File ImageMagick-xwd.c-update.patch of Package ImageMagick.28258

Overview Repositories Revisions Requests Users Attributes Meta

File ImageMagick-xwd.c-update.patch of Package ImageMagick.28258

Index: ImageMagick-7.0.7-34/coders/xwd.c
===================================================================
--- ImageMagick-7.0.7-34.orig/coders/xwd.c	2018-05-20 17:55:43.000000000 +0200
+++ ImageMagick-7.0.7-34/coders/xwd.c	2019-04-30 12:06:11.158174993 +0200
@@ -17,13 +17,13 @@
 %                                 July 1992                                   %
 %                                                                             %
 %                                                                             %
-%  Copyright 1999-2018 ImageMagick Studio LLC, a non-profit organization      %
+%  Copyright 1999-2019 ImageMagick Studio LLC, a non-profit organization      %
 %  dedicated to making software imaging solutions freely available.           %
 %                                                                             %
 %  You may not use this file except in compliance with the License.  You may  %
 %  obtain a copy of the License at                                            %
 %                                                                             %
-%    https://www.imagemagick.org/script/license.php                           %
+%    https://imagemagick.org/script/license.php                               %
 %                                                                             %
 %  Unless required by applicable law or agreed to in writing, software        %
 %  distributed under the License is distributed on an "AS IS" BASIS,          %
@@ -40,6 +40,7 @@
   Include declarations.
 */
 #include "MagickCore/studio.h"
+#include "MagickCore/attribute.h"
 #include "MagickCore/blob.h"
 #include "MagickCore/blob-private.h"
 #include "MagickCore/cache.h"
@@ -236,27 +237,92 @@ static Image *ReadXWDImage(const ImageIn
   if (header.file_version != XWD_FILE_VERSION)
     ThrowReaderException(CorruptImageError,"FileFormatVersionMismatch");
   if (header.header_size < sz_XWDheader)
-    ThrowReaderException(CorruptImageError,"CorruptImage");
-  switch (header.visual_class) {
+    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+  if (header.xoffset >= header.pixmap_width)
+    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+  switch (header.visual_class)
+  {
     case StaticGray:
     case GrayScale:
+    {
+      if (header.bits_per_pixel != 1)
+        ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+      break;
+    }
     case StaticColor:
     case PseudoColor:
+    {
+      if ((header.bits_per_pixel < 1) || (header.bits_per_pixel > 15) ||
+          (header.colormap_entries == 0))
+        ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+      break;
+    }
     case TrueColor:
     case DirectColor:
+    {
+      if ((header.bits_per_pixel != 16) && (header.bits_per_pixel != 24) &&
+          (header.bits_per_pixel != 32))
+        ThrowReaderException(CorruptImageError,"ImproperImageHeader");
       break;
-    default:
-      ThrowReaderException(CorruptImageError,"CorruptImage");
     }
-  switch (header.pixmap_format) {
+    default:
+      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+  }
+  switch (header.pixmap_format)
+  {
     case XYBitmap:
+    {
+      if (header.pixmap_depth != 1)
+        ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+      break;
+    }
     case XYPixmap:
     case ZPixmap:
+    {
+      if ((header.pixmap_depth < 1) || (header.pixmap_depth > 32))
+        ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+      switch (header.bitmap_pad)
+      {
+        case 8:
+        case 16:
+        case 32:
+          break;
+        default:
+          ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+      }
+      break;
+    }
+    default:
+      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+  }
+  switch (header.bitmap_unit)
+  {
+    case 8:
+    case 16:
+    case 32:
+      break;
+    default:
+      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+  }
+  switch (header.byte_order)
+  {
+    case LSBFirst:
+    case MSBFirst:
       break;
     default:
-      ThrowReaderException(CorruptImageError,"CorruptImage");
+      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   }
-  length=(size_t) header.header_size-sz_XWDheader;
+  switch (header.bitmap_bit_order)
+  {
+    case LSBFirst:
+    case MSBFirst:
+      break;
+    default:
+      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+  }
+  if (((header.bitmap_pad % 8) != 0) || (header.bitmap_pad > 32))
+    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+  length=(size_t) (header.header_size-sz_XWDheader);
   comment=(char *) AcquireQuantumMemory(length+1,sizeof(*comment));
   if (comment == (char *) NULL)
     ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
@@ -287,10 +353,11 @@ static Image *ReadXWDImage(const ImageIn
   ximage->red_mask=header.red_mask;
   ximage->green_mask=header.green_mask;
   ximage->blue_mask=header.blue_mask;
-  if ((ximage->width < 0) || (ximage->height < 0) || (ximage->depth < 0) ||    
-      (ximage->format < 0) || (ximage->byte_order < 0) || 
-      (ximage->bitmap_bit_order < 0) || (ximage->bitmap_pad < 0) || 
-      (ximage->bytes_per_line < 0))
+  if ((ximage->depth < 0) || (ximage->format < 0) || (ximage->xoffset < 0) ||
+      (ximage->width < 0) || (ximage->height < 0) || (ximage->bitmap_pad < 0) ||
+      (ximage->bytes_per_line < 0) || (ximage->byte_order < 0) ||
+      (ximage->bitmap_unit < 0) || (ximage->bitmap_bit_order < 0) ||
+      (ximage->bits_per_pixel < 0))
     {
       ximage=(XImage *) RelinquishMagickMemory(ximage);
       ThrowReaderException(CorruptImageError,"ImproperImageHeader");
@@ -477,18 +544,18 @@ static Image *ReadXWDImage(const ImageIn
             for (x=0; x < (ssize_t) image->columns; x++)
             {
               pixel=XGetPixel(ximage,(int) x,(int) y);
-              index=(Quantum) ((pixel >> red_shift) & red_mask);
-              if (index < header.ncolors)
-                SetPixelRed(image,ScaleShortToQuantum(
-                  colors[(ssize_t) index].red),q);
-              index=(Quantum) ((pixel >> green_shift) & green_mask);
-              if (index < header.ncolors)
-                SetPixelGreen(image,ScaleShortToQuantum(
-                  colors[(ssize_t) index].green),q);
-              index=(Quantum) ((pixel >> blue_shift) & blue_mask);
-              if (index < header.ncolors)
-                SetPixelBlue(image,ScaleShortToQuantum(
-                  colors[(ssize_t) index].blue),q);
+              index=(Quantum) ConstrainColormapIndex(image,(ssize_t) (pixel >>
+                red_shift) & red_mask,exception);
+              SetPixelRed(image,ScaleShortToQuantum(
+                colors[(ssize_t) index].red),q);
+              index=(Quantum) ConstrainColormapIndex(image,(ssize_t) (pixel >>
+                green_shift) & green_mask,exception);
+              SetPixelGreen(image,ScaleShortToQuantum(
+                colors[(ssize_t) index].green),q);
+              index=(Quantum) ConstrainColormapIndex(image,(ssize_t) (pixel >>
+                blue_shift) & blue_mask,exception);
+              SetPixelBlue(image,ScaleShortToQuantum(
+                colors[(ssize_t) index].blue),q);
               q+=GetPixelChannels(image);
             }
             if (SyncAuthenticPixels(image,exception) == MagickFalse)
@@ -560,8 +627,8 @@ static Image *ReadXWDImage(const ImageIn
             break;
           for (x=0; x < (ssize_t) image->columns; x++)
           {
-            index=ConstrainColormapIndex(image,XGetPixel(ximage,(int) x,
-              (int) y),exception);
+            index=(Quantum) ConstrainColormapIndex(image,(ssize_t)
+              XGetPixel(ximage,(int) x,(int) y),exception);
             SetPixelIndex(image,index,q);
             SetPixelViaPixelInfo(image,image->colormap+(ssize_t) index,q);
             q+=GetPixelChannels(image);
@@ -708,6 +775,7 @@ static MagickBooleanType WriteXWDImage(c
     scanline_pad;
 
