File ImageMagick-meta.c-update.patch of Package ImageMagick

Overview Repositories Revisions Requests Users Attributes Meta

File ImageMagick-meta.c-update.patch of Package ImageMagick (Revision 4a562eb5f5aa10823d7f44f8640934be)

Currently displaying revision 4a562eb5f5aa10823d7f44f8640934be , Show latest

Index: ImageMagick-6.8.8-1/coders/meta.c
===================================================================
--- ImageMagick-6.8.8-1.orig/coders/meta.c	2018-09-15 09:34:46.291973385 +0200
+++ ImageMagick-6.8.8-1/coders/meta.c	2018-09-15 09:50:06.668473552 +0200
@@ -17,13 +17,13 @@
 %                                 July 2001                                   %
 %                                                                             %
 %                                                                             %
-%  Copyright 1999-2014 ImageMagick Studio LLC, a non-profit organization      %
+%  Copyright 1999-2018 ImageMagick Studio LLC, a non-profit organization      %
 %  dedicated to making software imaging solutions freely available.           %
 %                                                                             %
 %  You may not use this file except in compliance with the License.  You may  %
 %  obtain a copy of the License at                                            %
 %                                                                             %
-%    http://www.imagemagick.org/script/license.php                            %
+%    https://www.imagemagick.org/script/license.php                           %
 %                                                                             %
 %  Unless required by applicable law or agreed to in writing, software        %
 %  distributed under the License is distributed on an "AS IS" BASIS,          %
@@ -140,18 +140,17 @@ static MagickBooleanType IsMETA(const un
 %    o exception: return any errors or warnings in this structure.
 %
 */
-#define BUFFER_SZ 4096
-
 typedef struct _html_code
 {
-  short
+  const short
     len;
+
   const char
     *code,
     val;
 } html_code;
 
-static html_code html_codes[] = {
+static const html_code html_codes[] = {
 #ifdef HANDLE_GT_LT
   { 4,"&lt;",'<' },
   { 4,"&gt;",'>' },
@@ -199,7 +198,7 @@ static size_t convertHTMLcodes(char *s,
   int
     value;
 
-  if ((len == 0) || (s == (char*)NULL) || (*s=='\0'))
+  if ((len == 0) || (s == (char*) NULL) || (*s=='\0'))
     return(0);
   if ((len > 3) && (s[1] == '#') && (strchr(s,';') != (char *) NULL) &&
       (sscanf(s,"&#%d;",&value) == 1))
@@ -212,7 +211,7 @@ static size_t convertHTMLcodes(char *s,
           break;
       }
       if (o < 6)
-        (void) strcpy(s+1,s+1+o);
+        (void) memmove(s+1,s+1+o,strlen(s+1+o)+1);
       *s=value;
       return(o);
     }
@@ -225,11 +224,12 @@ static size_t convertHTMLcodes(char *s,
       codes=sizeof(html_codes)/sizeof(html_code);
       for (i=0; i < codes; i++)
       {
-        if (html_codes[i].len <= len)
+        if (html_codes[i].len <= (ssize_t) len)
           if (stringnicmp(s, html_codes[i].code,(size_t) (html_codes[i].len)) == 0)
             {
-              (void) strcpy(s+1,s+html_codes[i].len);
-              *s = html_codes[i].val;
+              (void) memmove(s+1,s+html_codes[i].len,
+                strlen(s+html_codes[i].len)+1);
+              *s=html_codes[i].val;
               return(html_codes[i].len-1);
             }
       }
@@ -284,7 +284,6 @@ static char *super_fgets(char **b, int *
   return((char *) p);
 }
 
-#define BUFFER_SZ 4096
 #define IPTC_ID 1028
 #define THUMBNAIL_ID 1033
 
@@ -309,7 +308,7 @@ static ssize_t parse8BIM(Image *ifile, I
     recnum;
 
   int
-    inputlen = BUFFER_SZ;
+    inputlen = MaxTextExtent;
 
