Memory leak in BlobToImage

[kiryushinm]

Hi!

I'm using IM 6.9.2-6 on Linux for convertion images to png format.
I've got a problem with very specific type of image - multisize ICO (for example livejournal.com/favicon.ico)

The convertion works fine on them but it seems like there is a memory leak. I prepared very simple code which illustrates this case:

Code: Select all

int main(int, const char *argv[]) {
    ifstream fin(argv[1], ios::binary);
    ostringstream ostrm;
    ostrm << fin.rdbuf();
    string from(ostrm.str());
    
    while (true) {
        _ImageInfo* imageInfoPtr(CloneImageInfo(0));
        strcpy(imageInfoPtr->magick, "ICO");
       
        ExceptionInfo* _exception = AcquireExceptionInfo();
        _Image *imagePtr = BlobToImage(imageInfoPtr, from.c_str(), from.length(), _exception);
        DestroyImage(imagePtr);
        DestroyImageInfo(imageInfoPtr);
        DestroyExceptionInfo(_exception);
    }

Infinite loop here causes a huge memory consumption on multisize ICO file. But if I try any other image format it works fine.

[kiryushinm]

The problem is in coders/icon.c, ReadICONImage function
There is a loop iterating through all images in ico file. After each iteration it allocates memory for the next one. But it seems like this memory stays allocated.

[kiryushinm]

Got it.

I should've used DestroyImageList instead of DestroyImage

[dlemstra]

Feel free to submit a pull requests here: https://github.com/ImageMagick/ImageMagick. We can also do the patch if you prefer that.