Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-12-SP2:Update
ImageMagick.12443
ImageMagick-meta.c-update.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File ImageMagick-meta.c-update.patch of Package ImageMagick.12443
Index: ImageMagick-6.8.8-1/coders/meta.c =================================================================== --- ImageMagick-6.8.8-1.orig/coders/meta.c 2018-09-15 09:34:46.291973385 +0200 +++ ImageMagick-6.8.8-1/coders/meta.c 2018-09-15 09:50:06.668473552 +0200 @@ -17,13 +17,13 @@ % July 2001 % % % % % -% Copyright 1999-2014 ImageMagick Studio LLC, a non-profit organization % +% Copyright 1999-2018 ImageMagick Studio LLC, a non-profit organization % % dedicated to making software imaging solutions freely available. % % % % You may not use this file except in compliance with the License. You may % % obtain a copy of the License at % % % -% http://www.imagemagick.org/script/license.php % +% https://www.imagemagick.org/script/license.php % % % % Unless required by applicable law or agreed to in writing, software % % distributed under the License is distributed on an "AS IS" BASIS, % @@ -140,18 +140,17 @@ static MagickBooleanType IsMETA(const un % o exception: return any errors or warnings in this structure. % */ -#define BUFFER_SZ 4096 - typedef struct _html_code { - short + const short len; + const char *code, val; } html_code; -static html_code html_codes[] = { +static const html_code html_codes[] = { #ifdef HANDLE_GT_LT { 4,"<",'<' }, { 4,">",'>' }, @@ -199,7 +198,7 @@ static size_t convertHTMLcodes(char *s, int value; - if ((len == 0) || (s == (char*)NULL) || (*s=='\0')) + if ((len == 0) || (s == (char*) NULL) || (*s=='\0')) return(0); if ((len > 3) && (s[1] == '#') && (strchr(s,';') != (char *) NULL) && (sscanf(s,"&#%d;",&value) == 1)) @@ -212,7 +211,7 @@ static size_t convertHTMLcodes(char *s, break; } if (o < 6) - (void) strcpy(s+1,s+1+o); + (void) memmove(s+1,s+1+o,strlen(s+1+o)+1); *s=value; return(o); } @@ -225,11 +224,12 @@ static size_t convertHTMLcodes(char *s, codes=sizeof(html_codes)/sizeof(html_code); for (i=0; i < codes; i++) { - if (html_codes[i].len <= len) + if (html_codes[i].len <= (ssize_t) len) if (stringnicmp(s, html_codes[i].code,(size_t) (html_codes[i].len)) == 0) { - (void) strcpy(s+1,s+html_codes[i].len); - *s = html_codes[i].val; + (void) memmove(s+1,s+html_codes[i].len, + strlen(s+html_codes[i].len)+1); + *s=html_codes[i].val; return(html_codes[i].len-1); } } @@ -284,7 +284,6 @@ static char *super_fgets(char **b, int * return((char *) p); } -#define BUFFER_SZ 4096 #define IPTC_ID 1028 #define THUMBNAIL_ID 1033 @@ -309,7 +308,7 @@ static ssize_t parse8BIM(Image *ifile, I recnum; int - inputlen = BUFFER_SZ; + inputlen = MaxTextExtent; MagickOffsetType savedpos, @@ -325,7 +324,9 @@ static ssize_t parse8BIM(Image *ifile, I dataset = 0; recnum = 0; line = (char *) AcquireQuantumMemory((size_t) inputlen,sizeof(*line)); - name = token = (char *)NULL; + if (line == (char *) NULL) + return(-1); + newstr = name = token = (char *) NULL; savedpos = 0; token_info=AcquireTokenInfo(); while (super_fgets(&line,&inputlen,ifile)!