File ImageMagick-xwd.c-update.patch of Package ImageMagick.17345

Overview Repositories Revisions Requests Users Attributes Meta

File ImageMagick-xwd.c-update.patch of Package ImageMagick.17345

Index: ImageMagick-6.8.8-1/coders/xwd.c
===================================================================
--- ImageMagick-6.8.8-1.orig/coders/xwd.c	2019-04-30 11:57:36.555540222 +0200
+++ ImageMagick-6.8.8-1/coders/xwd.c	2019-04-30 12:07:32.742593884 +0200
@@ -17,13 +17,13 @@
 %                                 July 1992                                   %
 %                                                                             %
 %                                                                             %
-%  Copyright 1999-2014 ImageMagick Studio LLC, a non-profit organization      %
+%  Copyright 1999-2019 ImageMagick Studio LLC, a non-profit organization      %
 %  dedicated to making software imaging solutions freely available.           %
 %                                                                             %
 %  You may not use this file except in compliance with the License.  You may  %
 %  obtain a copy of the License at                                            %
 %                                                                             %
-%    http://www.imagemagick.org/script/license.php                            %
+%    https://imagemagick.org/script/license.php                               %
 %                                                                             %
 %  Unless required by applicable law or agreed to in writing, software        %
 %  distributed under the License is distributed on an "AS IS" BASIS,          %
@@ -40,6 +40,7 @@
   Include declarations.
 */
 #include "magick/studio.h"
+#include "magick/attribute.h"
 #include "magick/blob.h"
 #include "magick/blob-private.h"
 #include "magick/cache.h"
@@ -186,13 +187,15 @@ static Image *ReadXWDImage(const ImageIn
     pixel;
 
   size_t
-    length,
-    lsb_first;
+    length;
 
   ssize_t
     count,
     y;
 
+  unsigned long
+    lsb_first;
+
   XColor
     *colors;
 
@@ -206,12 +209,12 @@ static Image *ReadXWDImage(const ImageIn
     Open image file.
   */
   assert(image_info != (const ImageInfo *) NULL);
-  assert(image_info->signature == MagickSignature);
+  assert(image_info->signature == MagickSignature);
   if (image_info->debug != MagickFalse)
     (void) LogMagickEvent(TraceEvent,GetMagickModule(),"%s",
       image_info->filename);
   assert(exception != (ExceptionInfo *) NULL);
-  assert(exception->signature == MagickSignature);
+  assert(exception->signature == MagickSignature);
   image=AcquireImage(image_info);
   status=OpenBlob(image_info,image,ReadBinaryBlobMode,exception);
   if (status == MagickFalse)
@@ -237,27 +240,96 @@ static Image *ReadXWDImage(const ImageIn
   if (header.file_version != XWD_FILE_VERSION)
     ThrowReaderException(CorruptImageError,"FileFormatVersionMismatch");
   if (header.header_size < sz_XWDheader)
-    ThrowReaderException(CorruptImageError,"CorruptImage");
-  switch (header.visual_class) {
+    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+  if (header.xoffset >= header.pixmap_width)
+    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+  switch (header.visual_class)
+  {
     case StaticGray:
     case GrayScale:
+    {
+      if (header.bits_per_pixel != 1)
+        ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+      break;
+    }
     case StaticColor:
