File ImageMagick-CVE-2017-11640.patch of Package ImageMagick

Overview Repositories Revisions Requests Users Attributes Meta

File ImageMagick-CVE-2017-11640.patch of Package ImageMagick (Revision ede7a536328eec17bacb42c62585ca00)

Currently displaying revision ede7a536328eec17bacb42c62585ca00 , Show latest

Index: ImageMagick-6.8.8-1/coders/tiff.c
===================================================================
--- ImageMagick-6.8.8-1.orig/coders/tiff.c	2017-11-28 15:20:07.837340433 +0100
+++ ImageMagick-6.8.8-1/coders/tiff.c	2017-11-28 15:20:07.845340567 +0100
@@ -2287,8 +2287,16 @@ static MagickBooleanType WritePTIFImage(
   images=NewImageList();
   for (next=image; next != (Image *) NULL; next=GetNextImageInList(next))
   {
-    AppendImageToList(&images,CloneImage(next,0,0,MagickFalse,
-      &image->exception));
+    Image
+      *clone_image;
+
+    clone_image=CloneImage(next,0,0,MagickFalse,&image->exception);
+    if (clone_image == (Image *) NULL)
+      break;
+    clone_image->previous=NewImageList();
+    clone_image->next=NewImageList();
+    (void) SetImageProperty(clone_image,"tiff:subfiletype","none");
+    AppendImageToList(&images,clone_image);
     columns=next->columns;
     rows=next->rows;
     resolution.x=next->x_resolution;
@@ -2311,11 +2319,15 @@ static MagickBooleanType WritePTIFImage(
   /*
     Write pyramid-encoded TIFF image.
   */
+  status=MagickFalse;
+  if (images != (Image *) NULL)
+  {
   write_info=CloneImageInfo(image_info);
   write_info->adjoin=MagickTrue;
   status=WriteTIFFImage(write_info,GetFirstImageInList(images));
   images=DestroyImageList(images);
   write_info=DestroyImageInfo(write_info);
+  }
   return(status);
 }
 #endif
Index: ImageMagick-6.8.8-1/magick/image.c
===================================================================
--- ImageMagick-6.8.8-1.orig/magick/image.c	2017-11-28 15:20:07.605336516 +0100
+++ ImageMagick-6.8.8-1/magick/image.c	2017-11-28 15:56:06.861606469 +0100
@@ -801,6 +801,10 @@ MagickExport Image *CloneImage(const Ima
     (void) LogMagickEvent(TraceEvent,GetMagickModule(),"%s",image->filename);
   assert(exception != (ExceptionInfo *) NULL);
   assert(exception->signature == MagickSignature);
+  if ((image->columns == 0) || (image->rows == 0))
+    {
+      return((Image *) NULL);
+    }
   clone_image=(Image *) AcquireMagickMemory(sizeof(*clone_image));
   if (clone_image == (Image *) NULL)
     ThrowImageException(ResourceLimitError,"MemoryAllocationFailed");
Index: ImageMagick-6.8.8-1/coders/pwp.c
===================================================================
--- ImageMagick-6.8.8-1.orig/coders/pwp.c	2017-11-28 15:20:07.697338070 +0100
+++ ImageMagick-6.8.8-1/coders/pwp.c	2017-11-28 15:20:07.849340636 +0100
@@ -171,6 +171,7 @@ static Image *ReadPWPImage(const ImageIn
   status=OpenBlob(image_info,pwp_image,ReadBinaryBlobMode,exception);
   if (status == MagickFalse)
     return((Image *) NULL);
+  ResetMagickMemory(magick,0,sizeof(magick));
   count=ReadBlob(pwp_image,5,magick);
   if ((count == 0) || (LocaleNCompare((char *) magick,"SFW95",5) != 0))
     ThrowReaderException(CorruptImageError,"ImproperImageHeader");

Places

File ImageMagick-CVE-2017-11640.patch of Package ImageMagick (Revision ede7a536328eec17bacb42c62585ca00)

Places