Attachment 278221 Details for Bug 310121 – ImageMagick-5.5.6-CVE-2007-4986.patch

[patch] ImageMagick-5.5.6-CVE-2007-4986.patch

ImageMagick-5.5.6-CVE-2007-4986.patch (text/plain), 10.13 KB, created by Bastien Nocera on 2007-12-05 12:14:34 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Bastien Nocera

Created: 2007-12-05 12:14:34 UTC

Size: 10.13 KB

patch

obsolete

>diff -upr ImageMagick-5.5.6.orig/coders/dcm.c ImageMagick-5.5.6/coders/dcm.c
>--- ImageMagick-5.5.6.orig/coders/dcm.c	2007-12-05 11:55:26.000000000 +0000
>+++ ImageMagick-5.5.6/coders/dcm.c	2007-12-05 11:57:11.000000000 +0000
>@@ -3120,8 +3120,7 @@ static Image *ReadDCMImage(const ImageIn
>             */
>             colors=length/bytes_per_pixel;
>             datum=(long) colors;
>-            graymap=(unsigned short *)
>-              AcquireMemory(colors*sizeof(unsigned short));
>+            graymap=(unsigned short *) AcquireQuantumMemory((size_t) colors,sizeof(*graymap));
>             if (graymap == (unsigned short *) NULL)
>               ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed",
>                 image);
>@@ -3258,7 +3257,7 @@ static Image *ReadDCMImage(const ImageIn
>       /*
>         Compute pixel scaling table.
>       */
>-      scale=(Quantum *) AcquireMemory((max_value+1)*sizeof(Quantum));
>+      scale=(Quantum *) AcquireQuantumMemory(length,sizeof(*scale));
>       if (scale == (Quantum *) NULL)
>         ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed",image);
>       for (i=0; i <= (long) max_value; i++)
>diff -upr ImageMagick-5.5.6.orig/coders/dib.c ImageMagick-5.5.6/coders/dib.c
>--- ImageMagick-5.5.6.orig/coders/dib.c	2007-12-05 11:55:26.000000000 +0000
>+++ ImageMagick-5.5.6/coders/dib.c	2007-12-05 12:04:12.000000000 +0000
>@@ -554,8 +554,9 @@ static Image *ReadDIBImage(const ImageIn
>         ThrowReaderException(CorruptImageError,"ImproperImageHeader");
>       if (!AllocateImageColormap(image,image->colors))
>         ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed",image);
>-      dib_colormap=(unsigned char *) AcquireMagickMemory(4*image->colors*
>-        sizeof(*dib_colormap));
>+      length=(size_t) image->colors;
>+      dib_colormap=(unsigned char *) AcquireQuantumMemory(length,
>+        4*sizeof(*dib_colormap));
>       if (dib_colormap == (unsigned char *) NULL)
>         ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed",image);
>       packet_size=4;
>@@ -578,8 +579,8 @@ static Image *ReadDIBImage(const ImageIn
>     dib_info.bits_per_pixel<<=1;
>   bytes_per_line=4*((image->columns*dib_info.bits_per_pixel+31)/32);
>   length=bytes_per_line*image->rows;
>-  pixels=(unsigned char *)
>-    AcquireMemory(Max(bytes_per_line,image->columns+1)*image->rows);
>+  pixels=(unsigned char *) AcquireQuantumMemory((size_t) image->rows,
>+    MagickMax(bytes_per_line,image->columns+256)*sizeof(*pixels));
>   if (pixels == (unsigned char *) NULL)
>     ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed",image);
>   if ((dib_info.compression == 0) || (dib_info.compression == 3))
>@@ -1017,7 +1018,8 @@ static unsigned int WriteDIBImage(const 
>   /*
>     Convert MIFF to DIB raster pixels.
>   */
>-  pixels=(unsigned char *) AcquireMemory(dib_info.image_size);
>+  pixels=(unsigned char *) AcquireQuantumMemory(dib_info.image_size,
>+    sizeof(*pixels));
>   if (pixels == (unsigned char *) NULL)
>     ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed",image);
>   switch (dib_info.bits_per_pixel)
>@@ -1125,7 +1127,8 @@ static unsigned int WriteDIBImage(const 
>           Convert run-length encoded raster pixels.
>         */
