File ImageMagick-CVE-2017-8346.patch of Package ImageMagick.30956
Index: ImageMagick-6.8.8-1/coders/dcm.c
===================================================================
--- ImageMagick-6.8.8-1.orig/coders/dcm.c 2017-05-05 13:31:42.944243167 +0200
+++ ImageMagick-6.8.8-1/coders/dcm.c 2017-05-05 13:48:44.737361678 +0200
@@ -2796,6 +2796,15 @@ static unsigned short ReadDCMMSBShort(DC
static Image *ReadDCMImage(const ImageInfo *image_info,ExceptionInfo *exception)
{
+#define ThrowDCMReaderException(exception,message) \
+{ \
+ if (data != (unsigned char *) NULL) \
+ data=(unsigned char *) RelinquishMagickMemory(data); \
+ if (stream_info != (DCMStreamInfo *) NULL) \
+ stream_info=(DCMStreamInfo *) RelinquishMagickMemory(stream_info); \
+ ThrowReaderException((exception),(message)); \
+}
+
char
explicit_vr[MaxTextExtent],
implicit_vr[MaxTextExtent],
@@ -2892,19 +2901,20 @@ static Image *ReadDCMImage(const ImageIn
/*
Read DCM preamble.
*/
+ data=(unsigned char *) NULL;
stream_info=(DCMStreamInfo *) AcquireMagickMemory(sizeof(*stream_info));
if (stream_info == (DCMStreamInfo *) NULL)
- ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+ ThrowDCMReaderException(ResourceLimitError,"MemoryAllocationFailed");
(void) ResetMagickMemory(stream_info,0,sizeof(*stream_info));
count=ReadBlob(image,128,(unsigned char *) magick);
if (count != 128)
- ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+ ThrowDCMReaderException(CorruptImageError,"ImproperImageHeader");
count=ReadBlob(image,4,(unsigned char *) magick);
if ((count != 4) || (LocaleNCompare(magick,"DICM",4) != 0))
{
offset=SeekBlob(image,0L,SEEK_SET);
if (offset < 0)
- ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+ ThrowDCMReaderException(CorruptImageError,"ImproperImageHeader");
}
/*
Read DCM Medical image.
@@ -2971,7 +2981,7 @@ static Image *ReadDCMImage(const ImageIn
{
offset=SeekBlob(image,(MagickOffsetType) -2,SEEK_CUR);
if (offset < 0)
- ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+ ThrowDCMReaderException(CorruptImageError,"ImproperImageHeader");
quantum=4;
}
else
@@ -3066,7 +3076,7 @@ static Image *ReadDCMImage(const ImageIn
data=(unsigned char *) AcquireQuantumMemory(length+1,quantum*
sizeof(*data));
if (data == (unsigned char *) NULL)
- ThrowReaderException(ResourceLimitError,
+ ThrowDCMReaderException(ResourceLimitError,
"MemoryAllocationFailed");
count=ReadBlob(image,(size_t) quantum*length,data);
if (count != (ssize_t) (quantum*length))
@@ -3074,7 +3084,7 @@ static Image *ReadDCMImage(const ImageIn
(void) FormatLocaleFile(stdout,"count=%d quantum=%d "
"length=%d group=%d\n",(int) count,(int) quantum,(int)
length,(int) group);
- ThrowReaderException(CorruptImageError,
+ ThrowDCMReaderException(CorruptImageError,
"InsufficientImageDataInFile");
}
data[length*quantum]='\0';
@@ -3245,7 +3255,7 @@ static Image *ReadDCMImage(const ImageIn
bytes_per_pixel=2;
depth=bits_allocated;
if (depth > 32)
- ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+ ThrowDCMReaderException(CorruptImageError,"ImproperImageHeader");
max_value=(1UL << bits_allocated)-1;
break;
}
@@ -3260,7 +3270,7 @@ static Image *ReadDCMImage(const ImageIn
bytes_per_pixel=2;
depth=significant_bits;
if (depth > 32)
- ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+ ThrowDCMReaderException(CorruptImageError,"ImproperImageHeader");
max_value=(1UL << significant_bits)-1;
mask=(size_t) GetQuantumRange(significant_bits);
break;
@@ -3311,7 +3321,8 @@ static Image *ReadDCMImage(const ImageIn
graymap=(int *) AcquireQuantumMemory((size_t) colors,
sizeof(*graymap));
if (graymap == (int *) NULL)
- ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+ ThrowDCMReaderException(ResourceLimitError,
+ "MemoryAllocationFailed");
for (i=0; i < (ssize_t) colors; i++)
if (bytes_per_pixel == 1)
graymap[i]=(int) data[i];
@@ -3334,7 +3345,8 @@ static Image *ReadDCMImage(const ImageIn
