File ImageMagick-CVE-2023-34151.patch of Package ImageMagick
Index: ImageMagick-7.1.0-9/MagickCore/annotate.c
===================================================================
--- ImageMagick-7.1.0-9.orig/MagickCore/annotate.c
+++ ImageMagick-7.1.0-9/MagickCore/annotate.c
@@ -336,7 +336,7 @@ MagickExport MagickBooleanType AnnotateI
(void) CloneString(&annotate->text,textlist[i]);
if ((metrics.width == 0) || (annotate->gravity != NorthWestGravity))
(void) GetTypeMetrics(image,annotate,&metrics,exception);
- height=(size_t) floor(metrics.ascent-metrics.descent+0.5);
+ height=CastDoubleToUnsigned(metrics.ascent-metrics.descent+0.5);
if (height == 0)
height=draw_info->pointsize;
height+=(size_t) floor(draw_info->interline_spacing+0.5);
@@ -665,7 +665,7 @@ MagickExport ssize_t FormatMagickCaption
status=GetTypeMetrics(image,draw_info,metrics,exception);
if (status == MagickFalse)
break;
- width=(size_t) floor(metrics->width+draw_info->stroke_width+0.5);
+ width=CastDoubleToUnsigned(metrics->width+draw_info->stroke_width+0.5);
if (width <= image->columns)
continue;
if (s != (char *) NULL)
Index: ImageMagick-7.1.0-9/MagickCore/draw.c
===================================================================
--- ImageMagick-7.1.0-9.orig/MagickCore/draw.c
+++ ImageMagick-7.1.0-9/MagickCore/draw.c
@@ -3483,7 +3483,7 @@ static MagickBooleanType RenderMVGConten
(void) GetNextToken(q,&q,extent,token);
if (*token == ',')
(void) GetNextToken(q,&q,extent,token);
- region.height=(size_t) floor(GetDrawValue(token,&next_token)+
+ region.height=CastDoubleToUnsigned(GetDrawValue(token,&next_token)+
0.5);
if (token == next_token)
ThrowPointExpectedException(token,exception);
Index: ImageMagick-7.1.0-9/MagickCore/geometry.c
===================================================================
--- ImageMagick-7.1.0-9.orig/MagickCore/geometry.c
+++ ImageMagick-7.1.0-9/MagickCore/geometry.c
@@ -1424,8 +1424,8 @@ MagickExport MagickStatusType ParseMetaG
scale.y=geometry_info.sigma;
if ((percent_flags & SigmaValue) == 0)
scale.y=scale.x;
- *width=(size_t) floor(scale.x*former_width/100.0+0.5);
- *height=(size_t) floor(scale.y*former_height/100.0+0.5);
+ *width=CastDoubleToUnsigned(scale.x*former_width/100.0+0.5);
+ *height=CastDoubleToUnsigned(scale.y*former_height/100.0+0.5);
former_width=(*width);
former_height=(*height);
}
@@ -1445,7 +1445,7 @@ MagickExport MagickStatusType ParseMetaG
if (geometry_ratio >= image_ratio)
{
*width=former_width;
- *height=(size_t) floor((double) (PerceptibleReciprocal(
+ *height=CastDoubleToUnsigned((double) (PerceptibleReciprocal(
geometry_ratio)*former_height*image_ratio)+0.5);
}
else
Index: ImageMagick-7.1.0-9/MagickCore/shear.c
===================================================================
--- ImageMagick-7.1.0-9.orig/MagickCore/shear.c
+++ ImageMagick-7.1.0-9/MagickCore/shear.c
@@ -1768,9 +1768,9 @@ MagickExport Image *ShearRotateImage(con
*/
width=integral_image->columns;
height=integral_image->rows;
- bounds.width=(size_t) floor(fabs((double) height*shear.x)+width+0.5);
- bounds.height=(size_t) floor(fabs((double) bounds.width*shear.y)+height+0.5);
- shear_width=(size_t) floor(fabs((double) bounds.height*shear.x)+
+ bounds.width=CastDoubleToUnsigned(fabs((double) height*shear.x)+width+0.5);
+ bounds.height=CastDoubleToUnsigned(fabs((double) bounds.width*shear.y)+height+0.5);
+ shear_width=CastDoubleToUnsigned(fabs((double) bounds.height*shear.x)+
bounds.width+0.5);
bounds.x=CastDoubleToLong(floor((double) ((shear_width > bounds.width) ?
