File ImageMagick-CVE-2017-15218.patch of Package ImageMagick.30355

Overview Repositories Revisions Requests Users Attributes Meta

File ImageMagick-CVE-2017-15218.patch of Package ImageMagick.30355

Index: ImageMagick-6.8.8-1/coders/png.c
===================================================================
--- ImageMagick-6.8.8-1.orig/coders/png.c	2018-01-12 14:24:25.733948143 +0100
+++ ImageMagick-6.8.8-1/coders/png.c	2018-01-12 14:29:30.034841341 +0100
@@ -4355,6 +4355,12 @@ static Image *ReadOneJNGImage(MngInfo *m
                 (p[2] << 8) | p[3]);
             jng_height=(size_t) ((p[4] << 24) | (p[5] << 16) |
                 (p[6] << 8) | p[7]);
+            if ((jng_width == 0) || (jng_height == 0))
+            {
+               DestroyJNG(chunk,&color_image,&color_image_info,
+                          &alpha_image,&alpha_image_info);
+               ThrowReaderException(CorruptImageError,"NegativeOrZeroImageSize");
+            }
             jng_color_type=p[8];
             jng_image_sample_depth=p[9];
             jng_image_compression_method=p[10];
@@ -4445,13 +4451,20 @@ static Image *ReadOneJNGImage(MngInfo *m
         color_image_info=(ImageInfo *)AcquireMagickMemory(sizeof(ImageInfo));
 
         if (color_image_info == (ImageInfo *) NULL)
+        {
+          DestroyJNG(chunk,&color_image,&color_image_info,
+              &alpha_image,&alpha_image_info);
           ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+        }
 
         GetImageInfo(color_image_info);
         color_image=AcquireImage(color_image_info);
-
         if (color_image == (Image *) NULL)
+        {
+          DestroyJNG(chunk,&color_image,&color_image_info,
+              &alpha_image,&alpha_image_info);
           ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+        }
 
         if (logging != MagickFalse)
           (void) LogMagickEvent(CoderEvent,GetMagickModule(),
@@ -4464,7 +4477,8 @@ static Image *ReadOneJNGImage(MngInfo *m
 
         if (status == MagickFalse)
           {
-            color_image=DestroyImage(color_image);
+            DestroyJNG(chunk,&color_image,&color_image_info,
+              &alpha_image,&alpha_image_info);
             return(DestroyImageList(image));
           }
 
@@ -4475,7 +4489,8 @@ static Image *ReadOneJNGImage(MngInfo *m
 
             if (alpha_image_info == (ImageInfo *) NULL)
               {
-                color_image=DestroyImage(color_image);
+                DestroyJNG(chunk,&color_image,&color_image_info,
+                  &alpha_image,&alpha_image_info);
                 ThrowReaderException(ResourceLimitError,
                   "MemoryAllocationFailed");
               }
@@ -4485,8 +4500,8 @@ static Image *ReadOneJNGImage(MngInfo *m
 
             if (alpha_image == (Image *) NULL)
               {
-                alpha_image_info=DestroyImageInfo(alpha_image_info);
-                color_image=DestroyImage(color_image);
+                  DestroyJNG(chunk,&color_image,&color_image_info,
+                    &alpha_image,&alpha_image_info);
                 ThrowReaderException(ResourceLimitError,
                   "MemoryAllocationFailed");
               }
@@ -4782,7 +4797,12 @@ static Image *ReadOneJNGImage(MngInfo *m
   color_image_info=DestroyImageInfo(color_image_info);
 
   if (jng_image == (Image *) NULL)
+  {
+     DestroyJNG(NULL,&color_image,&color_image_info,
+         &alpha_image,&alpha_image_info);
     return(DestroyImageList(image));
+  }
+
 
   if (logging != MagickFalse)
     (void) LogMagickEvent(CoderEvent,GetMagickModule(),

Places

File ImageMagick-CVE-2017-15218.patch of Package ImageMagick.30355

Places