   MagickOffsetType
     savedpos,
@@ -325,7 +324,9 @@ static ssize_t parse8BIM(Image *ifile, I
   dataset = 0;
   recnum = 0;
   line = (char *) AcquireQuantumMemory((size_t) inputlen,sizeof(*line));
-  name = token = (char *)NULL;
+  if (line == (char *) NULL)
+    return(-1);
+  newstr = name = token = (char *) NULL;
   savedpos = 0;
   token_info=AcquireTokenInfo();
   while (super_fgets(&line,&inputlen,ifile)!=NULL)
@@ -334,7 +335,11 @@ static ssize_t parse8BIM(Image *ifile, I
     next=0;
 
     token=(char *) AcquireQuantumMemory((size_t) inputlen,sizeof(*token));
+    if (token == (char *) NULL)
+      break;
     newstr=(char *) AcquireQuantumMemory((size_t) inputlen,sizeof(*newstr));
+    if (newstr == (char *) NULL)
+      break;
     while (Tokenizer(token_info,0,token,(size_t) inputlen,line,"","=","\"",0,
            &brkused,&next,&quoted)==0)
     {
@@ -395,16 +400,16 @@ static ssize_t parse8BIM(Image *ifile, I
               if (brkused && next > 0)
                 {
                   size_t
-                    codes_len;
+                    codes_length;
 
                   char
                     *s = &token[next-1];
 
-                  codes_len = (ssize_t) convertHTMLcodes(s,strlen(s));
-                  if (codes_len > len)
-                    len = 0;
+                  codes_length=convertHTMLcodes(s, strlen(s));
+                  if ((ssize_t) codes_length > len)
+                    len=0;
                   else
-                    len -= codes_len;
+                    len-=codes_length;
                 }
             }
 
@@ -423,19 +428,24 @@ static ssize_t parse8BIM(Image *ifile, I
 
                     ssize_t diff = outputlen - savedolen;
                     currentpos = TellBlob(ofile);
+                    if (currentpos < 0)
+                      {
+                        line=DestroyString(line);
+                        return(-1);
+                      }
                     offset=SeekBlob(ofile,savedpos,SEEK_SET);
                     if (offset < 0)
-                    {
-                      line=DestroyString(line);
-                      return(-1);
-                    }
+                      {
+                        line=DestroyString(line);
+                        return(-1);
+                      }
                     (void) WriteBlobMSBLong(ofile,(unsigned int) diff);
                     offset=SeekBlob(ofile,currentpos,SEEK_SET);
                     if (offset < 0)
-                    {
-                      line=DestroyString(line);
-                      return(-1);
-                    }
+                      {
+                        line=DestroyString(line);
+                        return(-1);
+                      }
                     savedolen = 0L;
                   }
                 if (outputlen & 1)
@@ -478,6 +488,8 @@ static ssize_t parse8BIM(Image *ifile, I
                   {
                     /* patch in a fake length for now and fix it later */
                     savedpos = TellBlob(ofile);
+                    if (savedpos < 0)
+                      return(-1);
                     (void) WriteBlobMSBLong(ofile,0xFFFFFFFFU);
                     outputlen += 4;
                     savedolen = outputlen;
@@ -501,12 +513,20 @@ static ssize_t parse8BIM(Image *ifile, I
           }
       state++;
     }
-    token=DestroyString(token);
-    newstr=DestroyString(newstr);
+    if (token != (char *) NULL)
+      token=DestroyString(token);
+    if (newstr != (char *) NULL)
+      newstr=DestroyString(newstr);
     if (name != (char *) NULL)
       name=DestroyString(name);
   }
   token_info=DestroyTokenInfo(token_info);
+  if (token != (char *) NULL)
+    token=DestroyString(token);
+  if (newstr != (char *) NULL)
+    newstr=DestroyString(newstr);
+  if (name != (char *) NULL)
+    name=DestroyString(name);
   line=DestroyString(line);
   if (savedolen > 0)
     {
@@ -516,6 +536,8 @@ static ssize_t parse8BIM(Image *ifile, I
       ssize_t diff = outputlen - savedolen;
 
