GraphicsMagick/GraphicsMagick-CVE-2017-11102-2.patch

# HG changeset patch
# User Glenn Randers-Pehrson <glennrp+bmo@gmail.com>
# Date 1499352170 14400
# Node ID d445af60a8d50c4c6f063c7e65fea255b6db2b33
# Parent  dea93a690fc125f70fb8688a0ff3035b96b0045e
coders/png.c: Consolidate JNG cleanup into a new DestroyJNG() function.

diff -r dea93a690fc1 -r d445af60a8d5 coders/png.c
--- a/coders/png.c	Wed Jul 05 09:41:22 2017 -0400
+++ b/coders/png.c	Thu Jul 06 10:42:50 2017 -0400
@@ -2924,18 +2924,20 @@
 
 #if defined(JNG_SUPPORTED)
 
-
 void
-DestroyJNGInfo(ImageInfo *color_image_info, ImageInfo *alpha_image_info)
+DestroyJNG(unsigned char *chunk,Image *color_image,ImageInfo *color_image_info,
+   Image *alpha_image,ImageInfo *alpha_image_info)
 {
-          if (color_image_info != (ImageInfo *)NULL)
-            {
-              DestroyImageInfo(color_image_info);
-            }
-          if (alpha_image_info != (ImageInfo *)NULL)
-            {
-              DestroyImageInfo(alpha_image_info);
-            }
+  if (chunk)
+    MagickFreeMemory(chunk);
+  if (color_image_info)
+    DestroyImageInfo(color_image_info);
+  if (alpha_image_info)
+    DestroyImageInfo(alpha_image_info);
+  if (color_image)
+    DestroyImage(color_image);
+  if (alpha_image)
+    DestroyImage(alpha_image);
 }
 /*
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
@@ -3105,7 +3107,8 @@
 
       if (length > PNG_MAX_UINT || count == 0)
         {
-          DestroyJNGInfo(color_image_info,alpha_image_info);
+          DestroyJNG(NULL,color_image,color_image_info,
+            alpha_image,alpha_image_info);
           ThrowReaderException(CorruptImageError,CorruptImage,image);
         }
 
@@ -3116,13 +3119,15 @@
           chunk=MagickAllocateMemory(unsigned char *,length);
           if (chunk == (unsigned char *) NULL)
             {
-              DestroyJNGInfo(color_image_info,alpha_image_info);
+              DestroyJNG(chunk,color_image,color_image_info,
+                alpha_image,alpha_image_info);
               ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,
                                    image);
             }
           if (ReadBlob(image,length,chunk) < length)
             {
-              DestroyJNGInfo(color_image_info,alpha_image_info);
+              DestroyJNG(chunk,color_image,color_image_info,
+                alpha_image,alpha_image_info);
               ThrowReaderException(CorruptImageError,CorruptImage,image);
             }
           p=chunk;
@@ -3133,8 +3138,8 @@
         {
           if (length != 16)
             {
-              DestroyJNGInfo(color_image_info,alpha_image_info);
-              MagickFreeMemory(chunk);
+              DestroyJNG(chunk,color_image,color_image_info,
+                alpha_image,alpha_image_info);
               (void) ThrowException2(&image->exception,CoderWarning,
                              "Invalid JHDR chunk length",(char *) NULL);
               return (MagickFail);
@@ -3196,8 +3201,8 @@
               (void) LogMagickEvent(CoderEvent,GetMagickModule(),
                  "    JNG width or height too large: (%lu x %lu)",
                   jng_width, jng_height);
-              MagickFreeMemory(chunk);
-              DestroyJNGInfo(color_image_info,alpha_image_info);
+              DestroyJNG(chunk,color_image,color_image_info,
+                alpha_image,alpha_image_info);
               ThrowReaderException(CorruptImageError,ImproperImageHeader,image);
             }
 
@@ -3224,7 +3229,8 @@
           color_image_info=MagickAllocateMemory(ImageInfo *,sizeof(ImageInfo));
           if (color_image_info == (ImageInfo *) NULL)
             {
-              DestroyJNGInfo(color_image_info,alpha_image_info);
+              DestroyJNG(chunk,color_image,color_image_info,
+                alpha_image,alpha_image_info);
               ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,
                                    image);
             }
@@ -3232,7 +3238,8 @@
           color_image=AllocateImage(color_image_info);
           if (color_image == (Image *) NULL)
             {
-              DestroyJNGInfo(color_image_info,alpha_image_info);
+              DestroyJNG(chunk,color_image,color_image_info,
+                alpha_image,alpha_image_info);
               ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,
                                    image);
             }
@@ -3244,7 +3251,8 @@
                           exception);
           if (status == MagickFalse)
             {
-              DestroyJNGInfo(color_image_info,alpha_image_info);
+              DestroyJNG(chunk,color_image,color_image_info,
+                alpha_image,alpha_image_info);
               ThrowReaderException(CoderError,UnableToOpenBlob,color_image);
             }
 
@@ -3254,7 +3262,8 @@
                                                     sizeof(ImageInfo));
               if (alpha_image_info == (ImageInfo *) NULL)
                 {
-                  DestroyJNGInfo(color_image_info,alpha_image_info);
+                  DestroyJNG(chunk,color_image,color_image_info,
+                    alpha_image,alpha_image_info);
                   ThrowReaderException(ResourceLimitError,
                                        MemoryAllocationFailed, image);
                 }
@@ -3262,7 +3271,8 @@
               alpha_image=AllocateImage(alpha_image_info);
               if (alpha_image == (Image *) NULL)
                 {
-                  DestroyJNGInfo(color_image_info,alpha_image_info);
+                  DestroyJNG(chunk,color_image,color_image_info,
+                    alpha_image,alpha_image_info);
                   ThrowReaderException(ResourceLimitError,
                                        MemoryAllocationFailed,
                                        alpha_image);
@@ -3275,8 +3285,8 @@
                               exception);
               if (status == MagickFalse)
                 {
-                  DestroyJNGInfo(color_image_info,alpha_image_info);
-                  DestroyImage(alpha_image);
+                  DestroyJNG(chunk,color_image,color_image_info,
+                    alpha_image,alpha_image_info);
                   ThrowReaderException(CoderError,UnableToOpenBlob,image);
                 }
               if (jng_alpha_compression_method == 0)
@@ -3496,7 +3506,7 @@
     }
 
 
-  /* IEND found */
+  /* IEND found or loop ended */
 
   /*
     Finish up reading image data:
@@ -3610,10 +3620,8 @@
                     break;
                 }
               (void) LiberateUniqueFileResource(alpha_image->filename);
-              DestroyImage(alpha_image);
-              alpha_image = (Image *)NULL;
-              DestroyImageInfo(alpha_image_info);
-              alpha_image_info = (ImageInfo *)NULL;
+              DestroyJNG(NULL,color_image,color_image_info,
+                alpha_image,alpha_image_info);
               DestroyImage(jng_image);
               jng_image = (Image *)NULL;
             }
@@ -3636,13 +3644,8 @@
 
   /* Clean up in case we didn't earlier */
 
-  DestroyJNGInfo(color_image_info,alpha_image_info);
-
-  if (alpha_image != (Image *)NULL)
-    {
-      (void) LiberateUniqueFileResource(alpha_image->filename);
-      DestroyImage(alpha_image);
-    }
+  DestroyJNG(NULL,color_image,color_image_info,
+    alpha_image,alpha_image_info);
 
   if (logging)
     (void) LogMagickEvent(CoderEvent,GetMagickModule(),