File GraphicsMagick-1.1.7-debian-fixed.patch of Package GraphicsMagick

Overview Repositories Revisions Requests Users Attributes Meta

File GraphicsMagick-1.1.7-debian-fixed.patch of Package GraphicsMagick (Revision 5a08bbcf5bfdab2d311ffdc19ba452bd)

Currently displaying revision 5a08bbcf5bfdab2d311ffdc19ba452bd , Show latest

--- graphicsmagick-1.1.7.orig/magick/tempfile.h
+++ graphicsmagick-1.1.7/magick/tempfile.h
@@ -26,6 +26,7 @@
 
 MagickExport unsigned int
   AcquireTemporaryFileName(char *filename),
+  AcquireTemporarySymlink(char *linkname, const char *name),
   LiberateTemporaryFile(char *filename);
 
 MagickExport int
--- graphicsmagick-1.1.7.orig/magick/symbols.h
+++ graphicsmagick-1.1.7/magick/symbols.h
@@ -30,6 +30,7 @@
 #define AcquireTemporaryFileDescriptor GmAcquireTemporaryFileDescriptor
 #define AcquireTemporaryFileName GmAcquireTemporaryFileName
 #define AcquireTemporaryFileStream GmAcquireTemporaryFileStream
+#define AcquireTemporarySymlink GmAcquireTemporarySymlink
 #define AdaptiveThresholdImage GmAdaptiveThresholdImage
 #define AddDefinitions GmAddDefinitions
 #define AddNoiseImage GmAddNoiseImage
--- graphicsmagick-1.1.7.orig/magick/utility.h
+++ graphicsmagick-1.1.7/magick/utility.h
@@ -61,6 +61,7 @@
   *AllocateString(const char *),
   *Base64Encode(const unsigned char *,const size_t,size_t *),
   *EscapeString(const char *,const char),
+  *FormatStringNumeric(const char *,int),
   *GetPageGeometry(const char *),
   **ListFiles(const char *,const char *,long *),
   *SetClientName(const char *),
--- graphicsmagick-1.1.7.orig/magick/attribute.c
+++ graphicsmagick-1.1.7/magick/attribute.c
@@ -1311,7 +1311,7 @@
               offset;
 
             offset=(size_t) Read32u(morder,pval);
-            if ((offset < length) || (level < (DE_STACK_SIZE-2)))
+            if ((offset < length) && (level < (DE_STACK_SIZE-2)))
               {
                 /*
                   Push our current directory state onto the stack.
--- graphicsmagick-1.1.7.orig/magick/blob.c
+++ graphicsmagick-1.1.7/magick/blob.c
@@ -2130,31 +2130,13 @@
 static void FormMultiPartFilename(Image *image, const ImageInfo *image_info)
 {
   char
-    filename[MaxTextExtent],
+    *filename,
     *p;
 
   /*
     Form filename for multi-part images.
   */
-  (void) strncpy(filename,image->filename,MaxTextExtent-1);
-  for (p=strchr(filename,'%'); p != (char *) NULL; p=strchr(p+1,'%'))
-    {
-      char
-        *q;
-
-      q=p+1;
-      if (*q == '0')
-        (void) strtol(q,&q,10);
-      if (*q == 'd')
-        {
-          char
-            format[MaxTextExtent];
-
-          (void) strncpy(format,p,MaxTextExtent-1);
-          FormatString(p,format,GetImageIndexInList(image));
-          break;
-        }
-    }
+  filename=FormatStringNumeric(image->filename,GetImageIndexInList(image));
   if (!image_info->adjoin)
     if ((image->previous != (Image *) NULL) ||
         (image->next != (Image *) NULL))
@@ -2167,6 +2149,7 @@
                          MaxTextExtent-1);
       }
   (void) strncpy(image->filename,filename,MaxTextExtent-1);
+  MagickFreeMemory(filename);
 }
 
 MagickExport unsigned int OpenBlob(const ImageInfo *image_info,Image *image,
--- graphicsmagick-1.1.7.orig/magick/command.c
+++ graphicsmagick-1.1.7/magick/command.c
@@ -437,16 +437,17 @@
           if (first_scene != last_scene)
             {
               char
-                filename[MaxTextExtent];
+                *filename;
 
