File ImageMagick-xwd.c-update.patch of Package ImageMagick.29977
Index: ImageMagick-6.8.8-1/coders/xwd.c
===================================================================
--- ImageMagick-6.8.8-1.orig/coders/xwd.c 2019-04-30 11:57:36.555540222 +0200
+++ ImageMagick-6.8.8-1/coders/xwd.c 2019-04-30 12:07:32.742593884 +0200
@@ -17,13 +17,13 @@
% July 1992 %
% %
% %
-% Copyright 1999-2014 ImageMagick Studio LLC, a non-profit organization %
+% Copyright 1999-2019 ImageMagick Studio LLC, a non-profit organization %
% dedicated to making software imaging solutions freely available. %
% %
% You may not use this file except in compliance with the License. You may %
% obtain a copy of the License at %
% %
-% http://www.imagemagick.org/script/license.php %
+% https://imagemagick.org/script/license.php %
% %
% Unless required by applicable law or agreed to in writing, software %
% distributed under the License is distributed on an "AS IS" BASIS, %
@@ -40,6 +40,7 @@
Include declarations.
*/
#include "magick/studio.h"
+#include "magick/attribute.h"
#include "magick/blob.h"
#include "magick/blob-private.h"
#include "magick/cache.h"
@@ -186,13 +187,15 @@ static Image *ReadXWDImage(const ImageIn
pixel;
size_t
- length,
- lsb_first;
+ length;
ssize_t
count,
y;
+ unsigned long
+ lsb_first;
+
XColor
*colors;
@@ -206,12 +209,12 @@ static Image *ReadXWDImage(const ImageIn
Open image file.
*/
assert(image_info != (const ImageInfo *) NULL);
- assert(image_info->signature == MagickSignature);
+ assert(image_info->signature == MagickSignature);
if (image_info->debug != MagickFalse)
(void) LogMagickEvent(TraceEvent,GetMagickModule(),"%s",
image_info->filename);
assert(exception != (ExceptionInfo *) NULL);
- assert(exception->signature == MagickSignature);
+ assert(exception->signature == MagickSignature);
image=AcquireImage(image_info);
status=OpenBlob(image_info,image,ReadBinaryBlobMode,exception);
if (status == MagickFalse)
@@ -237,27 +240,96 @@ static Image *ReadXWDImage(const ImageIn
if (header.file_version != XWD_FILE_VERSION)
ThrowReaderException(CorruptImageError,"FileFormatVersionMismatch");
if (header.header_size < sz_XWDheader)
- ThrowReaderException(CorruptImageError,"CorruptImage");
- switch (header.visual_class) {
+ ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+ if (header.xoffset >= header.pixmap_width)
+ ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+ switch (header.visual_class)
+ {
case StaticGray:
case GrayScale:
+ {
+ if (header.bits_per_pixel != 1)
+ ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+ break;
+ }
case StaticColor:
case PseudoColor:
+ {
+ if ((header.bits_per_pixel < 1) || (header.bits_per_pixel > 15) ||
+ (header.ncolors == 0))
+ ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+ break;
+ }
case TrueColor:
case DirectColor:
+ {
+ if ((header.bits_per_pixel != 16) && (header.bits_per_pixel != 24) &&
+ (header.bits_per_pixel != 32))
+ ThrowReaderException(CorruptImageError,"ImproperImageHeader");
break;
- default:
- ThrowReaderException(CorruptImageError,"CorruptImage");
}
- switch (header.pixmap_format) {
+ default:
+ ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+ }
+ switch (header.pixmap_format)
+ {
case XYBitmap:
+ {
+ if (header.pixmap_depth != 1)
+ ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+ break;
+ }
case XYPixmap:
case ZPixmap:
+ {
+ if ((header.pixmap_depth < 1) || (header.pixmap_depth > 32))
+ ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+ switch (header.bitmap_pad)
+ {
+ case 8:
+ case 16:
+ case 32:
+ break;
+ default:
+ ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+ }