       currentpos = TellBlob(ofile);
+      if (currentpos < 0)
+        return(-1);
       offset=SeekBlob(ofile,savedpos,SEEK_SET);
       if (offset < 0)
         return(-1);
@@ -525,7 +547,52 @@ static ssize_t parse8BIM(Image *ifile, I
         return(-1);
       savedolen = 0L;
     }
-  return outputlen;
+  return(outputlen);
+}
+
+MagickExport signed int ReadBlobMSBSignedLong(Image *image)
+{
+  union
+  {
+    unsigned int
+      unsigned_value;
+
+    signed int
+      signed_value;
+  } quantum;
+
+  quantum.unsigned_value=ReadBlobMSBLong(image);
+  return(quantum.signed_value);
+}
+
+MagickExport signed short ReadBlobMSBSignedShort(Image *image)
+{
+  union
+  {
+    unsigned short
+      unsigned_value;
+
+    signed short
+      signed_value;
+  } quantum;
+
+  quantum.unsigned_value=ReadBlobMSBShort(image);
+  return(quantum.signed_value);
+}
+
+MagickExport signed short ReadBlobLSBSignedShort(Image *image)
+{
+  union
+  {
+    unsigned short
+      unsigned_value;
+
+    signed short
+      signed_value;
+  } quantum;
+
+  quantum.unsigned_value=ReadBlobLSBShort(image);
+  return(quantum.signed_value);
 }
 
 static char *super_fgets_w(char **b, int *blen, Image *file)
@@ -542,7 +609,7 @@ static char *super_fgets_w(char **b, int
   p=(unsigned char *) (*b);
   for (q=p; ; q++)
   {
-    c=(int) ReadBlobLSBShort(file);
+    c=ReadBlobLSBSignedShort(file);
     if ((c == -1) || (c == '\n'))
       break;
    if (EOFBlob(file))
@@ -598,7 +665,7 @@ static ssize_t parse8BIMW(Image *ifile,
     recnum;
 
   int
-    inputlen = BUFFER_SZ;
+    inputlen = MaxTextExtent;
 
   ssize_t
     savedolen = 0L,
@@ -614,7 +681,9 @@ static ssize_t parse8BIMW(Image *ifile,
   dataset = 0;
   recnum = 0;
   line=(char *) AcquireQuantumMemory((size_t) inputlen,sizeof(*line));
-  name = token = (char *)NULL;
+  if (line == (char *) NULL)
+    return(-1);
+  newstr = name = token = (char *) NULL;
   savedpos = 0;
   token_info=AcquireTokenInfo();
   while (super_fgets_w(&line,&inputlen,ifile) != NULL)
@@ -623,7 +692,11 @@ static ssize_t parse8BIMW(Image *ifile,
     next=0;
 
     token=(char *) AcquireQuantumMemory((size_t) inputlen,sizeof(*token));
+    if (token == (char *) NULL)
+      break;
     newstr=(char *) AcquireQuantumMemory((size_t) inputlen,sizeof(*newstr));
+    if (newstr == (char *) NULL)
+      break;
     while (Tokenizer(token_info,0,token,(size_t) inputlen,line,"","=","\"",0,
       &brkused,&next,&quoted)==0)
     {
@@ -684,16 +757,16 @@ static ssize_t parse8BIMW(Image *ifile,
               if (brkused && next > 0)
                 {
                   size_t
-                    codes_len;
+                    codes_length;
 
                   char
                     *s = &token[next-1];
 
-                  codes_len = (ssize_t) convertHTMLcodes(s,strlen(s));
-                  if (codes_len > len)
-                    len = 0;
+                  codes_length=convertHTMLcodes(s, strlen(s));
+                  if ((ssize_t) codes_length > len)
+                    len=0;
                   else
-                    len -= codes_len;
+                    len-=codes_length;
                 }
             }
 