               /*
                 Form filename for multi-part images.
               */
-              FormatString(filename,image_info->filename,scene);
+              filename=FormatStringNumeric(image_info->filename,scene);
               if (LocaleCompare(filename,image_info->filename) == 0)
                 FormatString(filename,"%.1024s[%lu]",image_info->filename,
                   scene);
               (void) strncpy(image_info->filename,filename,MaxTextExtent-1);
+	      MagickFreeMemory(filename);
             }
           image_info->colorspace=quantize_info->colorspace;
           image_info->dither=quantize_info->dither;
@@ -5337,15 +5338,16 @@
           if (first_scene != last_scene)
             {
               char
-                filename[MaxTextExtent];
+                *filename;
 
               /*
                 Form filename for multi-part images.
               */
-              FormatString(filename,image_info->filename,scene);
+              filename=FormatStringNumeric(image_info->filename,scene);
               if (LocaleCompare(filename,image_info->filename) == 0)
                 FormatString(filename,"%.1024s.%lu",image_info->filename,scene);
               (void) strncpy(image_info->filename,filename,MaxTextExtent-1);
+	      MagickFreeMemory(filename);
             }
           (void) strcpy(image_info->magick,"MIFF");
           image_info->colorspace=quantize_info->colorspace;
@@ -11916,15 +11918,16 @@
           if (first_scene != last_scene)
             {
               char
-                filename[MaxTextExtent];
+                *filename;
 
               /*
                 Form filename for multi-part images.
               */
-              FormatString(filename,image_info->filename,scene);
+              filename=FormatStringNumeric(image_info->filename,scene);
               if (LocaleCompare(filename,image_info->filename) == 0)
                 FormatString(filename,"%.1024s.%lu",image_info->filename,scene);
               (void) strncpy(image_info->filename,filename,MaxTextExtent-1);
+	      MagickFreeMemory(filename);
             }
           (void) CloneString(&image_info->font,montage_info->font);
           image_info->colorspace=quantize_info.colorspace;
--- graphicsmagick-1.1.7.orig/magick/constitute.c
+++ graphicsmagick-1.1.7/magick/constitute.c
@@ -2826,7 +2826,8 @@
         will expect that the format reported is that of the input
         file.
       */
-      (void) strncpy(image->magick,magick,MaxTextExtent-1);
+      if (image != (Image *) NULL)
+        (void) strncpy(image->magick,magick,MaxTextExtent-1);
     }
   if (clone_info->temporary)
     {
--- graphicsmagick-1.1.7.orig/magick/delegate.c
+++ graphicsmagick-1.1.7/magick/delegate.c
@@ -342,7 +342,10 @@
   char
     *command,
     **commands,
-    filename[MaxTextExtent];
+    linkedname[MaxTextExtent],
+    linkedinfoname[MaxTextExtent],
+    filename[MaxTextExtent],
+    safechars[]="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.,-_+ /";
 
   const DelegateInfo
     *delegate_info;
@@ -362,6 +365,10 @@
   assert(image != (Image *) NULL);
   assert(image->signature == MagickSignature);
   temporary_image_filename=(*image->filename == '\0');
+  linkedname[0]='\0';
+  linkedname[MaxTextExtent-1]='\0';
+  linkedinfoname[0]='\0';
+  linkedinfoname[MaxTextExtent-1]='\0';
   if (temporary_image_filename)
     {
       /* Allocate a temporary filename if image is unnamed.  */
@@ -371,12 +378,24 @@
           return(False);
         }
     }
+  else if (strspn(image->filename, safechars) != strlen(image->filename))
+    {
+      strncpy(linkedname,image->filename,MaxTextExtent-1);
+      if (!AcquireTemporarySymlink(image->filename,linkedname))
+	{
+          (void) ThrowException(exception,FileOpenError,UnableToCreateTemporaryFile,image->filename);
+	  return (False);
+	}
+    }
+
   (void) strncpy(filename,image->filename,MaxTextExtent-1);
   delegate_info=GetDelegateInfo(decode,encode,exception);
   if (delegate_info == (DelegateInfo *) NULL)
     {
       if (temporary_image_filename)
         LiberateTemporaryFile(image->filename);
+      if (*linkedname)
+	strncpy(image->filename,linkedname,MaxTextExtent-1);
       (void) ThrowException(exception,DelegateError,NoTagFound,
         decode ? decode : encode);
       return(False);
@@ -397,6 +416,18 @@
         }
       image_info->temporary=True;
     }
+  else if (strspn(image_info->filename, safechars) != strlen(image_info->filename))
+    {
+      strncpy(linkedinfoname,image_info->filename,MaxTextExtent-1);
+      if (!AcquireTemporarySymlink(image_info->filename,linkedinfoname))
+	{
+          if (temporary_image_filename)
+            LiberateTemporaryFile(image->filename);
+          (void) ThrowException(exception,FileOpenError,UnableToCreateTemporaryFile,image_info->filename);
+          return(False);
+        }
+      temporary_image_filename=True;
+    }
 