>         length=2*(bytes_per_line+2)*(image->rows+2)+2;
>-        dib_data=(unsigned char *) AcquireMemory(length);
>+        dib_data=(unsigned char *) AcquireQuantumMemory(length,
>+          sizeof(*dib_data));
>         if (pixels == (unsigned char *) NULL)
>           {
>             LiberateMemory((void **) &pixels);
>@@ -1159,8 +1162,8 @@ static unsigned int WriteDIBImage(const 
>       /*
>         Dump colormap to file.
>       */
>-      dib_colormap=(unsigned char *)
>-        AcquireMemory(4*(1 << dib_info.bits_per_pixel));
>+      dib_colormap=(unsigned char *) AcquireQuantumMemory((size_t)
>+        (1UL << dib_info.bits_per_pixel),4*sizeof(dib_colormap));
>       if (dib_colormap == (unsigned char *) NULL)
>         ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed",image);
>       q=dib_colormap;
>diff -upr ImageMagick-5.5.6.orig/coders/xbm.c ImageMagick-5.5.6/coders/xbm.c
>--- ImageMagick-5.5.6.orig/coders/xbm.c	2003-01-05 03:55:30.000000000 +0000
>+++ ImageMagick-5.5.6/coders/xbm.c	2007-12-05 12:05:48.000000000 +0000
>@@ -197,6 +197,8 @@ static Image *ReadXBMImage(const ImageIn
>   short int
>     hex_digits[256];
> 
>+  size_t length;
>+
>   unsigned char
>     *data;
> 
>@@ -268,13 +270,6 @@ static Image *ReadXBMImage(const ImageIn
>   */
>   if (!AllocateImageColormap(image,image->colors))
>     ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed",image);
>-  padding=0;
>-  if ((image->columns % 16) && ((image->columns % 16) < 9)  && (version == 10))
>-    padding=1;
>-  bytes_per_line=(image->columns+7)/8+padding;
>-  data=(unsigned char *) AcquireMemory(bytes_per_line*image->rows);
>-  if (data == (unsigned char *) NULL)
>-    ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed",image);
>   /*
>     Initialize colormap.
>   */
>@@ -323,6 +318,16 @@ static Image *ReadXBMImage(const ImageIn
>   /*
>     Read hex image data.
>   */
>+  padding=0;
>+  if (((image->columns % 16) != 0) &&
>+      ((image->columns % 16) < 9) && (version == 10))
>+    padding=1;
>+  bytes_per_line=(image->columns+7)/8+padding;
>+  length=(size_t) image->rows;
>+  data=(unsigned char *) AcquireQuantumMemory(length,bytes_per_line*
>+    sizeof(*data));
>+  if (data == (unsigned char *) NULL)
>+    ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
>   p=data;
>   if (version == 10)
>     for (i=0; i < (long) (bytes_per_line*image->rows); (i+=2))
>diff -upr ImageMagick-5.5.6.orig/coders/xcf.c ImageMagick-5.5.6/coders/xcf.c
>--- ImageMagick-5.5.6.orig/coders/xcf.c	2007-12-05 11:55:26.000000000 +0000
>+++ ImageMagick-5.5.6/coders/xcf.c	2007-12-05 12:07:34.000000000 +0000
>@@ -312,7 +312,8 @@ static int load_tile (Image* image, Imag
>   XCFPixelPacket *xcfdata, *xcfodata;
>   unsigned char  *graydata;
> 
>-  xcfdata = xcfodata = (XCFPixelPacket *) AcquireMemory(data_length);
>+  xcfdata = xcfodata = (XCFPixelPacket *) AcquireQuantumMemory(data_length,
>+    sizeof(*xcfdata));
>   graydata = (unsigned char *)xcfdata;  /* used by gray and indexed */
>   nmemb_read_successfully = ReadBlob(image, data_length, xcfdata);
> 
>@@ -360,7 +361,8 @@ static int load_tile_rle (Image* image, 
> 
>   bpp = (int) inDocInfo->bpp;
>  
>-  xcfdata = xcfodata = (unsigned char *) AcquireMemory(data_length);
>+  xcfdata = xcfodata = (unsigned char *) AcquireQuantumMemory((size_t)
>+    data_length,sizeof(*xcfdata));
> 
>   nmemb_read_successfully = ReadBlob(image, data_length, xcfdata);
> 
>@@ -1155,7 +1157,9 @@ static Image *ReadXCFImage(const ImageIn
> 
> 
>     /* allocate our array of layer info blocks */
>-    layer_info=(XCFLayerInfo *)
>+    length=(size_t) number_layers;