@@ -712,6 +785,8 @@ static ssize_t parse8BIMW(Image *ifile,
 
                     ssize_t diff = outputlen - savedolen;
                     currentpos = TellBlob(ofile);
+                    if (currentpos < 0)
+                      return(-1);
                     offset=SeekBlob(ofile,savedpos,SEEK_SET);
                     if (offset < 0)
                       return(-1);
@@ -761,6 +836,8 @@ static ssize_t parse8BIMW(Image *ifile,
                   {
                     /* patch in a fake length for now and fix it later */
                     savedpos = TellBlob(ofile);
+                    if (savedpos < 0)
+                      return(-1);
                     (void) WriteBlobMSBLong(ofile,0xFFFFFFFFU);
                     outputlen += 4;
                     savedolen = outputlen;
@@ -784,11 +861,20 @@ static ssize_t parse8BIMW(Image *ifile,
           }
       state++;
     }
+    if (token != (char *) NULL)
+      token=DestroyString(token);
+    if (newstr != (char *) NULL)
+      newstr=DestroyString(newstr);
+    if (name != (char *) NULL)
+      name=DestroyString(name);
+  }
+  token_info=DestroyTokenInfo(token_info);
+  if (token != (char *) NULL)
     token=DestroyString(token);
+  if (newstr != (char *) NULL)
     newstr=DestroyString(newstr);
+  if (name != (char *) NULL)
     name=DestroyString(name);
-  }
-  token_info=DestroyTokenInfo(token_info);
   line=DestroyString(line);
   if (savedolen > 0)
     {
@@ -798,6 +884,8 @@ static ssize_t parse8BIMW(Image *ifile,
       ssize_t diff = outputlen - savedolen;
 
       currentpos = TellBlob(ofile);
+      if (currentpos < 0)
+        return(-1);
       offset=SeekBlob(ofile,savedpos,SEEK_SET);
       if (offset < 0)
         return(-1);
@@ -1010,7 +1098,7 @@ static int jpeg_embed(Image *ifile, Imag
         /* APP0 is in each and every JPEG, so when we hit APP0 we insert our new APP13! */
         jpeg_skip_variable(ifile, ofile);
 
-        if (iptc != (Image *)NULL)
+        if (iptc != (Image *) NULL)
           {
             char
               psheader[] = "\xFF\xED\0\0Photoshop 3.0\0" "8BIM\x04\x04\0\0\0\0";
@@ -1082,6 +1170,39 @@ static int jpeg_extract(Image *ifile, Im
 }
 #endif
 
+static void CopyBlob(Image *source,Image *destination)
+{
+  ssize_t
+    i;
+
+  unsigned char
+    *buffer;
+
+  ssize_t
+    count,
+    length;
+
+  buffer=(unsigned char *) AcquireQuantumMemory(MagickMaxBufferExtent,
+    sizeof(*buffer));
+  if (buffer != (unsigned char *) NULL)
+    {
+      i=0;
+      while ((length=ReadBlob(source,MagickMaxBufferExtent,buffer)) != 0)
+      {
+        count=0;
+        for (i=0; i < (ssize_t) length; i+=count)
+        {
+          count=WriteBlob(destination,(size_t) (length-i),buffer+i);
+          if (count <= 0)
+            break;
+        }
+        if (i < (ssize_t) length)
+          break;
+      }
+      buffer=(unsigned char *) RelinquishMagickMemory(buffer);
+    }
+}
+
 static Image *ReadMETAImage(const ImageInfo *image_info,
   ExceptionInfo *exception)
 {
@@ -1089,9 +1210,6 @@ static Image *ReadMETAImage(const ImageI
     *buff,
     *image;
 
-  int
-    c;
-
   MagickBooleanType
     status;
 
