File GraphicsMagick-CVE-2019-11506.patch of Package GraphicsMagick.openSUSE_Leap_42.3_Update

Index: GraphicsMagick-1.3.25/coders/mat.c
===================================================================
--- GraphicsMagick-1.3.25.orig/coders/mat.c	2019-04-30 07:56:03.342009217 +0200
+++ GraphicsMagick-1.3.25/coders/mat.c	2019-04-30 07:56:03.974012320 +0200
@@ -1302,11 +1302,11 @@ END_OF_READING:
 %    o image:  A pointer to an Image structure.
 %
 */
-static unsigned int WriteMATLABImage(const ImageInfo *image_info,Image *image)
+static MagickPassFail WriteMATLABImage(const ImageInfo *image_info,Image *image)
 {
   long y;
   unsigned z;
-  unsigned int status;
+  MagickPassFail status;
   int logging;
   unsigned long DataSize;
   char padding;
@@ -1329,7 +1329,7 @@ static unsigned int WriteMATLABImage(con
   assert(image->signature == MagickSignature);
   logging=LogMagickEvent(CoderEvent,GetMagickModule(),"enter MAT");
   status=OpenBlob(image_info,image,WriteBinaryBlobMode,&image->exception);
-  if (status == False)
+  if (status == MagickFail)
     ThrowWriterException(FileOpenError,UnableToOpenFile,image);
 
   /*
@@ -1403,26 +1403,32 @@ static unsigned int WriteMATLABImage(con
         for (y=0; y<(long)image->columns; y++)
         {
           progress_quantum++;
-          (void) AcquireImagePixels(image,y,0,1,image->rows,&image->exception);
-          (void) ExportImagePixelArea(image,z2qtype[z],8,pixels,0,0);
-          (void) WriteBlob(image,image->rows,pixels);
+          if (AcquireImagePixels(image,y,0,1,image->rows,&image->exception) == (PixelPacket *) NULL)
+            break;
+          if (ExportImagePixelArea(image,z2qtype[z],8,pixels,0,0) == MagickFail)
+            break;
+          if (WriteBlob(image,image->rows,pixels) != image->rows)
+            break;
           if (QuantumTick(progress_quantum,progress_span))
             if (!MagickMonitorFormatted(progress_quantum,progress_span,&image->exception,
                                         SaveImageText,image->filename,
                                         image->columns,image->rows))
-              goto BreakAll;
+              break;
         }
+        if (y != (long)image->columns)
+          {
+            status=MagickFail;
+            goto BreakAll;
+          }
+
       } while(z-- >= 2);
     }
 BreakAll:
 
     while(padding-->0) (void) WriteBlobByte(image,0);
 
-    status=True;
-
-    if(pixels)
-     {MagickFreeMemory(pixels);pixels=NULL;}
-    if(image->next==NULL) break;
+    MagickFreeMemory(pixels);
+    if(status == MagickFail || image->next==NULL) break;
     image=SyncNextImageInList(image);
   }