File ImageMagick-xwd.c-update.patch of Package ImageMagick.9832
Index: ImageMagick-6.8.8-1/coders/xwd.c
===================================================================
--- ImageMagick-6.8.8-1.orig/coders/xwd.c 2019-04-15 13:20:34.846267830 +0200
+++ ImageMagick-6.8.8-1/coders/xwd.c 2019-04-15 13:20:35.766272290 +0200
@@ -17,13 +17,13 @@
% July 1992 %
% %
% %
-% Copyright 1999-2014 ImageMagick Studio LLC, a non-profit organization %
+% Copyright 1999-2019 ImageMagick Studio LLC, a non-profit organization %
% dedicated to making software imaging solutions freely available. %
% %
% You may not use this file except in compliance with the License. You may %
% obtain a copy of the License at %
% %
-% http://www.imagemagick.org/script/license.php %
+% https://imagemagick.org/script/license.php %
% %
% Unless required by applicable law or agreed to in writing, software %
% distributed under the License is distributed on an "AS IS" BASIS, %
@@ -40,6 +40,7 @@
Include declarations.
*/
#include "magick/studio.h"
+#include "magick/attribute.h"
#include "magick/blob.h"
#include "magick/blob-private.h"
#include "magick/cache.h"
@@ -186,13 +187,15 @@ static Image *ReadXWDImage(const ImageIn
pixel;
size_t
- length,
- lsb_first;
+ length;
ssize_t
count,
y;
+ unsigned long
+ lsb_first;
+
XColor
*colors;
@@ -237,8 +240,17 @@ static Image *ReadXWDImage(const ImageIn
if (header.file_version != XWD_FILE_VERSION)
ThrowReaderException(CorruptImageError,"FileFormatVersionMismatch");
if (header.header_size < sz_XWDheader)
- ThrowReaderException(CorruptImageError,"CorruptImage");
- switch (header.visual_class) {
+ ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+ if ((header.bits_per_pixel == 0) || (header.bits_per_pixel > 32))
+ ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+ if (((header.bitmap_pad % 8) != 0) || (header.bitmap_pad > 32))
+ ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+ if (header.bitmap_unit > 32)
+ ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+ if (header.ncolors > 256)
+ ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+ switch (header.visual_class)
+ {
case StaticGray:
case GrayScale:
case StaticColor:
@@ -247,17 +259,20 @@ static Image *ReadXWDImage(const ImageIn
case DirectColor:
break;
default:
- ThrowReaderException(CorruptImageError,"CorruptImage");
- }
- switch (header.pixmap_format) {
+ ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+ }
+ switch (header.pixmap_format)
+ {
case XYBitmap:
case XYPixmap:
case ZPixmap:
break;
default:
- ThrowReaderException(CorruptImageError,"CorruptImage");
+ ThrowReaderException(CorruptImageError,"ImproperImageHeader");
}
- length=(size_t) header.header_size-sz_XWDheader;
+ length=(size_t) (header.header_size-sz_XWDheader);
+ if ((length+1) != ((size_t) ((CARD32) (length+1))))
+ ThrowReaderException(CorruptImageError,"ImproperImageHeader");
comment=(char *) AcquireQuantumMemory(length+1,sizeof(*comment));
if (comment == (char *) NULL)
ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
@@ -290,7 +305,7 @@ static Image *ReadXWDImage(const ImageIn
ximage->blue_mask=header.blue_mask;
if ((ximage->width < 0) || (ximage->height < 0) || (ximage->depth < 0) ||
(ximage->format < 0) || (ximage->byte_order < 0) ||
- (ximage->bitmap_bit_order < 0) || (ximage->bitmap_pad < 0) ||
+ (ximage->bitmap_bit_order < 0) || (ximage->bitmap_pad < 0) ||
(ximage->bytes_per_line < 0))
{
ximage=(XImage *) RelinquishMagickMemory(ximage);
@@ -334,7 +349,7 @@ static Image *ReadXWDImage(const ImageIn
for (i=0; i < (ssize_t) header.ncolors; i++)
{
count=ReadBlob(image,sz_XWDColor,(unsigned char *) &color);
- if (count == 0)
+ if (count != sz_XWDColor)
{
colors=(XColor *) RelinquishMagickMemory(colors);
ximage=(XImage *) RelinquishMagickMemory(ximage);
@@ -346,7 +361,7 @@ static Image *ReadXWDImage(const ImageIn
colors[i].blue=color.blue;
colors[i].flags=(char) color.flags;
if (color.flags != 0)
- authentic_colormap=MagickTrue;
+ authentic_colormap=MagickTrue;
}
/*
Ensure the header byte-order is most-significant byte first.