     case PseudoColor:
+    {
+      if ((header.bits_per_pixel < 1) || (header.bits_per_pixel > 15) ||
+          (header.ncolors == 0))
+        ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+      break;
+    }
     case TrueColor:
     case DirectColor:
+    {
+      if ((header.bits_per_pixel != 16) && (header.bits_per_pixel != 24) &&
+          (header.bits_per_pixel != 32))
+        ThrowReaderException(CorruptImageError,"ImproperImageHeader");
       break;
-    default:
-      ThrowReaderException(CorruptImageError,"CorruptImage");
     }
-  switch (header.pixmap_format) {
+    default:
+      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+  }
+  switch (header.pixmap_format)
+  {
     case XYBitmap:
+    {
+      if (header.pixmap_depth != 1)
+        ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+      break;
+    }
     case XYPixmap:
     case ZPixmap:
+    {
+      if ((header.pixmap_depth < 1) || (header.pixmap_depth > 32))
+        ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+      switch (header.bitmap_pad)
+      {
+        case 8:
+        case 16:
+        case 32:
+          break;
+        default:
+          ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+      }
+      break;
+    }
+    default:
+      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+  }
+  switch (header.bitmap_unit)
+  {
+    case 8:
+    case 16:
+    case 32:
+      break;
+    default:
+      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+  }
+  switch (header.byte_order)
+  {
+    case LSBFirst:
+    case MSBFirst:
+      break;
+    default:
+      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+  }
+  switch (header.bitmap_bit_order)
+  {
+    case LSBFirst:
+    case MSBFirst:
       break;
     default:
-      ThrowReaderException(CorruptImageError,"CorruptImage");
+      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   }
-  length=(size_t) header.header_size-sz_XWDheader;
+  if (((header.bitmap_pad % 8) != 0) || (header.bitmap_pad > 32))
+    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+  if (header.ncolors > 65535)
+    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+  length=(size_t) (header.header_size-sz_XWDheader);
+  if ((length+1) != ((size_t) ((CARD32) (length+1))))
+    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   comment=(char *) AcquireQuantumMemory(length+1,sizeof(*comment));
   if (comment == (char *) NULL)
     ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
@@ -288,10 +360,11 @@ static Image *ReadXWDImage(const ImageIn
   ximage->red_mask=header.red_mask;
   ximage->green_mask=header.green_mask;
   ximage->blue_mask=header.blue_mask;
-  if ((ximage->width < 0) || (ximage->height < 0) || (ximage->depth < 0) || 
-      (ximage->format < 0) || (ximage->byte_order < 0) ||
-			(ximage->bitmap_bit_order < 0) || (ximage->bitmap_pad < 0) ||
-      (ximage->bytes_per_line < 0))
+  if ((ximage->depth < 0) || (ximage->format < 0) || (ximage->xoffset < 0) ||
+      (ximage->width < 0) || (ximage->height < 0) || (ximage->bitmap_pad < 0) ||
+      (ximage->bytes_per_line < 0) || (ximage->byte_order < 0) ||
+      (ximage->bitmap_unit < 0) || (ximage->bitmap_bit_order < 0) ||
+      (ximage->bits_per_pixel < 0))
     {
       ximage=(XImage *) RelinquishMagickMemory(ximage);
       ThrowReaderException(CorruptImageError,"ImproperImageHeader");
@@ -322,10 +395,8 @@ static Image *ReadXWDImage(const ImageIn
       XWDColor
         color;
 
