Skip to content

memory leak in ReadOneJNGImage #760

Closed
@jgj212

Description

@jgj212

Here is the critical code:

code1

===============================
    if (memcmp(type,mng_JHDR,4) == 0) 
      {
        if (length == 16) //JHDR len is 16
          {
            jng_width=(png_uint_32)mng_get_long(p);
            jng_height=(png_uint_32)mng_get_long(&p[4]);
            if ((jng_width == 0) || (jng_height == 0))   //4534, forget to free chunk
              ThrowReaderException(CorruptImageError,
                "NegativeOrZeroImageSize");
===============================fix
add  "DestroyJNG(chunk,&color_image,&color_image_info,&alpha_image,&alpha_image_info);" before ThrowReaderException

code2

===============================
        if (color_image_info == (ImageInfo *) NULL)   //4607, not free chunk
          ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
===============================fix
add  "DestroyJNG(chunk,&color_image,&color_image_info,&alpha_image,&alpha_image_info);" before ThrowReaderException

code3

===============================
        if (color_image == (Image *) NULL)  //4613, not free chunk and color_image_info 
          ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
===============================fix
add  "DestroyJNG(chunk,&color_image,&color_image_info,&alpha_image,&alpha_image_info);" before ThrowReaderException

code4

===============================
        if (status == MagickFalse)
          {
            color_image=DestroyImage(color_image); //4626, not free chunk/color_image_info/color_image 
            return(DestroyImageList(image));
          }
===============================fix
add  "DestroyJNG(chunk,&color_image,&color_image_info,&alpha_image,&alpha_image_info);" before return

code5

===============================
            if (alpha_image_info == (ImageInfo *) NULL)
              {
                color_image=DestroyImage(color_image); //4637, not free chunk/color_image_info/color_image 
                ThrowReaderException(ResourceLimitError,
                  "MemoryAllocationFailed");
              }
===============================fix
add  "DestroyJNG(chunk,&color_image,&color_image_info,&alpha_image,&alpha_image_info);" before ThrowReaderException

code6

===============================
            if (alpha_image == (Image *) NULL)
              {
                alpha_image_info=DestroyImageInfo(alpha_image_info);
                color_image=DestroyImage(color_image);  //4648, not free chunk/color_image_info
                ThrowReaderException(ResourceLimitError,
                  "MemoryAllocationFailed");
              }
===============================fix
add  "DestroyJNG(chunk,&color_image,&color_image_info,&alpha_image,&alpha_image_info);" before ThrowReaderException

code7

===============================
  if (jng_image == (Image *) NULL)  //4946, not free alpha_image/alpha_image_info
    return(DestroyImageList(image));
===============================fix
add  "DestroyJNG(chunk,&color_image,&color_image_info,&alpha_image,&alpha_image_info);" before return

code8

===============================
  status=SetImageExtent(image,image->columns,image->rows,exception);
  if (status == MagickFalse)
    return(DestroyImageList(image));
===============================fix
add  "DestroyJNG(chunk,&color_image,&color_image_info,&alpha_image,&alpha_image_info);"  and "jng_image= DestroyImage(jng_image);"before return

Credit: ADLab of Venustech

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions