GraphicsMagick: ReadMNGImage(): Address oss-fuzz 46843 "graphics...

changeset 14b2a9e3380a in /hg/GraphicsMagick
details: http://hg.GraphicsMagick.org/hg/GraphicsMagick?cmd=changeset;node=14b2a9e3380a
summary: ReadMNGImage(): Address oss-fuzz 46843 "graphicsmagick:enhance_fuzzer: Heap-use-after-free in CloseBlob"

diffstat:

 ChangeLog                              |   5 +++++
 VisualMagick/installer/inc/version.isx |   4 ++--
 coders/png.c                           |  23 ++++++++++++++++++-----
 magick/version.h                       |   4 ++--
 www/Changelog.html                     |   4 ++++
 5 files changed, 31 insertions(+), 9 deletions(-)

diffs (95 lines):

diff -r af5795bfab2a -r 14b2a9e3380a ChangeLog
--- a/ChangeLog	Sun Apr 17 15:49:54 2022 -0500
+++ b/ChangeLog	Wed Apr 20 18:31:45 2022 -0500
@@ -1,3 +1,8 @@
+2022-04-20  Bob Friesenhahn  <[email protected]>
+
+        * coders/png.c (ReadMNGImage): Address oss-fuzz 46843
+        "graphicsmagick:enhance_fuzzer: Heap-use-after-free in CloseBlob".
+
 2022-04-17  Bob Friesenhahn  <[email protected]>
 
         * coders/{msl.c, svg.c, url.c}: When __MINGW32__ is defined, then
diff -r af5795bfab2a -r 14b2a9e3380a VisualMagick/installer/inc/version.isx
--- a/VisualMagick/installer/inc/version.isx	Sun Apr 17 15:49:54 2022 -0500
+++ b/VisualMagick/installer/inc/version.isx	Wed Apr 20 18:31:45 2022 -0500
@@ -10,5 +10,5 @@
 
 #define public MagickPackageName "GraphicsMagick"
 #define public MagickPackageVersion "1.4"
-#define public MagickPackageVersionAddendum ".020220417"
-#define public MagickPackageReleaseDate "snapshot-20220417"
+#define public MagickPackageVersionAddendum ".020220420"
+#define public MagickPackageReleaseDate "snapshot-20220420"
diff -r af5795bfab2a -r 14b2a9e3380a coders/png.c
--- a/coders/png.c	Sun Apr 17 15:49:54 2022 -0500
+++ b/coders/png.c	Wed Apr 20 18:31:45 2022 -0500
@@ -5712,22 +5712,35 @@
           (void) SeekBlob(image,-((long) length+12),SEEK_CUR);
         }
 
-      previous=image;
+      previous=(Image *) NULL;
       mng_info->image=image;
       mng_info->mng_type=mng_type;
       mng_info->object_id=object_id;
 
       if (!memcmp(type,mng_IHDR,4))
-        image=ReadOnePNGImage(mng_info,image_info,exception);
+        {
+          Image *new_image=ReadOnePNGImage(mng_info,image_info,exception);
+          if (new_image != (Image *) NULL)
+            previous=image;
+          image=new_image;
 #if defined(JNG_SUPPORTED)
+        }
       else
-        image=ReadOneJNGImage(mng_info,image_info,exception);
+        {
+          Image *new_image=ReadOneJNGImage(mng_info,image_info,exception);
+          if (new_image != (Image *) NULL)
+              previous=image;
+          image=new_image;
+        }
 #endif
 
       if (image == (Image *) NULL)
         {
-          CloseBlob(previous);
-          DestroyImageList(previous);
+          if (previous != (Image *) NULL)
+            {
+              CloseBlob(previous);
+              DestroyImageList(previous);
+            }
           MngInfoFreeStruct(mng_info,&have_mng_structure);
           return((Image *) NULL);
         }
diff -r af5795bfab2a -r 14b2a9e3380a magick/version.h
--- a/magick/version.h	Sun Apr 17 15:49:54 2022 -0500
+++ b/magick/version.h	Wed Apr 20 18:31:45 2022 -0500
@@ -38,8 +38,8 @@
 #define MagickLibVersion  0x272400
 #define MagickLibVersionText  "1.4"
 #define MagickLibVersionNumber 27,24,0
-#define MagickChangeDate   "20220417"
-#define MagickReleaseDate  "snapshot-20220417"
+#define MagickChangeDate   "20220420"
+#define MagickReleaseDate  "snapshot-20220420"
 
 /*
   The MagickLibInterfaceNewest and MagickLibInterfaceOldest defines
diff -r af5795bfab2a -r 14b2a9e3380a www/Changelog.html
--- a/www/Changelog.html	Sun Apr 17 15:49:54 2022 -0500
+++ b/www/Changelog.html	Wed Apr 20 18:31:45 2022 -0500
@@ -35,6 +35,10 @@
 <div class="document">
 
 
+<p>2022-04-20  Bob Friesenhahn  &lt;<a class="reference external" href="mailto:bfriesen&#37;&#52;&#48;simple&#46;dallas&#46;tx&#46;us">bfriesen<span>&#64;</span>simple<span>&#46;</span>dallas<span>&#46;</span>tx<span>&#46;</span>us</a>&gt;</p>
+<blockquote>
+* coders/png.c (ReadMNGImage): Address oss-fuzz 46843
+&quot;graphicsmagick:enhance_fuzzer: Heap-use-after-free in CloseBlob&quot;.</blockquote>
 <p>2022-04-17  Bob Friesenhahn  &lt;<a class="reference external" href="mailto:bfriesen&#37;&#52;&#48;simple&#46;dallas&#46;tx&#46;us">bfriesen<span>&#64;</span>simple<span>&#46;</span>dallas<span>&#46;</span>tx<span>&#46;</span>us</a>&gt;</p>
 <blockquote>
 * coders/{msl.c, svg.c, url.c}: When __MINGW32__ is defined, then