@@ -1144,40 +1262,52 @@ static Image *ReadMETAImage(const ImageI
           buff=DestroyImage(buff);
           ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
         }
+      (void) memset(blob,0,length);
       AttachBlob(buff->blob,blob,length);
       if (LocaleCompare(image_info->magick,"8BIMTEXT") == 0)
         {
           length=(size_t) parse8BIM(image, buff);
+          if (length == 0)
+            {
+              blob=DetachBlob(buff->blob);
+              blob=(unsigned char *) RelinquishMagickMemory(blob);
+              buff=DestroyImage(buff);
+              ThrowReaderException(CorruptImageError,"CorruptImage");
+            }
           if (length & 1)
             (void) WriteBlobByte(buff,0x0);
         }
       else if (LocaleCompare(image_info->magick,"8BIMWTEXT") == 0)
         {
           length=(size_t) parse8BIMW(image, buff);
+          if (length == 0)
+            {
+              blob=DetachBlob(buff->blob);
+              blob=(unsigned char *) RelinquishMagickMemory(blob);
+              buff=DestroyImage(buff);
+              ThrowReaderException(CorruptImageError,"CorruptImage");
+            }
           if (length & 1)
             (void) WriteBlobByte(buff,0x0);
         }
       else
-        {
-          for ( ; ; )
-          {
-            c=ReadBlobByte(image);
-            if (c == EOF)
-              break;
-            (void) WriteBlobByte(buff,(unsigned char) c);
-          }
-        }
+        CopyBlob(image,buff);
       profile=BlobToStringInfo(GetBlobStreamData(buff),(size_t)
         GetBlobSize(buff));
       if (profile == (StringInfo *) NULL)
-        ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+        {
+          blob=DetachBlob(buff->blob);
+          blob=(unsigned char *) RelinquishMagickMemory(blob);
+          buff=DestroyImage(buff);
+          ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+        }
       status=SetImageProfile(image,"8bim",profile);
       profile=DestroyStringInfo(profile);
-      if (status == MagickFalse)
-        ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
       blob=DetachBlob(buff->blob);
       blob=(unsigned char *) RelinquishMagickMemory(blob);
       buff=DestroyImage(buff);
+      if (status == MagickFalse)
+        ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
     }
   if (LocaleNCompare(image_info->magick,"APP1",4) == 0)
     {
@@ -1206,7 +1336,7 @@ static Image *ReadMETAImage(const ImageI
           if (image_info->profile == (void *) NULL)
             {
               blob=DetachBlob(buff->blob);
-              blob=RelinquishMagickMemory(blob);
+              blob=(unsigned char *) RelinquishMagickMemory(blob);
               buff=DestroyImage(buff);
               ThrowReaderException(CoderError,"NoIPTCProfileAvailable");
             }
@@ -1215,7 +1345,7 @@ static Image *ReadMETAImage(const ImageI
           if (iptc == (Image *) NULL)
             {
               blob=DetachBlob(buff->blob);
-              blob=RelinquishMagickMemory(blob);
+              blob=(unsigned char *) RelinquishMagickMemory(blob);
               buff=DestroyImage(buff);
               ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
             }
@@ -1223,70 +1353,27 @@ static Image *ReadMETAImage(const ImageI
             GetStringInfoLength(profile));
           result=jpeg_embed(image,buff,iptc);
           blob=DetachBlob(iptc->blob);
-          blob=RelinquishMagickMemory(blob);
+          blob=(unsigned char *) RelinquishMagickMemory(blob);
           iptc=DestroyImage(iptc);
           if (result == 0)
-            {
-              blob=DetachBlob(buff->blob);
-              blob=RelinquishMagickMemory(blob);
-              buff=DestroyImage(buff);
-              ThrowReaderException(CoderError,"JPEGEmbeddingFailed");
-            }
+            ThrowReaderException(CoderError,"JPEGEmbeddingFailed");
         }
       else
-        {
-#ifdef SLOW_METHOD
-          for ( ; ; )
-          {
-            /* Really - really slow - FIX ME PLEASE!!!! */
-            c=ReadBlobByte(image);
-            if (c == EOF)
-              break;
-            (void) WriteBlobByte(buff,c);
-          }
-#else
-          ssize_t
-            i;
-
-          unsigned char
-            *buffer;
-
-          ssize_t
-            count,
-            length;
-
-          buffer=(unsigned char *) AcquireQuantumMemory(MagickMaxBufferExtent,
-            sizeof(*buffer));
-          if (buffer != (unsigned char *) NULL)
-            {
-              i=0;
-              while ((length=ReadBlob(image,MagickMaxBufferExtent,buffer)) != 0)
-              {
-                count=0;
-                for (i=0; i < (ssize_t) length; i+=count)
-                {
-                  count=WriteBlob(buff,(size_t) (length-i),buffer+i);
-                  if (count <= 0)
-                    break;
-                }
-                if (i < (ssize_t) length)
-                  break;
-              }
-              buffer=(unsigned char *) RelinquishMagickMemory(buffer);
