Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-12-SP1:GA
ImageMagick.9832
ImageMagick-xwd.c-update.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File ImageMagick-xwd.c-update.patch of Package ImageMagick.9832
Index: ImageMagick-6.8.8-1/coders/xwd.c =================================================================== --- ImageMagick-6.8.8-1.orig/coders/xwd.c 2019-04-15 13:20:34.846267830 +0200 +++ ImageMagick-6.8.8-1/coders/xwd.c 2019-04-15 13:20:35.766272290 +0200 @@ -17,13 +17,13 @@ % July 1992 % % % % % -% Copyright 1999-2014 ImageMagick Studio LLC, a non-profit organization % +% Copyright 1999-2019 ImageMagick Studio LLC, a non-profit organization % % dedicated to making software imaging solutions freely available. % % % % You may not use this file except in compliance with the License. You may % % obtain a copy of the License at % % % -% http://www.imagemagick.org/script/license.php % +% https://imagemagick.org/script/license.php % % % % Unless required by applicable law or agreed to in writing, software % % distributed under the License is distributed on an "AS IS" BASIS, % @@ -40,6 +40,7 @@ Include declarations. */ #include "magick/studio.h" +#include "magick/attribute.h" #include "magick/blob.h" #include "magick/blob-private.h" #include "magick/cache.h" @@ -186,13 +187,15 @@ static Image *ReadXWDImage(const ImageIn pixel; size_t - length, - lsb_first; + length; ssize_t count, y; + unsigned long + lsb_first; + XColor *colors; @@ -237,8 +240,17 @@ static Image *ReadXWDImage(const ImageIn if (header.file_version != XWD_FILE_VERSION) ThrowReaderException(CorruptImageError,"FileFormatVersionMismatch"); if (header.header_size < sz_XWDheader) - ThrowReaderException(CorruptImageError,"CorruptImage"); - switch (header.visual_class) { + ThrowReaderException(CorruptImageError,"ImproperImageHeader"); + if ((header.bits_per_pixel == 0) || (header.bits_per_pixel > 32)) + ThrowReaderException(CorruptImageError,"ImproperImageHeader"); + if (((header.bitmap_pad % 8) != 0) || (header.bitmap_pad > 32)) + ThrowReaderException(CorruptImageError,"ImproperImageHeader"); + if (header.bitmap_unit > 32) + ThrowReaderException(CorruptImageError,"ImproperImageHeader"); + if (header.ncolors > 256) + ThrowReaderException(CorruptImageError,"ImproperImageHeader"); + switch (header.visual_class) + { case StaticGray: case GrayScale: case StaticColor: @@ -247,17 +259,20 @@ static Image *ReadXWDImage(const ImageIn case DirectColor: break; default: - ThrowReaderException(CorruptImageError,"CorruptImage"); - } - switch (header.pixmap_format) { + ThrowReaderException(CorruptImageError,"ImproperImageHeader"); + } + switch (header.pixmap_format) + { case XYBitmap: case XYPixmap: case ZPixmap: break; default: - ThrowReaderException(CorruptImageError,"CorruptImage"); + ThrowReaderException(CorruptImageError,"ImproperImageHeader"); } - length=(size_t) header.header_size-sz_XWDheader; + length=(size_t) (header.header_size-sz_XWDheader); + if ((length+1) != ((size_t) ((CARD32) (length+1)))) + ThrowReaderException(CorruptImageError,"ImproperImageHeader"); comment=(char *) AcquireQuantumMemory(length+1,sizeof(*comment)); if (comment == (char *) NULL) ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed"); @@ -290,7 +305,7 @@ static Image *ReadXWDImage(const ImageIn ximage->blue_mask=header.blue_mask; if ((ximage->width < 0) || (ximage->height < 0) || (ximage->depth < 0) || (ximage->format < 0) || (ximage->byte_order < 0) || - (ximage->bitmap_bit_order < 0) || (ximage->bitmap_pad < 0) || + (ximage->bitmap_bit_order < 0) || (ximage->bitmap_pad < 0) || (ximage->bytes_per_line < 0)) { ximage=(XImage *) RelinquishMagickMemory(ximage); @@ -334,7 +349,7 @@ static Image *ReadXWDImage(const ImageIn for (i=0; i < (ssize_t) header.ncolors; i++) { count=ReadBlob(image,sz_XWDColor,(unsigned char *) &color); - if (count == 0) + if (count != sz_XWDColor) { colors=(XColor *) RelinquishMagickMemory(colors); ximage=(XImage *) RelinquishMagickMemory(ximage); @@ -346,7 +361,7 @@ static Image *ReadXWDImage(const ImageIn colors[i].blue=color.blue; colors[i].flags=(char) color.flags; if (color.flags != 0) - authentic_colormap=MagickTrue; + authentic_colormap=MagickTrue; } /* Ensure the header byte-order is most-significant byte first. @@ -396,13 +411,13 @@ static Image *ReadXWDImage(const ImageIn ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed"); } count=ReadBlob(image,length,(unsigned char *) ximage->data); - if (count == 0) + if (count != (ssize_t) length) { if (header.ncolors != 0) colors=(XColor *) RelinquishMagickMemory(colors); ximage->data=DestroyString(ximage->data); ximage=(XImage *) RelinquishMagickMemory(ximage); - ThrowReaderException(CorruptImageError,"UnexpectedEndOfFile"); + ThrowReaderException(CorruptImageError,"UnableToReadImageData"); } /* Convert image to MIFF format. @@ -410,6 +425,16 @@ static Image *ReadXWDImage(const ImageIn image->columns=(size_t) ximage->width; image->rows=(size_t) ximage->height; image->depth=8; + status=SetImageExtent(image,image->columns,image->rows); + if (status == MagickFalse) + { + if (header.ncolors != 0) + colors=(XColor *) RelinquishMagickMemory(colors); + ximage->data=DestroyString(ximage->data); + ximage=(XImage *) RelinquishMagickMemory(ximage); + InheritException(exception,&image->exception); + return(DestroyImageList(image)); + } if ((header.ncolors == 0U) || (ximage->red_mask != 0) || (ximage->green_mask != 0) || (ximage->blue_mask != 0)) image->storage_class=DirectClass; @@ -469,15 +494,16 @@ static Image *ReadXWDImage(const ImageIn for (x=0; x < (ssize_t) image->columns; x++) { pixel=XGetPixel(ximage,(int) x,(int) y); - index=(IndexPacket) ((pixel >> red_shift) & red_mask); - SetPixelRed(q,ScaleShortToQuantum(colors[(ssize_t) - index].red)); - index=(IndexPacket) ((pixel >> green_shift) & green_mask); + index=ConstrainColormapIndex(image,(ssize_t) (pixel >> + red_shift) & red_mask); + SetPixelRed(q,ScaleShortToQuantum(colors[(ssize_t) index].red)); + index=ConstrainColormapIndex(image,(ssize_t) (pixel >> + green_shift) & green_mask); SetPixelGreen(q,ScaleShortToQuantum(colors[(ssize_t) index].green)); - index=(IndexPacket) ((pixel >> blue_shift) & blue_mask); - SetPixelBlue(q,ScaleShortToQuantum(colors[(ssize_t) - index].blue)); + index=ConstrainColormapIndex(image,(ssize_t) (pixel >> + blue_shift) & blue_mask); + SetPixelBlue(q,ScaleShortToQuantum(colors[(ssize_t) index].blue)); q++; } if (SyncAuthenticPixels(image,exception) == MagickFalse) @@ -497,23 +523,23 @@ static Image *ReadXWDImage(const ImageIn { pixel=XGetPixel(ximage,(int) x,(int) y); color=(pixel >> red_shift) & red_mask; - color=(color*65535UL)/red_mask; - SetPixelRed(q,ScaleShortToQuantum((unsigned short) - color)); + if (red_mask != 0) + color=(color*65535UL)/red_mask; + SetPixelRed(q,ScaleShortToQuantum((unsigned short) color)); color=(pixel >> green_shift) & green_mask; - color=(color*65535UL)/green_mask; - SetPixelGreen(q,ScaleShortToQuantum((unsigned short) - color)); + if (green_mask != 0) + color=(color*65535UL)/green_mask; + SetPixelGreen(q,ScaleShortToQuantum((unsigned short) color)); color=(pixel >> blue_shift) & blue_mask; - color=(color*65535UL)/blue_mask; - SetPixelBlue(q,ScaleShortToQuantum((unsigned short) - color)); + if (blue_mask != 0) + color=(color*65535UL)/blue_mask; + SetPixelBlue(q,ScaleShortToQuantum((unsigned short) color)); q++; } if (SyncAuthenticPixels(image,exception) == MagickFalse) break; status=SetImageProgress(image,LoadImageTag,(MagickOffsetType) y, - image->rows); + image->rows); if (status == MagickFalse) break; } @@ -546,8 +572,8 @@ static Image *ReadXWDImage(const ImageIn indexes=GetAuthenticIndexQueue(image); for (x=0; x < (ssize_t) image->columns; x++) { - index=ConstrainColormapIndex(image,XGetPixel(ximage,(int) x, - (int) y)); + index=ConstrainColormapIndex(image,(ssize_t) XGetPixel(ximage,(int) + x,(int) y)); SetPixelIndex(indexes+x,index); SetPixelRGBO(q,image->colormap+(ssize_t) index); q++; @@ -692,15 +718,18 @@ static MagickBooleanType WriteXWDImage(c bits_per_pixel, bytes_per_line, length, - lsb_first, scanline_pad; ssize_t + count, y; unsigned char *pixels; + unsigned long + lsb_first; + XWDFileHeader xwd_info; @@ -716,12 +745,16 @@ static MagickBooleanType WriteXWDImage(c status=OpenBlob(image_info,image,WriteBinaryBlobMode,&image->exception); if (status == MagickFalse) return(status); - if (IssRGBCompatibleColorspace(image->colorspace) == MagickFalse) - (void) TransformImageColorspace(image,sRGBColorspace); + if ((image->columns != (CARD32) image->columns) || + (image->rows != (CARD32) image->rows)) + ThrowWriterException(ImageError,"WidthOrHeightExceedsLimit"); + if ((image->storage_class == PseudoClass) && (image->colors > 256)) + (void) SetImageType(image,TrueColorType); + (void) TransformImageColorspace(image,sRGBColorspace); /* Initialize XWD file header. */ - (void) ResetMagickMemory(&xwd_info,0,sizeof(xwd_info)); + (void) memset(&xwd_info,0,sizeof(xwd_info)); xwd_info.header_size=(CARD32) sz_XWDheader; value=GetImageProperty(image,"comment"); if (value != (const char *) NULL) @@ -784,7 +817,7 @@ static MagickBooleanType WriteXWDImage(c /* Dump colormap to file. */ - (void) ResetMagickMemory(&color,0,sizeof(color)); + (void) memset(&color,0,sizeof(color)); colors=(XColor *) AcquireQuantumMemory((size_t) image->colors, sizeof(*colors)); if (colors == (XColor *) NULL) @@ -801,8 +834,8 @@ static MagickBooleanType WriteXWDImage(c { MSBOrderLong((unsigned char *) &colors[i].pixel, sizeof(colors[i].pixel)); - MSBOrderShort((unsigned char *) &colors[i].red, - 3*sizeof(colors[i].red)); + MSBOrderShort((unsigned char *) &colors[i].red,3* + sizeof(colors[i].red)); } } for (i=0; i < (ssize_t) image->colors; i++) @@ -812,7 +845,9 @@ static MagickBooleanType WriteXWDImage(c color.green=colors[i].green; color.blue=colors[i].blue; color.flags=(CARD8) colors[i].flags; - (void) WriteBlob(image,sz_XWDColor,(unsigned char *) &color); + count=WriteBlob(image,sz_XWDColor,(unsigned char *) &color); + if (count != (ssize_t) sz_XWDColor) + break; } colors=(XColor *) RelinquishMagickMemory(colors); } @@ -825,7 +860,7 @@ static MagickBooleanType WriteXWDImage(c pixels=(unsigned char *) AcquireQuantumMemory(length,sizeof(*pixels)); if (pixels == (unsigned char *) NULL) ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed"); - (void) ResetMagickMemory(pixels,0,length); + (void) memset(pixels,0,length); /* Convert MIFF to XWD raster pixels. */ @@ -852,7 +887,10 @@ static MagickBooleanType WriteXWDImage(c } for (x=0; x < (ssize_t) scanline_pad; x++) *q++='\0'; - (void) WriteBlob(image,(size_t) (q-pixels),pixels); + length=(size_t) (q-pixels); + count=WriteBlob(image,length,pixels); + if (count != (ssize_t) length) + break; status=SetImageProgress(image,SaveImageTag,(MagickOffsetType) y, image->rows); if (status == MagickFalse) @@ -860,6 +898,6 @@ static MagickBooleanType WriteXWDImage(c } pixels=(unsigned char *) RelinquishMagickMemory(pixels); (void) CloseBlob(image); - return(MagickTrue); + return(y < (ssize_t) image->rows ? MagickFalse : MagickTrue); } #endif
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
