File ImageMagick-CVE-2018-16642.patch of Package ImageMagick.9293
Index: ImageMagick-6.8.8-1/coders/cut.c
===================================================================
--- ImageMagick-6.8.8-1.orig/coders/cut.c 2018-09-11 11:52:02.022827506 +0200
+++ ImageMagick-6.8.8-1/coders/cut.c 2018-09-11 11:55:25.523993336 +0200
@@ -94,130 +94,159 @@ typedef struct
} CUTPalHeader;
-static void InsertRow(ssize_t depth,unsigned char *p,ssize_t y,Image *image)
+static MagickBooleanType InsertRow(ssize_t bpp,unsigned char *p,ssize_t y,Image *image)
{
ExceptionInfo
*exception;
- size_t bit; ssize_t x;
- register PixelPacket *q;
- IndexPacket index;
- register IndexPacket *indexes;
+ int
+ bit;
+
+ ssize_t
+ x;
+
+ register PixelPacket
+ *q;
+
+ IndexPacket
+ index;
+
+ register IndexPacket
+ *indexes;
- index=(IndexPacket) 0;
exception=(&image->exception);
- switch (depth)
- {
+ q=QueueAuthenticPixels(image,0,y,image->columns,1,exception);
+ if (q == (PixelPacket *) NULL)
+ return(MagickFalse);
+ indexes=GetAuthenticIndexQueue(image);
+ switch (bpp)
+ {
case 1: /* Convert bitmap scanline. */
{
- q=QueueAuthenticPixels(image,0,y,image->columns,1,exception);
- if (q == (PixelPacket *) NULL)
- break;
- indexes=GetAuthenticIndexQueue(image);
for (x=0; x < ((ssize_t) image->columns-7); x+=8)
- {
- for (bit=0; bit < 8; bit++)
{
- index=(IndexPacket) ((((*p) & (0x80 >> bit)) != 0) ? 0x01 : 0x00);
- SetPixelIndex(indexes+x+bit,index);
+ for (bit=0; bit < 8; bit++)
+ {
+ index=((*p) & (0x80 >> bit) ? 0x01 : 0x00);
+ SetPixelIndex(indexes+x+bit,index);
+ SetPixelRGBO(q,image->colormap+(ssize_t) index);
+ q++;
+ }
+ p++;
}
- p++;
- }
if ((image->columns % 8) != 0)
{
- for (bit=0; bit < (image->columns % 8); bit++)
+ for (bit=0; bit < (ssize_t) (image->columns % 8); bit++)
{
- index=(IndexPacket) ((((*p) & (0x80 >> bit)) != 0) ? 0x01 : 0x00);
+ index=((*p) & (0x80 >> bit) ? 0x01 : 0x00);
SetPixelIndex(indexes+x+bit,index);
+ SetPixelRGBO(q,image->colormap+(ssize_t) index);
+ q++;
}
p++;
}
- if (SyncAuthenticPixels(image,exception) == MagickFalse)
- break;
break;
}
case 2: /* Convert PseudoColor scanline. */
{
- q=QueueAuthenticPixels(image,0,y,image->columns,1,exception);
- if (q == (PixelPacket *) NULL)
- break;
- indexes=GetAuthenticIndexQueue(image);
- for (x=0; x < ((ssize_t) image->columns-1); x+=2)
- {
+ if ((image->storage_class != PseudoClass) ||
+ (indexes == (IndexPacket *) NULL))
+ return MagickFalse;
+ for (x=0; x < ((ssize_t) image->columns-3); x+=4)
+ {
index=ConstrainColormapIndex(image,(*p >> 6) & 0x3);
SetPixelIndex(indexes+x,index);
+ SetPixelRGBO(q,image->colormap+(ssize_t) index);
+ q++;
index=ConstrainColormapIndex(image,(*p >> 4) & 0x3);
SetPixelIndex(indexes+x,index);
+ SetPixelRGBO(q,image->colormap+(ssize_t) index);
+ q++;
index=ConstrainColormapIndex(image,(*p >> 2) & 0x3);