>+    layer_info=(XCFLayerInfo *) AcquireQuantumMemory(length,
>+      sizeof(*layer_info));
>       AcquireMemory(number_layers*sizeof(XCFLayerInfo));
>     if (layer_info == (XCFLayerInfo *) NULL)
>       ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed",image);
>diff -upr ImageMagick-5.5.6.orig/coders/xwd.c ImageMagick-5.5.6/coders/xwd.c
>--- ImageMagick-5.5.6.orig/coders/xwd.c	2007-12-05 11:55:26.000000000 +0000
>+++ ImageMagick-5.5.6/coders/xwd.c	2007-12-05 12:10:46.000000000 +0000
>@@ -145,6 +145,9 @@ static unsigned int IsXWD(const unsigned
> */
> static Image *ReadXWDImage(const ImageInfo *image_info,ExceptionInfo *exception)
> {
>+#define CheckOverflowException(length,width,height) \
>+   (((height) != 0) && ((length)/((size_t) height) != ((size_t) width)))
>+
>   char
>     *comment;
> 
>@@ -227,7 +230,7 @@ static Image *ReadXWDImage(const ImageIn
>   length=header.header_size-sz_XWDheader;
>   if (length > ((~0UL)/sizeof(*comment)))
>     ThrowReaderException(CorruptImageError,"ImproperImageHeader",image);
>-  comment=(char *) AcquireMemory((length+1)*sizeof(*comment));
>+  comment=(char *) AcquireQuantumMemory(length+1,sizeof(*comment));
>   if (comment == (char *) NULL)
>     ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed",image);
>   count=ReadBlob(image,length,comment);
>@@ -273,7 +276,7 @@ static Image *ReadXWDImage(const ImageIn
>       length=(size_t) header.ncolors;
>       if (length > ((~0UL)/sizeof(*colors)))
>         ThrowReaderException(CorruptImageError,"ImproperImageHeader",image);
>-      colors=(XColor *) AcquireMemory(length*sizeof(*colors));
>+      colors=(XColor *) AcquireQuantumMemory(length,sizeof(*colors));
>       if (colors == (XColor *) NULL)
>         ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed",image);
>       for (i=0; i < (long) header.ncolors; i++)
>@@ -308,7 +311,7 @@ static Image *ReadXWDImage(const ImageIn
>     length=ximage->bytes_per_line*ximage->height;
>   else
>     length=ximage->bytes_per_line*ximage->height*ximage->depth;
>-  ximage->data=(char *) AcquireMemory(length);
>+  ximage->data=(char *) AcquireQuantumMemory(length,sizeof(*ximage->data));
>   if (ximage->data == (char *) NULL)
>     ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed",image);
>   count=ReadBlob(image,length,ximage->data);
>@@ -325,6 +328,11 @@ static Image *ReadXWDImage(const ImageIn
>     image->storage_class=DirectClass;
>   else
>     image->storage_class=PseudoClass;
>+  if (SetImageExtent(image,0,0) == MagickFalse)
>+    {
>+      InheritException(exception,&image->exception);
>+      return(DestroyImageList(image));
>+    }
>   image->colors=header.ncolors;
>   if (!image_info->ping)
>     switch (image->storage_class)
>@@ -673,7 +681,8 @@ static unsigned int WriteXWDImage(const 
>       /*
>         Dump colormap to file.
>       */
>-      colors=(XColor *) AcquireMemory(image->colors*sizeof(XColor));
>+      colors=(XColor *) AcquireQuantumMemory((size_t) image->colors,
>+        sizeof(*colors));
>       if (colors == (XColor *) NULL)
>         ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed",image);
>       for (i=0; i < (long) image->colors; i++)
>@@ -704,8 +713,7 @@ static unsigned int WriteXWDImage(const 
>   /*
>     Allocate memory for pixels.
>   */
>-  pixels=(unsigned char *)
>-    AcquireMemory(image->columns*sizeof(PixelPacket));
>+  pixels=(unsigned char *) AcquireQuantumMemory(length,sizeof(*pixels));
>   if (pixels == (unsigned char *) NULL)
>     ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed",image);
>   /*

Actions: View | Diff

Attachments on bug 310121: 241651 | 278221