File ImageMagick-meta.c-update.patch of Package ImageMagick.9182
Index: ImageMagick-6.8.8-1/coders/meta.c
===================================================================
--- ImageMagick-6.8.8-1.orig/coders/meta.c 2018-09-15 09:34:46.291973385 +0200
+++ ImageMagick-6.8.8-1/coders/meta.c 2018-09-15 09:50:06.668473552 +0200
@@ -17,13 +17,13 @@
% July 2001 %
% %
% %
-% Copyright 1999-2014 ImageMagick Studio LLC, a non-profit organization %
+% Copyright 1999-2018 ImageMagick Studio LLC, a non-profit organization %
% dedicated to making software imaging solutions freely available. %
% %
% You may not use this file except in compliance with the License. You may %
% obtain a copy of the License at %
% %
-% http://www.imagemagick.org/script/license.php %
+% https://www.imagemagick.org/script/license.php %
% %
% Unless required by applicable law or agreed to in writing, software %
% distributed under the License is distributed on an "AS IS" BASIS, %
@@ -140,18 +140,17 @@ static MagickBooleanType IsMETA(const un
% o exception: return any errors or warnings in this structure.
%
*/
-#define BUFFER_SZ 4096
-
typedef struct _html_code
{
- short
+ const short
len;
+
const char
*code,
val;
} html_code;
-static html_code html_codes[] = {
+static const html_code html_codes[] = {
#ifdef HANDLE_GT_LT
{ 4,"<",'<' },
{ 4,">",'>' },
@@ -199,7 +198,7 @@ static size_t convertHTMLcodes(char *s,
int
value;
- if ((len == 0) || (s == (char*)NULL) || (*s=='\0'))
+ if ((len == 0) || (s == (char*) NULL) || (*s=='\0'))
return(0);
if ((len > 3) && (s[1] == '#') && (strchr(s,';') != (char *) NULL) &&
(sscanf(s,"&#%d;",&value) == 1))
@@ -212,7 +211,7 @@ static size_t convertHTMLcodes(char *s,
break;
}
if (o < 6)
- (void) strcpy(s+1,s+1+o);
+ (void) memmove(s+1,s+1+o,strlen(s+1+o)+1);
*s=value;
return(o);
}
@@ -225,11 +224,12 @@ static size_t convertHTMLcodes(char *s,
codes=sizeof(html_codes)/sizeof(html_code);
for (i=0; i < codes; i++)
{
- if (html_codes[i].len <= len)
+ if (html_codes[i].len <= (ssize_t) len)
if (stringnicmp(s, html_codes[i].code,(size_t) (html_codes[i].len)) == 0)
{
- (void) strcpy(s+1,s+html_codes[i].len);
- *s = html_codes[i].val;
+ (void) memmove(s+1,s+html_codes[i].len,
+ strlen(s+html_codes[i].len)+1);
+ *s=html_codes[i].val;
return(html_codes[i].len-1);
}
}
@@ -284,7 +284,6 @@ static char *super_fgets(char **b, int *
return((char *) p);
}
-#define BUFFER_SZ 4096
#define IPTC_ID 1028
#define THUMBNAIL_ID 1033
@@ -309,7 +308,7 @@ static ssize_t parse8BIM(Image *ifile, I
recnum;
int
- inputlen = BUFFER_SZ;
+ inputlen = MaxTextExtent;
MagickOffsetType
savedpos,
@@ -325,7 +324,9 @@ static ssize_t parse8BIM(Image *ifile, I
dataset = 0;
recnum = 0;
line = (char *) AcquireQuantumMemory((size_t) inputlen,sizeof(*line));
- name = token = (char *)NULL;
+ if (line == (char *) NULL)
+ return(-1);
+ newstr = name = token = (char *) NULL;
savedpos = 0;
token_info=AcquireTokenInfo();
while (super_fgets(&line,&inputlen,ifile)!=NULL)
@@ -334,7 +335,11 @@ static ssize_t parse8BIM(Image *ifile, I
next=0;
token=(char *) AcquireQuantumMemory((size_t) inputlen,sizeof(*token));
+ if (token == (char *) NULL)
+ break;
newstr=(char *) AcquireQuantumMemory((size_t) inputlen,sizeof(*newstr));
+ if (newstr == (char *) NULL)
+ break;
while (Tokenizer(token_info,0,token,(size_t) inputlen,line,"","=","\"",0,
&brkused,&next,"ed)==0)
