From ea3ad2ad2c9b13f4c6680631b9ef1b64bd4d45fd Mon Sep 17 00:00:00 2001 From: Dirk Lemstra Date: Mon, 17 Apr 2017 19:03:27 +0200 Subject: [PATCH] Fixed memory leak reported in #428. --- coders/sgi.c | 40 +++++++++++++++++++++++++++++++--------- 1 file changed, 31 insertions(+), 9 deletions(-) diff --git a/coders/sgi.c b/coders/sgi.c index 3ee90e2a8..4706ad0d8 100644 --- a/coders/sgi.c +++ b/coders/sgi.c @@ -398,7 +398,10 @@ static Image *ReadSGIImage(const ImageInfo *image_info,ExceptionInfo *exception) scanline=(unsigned char *) AcquireQuantumMemory(iris_info.columns, bytes_per_pixel*sizeof(*scanline)); if (scanline == (unsigned char *) NULL) - ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed"); + { + pixel_info=RelinquishVirtualMemory(pixel_info); + ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed"); + } for (z=0; z < (ssize_t) iris_info.depth; z++) { p=pixels+bytes_per_pixel*z; @@ -455,12 +458,11 @@ static Image *ReadSGIImage(const ImageInfo *image_info,ExceptionInfo *exception) (runlength == (size_t *) NULL) || (packet_info == (MemoryInfo *) NULL)) { - if (offsets == (ssize_t *) NULL) - offsets=(ssize_t *) RelinquishMagickMemory(offsets); - if (runlength == (size_t *) NULL) - runlength=(size_t *) RelinquishMagickMemory(runlength); - if (packet_info == (MemoryInfo *) NULL) + offsets=(ssize_t *) RelinquishMagickMemory(offsets); + runlength=(size_t *) RelinquishMagickMemory(runlength); + if (packet_info != (MemoryInfo *) NULL) packet_info=RelinquishVirtualMemory(packet_info); + pixel_info=RelinquishVirtualMemory(pixel_info); ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed"); } packets=(unsigned char *) GetVirtualMemoryBlob(packet_info); @@ -470,7 +472,13 @@ static Image *ReadSGIImage(const ImageInfo *image_info,ExceptionInfo *exception) { runlength[i]=ReadBlobMSBLong(image); if (runlength[i] > (4*(size_t) iris_info.columns+10)) - ThrowReaderException(CorruptImageError,"ImproperImageHeader"); + { + packet_info=RelinquishVirtualMemory(packet_info); + runlength=(size_t *) RelinquishMagickMemory(runlength); + offsets=(ssize_t *) RelinquishMagickMemory(offsets); + pixel_info=RelinquishVirtualMemory(pixel_info); + ThrowReaderException(CorruptImageError,"ImproperImageHeader"); + } } /* Check data order. @@ -507,7 +515,14 @@ static Image *ReadSGIImage(const ImageInfo *image_info,ExceptionInfo *exception) (runlength[y+z*iris_info.rows]/bytes_per_pixel),packets, (ssize_t) iris_info.columns,p+bytes_per_pixel*z); if (status == MagickFalse) - ThrowReaderException(CorruptImageError,"ImproperImageHeader"); + { + packet_info=RelinquishVirtualMemory(packet_info); + runlength=(size_t *) RelinquishMagickMemory(runlength); + offsets=(ssize_t *) RelinquishMagickMemory(offsets); + pixel_info=RelinquishVirtualMemory(pixel_info); + ThrowReaderException(CorruptImageError, + "ImproperImageHeader"); + } p+=(iris_info.columns*4*bytes_per_pixel); } } @@ -538,7 +553,14 @@ static Image *ReadSGIImage(const ImageInfo *image_info,ExceptionInfo *exception) (runlength[y+z*iris_info.rows]/bytes_per_pixel),packets, (ssize_t) iris_info.columns,p+bytes_per_pixel*z); if (status == MagickFalse) - ThrowReaderException(CorruptImageError,"ImproperImageHeader"); + { + packet_info=RelinquishVirtualMemory(packet_info); + runlength=(size_t *) RelinquishMagickMemory(runlength); + offsets=(ssize_t *) RelinquishMagickMemory(offsets); + pixel_info=RelinquishVirtualMemory(pixel_info); + ThrowReaderException(CorruptImageError, + "ImproperImageHeader"); + } } p+=(iris_info.columns*4*bytes_per_pixel); } -- 2.40.0