Closed
Description
Here is the critical code:
code1
===============================
if (memcmp(type,mng_JHDR,4) == 0)
{
if (length == 16) //JHDR len is 16
{
jng_width=(png_uint_32)mng_get_long(p);
jng_height=(png_uint_32)mng_get_long(&p[4]);
if ((jng_width == 0) || (jng_height == 0)) //4534, forget to free chunk
ThrowReaderException(CorruptImageError,
"NegativeOrZeroImageSize");
===============================fix
add "DestroyJNG(chunk,&color_image,&color_image_info,&alpha_image,&alpha_image_info);" before ThrowReaderException
code2
===============================
if (color_image_info == (ImageInfo *) NULL) //4607, not free chunk
ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
===============================fix
add "DestroyJNG(chunk,&color_image,&color_image_info,&alpha_image,&alpha_image_info);" before ThrowReaderException
code3
===============================
if (color_image == (Image *) NULL) //4613, not free chunk and color_image_info
ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
===============================fix
add "DestroyJNG(chunk,&color_image,&color_image_info,&alpha_image,&alpha_image_info);" before ThrowReaderException
code4
===============================
if (status == MagickFalse)
{
color_image=DestroyImage(color_image); //4626, not free chunk/color_image_info/color_image
return(DestroyImageList(image));
}
===============================fix
add "DestroyJNG(chunk,&color_image,&color_image_info,&alpha_image,&alpha_image_info);" before return
code5
===============================
if (alpha_image_info == (ImageInfo *) NULL)
{
color_image=DestroyImage(color_image); //4637, not free chunk/color_image_info/color_image
ThrowReaderException(ResourceLimitError,
"MemoryAllocationFailed");
}
===============================fix
add "DestroyJNG(chunk,&color_image,&color_image_info,&alpha_image,&alpha_image_info);" before ThrowReaderException
code6
===============================
if (alpha_image == (Image *) NULL)
{
alpha_image_info=DestroyImageInfo(alpha_image_info);
color_image=DestroyImage(color_image); //4648, not free chunk/color_image_info
ThrowReaderException(ResourceLimitError,
"MemoryAllocationFailed");
}
===============================fix
add "DestroyJNG(chunk,&color_image,&color_image_info,&alpha_image,&alpha_image_info);" before ThrowReaderException
code7
===============================
if (jng_image == (Image *) NULL) //4946, not free alpha_image/alpha_image_info
return(DestroyImageList(image));
===============================fix
add "DestroyJNG(chunk,&color_image,&color_image_info,&alpha_image,&alpha_image_info);" before return
code8
===============================
status=SetImageExtent(image,image->columns,image->rows,exception);
if (status == MagickFalse)
return(DestroyImageList(image));
===============================fix
add "DestroyJNG(chunk,&color_image,&color_image_info,&alpha_image,&alpha_image_info);" and "jng_image= DestroyImage(jng_image);"before return
Credit: ADLab of Venustech