{
@@ -395,16 +400,16 @@ static ssize_t parse8BIM(Image *ifile, I
if (brkused && next > 0)
{
size_t
- codes_len;
+ codes_length;
char
*s = &token[next-1];
- codes_len = (ssize_t) convertHTMLcodes(s,strlen(s));
- if (codes_len > len)
- len = 0;
+ codes_length=convertHTMLcodes(s, strlen(s));
+ if ((ssize_t) codes_length > len)
+ len=0;
else
- len -= codes_len;
+ len-=codes_length;
}
}
@@ -423,19 +428,24 @@ static ssize_t parse8BIM(Image *ifile, I
ssize_t diff = outputlen - savedolen;
currentpos = TellBlob(ofile);
+ if (currentpos < 0)
+ {
+ line=DestroyString(line);
+ return(-1);
+ }
offset=SeekBlob(ofile,savedpos,SEEK_SET);
if (offset < 0)
- {
- line=DestroyString(line);
- return(-1);
- }
+ {
+ line=DestroyString(line);
+ return(-1);
+ }
(void) WriteBlobMSBLong(ofile,(unsigned int) diff);
offset=SeekBlob(ofile,currentpos,SEEK_SET);
if (offset < 0)
- {
- line=DestroyString(line);
- return(-1);
- }
+ {
+ line=DestroyString(line);
+ return(-1);
+ }
savedolen = 0L;
}
if (outputlen & 1)
@@ -478,6 +488,8 @@ static ssize_t parse8BIM(Image *ifile, I
{
/* patch in a fake length for now and fix it later */
savedpos = TellBlob(ofile);
+ if (savedpos < 0)
+ return(-1);
(void) WriteBlobMSBLong(ofile,0xFFFFFFFFU);
outputlen += 4;
savedolen = outputlen;
@@ -501,12 +513,20 @@ static ssize_t parse8BIM(Image *ifile, I
}
state++;
}
- token=DestroyString(token);
- newstr=DestroyString(newstr);
+ if (token != (char *) NULL)
+ token=DestroyString(token);
+ if (newstr != (char *) NULL)
+ newstr=DestroyString(newstr);
if (name != (char *) NULL)
name=DestroyString(name);
}
token_info=DestroyTokenInfo(token_info);
+ if (token != (char *) NULL)
+ token=DestroyString(token);
+ if (newstr != (char *) NULL)
+ newstr=DestroyString(newstr);
+ if (name != (char *) NULL)
+ name=DestroyString(name);
line=DestroyString(line);
if (savedolen > 0)
{
@@ -516,6 +536,8 @@ static ssize_t parse8BIM(Image *ifile, I
ssize_t diff = outputlen - savedolen;
currentpos = TellBlob(ofile);
+ if (currentpos < 0)
+ return(-1);
offset=SeekBlob(ofile,savedpos,SEEK_SET);
if (offset < 0)
return(-1);
@@ -525,7 +547,52 @@ static ssize_t parse8BIM(Image *ifile, I
return(-1);
savedolen = 0L;
}
- return outputlen;
+ return(outputlen);
+}
+
+MagickExport signed int ReadBlobMSBSignedLong(Image *image)
+{
+ union
+ {
+ unsigned int
+ unsigned_value;
+
+ signed int
+ signed_value;
+ } quantum;
+
+ quantum.unsigned_value=ReadBlobMSBLong(image);
+ return(quantum.signed_value);
+}
+
+MagickExport signed short ReadBlobMSBSignedShort(Image *image)
+{
+ union
+ {
+ unsigned short
+ unsigned_value;
+
+ signed short
+ signed_value;
+ } quantum;
+
+ quantum.unsigned_value=ReadBlobMSBShort(image);
+ return(quantum.signed_value);
+}
+
+MagickExport signed short ReadBlobLSBSignedShort(Image *image)
+{
+ union
+ {
+ unsigned short
+ unsigned_value;
+
+ signed short
+ signed_value;
+ } quantum;
+
+ quantum.unsigned_value=ReadBlobLSBShort(image);
+ return(quantum.signed_value);
}
static char *super_fgets_w(char **b, int *blen, Image *file)
@@ -542,7 +609,7 @@ static char *super_fgets_w(char **b, int
p=(unsigned char *) (*b);
for (q=p; ; q++)
{
- c=(int) ReadBlobLSBShort(file);
+ c=ReadBlobLSBSignedShort(file);
if ((c == -1) || (c == '\n'))
break;
if (EOFBlob(file))
@@ -598,7 +665,7 @@ static ssize_t parse8BIMW(Image *ifile,
recnum;
int
- inputlen = BUFFER_SZ;
+ inputlen = MaxTextExtent;
