# HG changeset patch
# User Bob Friesenhahn <bfriesen@GraphicsMagick.org>
# Date 1734634653 21600
#      Thu Dec 19 12:57:33 2024 -0600
# Node ID 883ebf8cae6dfa5873d975fe3476b1a188ef3f9f
# Parent  cf7cd5ebabb0ca40204de7539f4fb9ae02121958
ReadWPGImage(): Assure that palette buffer is allocated and the current size.

CVE: CVE-2025-27796
Upstream: https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/883ebf8cae6dfa5873d975fe3476b1a188ef3f9f
[thomas: remove changelog and binary]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>

diff --git a/coders/wpg.c b/coders/wpg.c
--- a/coders/wpg.c
+++ b/coders/wpg.c
@@ -1704,28 +1704,23 @@
                 ThrowReaderException(CorruptImageError,InvalidColormapIndex,image);
               }
 
-              if(pPalette!=NULL &&
-                 PaletteAllocBytes < 4*(WPG_Palette.StartIndex+WPG_Palette.NumOfEntries))
-              {
-                MagickFreeResourceLimitedMemory(pPalette);
-                PaletteAllocBytes = 0;
-              }
+              /* Assure that buffer is allocated and the current size */
+              if (PaletteAllocBytes != Max(4*(WPG_Palette.StartIndex+WPG_Palette.NumOfEntries),4*256))
+                {
+                  PaletteAllocBytes = Max(4*(WPG_Palette.StartIndex+WPG_Palette.NumOfEntries),4*256);
+                  MagickReallocateResourceLimitedMemory(unsigned char *,pPalette,PaletteAllocBytes);
+                }
               if(pPalette==NULL)
-              {
-                PaletteItems = WPG_Palette.NumOfEntries;
-                PaletteAllocBytes = 4*(WPG_Palette.StartIndex+WPG_Palette.NumOfEntries);
-                if(PaletteAllocBytes < 4*256) PaletteAllocBytes = 4*256;
-                pPalette = MagickAllocateResourceLimitedMemory(unsigned char *,(size_t)PaletteAllocBytes);
-                if(pPalette==NULL)
-                    ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,image);
-                for(i=0; i<=255; i++)
+                ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,image);
+
+              PaletteItems = WPG_Palette.NumOfEntries;
+              for(i=0; i<=255; i++)
                 {
                   pPalette[4*i] = WPG1_Palette[i].Red;
                   pPalette[4*i+1] = WPG1_Palette[i].Green;
                   pPalette[4*i+2] = WPG1_Palette[i].Blue;
                   pPalette[4*i+3] = OpaqueOpacity;
                 }
-              }
               if(ReadBlob(image,(size_t) PaletteItems*4,pPalette+((size_t)4*WPG_Palette.StartIndex)) != (size_t) PaletteItems*4)
               {
                 MagickFreeResourceLimitedMemory(pPalette);