-            }
-#endif
-        }
+        CopyBlob(image,buff);
       profile=BlobToStringInfo(GetBlobStreamData(buff),(size_t)
         GetBlobSize(buff));
       if (profile == (StringInfo *) NULL)
         ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
       status=SetImageProfile(image,name,profile);
       profile=DestroyStringInfo(profile);
-      if (status == MagickFalse)
-        ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
       blob=DetachBlob(buff->blob);
-      blob=RelinquishMagickMemory(blob);
+      blob=(unsigned char *) RelinquishMagickMemory(blob);
       buff=DestroyImage(buff);
+      if (status == MagickFalse)
+        {
+          buff=DestroyImage(buff);
+          ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+        }
     }
   if ((LocaleCompare(image_info->magick,"ICC") == 0) ||
       (LocaleCompare(image_info->magick,"ICM") == 0))
@@ -1301,17 +1388,16 @@ static Image *ReadMETAImage(const ImageI
           ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
         }
       AttachBlob(buff->blob,blob,length);
-      for ( ; ; )
-      {
-        c=ReadBlobByte(image);
-        if (c == EOF)
-          break;
-        (void) WriteBlobByte(buff,(unsigned char) c);
-      }
+      CopyBlob(image,buff);
       profile=BlobToStringInfo(GetBlobStreamData(buff),(size_t)
         GetBlobSize(buff));
       if (profile == (StringInfo *) NULL)
-        ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+        {
+          blob=DetachBlob(buff->blob);
+          blob=(unsigned char *) RelinquishMagickMemory(blob);
+          buff=DestroyImage(buff);
+          ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+        }
       (void) SetImageProfile(image,"icc",profile);
       profile=DestroyStringInfo(profile);
       blob=DetachBlob(buff->blob);
@@ -1320,9 +1406,6 @@ static Image *ReadMETAImage(const ImageI
     }
   if (LocaleCompare(image_info->magick,"IPTC") == 0)
     {
-      register unsigned char
-        *p;
-
       buff=AcquireImage((ImageInfo *) NULL);
       if (buff == (Image *) NULL)
         ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
@@ -1333,41 +1416,17 @@ static Image *ReadMETAImage(const ImageI
           ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
         }
       AttachBlob(buff->blob,blob,length);
-      /* write out the header - length field patched below */
-      (void) WriteBlob(buff,11,(unsigned char *) "8BIM\04\04\0\0\0\0\0");
-      (void) WriteBlobByte(buff,0xc6);
-      if (LocaleCompare(image_info->magick,"IPTCTEXT") == 0)
-        {
-          length=(size_t) parse8BIM(image,buff);
-          if (length & 1)
-            (void) WriteBlobByte(buff,0x00);
-        }
-      else if (LocaleCompare(image_info->magick,"IPTCWTEXT") == 0)
-        {
-        }
-      else
-        {
-          for ( ; ; )
-          {
-            c=ReadBlobByte(image);
-            if (c == EOF)
-              break;
-            (void) WriteBlobByte(buff,(unsigned char) c);
-          }
-        }
+      CopyBlob(image,buff);
       profile=BlobToStringInfo(GetBlobStreamData(buff),(size_t)
         GetBlobSize(buff));
       if (profile == (StringInfo *) NULL)
-        ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
-      /*
-        subtract off the length of the 8BIM stuff.
-      */
-      length=GetStringInfoLength(profile)-12;
-      p=GetStringInfoDatum(profile);
-      p[10]=(unsigned char) (length >> 8);
-      p[11]=(unsigned char) (length & 0xff);
-      SetStringInfoDatum(profile,GetBlobStreamData(buff));
-      (void) SetImageProfile(image,"8bim",profile);
+        {
+          blob=DetachBlob(buff->blob);
+          blob=(unsigned char *) RelinquishMagickMemory(blob);
+          buff=DestroyImage(buff);
+          ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+        }
+      (void) SetImageProfile(image,"iptc",profile);
       profile=DestroyStringInfo(profile);
       blob=DetachBlob(buff->blob);
       blob=(unsigned char *) RelinquishMagickMemory(blob);
@@ -1385,17 +1444,16 @@ static Image *ReadMETAImage(const ImageI
           ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
         }
       AttachBlob(buff->blob,blob,length);
-      for ( ; ; )
-      {
-        c=ReadBlobByte(image);
-        if (c == EOF)
-          break;
-        (void) WriteBlobByte(buff,(unsigned char) c);
-      }
+      CopyBlob(image,buff);
       profile=BlobToStringInfo(GetBlobStreamData(buff),(size_t)
         GetBlobSize(buff));
       if (profile == (StringInfo *) NULL)
-        ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+        {
+          blob=DetachBlob(buff->blob);
+          blob=(unsigned char *) RelinquishMagickMemory(blob);
+          buff=DestroyImage(buff);
+          ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+        }
       (void) SetImageProfile(image,"xmp",profile);
       profile=DestroyStringInfo(profile);
       blob=DetachBlob(buff->blob);
@@ -1821,7 +1879,7 @@ static void formatString(Image *ofile, c
 