ssize_t
savedolen = 0L,
@@ -614,7 +681,9 @@ static ssize_t parse8BIMW(Image *ifile,
dataset = 0;
recnum = 0;
line=(char *) AcquireQuantumMemory((size_t) inputlen,sizeof(*line));
- name = token = (char *)NULL;
+ if (line == (char *) NULL)
+ return(-1);
+ newstr = name = token = (char *) NULL;
savedpos = 0;
token_info=AcquireTokenInfo();
while (super_fgets_w(&line,&inputlen,ifile) != NULL)
@@ -623,7 +692,11 @@ static ssize_t parse8BIMW(Image *ifile,
next=0;
token=(char *) AcquireQuantumMemory((size_t) inputlen,sizeof(*token));
+ if (token == (char *) NULL)
+ break;
newstr=(char *) AcquireQuantumMemory((size_t) inputlen,sizeof(*newstr));
+ if (newstr == (char *) NULL)
+ break;
while (Tokenizer(token_info,0,token,(size_t) inputlen,line,"","=","\"",0,
&brkused,&next,"ed)==0)
{
@@ -684,16 +757,16 @@ static ssize_t parse8BIMW(Image *ifile,
if (brkused && next > 0)
{
size_t
- codes_len;
+ codes_length;
char
*s = &token[next-1];
- codes_len = (ssize_t) convertHTMLcodes(s,strlen(s));
- if (codes_len > len)
- len = 0;
+ codes_length=convertHTMLcodes(s, strlen(s));
+ if ((ssize_t) codes_length > len)
+ len=0;
else
- len -= codes_len;
+ len-=codes_length;
}
}
@@ -712,6 +785,8 @@ static ssize_t parse8BIMW(Image *ifile,
ssize_t diff = outputlen - savedolen;
currentpos = TellBlob(ofile);
+ if (currentpos < 0)
+ return(-1);
offset=SeekBlob(ofile,savedpos,SEEK_SET);
if (offset < 0)
return(-1);
@@ -761,6 +836,8 @@ static ssize_t parse8BIMW(Image *ifile,
{
/* patch in a fake length for now and fix it later */
savedpos = TellBlob(ofile);
+ if (savedpos < 0)
+ return(-1);
(void) WriteBlobMSBLong(ofile,0xFFFFFFFFU);
outputlen += 4;
savedolen = outputlen;
@@ -784,11 +861,20 @@ static ssize_t parse8BIMW(Image *ifile,
}
state++;
}
+ if (token != (char *) NULL)
+ token=DestroyString(token);
+ if (newstr != (char *) NULL)
+ newstr=DestroyString(newstr);
+ if (name != (char *) NULL)
+ name=DestroyString(name);
+ }
+ token_info=DestroyTokenInfo(token_info);
+ if (token != (char *) NULL)
token=DestroyString(token);
+ if (newstr != (char *) NULL)
newstr=DestroyString(newstr);
+ if (name != (char *) NULL)
name=DestroyString(name);
- }
- token_info=DestroyTokenInfo(token_info);
line=DestroyString(line);
if (savedolen > 0)
{
@@ -798,6 +884,8 @@ static ssize_t parse8BIMW(Image *ifile,
ssize_t diff = outputlen - savedolen;
currentpos = TellBlob(ofile);
+ if (currentpos < 0)
+ return(-1);
offset=SeekBlob(ofile,savedpos,SEEK_SET);
if (offset < 0)
return(-1);
@@ -1010,7 +1098,7 @@ static int jpeg_embed(Image *ifile, Imag
/* APP0 is in each and every JPEG, so when we hit APP0 we insert our new APP13! */
jpeg_skip_variable(ifile, ofile);
- if (iptc != (Image *)NULL)
+ if (iptc != (Image *) NULL)
{
char
psheader[] = "\xFF\xED\0\0Photoshop 3.0\0" "8BIM\x04\x04\0\0\0\0";
@@ -1082,6 +1170,39 @@ static int jpeg_extract(Image *ifile, Im
}
#endif
+static void CopyBlob(Image *source,Image *destination)
+{
+ ssize_t
+ i;
+
+ unsigned char
+ *buffer;
+
+ ssize_t
+ count,
+ length;
+
+ buffer=(unsigned char *) AcquireQuantumMemory(MagickMaxBufferExtent,
+ sizeof(*buffer));
+ if (buffer != (unsigned char *) NULL)
+ {
+ i=0;
+ while ((length=ReadBlob(source,MagickMaxBufferExtent,buffer)) != 0)
+ {
+ count=0;
+ for (i=0; i < (ssize_t) length; i+=count)
+ {
+ count=WriteBlob(destination,(size_t) (length-i),buffer+i);
+ if (count <= 0)