   ssize_t
+    count,
     y;
 
   unsigned char
@@ -733,6 +801,11 @@ static MagickBooleanType WriteXWDImage(c
   status=OpenBlob(image_info,image,WriteBinaryBlobMode,exception);
   if (status == MagickFalse)
     return(status);
+  if ((image->columns != (CARD32) image->columns) ||
+      (image->rows != (CARD32) image->rows))
+    ThrowWriterException(ImageError,"WidthOrHeightExceedsLimit");
+  if ((image->storage_class == PseudoClass) && (image->colors > 256))
+    (void) SetImageType(image,TrueColorType,exception);
   (void) TransformImageColorspace(image,sRGBColorspace,exception);
   /*
     Initialize XWD file header.
@@ -820,8 +893,8 @@ static MagickBooleanType WriteXWDImage(c
           {
             MSBOrderLong((unsigned char *) &colors[i].pixel,
               sizeof(colors[i].pixel));
-            MSBOrderShort((unsigned char *) &colors[i].red,
-              3*sizeof(colors[i].red));
+            MSBOrderShort((unsigned char *) &colors[i].red,3*
+              sizeof(colors[i].red));
           }
       }
       for (i=0; i < (ssize_t) image->colors; i++)
@@ -831,7 +904,9 @@ static MagickBooleanType WriteXWDImage(c
         color.green=colors[i].green;
         color.blue=colors[i].blue;
         color.flags=(CARD8) colors[i].flags;
-        (void) WriteBlob(image,sz_XWDColor,(unsigned char *) &color);
+        count=WriteBlob(image,sz_XWDColor,(unsigned char *) &color);
+        if (count != (ssize_t) sz_XWDColor)
+          break;
       }
       colors=(XColor *) RelinquishMagickMemory(colors);
     }
@@ -873,7 +948,10 @@ static MagickBooleanType WriteXWDImage(c
       }
     for (x=0; x < (ssize_t) scanline_pad; x++)
       *q++='\0';
-    (void) WriteBlob(image,(size_t) (q-pixels),pixels);
+    length=(size_t) (q-pixels);
+    count=WriteBlob(image,length,pixels);
+    if (count != (ssize_t) length)
+      break;
     status=SetImageProgress(image,SaveImageTag,(MagickOffsetType) y,
       image->rows);
     if (status == MagickFalse)
@@ -881,6 +959,6 @@ static MagickBooleanType WriteXWDImage(c
   }
   pixels=(unsigned char *) RelinquishMagickMemory(pixels);
   (void) CloseBlob(image);
-  return(MagickTrue);
+  return(y < (ssize_t) image->rows ? MagickFalse :  MagickTrue);
 }
 #endif

Places

File ImageMagick-xwd.c-update.patch of Package ImageMagick.28258

Places