Bugs in the WMF coders

[mootools]

Hello,

There is a bug in the WMF parser. Look at line 2749 in function

Code: Select all

static Image *ReadWMFImage(const ImageInfo * image_info, ExceptionInfo * exception)

Code: Select all

  /* Cleanup allocated data */
  wmf_api_destroy(API);
  CloseBlob(image);

  /* Check for and report any rendering error */
  if (image->exception.severity != UndefinedException)
    (void) ThrowMagickException(exception,GetMagickModule(),CoderWarning,
      ddata->image->exception.reason,"`%s'",ddata->image->exception.description);

the ddata has been released just above in the wmf_api_destroy(API) call.
So when an exception should occurs ddata is invalid and the application crash.

I am using ImageMagick 6.3.6. I check the latest wmf.c source and the bug is still here.

Moreover the following WMF files are not correctly handled:

http://www.mootools.com/tmp/error.wmf
http://www.mootools.com/tmp/error2.wmf

The first file generates an exception and crash imagemagick.
The second file is incorrectly displayed. In a previous version of ImageMagick it was correctly handled.

Thanks for your help,
Manuel Jouglet
Mootools

[magick]

Thanks for the bug report. We have a patch in ImageMagick 6.3.7-10 Beta for the problem you reported available sometime tomorrow.