+ break;
+ }
+ if (i < (ssize_t) length)
+ break;
+ }
+ buffer=(unsigned char *) RelinquishMagickMemory(buffer);
+ }
+}
+
static Image *ReadMETAImage(const ImageInfo *image_info,
ExceptionInfo *exception)
{
@@ -1089,9 +1210,6 @@ static Image *ReadMETAImage(const ImageI
*buff,
*image;
- int
- c;
-
MagickBooleanType
status;
@@ -1144,40 +1262,52 @@ static Image *ReadMETAImage(const ImageI
buff=DestroyImage(buff);
ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
}
+ (void) memset(blob,0,length);
AttachBlob(buff->blob,blob,length);
if (LocaleCompare(image_info->magick,"8BIMTEXT") == 0)
{
length=(size_t) parse8BIM(image, buff);
+ if (length == 0)
+ {
+ blob=DetachBlob(buff->blob);
+ blob=(unsigned char *) RelinquishMagickMemory(blob);
+ buff=DestroyImage(buff);
+ ThrowReaderException(CorruptImageError,"CorruptImage");
+ }
if (length & 1)
(void) WriteBlobByte(buff,0x0);
}
else if (LocaleCompare(image_info->magick,"8BIMWTEXT") == 0)
{
length=(size_t) parse8BIMW(image, buff);
+ if (length == 0)
+ {
+ blob=DetachBlob(buff->blob);
+ blob=(unsigned char *) RelinquishMagickMemory(blob);
+ buff=DestroyImage(buff);
+ ThrowReaderException(CorruptImageError,"CorruptImage");
+ }
if (length & 1)
(void) WriteBlobByte(buff,0x0);
}
else
- {
- for ( ; ; )
- {
- c=ReadBlobByte(image);
- if (c == EOF)
- break;
- (void) WriteBlobByte(buff,(unsigned char) c);
- }
- }
+ CopyBlob(image,buff);
profile=BlobToStringInfo(GetBlobStreamData(buff),(size_t)
GetBlobSize(buff));
if (profile == (StringInfo *) NULL)
- ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+ {
+ blob=DetachBlob(buff->blob);
+ blob=(unsigned char *) RelinquishMagickMemory(blob);
+ buff=DestroyImage(buff);
+ ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+ }
status=SetImageProfile(image,"8bim",profile);
profile=DestroyStringInfo(profile);
- if (status == MagickFalse)
- ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
blob=DetachBlob(buff->blob);
blob=(unsigned char *) RelinquishMagickMemory(blob);
buff=DestroyImage(buff);
+ if (status == MagickFalse)
+ ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
}
if (LocaleNCompare(image_info->magick,"APP1",4) == 0)
{
@@ -1206,7 +1336,7 @@ static Image *ReadMETAImage(const ImageI
if (image_info->profile == (void *) NULL)
{
blob=DetachBlob(buff->blob);
- blob=RelinquishMagickMemory(blob);
+ blob=(unsigned char *) RelinquishMagickMemory(blob);
buff=DestroyImage(buff);
ThrowReaderException(CoderError,"NoIPTCProfileAvailable");
}
@@ -1215,7 +1345,7 @@ static Image *ReadMETAImage(const ImageI
if (iptc == (Image *) NULL)
{
blob=DetachBlob(buff->blob);
- blob=RelinquishMagickMemory(blob);
+ blob=(unsigned char *) RelinquishMagickMemory(blob);
buff=DestroyImage(buff);
ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
}
@@ -1223,70 +1353,27 @@ static Image *ReadMETAImage(const ImageI
GetStringInfoLength(profile));
result=jpeg_embed(image,buff,iptc);
blob=DetachBlob(iptc->blob);
- blob=RelinquishMagickMemory(blob);
+ blob=(unsigned char *) RelinquishMagickMemory(blob);
iptc=DestroyImage(iptc);
if (result == 0)
- {
- blob=DetachBlob(buff->blob);
- blob=RelinquishMagickMemory(blob);
- buff=DestroyImage(buff);
- ThrowReaderException(CoderError,"JPEGEmbeddingFailed");
- }
+ ThrowReaderException(CoderError,"JPEGEmbeddingFailed");
}
else
- {
-#ifdef SLOW_METHOD
- for ( ; ; )
- {
- /* Really - really slow - FIX ME PLEASE!!!! */
