File ImageMagick-CVE-2017-11638,11642.patch of Package ImageMagick

Overview Repositories Revisions Requests Users Attributes Meta

File ImageMagick-CVE-2017-11638,11642.patch of Package ImageMagick

Index: ImageMagick-6.8.8-1/coders/map.c
===================================================================
--- ImageMagick-6.8.8-1.orig/coders/map.c	2018-02-14 10:29:15.998169789 +0100
+++ ImageMagick-6.8.8-1/coders/map.c	2018-02-14 10:40:24.833169750 +0100
@@ -334,6 +334,21 @@ ModuleExport void UnregisterMAPImage(voi
 %
 %
 */
+static MagickBooleanType CheckMemoryOverflow(const size_t count,
+  const size_t quantum)
+{
+  size_t
+    size;
+
+  size=count*quantum;
+  if ((count == 0) || (quantum != (size/count)))
+    {
+      errno=ENOMEM;
+      return(MagickTrue);
+    }
+  return(MagickFalse);
+}
+
 static MagickBooleanType WriteMAPImage(const ImageInfo *image_info,Image *image)
 {
   MagickBooleanType
@@ -380,13 +395,20 @@ static MagickBooleanType WriteMAPImage(c
   /*
     Allocate colormap.
   */
-  if (IsPaletteImage(image,&image->exception) == MagickFalse)
-    (void) SetImageType(image,PaletteType);
+  if (SetImageType(image,PaletteType) == MagickFalse)
+    ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
   depth=GetImageQuantumDepth(image,MagickTrue);
   packet_size=(size_t) (depth/8);
+  if (CheckMemoryOverflow(packet_size,sizeof(*pixels)) != MagickFalse)
+      ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
   pixels=(unsigned char *) AcquireQuantumMemory(image->columns,packet_size*
     sizeof(*pixels));
   packet_size=(size_t) (image->colors > 256 ? 6UL : 3UL);
+  if (CheckMemoryOverflow(packet_size,sizeof(*colormap)) != MagickFalse)
+    {
+      colormap=(unsigned char *) RelinquishMagickMemory(pixels);
+      ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
+    }
   colormap=(unsigned char *) AcquireQuantumMemory(image->colors,packet_size*
     sizeof(*colormap));
   if ((pixels == (unsigned char *) NULL) ||

Places

File ImageMagick-CVE-2017-11638,11642.patch of Package ImageMagick

Places