coders/png.c (ReadMNGImage): Fix out-of-order CloseBlob()
and DestroyImageList() that caused a use-after-free crash.
--- a/ChangeLog Mon Jul 10 11:31:05 2017 -0400
+++ b/ChangeLog Mon Jul 10 12:40:55 2017 -0400
@@ -4,6 +4,8 @@
and CLIP object_id's.
* coders/png.c (ReadMNGImage): Fix apparent off-by-one error
in MNG FRAM change_clipping processing.
+ * coders/png.c (ReadMNGImage): Fix out-of-order CloseBlob()
+ and DestroyImageList() that caused a use-after-free crash.
2017-07-08 Glenn Randers-Pehrson <glennrp@simple.dallas.tx.us>
--- a/coders/png.c Mon Jul 10 11:31:05 2017 -0400
+++ b/coders/png.c Mon Jul 10 12:40:55 2017 -0400
@@ -5161,8 +5161,8 @@
if (image == (Image *) NULL)
{
+ CloseBlob(previous);
DestroyImageList(previous);
- CloseBlob(previous);
MngInfoFreeStruct(mng_info,&have_mng_structure);
return((Image *) NULL);
}