- c=ReadBlobByte(image);
- if (c == EOF)
- break;
- (void) WriteBlobByte(buff,c);
- }
-#else
- ssize_t
- i;
-
- unsigned char
- *buffer;
-
- ssize_t
- count,
- length;
-
- buffer=(unsigned char *) AcquireQuantumMemory(MagickMaxBufferExtent,
- sizeof(*buffer));
- if (buffer != (unsigned char *) NULL)
- {
- i=0;
- while ((length=ReadBlob(image,MagickMaxBufferExtent,buffer)) != 0)
- {
- count=0;
- for (i=0; i < (ssize_t) length; i+=count)
- {
- count=WriteBlob(buff,(size_t) (length-i),buffer+i);
- if (count <= 0)
- break;
- }
- if (i < (ssize_t) length)
- break;
- }
- buffer=(unsigned char *) RelinquishMagickMemory(buffer);
- }
-#endif
- }
+ CopyBlob(image,buff);
profile=BlobToStringInfo(GetBlobStreamData(buff),(size_t)
GetBlobSize(buff));
if (profile == (StringInfo *) NULL)
ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
status=SetImageProfile(image,name,profile);
profile=DestroyStringInfo(profile);
- if (status == MagickFalse)
- ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
blob=DetachBlob(buff->blob);
- blob=RelinquishMagickMemory(blob);
+ blob=(unsigned char *) RelinquishMagickMemory(blob);
buff=DestroyImage(buff);
+ if (status == MagickFalse)
+ {
+ buff=DestroyImage(buff);
+ ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+ }
}
if ((LocaleCompare(image_info->magick,"ICC") == 0) ||
(LocaleCompare(image_info->magick,"ICM") == 0))
@@ -1301,17 +1388,16 @@ static Image *ReadMETAImage(const ImageI
ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
}
AttachBlob(buff->blob,blob,length);
- for ( ; ; )
- {
- c=ReadBlobByte(image);
- if (c == EOF)
- break;
- (void) WriteBlobByte(buff,(unsigned char) c);
- }
+ CopyBlob(image,buff);
profile=BlobToStringInfo(GetBlobStreamData(buff),(size_t)
GetBlobSize(buff));
if (profile == (StringInfo *) NULL)
- ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+ {
+ blob=DetachBlob(buff->blob);
+ blob=(unsigned char *) RelinquishMagickMemory(blob);
+ buff=DestroyImage(buff);
+ ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+ }
(void) SetImageProfile(image,"icc",profile);
profile=DestroyStringInfo(profile);
blob=DetachBlob(buff->blob);
@@ -1320,9 +1406,6 @@ static Image *ReadMETAImage(const ImageI
}
if (LocaleCompare(image_info->magick,"IPTC") == 0)
{
- register unsigned char
- *p;
-
buff=AcquireImage((ImageInfo *) NULL);
if (buff == (Image *) NULL)
ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
@@ -1333,41 +1416,17 @@ static Image *ReadMETAImage(const ImageI
ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
}
AttachBlob(buff->blob,blob,length);
- /* write out the header - length field patched below */
- (void) WriteBlob(buff,11,(unsigned char *) "8BIM\04\04\0\0\0\0\0");
- (void) WriteBlobByte(buff,0xc6);
- if (LocaleCompare(image_info->magick,"IPTCTEXT") == 0)
- {
- length=(size_t) parse8BIM(image,buff);
- if (length & 1)
- (void) WriteBlobByte(buff,0x00);
- }
- else if (LocaleCompare(image_info->magick,"IPTCWTEXT") == 0)
- {
- }
- else
- {
- for ( ; ; )
- {
- c=ReadBlobByte(image);
- if (c == EOF)
- break;
- (void) WriteBlobByte(buff,(unsigned char) c);
- }
- }
+ CopyBlob(image,buff);
profile=BlobToStringInfo(GetBlobStreamData(buff),(size_t)
GetBlobSize(buff));
if (profile == (StringInfo *) NULL)
- ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
- /*
- subtract off the length of the 8BIM stuff.
