coders/png.c (ReadMNGImage): Fix out-of-order CloseBlob()
authorGlenn Randers-Pehrson <glennrp+bmo@gmail.com>
Mon, 10 Jul 2017 12:40:55 -0400
changeset 15073 d0a76868ca37
parent 15072 b24f2a9b0dd7
child 15074 1265df574db7
coders/png.c (ReadMNGImage): Fix out-of-order CloseBlob() and DestroyImageList() that caused a use-after-free crash.
ChangeLog
coders/png.c
--- a/ChangeLog	Mon Jul 10 11:31:05 2017 -0400
+++ b/ChangeLog	Mon Jul 10 12:40:55 2017 -0400
@@ -4,6 +4,8 @@
 	and CLIP object_id's.
 	* coders/png.c (ReadMNGImage): Fix apparent off-by-one error
 	in MNG FRAM change_clipping processing.
+	* coders/png.c (ReadMNGImage): Fix out-of-order CloseBlob()
+	and DestroyImageList() that caused a use-after-free crash.
 
 2017-07-08  Glenn Randers-Pehrson  <glennrp@simple.dallas.tx.us>
 
--- a/coders/png.c	Mon Jul 10 11:31:05 2017 -0400
+++ b/coders/png.c	Mon Jul 10 12:40:55 2017 -0400
@@ -5161,8 +5161,8 @@
 
       if (image == (Image *) NULL)
         {
+          CloseBlob(previous);
           DestroyImageList(previous);
-          CloseBlob(previous);
           MngInfoFreeStruct(mng_info,&have_mng_structure);
           return((Image *) NULL);
         }