   if (delegate_info->mode != 0)
     if ((decode && (delegate_info->encode != (char *) NULL)) ||
@@ -420,6 +451,13 @@
         {
           if (temporary_image_filename)
             LiberateTemporaryFile(image->filename);
+	  if (*linkedname)
+            strncpy(image->filename,linkedname,MaxTextExtent-1);
+	  if (*linkedinfoname)
+            {
+              LiberateTemporaryFile(linkedinfoname);
+              strncpy(image_info->filename,linkedinfoname,MaxTextExtent-1);
+	    }
           (void) ThrowException(exception,FileOpenError,UnableToCreateTemporaryFile,image_info->unique);
           return(False);
         }
@@ -428,6 +466,13 @@
         {
           if (temporary_image_filename)
             LiberateTemporaryFile(image->filename);
+	  if (*linkedname)
+            strncpy(image->filename,linkedname,MaxTextExtent-1);
+	  if (*linkedinfoname)
+            {
+              LiberateTemporaryFile(linkedinfoname);
+              strncpy(image_info->filename,linkedinfoname,MaxTextExtent-1);
+	    }
           LiberateTemporaryFile(image_info->unique);
           (void) ThrowException(exception,FileOpenError,UnableToCreateTemporaryFile,image_info->zero);
           return(False);
@@ -441,6 +486,13 @@
             LiberateTemporaryFile(image_info->zero);
             if (temporary_image_filename)
               LiberateTemporaryFile(image->filename);
+	    if (*linkedname)
+              strncpy(image->filename,linkedname,MaxTextExtent-1);
+	    if (*linkedinfoname)
+              {
+                LiberateTemporaryFile(linkedinfoname);
+                strncpy(image_info->filename,linkedinfoname,MaxTextExtent-1);
+	      }
             (void) ThrowException(exception,DelegateError,DelegateFailed,
               decode ? decode : encode);
             return(False);
@@ -466,6 +518,13 @@
               LiberateTemporaryFile(image_info->zero);
               if (temporary_image_filename)
                 LiberateTemporaryFile(image->filename);
+	      if (*linkedname)
+                strncpy(image->filename,linkedname,MaxTextExtent-1);
+	      if (*linkedinfoname)
+                {
+                  LiberateTemporaryFile(linkedinfoname);
+                  strncpy(image_info->filename,linkedinfoname,MaxTextExtent-1);
+	        }
               DestroyImageInfo(clone_info);
               (void) ThrowException(exception,DelegateError,DelegateFailed,
                 decode ? decode : encode);
@@ -487,6 +546,13 @@
     {
       if (temporary_image_filename)
         LiberateTemporaryFile(image->filename);
+      if (*linkedname)
+        strncpy(image->filename,linkedname,MaxTextExtent-1);
+      if (*linkedinfoname)
+        {
+          LiberateTemporaryFile(linkedinfoname);
+          strncpy(image_info->filename,linkedinfoname,MaxTextExtent-1);
+        }
       (void) ThrowException(exception,ResourceLimitError,MemoryAllocationFailed,decode ? decode : encode);
       return(False);
     }
@@ -537,6 +603,13 @@
  error_exit:
   if (temporary_image_filename)
     LiberateTemporaryFile(image->filename);
+  if (*linkedname)
+    strncpy(image->filename,linkedname,MaxTextExtent-1);
+  if (*linkedinfoname)
+    {
+      LiberateTemporaryFile(linkedinfoname);
+      strncpy(image_info->filename,linkedinfoname,MaxTextExtent-1);
+    }
   for ( ; commands[i] != (char *) NULL; i++)
     MagickFreeMemory(commands[i]);
   MagickFreeMemory(commands);
--- graphicsmagick-1.1.7.orig/magick/image.c
+++ graphicsmagick-1.1.7/magick/image.c
@@ -6244,16 +6244,19 @@
     }
   if (rectify)
     {
+      char
+        *filename_fmt;
       const MagickInfo
         *magick_info;
 
