Attachment 278181 Details for Bug 310081 – ImageMagick-5.5.6-CVE-2007-4988.patch

[patch] ImageMagick-5.5.6-CVE-2007-4988.patch

ImageMagick-5.5.6-CVE-2007-4988.patch (text/plain), 1.51 KB, created by Bastien Nocera on 2007-12-05 11:44:15 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Bastien Nocera

Created: 2007-12-05 11:44:15 UTC

Size: 1.51 KB

patch

obsolete

>--- ImageMagick-5.5.6/coders/dib.c.cve-2007-4988	2007-12-05 11:39:33.000000000 +0000
>+++ ImageMagick-5.5.6/coders/dib.c	2007-12-05 11:41:21.000000000 +0000
>@@ -424,6 +424,14 @@ static unsigned int IsDIB(const unsigned
> %
> %
> */
>+
>+static inline long MagickAbsoluteValue(const long x)
>+{
>+  if (x < 0)
>+    return(-x);
>+  return(x);
>+}
>+
> static Image *ReadDIBImage(const ImageInfo *image_info,ExceptionInfo *exception)
> {
>   DIBInfo
>@@ -505,7 +513,7 @@ static Image *ReadDIBImage(const ImageIn
>       dib_info.blue_mask=ReadBlobLSBShort(image);
>     }
>   image->matte=dib_info.bits_per_pixel == 32;
>-  image->columns=dib_info.width;
>+  image->columns=(unsigned long) MagickAbsoluteValue(dib_info.width);
>   image->rows=AbsoluteValue(dib_info.height);
>   image->depth=8;
>   if ((dib_info.number_colors != 0) || (dib_info.bits_per_pixel < 16))
>@@ -542,9 +550,12 @@ static Image *ReadDIBImage(const ImageIn
>       /*
>         Read DIB raster colormap.
>       */
>+      if ((4*image->colors) < image->colors)
>+        ThrowReaderException(CorruptImageError,"ImproperImageHeader");
>       if (!AllocateImageColormap(image,image->colors))
>         ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed",image);
>-      dib_colormap=(unsigned char *) AcquireMemory(4*image->colors);
>+      dib_colormap=(unsigned char *) AcquireMagickMemory(4*image->colors*
>+        sizeof(*dib_colormap));
>       if (dib_colormap == (unsigned char *) NULL)
>         ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed",image);
>       packet_size=4;

Actions: View | Diff

Attachments on bug 310081: 241681 | 241701 | 241711 | 278181