte=ReadBlobLSBShort(image);
@@ -346,7 +355,7 @@ static Image *ReadCUTImage(const ImageInfo *image_info,ExceptionInfo *exception)
       if((int) RunCount<0x80) i=(ssize_t) RunCountMasked;
       offset=SeekBlob(image,TellBlob(image)+i,SEEK_SET);
       if (offset < 0)
-        ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+        ThrowCUTReaderException(CorruptImageError,"ImproperImageHeader");
       if(EOFBlob(image) != MagickFalse) goto CUT_KO;  /*wrong data*/
       EncodedByte-=i+1;
       ldblk+=(ssize_t) RunCountMasked;
@@ -371,7 +380,13 @@ static Image *ReadCUTImage(const ImageInfo *image_info,ExceptionInfo *exception)
   if (image_info->ping != MagickFalse) goto Finish;
   status=SetImageExtent(image,image->columns,image->rows,exception);
   if (status == MagickFalse)
-    return(DestroyImageList(image));
+    {
+      if (palette != NULL) 
+        palette=DestroyImage(palette); 
+      if (clone_info != NULL) 
+        clone_info=DestroyImageInfo(clone_info); 
+      return(DestroyImageList(image));
+    }
 
   /* ----- Do something with palette ----- */
   if ((clone_info=CloneImageInfo(image_info)) == NULL) goto NoPalette;
@@ -437,6 +452,8 @@ static Image *ReadCUTImage(const ImageInfo *image_info,ExceptionInfo *exception)
       PalHeader.MaxGreen=ReadBlobLSBShort(palette);
       PalHeader.MaxBlue=ReadBlobLSBShort(palette);
       (void) ReadBlob(palette,20,(unsigned char *) PalHeader.PaletteId);
+      if (EOFBlob(image))
+        ThrowCUTReaderException(CorruptImageError,"UnexpectedEndOfFile");
 
       if(PalHeader.MaxIndex<1) goto ErasePalette;
       image->colors=PalHeader.MaxIndex+1;
@@ -477,6 +494,8 @@ static Image *ReadCUTImage(const ImageInfo *image_info,ExceptionInfo *exception)
             }
 
         }
+      if (EOFBlob(image))
+        ThrowCUTReaderException(CorruptImageError,"UnexpectedEndOfFile");
     }
 
 
@@ -489,7 +508,7 @@ static Image *ReadCUTImage(const ImageInfo *image_info,ExceptionInfo *exception)
       if (AcquireImageColormap(image,image->colors,exception) == MagickFalse)
         {
         NoMemory:
-          ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+          ThrowCUTReaderException(ResourceLimitError,"MemoryAllocationFailed");
             }
 
       for (i=0; i < (ssize_t)image->colors; i++)
-- 
2.40.0