Fixed memory leak reported in #428.

ImageMagick · Apr 17, 2017 · 721dc13 · 721dc13
1 parent fd84a5e
commit 721dc13
Showing 1 changed file with 31 additions and 9 deletions.
diff --git a/coders/sgi.c b/coders/sgi.c
@@ -403,7 +403,10 @@ static Image *ReadSGIImage(const ImageInfo *image_info,ExceptionInfo *exception)
         scanline=(unsigned char *) AcquireQuantumMemory(iris_info.columns,
           bytes_per_pixel*sizeof(*scanline));
         if (scanline == (unsigned char *) NULL)
-          ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+          {
+            pixel_info=RelinquishVirtualMemory(pixel_info);
+            ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+          }
         for (z=0; z < (ssize_t) iris_info.depth; z++)
         {
           p=pixels+bytes_per_pixel*z;
@@ -460,12 +463,11 @@ static Image *ReadSGIImage(const ImageInfo *image_info,ExceptionInfo *exception)
             (runlength == (size_t *) NULL) ||
             (packet_info == (MemoryInfo *) NULL))
           {
-            if (offsets == (ssize_t *) NULL)
-              offsets=(ssize_t *) RelinquishMagickMemory(offsets);
-            if (runlength == (size_t *) NULL)
-              runlength=(size_t *) RelinquishMagickMemory(runlength);
-            if (packet_info == (MemoryInfo *) NULL)
+            offsets=(ssize_t *) RelinquishMagickMemory(offsets);
+            runlength=(size_t *) RelinquishMagickMemory(runlength);
+            if (packet_info != (MemoryInfo *) NULL)
               packet_info=RelinquishVirtualMemory(packet_info);
+            pixel_info=RelinquishVirtualMemory(pixel_info);
             ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
           }
         packets=(unsigned char *) GetVirtualMemoryBlob(packet_info);
@@ -475,7 +477,13 @@ static Image *ReadSGIImage(const ImageInfo *image_info,ExceptionInfo *exception)
         {
           runlength[i]=ReadBlobMSBLong(image);
           if (runlength[i] > (4*(size_t) iris_info.columns+10))
-            ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+            {
+              offsets=(ssize_t *) RelinquishMagickMemory(offsets);
+              runlength=(size_t *) RelinquishMagickMemory(runlength);
+              packet_info=RelinquishVirtualMemory(packet_info);
+              pixel_info=RelinquishVirtualMemory(pixel_info);
+              ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+            }
         }
         /*
           Check data order.
@@ -512,7 +520,14 @@ static Image *ReadSGIImage(const ImageInfo *image_info,ExceptionInfo *exception)
                   (runlength[y+z*iris_info.rows]/bytes_per_pixel),packets,
                   (ssize_t) iris_info.columns,p+bytes_per_pixel*z);
                 if (status == MagickFalse)
-                  ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+                  {
+                    offsets=(ssize_t *) RelinquishMagickMemory(offsets);
+                    runlength=(size_t *) RelinquishMagickMemory(runlength);
+                    packet_info=RelinquishVirtualMemory(packet_info);
+                    pixel_info=RelinquishVirtualMemory(pixel_info);
+                    ThrowReaderException(CorruptImageError,
+                      "ImproperImageHeader");
+                  }
                 p+=(iris_info.columns*4*bytes_per_pixel);
               }
             }
@@ -543,7 +558,14 @@ static Image *ReadSGIImage(const ImageInfo *image_info,ExceptionInfo *exception)
                   (runlength[y+z*iris_info.rows]/bytes_per_pixel),packets,
                   (ssize_t) iris_info.columns,p+bytes_per_pixel*z);
                 if (status == MagickFalse)
-                  ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+                  {
+                    offsets=(ssize_t *) RelinquishMagickMemory(offsets);
+                    runlength=(size_t *) RelinquishMagickMemory(runlength);
+                    packet_info=RelinquishVirtualMemory(packet_info);
+                    pixel_info=RelinquishVirtualMemory(pixel_info);
+                    ThrowReaderException(CorruptImageError,
+                      "ImproperImageHeader");
+                  }
               }
               p+=(iris_info.columns*4*bytes_per_pixel);
             }