File ImageMagick-buffer-overflow-pdb,map,tiff.patch of Package ImageMagick
Index: ImageMagick-6.8.9-8/coders/map.c
===================================================================
--- ImageMagick-6.8.9-8.orig/coders/map.c 2014-02-21 13:40:32.000000000 +0100
+++ ImageMagick-6.8.9-8/coders/map.c 2016-10-11 13:32:43.281778741 +0200
@@ -395,22 +395,23 @@ static MagickBooleanType WriteMAPImage(c
Write colormap to file.
*/
q=colormap;
- if (image->depth <= 8)
+ q=colormap;
+ if (image->colors <= 256)
for (i=0; i < (ssize_t) image->colors; i++)
{
- *q++=(unsigned char) image->colormap[i].red;
- *q++=(unsigned char) image->colormap[i].green;
- *q++=(unsigned char) image->colormap[i].blue;
+ *q++=(unsigned char) ScaleQuantumToChar(image->colormap[i].red);
+ *q++=(unsigned char) ScaleQuantumToChar(image->colormap[i].green);
+ *q++=(unsigned char) ScaleQuantumToChar(image->colormap[i].blue);
}
else
for (i=0; i < (ssize_t) image->colors; i++)
{
- *q++=(unsigned char) ((size_t) image->colormap[i].red >> 8);
- *q++=(unsigned char) image->colormap[i].red;
- *q++=(unsigned char) ((size_t) image->colormap[i].green >> 8);
- *q++=(unsigned char) image->colormap[i].green;
- *q++=(unsigned char) ((size_t) image->colormap[i].blue >> 8);
- *q++=(unsigned char) image->colormap[i].blue;
+ *q++=(unsigned char) (ScaleQuantumToShort(image->colormap[i].red) >> 8);
+ *q++=(unsigned char) (ScaleQuantumToShort(image->colormap[i].red) & 0xff);
+ *q++=(unsigned char) (ScaleQuantumToShort(image->colormap[i].green) >> 8);
+ *q++=(unsigned char) (ScaleQuantumToShort(image->colormap[i].green) & 0xff);;
+ *q++=(unsigned char) (ScaleQuantumToShort(image->colormap[i].blue) >> 8);
+ *q++=(unsigned char) (ScaleQuantumToShort(image->colormap[i].blue) & 0xff);
}
(void) WriteBlob(image,packet_size*image->colors,colormap);
colormap=(unsigned char *) RelinquishMagickMemory(colormap);
Index: ImageMagick-6.8.9-8/coders/pdb.c
===================================================================
--- ImageMagick-6.8.9-8.orig/coders/pdb.c 2016-10-11 13:32:43.253778301 +0200
+++ ImageMagick-6.8.9-8/coders/pdb.c 2016-10-11 13:32:43.281778741 +0200
@@ -830,6 +830,7 @@ static MagickBooleanType WritePDBImage(c
quantum_info=AcquireQuantumInfo(image_info,image);
if (quantum_info == (QuantumInfo *) NULL)
ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
+ status=SetQuantumDepth(image,quantum_info,image->depth > 8 ? 16 : 8);
bits=8/(int) bits_per_pixel-1; /* start at most significant bits */
literal=0;
repeat=0;
Index: ImageMagick-6.8.9-8/coders/tiff.c
===================================================================
--- ImageMagick-6.8.9-8.orig/coders/tiff.c 2016-10-11 13:32:43.281778741 +0200
+++ ImageMagick-6.8.9-8/coders/tiff.c 2016-10-11 13:35:50.168713172 +0200
@@ -2232,6 +2232,8 @@ static MagickBooleanType WriteGROUP4Imag
(void) SetImageType(huffman_image,BilevelType);
write_info=CloneImageInfo((ImageInfo *) NULL);
SetImageInfoFile(write_info,file);
+ (void) SetImageDepth(image,1);
+ (void) SetImageType(image,BilevelType);
write_info->compression=Group4Compression;
write_info->type=BilevelType;
(void) SetImageOption(write_info,"quantum:polarity","min-is-white");