In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c.
cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*
E982CE9C-89F7-4A5D-B036-A9A483493D5B
6.9.10-25
cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*
2F7DF2A1-ADDE-48C4-BD39-CCA15D0D767A
7.0.8-25
7.0.0-0
OR
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
F1E78106-58E6-4D59-990F-75DA575BFAD9
OR
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
07B237A9-69A3-4A9C-9DA0-4E06BD37AE73
OR
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D
cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*
07C312A0-CD2C-4B9C-B064-6409B25C278F
cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*
CD783B0C-9246-47D9-A937-6144FE8BFF0F
OR
### Prerequisites

- [x] I have written a descriptive issue title
- [x] I have verified that I am using the latest version of ImageMagick
- [x] I have searched [open](https://github.com/ImageMagick/ImageMagick/issues) and [closed](https://github.com/ImageMagick/ImageMagick/issues?q=is%3Aissue+is%3Aclosed) issues to ensure it has not already been reported

### Description
<!-- A description of the bug or feature -->
memory leak in WriteDIBImage in coders/dib.c
### Steps to Reproduce
<!-- List of steps, sample code, failing test or link to a project that reproduces the behavior.
     Make sure you place a stack trace inside a code (```) block to avoid linking unrelated issues -->
The critical code snippets are:
https://github.com/ImageMagick/ImageMagick/blob/master/coders/dib.c#L1330
```c
if (dib_info.bits_per_pixel == 8)       //line 1330
    if (image_info->compression != NoCompression)     //line 1331
      {
        size_t
          length;

        /*
          Convert run-length encoded raster pixels.
        */
        length=2UL*(bytes_per_line+2UL)+2UL;
        dib_data=(unsigned char *) AcquireQuantumMemory(length,     // line 1340
          (image->rows+2UL)*sizeof(*dib_data));
        if (dib_data == (unsigned char *) NULL)
          {
            pixels=(unsigned char *) RelinquishMagickMemory(pixels);
            ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
          }
        dib_info.image_size=(unsigned int) EncodeImage(image,bytes_per_line,
          pixels,dib_data);
        pixels=(unsigned char *) RelinquishMagickMemory(pixels);
        pixels=dib_data;                                 // line 1350
        dib_info.compression = BI_RLE8;
      }
```
and
https://github.com/ImageMagick/ImageMagick/blob/master/coders/dib.c#L1367
```c
if (image->storage_class == PseudoClass)     //line 1367
    {
      if (dib_info.bits_per_pixel <= 8)              //line 1369
        {
          unsigned char
            *dib_colormap;

          /*
            Dump colormap to file.
          */
          dib_colormap=(unsigned char *) AcquireQuantumMemory((size_t)
            (1UL << dib_info.bits_per_pixel),4*sizeof(*dib_colormap));
          if (dib_colormap == (unsigned char *) NULL)     // line 1379
            ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");      // line 1380
          q=dib_colormap;
```
According to the code in function WriteDIBImage before line 1330, when **image->storage_class** is not **DirectClass** (i.e. storage class is **PseudoClass**) and **image_info->depth<=8**, **dib_info.bits_per_pixel** can be equal to **8** (at line 1151-1155), as a result, **dib_info.compression** will be BI_RGB (at line 1164-1165). **So the 4 conditions at line 1330, 1331, 1367 and 1369 can be satisfied at the same time in some setting.**

When the 4 conditions are satisfied and **dib_data** is successfully allocated at line **1340**, **dib_data** will be assigned to **pixels** at line **1350**. However, when the allocation at line **1377** fails, the function don't free **dib_data** memory as done at line **1410** before returning with exception at line **1378**. As a result, a memory leak will happen. 

The size of leaked memory is 4*((image->columns*dib_info.bits_per_pixel+31)/32)*(image->rows+2UL)*sizeof(*dib_data)  = (image->columns + 4) * (image->rows + 2) * sizeof(*dib_data), which may be a large value. (ps. dib_info.bits_per_pixel is 8)

Patch Suggestion:
```c
          dib_colormap=(unsigned char *) AcquireQuantumMemory((size_t)  // line 1377
            (1UL << dib_info.bits_per_pixel),4*sizeof(*dib_colormap));
          if (dib_colormap == (unsigned char *) NULL)
          {
            pixels=(unsigned char *) RelinquishMagickMemory(pixels);
            ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
          }
          q=dib_colormap;
```
### System Configuration
<!-- Tell us about the environment where you are experiencing the bug -->

- ImageMagick version: ImageMagick-4f0ea40e2a090e245f31d1f05247520d6e7eb4ca
- Environment (Operating system, version and so on): Ubuntu 16.04
- Additional information:

