# HG changeset patch
# User Glenn Randers-Pehrson <glennrp+bmo@gmail.com>
# Date 1499704855 14400
# Node ID d0a76868ca37ae482eb3e8cecbb9150c5348ffe8
# Parent  b24f2a9b0dd70506d429e537ff3e81532b5bfc23
coders/png.c (ReadMNGImage): Fix out-of-order CloseBlob()

and DestroyImageList() that caused a use-after-free crash.

diff -r b24f2a9b0dd7 -r d0a76868ca37 coders/png.c
--- a/coders/png.c	Mon Jul 10 11:31:05 2017 -0400
+++ b/coders/png.c	Mon Jul 10 12:40:55 2017 -0400
@@ -5161,8 +5161,8 @@
 
       if (image == (Image *) NULL)
         {
+          CloseBlob(previous);
           DestroyImageList(previous);
-          CloseBlob(previous);
           MngInfoFreeStruct(mng_info,&have_mng_structure);
           return((Image *) NULL);
         }