#475 NULL pointer dereference in ReadEnhMetaFile

[bestshow]

Here is the critical code: (in ReadEnhMetaFile)

pBits=MagickAllocateMemory(LPBYTE,dwSize); //190
  ReadFile(hFile,pBits,dwSize,&dwSize,NULL);
  CloseHandle(hFile);
  if (((PAPMHEADER) pBits)->dwKey != 0x9ac6cdd7l)
    {
      MagickFreeMemory(pBits);
      return((HENHMETAFILE) NULL);
    }

MagickAllocateMemory(...) may return NULL, so the following operations on the "pBits" will Dereference Null pointer to cause memory error.

Credit : ADLab of Venustech

[Bob Friesenhahn]

This problem is fixed by Mercurial changeset 15183:ea074081678b. Thanks for the report!