Attachment 574539 Details for Bug 807993 – Proposed patch

[patch] Proposed patch

ImageMagick-6.5.4-cve-2012-0259.patch (text/plain), 3.48 KB, created by Olivier Fourdan on 2012-04-02 15:23:09 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Olivier Fourdan

Created: 2012-04-02 15:23:09 UTC

Size: 3.48 KB

patch

obsolete

>diff -up ImageMagick-6.5.4-7/coders/jpeg.c.cve-2012-0259 ImageMagick-6.5.4-7/coders/jpeg.c
>--- ImageMagick-6.5.4-7/coders/jpeg.c.cve-2012-0259	2012-04-02 13:26:48.000000000 +0200
>+++ ImageMagick-6.5.4-7/coders/jpeg.c	2012-04-02 13:47:58.000000000 +0200
>@@ -140,6 +140,9 @@ typedef struct _SourceManager
> static MagickBooleanType
>   WriteJPEGImage(const ImageInfo *,Image *);
> #endif
>+static void 
>+  JPEGErrorHandler(j_common_ptr);
>+
> 
> /*
> %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
>@@ -206,6 +209,8 @@ static MagickBooleanType IsJPEG(const un
> 
> static MagickBooleanType EmitMessage(j_common_ptr jpeg_info,int level)
> {
>+  #define JPEGExcessiveWarnings  1000
>+
>   char
>     message[JMSG_LENGTH_MAX];
> 
>@@ -220,11 +225,12 @@ static MagickBooleanType EmitMessage(j_c
>   image=error_manager->image;
>   if (level < 0)
>     {
>+      if (jpeg_info->err->num_warnings++ > JPEGExcessiveWarnings)
>+        JPEGErrorHandler(jpeg_info);
>       if ((jpeg_info->err->num_warnings == 0) ||
>           (jpeg_info->err->trace_level >= 3))
>         ThrowBinaryException(CorruptImageWarning,(char *) message,
>           image->filename);
>-      jpeg_info->err->num_warnings++;
>     }
>   else
>     if (jpeg_info->err->trace_level >= level)
>diff -up ImageMagick-6.5.4-7/coders/tiff.c.cve-2012-0259 ImageMagick-6.5.4-7/coders/tiff.c
>--- ImageMagick-6.5.4-7/coders/tiff.c.cve-2012-0259	2012-04-02 13:38:12.000000000 +0200
>+++ ImageMagick-6.5.4-7/coders/tiff.c	2012-04-02 13:40:57.000000000 +0200
>@@ -435,7 +435,7 @@ static void TIFFGetEXIFProperties(TIFF *
>           *ascii;
> 
>         if (TIFFGetField(tiff,exif_info[i].tag,&ascii) != 0)
>-          (void) CopyMagickMemory(value,ascii,MaxTextExtent);
>+          (void) CopyMagickString(value,ascii,MaxTextExtent);
>         break;
>       }
>       case TIFF_SHORT:
>diff -up ImageMagick-6.5.4-7/magick/property.c.cve-2012-0259 ImageMagick-6.5.4-7/magick/property.c
>--- ImageMagick-6.5.4-7/magick/property.c.cve-2012-0259	2012-04-02 13:25:21.000000000 +0200
>+++ ImageMagick-6.5.4-7/magick/property.c	2012-04-02 17:08:33.000000000 +0200
>@@ -771,14 +771,18 @@ static MagickBooleanType GetEXIFProperty
>  \
>    length=0; \
>    p1=p; \
>+   printf("In EXIFMulFra, prior to for loop - p: %x p1: %x, components: %d\n", p, p1, components); \ 
>    for (component=0; component < components; component++) \
>    { \
>+     printf("In EXIFMulFra, start of for loop iteration - component: %d, components: %d length: %d, size: %d\n", component, components, length, size); \
>      length+=FormatMagickString(buffer+length,MaxTextExtent-length, \
>        format", ",arg1, arg2); \
>      if (length >= MaxTextExtent - 1) \
>        length=MaxTextExtent-1; \
>      p1+=size; \
>+     printf("In EXIFMulFra, end of for loop iteration - p1: %x length: %d size: %d\n", p1, length, size); \
>    } \
>+   printf("In EXIFMulFra, after for loop\n"); \
>    if (length > 1) \
>      buffer[length-2]='\0'; \
>    value=AcquireString(buffer); \
>@@ -1294,6 +1298,8 @@ static MagickBooleanType GetEXIFProperty
>         break;
>       components=(long) ((int) ReadPropertyLong(endian,q+4));
>       number_bytes=(size_t) components*tag_bytes[format];
>+      if (number_bytes < components)
>+        break;  /* prevent overflow */
>       if (number_bytes <= 4)
>         p=q+8;
>       else
>@@ -1317,6 +1323,8 @@ static MagickBooleanType GetEXIFProperty
>             buffer[MaxTextExtent],
>             *value;
> 
>+          value=(char *) NULL;
>+          *buffer='\0';
>           switch (format)
>           {
>             case EXIF_FMT_BYTE:

Actions: View | Diff

Attachments on bug 807993: 574539 | 574809