From e02ef0c28e495c3c38109c46de28229b51ce67d6 Mon Sep 17 00:00:00 2001
From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
Date: Sun, 14 Dec 2014 17:43:28 +0000
Subject: [PATCH] Avoid heap overflow

Avoid to allocate too much memory

git-svn-id: https://subversion.imagemagick.org/subversion/ImageMagick/branches/ImageMagick-6@17210 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74
origin:  http://trac.imagemagick.org/changeset/17210
---
 coders/fits.c |  2 +-
 coders/pnm.c  | 10 ++++++----
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/coders/fits.c b/coders/fits.c
index 8f7829a..00d8283 100644
--- a/coders/fits.c
+++ b/coders/fits.c
@@ -648,7 +648,7 @@ static MagickBooleanType WriteFITSImage(const ImageInfo *image_info,
     Initialize image header.
   */
   image->depth=GetImageQuantumDepth(image,MagickFalse);
-  quantum_info=AcquireQuantumInfo((const ImageInfo *) NULL,image);
+  quantum_info=AcquireQuantumInfo(image_info,image);
   if (quantum_info == (QuantumInfo *) NULL)
     ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
   offset=0;
diff --git a/coders/pnm.c b/coders/pnm.c
index 23033d3..8021475 100644
--- a/coders/pnm.c
+++ b/coders/pnm.c
@@ -1850,7 +1850,7 @@ static MagickBooleanType WritePNMImage(const ImageInfo *image_info,Image *image)
           Convert image to a PBM image.
         */
         image->depth=1;
-        quantum_info=AcquireQuantumInfo((const ImageInfo *) NULL,image);
+        quantum_info=AcquireQuantumInfo(image_info,image);
         if (quantum_info == (QuantumInfo *) NULL)
           ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
         quantum_info->min_is_white=MagickTrue;
@@ -1891,7 +1891,7 @@ static MagickBooleanType WritePNMImage(const ImageInfo *image_info,Image *image)
         (void) FormatMagickString(buffer,MaxTextExtent,"%lu\n",(unsigned long)
           GetQuantumRange(image->depth));
         (void) WriteBlobString(image,buffer);
-        quantum_info=AcquireQuantumInfo((const ImageInfo *) NULL,image);
+        quantum_info=AcquireQuantumInfo(image_info,image);
         if (quantum_info == (QuantumInfo *) NULL)
           ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
         quantum_info->min_is_white=MagickTrue;
@@ -1973,7 +1973,7 @@ static MagickBooleanType WritePNMImage(const ImageInfo *image_info,Image *image)
         (void) FormatMagickString(buffer,MaxTextExtent,"%lu\n",(unsigned long)
           GetQuantumRange(image->depth));
         (void) WriteBlobString(image,buffer);
-        quantum_info=AcquireQuantumInfo((const ImageInfo *) NULL,image);
+        quantum_info=AcquireQuantumInfo(image_info,image);
         if (quantum_info == (QuantumInfo *) NULL)
           ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
         pixels=GetQuantumPixels(quantum_info);
@@ -2055,7 +2055,9 @@ static MagickBooleanType WritePNMImage(const ImageInfo *image_info,Image *image)
         */
         if (image->depth > 16)
           image->depth=16;
-        quantum_info=AcquireQuantumInfo((const ImageInfo *) NULL,image);
+        quantum_info=AcquireQuantumInfo((const ImageInfo *) image_info,image);
+        if (quantum_info == (QuantumInfo *) NULL)
+          ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
         pixels=GetQuantumPixels(quantum_info);
         range=GetQuantumRange(image->depth);
         for (y=0; y < (long) image->rows; y++)
-- 
2.1.4