File ImageMagick-CVE-2016-7515.patch of Package ImageMagick.29977

Overview Repositories Revisions Requests Users Attributes Meta

File ImageMagick-CVE-2016-7515.patch of Package ImageMagick.29977

From 09fb19104d70d0491b686e001bf52cfbec23804a Mon Sep 17 00:00:00 2001
From: dirk <dirk@git.imagemagick.org>
Date: Mon, 5 Oct 2015 22:11:47 +0200
Subject: [PATCH] Fixed check for the number of pixels that will be allocated.

---
 coders/rle.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

Index: ImageMagick-6.8.9-8/coders/rle.c
===================================================================
--- ImageMagick-6.8.9-8.orig/coders/rle.c	2016-10-03 09:40:03.113728985 +0200
+++ ImageMagick-6.8.9-8/coders/rle.c	2016-10-03 09:43:46.093303427 +0200
@@ -173,6 +173,7 @@ static Image *ReadRLEImage(const ImageIn
     map_length,
     number_colormaps,
     number_planes,
+    number_planes_filled,
     one,
     offset,
     pixel_info_length;
@@ -302,9 +303,10 @@ static Image *ReadRLEImage(const ImageIn
     if (image->matte != MagickFalse)
       number_planes++;
     number_pixels=(MagickSizeType) image->columns*image->rows;
-    if ((number_pixels*number_planes) != (size_t) (number_pixels*number_planes))
+    number_planes_filled=(number_planes % 2 == 0) ? number_planes : number_planes+1;
+    if ((number_pixels*number_planes_filled) != (size_t) (number_pixels*number_planes_filled))
       ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
-    pixel_info_length=image->columns*image->rows*(number_planes > 4 ? number_planes : 4);
+    pixel_info_length=image->columns*image->rows*number_planes_filled;
     pixel_info=AcquireVirtualMemory(pixel_info_length,sizeof(*pixels));
     if (pixel_info == (MemoryInfo *) NULL)
       ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");

Places

File ImageMagick-CVE-2016-7515.patch of Package ImageMagick.29977

Places