width : bounds.width-shear_width+2)/2.0+0.5));
Index: ImageMagick-7.1.0-9/MagickCore/visual-effects.c
===================================================================
--- ImageMagick-7.1.0-9.orig/MagickCore/visual-effects.c
+++ ImageMagick-7.1.0-9/MagickCore/visual-effects.c
@@ -2062,8 +2062,8 @@ MagickExport Image *ShadowImage(const Im
(void) SetImageColorspace(clone_image,sRGBColorspace,exception);
(void) SetImageVirtualPixelMethod(clone_image,EdgeVirtualPixelMethod,
exception);
- border_info.width=(size_t) floor(2.0*sigma+0.5);
- border_info.height=(size_t) floor(2.0*sigma+0.5);
+ border_info.width=CastDoubleToUnsigned(2.0*sigma+0.5);
+ border_info.height=CastDoubleToUnsigned(2.0*sigma+0.5);
border_info.x=0;
border_info.y=0;
(void) QueryColorCompliance("none",AllCompliance,&clone_image->border_color,
Index: ImageMagick-7.1.0-9/coders/caption.c
===================================================================
--- ImageMagick-7.1.0-9.orig/coders/caption.c
+++ ImageMagick-7.1.0-9/coders/caption.c
@@ -171,7 +171,7 @@ static Image *ReadCAPTIONImage(const Ima
return(DestroyImageList(image));
(void) SetImageProperty(image,"caption",caption,exception);
draw_info=CloneDrawInfo(image_info,(DrawInfo *) NULL);
- width=(size_t) floor(0.5*draw_info->pointsize*strlen(caption)+0.5);
+ width=CastDoubleToUnsigned(0.5*draw_info->pointsize*strlen(caption)+0.5);
if (AcquireMagickResource(WidthResource,width) == MagickFalse)
{
caption=DestroyString(caption);
@@ -271,8 +271,8 @@ static Image *ReadCAPTIONImage(const Ima
if (status == MagickFalse)
break;
AdjustTypeMetricBounds(&metrics);
- width=(size_t) floor(metrics.width+draw_info->stroke_width+0.5);
- height=(size_t) floor(metrics.height+draw_info->interline_spacing+
+ width=CastDoubleToUnsigned(metrics.width+draw_info->stroke_width+0.5);
+ height=CastDoubleToUnsigned(metrics.height+draw_info->interline_spacing+
draw_info->stroke_width+0.5);
if ((image->columns != 0) && (image->rows != 0))
{
@@ -303,8 +303,8 @@ static Image *ReadCAPTIONImage(const Ima
if (status == MagickFalse)
break;
AdjustTypeMetricBounds(&metrics);
- width=(size_t) floor(metrics.width+draw_info->stroke_width+0.5);
- height=(size_t) floor(metrics.height+draw_info->interline_spacing+
+ width=CastDoubleToUnsigned(metrics.width+draw_info->stroke_width+0.5);
+ height=CastDoubleToUnsigned(metrics.height+draw_info->interline_spacing+
draw_info->stroke_width+0.5);
if ((image->columns != 0) && (image->rows != 0))
{
Index: ImageMagick-7.1.0-9/coders/label.c
===================================================================
--- ImageMagick-7.1.0-9.orig/coders/label.c
+++ ImageMagick-7.1.0-9/coders/label.c
@@ -151,7 +151,7 @@ static Image *ReadLABELImage(const Image
return(DestroyImageList(image));
(void) SetImageProperty(image,"label",label,exception);
draw_info=CloneDrawInfo(image_info,(DrawInfo *) NULL);
- width=(size_t) floor(0.5*draw_info->pointsize*strlen(label)+0.5);
+ width=CastDoubleToUnsigned(0.5*draw_info->pointsize*strlen(label)+0.5);
if (AcquireMagickResource(WidthResource,width) == MagickFalse)
{
label=DestroyString(label);
@@ -192,8 +192,8 @@ static Image *ReadLABELImage(const Image
if (status == MagickFalse)
break;
AdjustTypeMetricBounds(&metrics);
- width=(size_t) floor(metrics.width+draw_info->stroke_width+0.5);
- height=(size_t) floor(metrics.height+draw_info->stroke_width+0.5);
+ width=CastDoubleToUnsigned(metrics.width+draw_info->stroke_width+0.5);