+ break;
+ }
+ default:
+ ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+ }
+ switch (header.bitmap_unit)
+ {
+ case 8:
+ case 16:
+ case 32:
+ break;
+ default:
+ ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+ }
+ switch (header.byte_order)
+ {
+ case LSBFirst:
+ case MSBFirst:
+ break;
+ default:
+ ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+ }
+ switch (header.bitmap_bit_order)
+ {
+ case LSBFirst:
+ case MSBFirst:
break;
default:
- ThrowReaderException(CorruptImageError,"CorruptImage");
+ ThrowReaderException(CorruptImageError,"ImproperImageHeader");
}
- length=(size_t) header.header_size-sz_XWDheader;
+ if (((header.bitmap_pad % 8) != 0) || (header.bitmap_pad > 32))
+ ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+ if (header.ncolors > 65535)
+ ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+ length=(size_t) (header.header_size-sz_XWDheader);
+ if ((length+1) != ((size_t) ((CARD32) (length+1))))
+ ThrowReaderException(CorruptImageError,"ImproperImageHeader");
comment=(char *) AcquireQuantumMemory(length+1,sizeof(*comment));
if (comment == (char *) NULL)
ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
@@ -288,10 +360,11 @@ static Image *ReadXWDImage(const ImageIn
ximage->red_mask=header.red_mask;
ximage->green_mask=header.green_mask;
ximage->blue_mask=header.blue_mask;
- if ((ximage->width < 0) || (ximage->height < 0) || (ximage->depth < 0) ||
- (ximage->format < 0) || (ximage->byte_order < 0) ||
- (ximage->bitmap_bit_order < 0) || (ximage->bitmap_pad < 0) ||
- (ximage->bytes_per_line < 0))
+ if ((ximage->depth < 0) || (ximage->format < 0) || (ximage->xoffset < 0) ||
+ (ximage->width < 0) || (ximage->height < 0) || (ximage->bitmap_pad < 0) ||
+ (ximage->bytes_per_line < 0) || (ximage->byte_order < 0) ||
+ (ximage->bitmap_unit < 0) || (ximage->bitmap_bit_order < 0) ||
+ (ximage->bits_per_pixel < 0))
{
ximage=(XImage *) RelinquishMagickMemory(ximage);
ThrowReaderException(CorruptImageError,"ImproperImageHeader");
@@ -322,10 +395,8 @@ static Image *ReadXWDImage(const ImageIn
XWDColor
color;
- length=(size_t) header.ncolors;
- if (length > ((~0UL)/sizeof(*colors)))
- ThrowReaderException(CorruptImageError,"ImproperImageHeader");
- colors=(XColor *) AcquireQuantumMemory(length,sizeof(*colors));
+ colors=(XColor *) AcquireQuantumMemory((size_t) header.ncolors,
+ sizeof(*colors));
if (colors == (XColor *) NULL)
{
ximage=(XImage *) RelinquishMagickMemory(ximage);
@@ -334,7 +405,7 @@ static Image *ReadXWDImage(const ImageIn
for (i=0; i < (ssize_t) header.ncolors; i++)
{
count=ReadBlob(image,sz_XWDColor,(unsigned char *) &color);
- if (count == 0)
+ if (count != sz_XWDColor)
{
colors=(XColor *) RelinquishMagickMemory(colors);
ximage=(XImage *) RelinquishMagickMemory(ximage);
@@ -346,7 +417,7 @@ static Image *ReadXWDImage(const ImageIn
colors[i].blue=color.blue;
colors[i].flags=(char) color.flags;
if (color.flags != 0)
- authentic_colormap=MagickTrue;
+ authentic_colormap=MagickTrue;
}
/*
Ensure the header byte-order is most-significant byte first.
@@ -396,13 +467,13 @@ static Image *ReadXWDImage(const ImageIn
ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
}
count=ReadBlob(image,length,(unsigned char *) ximage->data);
- if (count == 0)
+ if (count != (ssize_t) length)
{
if (header.ncolors != 0)
colors=(XColor *) RelinquishMagickMemory(colors);
ximage->data=DestroyString(ximage->data);
ximage=(XImage *) RelinquishMagickMemory(ximage);
- ThrowReaderException(CorruptImageError,"UnexpectedEndOfFile");
+ ThrowReaderException(CorruptImageError,"UnableToReadImageData");
}
/*
Convert image to MIFF format.
