File ImageMagick-CVE-2018-16642.patch of Package ImageMagick.8831

Index: ImageMagick-6.8.8-1/coders/cut.c
===================================================================
--- ImageMagick-6.8.8-1.orig/coders/cut.c	2018-09-11 11:52:02.022827506 +0200
+++ ImageMagick-6.8.8-1/coders/cut.c	2018-09-11 11:55:25.523993336 +0200
@@ -94,130 +94,159 @@ typedef struct
 } CUTPalHeader;
 
 
-static void InsertRow(ssize_t depth,unsigned char *p,ssize_t y,Image *image)
+static MagickBooleanType InsertRow(ssize_t bpp,unsigned char *p,ssize_t y,Image *image)
 {
   ExceptionInfo
     *exception;
 
-  size_t bit; ssize_t x;
-  register PixelPacket *q;
-  IndexPacket index;
-  register IndexPacket *indexes;
+  int
+    bit;
+
+  ssize_t
+    x;
+
+  register PixelPacket
+    *q;
+
+  IndexPacket
+    index;
+
+  register IndexPacket
+    *indexes;
 
-  index=(IndexPacket) 0;
   exception=(&image->exception);
-  switch (depth)
-  {
+  q=QueueAuthenticPixels(image,0,y,image->columns,1,exception);
+  if (q == (PixelPacket *) NULL)
+    return(MagickFalse);
+  indexes=GetAuthenticIndexQueue(image);
+  switch (bpp)
+    {
     case 1:  /* Convert bitmap scanline. */
       {
-        q=QueueAuthenticPixels(image,0,y,image->columns,1,exception);
-        if (q == (PixelPacket *) NULL)
-          break;
-        indexes=GetAuthenticIndexQueue(image);
         for (x=0; x < ((ssize_t) image->columns-7); x+=8)
-        {
-          for (bit=0; bit < 8; bit++)
           {
-            index=(IndexPacket) ((((*p) & (0x80 >> bit)) != 0) ? 0x01 : 0x00);
-            SetPixelIndex(indexes+x+bit,index);
+            for (bit=0; bit < 8; bit++)
+              {
+                index=((*p) & (0x80 >> bit) ? 0x01 : 0x00);
+                SetPixelIndex(indexes+x+bit,index);
+                SetPixelRGBO(q,image->colormap+(ssize_t) index);
+                q++;
+              }
+            p++;
           }
-          p++;
-        }
         if ((image->columns % 8) != 0)
           {
-            for (bit=0; bit < (image->columns % 8); bit++)
+            for (bit=0; bit < (ssize_t) (image->columns % 8); bit++)
               {
-                index=(IndexPacket) ((((*p) & (0x80 >> bit)) != 0) ? 0x01 : 0x00);
+                index=((*p) & (0x80 >> bit) ? 0x01 : 0x00);
                 SetPixelIndex(indexes+x+bit,index);
+                SetPixelRGBO(q,image->colormap+(ssize_t) index);
+                q++;
               }
             p++;
           }
-        if (SyncAuthenticPixels(image,exception) == MagickFalse)
-          break;
         break;
       }
     case 2:  /* Convert PseudoColor scanline. */
       {
-        q=QueueAuthenticPixels(image,0,y,image->columns,1,exception);
-        if (q == (PixelPacket *) NULL)
-          break;
-        indexes=GetAuthenticIndexQueue(image);
-        for (x=0; x < ((ssize_t) image->columns-1); x+=2)
-          {
+        if ((image->storage_class != PseudoClass) ||
+            (indexes == (IndexPacket *) NULL))
+          return MagickFalse;
+        for (x=0; x < ((ssize_t) image->columns-3); x+=4)
+        {
             index=ConstrainColormapIndex(image,(*p >> 6) & 0x3);
             SetPixelIndex(indexes+x,index);
+            SetPixelRGBO(q,image->colormap+(ssize_t) index);
+            q++;
             index=ConstrainColormapIndex(image,(*p >> 4) & 0x3);
             SetPixelIndex(indexes+x,index);
+            SetPixelRGBO(q,image->colormap+(ssize_t) index);
+            q++;
             index=ConstrainColormapIndex(image,(*p >> 2) & 0x3);
             SetPixelIndex(indexes+x,index);
+            SetPixelRGBO(q,image->colormap+(ssize_t) index);
+            q++;
             index=ConstrainColormapIndex(image,(*p) & 0x3);
             SetPixelIndex(indexes+x+1,index);
