#486 NULL pointer dereference in Magick::Options::strokeDashArray

[bestshow]

Here is the critical code: (in Magick::Options::strokeDashArray )

void Magick::Options::strokeDashArray ( const double* strokeDashArray_ )
{
  MagickFreeMemory(_drawInfo->dash_pattern);

  if(strokeDashArray_)
    {
      // Count elements in dash array
      unsigned int x;
      for (x=0; strokeDashArray_[x]; x++) {};
      // Allocate elements
      _drawInfo->dash_pattern = MagickAllocateMemory(double*,(x+1)*sizeof(double)); //509
      // Copy elements
      memcpy(_drawInfo->dash_pattern,strokeDashArray_,
             (x+1)*sizeof(double));
    }
}

MagickAllocateMemory(...) may return NULL, so the following operations on the "_drawInfo->dash_pattern" will Dereference Null pointer to cause memory error.

Credit : ADLab of Venustech

[Bob Friesenhahn]

This problem is fixed by Mercurial changeset 15192:472bf9f2771f. Thanks for the report!