Fixed possible memory leak.

ImageMagick · Dec 12, 2024 · 54ddd07 · 54ddd07
1 parent 58075e4
commit 54ddd07
Showing 1 changed file with 38 additions and 13 deletions.
diff --git a/coders/meta.c b/coders/meta.c
@@ -322,6 +322,9 @@ static ssize_t parse8BIM(Image *ifile, Image *ofile)
   unsigned int
     recnum;
 
+  MagickBooleanType
+    status;
+
   MagickOffsetType
     savedpos,
     currentpos;
@@ -343,6 +346,7 @@ static ssize_t parse8BIM(Image *ifile, Image *ofile)
     return(-1);
   newstr = name = token = (char *) NULL;
   savedpos = 0;
+  status=MagickTrue;
   token_info=AcquireTokenInfo();
   while (super_fgets(&line,&inputlen,ifile)!=NULL)
   {
@@ -447,21 +451,21 @@ static ssize_t parse8BIM(Image *ifile, Image *ofile)
                     currentpos = TellBlob(ofile);
                     if (currentpos < 0)
                       {
-                        line=DestroyString(line);
-                        return(-1);
+                        status=MagickFalse;
+                        break;
                       }
                     offset=SeekBlob(ofile,savedpos,SEEK_SET);
                     if (offset < 0)
                       {
-                        line=DestroyString(line);
-                        return(-1);
+                        status=MagickFalse;
+                        break;
                       }
                     (void) WriteBlobMSBLong(ofile,(unsigned int) diff);
                     offset=SeekBlob(ofile,currentpos,SEEK_SET);
                     if (offset < 0)
                       {
-                        line=DestroyString(line);
-                        return(-1);
+                        status=MagickFalse;
+                        break;
                       }
                     savedolen = 0L;
                   }
@@ -506,7 +510,8 @@ static ssize_t parse8BIM(Image *ifile, Image *ofile)
                     /* patch in a fake length for now and fix it later */
                     savedpos = TellBlob(ofile);
                     if (savedpos < 0)
-                      return(-1);
+                        status=MagickFalse;
+                        break;
                     (void) WriteBlobMSBLong(ofile,0xFFFFFFFFU);
                     outputlen += 4;
                     savedolen = outputlen;
@@ -536,6 +541,8 @@ static ssize_t parse8BIM(Image *ifile, Image *ofile)
       newstr=DestroyString(newstr);
     if (name != (char *) NULL)
       name=DestroyString(name);
+    if (status == MagickFalse)
+      break;
   }
   token_info=DestroyTokenInfo(token_info);
   if (token != (char *) NULL)
@@ -564,7 +571,7 @@ static ssize_t parse8BIM(Image *ifile, Image *ofile)
         return(-1);
       savedolen = 0L;
     }
-  return(outputlen);
+  return(status == MagickFalse ? -1 : outputlen);
 }
 
 static char *super_fgets_w(char **b, size_t *blen, Image *file)
@@ -650,6 +657,9 @@ static ssize_t parse8BIMW(Image *ifile, Image *ofile)
     savedolen = 0L,
     outputlen = 0L;
 
+  MagickBooleanType
+    status;
+
   MagickOffsetType
     savedpos,
     currentpos;
@@ -664,6 +674,7 @@ static ssize_t parse8BIMW(Image *ifile, Image *ofile)
     return(-1);
   newstr = name = token = (char *) NULL;
   savedpos = 0;
+  status=MagickTrue;
   token_info=AcquireTokenInfo();
   while (super_fgets_w(&line,&inputlen,ifile) != NULL)
   {
@@ -765,14 +776,23 @@ static ssize_t parse8BIMW(Image *ifile, Image *ofile)
                     ssize_t diff = outputlen - savedolen;
                     currentpos = TellBlob(ofile);
                     if (currentpos < 0)
-                      return(-1);
+                      {
+                        status=MagickFalse;
+                        break;
+                      }
                     offset=SeekBlob(ofile,savedpos,SEEK_SET);
                     if (offset < 0)
-                      return(-1);
+                      {
+                        status=MagickFalse;
+                        break;
+                      }
                     (void) WriteBlobMSBLong(ofile,(unsigned int) diff);
                     offset=SeekBlob(ofile,currentpos,SEEK_SET);
                     if (offset < 0)
-                      return(-1);
+                      {
+                        status=MagickFalse;
+                        break;
+                      }
                     savedolen = 0L;
                   }
                 if (outputlen & 1)
@@ -816,7 +836,10 @@ static ssize_t parse8BIMW(Image *ifile, Image *ofile)
                     /* patch in a fake length for now and fix it later */
                     savedpos = TellBlob(ofile);
                     if (savedpos < 0)
-                      return(-1);
+                      {
+                        status=MagickFalse;
+                        break;
+                      }
                     (void) WriteBlobMSBLong(ofile,0xFFFFFFFFU);
                     outputlen += 4;
                     savedolen = outputlen;
@@ -846,6 +869,8 @@ static ssize_t parse8BIMW(Image *ifile, Image *ofile)
       newstr=DestroyString(newstr);
     if (name != (char *) NULL)
       name=DestroyString(name);
+    if (status == MagickFalse)
+      break;
   }
   token_info=DestroyTokenInfo(token_info);
   if (token != (char *) NULL)
@@ -874,7 +899,7 @@ static ssize_t parse8BIMW(Image *ifile, Image *ofile)
         return(-1);
       savedolen = 0L;
     }
-  return outputlen;
+  return(status == MagickFalse ? -1 : outputlen);
 }
 
 /* some defines for the different JPEG block types */