Index: GraphicsMagick-1.3.29/coders/png.c =================================================================== --- GraphicsMagick-1.3.29.orig/coders/png.c 2018-04-29 20:01:26.000000000 +0200 +++ GraphicsMagick-1.3.29/coders/png.c 2019-04-15 16:34:31.494366006 +0200 @@ -504,6 +504,44 @@ static const char* PngColorTypeToString( return result; } #endif /* HasPNG */ +static MagickPassFail ReallocateImageColormap(Image *image, + const unsigned int colors) +{ + register unsigned int + i; + + unsigned int + prev_colors; + + size_t + length; + + /* + Allocate image colormap. + */ + assert(image != (Image *) NULL); + assert(image->signature == MagickSignature); + if (colors > MaxColormapSize) + return (MagickFail); + prev_colors=image->colors; + length=MagickArraySize((size_t) colors,sizeof(PixelPacket)); + MagickReallocMemory(PixelPacket *,image->colormap,length); + if (image->colormap == (PixelPacket *) NULL) + { + image->colors=0; + return(MagickFail); + } + image->colors=colors; + for (i=prev_colors; i < image->colors; i++) + { + image->colormap[i].red=0; + image->colormap[i].green=0; + image->colormap[i].blue=0; + image->colormap[i].opacity=OpaqueOpacity; + } + return(MagickPass); +} + /* %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% @@ -2595,7 +2633,11 @@ static Image *ReadOnePNGImage(MngInfo *m png_destroy_read_struct(&ping,&ping_info,&end_info); MagickFreeMemory(mng_info->quantum_scanline); MagickFreeMemory(mng_info->png_pixels); - image->colors=2; + if (ReallocateImageColormap(image,2) == MagickFail) + { + ThrowReaderException(ResourceLimitError,MemoryAllocationFailed, + image); + } (void) SetImage(image,TransparentOpacity); #if defined(GMPNG_SETJMP_NOT_THREAD_SAFE) UnlockSemaphoreInfo(png_semaphore); @@ -5893,7 +5935,11 @@ static Image *ReadMNGImage(const ImageIn */ image->columns=1; image->rows=1; - image->colors=2; + if (ReallocateImageColormap(image,2) == MagickFail) + { + ThrowReaderException(ResourceLimitError,MemoryAllocationFailed, + image); + } (void) SetImage(image,TransparentOpacity); image->page.width=1; image->page.height=1;