memory leak in ReadBGRImage

[bestshow]

Version: ImageMagick 7.0.7-28
Here is the critical code in function ReadBGRImage：

canvas_image=CloneImage(image,image->extract_info.width,1,MagickFalse,        //160
    exception);
  if (canvas_image == (Image *) NULL)
    ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
  (void) SetImageVirtualPixelMethod(canvas_image,BlackVirtualPixelMethod,
    exception);
  quantum_info=AcquireQuantumInfo(image_info,canvas_image);                    //166
  if (quantum_info == (QuantumInfo *) NULL)
    ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed"); 
  quantum_type=BGRQuantum;
  if (LocaleCompare(image_info->magick,"BGRA") == 0)
    {
      quantum_type=BGRAQuantum;
      image->alpha_trait=BlendPixelTrait;
      canvas_image->alpha_trait=BlendPixelTrait;
    }
  if (LocaleCompare(image_info->magick,"BGRO") == 0)
    {
      quantum_type=BGROQuantum;
      image->alpha_trait=BlendPixelTrait;
      canvas_image->alpha_trait=BlendPixelTrait;
    }
  pixels=(const unsigned char *) NULL;
  if (image_info->number_scenes != 0)
    while (image->scene < image_info->scene)
    {
      /*
        Skip to next image.
      */
      image->scene++;
      length=GetQuantumExtent(canvas_image,quantum_info,quantum_type);
      for (y=0; y < (ssize_t) image->rows; y++)
      {
        pixels=(const unsigned char *) ReadBlobStream(image,length,
          GetQuantumPixels(quantum_info),&count);
        if (count != (ssize_t) length)
          break;
      }
    }
  count=0;
  length=0;
  scene=0;
  do
  {
    /*
      Read pixels to virtual canvas image then push to image.
    */
    if ((image_info->ping != MagickFalse) && (image_info->number_scenes != 0))
      if (image->scene >= (image_info->scene+image_info->number_scenes-1))
        break;
    status=SetImageExtent(image,image->columns,image->rows,exception);
    if (status == MagickFalse)
      return(DestroyImageList(image));                                        //212 
    switch (image_info->interlace)

line 212 forgot to free “canvas_image" (line 160) and “quantum_info” (line 166), this may cause memory leak.
Credit : ADLab of Venustech

[dlemstra]

Thanks for reporting this. Pushed some patches to resolve this and it also includes a couple other fixes.