File ImageMagick-CVE-2014-9848.patch of Package ImageMagick.30956

Index: ImageMagick-6.8.8-1/magick/quantum.c
===================================================================
--- ImageMagick-6.8.8-1.orig/magick/quantum.c	2016-12-04 10:36:45.453185176 +0100
+++ ImageMagick-6.8.8-1/magick/quantum.c	2016-12-04 10:38:08.138559680 +0100
@@ -46,6 +46,7 @@
 #include "magick/exception.h"
 #include "magick/exception-private.h"
 #include "magick/cache.h"
+#include "magick/cache-private.h"
 #include "magick/constitute.h"
 #include "magick/delegate.h"
 #include "magick/geometry.h"
@@ -126,6 +127,8 @@ MagickExport QuantumInfo *AcquireQuantum
   GetQuantumInfo(image_info,quantum_info);
   if (image == (const Image *) NULL)
     return(quantum_info);
+  if (SyncImagePixelCache(image,&image->exception) == MagickFalse)
+    return(quantum_info);
   status=SetQuantumDepth(image,quantum_info,image->depth);
   quantum_info->endian=image->endian;
   if (status == MagickFalse)
@@ -144,7 +147,7 @@ MagickExport QuantumInfo *AcquireQuantum
 %                                                                             %
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 %
-%  AcquireQuantumPixels() allocates the unsigned char structure.
+%  AcquireQuantumPixels() allocates the pixel staging area.
 %
 %  The format of the AcquireQuantumPixels method is:
 %
@@ -179,7 +182,12 @@ static MagickBooleanType AcquireQuantumP
     quantum_info->pixels[i]=(unsigned char *) AcquireQuantumMemory(extent+1,
       sizeof(**quantum_info->pixels));
     if (quantum_info->pixels[i] == (unsigned char *) NULL)
-      return(MagickFalse);
+      {
+        while (--i >= 0)
+          quantum_info->pixels[i]=(unsigned char *) RelinquishMagickMemory(
+            quantum_info->pixels[i]);
+        return(MagickFalse);
+      }
     (void) ResetMagickMemory(quantum_info->pixels[i],0,(extent+1)*
       sizeof(**quantum_info->pixels));
     quantum_info->pixels[i][extent]=QuantumSignature;