<!-- Thanks for reporting the issue to ImageMagick! -->
Credit to Bingchang Liu at VARAS of IIE
Potential Memory Leak in WriteDIBImage in coders/dib.c
This is a GitHub Issue
repo:ImageMagick
owner:ImageMagick
Title : Potential Memory Leak in WriteDIBImage in coders/dib.c
Issue date:

--- start body ---
### Prerequisites

- [x] I have written a descriptive issue title
- [x] I have verified that I am using the latest version of ImageMagick
- [x] I have searched [open](https://github.com/ImageMagick/ImageMagick/issues) and [closed](https://github.com/ImageMagick/ImageMagick/issues?q=is%3Aissue+is%3Aclosed) issues to ensure it has not already been reported

### Description
<!-- A description of the bug or feature -->
memory leak in WriteDIBImage in coders/dib.c
### Steps to Reproduce
<!-- List of steps, sample code, failing test or link to a project that reproduces the behavior.
     Make sure you place a stack trace inside a code (```) block to avoid linking unrelated issues -->
The critical code snippets are:
https://github.com/ImageMagick/ImageMagick/blob/master/coders/dib.c#L1330
```c
if (dib_info.bits_per_pixel == 8)       //line 1330
    if (image_info->compression != NoCompression)     //line 1331
      {
        size_t
          length;

        /*
          Convert run-length encoded raster pixels.
        */
        length=2UL*(bytes_per_line+2UL)+2UL;
        dib_data=(unsigned char *) AcquireQuantumMemory(length,     // line 1340
          (image->rows+2UL)*sizeof(*dib_data));
        if (dib_data == (unsigned char *) NULL)
          {
            pixels=(unsigned char *) RelinquishMagickMemory(pixels);
            ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
          }
        dib_info.image_size=(unsigned int) EncodeImage(image,bytes_per_line,
          pixels,dib_data);
        pixels=(unsigned char *) RelinquishMagickMemory(pixels);
        pixels=dib_data;                                 // line 1350
        dib_info.compression = BI_RLE8;
      }
```
and
https://github.com/ImageMagick/ImageMagick/blob/master/coders/dib.c#L1367
```c
if (image->storage_class == PseudoClass)     //line 1367
    {
      if (dib_info.bits_per_pixel <= 8)              //line 1369
        {
          unsigned char
            *dib_colormap;

          /*
            Dump colormap to file.
          */
          dib_colormap=(unsigned char *) AcquireQuantumMemory((size_t)
            (1UL << dib_info.bits_per_pixel),4*sizeof(*dib_colormap));
          if (dib_colormap == (unsigned char *) NULL)     // line 1379
            ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");      // line 1380
          q=dib_colormap;
```
According to the code in function WriteDIBImage before line 1330, when **image->storage_class** is not **DirectClass** (i.e. storage class is **PseudoClass**) and **image_info->depth<=8**, **dib_info.bits_per_pixel** can be equal to **8** (at line 1151-1155), as a result, **dib_info.compression** will be BI_RGB (at line 1164-1165). **So the 4 conditions at line 1330, 1331, 1367 and 1369 can be satisfied at the same time in some setting.**

When the 4 conditions are satisfied and **dib_data** is successfully allocated at line **1340**, **dib_data** will be assigned to **pixels** at line **1350**. However, when the allocation at line **1377** fails, the function don't free **dib_data** memory as done at line **1410** before returning with exception at line **1378**. As a result, a memory leak will happen. 

The size of leaked memory is 4*((image->columns*dib_info.bits_per_pixel+31)/32)*(image->rows+2UL)*sizeof(*dib_data)  = (image->columns + 4) * (image->rows + 2) * sizeof(*dib_data), which may be a large value. (ps. dib_info.bits_per_pixel is 8)

Patch Suggestion:
```c
          dib_colormap=(unsigned char *) AcquireQuantumMemory((size_t)  // line 1377
            (1UL << dib_info.bits_per_pixel),4*sizeof(*dib_colormap));
          if (dib_colormap == (unsigned char *) NULL)
          {
            pixels=(unsigned char *) RelinquishMagickMemory(pixels);
            ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
          }
          q=dib_colormap;
```
### System Configuration
<!-- Tell us about the environment where you are experiencing the bug -->

- ImageMagick version: ImageMagick-4f0ea40e2a090e245f31d1f05247520d6e7eb4ca
- Environment (Operating system, version and so on): Ubuntu 16.04
- Additional information:

<!-- Thanks for reporting the issue to ImageMagick! -->
Credit to Bingchang Liu at VARAS of IIE
--- end body ---

comments :
--- start comments ---

--- end comments ---