File ImageMagick-CVE-2017-11639.patch of Package ImageMagick.16891
--- a/coders/cip.c
+++ b/coders/cip.c
@@ -240,13 +240,39 @@ static MagickBooleanType WriteCIPImage(const ImageInfo *image_info,Image *image)
}
if ((image->columns % 4) != 0)
{
- i=(ssize_t) image->columns % 4;
- byte=(unsigned char)
- ((((size_t) (3*ClampToQuantum(GetPixelLuma(image,p+MagickMin(i,3)))/QuantumRange) & 0x03) << 6) |
- (((size_t) (3*ClampToQuantum(GetPixelLuma(image,p+MagickMin(i,2)))/QuantumRange) & 0x03) << 4) |
- (((size_t) (3*ClampToQuantum(GetPixelLuma(image,p+MagickMin(i,1)))/QuantumRange) & 0x03) << 2) |
- (((size_t) (3*ClampToQuantum(GetPixelLuma(image,p+MagickMin(i,0)))/QuantumRange) & 0x03) << 0));
- (void) FormatLocaleString(buffer,MaxTextExtent,"%02x",~byte);
+ byte=0;
+ for ( ; x < (ssize_t) image->columns; x++)
+ {
+ i=x % 4;
+ switch (i)
+ {
+ case 0:
+ {
+ byte|=(unsigned char) (((size_t) (3*ClampToQuantum(GetPixelLuma(
+ image,p+MagickMin(i,3)))/QuantumRange) & 0x03) << 6);
+ break;
+ }
+ case 1:
+ {
+ byte|=(unsigned char) (((size_t) (3*ClampToQuantum(GetPixelLuma(
+ image,p+MagickMin(i,2)))/QuantumRange) & 0x03) << 4);
+ break;
+ }
+ case 2:
+ {
+ byte|=(unsigned char) (((size_t) (3*ClampToQuantum(GetPixelLuma(
+ image,p+MagickMin(i,1)))/QuantumRange) & 0x03) << 2);
+ break;
+ }
+ case 3:
+ {
+ byte|=(unsigned char) (((size_t) (3*ClampToQuantum(GetPixelLuma(
+ image,p+MagickMin(i,0)))/QuantumRange) & 0x03) << 0);
+ break;
+ }
+ }
+ }
+ (void) FormatLocaleString(buffer,MaxTextExtent,"%02x",~byte);
(void) WriteBlobString(image,buffer);
}
status=SetImageProgress(image,SaveImageTag,(MagickOffsetType) y,