       /*
         Rectify multi-image file support.
       */
-      FormatString(filename,image_info->filename,0);
-      if ((LocaleCompare(filename,image_info->filename) != 0) &&
-          (strchr(filename,'%') == (char *) NULL))
+      filename_fmt=FormatStringNumeric(image_info->filename,0);
+      if ((LocaleCompare(filename_fmt,image_info->filename) != 0) &&
+          (strchr(filename_fmt,'%') == (char *) NULL))
         image_info->adjoin=False;
+      MagickFreeMemory(filename_fmt);
       magick_info=GetMagickInfo(magic,exception);
       if (magick_info != (const MagickInfo *) NULL)
         image_info->adjoin&=magick_info->adjoin;
--- graphicsmagick-1.1.7.orig/magick/log.c
+++ graphicsmagick-1.1.7/magick/log.c
@@ -517,11 +517,11 @@
       if (log_info->file == (FILE *) NULL)
         {
           char
-            filename[MaxTextExtent];
+            *filename;
 
-          FormatString(filename,log_info->filename,
-            log_info->generation);
+          filename=FormatStringNumeric(log_info->filename,log_info->generation);
           log_info->file=fopen(filename,"w");
+	  MagickFreeMemory(filename);
           if (log_info->file == (FILE *) NULL)
             {
               LiberateSemaphoreInfo(&log_semaphore);
@@ -569,11 +569,11 @@
       if (log_info->file == (FILE *) NULL)
         {
           char
-            filename[MaxTextExtent];
+            *filename;
 