@@ -396,13 +411,13 @@ static Image *ReadXWDImage(const ImageIn
ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
}
count=ReadBlob(image,length,(unsigned char *) ximage->data);
- if (count == 0)
+ if (count != (ssize_t) length)
{
if (header.ncolors != 0)
colors=(XColor *) RelinquishMagickMemory(colors);
ximage->data=DestroyString(ximage->data);
ximage=(XImage *) RelinquishMagickMemory(ximage);
- ThrowReaderException(CorruptImageError,"UnexpectedEndOfFile");
+ ThrowReaderException(CorruptImageError,"UnableToReadImageData");
}
/*
Convert image to MIFF format.
@@ -410,6 +425,16 @@ static Image *ReadXWDImage(const ImageIn
image->columns=(size_t) ximage->width;
image->rows=(size_t) ximage->height;
image->depth=8;
+ status=SetImageExtent(image,image->columns,image->rows);
+ if (status == MagickFalse)
+ {
+ if (header.ncolors != 0)
+ colors=(XColor *) RelinquishMagickMemory(colors);
+ ximage->data=DestroyString(ximage->data);
+ ximage=(XImage *) RelinquishMagickMemory(ximage);
+ InheritException(exception,&image->exception);
+ return(DestroyImageList(image));
+ }
if ((header.ncolors == 0U) || (ximage->red_mask != 0) ||
(ximage->green_mask != 0) || (ximage->blue_mask != 0))
image->storage_class=DirectClass;
@@ -469,15 +494,16 @@ static Image *ReadXWDImage(const ImageIn
for (x=0; x < (ssize_t) image->columns; x++)
{
pixel=XGetPixel(ximage,(int) x,(int) y);
- index=(IndexPacket) ((pixel >> red_shift) & red_mask);
- SetPixelRed(q,ScaleShortToQuantum(colors[(ssize_t)
- index].red));
- index=(IndexPacket) ((pixel >> green_shift) & green_mask);
+ index=ConstrainColormapIndex(image,(ssize_t) (pixel >>
+ red_shift) & red_mask);
+ SetPixelRed(q,ScaleShortToQuantum(colors[(ssize_t) index].red));
+ index=ConstrainColormapIndex(image,(ssize_t) (pixel >>
+ green_shift) & green_mask);
SetPixelGreen(q,ScaleShortToQuantum(colors[(ssize_t)
index].green));
- index=(IndexPacket) ((pixel >> blue_shift) & blue_mask);
- SetPixelBlue(q,ScaleShortToQuantum(colors[(ssize_t)
- index].blue));
+ index=ConstrainColormapIndex(image,(ssize_t) (pixel >>
+ blue_shift) & blue_mask);
+ SetPixelBlue(q,ScaleShortToQuantum(colors[(ssize_t) index].blue));
q++;
}
if (SyncAuthenticPixels(image,exception) == MagickFalse)
@@ -497,23 +523,23 @@ static Image *ReadXWDImage(const ImageIn
{
pixel=XGetPixel(ximage,(int) x,(int) y);
color=(pixel >> red_shift) & red_mask;
- color=(color*65535UL)/red_mask;
- SetPixelRed(q,ScaleShortToQuantum((unsigned short)
- color));
+ if (red_mask != 0)
+ color=(color*65535UL)/red_mask;
+ SetPixelRed(q,ScaleShortToQuantum((unsigned short) color));
color=(pixel >> green_shift) & green_mask;
- color=(color*65535UL)/green_mask;
- SetPixelGreen(q,ScaleShortToQuantum((unsigned short)
- color));
+ if (green_mask != 0)
+ color=(color*65535UL)/green_mask;
+ SetPixelGreen(q,ScaleShortToQuantum((unsigned short) color));
color=(pixel >> blue_shift) & blue_mask;
- color=(color*65535UL)/blue_mask;
- SetPixelBlue(q,ScaleShortToQuantum((unsigned short)
- color));
+ if (blue_mask != 0)
+ color=(color*65535UL)/blue_mask;
+ SetPixelBlue(q,ScaleShortToQuantum((unsigned short) color));
q++;
}
if (SyncAuthenticPixels(image,exception) == MagickFalse)
break;
status=SetImageProgress(image,LoadImageTag,(MagickOffsetType) y,
- image->rows);
+ image->rows);
if (status == MagickFalse)
break;
}
@@ -546,8 +572,8 @@ static Image *ReadXWDImage(const ImageIn
indexes=GetAuthenticIndexQueue(image);
