Attachment 600950 Details for Bug 844101 – Patch for CVE-2012-3437 from ImageMagick SVN

[patch] Patch for CVE-2012-3437 from ImageMagick SVN

CVE-2012-3437-coders-png-c.patch (text/plain), 2.15 KB, created by Kurt Seifried on 2012-07-28 22:57:47 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Kurt Seifried

Created: 2012-07-28 22:57:47 UTC

Size: 2.15 KB

patch

obsolete

>Index: coders/png.c
>===================================================================
>--- coders/png.c	(revision 8733)
>+++ coders/png.c	(revision 8732)
>@@ -1808,11 +1808,7 @@
> }
> 
> #ifdef PNG_USER_MEM_SUPPORTED
>-#if PNG_LIBPNG_VER >= 14000
>-static png_voidp Magick_png_malloc(png_structp png_ptr,png_alloc_size_t size)
>-#else
>-static png_voidp Magick_png_malloc(png_structp png_ptr,png_size_t size)
>-#endif
>+static png_voidp Magick_png_malloc(png_structp png_ptr,png_uint_32 size)
> {
>   (void) png_ptr;
>   return((png_voidp) AcquireMagickMemory((size_t) size));
>@@ -7462,22 +7458,12 @@
>          (char *) profile_type, (double) length);
>      }
> 
>-#if PNG_LIBPNG_VER >= 14000
>-   text=(png_textp) png_malloc(ping,(png_alloc_size_t) sizeof(png_text));
>-#else
>-   text=(png_textp) png_malloc(ping,(png_size_t) sizeof(png_text));
>-#endif
>+   text=(png_textp) png_malloc(ping,(png_uint_32) sizeof(png_text));
>    description_length=(png_uint_32) strlen((const char *) profile_description);
>    allocated_length=(png_uint_32) (length*2 + (length >> 5) + 20
>       + description_length);
>-#if PNG_LIBPNG_VER >= 14000
>-   text[0].text=(png_charp) png_malloc(ping,
>-      (png_alloc_size_t) allocated_length);
>-   text[0].key=(png_charp) png_malloc(ping, (png_alloc_size_t) 80);
>-#else
>-   text[0].text=(png_charp) png_malloc(ping, (png_size_t) allocated_length);
>-   text[0].key=(png_charp) png_malloc(ping, (png_size_t) 80);
>-#endif
>+   text[0].text=(png_charp) png_malloc(ping,allocated_length);
>+   text[0].key=(png_charp) png_malloc(ping, (png_uint_32) 80);
>    text[0].key[0]='\0';
>    (void) ConcatenateMagickString(text[0].key,
>       "Raw profile type ",MaxTextExtent);
>@@ -10796,13 +10782,7 @@
>         {
>         if (value != (const char *) NULL)
>           {
>-
>-#if PNG_LIBPNG_VER >= 14000
>-            text=(png_textp) png_malloc(ping,
>-                 (png_alloc_size_t) sizeof(png_text));
>-#else
>-            text=(png_textp) png_malloc(ping,(png_size_t) sizeof(png_text));
>-#endif
>+            text=(png_textp) png_malloc(ping,(png_uint_32) sizeof(png_text));
>             text[0].key=(char *) property;
>             text[0].text=(char *) value;
>             text[0].text_length=strlen(value);

Actions: View | Diff

Attachments on bug 844101: 600950