=NULL) @@ -334,7 +335,11 @@ static ssize_t parse8BIM(Image *ifile, I next=0; token=(char *) AcquireQuantumMemory((size_t) inputlen,sizeof(*token)); + if (token == (char *) NULL) + break; newstr=(char *) AcquireQuantumMemory((size_t) inputlen,sizeof(*newstr)); + if (newstr == (char *) NULL) + break; while (Tokenizer(token_info,0,token,(size_t) inputlen,line,"","=","\"",0, &brkused,&next,"ed)==0) { @@ -395,16 +400,16 @@ static ssize_t parse8BIM(Image *ifile, I if (brkused && next > 0) { size_t - codes_len; + codes_length; char *s = &token[next-1]; - codes_len = (ssize_t) convertHTMLcodes(s,strlen(s)); - if (codes_len > len) - len = 0; + codes_length=convertHTMLcodes(s, strlen(s)); + if ((ssize_t) codes_length > len) + len=0; else - len -= codes_len; + len-=codes_length; } } @@ -423,19 +428,24 @@ static ssize_t parse8BIM(Image *ifile, I ssize_t diff = outputlen - savedolen; currentpos = TellBlob(ofile); + if (currentpos < 0) + { + line=DestroyString(line); + return(-1); + } offset=SeekBlob(ofile,savedpos,SEEK_SET); if (offset < 0) - { - line=DestroyString(line); - return(-1); - } + { + line=DestroyString(line); + return(-1); + } (void) WriteBlobMSBLong(ofile,(unsigned int) diff); offset=SeekBlob(ofile,currentpos,SEEK_SET); if (offset < 0) - { - line=DestroyString(line); - return(-1); - } + { + line=DestroyString(line); + return(-1); + } savedolen = 0L; } if (outputlen & 1) @@ -478,6 +488,8 @@ static ssize_t parse8BIM(Image *ifile, I { /* patch in a fake length for now and fix it later */ savedpos = TellBlob(ofile); + if (savedpos < 0) + return(-1); (void) WriteBlobMSBLong(ofile,0xFFFFFFFFU); outputlen += 4; savedolen = outputlen; @@ -501,12 +513,20 @@ static ssize_t parse8BIM(Image *ifile, I } state++; } - token=DestroyString(token); - newstr=DestroyString(newstr); + if (token != (char *) NULL) + token=DestroyString(token); + if (newstr != (char *) NULL) + newstr=DestroyString(newstr); if (name != (char *) NULL) name=DestroyString(name); } token_info=DestroyTokenInfo(token_info); + if (token != (char *) NULL) + token=DestroyString(token); + if (newstr != (char *) NULL) + newstr=DestroyString(newstr); + if (name != (char *) NULL) + name=DestroyString(name); line=DestroyString(line); if (savedolen > 0) { @@ -516,6 +536,8 @@ static ssize_t parse8BIM(Image *ifile, I ssize_t diff = outputlen - savedolen; currentpos = TellBlob(ofile); + if (currentpos < 0) + return(-1); offset=SeekBlob(ofile,savedpos,SEEK_SET); if (offset < 0) return(-1); @@ -525,7 +547,52 @@ static ssize_t parse8BIM(Image *ifile, I return(-1); savedolen = 0L; } - return outputlen; + return(outputlen); +} + +MagickExport signed int ReadBlobMSBSignedLong(Image *image) +{ + union + { + unsigned int + unsigned_value; + + signed int + signed_value; + } quantum; + + quantum.unsigned_value=ReadBlobMSBLong(image); + return(quantum.signed_value); +} + +MagickExport signed short ReadBlobMSBSignedShort(Image *image) +{ + union + { + unsigned short + unsigned_value; + + signed short + signed_value; + } quantum; + + quantum.unsigned_value=ReadBlobMSBShort(image); + return(quantum.signed_value); +} + +MagickExport signed short ReadBlobLSBSignedShort(Image *image) +{ + union + { + unsigned short + unsigned_value; + + signed short + signed_value; + } quantum; + + quantum.unsigned_value=ReadBlobLSBShort(image); + return(quantum.signed_value); } static