File ImageMagick-CVE-2017-14224.patch of Package ImageMagick.29424

Overview Repositories Revisions Requests Users Attributes Meta

File ImageMagick-CVE-2017-14224.patch of Package ImageMagick.29424

Index: ImageMagick-6.8.8-1/coders/pcx.c
===================================================================
--- ImageMagick-6.8.8-1.orig/coders/pcx.c	2018-02-06 11:27:03.680476954 +0100
+++ ImageMagick-6.8.8-1/coders/pcx.c	2018-02-06 11:27:29.780915649 +0100
@@ -929,6 +929,8 @@ static MagickBooleanType WritePCXImage(c
   status=OpenBlob(image_info,image,WriteBinaryBlobMode,&image->exception);
   if (status == MagickFalse)
     return(status);
+  if ((image->columns > 65535UL) || (image->rows > 65535UL))
+    ThrowWriterException(ImageError,"WidthOrHeightExceedsLimit");
   if (IssRGBCompatibleColorspace(image->colorspace) == MagickFalse)
     (void) TransformImageColorspace(image,sRGBColorspace);
   page_table=(MagickOffsetType *) NULL;
@@ -993,8 +995,10 @@ static MagickBooleanType WritePCXImage(c
         if (image->matte != MagickFalse)
           pcx_info.planes++;
       }
-    pcx_info.bytes_per_line=(unsigned short) (((size_t) image->columns*
-      pcx_info.bits_per_pixel+7)/8);
+    length=(((size_t) image->columns*pcx_info.bits_per_pixel+7)/8);
+    if (length > 65535UL)
+      ThrowWriterException(ImageError,"WidthOrHeightExceedsLimit");
+    pcx_info.bytes_per_line=(unsigned short) length;
     pcx_info.palette_info=1;
     pcx_info.colormap_signature=0x0c;
     /*

Places

File ImageMagick-CVE-2017-14224.patch of Package ImageMagick.29424

Places