File ImageMagick-CVE-2015-8897.patch of Package ImageMagick
Index: ImageMagick-6.8.8-1/magick/transform.c
===================================================================
--- ImageMagick-6.8.8-1.orig/magick/transform.c 2013-12-01 15:47:50.000000000 +0100
+++ ImageMagick-6.8.8-1/magick/transform.c 2016-06-09 12:08:44.453437147 +0200
@@ -67,6 +67,14 @@
#include "magick/thread-private.h"
#include "magick/transform.h"
+static inline MagickSizeType MagickMin(const MagickSizeType x,
+ const MagickSizeType y)
+{
+ if (x < y)
+ return(x);
+ return(y);
+}
+
/*
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% %
@@ -1741,6 +1749,7 @@ MagickExport Image *SpliceImage(const Im
splice_geometry;
ssize_t
+ columns,
y;
/*
@@ -1825,6 +1834,7 @@ MagickExport Image *SpliceImage(const Im
*/
status=MagickTrue;
progress=0;
+ columns=MagickMin(splice_geometry.x,(ssize_t) splice_image->columns);
image_view=AcquireVirtualCacheView(image,exception);
splice_view=AcquireAuthenticCacheView(splice_image,exception);
#if defined(MAGICKCORE_OPENMP_SUPPORT)
@@ -1848,7 +1858,8 @@ MagickExport Image *SpliceImage(const Im
if (status == MagickFalse)
continue;
- p=GetCacheViewVirtualPixels(image_view,0,y,image->columns,1,exception);
+ p=GetCacheViewVirtualPixels(image_view,0,y,splice_image->columns,1,
+ exception);
q=QueueCacheViewAuthenticPixels(splice_view,0,y,splice_image->columns,1,
exception);
if ((p == (const PixelPacket *) NULL) || (q == (PixelPacket *) NULL))
@@ -1858,7 +1869,7 @@ MagickExport Image *SpliceImage(const Im
}
indexes=GetCacheViewAuthenticIndexQueue(image_view);
splice_indexes=GetCacheViewAuthenticIndexQueue(splice_view);
- for (x=0; x < splice_geometry.x; x++)
+ for (x=0; x < columns; x++)
{
SetPixelRed(q,GetPixelRed(p));
SetPixelGreen(q,GetPixelGreen(p));
@@ -1926,10 +1937,10 @@ MagickExport Image *SpliceImage(const Im
if (status == MagickFalse)
continue;
- p=GetCacheViewVirtualPixels(image_view,0,y-(ssize_t) splice_geometry.height,
- image->columns,1,exception);
- if ((y < 0) || (y >= (ssize_t) splice_image->rows))
+ if ((y < 0) || (y >= (ssize_t)splice_image->rows))
continue;
+ p=GetCacheViewVirtualPixels(image_view,0,y-(ssize_t) splice_geometry.height,
+ splice_image->columns,1,exception);
q=QueueCacheViewAuthenticPixels(splice_view,0,y,splice_image->columns,1,
exception);
if ((p == (const PixelPacket *) NULL) || (q == (PixelPacket *) NULL))
@@ -1939,7 +1950,7 @@ MagickExport Image *SpliceImage(const Im
}
indexes=GetCacheViewAuthenticIndexQueue(image_view);
splice_indexes=GetCacheViewAuthenticIndexQueue(splice_view);
- for (x=0; x < splice_geometry.x; x++)
+ for (x=0; x < columns; x++)
{
SetPixelRed(q,GetPixelRed(p));
SetPixelGreen(q,GetPixelGreen(p));