 typedef struct _tag_spec
 {
-  short
+  const short
     id;
 
   const char
@@ -1850,6 +1908,7 @@ static const tag_spec tags[] = {
   { 80, "Byline" },
   { 85, "Byline Title" },
   { 90, "City" },
+  { 92, "Sub-Location" },
   { 95, "Province State" },
   { 100, "Country Code" },
   { 101, "Country" },
@@ -1919,21 +1978,26 @@ static int formatIPTC(Image *ifile, Imag
   while (c != EOF)
   {
     if (c == 0x1c)
-      foundiptc = 1;
+      foundiptc=1;
     else
       {
         if (foundiptc)
-          return -1;
+          return(-1);
         else
-          continue;
+          {
+            c=0;
+            continue;
+          }
       }
 
     /* we found the 0x1c tag and now grab the dataset and record number tags */
     c = ReadBlobByte(ifile);
-    if (c == EOF) return -1;
+    if (c == EOF)
+      return(-1);
     dataset = (unsigned char) c;
     c = ReadBlobByte(ifile);
-    if (c == EOF) return -1;
+    if (c == EOF)
+      return(-1);
     recnum = (unsigned char) c;
     /* try to match this record to one of the ones in our named table */
     for (i=0; i< tagcount; i++)
@@ -1949,35 +2013,38 @@ static int formatIPTC(Image *ifile, Imag
       We decode the length of the block that follows - ssize_t or short fmt.
     */
     c=ReadBlobByte(ifile);
-    if (c == EOF) return -1;
+    if (c == EOF)
+      return(-1);
     if (c & (unsigned char) 0x80)
-      return 0;
+      return(0);
     else
       {
         int
           c0;
 
