ImageMagick/CVE-2019-7397.patch

diff -Nur ImageMagick-6.9.10-67_old/coders/pdf.c ImageMagick-6.9.10-67/coders/pdf.c
--- ImageMagick-6.9.10-67_old/coders/pdf.c	2019-12-25 16:48:50.196305907 +0800
+++ ImageMagick-6.9.10-67/coders/pdf.c	2019-12-25 18:00:11.863959671 +0800
@@ -1712,7 +1712,10 @@
     offset=TellBlob(image);
     number_pixels=(MagickSizeType) image->columns*image->rows;
     if ((4*number_pixels) != (MagickSizeType) ((size_t) (4*number_pixels)))
+    {
+      xref=(MagickOffsetType *) RelinquishMagickMemory(xref);
       ThrowPDFException(ResourceLimitError,"MemoryAllocationFailed");
+    }
     if ((compression == FaxCompression) || (compression == Group4Compression) ||
         ((image_info->type != TrueColorType) &&
          (SetImageGray(image,&image->exception) != MagickFalse)))
@@ -1735,7 +1738,10 @@
             status=InjectImageBlob(image_info,image,image,"jpeg",
               &image->exception);
             if (status == MagickFalse)
+            {
+              xref=(MagickOffsetType *) RelinquishMagickMemory(xref);
               ThrowPDFException(CoderError,image->exception.reason);
+            }
             break;
           }
           case JPEG2000Compression:
@@ -1743,7 +1749,10 @@
             status=InjectImageBlob(image_info,image,image,"jp2",
               &image->exception);
             if (status == MagickFalse)
+            {
+              xref=(MagickOffsetType *) RelinquishMagickMemory(xref);
               ThrowPDFException(CoderError,image->exception.reason);
+            }
             break;
           }
           case RLECompression:
@@ -1758,7 +1767,10 @@
             length=(size_t) number_pixels;
             pixel_info=AcquireVirtualMemory(length,sizeof(*pixels));
             if (pixel_info == (MemoryInfo *) NULL)
+            {
+              xref=(MagickOffsetType *) RelinquishMagickMemory(xref);
               ThrowPDFException(ResourceLimitError,"MemoryAllocationFailed");
+            }
             pixels=(unsigned char *) GetVirtualMemoryBlob(pixel_info);
             /*
               Dump Runlength encoded pixels.
@@ -1842,7 +1854,10 @@
             status=InjectImageBlob(image_info,image,image,"jpeg",
               &image->exception);
             if (status == MagickFalse)
+            {
+              xref=(MagickOffsetType *) RelinquishMagickMemory(xref);
               ThrowPDFException(CoderError,image->exception.reason);
+            }
             break;
           }
           case JPEG2000Compression:
@@ -1850,7 +1865,10 @@
             status=InjectImageBlob(image_info,image,image,"jp2",
               &image->exception);
             if (status == MagickFalse)
+            {
+              xref=(MagickOffsetType *) RelinquishMagickMemory(xref);
               ThrowPDFException(CoderError,image->exception.reason);
+            }
             break;
           }
           case RLECompression:
@@ -2151,7 +2169,10 @@
     tile_image=ThumbnailImage(image,geometry.width,geometry.height,
       &image->exception);
     if (tile_image == (Image *) NULL)
+    {
+      xref=(MagickOffsetType *) RelinquishMagickMemory(xref);
       ThrowPDFException(ResourceLimitError,image->exception.reason);
+    }
     xref[object++]=TellBlob(image);
     (void) FormatLocaleString(buffer,MaxTextExtent,"%.20g 0 obj\n",(double)
       object);
@@ -2256,7 +2277,10 @@
             status=InjectImageBlob(image_info,image,tile_image,"jpeg",
               &image->exception);
             if (status == MagickFalse)
+            {
+              xref=(MagickOffsetType *) RelinquishMagickMemory(xref);
               ThrowPDFException(CoderError,tile_image->exception.reason);
+            }
             break;
           }
           case JPEG2000Compression:
@@ -2264,7 +2288,10 @@
             status=InjectImageBlob(image_info,image,tile_image,"jp2",
               &image->exception);
             if (status == MagickFalse)
+            {
+              xref=(MagickOffsetType *) RelinquishMagickMemory(xref);
               ThrowPDFException(CoderError,tile_image->exception.reason);
+            }
             break;
           }
           case RLECompression:
@@ -2281,6 +2308,7 @@
             if (pixel_info == (MemoryInfo *) NULL)
               {
                 tile_image=DestroyImage(tile_image);
+                xref=(MagickOffsetType *) RelinquishMagickMemory(xref);
                 ThrowPDFException(ResourceLimitError,"MemoryAllocationFailed");
               }
             pixels=(unsigned char *) GetVirtualMemoryBlob(pixel_info);
@@ -2354,7 +2382,10 @@
             status=InjectImageBlob(image_info,image,tile_image,"jpeg",
               &image->exception);
             if (status == MagickFalse)
+            {
+              xref=(MagickOffsetType *) RelinquishMagickMemory(xref);
               ThrowPDFException(CoderError,tile_image->exception.reason);
+            }
             break;
           }
           case JPEG2000Compression:
@@ -2362,7 +2393,10 @@
             status=InjectImageBlob(image_info,image,tile_image,"jp2",
               &image->exception);
             if (status == MagickFalse)
+            {
+              xref=(MagickOffsetType *) RelinquishMagickMemory(xref);
               ThrowPDFException(CoderError,tile_image->exception.reason);
+            }
             break;
           }
           case RLECompression:
@@ -2380,6 +2414,7 @@
             if (pixel_info == (MemoryInfo *) NULL)
               {
                 tile_image=DestroyImage(tile_image);
+                xref=(MagickOffsetType *) RelinquishMagickMemory(xref);
                 ThrowPDFException(ResourceLimitError,"MemoryAllocationFailed");
               }
             pixels=(unsigned char *) GetVirtualMemoryBlob(pixel_info);
@@ -2474,6 +2509,7 @@
               if (pixel_info == (MemoryInfo *) NULL)
                 {
                   tile_image=DestroyImage(tile_image);
+                  xref=(MagickOffsetType *) RelinquishMagickMemory(xref);
                   ThrowPDFException(ResourceLimitError,
                     "MemoryAllocationFailed");
                 }
@@ -2679,6 +2715,7 @@
             if (pixel_info == (MemoryInfo *) NULL)
               {
                 image=DestroyImage(image);
+                xref=(MagickOffsetType *) RelinquishMagickMemory(xref);
                 ThrowPDFException(ResourceLimitError,"MemoryAllocationFailed");
               }
            pixels=(unsigned char *) GetVirtualMemoryBlob(pixel_info);