-          FormatString(filename,log_info->filename,
-            log_info->generation);
+          filename=FormatStringNumeric(log_info->filename,log_info->generation);
           log_info->file=fopen(filename,"w");
+	  MagickFreeMemory(filename);
           if (log_info->file == (FILE *) NULL)
             {
               LiberateSemaphoreInfo(&log_semaphore);
--- graphicsmagick-1.1.7.orig/magick/montage.c
+++ graphicsmagick-1.1.7/magick/montage.c
@@ -696,7 +696,7 @@
                   break;
                 for (columns=0; columns < Min(tile_info.x,4); columns++)
                 {
-                  Modulate(0.0,0.0,-25.0+4*columns,&q->red,&q->green,&q->blue);
+                  Modulate(0.0,0.0,53.0,&q->red,&q->green,&q->blue);
                   q++;
                 }
                 if (!SyncImagePixels(montage))
@@ -710,7 +710,7 @@
                   break;
                 for (columns=0; columns < (long) image->columns; columns++)
                 {
-                  Modulate(0.0,0.0,-25.0+4*rows,&q->red,&q->green,&q->blue);
+                  Modulate(0.0,0.0,53.0,&q->red,&q->green,&q->blue);
                   q++;
                 }
                 if (!SyncImagePixels(montage))
--- graphicsmagick-1.1.7.orig/magick/tempfile.c
+++ graphicsmagick-1.1.7/magick/tempfile.c
@@ -197,6 +197,93 @@
 %                                                                             %
 %                                                                             %
 %                                                                             %
++   A c q u i r e T e m p o r a r y S y m l i n k                             %
+%                                                                             %
+%                                                                             %
+%                                                                             %
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%
+% AcquireTemporarySymlink replaces the contents of the string buffer pointed
+% to by filename with the unique name of a symbolic link.  True is returned
+% if a symlink waas created, or False is returned if there is a failure.
+% The allocated symlink should be recovered via the LiberateTemporaryFile()
+% function once it is no longer required.
+%
+% The format of the AcquireTemporarySymlink method is:
+%
+%     unsigned int AcquireTemporarySymlink(char *linkname, const char *name,
+%                                          ExceptionInfo *exception)
+%
+%  A description of each parameter follows.
+%
+%   o linkname: Specifies a pointer to an array of characters that must be
+%               MaxTextExtent characters of size.  The unique
+%               name of the symlink is returned in this array.
+%   o name: Specifies a file name the symlink should point to.
+*/
+MagickExport unsigned int AcquireTemporarySymlink(char *linkname, const char *name)
+{
+  char
+    *tempdir,
+    tempname[MaxTextExtent];
+
+  int
+    fd,
+    tries;
+  
+  assert(linkname != (char *)NULL);
+  linkname[0]='\0';
+  tempname[MaxTextExtent-1]='\0';
+
+  tempdir=getenv("MAGICK_TMPDIR");
+#if defined(POSIX)
+  if (!tempdir)
+    tempdir=getenv("TMPDIR");
+#endif /* POSIX */
+#if defined(WIN32)
+  if (!tempdir)
+    tempdir=getenv("TMP");
+  if (!tempdir)
+    tempdir=getenv("TEMP");
+#endif /* WIN32 */
+#if defined(P_tmpdir)
+  if (!tempdir)
+    tempdir=P_tmpdir;
+#endif
+
+  for (tries=0; tries < 15; tries++)
+    {
+      strncpy(tempname,"gmXXXXXX",MaxTextExtent-1);
+      ComposeTemporaryFileName(tempname);
+      strncpy(linkname,tempdir,MaxTextExtent-1);
+      if (tempdir[strlen(tempdir)-1] != DirectorySeparator[0])
+	strncat(linkname,DirectorySeparator,MaxTextExtent-1);
+      strncat(linkname,tempname,MaxTextExtent-1);
+      if (*name == '/')
+        fd=symlink(name, linkname);
+      else
+        {
+          char cname[MaxTextExtent];
+	  if (!getcwd(cname,(size_t)MaxTextExtent))
+	    return (False);
+	  strncat(cname,DirectorySeparator,MaxTextExtent-1);
+	  strncat(cname,name,MaxTextExtent-1);
+	  fd=symlink(cname,linkname);
+	}
+      if (fd != -1)
+	{
+	  AddTemporaryFileToList(linkname);
+	  return (True);
+	}
+    }
+  return (False);
+}
+
+/*
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%                                                                             %
+%                                                                             %
+%                                                                             %
 +   A c q u i r e T e m p o r a r y F i l e D e s c r i p t o r               %
 %                                                                             %
 %                                                                             %
--- graphicsmagick-1.1.7.orig/magick/utility.c
+++ graphicsmagick-1.1.7/magick/utility.c
@@ -1134,6 +1134,72 @@
 %                                                                             %
 %                                                                             %
 %                                                                             %
+%  F o r m a t S t r i n g N u m e r i c                                      %
+%                                                                             %
+%                                                                             %
+%                                                                             %
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%
+%  Method FormatStringNumeric formats output for a single numeric argument.
+%  It takes into account that the format string given might be untrusted
+%  user input, and returns a pointer to the formatted string.
+%
+%  The format of the FormatStringNumeric method is:
+%
+%      char * FormatStringNumeric(char *string,const char *format,int value)
+%
+%  A description of each parameter follows.
+%
+%   o  format:  A string describing the format to use to write the numeric
+%      argument. Only the first numeric format identifier is replaced.
+%
+%   o  value:  Numeric value to substitute into format string.
+%
+%
+*/
+MagickExport char *FormatStringNumeric(const char *format,int value)
+{
+  char
+    *p,
+    *string;
+
+  string = NULL;
+
+  (void) CloneString(&string, format);
+
+  for (p=strchr(format,'%'); p != (char *) NULL; p=strchr(p+1,'%'))
+  {  
+    char
+      *q;
+
+    q=(char *) p+1;
+    if (*q == '0')
+      (void) strtol(q,&q,10);
+    if ((*q == '%') || (*q == 'd') || (*q == 'o') || (*q == 'x'))
+    {
+      char
+        c;
+
+      q++;
+      c=*q;
+      *q='\0';
+      (void) snprintf(string+(p-format),MaxTextExtent-(p-format),p,value);
+      *q=c;
+      (void) ConcatenateString(&string,q);
+      if (*(q-1) == '%')
+        p++;
+      else
+        break;
+    }
+  }
+  return string;
+}
+
+/*
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%                                                                             %
+%                                                                             %
+%                                                                             %
 %   G e t E x e c u t i o n P a t h                                           %
 %                                                                             %
 %                                                                             %
--- graphicsmagick-1.1.7.orig/configure.ac
+++ graphicsmagick-1.1.7/configure.ac
@@ -2370,7 +2370,7 @@
   GMDelegate="${GMDelegateDefault}"
   GnuplotDecodeDelegate="$GnuplotDecodeDelegateDefault"
   HPGLDecodeDelegate="$HPGLDecodeDelegateDefault"
-  HTMLDecodeDelegate="$HTMLDecodeDelegatDefault"
+  HTMLDecodeDelegate="$HTMLDecodeDelegateDefault"
   ILBMDecodeDelegate="$ILBMDecodeDelegateDefault"
   ILBMEncodeDelegate="$ILBMEncodeDelegateDefault"
   LPDelegate="$LPDelegateDefault"
--- graphicsmagick-1.1.7.orig/configure
+++ graphicsmagick-1.1.7/configure
@@ -35374,7 +35374,7 @@
   GMDelegate="${GMDelegateDefault}"
   GnuplotDecodeDelegate="$GnuplotDecodeDelegateDefault"
   HPGLDecodeDelegate="$HPGLDecodeDelegateDefault"
-  HTMLDecodeDelegate="$HTMLDecodeDelegatDefault"
+  HTMLDecodeDelegate="$HTMLDecodeDelegateDefault"
   ILBMDecodeDelegate="$ILBMDecodeDelegateDefault"
   ILBMEncodeDelegate="$ILBMEncodeDelegateDefault"
   LPDelegate="$LPDelegateDefault"
--- graphicsmagick-1.1.7.orig/coders/dcm.c
+++ graphicsmagick-1.1.7/coders/dcm.c
@@ -3022,7 +3022,7 @@
             /*
               Photometric interpretation.
             */
-            for (i=0; i < (long) length; i++)
+            for (i=0; i < (long) Min(length, MaxTextExtent-1); i++)
               photometric[i]=data[i];
             photometric[i]='\0';
             break;
--- graphicsmagick-1.1.7.orig/coders/palm.c
+++ graphicsmagick-1.1.7/coders/palm.c
@@ -541,7 +541,8 @@
         image->compression = RLECompression;
         for (i = 0; i < (long) bytes_per_row; )
           {
           count = ReadBlobByte(image);
+          count = Min(count, bytes_per_row-i);
           byte = ReadBlobByte(image);
           memset(one_row + i, (int) byte, count);
           i += count;
@@ -579,6 +579,8 @@
     indexes=GetIndexes(image);
     if(bits_per_pixel == 16)
       {
+      if (image->columns > 2*bytes_per_row)
+        ThrowReaderException(CorruptImageError,CorruptImage,image);
       for (x=0; x < (long) image->columns; x++)
         {
         color16 = (*ptr++ << 8);
@@ -595,6 +597,8 @@
       bit = 8 - bits_per_pixel;
       for(x = 0; x < (long) image->columns; x++)
         {
+	if (ptr - one_row >= bytes_per_row)
+          ThrowReaderException(CorruptImageError,CorruptImage,image);
         index =(IndexPacket) (mask - (((*ptr) & (mask << bit)) >> bit));
         indexes[x] = index;
         *q++ = image->colormap[index];
--- graphicsmagick-1.1.7.orig/coders/sgi.c
+++ graphicsmagick-1.1.7/coders/sgi.c
@@ -144,8 +144,9 @@
 %
 */
 
