File ImageMagick-CVE-2017-13058,CVE-2018-18016.patch of Package ImageMagick

Overview Repositories Revisions Requests Users Attributes Meta

File ImageMagick-CVE-2017-13058,CVE-2018-18016.patch of Package ImageMagick

Index: ImageMagick-6.8.8-1/coders/pcx.c
===================================================================
--- ImageMagick-6.8.8-1.orig/coders/pcx.c	2018-10-11 10:16:47.804639978 +0200
+++ ImageMagick-6.8.8-1/coders/pcx.c	2018-10-11 11:43:53.422144354 +0200
@@ -997,7 +997,11 @@ static MagickBooleanType WritePCXImage(c
       }
     length=(((size_t) image->columns*pcx_info.bits_per_pixel+7)/8);
     if (length > 65535UL)
+    {
+      if (page_table != (MagickOffsetType *) NULL)
+        page_table=(MagickOffsetType *) RelinquishMagickMemory(page_table); 
       ThrowWriterException(ImageError,"WidthOrHeightExceedsLimit");
+    }
     pcx_info.bytes_per_line=(unsigned short) length;
     pcx_info.palette_info=1;
     pcx_info.colormap_signature=0x0c;
@@ -1020,7 +1024,11 @@ static MagickBooleanType WritePCXImage(c
     pcx_colormap=(unsigned char *) AcquireQuantumMemory(256UL,
       3*sizeof(*pcx_colormap));
     if (pcx_colormap == (unsigned char *) NULL)
+    {
+      if (page_table != (MagickOffsetType *) NULL)
+        page_table=(MagickOffsetType *) RelinquishMagickMemory(page_table);
       ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
+    }
     (void) memset(pcx_colormap,0,3*256*sizeof(*pcx_colormap));
     q=pcx_colormap;
     if ((image->storage_class == PseudoClass) && (image->colors <= 256))
@@ -1042,6 +1050,8 @@ static MagickBooleanType WritePCXImage(c
     if (pixel_info == (MemoryInfo *) NULL)
       {
         pcx_colormap=(unsigned char *) RelinquishMagickMemory(pcx_colormap);
+        if (page_table != (MagickOffsetType *) NULL)
+          page_table=(MagickOffsetType *) RelinquishMagickMemory(page_table);
         ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
       }
     pixels=(unsigned char *) GetVirtualMemoryBlob(pixel_info);
@@ -1214,7 +1224,10 @@ static MagickBooleanType WritePCXImage(c
       page_table[scene+1]=0;
       offset=SeekBlob(image,0L,SEEK_SET);
       if (offset < 0)
+      {
+        page_table=(MagickOffsetType *) RelinquishMagickMemory(page_table);
         ThrowWriterException(CorruptImageError,"ImproperImageHeader");
+      }
       (void) WriteBlobLSBLong(image,0x3ADE68B1L);
       for (i=0; i <= (ssize_t) scene; i++)
         (void) WriteBlobLSBLong(image,(unsigned int) page_table[i]);

Places

File ImageMagick-CVE-2017-13058,CVE-2018-18016.patch of Package ImageMagick

Places