char *super_fgets_w(char **b, int *blen, Image *file) @@ -542,7 +609,7 @@ static char *super_fgets_w(char **b, int p=(unsigned char *) (*b); for (q=p; ; q++) { - c=(int) ReadBlobLSBShort(file); + c=ReadBlobLSBSignedShort(file); if ((c == -1) || (c == '\n')) break; if (EOFBlob(file)) @@ -598,7 +665,7 @@ static ssize_t parse8BIMW(Image *ifile, recnum; int - inputlen = BUFFER_SZ; + inputlen = MaxTextExtent; ssize_t savedolen = 0L, @@ -614,7 +681,9 @@ static ssize_t parse8BIMW(Image *ifile, dataset = 0; recnum = 0; line=(char *) AcquireQuantumMemory((size_t) inputlen,sizeof(*line)); - name = token = (char *)NULL; + if (line == (char *) NULL) + return(-1); + newstr = name = token = (char *) NULL; savedpos = 0; token_info=AcquireTokenInfo(); while (super_fgets_w(&line,&inputlen,ifile) != NULL) @@ -623,7 +692,11 @@ static ssize_t parse8BIMW(Image *ifile, next=0; token=(char *) AcquireQuantumMemory((size_t) inputlen,sizeof(*token)); + if (token == (char *) NULL) + break; newstr=(char *) AcquireQuantumMemory((size_t) inputlen,sizeof(*newstr)); + if (newstr == (char *) NULL) + break; while (Tokenizer(token_info,0,token,(size_t) inputlen,line,"","=","\"",0, &brkused,&next,"ed)==0) { @@ -684,16 +757,16 @@ static ssize_t parse8BIMW(Image *ifile, if (brkused && next > 0) { size_t - codes_len; + codes_length; char *s = &token[next-1]; - codes_len = (ssize_t) convertHTMLcodes(s,strlen(s)); - if (codes_len > len) - len = 0; + codes_length=convertHTMLcodes(s, strlen(s)); + if ((ssize_t) codes_length > len) + len=0; else - len -= codes_len; + len-=codes_length; } } @@ -712,6 +785,8 @@ static ssize_t parse8BIMW(Image *ifile, ssize_t diff = outputlen - savedolen; currentpos = TellBlob(ofile); + if (currentpos < 0) + return(-1); offset=SeekBlob(ofile,savedpos,SEEK_SET); if (offset < 0) return(-1); @@ -761,6 +836,8 @@ static ssize_t parse8BIMW(Image *ifile, { /* patch in a fake length for now and fix it later */ savedpos = TellBlob(ofile); + if (savedpos < 0) + return(-1); (void) WriteBlobMSBLong(ofile,0xFFFFFFFFU); outputlen += 4; savedolen = outputlen; @@ -784,11 +861,20 @@ static ssize_t parse8BIMW(Image *ifile, } state++; } + if (token != (char *) NULL) + token=DestroyString(token); + if (newstr != (char *) NULL) + newstr=DestroyString(newstr); + if (name != (char *) NULL) + name=DestroyString(name); + } + token_info=DestroyTokenInfo(token_info); + if (token != (char *) NULL) token=DestroyString(token); + if (newstr != (char *) NULL) newstr=DestroyString(newstr); + if (name != (char *) NULL) name=DestroyString(name); - } - token_info=DestroyTokenInfo(token_info); line=DestroyString(line); if (savedolen > 0) { @@ -798,6 +884,8 @@ static ssize_t parse8BIMW(Image *ifile, ssize_t diff = outputlen - savedolen; currentpos = TellBlob(ofile); + if (currentpos < 0) + return(-1); offset=SeekBlob(ofile,savedpos,SEEK_SET); if (offset < 0) return(-1); @@ -1010,7 +1098,7 @@ static int jpeg_embed(Image *ifile, Imag /* APP0 is in each and every JPEG, so when we hit APP0 we insert our new APP13! */ jpeg_skip_variable(ifile, ofile); - if (iptc != (Image *)NULL) + if (iptc != (Image *) NULL) { char psheader[] = "\xFF\xED\0\0Photoshop 3.0\0" "8BIM\x04\x04\0\0\0\0"; @@ -1082,6 +1170,39 @@ static