Access Violation when TIFF tag value cannot be allocated

[johnbuuck]

When TIFF tags are being read and the memory allocation for a tag's data fails, the tag's pointer is correctly set to 0 and the error is noted at that time. However, later in TIFFGetProfiles(), when such a tag is encountered, the 0 pointer is dereferenced, causing an access violation. Adding

Code: Select all

 && profile != (unsigned char*)NULL

to each

Code: Select all

if (TIFFGetField(tiff,TIFFTAG_...,&length,&profile) == 1

conditional in TIFFGetProfiles() avoids this access violation.

[magick]

We can reproduce the problem you posted and have a patch in ImageMagick 6.8.9-4 Beta, available by sometime tomorrow. Thanks.