File ImageMagick-buffer-overflow-pdb,map,tiff.patch of Package ImageMagick.18391

Overview Repositories Revisions Requests Users Attributes Meta

File ImageMagick-buffer-overflow-pdb,map,tiff.patch of Package ImageMagick.18391

Index: ImageMagick-6.8.9-8/coders/map.c
===================================================================
--- ImageMagick-6.8.9-8.orig/coders/map.c	2014-02-21 13:40:32.000000000 +0100
+++ ImageMagick-6.8.9-8/coders/map.c	2016-10-11 13:32:43.281778741 +0200
@@ -395,22 +395,23 @@ static MagickBooleanType WriteMAPImage(c
     Write colormap to file.
   */
   q=colormap;
-  if (image->depth <= 8)
+  q=colormap;
+  if (image->colors <= 256)
     for (i=0; i < (ssize_t) image->colors; i++)
     {
-      *q++=(unsigned char) image->colormap[i].red;
-      *q++=(unsigned char) image->colormap[i].green;
-      *q++=(unsigned char) image->colormap[i].blue;
+      *q++=(unsigned char) ScaleQuantumToChar(image->colormap[i].red);
+      *q++=(unsigned char) ScaleQuantumToChar(image->colormap[i].green);
+      *q++=(unsigned char) ScaleQuantumToChar(image->colormap[i].blue);
     }
   else
     for (i=0; i < (ssize_t) image->colors; i++)
     {
-      *q++=(unsigned char) ((size_t) image->colormap[i].red >> 8);
-      *q++=(unsigned char) image->colormap[i].red;
-      *q++=(unsigned char) ((size_t) image->colormap[i].green >> 8);
-      *q++=(unsigned char) image->colormap[i].green;
-      *q++=(unsigned char) ((size_t) image->colormap[i].blue >> 8);
-      *q++=(unsigned char) image->colormap[i].blue;
+      *q++=(unsigned char) (ScaleQuantumToShort(image->colormap[i].red) >> 8);
+      *q++=(unsigned char) (ScaleQuantumToShort(image->colormap[i].red) & 0xff);
+      *q++=(unsigned char) (ScaleQuantumToShort(image->colormap[i].green) >> 8);
+      *q++=(unsigned char) (ScaleQuantumToShort(image->colormap[i].green) & 0xff);;
+      *q++=(unsigned char) (ScaleQuantumToShort(image->colormap[i].blue) >> 8);
+      *q++=(unsigned char) (ScaleQuantumToShort(image->colormap[i].blue) & 0xff);
     }
   (void) WriteBlob(image,packet_size*image->colors,colormap);
   colormap=(unsigned char *) RelinquishMagickMemory(colormap);
Index: ImageMagick-6.8.9-8/coders/pdb.c
===================================================================
--- ImageMagick-6.8.9-8.orig/coders/pdb.c	2016-10-11 13:32:43.253778301 +0200
+++ ImageMagick-6.8.9-8/coders/pdb.c	2016-10-11 13:32:43.281778741 +0200
@@ -830,6 +830,7 @@ static MagickBooleanType WritePDBImage(c
   quantum_info=AcquireQuantumInfo(image_info,image);
   if (quantum_info == (QuantumInfo *) NULL)
     ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
+  status=SetQuantumDepth(image,quantum_info,image->depth > 8 ? 16 : 8);
   bits=8/(int) bits_per_pixel-1;  /* start at most significant bits */
   literal=0;
   repeat=0;
Index: ImageMagick-6.8.9-8/coders/tiff.c
===================================================================
--- ImageMagick-6.8.9-8.orig/coders/tiff.c	2016-10-11 13:32:43.281778741 +0200
+++ ImageMagick-6.8.9-8/coders/tiff.c	2016-10-11 13:35:50.168713172 +0200
@@ -2232,6 +2232,8 @@ static MagickBooleanType WriteGROUP4Imag
   (void) SetImageType(huffman_image,BilevelType);
   write_info=CloneImageInfo((ImageInfo *) NULL);
   SetImageInfoFile(write_info,file);
+  (void) SetImageDepth(image,1);
+  (void) SetImageType(image,BilevelType);
   write_info->compression=Group4Compression;
   write_info->type=BilevelType;
   (void) SetImageOption(write_info,"quantum:polarity","min-is-white");

Places

File ImageMagick-buffer-overflow-pdb,map,tiff.patch of Package ImageMagick.18391

Places