File ImageMagick-CVE-2020-27772.patch of Package ImageMagick.30956

Overview Repositories Revisions Requests Users Attributes Meta

File ImageMagick-CVE-2020-27772.patch of Package ImageMagick.30956

Index: ImageMagick-6.8.8-1/coders/bmp.c
===================================================================
--- ImageMagick-6.8.8-1.orig/coders/bmp.c	2020-12-07 15:30:16.536560842 +0100
+++ ImageMagick-6.8.8-1/coders/bmp.c	2020-12-07 15:30:16.952563626 +0100
@@ -2046,6 +2046,45 @@ static MagickBooleanType WriteBMPImage(c
         (void) WriteBlobLSBLong(image,0x000000ffU);  /* Blue mask */
         (void) WriteBlobLSBLong(image,0xff000000U);  /* Alpha mask */
         (void) WriteBlobLSBLong(image,0x73524742U);  /* sRGB */
+
+        // bounds check, assign .0 if invalid value
+        if( isgreater(image->chromaticity.red_primary.x, 1.0) ||
+           !isgreater(image->chromaticity.red_primary.x, 0.0)) {
+          image->chromaticity.red_primary.x = 0.0;
+        }
+        if( isgreater(image->chromaticity.red_primary.y, 1.0) ||
+           !isgreater(image->chromaticity.red_primary.y, 0.0)) {
+          image->chromaticity.red_primary.y = 0.0;
+        }
+        if( isgreater(image->chromaticity.green_primary.x, 1.0) ||
+           !isgreater(image->chromaticity.green_primary.x, 0.0)) {
+          image->chromaticity.green_primary.x = 0.0;
+        }
+        if( isgreater(image->chromaticity.green_primary.y, 1.0) ||
+           !isgreater(image->chromaticity.green_primary.y, 0.0)) {
+          image->chromaticity.green_primary.y = 0.0;
+        }
+        if( isgreater(image->chromaticity.blue_primary.x, 1.0) ||
+           !isgreater(image->chromaticity.blue_primary.x, 0.0)) {
+          image->chromaticity.blue_primary.x = 0.0;
+        }
+        if( isgreater(image->chromaticity.blue_primary.y, 1.0) ||
+           !isgreater(image->chromaticity.blue_primary.y, 0.0)) {
+          image->chromaticity.blue_primary.y = 0.0;
+        }
+        if( isgreater(bmp_info.gamma_scale.x, 1.0) ||
+           !isgreater(bmp_info.gamma_scale.x, 0.0)) {
+          bmp_info.gamma_scale.x = 0.0;
+        }
+        if( isgreater(bmp_info.gamma_scale.y, 1.0) ||
+           !isgreater(bmp_info.gamma_scale.y, 0.0)) {
+          bmp_info.gamma_scale.y = 0.0;
+        }
+        if( isgreater(bmp_info.gamma_scale.z, 1.0) ||
+           !isgreater(bmp_info.gamma_scale.z, 0.0)) {
+          bmp_info.gamma_scale.z = 0.0;
+        }
+
         (void) WriteBlobLSBLong(image,(unsigned int)
           (image->chromaticity.red_primary.x*0x40000000));
         (void) WriteBlobLSBLong(image,(unsigned int)

Places

File ImageMagick-CVE-2020-27772.patch of Package ImageMagick.30956

Places