- */
- length=GetStringInfoLength(profile)-12;
- p=GetStringInfoDatum(profile);
- p[10]=(unsigned char) (length >> 8);
- p[11]=(unsigned char) (length & 0xff);
- SetStringInfoDatum(profile,GetBlobStreamData(buff));
- (void) SetImageProfile(image,"8bim",profile);
+ {
+ blob=DetachBlob(buff->blob);
+ blob=(unsigned char *) RelinquishMagickMemory(blob);
+ buff=DestroyImage(buff);
+ ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+ }
+ (void) SetImageProfile(image,"iptc",profile);
profile=DestroyStringInfo(profile);
blob=DetachBlob(buff->blob);
blob=(unsigned char *) RelinquishMagickMemory(blob);
@@ -1385,17 +1444,16 @@ static Image *ReadMETAImage(const ImageI
ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
}
AttachBlob(buff->blob,blob,length);
- for ( ; ; )
- {
- c=ReadBlobByte(image);
- if (c == EOF)
- break;
- (void) WriteBlobByte(buff,(unsigned char) c);
- }
+ CopyBlob(image,buff);
profile=BlobToStringInfo(GetBlobStreamData(buff),(size_t)
GetBlobSize(buff));
if (profile == (StringInfo *) NULL)
- ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+ {
+ blob=DetachBlob(buff->blob);
+ blob=(unsigned char *) RelinquishMagickMemory(blob);
+ buff=DestroyImage(buff);
+ ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+ }
(void) SetImageProfile(image,"xmp",profile);
profile=DestroyStringInfo(profile);
blob=DetachBlob(buff->blob);
@@ -1821,7 +1879,7 @@ static void formatString(Image *ofile, c
typedef struct _tag_spec
{
- short
+ const short
id;
const char
@@ -1850,6 +1908,7 @@ static const tag_spec tags[] = {
{ 80, "Byline" },
{ 85, "Byline Title" },
{ 90, "City" },
+ { 92, "Sub-Location" },
{ 95, "Province State" },
{ 100, "Country Code" },
{ 101, "Country" },
@@ -1919,21 +1978,26 @@ static int formatIPTC(Image *ifile, Imag
while (c != EOF)
{
if (c == 0x1c)
- foundiptc = 1;
+ foundiptc=1;
else
{
if (foundiptc)
- return -1;
+ return(-1);
else
- continue;
+ {
+ c=0;
+ continue;
+ }
}
/* we found the 0x1c tag and now grab the dataset and record number tags */
c = ReadBlobByte(ifile);
- if (c == EOF) return -1;
+ if (c == EOF)
+ return(-1);
dataset = (unsigned char) c;
c = ReadBlobByte(ifile);
- if (c == EOF) return -1;
+ if (c == EOF)
+ return(-1);
recnum = (unsigned char) c;
/* try to match this record to one of the ones in our named table */
for (i=0; i< tagcount; i++)
@@ -1949,35 +2013,38 @@ static int formatIPTC(Image *ifile, Imag
We decode the length of the block that follows - ssize_t or short fmt.
