#487 NULL pointer dereference in ReadPALMImage

[bestshow]

Here is the critical code: (in ReadPALMImage )

    lastrow = MagickAllocateMemory(unsigned char *,Max(palm_header.bytes_per_row,2*image->columns)); //1156

  mask = (1l << palm_header.bits_per_pixel) - 1;

  for (y = 0; y < (long) image->rows; y++)
    {
      if (palm_header.flags & PALM_IS_COMPRESSED_FLAG)
        {

    ...
                           one_row[i + bit] = lastrow[i + bit]; //1204
                          }
                      }
                  }
                (void) memcpy(lastrow, one_row, palm_header.bytes_per_row); //1208

MagickAllocateMemory(...) may return NULL, so the following operations on the "lastrow" will Dereference Null pointer to cause memory error.

Credit : ADLab of Venustech

[Bob Friesenhahn]

This problem is fixed by Mercurial changeset 15193:b0b6aba92ed1. Thanks for the report!