SetPixelIndex(indexes+x,index);
+ SetPixelRGBO(q,image->colormap+(ssize_t) index);
+ q++;
index=ConstrainColormapIndex(image,(*p) & 0x3);
SetPixelIndex(indexes+x+1,index);
+ SetPixelRGBO(q,image->colormap+(ssize_t) index);
+ q++;
p++;
- }
- if ((image->columns % 4) != 0)
+ }
+ if ((image->columns % 4) != 0)
{
index=ConstrainColormapIndex(image,(*p >> 6) & 0x3);
SetPixelIndex(indexes+x,index);
- if ((image->columns % 4) >= 1)
-
+ SetPixelRGBO(q,image->colormap+(ssize_t) index);
+ q++;
+ if ((image->columns % 4) > 1)
{
index=ConstrainColormapIndex(image,(*p >> 4) & 0x3);
SetPixelIndex(indexes+x,index);
- if ((image->columns % 4) >= 2)
-
+ SetPixelRGBO(q,image->colormap+(ssize_t) index);
+ q++;
+ if ((image->columns % 4) > 2)
{
index=ConstrainColormapIndex(image,(*p >> 2) & 0x3);
SetPixelIndex(indexes+x,index);
- }
- }
+ SetPixelRGBO(q,image->colormap+(ssize_t) index);
+ q++;
+ }
+ }
p++;
- }
- if (SyncAuthenticPixels(image,exception) == MagickFalse)
- break;
+ }
break;
- }
-
+ }
+
case 4: /* Convert PseudoColor scanline. */
{
- q=QueueAuthenticPixels(image,0,y,image->columns,1,exception);
- if (q == (PixelPacket *) NULL)
- break;
- indexes=GetAuthenticIndexQueue(image);
for (x=0; x < ((ssize_t) image->columns-1); x+=2)
{
- index=ConstrainColormapIndex(image,(*p >> 4) & 0xf);
+ index=ConstrainColormapIndex(image,(*p >> 4) & 0x0f);
SetPixelIndex(indexes+x,index);
- index=ConstrainColormapIndex(image,(*p) & 0xf);
+ SetPixelRGBO(q,image->colormap+(ssize_t) index);
+ q++;
+ index=ConstrainColormapIndex(image,(*p) & 0x0f);
SetPixelIndex(indexes+x+1,index);
+ SetPixelRGBO(q,image->colormap+(ssize_t) index);
p++;
+ q++;
}
if ((image->columns % 2) != 0)
{
- index=ConstrainColormapIndex(image,(*p >> 4) & 0xf);
+ index=ConstrainColormapIndex(image,(*p >> 4) & 0x0f);
SetPixelIndex(indexes+x,index);
+ SetPixelRGBO(q,image->colormap+(ssize_t) index);
p++;
+ q++;
}
- if (SyncAuthenticPixels(image,exception) == MagickFalse)
- break;
break;
}
case 8: /* Convert PseudoColor scanline. */
{
- q=QueueAuthenticPixels(image,0,y,image->columns,1,exception);
- if (q == (PixelPacket *) NULL) break;
- indexes=GetAuthenticIndexQueue(image);
for (x=0; x < (ssize_t) image->columns; x++)
- {
- index=ConstrainColormapIndex(image,*p);
- SetPixelIndex(indexes+x,index);
- p++;
- }
- if (SyncAuthenticPixels(image,exception) == MagickFalse)
- break;
+ {
+ index=ConstrainColormapIndex(image,*p);
+ SetPixelIndex(indexes+x,index);
+ SetPixelRGBO(q,image->colormap+(ssize_t) index);
+ p++;
+ q++;
+ }
}
break;
+ case 24: /* Convert DirectColor scanline. */
+ for (x=0; x < (ssize_t) image->columns; x++)
+ {
+ SetPixelRed(q,ScaleCharToQuantum(*p++));
+ SetPixelGreen(q,ScaleCharToQuantum(*p++));
+ SetPixelBlue(q,ScaleCharToQuantum(*p++));
+ q++;
+ }
+ break;
}
+ if (!SyncAuthenticPixels(image,exception))
+ return(MagickFalse);
+ return(MagickTrue);
}
/*
