CVE-2018-14434

An attacker can trigger this memory leak by supplying a crafted image file that causes `WriteMPCImage` to enter an error branch (e.g., an unsupported depth value) after the colormap has been allocated. Because the colormap pointer is not freed on the exception path, each such invocation leaks the colormap buffer. Repeated processing of malicious files can exhaust available memory, leading to a denial-of-service condition. No authentication or special network access is required if the attacker can submit images to an ImageMagick-based service.

The vulnerability is in `coders/mpc.c` at the colormap allocation block around line 1460. The function `WriteMPCImage` allocates a colormap via `AcquireQuantumMemory` inside an `if` block, but the allocated memory is only freed on the normal code path; the exception (error) branches that jump to the end of the function do not free the colormap [ref_id=1].

The issue report [ref_id=1] identifies that the colormap memory allocated by `AcquireQuantumMemory` in `WriteMPCImage` is freed in the normal branch but not in the exception (error) branches. The fix must ensure that the colormap pointer is freed before returning on every error path that occurs after allocation. No patch diff is included in the bundle, but the remediation is to add a `colormap` cleanup (e.g., `colormap=(unsigned char *) RelinquishMagickMemory(colormap);`) on each early-return path that follows the allocation.