int jpeg_extract(Image *ifile, Im } #endif +static void CopyBlob(Image *source,Image *destination) +{ + ssize_t + i; + + unsigned char + *buffer; + + ssize_t + count, + length; + + buffer=(unsigned char *) AcquireQuantumMemory(MagickMaxBufferExtent, + sizeof(*buffer)); + if (buffer != (unsigned char *) NULL) + { + i=0; + while ((length=ReadBlob(source,MagickMaxBufferExtent,buffer)) != 0) + { + count=0; + for (i=0; i < (ssize_t) length; i+=count) + { + count=WriteBlob(destination,(size_t) (length-i),buffer+i); + if (count <= 0) + break; + } + if (i < (ssize_t) length) + break; + } + buffer=(unsigned char *) RelinquishMagickMemory(buffer); + } +} + static Image *ReadMETAImage(const ImageInfo *image_info, ExceptionInfo *exception) { @@ -1089,9 +1210,6 @@ static Image *ReadMETAImage(const ImageI *buff, *image; - int - c; - MagickBooleanType status; @@ -1144,40 +1262,52 @@ static Image *ReadMETAImage(const ImageI buff=DestroyImage(buff); ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed"); } + (void) memset(blob,0,length); AttachBlob(buff->blob,blob,length); if (LocaleCompare(image_info->magick,"8BIMTEXT") == 0) { length=(size_t) parse8BIM(image, buff); + if (length == 0) + { + blob=DetachBlob(buff->blob); + blob=(unsigned char *) RelinquishMagickMemory(blob); + buff=DestroyImage(buff); + ThrowReaderException(CorruptImageError,"CorruptImage"); + } if (length & 1) (void) WriteBlobByte(buff,0x0); } else if (LocaleCompare(image_info->magick,"8BIMWTEXT") == 0) { length=(size_t) parse8BIMW(image, buff); + if (length == 0) + { + blob=DetachBlob(buff->blob); + blob=(unsigned char *) RelinquishMagickMemory(blob); + buff=DestroyImage(buff); + ThrowReaderException(CorruptImageError,"CorruptImage"); + } if (length & 1) (void) WriteBlobByte(buff,0x0); } else - { - for ( ; ; ) - { - c=ReadBlobByte(image); - if (c == EOF) - break; - (void) WriteBlobByte(buff,(unsigned char) c); - } - } + CopyBlob(image,buff); profile=BlobToStringInfo(GetBlobStreamData(buff),(size_t) GetBlobSize(buff)); if (profile == (StringInfo *) NULL) - ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed"); + { + blob=DetachBlob(buff->blob); + blob=(unsigned char *) RelinquishMagickMemory(blob); + buff=DestroyImage(buff); + ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed"); + } status=SetImageProfile(image,"8bim",profile); profile=DestroyStringInfo(profile); - if (status == MagickFalse) - ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed"); blob=DetachBlob(buff->blob); blob=(unsigned char *) RelinquishMagickMemory(blob); buff=DestroyImage(buff); + if (status == MagickFalse) + ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed"); } if (LocaleNCompare(image_info->magick,"APP1",4) == 0) { @@ -1206,7 +1336,7 @@ static Image *ReadMETAImage(const ImageI if (image_info->profile == (void *) NULL) { blob=DetachBlob(buff->blob); - blob=RelinquishMagickMemory(blob); + blob=(unsigned char *) RelinquishMagickMemory(blob); buff=DestroyImage(buff); ThrowReaderException(CoderError,"NoIPTCProfileAvailable"); } @@ -1215,7 +1345,7 @@ static Image *ReadMETAImage(const ImageI if (iptc == (Image *) NULL) { blob=DetachBlob(buff->blob); - blob=RelinquishMagickMemory(blob); + blob=(unsigned char *) RelinquishMagickMemory(blob); buff=DestroyImage(buff); ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed"); } @@ -1223,70 +1353,27 @@ static Image *ReadMETAImage(const ImageI GetStringInfoLength(profile)); result=jpeg_embed(image,buff,iptc); blob=DetachBlob(iptc->blob); - blob=RelinquishMagickMemory(blob); + blob=(unsigned char *) RelinquishMagickMemory(blob); iptc=DestroyImage(iptc); if (result == 0) - { - blob=DetachBlob(buff->blob); - blob=RelinquishMagickMemory(blob); - buff=DestroyImage(buff); - ThrowReaderException(CoderError,"JPEGEmbeddingFailed"); - } + ThrowReaderException(CoderError,"JPEGEmbeddingFailed"); } else - { -#ifdef SLOW_METHOD - for ( ; ; ) - { - /* Really - really slow - FIX ME PLEASE!!!! */ - c=ReadBlobByte(image); - if (c == EOF) - break; - (void) WriteBlobByte(buff,c); - } -#else - ssize_t - i; - - unsigned char - *buffer; - - ssize_t - count, - length; - - buffer=(unsigned char *) AcquireQuantumMemory(MagickMaxBufferExtent, - sizeof(*buffer)); - if (buffer != (unsigned char *) NULL) - { - i=0; - while ((length=ReadBlob(image,MagickMaxBufferExtent,buffer)) != 0) - { - count=0; - for (i=0; i < (ssize_t) length; i+=count) - { - count=WriteBlob(buff,(size_t) (length-i),buffer+i); - if (count <= 0) - break; - } - if (i < (ssize_t) length) - break; - } - buffer=(unsigned char *) RelinquishMagickMemory(buffer); - } -#endif - } + CopyBlob(image,buff); profile=BlobToStringInfo(GetBlobStreamData(buff),(size_t) GetBlobSize(buff)); if (profile == (StringInfo *) NULL) ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed"); status=SetImageProfile(image,name,profile); profile=DestroyStringInfo(profile); - if (status == MagickFalse) - ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed"); blob=DetachBlob(buff->blob); - blob=RelinquishMagickMemory(blob); + blob=(unsigned char *) RelinquishMagickMemory(blob); buff=DestroyImage(buff); + if (status == MagickFalse) + { + buff=DestroyImage(buff); + ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed"); + } } if ((LocaleCompare(image_info->magick,"ICC") == 0) || (LocaleCompare(image_info->magick,"ICM") == 0)) @@ -1301,17 +1388,16 @@ static Image *ReadMETAImage(const ImageI ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed"); } AttachBlob(buff->blob,blob,length); - for ( ; ; ) - { - c=ReadBlobByte(image); - if (c == EOF) - break; - (void) WriteBlobByte(buff,(unsigned char) c); - } + CopyBlob(image,buff); profile=BlobToStringInfo(GetBlobStreamData(buff),(size_t) GetBlobSize(buff)); if (profile == (StringInfo *) NULL) - ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed"); + { + blob=DetachBlob(buff->blob); + blob=(unsigned char *) RelinquishMagickMemory(blob); + buff=DestroyImage(buff); + ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed"); + } (void) SetImageProfile(image,"icc",profile); profile=DestroyStringInfo(profile); blob=DetachBlob(buff->blob); @@ -1320,9 +1406,6 @@ static Image *ReadMETAImage(const ImageI } if (LocaleCompare(image_info->magick,"IPTC") == 0) { - register unsigned char - *p; - buff=AcquireImage((ImageInfo *) NULL); if (buff == (Image *) NULL) ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed"); @@ -1333,41 +1416,17 @@ static Image *ReadMETAImage(const ImageI ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed"); } AttachBlob(buff->blob,blob,length); - /* write out the header - length field patched below */ - (void) WriteBlob(buff,11,(unsigned char *) "8BIM\04\04\0\0\0\0\0"); - (void) WriteBlobByte(buff,0xc6); - if (LocaleCompare(image_info->magick,"IPTCTEXT") == 0) - { - length=(size_t) parse8BIM(image,buff); - if (length & 1) - (void) WriteBlobByte(buff,0x00); - } - else if (LocaleCompare(image_info->magick,"IPTCWTEXT") == 0) - { - } - else - { - for ( ; ; ) - { - c=ReadBlobByte(image); - if (c == EOF) - break; - (void) WriteBlobByte(buff,(unsigned char) c); - } - } + CopyBlob(image,buff); profile=BlobToStringInfo(GetBlobStreamData(buff),(size_t) GetBlobSize(buff)); if (profile == (StringInfo *) NULL) - ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed"); - /* - subtract off the length of the 8BIM stuff. - */ - length=GetStringInfoLength(profile)-12; - p=GetStringInfoDatum(profile); - p[10]=(unsigned char) (length >> 8); - p[11]=(unsigned char) (length & 0xff); - SetStringInfoDatum(profile,GetBlobStreamData(buff)); - (void) SetImageProfile(image,"8bim",profile); + { + blob=DetachBlob(buff->blob); + blob=(unsigned char *) RelinquishMagickMemory(blob); + buff=DestroyImage(buff); + ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed"); + } + (void) SetImageProfile(image,"iptc",profile); profile=DestroyStringInfo(profile); blob=DetachBlob(buff->blob); blob=(unsigned char *) RelinquishMagickMemory(blob); @@ -1385,17 +1444,16 @@ static Image *ReadMETAImage(const ImageI ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed"); } AttachBlob(buff->blob,blob,length); - for ( ; ; ) - { - c=ReadBlobByte(image); - if (c == EOF) - break; - (void) WriteBlobByte(buff,(unsigned char) c); - } + CopyBlob(image,buff); profile=BlobToStringInfo(GetBlobStreamData(buff),(size_t) GetBlobSize(buff)); if (profile == (StringInfo *) NULL) - ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed"); + { + blob=DetachBlob(buff->blob); + blob=(unsigned char *) RelinquishMagickMemory(blob); + buff=DestroyImage(buff); + ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed"); + } (void) SetImageProfile(image,"xmp",profile); profile=DestroyStringInfo(profile); blob=DetachBlob(buff->blob); @@ -1821,7 +1879,7 @@ static void formatString(Image *ofile, c typedef struct _tag_spec { - short + const short id; const char @@ -1850,6 +1908,7 @@ static const tag_spec tags[] = { { 80, "Byline" }, { 85, "Byline Title" }, { 90, "City" }, + { 92, "Sub-Location" }, { 95, "Province State" }, { 100, "Country Code" }, { 101, "Country" }, @@ -1919,21 +1978,26 @@ static int formatIPTC(Image *ifile, Imag while (c != EOF) { if (c == 0x1c) - foundiptc = 1; + foundiptc=1; else { if (foundiptc) - return -1; + return(-1); else - continue; + { + c=0; + continue; + } } /* we found the 0x1c tag and now grab the dataset and record number tags */ c = ReadBlobByte(ifile); - if (c == EOF) return -1; + if (c == EOF) + return(-1); dataset = (unsigned char) c; c = ReadBlobByte(ifile); - if (c == EOF) return -1; + if (c == EOF) + return(-1); recnum = (unsigned char) c; /* try to match this record to one of the ones in our named table */ for (i=0; i< tagcount; i++) @@ -1949,35 +2013,38 @@ static