-static void SGIDecode(const unsigned long bytes_per_pixel,
-  unsigned char *max_packets,unsigned char *pixels)
+static int SGIDecode(const unsigned long bytes_per_pixel,
+  unsigned char *max_packets,unsigned char *pixels,
+  unsigned long npackets,unsigned long npixels)
 {
   long
     count;
@@ -163,20 +164,29 @@
     {
       for ( ; ; )
       {
+        if (npackets-- == 0)
+	  return -1;
         pixel=(*p++) << 8;
         pixel|=(*p++);
         count=(long) (pixel & 0x7f);
         if (count == 0)
           break;
+	if (count > npixels)
+	  return -1;
+	npixels -= count;
         if (pixel & 0x80)
           for ( ; count != 0; count--)
           {
+	    if (npackets-- == 0)
+	      return -1;
             *q=(*p++);
             *(q+1)=(*p++);
             q+=8;
           }
         else
           {
+	    if (npackets-- == 0)
+	      return -1;
             pixel=(*p++) << 8;
             pixel|=(*p++);
             for ( ; count != 0; count--)
@@ -187,22 +197,31 @@
             }
           }
       }
-      return;
+      return 0;
     }
   for ( ; ; )
   {
+    if (npackets-- == 0)
+      return -1;
     pixel=(*p++);
     count=(long) (pixel & 0x7f);
     if (count == 0)
       break;
+    if (count > npixels)
+      return -1;
+    npixels -= count;
     if (pixel & 0x80)
       for ( ; count != 0; count--)
       {
+        if (npackets-- == 0)
+          return -1;
         *q=(*p++);
         q+=4;
       }
     else
       {
+        if (npackets-- == 0)
+          return -1;
         pixel=(*p++);
         for ( ; count != 0; count--)
         {
@@ -211,6 +230,7 @@
         }
       }
   }
+  return 0;
 }
 
