Attachment 574809 Details for Bug 807993 – Updated (clean up) patch

[patch] Updated (clean up) patch

ImageMagick-6.5.4-cve-2012-0259.patch (text/plain), 2.63 KB, created by Olivier Fourdan on 2012-04-03 09:57:25 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Olivier Fourdan

Created: 2012-04-03 09:57:25 UTC

Size: 2.63 KB

patch

obsolete

>diff -up ImageMagick-6.5.4-7/coders/jpeg.c.cve-2012-0259 ImageMagick-6.5.4-7/coders/jpeg.c
>--- ImageMagick-6.5.4-7/coders/jpeg.c.cve-2012-0259	2012-04-02 13:26:48.000000000 +0200
>+++ ImageMagick-6.5.4-7/coders/jpeg.c	2012-04-02 13:47:58.000000000 +0200
>@@ -140,6 +140,9 @@ typedef struct _SourceManager
> static MagickBooleanType
>   WriteJPEGImage(const ImageInfo *,Image *);
> #endif
>+static void 
>+  JPEGErrorHandler(j_common_ptr);
>+
> 
> /*
> %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
>@@ -206,6 +209,8 @@ static MagickBooleanType IsJPEG(const un
> 
> static MagickBooleanType EmitMessage(j_common_ptr jpeg_info,int level)
> {
>+  #define JPEGExcessiveWarnings  1000
>+
>   char
>     message[JMSG_LENGTH_MAX];
> 
>@@ -220,11 +225,12 @@ static MagickBooleanType EmitMessage(j_c
>   image=error_manager->image;
>   if (level < 0)
>     {
>+      if (jpeg_info->err->num_warnings++ > JPEGExcessiveWarnings)
>+        JPEGErrorHandler(jpeg_info);
>       if ((jpeg_info->err->num_warnings == 0) ||
>           (jpeg_info->err->trace_level >= 3))
>         ThrowBinaryException(CorruptImageWarning,(char *) message,
>           image->filename);
>-      jpeg_info->err->num_warnings++;
>     }
>   else
>     if (jpeg_info->err->trace_level >= level)
>diff -up ImageMagick-6.5.4-7/coders/tiff.c.cve-2012-0259 ImageMagick-6.5.4-7/coders/tiff.c
>--- ImageMagick-6.5.4-7/coders/tiff.c.cve-2012-0259	2012-04-02 13:38:12.000000000 +0200
>+++ ImageMagick-6.5.4-7/coders/tiff.c	2012-04-02 13:40:57.000000000 +0200
>@@ -435,7 +435,7 @@ static void TIFFGetEXIFProperties(TIFF *
>           *ascii;
> 
>         if (TIFFGetField(tiff,exif_info[i].tag,&ascii) != 0)
>-          (void) CopyMagickMemory(value,ascii,MaxTextExtent);
>+          (void) CopyMagickString(value,ascii,MaxTextExtent);
>         break;
>       }
>       case TIFF_SHORT:
>diff -up ImageMagick-6.5.4-7/magick/property.c.cve-2012-0259 ImageMagick-6.5.4-7/magick/property.c
>--- ImageMagick-6.5.4-7/magick/property.c.cve-2012-0259	2012-04-02 13:25:21.000000000 +0200
>+++ ImageMagick-6.5.4-7/magick/property.c	2012-04-03 10:39:44.000000000 +0200
>@@ -1294,6 +1294,8 @@ static MagickBooleanType GetEXIFProperty
>         break;
>       components=(long) ((int) ReadPropertyLong(endian,q+4));
>       number_bytes=(size_t) components*tag_bytes[format];
>+      if (number_bytes < components)
>+        break;  /* prevent overflow */
>       if (number_bytes <= 4)
>         p=q+8;
>       else
>@@ -1317,6 +1319,8 @@ static MagickBooleanType GetEXIFProperty
>             buffer[MaxTextExtent],
>             *value;
> 
>+          value=(char *) NULL;
>+          *buffer='\0';
>           switch (format)
>           {
>             case EXIF_FMT_BYTE:

Actions: View | Diff

Attachments on bug 807993: 574539 | 574809