diff -Nur ImageMagick-6.9.10-67_old/coders/pdf.c ImageMagick-6.9.10-67/coders/pdf.c --- ImageMagick-6.9.10-67_old/coders/pdf.c 2019-12-25 16:48:50.196305907 +0800 +++ ImageMagick-6.9.10-67/coders/pdf.c 2019-12-25 18:00:11.863959671 +0800 @@ -1712,7 +1712,10 @@ offset=TellBlob(image); number_pixels=(MagickSizeType) image->columns*image->rows; if ((4*number_pixels) != (MagickSizeType) ((size_t) (4*number_pixels))) + { + xref=(MagickOffsetType *) RelinquishMagickMemory(xref); ThrowPDFException(ResourceLimitError,"MemoryAllocationFailed"); + } if ((compression == FaxCompression) || (compression == Group4Compression) || ((image_info->type != TrueColorType) && (SetImageGray(image,&image->exception) != MagickFalse))) @@ -1735,7 +1738,10 @@ status=InjectImageBlob(image_info,image,image,"jpeg", &image->exception); if (status == MagickFalse) + { + xref=(MagickOffsetType *) RelinquishMagickMemory(xref); ThrowPDFException(CoderError,image->exception.reason); + } break; } case JPEG2000Compression: @@ -1743,7 +1749,10 @@ status=InjectImageBlob(image_info,image,image,"jp2", &image->exception); if (status == MagickFalse) + { + xref=(MagickOffsetType *) RelinquishMagickMemory(xref); ThrowPDFException(CoderError,image->exception.reason); + } break; } case RLECompression: @@ -1758,7 +1767,10 @@ length=(size_t) number_pixels; pixel_info=AcquireVirtualMemory(length,sizeof(*pixels)); if (pixel_info == (MemoryInfo *) NULL) + { + xref=(MagickOffsetType *) RelinquishMagickMemory(xref); ThrowPDFException(ResourceLimitError,"MemoryAllocationFailed"); + } pixels=(unsigned char *) GetVirtualMemoryBlob(pixel_info); /* Dump Runlength encoded pixels. @@ -1842,7 +1854,10 @@ status=InjectImageBlob(image_info,image,image,"jpeg", &image->exception); if (status == MagickFalse) + { + xref=(MagickOffsetType *) RelinquishMagickMemory(xref); ThrowPDFException(CoderError,image->exception.reason); + } break; } case JPEG2000Compression: @@ -1850,7 +1865,10 @@ status=InjectImageBlob(image_info,image,image,"jp2", &image->exception); if (status == MagickFalse) + { + xref=(MagickOffsetType *) RelinquishMagickMemory(xref); ThrowPDFException(CoderError,image->exception.reason); + } break; } case RLECompression: @@ -2151,7 +2169,10 @@ tile_image=ThumbnailImage(image,geometry.width,geometry.height, &image->exception); if (tile_image == (Image *) NULL) + { + xref=(MagickOffsetType *) RelinquishMagickMemory(xref); ThrowPDFException(ResourceLimitError,image->exception.reason); + } xref[object++]=TellBlob(image); (void) FormatLocaleString(buffer,MaxTextExtent,"%.20g 0 obj\n",(double) object); @@ -2256,7 +2277,10 @@ status=InjectImageBlob(image_info,image,tile_image,"jpeg", &image->exception); if (status == MagickFalse) + { + xref=(MagickOffsetType *) RelinquishMagickMemory(xref); ThrowPDFException(CoderError,tile_image->exception.reason); + } break; } case JPEG2000Compression: @@ -2264,7 +2288,10 @@ status=InjectImageBlob(image_info,image,tile_image,"jp2", &image->exception); if (status == MagickFalse) + { + xref=(MagickOffsetType *) RelinquishMagickMemory(xref); ThrowPDFException(CoderError,tile_image->exception.reason); + } break; } case RLECompression: @@ -2281,6 +2308,7 @@ if (pixel_info == (MemoryInfo *) NULL) { tile_image=DestroyImage(tile_image); + xref=(MagickOffsetType *) RelinquishMagickMemory(xref); ThrowPDFException(ResourceLimitError,"MemoryAllocationFailed"); } pixels=(unsigned char *) GetVirtualMemoryBlob(pixel_info); @@ -2354,7 +2382,10 @@ status=InjectImageBlob(image_info,image,tile_image,"jpeg", &image->exception); if (status == MagickFalse) + { + xref=(MagickOffsetType *) RelinquishMagickMemory(xref); ThrowPDFException(CoderError,tile_image->exception.reason); + } break; } case JPEG2000Compression: @@ -2362,7 +2393,10 @@ status=InjectImageBlob(image_info,image,tile_image,"jp2", &image->exception); if (status == MagickFalse) + { + xref=(MagickOffsetType *) RelinquishMagickMemory(xref); ThrowPDFException(CoderError,tile_image->exception.reason); + } break; } case RLECompression: @@ -2380,6 +2414,7 @@ if (pixel_info == (MemoryInfo *) NULL) { tile_image=DestroyImage(tile_image); + xref=(MagickOffsetType *) RelinquishMagickMemory(xref); ThrowPDFException(ResourceLimitError,"MemoryAllocationFailed"); } pixels=(unsigned char *) GetVirtualMemoryBlob(pixel_info); @@ -2474,6 +2509,7 @@ if (pixel_info == (MemoryInfo *) NULL) { tile_image=DestroyImage(tile_image); + xref=(MagickOffsetType *) RelinquishMagickMemory(xref); ThrowPDFException(ResourceLimitError, "MemoryAllocationFailed"); } @@ -2679,6 +2715,7 @@ if (pixel_info == (MemoryInfo *) NULL) { image=DestroyImage(image); + xref=(MagickOffsetType *) RelinquishMagickMemory(xref); ThrowPDFException(ResourceLimitError,"MemoryAllocationFailed"); } pixels=(unsigned char *) GetVirtualMemoryBlob(pixel_info);