ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadBMPImage in coders/bmp.c.
cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*
F8AB2B06-598F-4F38-813C-B1E3E1E7EEE5
7.0.8-50
7.0.0-0
OR
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
F1E78106-58E6-4D59-990F-75DA575BFAD9
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
B620311B-34A3-48A6-82DF-6F078D7A4493
OR
### Prerequisites

- [ Y ] I have written a descriptive issue title
- [ Y ] I have verified that I am using the latest version of ImageMagick
- [ Y ] I have searched [open](https://github.com/ImageMagick/ImageMagick/issues) and [closed](https://github.com/ImageMagick/ImageMagick/issues?q=is%3Aissue+is%3Aclosed) issues to ensure it has not already been reported

### Description
<!-- A description of the bug or feature -->
There are two memory leak issues in ReadBMPImage in coder/bmp.c and ReadVIFFImage in coder/viff.c.

There is a patch https://github.com/ImageMagick/ImageMagick/commit/3b48d20df53ad048af05107aa1850c344466b082, which fixed multiple memory leak vulnerabilities.

However, the patch for ReadBMPImage is wrong.

```
        if (GetNextImageInList(image) == (Image *) NULL)
          {
-            image=DestroyImageList(image);
+            status=MagickFalse;
            return((Image *) NULL);
          }
```

Below is the correct logic.

```
        if (GetNextImageInList(image) == (Image *) NULL)
          {
-            image=DestroyImageList(image);
-            return((Image *) NULL);
+            status=MagickFalse;
+            break;
          }
```
https://github.com/ImageMagick/ImageMagick/blob/master/coders/bmp.c#L1508

At the same time, there is the same issue in ReadVIFFImage.

```
        if (GetNextImageInList(image) == (Image *) NULL)
          {
            image=DestroyImageList(image);
            return((Image *) NULL);
           }
```
https://github.com/ImageMagick/ImageMagick/blob/master/coders/viff.c#L774

### Steps to Reproduce
<!-- List of steps, sample code, failing test or link to a project that reproduces the behavior.
     Make sure you place a stack trace inside a code (```) block to avoid linking unrelated issues -->

### System Configuration
<!-- Tell us about the environment where you are experiencing the bug -->

- ImageMagick version:
- Environment (Operating system, version and so on):
- Additional information:

<!-- Thanks for reporting the issue to ImageMagick! -->

Memory leak in ReadBMPImage in coder/bmp.c and ReadVIFFImage in coder/viff.c.
This is a GitHub Issue
repo:ImageMagick
owner:ImageMagick
Title : Memory leak in ReadBMPImage in coder/bmp.c and ReadVIFFImage in coder/viff.c.
Issue date:

--- start body ---
### Prerequisites

- [ Y ] I have written a descriptive issue title
- [ Y ] I have verified that I am using the latest version of ImageMagick
- [ Y ] I have searched [open](https://github.com/ImageMagick/ImageMagick/issues) and [closed](https://github.com/ImageMagick/ImageMagick/issues?q=is%3Aissue+is%3Aclosed) issues to ensure it has not already been reported

### Description
<!-- A description of the bug or feature -->
There are two memory leak issues in ReadBMPImage in coder/bmp.c and ReadVIFFImage in coder/viff.c.

There is a patch https://github.com/ImageMagick/ImageMagick/commit/3b48d20df53ad048af05107aa1850c344466b082, which fixed multiple memory leak vulnerabilities.

However, the patch for ReadBMPImage is wrong.

```
        if (GetNextImageInList(image) == (Image *) NULL)
          {
-            image=DestroyImageList(image);
+            status=MagickFalse;
            return((Image *) NULL);
          }
```

Below is the correct logic.

```
        if (GetNextImageInList(image) == (Image *) NULL)
          {
-            image=DestroyImageList(image);
-            return((Image *) NULL);
+            status=MagickFalse;
+            break;
          }
```
https://github.com/ImageMagick/ImageMagick/blob/master/coders/bmp.c#L1508

At the same time, there is the same issue in ReadVIFFImage.

```
        if (GetNextImageInList(image) == (Image *) NULL)
          {
            image=DestroyImageList(image);
            return((Image *) NULL);
           }
```
https://github.com/ImageMagick/ImageMagick/blob/master/coders/viff.c#L774

### Steps to Reproduce
<!-- List of steps, sample code, failing test or link to a project that reproduces the behavior.
     Make sure you place a stack trace inside a code (```) block to avoid linking unrelated issues -->

### System Configuration
<!-- Tell us about the environment where you are experiencing the bug -->

- ImageMagick version:
- Environment (Operating system, version and so on):
- Additional information:

<!-- Thanks for reporting the issue to ImageMagick! -->

--- end body ---

comments :
--- start comments ---

--- end comments ---