Attachment 277501 Details for Bug 235071 – 151596: Fix for CVE-2007-1797 ImageMagick's DCM and XWD (RHEL-2.1)

[patch] 151596: Fix for CVE-2007-1797 ImageMagick's DCM and XWD (RHEL-2.1)

ImageMagick-5.3.8-cve-2007-1797.patch (text/plain), 2.03 KB, created by Lubomir Kundrak on 2007-12-05 00:39:28 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Lubomir Kundrak

Created: 2007-12-05 00:39:28 UTC

Size: 2.03 KB

patch

obsolete

>diff -urp ImageMagick-5.3.8.orig/coders/dcm.c ImageMagick-5.3.8/coders/dcm.c
>--- ImageMagick-5.3.8.orig/coders/dcm.c	2007-10-22 16:49:59.000000000 +0200
>+++ ImageMagick-5.3.8/coders/dcm.c	2007-12-05 01:21:57.000000000 +0100
>@@ -2912,6 +2912,8 @@ static Image *ReadDCMImage(const ImageIn
>           if ((quantum != 0) && (length > 0))
>             {
>               data=(unsigned char *) AcquireMemory(quantum*(length+1));
>+              if (length > ((~0UL)/quantum))
>+                ThrowReaderException(CorruptImageError,"ImproperImageHeader",image);
>               if (data == (unsigned char *) NULL)
>                 ThrowReaderException(ResourceLimitWarning,
>                   "Memory allocation failed",image);
>diff -urp ImageMagick-5.3.8.orig/coders/xwd.c ImageMagick-5.3.8/coders/xwd.c
>--- ImageMagick-5.3.8.orig/coders/xwd.c	2007-10-22 16:49:59.000000000 +0200
>+++ ImageMagick-5.3.8/coders/xwd.c	2007-12-05 01:25:15.000000000 +0100
>@@ -212,7 +212,9 @@ static Image *ReadXWDImage(const ImageIn
>     ThrowReaderException(CorruptImageWarning,"XWD header size is too small",
>       image);
>   length=header.header_size-sz_XWDheader;
>-  comment=(char *) AcquireMemory(length+1);
>+  if (length > ((~0UL)/sizeof(*comment)))
>+    ThrowReaderException(CorruptImageError,"ImproperImageHeader",image);
>+  comment=(char *) AcquireMemory((length+1)*sizeof(*comment));
>   if (comment == (char *) NULL)
>     ThrowReaderException(ResourceLimitWarning,"Memory allocation failed",image);
>   status=ReadBlob(image,length,comment);
>@@ -255,8 +257,10 @@ static Image *ReadXWDImage(const ImageIn
>       XWDColor
>         color;
> 
>-      colors=(XColor *)
>-        AcquireMemory((unsigned int) header.ncolors*sizeof(XColor));
>+      length=(size_t) header.ncolors;
>+      if (length > ((~0UL)/sizeof(*colors)))
>+        ThrowReaderException(CorruptImageError,"ImproperImageHeader",image);
>+      colors=(XColor *) AcquireMemory(length*sizeof(*colors));
>       if (colors == (XColor *) NULL)
>         ThrowReaderException(ResourceLimitWarning,"Memory allocation failed",
>           image);

Actions: View | Diff

Attachments on bug 235071: 151594 | 151595 | 151596 | 277491 | 277501