-      length=(size_t) header.ncolors;
-      if (length > ((~0UL)/sizeof(*colors)))
-        ThrowReaderException(CorruptImageError,"ImproperImageHeader");
-      colors=(XColor *) AcquireQuantumMemory(length,sizeof(*colors));
+      colors=(XColor *) AcquireQuantumMemory((size_t) header.ncolors,
+        sizeof(*colors));
       if (colors == (XColor *) NULL)
         {
           ximage=(XImage *) RelinquishMagickMemory(ximage);
@@ -334,7 +405,7 @@ static Image *ReadXWDImage(const ImageIn
       for (i=0; i < (ssize_t) header.ncolors; i++)
       {
         count=ReadBlob(image,sz_XWDColor,(unsigned char *) &color);
-        if (count == 0)
+        if (count != sz_XWDColor)
           {
             colors=(XColor *) RelinquishMagickMemory(colors);
             ximage=(XImage *) RelinquishMagickMemory(ximage);
@@ -346,7 +417,7 @@ static Image *ReadXWDImage(const ImageIn
         colors[i].blue=color.blue;
         colors[i].flags=(char) color.flags;
         if (color.flags != 0)
-         authentic_colormap=MagickTrue;
+          authentic_colormap=MagickTrue;
       }
       /*
         Ensure the header byte-order is most-significant byte first.
@@ -396,13 +467,13 @@ static Image *ReadXWDImage(const ImageIn
       ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
      }
   count=ReadBlob(image,length,(unsigned char *) ximage->data);
-  if (count == 0)
+  if (count != (ssize_t) length)
     {
       if (header.ncolors != 0)
         colors=(XColor *) RelinquishMagickMemory(colors);
       ximage->data=DestroyString(ximage->data);
       ximage=(XImage *) RelinquishMagickMemory(ximage);
-      ThrowReaderException(CorruptImageError,"UnexpectedEndOfFile");
+      ThrowReaderException(CorruptImageError,"UnableToReadImageData");
     }
   /*
     Convert image to MIFF format.
@@ -410,6 +481,16 @@ static Image *ReadXWDImage(const ImageIn
   image->columns=(size_t) ximage->width;
   image->rows=(size_t) ximage->height;
   image->depth=8;
+  status=SetImageExtent(image,image->columns,image->rows);
+  if (status == MagickFalse)
+    {
+      if (header.ncolors != 0)
+        colors=(XColor *) RelinquishMagickMemory(colors);
+      ximage->data=DestroyString(ximage->data);
+      ximage=(XImage *) RelinquishMagickMemory(ximage);
+      InheritException(exception,&image->exception);
+      return(DestroyImageList(image));
+    }
   if ((header.ncolors == 0U) || (ximage->red_mask != 0) ||
       (ximage->green_mask != 0) || (ximage->blue_mask != 0))
     image->storage_class=DirectClass;
@@ -469,15 +550,16 @@ static Image *ReadXWDImage(const ImageIn
             for (x=0; x < (ssize_t) image->columns; x++)
             {
               pixel=XGetPixel(ximage,(int) x,(int) y);
-              index=(IndexPacket) ((pixel >> red_shift) & red_mask);
-              SetPixelRed(q,ScaleShortToQuantum(colors[(ssize_t)
-                index].red));
-              index=(IndexPacket) ((pixel >> green_shift) & green_mask);
+              index=ConstrainColormapIndex(image,(ssize_t) (pixel >>
+                red_shift) & red_mask);
+              SetPixelRed(q,ScaleShortToQuantum(colors[(ssize_t) index].red));
+              index=ConstrainColormapIndex(image,(ssize_t) (pixel >>
+                green_shift) & green_mask);
               SetPixelGreen(q,ScaleShortToQuantum(colors[(ssize_t)
                 index].green));
-              index=(IndexPacket) ((pixel >> blue_shift) & blue_mask);
-              SetPixelBlue(q,ScaleShortToQuantum(colors[(ssize_t)
-                index].blue));
+              index=ConstrainColormapIndex(image,(ssize_t) (pixel >>
+                blue_shift) & blue_mask);
+              SetPixelBlue(q,ScaleShortToQuantum(colors[(ssize_t) index].blue));
               q++;
             }
             if (SyncAuthenticPixels(image,exception) == MagickFalse)
@@ -497,23 +579,23 @@ static Image *ReadXWDImage(const ImageIn
             {
               pixel=XGetPixel(ximage,(int) x,(int) y);
               color=(pixel >> red_shift) & red_mask;
-              color=(color*65535UL)/red_mask;
-              SetPixelRed(q,ScaleShortToQuantum((unsigned short)
-                color));
+              if (red_mask != 0)
+                color=(color*65535UL)/red_mask;
+              SetPixelRed(q,ScaleShortToQuantum((unsigned short) color));
               color=(pixel >> green_shift) & green_mask;
-              color=(color*65535UL)/green_mask;
-              SetPixelGreen(q,ScaleShortToQuantum((unsigned short)
-                color));
+              if (green_mask != 0)
+                color=(color*65535UL)/green_mask;
+              SetPixelGreen(q,ScaleShortToQuantum((unsigned short) color));
               color=(pixel >> blue_shift) & blue_mask;
-              color=(color*65535UL)/blue_mask;
-              SetPixelBlue(q,ScaleShortToQuantum((unsigned short)
-                color));
+              if (blue_mask != 0)
+                color=(color*65535UL)/blue_mask;
+              SetPixelBlue(q,ScaleShortToQuantum((unsigned short) color));
               q++;
             }
             if (SyncAuthenticPixels(image,exception) == MagickFalse)
               break;
             status=SetImageProgress(image,LoadImageTag,(MagickOffsetType) y,
-                image->rows);
+              image->rows);
             if (status == MagickFalse)
               break;
           }
@@ -546,8 +628,8 @@ static Image *ReadXWDImage(const ImageIn
           indexes=GetAuthenticIndexQueue(image);
           for (x=0; x < (ssize_t) image->columns; x++)
           {
-            index=ConstrainColormapIndex(image,XGetPixel(ximage,(int) x,
-              (int) y));
+            index=ConstrainColormapIndex(image,(ssize_t) XGetPixel(ximage,(int)
+              x,(int) y));
             SetPixelIndex(indexes+x,index);
             SetPixelRGBO(q,image->colormap+(ssize_t) index);
             q++;
@@ -692,15 +774,18 @@ static MagickBooleanType WriteXWDImage(c
     bits_per_pixel,
     bytes_per_line,
     length,
-    lsb_first,
     scanline_pad;
 
