File ImageMagick-CVE-2017-13058.patch of Package ImageMagick.6947

Overview Repositories Revisions Requests Users Attributes Meta

File ImageMagick-CVE-2017-13058.patch of Package ImageMagick.6947

Index: ImageMagick-6.8.8-1/coders/pcx.c
===================================================================
--- ImageMagick-6.8.8-1.orig/coders/pcx.c	2018-02-06 12:23:17.216630516 +0100
+++ ImageMagick-6.8.8-1/coders/pcx.c	2018-02-06 12:26:36.804004131 +0100
@@ -997,7 +997,10 @@ static MagickBooleanType WritePCXImage(c
       }
     length=(((size_t) image->columns*pcx_info.bits_per_pixel+7)/8);
     if (length > 65535UL)
+    {
+      page_table=(MagickOffsetType *) RelinquishMagickMemory(page_table); 
       ThrowWriterException(ImageError,"WidthOrHeightExceedsLimit");
+    }
     pcx_info.bytes_per_line=(unsigned short) length;
     pcx_info.palette_info=1;
     pcx_info.colormap_signature=0x0c;
@@ -1020,7 +1023,10 @@ static MagickBooleanType WritePCXImage(c
     pcx_colormap=(unsigned char *) AcquireQuantumMemory(256UL,
       3*sizeof(*pcx_colormap));
     if (pcx_colormap == (unsigned char *) NULL)
+    {
+      page_table=(MagickOffsetType *) RelinquishMagickMemory(page_table);
       ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
+    }
     (void) memset(pcx_colormap,0,3*256*sizeof(*pcx_colormap));
     q=pcx_colormap;
     if ((image->storage_class == PseudoClass) && (image->colors <= 256))
@@ -1042,6 +1048,7 @@ static MagickBooleanType WritePCXImage(c
     if (pixel_info == (MemoryInfo *) NULL)
       {
         pcx_colormap=(unsigned char *) RelinquishMagickMemory(pcx_colormap);
+        page_table=(MagickOffsetType *) RelinquishMagickMemory(page_table);
         ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
       }
     pixels=(unsigned char *) GetVirtualMemoryBlob(pixel_info);
@@ -1214,7 +1221,10 @@ static MagickBooleanType WritePCXImage(c
       page_table[scene+1]=0;
       offset=SeekBlob(image,0L,SEEK_SET);
       if (offset < 0)
+      {
+        page_table=(MagickOffsetType *) RelinquishMagickMemory(page_table);
         ThrowWriterException(CorruptImageError,"ImproperImageHeader");
+      }
       (void) WriteBlobLSBLong(image,0x3ADE68B1L);
       for (i=0; i <= (ssize_t) scene; i++)
         (void) WriteBlobLSBLong(image,(unsigned int) page_table[i]);

Places

File ImageMagick-CVE-2017-13058.patch of Package ImageMagick.6947

Places