+ height=CastDoubleToUnsigned(metrics.height+draw_info->stroke_width+0.5);
if ((image->columns != 0) && (image->rows != 0))
{
if ((width >= image->columns) && (height >= image->rows))
@@ -223,8 +223,8 @@ static Image *ReadLABELImage(const Image
if (status == MagickFalse)
break;
AdjustTypeMetricBounds(&metrics);
- width=(size_t) floor(metrics.width+draw_info->stroke_width+0.5);
- height=(size_t) floor(metrics.height+draw_info->stroke_width+0.5);
+ width=CastDoubleToUnsigned(metrics.width+draw_info->stroke_width+0.5);
+ height=CastDoubleToUnsigned(metrics.height+draw_info->stroke_width+0.5);
if ((image->columns != 0) && (image->rows != 0))
{
if ((width < image->columns) && (height < image->rows))
Index: ImageMagick-7.1.0-9/coders/pcl.c
===================================================================
--- ImageMagick-7.1.0-9.orig/coders/pcl.c
+++ ImageMagick-7.1.0-9/coders/pcl.c
@@ -333,8 +333,8 @@ static Image *ReadPCLImage(const ImageIn
image->resolution.x,image->resolution.y);
if (image_info->ping != MagickFalse)
(void) FormatLocaleString(density,MagickPathExtent,"2.0x2.0");
- page.width=(size_t) floor(page.width*image->resolution.x/delta.x+0.5);
- page.height=(size_t) floor(page.height*image->resolution.y/delta.y+0.5);
+ page.width=CastDoubleToUnsigned(page.width*image->resolution.x/delta.x+0.5);
+ page.height=CastDoubleToUnsigned(page.height*image->resolution.y/delta.y+0.5);
(void) FormatLocaleString(options,MagickPathExtent,"-g%.20gx%.20g ",(double)
page.width,(double) page.height);
image=DestroyImage(image);
Index: ImageMagick-7.1.0-9/coders/pdf.c
===================================================================
--- ImageMagick-7.1.0-9.orig/coders/pdf.c
+++ ImageMagick-7.1.0-9/coders/pdf.c
@@ -1729,9 +1729,9 @@ static MagickBooleanType WritePDFImage(c
(void) ParseMetaGeometry(temp,&geometry.x,&geometry.y,
&geometry.width,&geometry.height);
scale.x=(double) (geometry.width*delta.x)/resolution.x;
- geometry.width=(size_t) floor(scale.x+0.5);
+ geometry.width=CastDoubleToUnsigned(scale.x+0.5);
scale.y=(double) (geometry.height*delta.y)/resolution.y;
- geometry.height=(size_t) floor(scale.y+0.5);
+ geometry.height=CastDoubleToUnsigned(scale.y+0.5);
(void) ParseAbsoluteGeometry(temp,&media_info);
(void) ParseGravityGeometry(image,temp,&page_info,exception);
if (image->gravity != UndefinedGravity)
Index: ImageMagick-7.1.0-9/coders/ps.c
===================================================================
--- ImageMagick-7.1.0-9.orig/coders/ps.c
+++ ImageMagick-7.1.0-9/coders/ps.c
@@ -1519,9 +1519,9 @@ static MagickBooleanType WritePSImage(co
(void) ParseMetaGeometry(page_geometry,&geometry.x,&geometry.y,
&geometry.width,&geometry.height);
scale.x=PerceptibleReciprocal(resolution.x)*geometry.width*delta.x;
- geometry.width=(size_t) floor(scale.x+0.5);
+ geometry.width=CastDoubleToUnsigned(scale.x+0.5);
scale.y=PerceptibleReciprocal(resolution.y)*geometry.height*delta.y;
- geometry.height=(size_t) floor(scale.y+0.5);
+ geometry.height=CastDoubleToUnsigned(scale.y+0.5);
(void) ParseAbsoluteGeometry(page_geometry,&media_info);
(void) ParseGravityGeometry(image,page_geometry,&page_info,exception);
if (image->gravity != UndefinedGravity)
Index: ImageMagick-7.1.0-9/coders/ps2.c
===================================================================
--- ImageMagick-7.1.0-9.orig/coders/ps2.c
+++ ImageMagick-7.1.0-9/coders/ps2.c
@@ -538,9 +538,9 @@ static MagickBooleanType WritePS2Image(c