redmap=(int *) AcquireQuantumMemory((size_t) colors,
sizeof(*redmap));
if (redmap == (int *) NULL)
- ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+ ThrowDCMReaderException(ResourceLimitError,
+ "MemoryAllocationFailed");
p=data;
for (i=0; i < (ssize_t) colors; i++)
{
@@ -3362,7 +3374,8 @@ static Image *ReadDCMImage(const ImageIn
greenmap=(int *) AcquireQuantumMemory((size_t) colors,
sizeof(*greenmap));
if (greenmap == (int *) NULL)
- ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+ ThrowDCMReaderException(ResourceLimitError,
+ "MemoryAllocationFailed");
p=data;
for (i=0; i < (ssize_t) colors; i++)
{
@@ -3390,7 +3403,8 @@ static Image *ReadDCMImage(const ImageIn
bluemap=(int *) AcquireQuantumMemory((size_t) colors,
sizeof(*bluemap));
if (bluemap == (int *) NULL)
- ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+ ThrowDCMReaderException(ResourceLimitError,
+ "MemoryAllocationFailed");
p=data;
for (i=0; i < (ssize_t) colors; i++)
{
@@ -3492,7 +3506,7 @@ static Image *ReadDCMImage(const ImageIn
}
}
if ((width == 0) || (height == 0))
- ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+ ThrowDCMReaderException(CorruptImageError,"ImproperImageHeader");
image->columns=(size_t) width;
image->rows=(size_t) height;
if (signed_data == 0xffff)
@@ -3532,7 +3546,7 @@ static Image *ReadDCMImage(const ImageIn
stream_info->offsets=(ssize_t *) AcquireQuantumMemory(
stream_info->offset_count,sizeof(*stream_info->offsets));
if (stream_info->offsets == (ssize_t *) NULL)
- ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+ ThrowDCMReaderException(ResourceLimitError,"MemoryAllocationFailed");
for (i=0; i < (ssize_t) stream_info->offset_count; i++)
stream_info->offsets[i]=(int) ReadBlobLSBLong(image);
offset=TellBlob(image);
@@ -3570,7 +3584,7 @@ static Image *ReadDCMImage(const ImageIn
if (tag == 0xFFFEE0DD)
break; /* sequence delimiter tag */
if (tag != 0xFFFEE000)
- ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+ ThrowDCMReaderException(CorruptImageError,"ImproperImageHeader");
file=(FILE *) NULL;
unique_file=AcquireUniqueFileResource(filename);
if (unique_file != -1)
@@ -3632,7 +3646,7 @@ static Image *ReadDCMImage(const ImageIn
length=(size_t) (GetQuantumRange(depth)+1);
scale=(Quantum *) AcquireQuantumMemory(length,sizeof(*scale));
if (scale == (Quantum *) NULL)
- ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+ ThrowDCMReaderException(ResourceLimitError,"MemoryAllocationFailed");
range=GetQuantumRange(depth);
for (i=0; i <= (ssize_t) GetQuantumRange(depth); i++)
scale[i]=ScaleAnyToQuantum((size_t) i,range);
@@ -3662,7 +3676,8 @@ static Image *ReadDCMImage(const ImageIn
stream_info->offsets=(ssize_t *) AcquireQuantumMemory(
stream_info->offset_count,sizeof(*stream_info->offsets));
if (stream_info->offsets == (ssize_t *) NULL)
- ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+ ThrowDCMReaderException(ResourceLimitError,
+ "MemoryAllocationFailed");
for (i=0; i < (ssize_t) stream_info->offset_count; i++)
stream_info->offsets[i]=(int) ReadBlobLSBLong(image);
offset=TellBlob(image);
@@ -3687,7 +3702,7 @@ static Image *ReadDCMImage(const ImageIn
if (colors == 0)
colors=one << depth;
if (AcquireImageColormap(image,one << depth) == MagickFalse)
- ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+ ThrowDCMReaderException(ResourceLimitError,"MemoryAllocationFailed");
if (redmap != (int *) NULL)
for (i=0; i < (ssize_t) colors; i++)
{
@@ -3737,7 +3752,7 @@ static Image *ReadDCMImage(const ImageIn
stream_info->remaining=(size_t) ReadBlobLSBLong(image);
if ((tag != 0xFFFEE000) || (stream_info->remaining <= 64) ||
(EOFBlob(image) != MagickFalse))
- ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+ ThrowDCMReaderException(CorruptImageError,"ImproperImageHeader");
stream_info->count=0;
stream_info->segment_count=ReadBlobLSBLong(image);
if (stream_info->segment_count > 1)
