* coders/wpg.c Check for InsertRow() return value.
authorfojtik
Sat, 04 Nov 2017 22:05:24 +0100
changeset 15247 75245a215fff
parent 15246 2b7c826d36af
child 15248 fcd3ed3394f6
* coders/wpg.c Check for InsertRow() return value.
ChangeLog
coders/wpg.c
--- a/ChangeLog	Sat Nov 04 14:20:07 2017 -0500
+++ b/ChangeLog	Sat Nov 04 22:05:24 2017 +0100
@@ -1,3 +1,8 @@
+2016-07-01  Fojtik Jaroslav  <JaFojtik@seznam.cz>
+
+	* coders/wpg.c Check for InsertRow() return value.
+
+
 2017-11-04  Bob Friesenhahn  <bfriesen@simple.dallas.tx.us>
 
 	* magick/export.c: Add not-null check for indexes pointer where
--- a/coders/wpg.c	Sat Nov 04 14:20:07 2017 -0500
+++ b/coders/wpg.c	Sat Nov 04 22:05:24 2017 +0100
@@ -340,11 +340,11 @@
 
 
   if(RetVal==MagickFail)
-    (void) LogMagickEvent(CoderEvent,GetMagickModule(),"ImportImagePixelArea failed for row: %ld, bpp: %d", y, bpp); 
+    (void) LogMagickEvent(CoderEvent,GetMagickModule(),"ImportImagePixelArea failed for row: %ld, bpp: %d", y, bpp);
 
   if (!SyncImagePixels(image))
   {
-    (void) LogMagickEvent(CoderEvent,GetMagickModule(),"SyncImagePixels failed for row: %ld, bpp: %d", y, bpp); 
+    (void) LogMagickEvent(CoderEvent,GetMagickModule(),"SyncImagePixels failed for row: %ld, bpp: %d", y, bpp);
     RetVal = MagickFail;
   }
           
@@ -441,7 +441,12 @@
                   MagickFreeMemory(BImgBuff);
                   return(-4);
                 }
-              (void) InsertRow(BImgBuff,y-1,image,bpp);
+              if(InsertRow(BImgBuff,y-1,image,bpp)==MagickFail)
+                {
+                  MagickFreeMemory(BImgBuff);
+                  return(-5);
+                }
+                
             }
         }
       }
@@ -591,8 +596,11 @@
             /* duplicate the previous row RunCount x */
             for(i=0;i<=RunCount;i++)
               {      
-                (void) InsertRow(UpImgBuff,(long) (image->rows >= y ? y : image->rows-1),
-                                 image,bpp);
+                if(InsertRow(UpImgBuff,(long)(image->rows >= y ? y : image->rows-1),image,bpp) == MagickFail)
+                  {
+                    FreeUnpackWPG2RasterAllocs(BImgBuff,UpImgBuff);
+                    return(-4);
+                  }                 
                 y++;
               }    
           }
@@ -1173,7 +1181,7 @@
                           image->blob = TmpBlob;
                           ReplaceImageInList(&image,rotated_image);
                         }
-                    }                
+                    } 
                 }
 
               /* Allocate next image structure. */
@@ -1313,11 +1321,14 @@
                     for(i=0; i< (long) image->rows; i++)
                       {
                         (void) ReadBlob(image,ldblk,(char *) BImgBuff);
-                        (void) InsertRow(BImgBuff,i,image,bpp);
+                        if(InsertRow(BImgBuff,i,image,bpp) == MagickFail)
+                        {
+                          if(BImgBuff) MagickFreeMemory(BImgBuff);
+                          goto DecompressionFailed;
+                        }
                       }
 
-                    if(BImgBuff)
-                      MagickFreeMemory(BImgBuff);
+                    if(BImgBuff) MagickFreeMemory(BImgBuff);
                     break;
                   }
                 case 1:    /*RLE for WPG2 */