for (x=0; x < (ssize_t) image->columns; x++)
{
- index=ConstrainColormapIndex(image,XGetPixel(ximage,(int) x,
- (int) y));
+ index=ConstrainColormapIndex(image,(ssize_t) XGetPixel(ximage,(int)
+ x,(int) y));
SetPixelIndex(indexes+x,index);
SetPixelRGBO(q,image->colormap+(ssize_t) index);
q++;
@@ -692,15 +718,18 @@ static MagickBooleanType WriteXWDImage(c
bits_per_pixel,
bytes_per_line,
length,
- lsb_first,
scanline_pad;
ssize_t
+ count,
y;
unsigned char
*pixels;
+ unsigned long
+ lsb_first;
+
XWDFileHeader
xwd_info;
@@ -716,12 +745,16 @@ static MagickBooleanType WriteXWDImage(c
status=OpenBlob(image_info,image,WriteBinaryBlobMode,&image->exception);
if (status == MagickFalse)
return(status);
- if (IssRGBCompatibleColorspace(image->colorspace) == MagickFalse)
- (void) TransformImageColorspace(image,sRGBColorspace);
+ if ((image->columns != (CARD32) image->columns) ||
+ (image->rows != (CARD32) image->rows))
+ ThrowWriterException(ImageError,"WidthOrHeightExceedsLimit");
+ if ((image->storage_class == PseudoClass) && (image->colors > 256))
+ (void) SetImageType(image,TrueColorType);
+ (void) TransformImageColorspace(image,sRGBColorspace);
/*
Initialize XWD file header.
*/
- (void) ResetMagickMemory(&xwd_info,0,sizeof(xwd_info));
+ (void) memset(&xwd_info,0,sizeof(xwd_info));
xwd_info.header_size=(CARD32) sz_XWDheader;
value=GetImageProperty(image,"comment");
if (value != (const char *) NULL)
@@ -784,7 +817,7 @@ static MagickBooleanType WriteXWDImage(c
/*
Dump colormap to file.
*/
- (void) ResetMagickMemory(&color,0,sizeof(color));
+ (void) memset(&color,0,sizeof(color));
colors=(XColor *) AcquireQuantumMemory((size_t) image->colors,
sizeof(*colors));
if (colors == (XColor *) NULL)
@@ -801,8 +834,8 @@ static MagickBooleanType WriteXWDImage(c
{
MSBOrderLong((unsigned char *) &colors[i].pixel,
sizeof(colors[i].pixel));
- MSBOrderShort((unsigned char *) &colors[i].red,
- 3*sizeof(colors[i].red));
+ MSBOrderShort((unsigned char *) &colors[i].red,3*
+ sizeof(colors[i].red));
}
}
for (i=0; i < (ssize_t) image->colors; i++)
@@ -812,7 +845,9 @@ static MagickBooleanType WriteXWDImage(c
color.green=colors[i].green;
color.blue=colors[i].blue;
color.flags=(CARD8) colors[i].flags;
- (void) WriteBlob(image,sz_XWDColor,(unsigned char *) &color);
+ count=WriteBlob(image,sz_XWDColor,(unsigned char *) &color);
+ if (count != (ssize_t) sz_XWDColor)
+ break;
}
colors=(XColor *) RelinquishMagickMemory(colors);
}
@@ -825,7 +860,7 @@ static MagickBooleanType WriteXWDImage(c
pixels=(unsigned char *) AcquireQuantumMemory(length,sizeof(*pixels));
if (pixels == (unsigned char *) NULL)
ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
- (void) ResetMagickMemory(pixels,0,length);
+ (void) memset(pixels,0,length);
/*
Convert MIFF to XWD raster pixels.
*/
@@ -852,7 +887,10 @@ static MagickBooleanType WriteXWDImage(c
}
for (x=0; x < (ssize_t) scanline_pad; x++)
*q++='\0';
- (void) WriteBlob(image,(size_t) (q-pixels),pixels);
+ length=(size_t) (q-pixels);
+ count=WriteBlob(image,length,pixels);
+ if (count != (ssize_t) length)
+ break;
status=SetImageProgress(image,SaveImageTag,(MagickOffsetType) y,
image->rows);
if (status == MagickFalse)
@@ -860,6 +898,6 @@ static MagickBooleanType WriteXWDImage(c
}
pixels=(unsigned char *) RelinquishMagickMemory(pixels);
(void) CloseBlob(image);
- return(MagickTrue);
+ return(y < (ssize_t) image->rows ? MagickFalse : MagickTrue);
}
#endif
