From db9c47230cc5a1e866942fc9d73d8e81b93ffc3a Mon Sep 17 00:00:00 2001
From: root <356986351@qq.com>
Date: Fri, 15 Sep 2017 16:23:43 +0000
Subject: [PATCH] fix memory leak in meta

---
 coders/meta.c | 49 ++++++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 42 insertions(+), 7 deletions(-)

diff --git a/coders/meta.c b/coders/meta.c
index f1f65ced9..283bb6315 100644
--- a/coders/meta.c
+++ b/coders/meta.c
@@ -1226,11 +1226,21 @@ static Image *ReadMETAImage(const ImageInfo *image_info,
       profile=BlobToStringInfo(GetBlobStreamData(buff),(size_t)
         GetBlobSize(buff));
       if (profile == (StringInfo *) NULL)
-        ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+        {
+          blob=DetachBlob(buff->blob);
+          blob=RelinquishMagickMemory(blob);
+          buff=DestroyImage(buff);
+          ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+        }
       status=SetImageProfile(image,"8bim",profile,exception);
       profile=DestroyStringInfo(profile);
       if (status == MagickFalse)
-        ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+        {
+          blob=DetachBlob(buff->blob);
+          blob=RelinquishMagickMemory(blob);
+          buff=DestroyImage(buff);
+          ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+        }
       blob=DetachBlob(buff->blob);
       blob=(unsigned char *) RelinquishMagickMemory(blob);
       buff=DestroyImage(buff);
@@ -1294,11 +1304,21 @@ static Image *ReadMETAImage(const ImageInfo *image_info,
       profile=BlobToStringInfo(GetBlobStreamData(buff),(size_t)
         GetBlobSize(buff));
       if (profile == (StringInfo *) NULL)
-        ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+        {
+          blob=DetachBlob(buff->blob);
+          blob=RelinquishMagickMemory(blob);
+          buff=DestroyImage(buff);
+          ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+        }
       status=SetImageProfile(image,name,profile,exception);
       profile=DestroyStringInfo(profile);
       if (status == MagickFalse)
-        ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+        {
+          blob=DetachBlob(buff->blob);
+          blob=RelinquishMagickMemory(blob);
+          buff=DestroyImage(buff);          
+          ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+        }
       blob=DetachBlob(buff->blob);
       blob=RelinquishMagickMemory(blob);
       buff=DestroyImage(buff);
@@ -1320,7 +1340,12 @@ static Image *ReadMETAImage(const ImageInfo *image_info,
       profile=BlobToStringInfo(GetBlobStreamData(buff),(size_t)
         GetBlobSize(buff));
       if (profile == (StringInfo *) NULL)
-        ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+        {
+          blob=DetachBlob(buff->blob);
+          blob=(unsigned char *) RelinquishMagickMemory(blob);
+          buff=DestroyImage(buff);
+          ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+        }
       (void) SetImageProfile(image,"icc",profile,exception);
       profile=DestroyStringInfo(profile);
       blob=DetachBlob(buff->blob);
@@ -1343,7 +1368,12 @@ static Image *ReadMETAImage(const ImageInfo *image_info,
       profile=BlobToStringInfo(GetBlobStreamData(buff),(size_t)
         GetBlobSize(buff));
       if (profile == (StringInfo *) NULL)
-        ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+        {
+          blob=DetachBlob(buff->blob);
+          blob=(unsigned char *) RelinquishMagickMemory(blob);
+          buff=DestroyImage(buff);          
+          ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+        }
       (void) SetImageProfile(image,"8bim",profile,exception);
       profile=DestroyStringInfo(profile);
       blob=DetachBlob(buff->blob);
@@ -1366,7 +1396,12 @@ static Image *ReadMETAImage(const ImageInfo *image_info,
       profile=BlobToStringInfo(GetBlobStreamData(buff),(size_t)
         GetBlobSize(buff));
       if (profile == (StringInfo *) NULL)
-        ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+        {
+          blob=DetachBlob(buff->blob);
+          blob=(unsigned char *) RelinquishMagickMemory(blob);
+          buff=DestroyImage(buff);          
+          ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+        }
       (void) SetImageProfile(image,"xmp",profile,exception);
       profile=DestroyStringInfo(profile);
       blob=DetachBlob(buff->blob);
-- 
2.40.0