+            SetPixelRGBO(q,image->colormap+(ssize_t) index);
+            q++;
             p++;
-          }
-        if ((image->columns % 4) != 0)
+        }
+       if ((image->columns % 4) != 0)
           {
             index=ConstrainColormapIndex(image,(*p >> 6) & 0x3);
             SetPixelIndex(indexes+x,index);
-            if ((image->columns % 4) >= 1)
-
+            SetPixelRGBO(q,image->colormap+(ssize_t) index);
+            q++;
+            if ((image->columns % 4) > 1)
               {
                 index=ConstrainColormapIndex(image,(*p >> 4) & 0x3);
                 SetPixelIndex(indexes+x,index);
-                if ((image->columns % 4) >= 2)
-
+                SetPixelRGBO(q,image->colormap+(ssize_t) index);
+                q++;
+                if ((image->columns % 4) > 2)
                   {
                     index=ConstrainColormapIndex(image,(*p >> 2) & 0x3);
                     SetPixelIndex(indexes+x,index);
-                  }
-              }
+                    SetPixelRGBO(q,image->colormap+(ssize_t) index);
+                    q++;
+                  } 
+              }   
             p++;
-          }
-        if (SyncAuthenticPixels(image,exception) == MagickFalse)
-          break;
+          } 
         break;
-      }
-
+      } 
+      
     case 4:  /* Convert PseudoColor scanline. */
       {
-        q=QueueAuthenticPixels(image,0,y,image->columns,1,exception);
-        if (q == (PixelPacket *) NULL)
-          break;
-        indexes=GetAuthenticIndexQueue(image);
         for (x=0; x < ((ssize_t) image->columns-1); x+=2)
           {
-            index=ConstrainColormapIndex(image,(*p >> 4) & 0xf);
+            index=ConstrainColormapIndex(image,(*p >> 4) & 0x0f);
             SetPixelIndex(indexes+x,index);
-            index=ConstrainColormapIndex(image,(*p) & 0xf);
+            SetPixelRGBO(q,image->colormap+(ssize_t) index);
+            q++;
+            index=ConstrainColormapIndex(image,(*p) & 0x0f);
             SetPixelIndex(indexes+x+1,index);
+            SetPixelRGBO(q,image->colormap+(ssize_t) index);
             p++;
+            q++;
           }
         if ((image->columns % 2) != 0)
           {
-            index=ConstrainColormapIndex(image,(*p >> 4) & 0xf);
+            index=ConstrainColormapIndex(image,(*p >> 4) & 0x0f);
             SetPixelIndex(indexes+x,index);
+            SetPixelRGBO(q,image->colormap+(ssize_t) index);
             p++;
+            q++;
           }
-        if (SyncAuthenticPixels(image,exception) == MagickFalse)
-          break;
         break;
       }
     case 8: /* Convert PseudoColor scanline. */
       {
-        q=QueueAuthenticPixels(image,0,y,image->columns,1,exception);
-        if (q == (PixelPacket *) NULL) break;
-        indexes=GetAuthenticIndexQueue(image);
         for (x=0; x < (ssize_t) image->columns; x++)
-        {
-          index=ConstrainColormapIndex(image,*p);
-          SetPixelIndex(indexes+x,index);
-          p++;
-        }
-        if (SyncAuthenticPixels(image,exception) == MagickFalse)
-          break;
+          {
+            index=ConstrainColormapIndex(image,*p);
+            SetPixelIndex(indexes+x,index);
+            SetPixelRGBO(q,image->colormap+(ssize_t) index);
+            p++;
+            q++;
+          }
       }
       break;
 
+    case 24:     /*  Convert DirectColor scanline.  */
+      for (x=0; x < (ssize_t) image->columns; x++)
+        {
+          SetPixelRed(q,ScaleCharToQuantum(*p++));
+          SetPixelGreen(q,ScaleCharToQuantum(*p++));
+          SetPixelBlue(q,ScaleCharToQuantum(*p++));
+          q++;
+        }
+      break;
     }
+  if (!SyncAuthenticPixels(image,exception))
+    return(MagickFalse);
+  return(MagickTrue);
 }
 
 /*
openSUSE Build Service is sponsored by