Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
Package not found: openSUSE:Slowroll:Build:1/kubevirt
SUSE:SLE-12-SP1:GA
ImageMagick.9832
ImageMagick-CVE-2017-18028.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File ImageMagick-CVE-2017-18028.patch of Package ImageMagick.9832
Index: ImageMagick-6.8.8-1/coders/tiff.c =================================================================== --- ImageMagick-6.8.8-1.orig/coders/tiff.c 2018-01-29 16:25:15.880169937 +0100 +++ ImageMagick-6.8.8-1/coders/tiff.c 2018-01-29 17:02:06.365847864 +0100 @@ -901,6 +901,16 @@ static tsize_t TIFFWriteBlob(thandle_t i static Image *ReadTIFFImage(const ImageInfo *image_info, ExceptionInfo *exception) { +#define ThrowTIFFException(severity,message) \ +{ \ + if (pixels != (unsigned char *) NULL) \ + pixels=(unsigned char *) RelinquishMagickMemory(pixels); \ + if (quantum_info != (QuantumInfo *) NULL) \ + quantum_info=DestroyQuantumInfo(quantum_info); \ + TIFFClose(tiff); \ + ThrowReaderException(severity,message); \ +} + typedef enum { ReadSingleSampleMethod, @@ -1253,12 +1263,10 @@ RestoreMSCWarning /* Allocate memory for the image and pixel buffer. */ + pixels=(unsigned char *) NULL; quantum_info=AcquireQuantumInfo(image_info,image); if (quantum_info == (QuantumInfo *) NULL) - { - TIFFClose(tiff); - ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed"); - } + ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed"); if (sample_format == SAMPLEFORMAT_UINT) status=SetQuantumFormat(image,quantum_info,UnsignedQuantumFormat); if (sample_format == SAMPLEFORMAT_INT) @@ -1266,11 +1274,7 @@ RestoreMSCWarning if (sample_format == SAMPLEFORMAT_IEEEFP) status=SetQuantumFormat(image,quantum_info,FloatingPointQuantumFormat); if (status == MagickFalse) - { - TIFFClose(tiff); - quantum_info=DestroyQuantumInfo(quantum_info); - ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed"); - } + ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed"); status=MagickTrue; switch (photometric) { @@ -1347,10 +1351,7 @@ RestoreMSCWarning TIFFScanlineSize(tiff),(size_t) (image->columns*samples_per_pixel* pow(2.0,ceil(log(bits_per_sample)/log(2.0)))*sizeof(uint32)))); if (pixels == (unsigned char *) NULL) - { - TIFFClose(tiff); - ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed"); - } + ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed"); switch (method) { case ReadSingleSampleMethod: @@ -1425,10 +1426,7 @@ RestoreMSCWarning status=SetQuantumPad(image,quantum_info,pad*pow(2,ceil(log( bits_per_sample)/log(2)))); if (status == MagickFalse) - { - TIFFClose(tiff); - ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed"); - } + ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed"); for (y=0; y < (ssize_t) image->rows; y++) { int @@ -1482,10 +1480,7 @@ RestoreMSCWarning } status=SetQuantumPad(image,quantum_info,pad*((bits_per_sample+7) >> 3)); if (status == MagickFalse) - { - TIFFClose(tiff); - ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed"); - } + ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed"); for (y=0; y < (ssize_t) image->rows; y++) { int @@ -1641,24 +1636,19 @@ RestoreMSCWarning */ if ((TIFFGetField(tiff,TIFFTAG_TILEWIDTH,&columns) == 0) || (TIFFGetField(tiff,TIFFTAG_TILELENGTH,&rows) == 0)) - { - TIFFClose(tiff); - ThrowReaderException(CoderError,"ImageIsNotTiled"); - } + ThrowTIFFException(CoderError,"ImageIsNotTiled"); (void) SetImageStorageClass(image,DirectClass); + if (CheckMemoryOverflow(columns,rows) != MagickFalse) + ThrowTIFFException(ImageError,"WidthOrHeightExceedsLimit"); number_pixels=(MagickSizeType) columns*rows; + if (columns*rows > GetBlobSize(image)) + ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed") if (CheckMemoryOverflow(rows,sizeof(*tile_pixels)) != MagickFalse) - { - TIFFClose(tiff); - ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed"); - } + ThrowTIFFException(ImageError,"WidthOrHeightExceedsLimit"); tile_pixels=(uint32 *) AcquireQuantumMemory(columns, rows*sizeof(*tile_pixels)); if (tile_pixels == (uint32 *) NULL) - { - TIFFClose(tiff); - ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed"); - } + ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed"); for (y=0; y < (ssize_t) image->rows; y+=rows) { PixelPacket @@ -1756,17 +1746,11 @@ RestoreMSCWarning */ number_pixels=(MagickSizeType) image->columns*image->rows; if (CheckMemoryOverflow(image->rows,sizeof(*pixels)) != MagickFalse) - { - TIFFClose(tiff); - ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed"); - } + ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed"); pixel_info=AcquireVirtualMemory(image->columns,image->rows* sizeof(*pixels)); if (pixel_info == (MemoryInfo *) NULL) - { - TIFFClose(tiff); - ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed"); - } + ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed"); pixels=(uint32 *) GetVirtualMemoryBlob(pixel_info); (void) TIFFReadRGBAImage(tiff,(uint32) image->columns,(uint32) image->rows,(uint32 *) pixels,0);
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
