Attachment 241631 Details for Bug 310091 – backported patch from Jonathan Smith

backported patch from Jonathan Smith

ImageMagick-6.2.3-CVE-2007-4985.patch (text/x-patch), 1.40 KB, created by Mark J. Cox on 2007-10-29 11:27:22 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Mark J. Cox

Created: 2007-10-29 11:27:22 UTC

Size: 1.40 KB

patch

obsolete

>diff -r 6e2f7c2469aa coders/dcm.c
>--- a/coders/dcm.c	Fri Sep 28 03:02:20 2007 -0800
>+++ b/coders/dcm.c	Fri Sep 28 03:35:00 2007 -0800
>@@ -2899,12 +2899,10 @@ static Image *ReadDCMImage(const ImageIn
>         else
>           if ((quantum != 0) && (length != 0))
>             {
>-             /* new check for CVE-2007-1797 */
>-             if (length > ((~0UL)/quantum))
>-               ThrowReaderException(CorruptImageError,"ImproperImageHeader");
>-
>-              data=(unsigned char *)
>-                AcquireMagickMemory((size_t) quantum*(length+1));
>+              data=(unsigned char *) NULL;
>+              if (~length >= 1)
>+                data=(unsigned char *) AcquireQuantumMemory(length+1,quantum*
>+                  sizeof(*data));
>               if (data == (unsigned char *) NULL)
>                 ThrowReaderException(ResourceLimitError,
>                   "MemoryAllocationFailed");
>diff -r 6e2f7c2469aa coders/xcf.c
>--- a/coders/xcf.c	Fri Sep 28 03:02:20 2007 -0800
>+++ b/coders/xcf.c	Fri Sep 28 03:35:00 2007 -0800
>@@ -944,6 +944,11 @@ static Image *ReadXCFImage(const ImageIn
>     else
>       if ( image_type == GIMP_INDEXED )
>         ThrowReaderException(CoderError,"ColormapTypeNotSupported");
>+  if (SetImageExtent(image,0,0) == MagickFalse)
>+    {
>+      InheritException(exception,&image->exception);
>+      return(DestroyImageList(image));
>+    }
>   SetImageBackgroundColor(image);
>   /*
>     Read properties.

Actions: View

Attachments on bug 310091: 241631