 static Image *ReadSGIImage(const ImageInfo *image_info,ExceptionInfo *exception)
@@ -274,18 +294,22 @@
     if (iris_info.storage == 0x01)
       image->compression=RLECompression;
     iris_info.bytes_per_pixel=ReadBlobByte(image);
+    if (iris_info.bytes_per_pixel > 2 || iris_info.bytes_per_pixel == 0)
+      ThrowReaderException(CorruptImageError,ImproperImageHeader,image);
     iris_info.dimension=ReadBlobMSBShort(image);
     iris_info.columns=ReadBlobMSBShort(image);
     iris_info.rows=ReadBlobMSBShort(image);
     iris_info.depth=ReadBlobMSBShort(image);
-    image->columns=iris_info.columns;
-    image->rows=iris_info.rows;
-    image->depth=iris_info.depth <= 8 ? 8 : QuantumDepth;
+    if (iris_info.depth > 4 || iris_info.depth == 0)
+      ThrowReaderException(CorruptImageError,ImproperImageHeader,image);
     if (iris_info.depth < 3)
       {
         image->storage_class=PseudoClass;
         image->colors=256;
       }
+    image->columns=iris_info.columns;
+    image->rows=iris_info.rows;
+    image->depth=bytes_per_pixel == 1 ? 8 : QuantumDepth;
     if (image_info->ping && (image_info->subrange != 0))
       if (image->scene >= (image_info->subimage+image_info->subrange-1))
         break;
@@ -298,6 +322,8 @@
     */
     bytes_per_pixel=iris_info.bytes_per_pixel;
     number_pixels=iris_info.columns*iris_info.rows;
+    if (4*bytes_per_pixel*number_pixels < number_pixels) /* Overflow? */
+      ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,image);
     iris_pixels=MagickAllocateMemory(unsigned char *,
       4*bytes_per_pixel*number_pixels);
     if (iris_pixels == (unsigned char *) NULL)
@@ -368,7 +394,11 @@
         for (i=0; i < (int) (iris_info.rows*iris_info.depth); i++)
           offsets[i]=ReadBlobMSBLong(image);
         for (i=0; i < (int) (iris_info.rows*iris_info.depth); i++)
-          runlength[i]=ReadBlobMSBLong(image);
+	  {
+            runlength[i]=ReadBlobMSBLong(image);
+	    if (runlength[i] > 4*iris_info.columns+10)
+	      ThrowReaderException(CorruptImageError,ImproperImageHeader,image); 
+	  }
         /*
           Check data order.
         */
@@ -381,7 +411,7 @@
               data_order=1;
             offset=offsets[y+z*iris_info.rows];
           }
-        offset=512+4*bytes_per_pixel*2*(iris_info.rows*iris_info.depth);
+        offset=TellBlob(image);
         if (data_order == 1)
           {
             for (z=0; z < (int) iris_info.depth; z++)
@@ -397,7 +427,11 @@
                 (void) ReadBlob(image,runlength[y+z*iris_info.rows],
                   (char *) max_packets);
                 offset+=runlength[y+z*iris_info.rows];
-                SGIDecode(bytes_per_pixel,max_packets,p+bytes_per_pixel*z);
+                if (SGIDecode(bytes_per_pixel,max_packets,p+bytes_per_pixel*z,
+		              runlength[y+z*iris_info.rows]/bytes_per_pixel,
+                              iris_info.columns) == -1)
+	          ThrowReaderException(CorruptImageError,ImproperImageHeader,
+		                       image); 
                 p+=(iris_info.columns*4*bytes_per_pixel);
               }
             }
@@ -417,7 +451,11 @@
                 (void) ReadBlob(image,runlength[y+z*iris_info.rows],
                   (char *) max_packets);
                 offset+=runlength[y+z*iris_info.rows];
-                SGIDecode(bytes_per_pixel,max_packets,p+bytes_per_pixel*z);
+                if (SGIDecode(bytes_per_pixel,max_packets,p+bytes_per_pixel*z,
+		              runlength[y+z*iris_info.rows]/bytes_per_pixel,
+                              iris_info.columns) == -1)
+	          ThrowReaderException(CorruptImageError,ImproperImageHeader,
+		                       image); 
               }
               p+=(iris_info.columns*4*bytes_per_pixel);
             }
--- graphicsmagick-1.1.7.orig/coders/wpg.c
+++ graphicsmagick-1.1.7/coders/wpg.c
@@ -1201,13 +1201,20 @@
     /*
       Rewind list, removing any empty images while rewinding.
     */   
-    for (p=image; p != (Image *) NULL; p=p->previous)
+    p=image;
+    image=NULL;
+    while (p != (Image *) NULL)
       {
-        if ((p->rows == 0) || (p->columns == 0))
-          DeleteImageFromList(&p);
-        image=p;
+        Image *tmp=p;
+        if ((p->rows == 0) || (p->columns == 0)) {
+          p=p->previous;
+          DeleteImageFromList(&tmp);
+	} else {
+          image=p;
+          p=p->previous;
+        }
       }
-    
+
     /*
       Fix scene numbers
     */
--- graphicsmagick-1.1.7.orig/coders/xcf.c
+++ graphicsmagick-1.1.7/coders/xcf.c
@@ -258,14 +258,15 @@
 %
 %    o string: The address of a character buffer.
 %
+%    o max: Size of the 'string' buffer.
 %
 */
-static char *ReadBlobStringWithLongSize(Image *image,char *string)
+static char *ReadBlobStringWithLongSize(Image *image,char *string,size_t max)
 {
   int
     c;
 
