From d9cc60d2daefaa77f299ae52755d8c3eb23f0b82 Mon Sep 17 00:00:00 2001
From: Dirk Lemstra <dirk@git.imagemagick.org>
Date: Sun, 11 Mar 2018 11:19:53 +0100
Subject: [PATCH] Fixed various memory leaks
 (https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6758).

---
 coders/mat.c | 28 ++++++++++++++++++++++++----
 1 file changed, 24 insertions(+), 4 deletions(-)

diff --git a/coders/mat.c b/coders/mat.c
index f3a922bfb..bc2a53e4c 100644
--- a/coders/mat.c
+++ b/coders/mat.c
@@ -1066,7 +1066,7 @@ MATLAB_KO:
             DeleteImageFromList(&image2);
           }
         if (clone_info != (ImageInfo *) NULL)
-          DestroyImageInfo(clone_info);
+          clone_info=DestroyImageInfo(clone_info);
         ThrowReaderException(CoderError,"UnsupportedCellTypeInTheMatrix");
       }
 
@@ -1140,7 +1140,13 @@ MATLAB_KO:
 DisableMSCWarning(4127)
         if (sizeof(double) != 8)
 RestoreMSCWarning
-          ThrowReaderException(CoderError, "IncompatibleSizeOfDouble");
+          {
+            if (clone_info != (ImageInfo *) NULL)
+              clone_info=DestroyImageInfo(clone_info);
+            if ((image != image2) && (image2 != (Image *) NULL))
+              image2=DestroyImage(image2);
+            ThrowReaderException(CoderError, "IncompatibleSizeOfDouble");
+          }
         if (MATLAB_HDR.StructureFlag & FLAG_COMPLEX)
   {                         /* complex double type cell */
   }
@@ -1184,6 +1190,8 @@ RestoreMSCWarning
     status=SetImageExtent(image,image->columns,image->rows,exception);
     if (status == MagickFalse)
       {
+        if (clone_info != (ImageInfo *) NULL)
+          clone_info=DestroyImageInfo(clone_info);
         if ((image != image2) && (image2 != (Image *) NULL))
           image2=DestroyImage(image2);
         return(DestroyImageList(image));
@@ -1191,12 +1199,24 @@ RestoreMSCWarning
     (void) SetImageBackgroundColor(image,exception);
     quantum_info=AcquireQuantumInfo(clone_info,image);
     if (quantum_info == (QuantumInfo *) NULL)
-      ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+      {
+        if (clone_info != (ImageInfo *) NULL)
+          clone_info=DestroyImageInfo(clone_info);
+        if ((image != image2) && (image2 != (Image *) NULL))
+          image2=DestroyImage(image2);
+        ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+      }
 
   /* ----- Load raster data ----- */
     BImgBuff = (unsigned char *) AcquireQuantumMemory((size_t) (ldblk),sizeof(double));    /* Ldblk was set in the check phase */
     if (BImgBuff == NULL)
-      ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+      {
+        if (clone_info != (ImageInfo *) NULL)
+          clone_info=DestroyImageInfo(clone_info);
+        if ((image != image2) && (image2 != (Image *) NULL))
+          image2=DestroyImage(image2);
+        ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+      }
     (void) memset(BImgBuff,0,ldblk*sizeof(double));
 
     MinVal = 0;
-- 
2.40.0