         c0=ReadBlobByte(ifile);
-        if (c0 == EOF) return -1;
+        if (c0 == EOF)
+          return(-1);
         taglen = (c << 8) | c0;
       }
-    if (taglen < 0) return -1;
+    if (taglen < 0)
+      return(-1);
     /* make a buffer to hold the tag datand snag it from the input stream */
     str=(unsigned char *) AcquireQuantumMemory((size_t) (taglen+MaxTextExtent),
       sizeof(*str));
     if (str == (unsigned char *) NULL)
       {
-        printf("MemoryAllocationFailed");
+        (void) printf("MemoryAllocationFailed");
         return 0;
       }
     for (tagindx=0; tagindx<taglen; tagindx++)
     {
       c=ReadBlobByte(ifile);
       if (c == EOF)
-      {
-        str=(unsigned char *) RelinquishMagickMemory(str);
-        return -1;
-      }
+        {
+          str=(unsigned char *) RelinquishMagickMemory(str);
+          return(-1);
+        }
       str[tagindx] = (unsigned char) c;
     }
     str[taglen] = 0;
@@ -2096,19 +2163,21 @@ static int formatIPTCfromBuffer(Image *o
       }
     if (taglen < 0)
       return(-1);
+    if (taglen > 65535)
+      return(-1);
     /* make a buffer to hold the tag datand snag it from the input stream */
     str=(unsigned char *) AcquireQuantumMemory((size_t) (taglen+MaxTextExtent),
       sizeof(*str));
     if (str == (unsigned char *) NULL)
-      {
-        printf("MemoryAllocationFailed");
-        return 0;
-      }
+      return 0;
     for (tagindx=0; tagindx<taglen; tagindx++)
     {
       c = *s++; len--;
       if (len < 0)
-        return(-1);
+        {
+          str=(unsigned char *) RelinquishMagickMemory(str);
+          return(-1);
+        }
       str[tagindx]=(unsigned char) c;
     }
     str[taglen]=0;
@@ -2183,7 +2252,7 @@ static int format8BIM(Image *ifile, Imag
     /*
       We found the OSType (8BIM) and now grab the ID, PString, and Size fields.
     */
-    ID=(int) ReadBlobMSBShort(ifile);
+    ID=ReadBlobMSBSignedShort(ifile);
     if (ID < 0)
       return(-1);
     {
@@ -2197,10 +2266,7 @@ static int format8BIM(Image *ifile, Imag
       PString=(unsigned char *) AcquireQuantumMemory((size_t) (plen+
         MaxTextExtent),sizeof(*PString));
       if (PString == (unsigned char *) NULL)
-        {
-          printf("MemoryAllocationFailed");
-          return 0;
-        }
+        return 0;
       for (i=0; i<plen; i++)
       {
         c=ReadBlobByte(ifile);
@@ -2222,18 +2288,17 @@ static int format8BIM(Image *ifile, Imag
           }
       }
     }
-    count = (int) ReadBlobMSBLong(ifile);
-    if (count < 0)
+    count=(ssize_t) ReadBlobMSBSignedLong(ifile);
+    if ((count < 0) || (count > GetBlobSize(ifile)))
       {
         PString=(unsigned char *) RelinquishMagickMemory(PString);
         return(-1);
       }
-    /* make a buffer to hold the datand snag it from the input stream */
-    str=(unsigned char *) AcquireQuantumMemory((size_t) count,sizeof(*str));
+    /* make a buffer to hold the data and snag it from the input stream */
+    str=(unsigned char *) AcquireQuantumMemory((size_t) count+1,sizeof(*str));
     if (str == (unsigned char *) NULL)
       {
         PString=(unsigned char *) RelinquishMagickMemory(PString);
-        printf("MemoryAllocationFailed");
         return 0;
       }
     for (i=0; i < (ssize_t) count; i++)
@@ -2241,6 +2306,7 @@ static int format8BIM(Image *ifile, Imag
       c=ReadBlobByte(ifile);
       if (c == EOF)
         {
+          str=(unsigned char *) RelinquishMagickMemory(str);
           PString=(unsigned char *) RelinquishMagickMemory(PString);
           return(-1);
         }

Places

File ImageMagick-meta.c-update.patch of Package ImageMagick (Revision 4a562eb5f5aa10823d7f44f8640934be)

Places