   ssize_t
+    count,
     y;
 
   unsigned char
     *pixels;
 
+  unsigned long
+    lsb_first;
+
   XWDFileHeader
     xwd_info;
 
@@ -708,20 +793,24 @@ static MagickBooleanType WriteXWDImage(c
     Open output image file.
   */
   assert(image_info != (const ImageInfo *) NULL);
-  assert(image_info->signature == MagickSignature);
+  assert(image_info->signature == MagickSignature);
   assert(image != (Image *) NULL);
-  assert(image->signature == MagickSignature);
+  assert(image->signature == MagickSignature);
   if (image->debug != MagickFalse)
     (void) LogMagickEvent(TraceEvent,GetMagickModule(),"%s",image->filename);
   status=OpenBlob(image_info,image,WriteBinaryBlobMode,&image->exception);
   if (status == MagickFalse)
     return(status);
-  if (IssRGBCompatibleColorspace(image->colorspace) == MagickFalse)
-    (void) TransformImageColorspace(image,sRGBColorspace);
+  if ((image->columns != (CARD32) image->columns) ||
+      (image->rows != (CARD32) image->rows))
+    ThrowWriterException(ImageError,"WidthOrHeightExceedsLimit");
+  if ((image->storage_class == PseudoClass) && (image->colors > 256))
+    (void) SetImageType(image,TrueColorType);
+  (void) TransformImageColorspace(image,sRGBColorspace);
   /*
     Initialize XWD file header.
   */
-  (void) ResetMagickMemory(&xwd_info,0,sizeof(xwd_info));
+  (void) memset(&xwd_info,0,sizeof(xwd_info));
   xwd_info.header_size=(CARD32) sz_XWDheader;
   value=GetImageProperty(image,"comment");
   if (value != (const char *) NULL)
@@ -784,7 +873,7 @@ static MagickBooleanType WriteXWDImage(c
       /*
         Dump colormap to file.
       */
-      (void) ResetMagickMemory(&color,0,sizeof(color));
+      (void) memset(&color,0,sizeof(color));
       colors=(XColor *) AcquireQuantumMemory((size_t) image->colors,
         sizeof(*colors));
       if (colors == (XColor *) NULL)
@@ -801,8 +890,8 @@ static MagickBooleanType WriteXWDImage(c
           {
             MSBOrderLong((unsigned char *) &colors[i].pixel,
               sizeof(colors[i].pixel));
-            MSBOrderShort((unsigned char *) &colors[i].red,
-              3*sizeof(colors[i].red));
+            MSBOrderShort((unsigned char *) &colors[i].red,3*
+              sizeof(colors[i].red));
           }
       }
       for (i=0; i < (ssize_t) image->colors; i++)
@@ -812,7 +901,9 @@ static MagickBooleanType WriteXWDImage(c
         color.green=colors[i].green;
         color.blue=colors[i].blue;
         color.flags=(CARD8) colors[i].flags;
-        (void) WriteBlob(image,sz_XWDColor,(unsigned char *) &color);
+        count=WriteBlob(image,sz_XWDColor,(unsigned char *) &color);
+        if (count != (ssize_t) sz_XWDColor)
+          break;
       }
       colors=(XColor *) RelinquishMagickMemory(colors);
     }
@@ -825,7 +916,7 @@ static MagickBooleanType WriteXWDImage(c
   pixels=(unsigned char *) AcquireQuantumMemory(length,sizeof(*pixels));
   if (pixels == (unsigned char *) NULL)
     ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
-  (void) ResetMagickMemory(pixels,0,length);
+  (void) memset(pixels,0,length);
   /*
     Convert MIFF to XWD raster pixels.
   */
@@ -852,7 +943,10 @@ static MagickBooleanType WriteXWDImage(c
       }
     for (x=0; x < (ssize_t) scanline_pad; x++)
       *q++='\0';
-    (void) WriteBlob(image,(size_t) (q-pixels),pixels);
+    length=(size_t) (q-pixels);
+    count=WriteBlob(image,length,pixels);
+    if (count != (ssize_t) length)
+      break;
     status=SetImageProgress(image,SaveImageTag,(MagickOffsetType) y,
       image->rows);
     if (status == MagickFalse)
@@ -860,6 +954,6 @@ static MagickBooleanType WriteXWDImage(c
   }
   pixels=(unsigned char *) RelinquishMagickMemory(pixels);
   (void) CloseBlob(image);
-  return(MagickTrue);
+  return(y < (ssize_t) image->rows ? MagickFalse :  MagickTrue);
 }
 #endif

Places

File ImageMagick-xwd.c-update.patch of Package ImageMagick.17345

Places