Attachment 151596 Details for Bug 235071 – Fix for CVE-2007-1797 ImageMagick's DCM and XWD (RHEL-2.1)

[patch] Fix for CVE-2007-1797 ImageMagick's DCM and XWD (RHEL-2.1)

CVE-2007-1797-RHEL2.1.patch (text/plain), 1.89 KB, created by Lubomir Kundrak on 2007-04-03 18:08:24 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Lubomir Kundrak

Created: 2007-04-03 18:08:24 UTC

Size: 1.89 KB

patch

obsolete

>Fix for CVE-2007-1797 (possible heap overflows in ImageMagick
>DCM and XWD coders) backported from SVN. -- lkundrak@redhat.com
>
>Applies against:
>	RHEL2.1 (5.3.8-18)
>
>--- coders/dcm.c.orig	2007-04-03 19:54:21.000000000 +0200
>+++ coders/dcm.c	2007-04-03 19:55:09.000000000 +0200
>@@ -2912,6 +2912,8 @@ static Image *ReadDCMImage(const ImageIn
>           if ((quantum != 0) && (length > 0))
>             {
>               data=(unsigned char *) AcquireMemory(quantum*(length+1));
>+              if (length > ((~0UL)/quantum))
>+                ThrowReaderException(CorruptImageError,"ImproperImageHeader");
>               if (data == (unsigned char *) NULL)
>                 ThrowReaderException(ResourceLimitWarning,
>                   "Memory allocation failed",image);
>--- coders/xwd.c.orig	2007-04-03 19:54:21.000000000 +0200
>+++ coders/xwd.c	2007-04-03 19:56:49.000000000 +0200
>@@ -213,6 +213,9 @@ static Image *ReadXWDImage(const ImageIn
>       image);
>   length=header.header_size-sz_XWDheader;
>   comment=(char *) AcquireMemory(length+1);
>+  if (length > ((~0UL)/sizeof(*comment)))
>+    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
>+  comment=(char *) AcquireMagickMemory((length+1)*sizeof(*comment));
>   if (comment == (char *) NULL)
>     ThrowReaderException(ResourceLimitWarning,"Memory allocation failed",image);
>   status=ReadBlob(image,length,comment);
>@@ -255,8 +258,10 @@ static Image *ReadXWDImage(const ImageIn
>       XWDColor
>         color;
> 
>-      colors=(XColor *)
>-        AcquireMemory((unsigned int) header.ncolors*sizeof(XColor));
>+      length=(size_t) header.ncolors;
>+      if (length > ((~0UL)/sizeof(*colors)))
>+        ThrowReaderException(CorruptImageError,"ImproperImageHeader");
>+      colors=(XColor *) AcquireMagickMemory(length*sizeof(*colors));
>       if (colors == (XColor *) NULL)
>         ThrowReaderException(ResourceLimitWarning,"Memory allocation failed",
>           image);

Actions: View | Diff

Attachments on bug 235071: 151594 | 151595 | 151596 | 277491 | 277501