File GraphicsMagick-CVE-2019-11007.patch of Package GraphicsMagick.10463

Index: GraphicsMagick-1.3.29/coders/png.c
===================================================================
--- GraphicsMagick-1.3.29.orig/coders/png.c	2018-04-29 20:01:26.000000000 +0200
+++ GraphicsMagick-1.3.29/coders/png.c	2019-04-15 16:34:31.494366006 +0200
@@ -504,6 +504,44 @@ static const char* PngColorTypeToString(
   return result;
 }
 #endif /* HasPNG */
+static MagickPassFail ReallocateImageColormap(Image *image,
+  const unsigned int colors)
+{
+  register unsigned int
+    i;
+
+  unsigned int
+    prev_colors;
+
+  size_t
+    length;
+
+  /*
+    Allocate image colormap.
+  */
+  assert(image != (Image *) NULL);
+  assert(image->signature == MagickSignature);
+  if (colors > MaxColormapSize)
+    return (MagickFail);
+  prev_colors=image->colors;
+  length=MagickArraySize((size_t) colors,sizeof(PixelPacket));
+  MagickReallocMemory(PixelPacket *,image->colormap,length);
+  if (image->colormap == (PixelPacket *) NULL)
+    {
+      image->colors=0;
+      return(MagickFail);
+    }
+  image->colors=colors;
+  for (i=prev_colors; i < image->colors; i++)
+  {
+    image->colormap[i].red=0;
+    image->colormap[i].green=0;
+    image->colormap[i].blue=0;
+    image->colormap[i].opacity=OpaqueOpacity;
+  }
+  return(MagickPass);
+}
+
 
 /*
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
@@ -2595,7 +2633,11 @@ static Image *ReadOnePNGImage(MngInfo *m
       png_destroy_read_struct(&ping,&ping_info,&end_info);
       MagickFreeMemory(mng_info->quantum_scanline);
       MagickFreeMemory(mng_info->png_pixels);
-      image->colors=2;
+      if (ReallocateImageColormap(image,2) == MagickFail)
+        {
+          ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,
+                               image);
+        }
       (void) SetImage(image,TransparentOpacity);
 #if defined(GMPNG_SETJMP_NOT_THREAD_SAFE)
       UnlockSemaphoreInfo(png_semaphore);
@@ -5893,7 +5935,11 @@ static Image *ReadMNGImage(const ImageIn
                   */
                   image->columns=1;
                   image->rows=1;
-                  image->colors=2;
+                  if (ReallocateImageColormap(image,2) == MagickFail)
+                    {
+                      ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,
+                                           image);
+                    }
                   (void) SetImage(image,TransparentOpacity);
                   image->page.width=1;
                   image->page.height=1;