@@ -410,6 +481,16 @@ static Image *ReadXWDImage(const ImageIn
image->columns=(size_t) ximage->width;
image->rows=(size_t) ximage->height;
image->depth=8;
+ status=SetImageExtent(image,image->columns,image->rows);
+ if (status == MagickFalse)
+ {
+ if (header.ncolors != 0)
+ colors=(XColor *) RelinquishMagickMemory(colors);
+ ximage->data=DestroyString(ximage->data);
+ ximage=(XImage *) RelinquishMagickMemory(ximage);
+ InheritException(exception,&image->exception);
+ return(DestroyImageList(image));
+ }
if ((header.ncolors == 0U) || (ximage->red_mask != 0) ||
(ximage->green_mask != 0) || (ximage->blue_mask != 0))
image->storage_class=DirectClass;
@@ -469,15 +550,16 @@ static Image *ReadXWDImage(const ImageIn
for (x=0; x < (ssize_t) image->columns; x++)
{
pixel=XGetPixel(ximage,(int) x,(int) y);
- index=(IndexPacket) ((pixel >> red_shift) & red_mask);
- SetPixelRed(q,ScaleShortToQuantum(colors[(ssize_t)
- index].red));
- index=(IndexPacket) ((pixel >> green_shift) & green_mask);
+ index=ConstrainColormapIndex(image,(ssize_t) (pixel >>
+ red_shift) & red_mask);
+ SetPixelRed(q,ScaleShortToQuantum(colors[(ssize_t) index].red));
+ index=ConstrainColormapIndex(image,(ssize_t) (pixel >>
+ green_shift) & green_mask);
SetPixelGreen(q,ScaleShortToQuantum(colors[(ssize_t)
index].green));
- index=(IndexPacket) ((pixel >> blue_shift) & blue_mask);
- SetPixelBlue(q,ScaleShortToQuantum(colors[(ssize_t)
- index].blue));
+ index=ConstrainColormapIndex(image,(ssize_t) (pixel >>
+ blue_shift) & blue_mask);
+ SetPixelBlue(q,ScaleShortToQuantum(colors[(ssize_t) index].blue));
q++;
}
if (SyncAuthenticPixels(image,exception) == MagickFalse)
@@ -497,23 +579,23 @@ static Image *ReadXWDImage(const ImageIn
{
pixel=XGetPixel(ximage,(int) x,(int) y);
color=(pixel >> red_shift) & red_mask;
- color=(color*65535UL)/red_mask;
- SetPixelRed(q,ScaleShortToQuantum((unsigned short)
- color));
+ if (red_mask != 0)
+ color=(color*65535UL)/red_mask;
+ SetPixelRed(q,ScaleShortToQuantum((unsigned short) color));
color=(pixel >> green_shift) & green_mask;
- color=(color*65535UL)/green_mask;
- SetPixelGreen(q,ScaleShortToQuantum((unsigned short)
- color));
+ if (green_mask != 0)
+ color=(color*65535UL)/green_mask;
+ SetPixelGreen(q,ScaleShortToQuantum((unsigned short) color));
color=(pixel >> blue_shift) & blue_mask;
- color=(color*65535UL)/blue_mask;
- SetPixelBlue(q,ScaleShortToQuantum((unsigned short)
- color));
+ if (blue_mask != 0)
+ color=(color*65535UL)/blue_mask;
+ SetPixelBlue(q,ScaleShortToQuantum((unsigned short) color));
q++;
}
if (SyncAuthenticPixels(image,exception) == MagickFalse)
break;
status=SetImageProgress(image,LoadImageTag,(MagickOffsetType) y,
- image->rows);
+ image->rows);
if (status == MagickFalse)
break;
}
@@ -546,8 +628,8 @@ static Image *ReadXWDImage(const ImageIn
indexes=GetAuthenticIndexQueue(image);
for (x=0; x < (ssize_t) image->columns; x++)
{
- index=ConstrainColormapIndex(image,XGetPixel(ximage,(int) x,
- (int) y));
+ index=ConstrainColormapIndex(image,(ssize_t) XGetPixel(ximage,(int)
+ x,(int) y));
SetPixelIndex(indexes+x,index);
SetPixelRGBO(q,image->colormap+(ssize_t) index);
q++;
@@ -692,15 +774,18 @@ static MagickBooleanType WriteXWDImage(c
bits_per_pixel,
bytes_per_line,
length,
- lsb_first,
scanline_pad;
ssize_t
+ count,
y;
unsigned char
*pixels;
+ unsigned long
+ lsb_first;
+
XWDFileHeader
xwd_info;
@@ -708,20 +793,24 @@ static MagickBooleanType WriteXWDImage(c
Open output image file.