int formatIPTC(Image *ifile, Imag We decode the length of the block that follows - ssize_t or short fmt. */ c=ReadBlobByte(ifile); - if (c == EOF) return -1; + if (c == EOF) + return(-1); if (c & (unsigned char) 0x80) - return 0; + return(0); else { int c0; c0=ReadBlobByte(ifile); - if (c0 == EOF) return -1; + if (c0 == EOF) + return(-1); taglen = (c << 8) | c0; } - if (taglen < 0) return -1; + if (taglen < 0) + return(-1); /* make a buffer to hold the tag datand snag it from the input stream */ str=(unsigned char *) AcquireQuantumMemory((size_t) (taglen+MaxTextExtent), sizeof(*str)); if (str == (unsigned char *) NULL) { - printf("MemoryAllocationFailed"); + (void) printf("MemoryAllocationFailed"); return 0; } for (tagindx=0; tagindx<taglen; tagindx++) { c=ReadBlobByte(ifile); if (c == EOF) - { - str=(unsigned char *) RelinquishMagickMemory(str); - return -1; - } + { + str=(unsigned char *) RelinquishMagickMemory(str); + return(-1); + } str[tagindx] = (unsigned char) c; } str[taglen] = 0; @@ -2096,19 +2163,21 @@ static int formatIPTCfromBuffer(Image *o } if (taglen < 0) return(-1); + if (taglen > 65535) + return(-1); /* make a buffer to hold the tag datand snag it from the input stream */ str=(unsigned char *) AcquireQuantumMemory((size_t) (taglen+MaxTextExtent), sizeof(*str)); if (str == (unsigned char *) NULL) - { - printf("MemoryAllocationFailed"); - return 0; - } + return 0; for (tagindx=0; tagindx<taglen; tagindx++) { c = *s++; len--; if (len < 0) - return(-1); + { + str=(unsigned char *) RelinquishMagickMemory(str); + return(-1); + } str[tagindx]=(unsigned char) c; } str[taglen]=0; @@ -2183,7 +2252,7 @@ static int format8BIM(Image *ifile, Imag /* We found the OSType (8BIM) and now grab the ID, PString, and Size fields. */ - ID=(int) ReadBlobMSBShort(ifile); + ID=ReadBlobMSBSignedShort(ifile); if (ID < 0) return(-1); { @@ -2197,10 +2266,7 @@ static int format8BIM(Image *ifile, Imag PString=(unsigned char *) AcquireQuantumMemory((size_t) (plen+ MaxTextExtent),sizeof(*PString)); if (PString == (unsigned char *) NULL) - { - printf("MemoryAllocationFailed"); - return 0; - } + return 0; for (i=0; i<plen; i++) { c=ReadBlobByte(ifile); @@ -2222,18 +2288,17 @@ static int format8BIM(Image *ifile, Imag } } } - count = (int) ReadBlobMSBLong(ifile); - if (count < 0) + count=(ssize_t) ReadBlobMSBSignedLong(ifile); + if ((count < 0) || (count > GetBlobSize(ifile))) { PString=(unsigned char *) RelinquishMagickMemory(PString); return(-1); } - /* make a buffer to hold the datand snag it from the input stream */ - str=(unsigned char *) AcquireQuantumMemory((size_t) count,sizeof(*str)); + /* make a buffer to hold the data and snag it from the input stream */ + str=(unsigned char *) AcquireQuantumMemory((size_t) count+1,sizeof(*str)); if (str == (unsigned char *) NULL) { PString=(unsigned char *) RelinquishMagickMemory(PString); - printf("MemoryAllocationFailed"); return 0; } for (i=0; i < (ssize_t) count; i++) @@ -2241,6 +2306,7 @@ static int format8BIM(Image *ifile, Imag c=ReadBlobByte(ifile); if (c == EOF) { + str=(unsigned char *) RelinquishMagickMemory(str); PString=(unsigned char *) RelinquishMagickMemory(PString); return(-1); }
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