*/
c=ReadBlobByte(ifile);
- if (c == EOF) return -1;
+ if (c == EOF)
+ return(-1);
if (c & (unsigned char) 0x80)
- return 0;
+ return(0);
else
{
int
c0;
c0=ReadBlobByte(ifile);
- if (c0 == EOF) return -1;
+ if (c0 == EOF)
+ return(-1);
taglen = (c << 8) | c0;
}
- if (taglen < 0) return -1;
+ if (taglen < 0)
+ return(-1);
/* make a buffer to hold the tag datand snag it from the input stream */
str=(unsigned char *) AcquireQuantumMemory((size_t) (taglen+MaxTextExtent),
sizeof(*str));
if (str == (unsigned char *) NULL)
{
- printf("MemoryAllocationFailed");
+ (void) printf("MemoryAllocationFailed");
return 0;
}
for (tagindx=0; tagindx<taglen; tagindx++)
{
c=ReadBlobByte(ifile);
if (c == EOF)
- {
- str=(unsigned char *) RelinquishMagickMemory(str);
- return -1;
- }
+ {
+ str=(unsigned char *) RelinquishMagickMemory(str);
+ return(-1);
+ }
str[tagindx] = (unsigned char) c;
}
str[taglen] = 0;
@@ -2096,19 +2163,21 @@ static int formatIPTCfromBuffer(Image *o
}
if (taglen < 0)
return(-1);
+ if (taglen > 65535)
+ return(-1);
/* make a buffer to hold the tag datand snag it from the input stream */
str=(unsigned char *) AcquireQuantumMemory((size_t) (taglen+MaxTextExtent),
sizeof(*str));
if (str == (unsigned char *) NULL)
- {
- printf("MemoryAllocationFailed");
- return 0;
- }
+ return 0;
for (tagindx=0; tagindx<taglen; tagindx++)
{
c = *s++; len--;
if (len < 0)
- return(-1);
+ {
+ str=(unsigned char *) RelinquishMagickMemory(str);
+ return(-1);
+ }
str[tagindx]=(unsigned char) c;
}
str[taglen]=0;
@@ -2183,7 +2252,7 @@ static int format8BIM(Image *ifile, Imag
/*
We found the OSType (8BIM) and now grab the ID, PString, and Size fields.
*/
- ID=(int) ReadBlobMSBShort(ifile);
+ ID=ReadBlobMSBSignedShort(ifile);
if (ID < 0)
return(-1);
{
@@ -2197,10 +2266,7 @@ static int format8BIM(Image *ifile, Imag
PString=(unsigned char *) AcquireQuantumMemory((size_t) (plen+
MaxTextExtent),sizeof(*PString));
if (PString == (unsigned char *) NULL)
- {
- printf("MemoryAllocationFailed");
- return 0;
- }
+ return 0;
for (i=0; i<plen; i++)
{
c=ReadBlobByte(ifile);
@@ -2222,18 +2288,17 @@ static int format8BIM(Image *ifile, Imag
}
}
}
- count = (int) ReadBlobMSBLong(ifile);
- if (count < 0)
+ count=(ssize_t) ReadBlobMSBSignedLong(ifile);
+ if ((count < 0) || (count > GetBlobSize(ifile)))
{
PString=(unsigned char *) RelinquishMagickMemory(PString);
return(-1);
}
- /* make a buffer to hold the datand snag it from the input stream */
- str=(unsigned char *) AcquireQuantumMemory((size_t) count,sizeof(*str));
+ /* make a buffer to hold the data and snag it from the input stream */
+ str=(unsigned char *) AcquireQuantumMemory((size_t) count+1,sizeof(*str));
if (str == (unsigned char *) NULL)
{
PString=(unsigned char *) RelinquishMagickMemory(PString);
- printf("MemoryAllocationFailed");
return 0;
}
for (i=0; i < (ssize_t) count; i++)
@@ -2241,6 +2306,7 @@ static int format8BIM(Image *ifile, Imag
c=ReadBlobByte(ifile);
if (c == EOF)
{
+ str=(unsigned char *) RelinquishMagickMemory(str);
PString=(unsigned char *) RelinquishMagickMemory(PString);
return(-1);
}
