From ac74497be613d3fb246ce3a17457d08ac81d12fe Mon Sep 17 00:00:00 2001
From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
Date: Sun, 14 Dec 2014 17:43:28 +0000
Subject: Avoid heap overflow

Avoid to allocate too much memory

git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17210 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
origin:  http://trac.imagemagick.org/changeset/17210

diff --git a/coders/fits.c b/coders/fits.c
index 0ea0b13..2d75974 100644
--- a/coders/fits.c
+++ b/coders/fits.c
@@ -656,7 +656,7 @@ static MagickBooleanType WriteFITSImage(const ImageInfo *image_info,
   */
   image->depth=GetImageQuantumDepth(image,MagickFalse);
   image->endian=MSBEndian;
-  quantum_info=AcquireQuantumInfo((const ImageInfo *) NULL,image);
+  quantum_info=AcquireQuantumInfo(image_info,image);
   if (quantum_info == (QuantumInfo *) NULL)
     ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
   offset=0;
diff --git a/coders/pnm.c b/coders/pnm.c
index 44e9ffe..90c0267 100644
--- a/coders/pnm.c
+++ b/coders/pnm.c
@@ -1930,9 +1930,10 @@ static MagickBooleanType WritePNMImage(const ImageInfo *image_info,Image *image)
         */
         (void) SetImageType(image,BilevelType);
         image->depth=1;
-        quantum_info=AcquireQuantumInfo((const ImageInfo *) NULL,image);
+        quantum_info=AcquireQuantumInfo(image_info,image);
         if (quantum_info == (QuantumInfo *) NULL)
           ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
+        (void) SetQuantumEndian(image,quantum_info,MSBEndian);
         quantum_info->min_is_white=MagickTrue;
         pixels=GetQuantumPixels(quantum_info);
         for (y=0; y < (ssize_t) image->rows; y++)
@@ -1969,9 +1970,10 @@ static MagickBooleanType WritePNMImage(const ImageInfo *image_info,Image *image)
         (void) FormatLocaleString(buffer,MaxTextExtent,"%.20g\n",(double)
           ((MagickOffsetType) GetQuantumRange(image->depth)));
         (void) WriteBlobString(image,buffer);
-        quantum_info=AcquireQuantumInfo((const ImageInfo *) NULL,image);
+        quantum_info=AcquireQuantumInfo(image_info,image);
         if (quantum_info == (QuantumInfo *) NULL)
           ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
+        (void) SetQuantumEndian(image,quantum_info,MSBEndian);
         quantum_info->min_is_white=MagickTrue;
         pixels=GetQuantumPixels(quantum_info);
         extent=GetQuantumExtent(image,quantum_info,GrayQuantum);
@@ -2083,10 +2085,11 @@ static MagickBooleanType WritePNMImage(const ImageInfo *image_info,Image *image)
         (void) FormatLocaleString(buffer,MaxTextExtent,"%.20g\n",(double)
           ((MagickOffsetType) GetQuantumRange(image->depth)));
         (void) WriteBlobString(image,buffer);
-        quantum_info=AcquireQuantumInfo((const ImageInfo *) NULL,image);
+        quantum_info=AcquireQuantumInfo(image_info,image);
         if (quantum_info == (QuantumInfo *) NULL)
           ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
         (void) SetQuantumEndian(image,quantum_info,MSBEndian);
+        (void) SetQuantumEndian(image,quantum_info,MSBEndian);
         pixels=GetQuantumPixels(quantum_info);
         extent=GetQuantumExtent(image,quantum_info,quantum_type);
         for (y=0; y < (ssize_t) image->rows; y++)
@@ -2178,7 +2181,10 @@ static MagickBooleanType WritePNMImage(const ImageInfo *image_info,Image *image)
         */
         if (image->depth > 32)
           image->depth=32;
-        quantum_info=AcquireQuantumInfo((const ImageInfo *) NULL,image);
+        quantum_info=AcquireQuantumInfo(image_info,image);
+        if (quantum_info == (QuantumInfo *) NULL)
+          ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
+        (void) SetQuantumEndian(image,quantum_info,MSBEndian);
         pixels=GetQuantumPixels(quantum_info);
         for (y=0; y < (ssize_t) image->rows; y++)
         {
diff --git a/magick/quantum.c b/magick/quantum.c
index ff993bd..b7b227a 100644
--- a/magick/quantum.c
+++ b/magick/quantum.c
@@ -113,8 +113,6 @@ MagickExport QuantumInfo *AcquireQuantumInfo(const ImageInfo *image_info,
   QuantumInfo
     *quantum_info;
 
-  if (SyncImagePixelCache(image,&image->exception) == MagickFalse)
-    return(MagickFalse);
   quantum_info=(QuantumInfo *) AcquireMagickMemory(sizeof(*quantum_info));
   if (quantum_info == (QuantumInfo *) NULL)
     ThrowFatalException(ResourceLimitFatalError,"MemoryAllocationFailed");
@@ -122,6 +120,8 @@ MagickExport QuantumInfo *AcquireQuantumInfo(const ImageInfo *image_info,
   GetQuantumInfo(image_info,quantum_info);
   if (image == (const Image *) NULL)
     return(quantum_info);
+  if (SyncImagePixelCache(image,&image->exception) == MagickFalse)
+    return(DestroyQuantumInfo(quantum_info));
   status=SetQuantumDepth(image,quantum_info,image->depth);
   quantum_info->endian=image->endian;
   if (status == MagickFalse)
-- 
cgit v0.10.2