-  register long
+  register unsigned long
     i;
 
   unsigned long
@@ -273,8 +274,11 @@
 
   assert(image != (Image *) NULL);
   assert(image->signature == MagickSignature);
-  length = ReadBlobMSBLong(image);
-  for (i=0; i < (long) length; i++)
+  if (max == 0)
+    return((char *) NULL);
+  max--;
+  length = (unsigned long) ReadBlobMSBLong(image);
+  for (i=0; i < Min(length, max); i++)
   {
     c=ReadBlobByte(image);
     if (c == EOF)
@@ -282,6 +286,7 @@
     string[i]=c;
   }
   string[i]='\0';
+  SeekBlob(image, length-i, SEEK_CUR);
   return(string);
 }
 
@@ -692,7 +697,7 @@
   outLayer->width = ReadBlobMSBLong(image);
   outLayer->height = ReadBlobMSBLong(image);
   outLayer->type = ReadBlobMSBLong(image);
-  ReadBlobStringWithLongSize(image, outLayer->name);
+  ReadBlobStringWithLongSize(image, outLayer->name, sizeof(outLayer->name));
 
   /* allocate the image for this layer */
   outLayer->image=CloneImage(image,outLayer->width, outLayer->height,True,
@@ -936,7 +941,7 @@
   image->matte=True;  /* XCF always has a matte! */
 
   /* read properties */
-  while ( !foundPropEnd ) {
+  while ( !foundPropEnd && !EOFBlob(image)) {
   PropType    prop_type = (PropType) ReadBlobMSBLong(image);
   unsigned long  prop_size = ReadBlobMSBLong(image);
 
@@ -1079,31 +1084,19 @@
         /*float  factor = (float) */ (void) ReadBlobMSBLong(image);
         /* unsigned long digits =  */ (void) ReadBlobMSBLong(image);
         for (i=0; i<5; i++)
-         ReadBlobStringWithLongSize(image, unit_string);
+         ReadBlobStringWithLongSize(image, unit_string, sizeof(unit_string));
       }
      break;
 
     default:
-      /* g_message ("unexpected/unknown image property: %d (skipping)",
-         prop_type); */
-
-      {
-      int buf[16];
-      long amount;
-
-      /* read over it... */
-      while (prop_size > 0)
-        {
-        amount = (long) Min (16, prop_size);
-        for (i=0; i<(unsigned long) amount; i++)
-        amount = (long) ReadBlob(image, amount, &buf);
-        prop_size -= Min (16, amount);
-        }
-      }
+      SeekBlob(image, prop_size, SEEK_CUR);
       break;
   }
   }
 
+  if (!foundPropEnd)
+    ThrowReaderException(CorruptImageError,ImproperImageHeader,image);
+
   if (image_info->ping && (image_info->subrange != 0)) {
   ; /* do nothing, we were just pinging! */
   } else {
--- graphicsmagick-1.1.7.orig/tests/drawtest.c
+++ graphicsmagick-1.1.7/tests/drawtest.c
@@ -367,6 +367,7 @@
       exit( 1 );
     }
 
+  outfile[MaxTextExtent-1]='\0';
   (void) strncpy( outfile, argv[1], MaxTextExtent-1 );
 
   if (LocaleNCompare("drawtest",argv[0],7) == 0)
@@ -401,7 +402,8 @@
   /*
    * Save image to file
    */
-  (void) strncpy( canvas->filename, outfile, sizeof(image_info->filename)-1);
+  canvas->filename[MaxTextExtent-1]='\0';
+  (void) strncpy( canvas->filename, outfile, MaxTextExtent-1);
   WriteImage ( image_info, canvas );
 
   DestroyExceptionInfo( &exception );

Places

File GraphicsMagick-1.1.7-debian-fixed.patch of Package GraphicsMagick (Revision 5a08bbcf5bfdab2d311ffdc19ba452bd)

Places