*/
assert(image_info != (const ImageInfo *) NULL);
- assert(image_info->signature == MagickSignature);
+ assert(image_info->signature == MagickSignature);
assert(image != (Image *) NULL);
- assert(image->signature == MagickSignature);
+ assert(image->signature == MagickSignature);
if (image->debug != MagickFalse)
(void) LogMagickEvent(TraceEvent,GetMagickModule(),"%s",image->filename);
status=OpenBlob(image_info,image,WriteBinaryBlobMode,&image->exception);
if (status == MagickFalse)
return(status);
- if (IssRGBCompatibleColorspace(image->colorspace) == MagickFalse)
- (void) TransformImageColorspace(image,sRGBColorspace);
+ if ((image->columns != (CARD32) image->columns) ||
+ (image->rows != (CARD32) image->rows))
+ ThrowWriterException(ImageError,"WidthOrHeightExceedsLimit");
+ if ((image->storage_class == PseudoClass) && (image->colors > 256))
+ (void) SetImageType(image,TrueColorType);
+ (void) TransformImageColorspace(image,sRGBColorspace);
/*
Initialize XWD file header.
*/
- (void) ResetMagickMemory(&xwd_info,0,sizeof(xwd_info));
+ (void) memset(&xwd_info,0,sizeof(xwd_info));
xwd_info.header_size=(CARD32) sz_XWDheader;
value=GetImageProperty(image,"comment");
if (value != (const char *) NULL)
@@ -784,7 +873,7 @@ static MagickBooleanType WriteXWDImage(c
/*
Dump colormap to file.
*/
- (void) ResetMagickMemory(&color,0,sizeof(color));
+ (void) memset(&color,0,sizeof(color));
colors=(XColor *) AcquireQuantumMemory((size_t) image->colors,
sizeof(*colors));
if (colors == (XColor *) NULL)
@@ -801,8 +890,8 @@ static MagickBooleanType WriteXWDImage(c
{
MSBOrderLong((unsigned char *) &colors[i].pixel,
sizeof(colors[i].pixel));
- MSBOrderShort((unsigned char *) &colors[i].red,
- 3*sizeof(colors[i].red));
+ MSBOrderShort((unsigned char *) &colors[i].red,3*
+ sizeof(colors[i].red));
}
}
for (i=0; i < (ssize_t) image->colors; i++)
@@ -812,7 +901,9 @@ static MagickBooleanType WriteXWDImage(c
color.green=colors[i].green;
color.blue=colors[i].blue;
color.flags=(CARD8) colors[i].flags;
- (void) WriteBlob(image,sz_XWDColor,(unsigned char *) &color);
+ count=WriteBlob(image,sz_XWDColor,(unsigned char *) &color);
+ if (count != (ssize_t) sz_XWDColor)
+ break;
}
colors=(XColor *) RelinquishMagickMemory(colors);
}
@@ -825,7 +916,7 @@ static MagickBooleanType WriteXWDImage(c
pixels=(unsigned char *) AcquireQuantumMemory(length,sizeof(*pixels));
if (pixels == (unsigned char *) NULL)
ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
- (void) ResetMagickMemory(pixels,0,length);
+ (void) memset(pixels,0,length);
/*
Convert MIFF to XWD raster pixels.
*/
@@ -852,7 +943,10 @@ static MagickBooleanType WriteXWDImage(c
}
for (x=0; x < (ssize_t) scanline_pad; x++)
*q++='\0';
- (void) WriteBlob(image,(size_t) (q-pixels),pixels);
+ length=(size_t) (q-pixels);
+ count=WriteBlob(image,length,pixels);
+ if (count != (ssize_t) length)
+ break;
status=SetImageProgress(image,SaveImageTag,(MagickOffsetType) y,
image->rows);
if (status == MagickFalse)
@@ -860,6 +954,6 @@ static MagickBooleanType WriteXWDImage(c
}
pixels=(unsigned char *) RelinquishMagickMemory(pixels);
(void) CloseBlob(image);
- return(MagickTrue);
+ return(y < (ssize_t) image->rows ? MagickFalse : MagickTrue);
}
#endif