(void) ParseMetaGeometry(page_geometry,&geometry.x,&geometry.y,
&geometry.width,&geometry.height);
scale.x=PerceptibleReciprocal(resolution.x)*geometry.width*delta.x;
- geometry.width=(size_t) floor(scale.x+0.5);
+ geometry.width=CastDoubleToUnsigned(scale.x+0.5);
scale.y=PerceptibleReciprocal(resolution.y)*geometry.height*delta.y;
- geometry.height=(size_t) floor(scale.y+0.5);
+ geometry.height=CastDoubleToUnsigned(scale.y+0.5);
(void) ParseAbsoluteGeometry(page_geometry,&media_info);
(void) ParseGravityGeometry(image,page_geometry,&page_info,exception);
if (image->gravity != UndefinedGravity)
Index: ImageMagick-7.1.0-9/coders/ps3.c
===================================================================
--- ImageMagick-7.1.0-9.orig/coders/ps3.c
+++ ImageMagick-7.1.0-9/coders/ps3.c
@@ -985,9 +985,9 @@ static MagickBooleanType WritePS3Image(c
(void) ParseMetaGeometry(page_geometry,&geometry.x,&geometry.y,
&geometry.width,&geometry.height);
scale.x=PerceptibleReciprocal(resolution.x)*geometry.width*delta.x;
- geometry.width=(size_t) floor(scale.x+0.5);
+ geometry.width=CastDoubleToUnsigned(scale.x+0.5);
scale.y=PerceptibleReciprocal(resolution.y)*geometry.height*delta.y;
- geometry.height=(size_t) floor(scale.y+0.5);
+ geometry.height=CastDoubleToUnsigned(scale.y+0.5);
(void) ParseAbsoluteGeometry(page_geometry,&media_info);
(void) ParseGravityGeometry(image,page_geometry,&page_info,exception);
if (image->gravity != UndefinedGravity)
Index: ImageMagick-7.1.0-9/coders/svg.c
===================================================================
--- ImageMagick-7.1.0-9.orig/coders/svg.c
+++ ImageMagick-7.1.0-9/coders/svg.c
@@ -2820,10 +2820,10 @@ static void SVGStartElement(void *contex
svg_info->view_box=svg_info->bounds;
svg_info->width=0;
if (svg_info->bounds.width >= MagickEpsilon)
- svg_info->width=(size_t) floor(svg_info->bounds.width+0.5);
+ svg_info->width=CastDoubleToUnsigned(svg_info->bounds.width+0.5);
svg_info->height=0;
if (svg_info->bounds.height >= MagickEpsilon)
- svg_info->height=(size_t) floor(svg_info->bounds.height+0.5);
+ svg_info->height=CastDoubleToUnsigned(svg_info->bounds.height+0.5);
(void) FormatLocaleFile(svg_info->file,"viewbox 0 0 %.20g %.20g\n",
(double) svg_info->width,(double) svg_info->height);
sx=PerceptibleReciprocal(svg_info->view_box.width)*svg_info->width;
Index: ImageMagick-7.1.0-9/MagickCore/image-private.h
===================================================================
--- ImageMagick-7.1.0-9.orig/MagickCore/image-private.h
+++ ImageMagick-7.1.0-9/MagickCore/image-private.h
@@ -41,6 +41,7 @@ extern "C" {
#define MagickSQ1_2 0.70710678118654752440084436210484903928483593768847
#define MagickSQ2 1.41421356237309504880168872420969807856967187537695
#define MagickSQ2PI 2.50662827463100024161235523934010416269302368164062
+#define MAGICK_SIZE_MAX (SIZE_MAX)
#define MatteColor "#bdbdbd" /* gray */
#define PSDensityGeometry "72.0x72.0"
#define PSPageGeometry "612x792"
@@ -61,6 +62,26 @@ static inline ssize_t CastDoubleToLong(c
return((ssize_t) value);
}
+static inline size_t CastDoubleToUnsigned(const double x)
+{
+ if (IsNaN(x) != 0)
+ {
+ errno=ERANGE;
+ return(0);
+ }
+ if (floor(x) > ((double) MAGICK_SSIZE_MAX-1))
+ {
+ errno=ERANGE;
+ return((size_t) MAGICK_SIZE_MAX);
+ }
+ if (ceil(x) < 0.0)
+ {
+ errno=ERANGE;
+ return(0);
+ }
+ return((size_t) x);
+}
+
static inline double DegreesToRadians(const double degrees)
{
return((double) (MagickPI*degrees/180.0));
