File ImageMagick-CVE-2025-53015.patch of Package ImageMagick.40074
From 229fa96a988a21d78318bbca61245a6ed1ee33a0 Mon Sep 17 00:00:00 2001
From: Dirk Lemstra <dirk@lemstra.org>
Date: Fri, 2 May 2025 18:33:17 +0200
Subject: [PATCH] Added extra checks to make sure we don't get stuck in the
while loop.
---
MagickCore/image-private.h | 1 +
MagickCore/profile.c | 11 +++++++++++
2 files changed, 12 insertions(+)
Index: ImageMagick-7.1.1-21/MagickCore/image-private.h
===================================================================
--- ImageMagick-7.1.1-21.orig/MagickCore/image-private.h
+++ ImageMagick-7.1.1-21/MagickCore/image-private.h
@@ -52,6 +52,7 @@ extern "C" {
#define MAGICK_SIZE_MAX (SIZE_MAX)
#define MAGICK_SSIZE_MAX (SSIZE_MAX)
#define MAGICK_SSIZE_MIN (-SSIZE_MAX-1)
+#define MAGICK_ULONG_MAX (ULONG_MAX)
#define MatteColor "#bdbdbd" /* gray */
#define MatteColorRGBA ScaleShortToQuantum(0xbdbd),\
ScaleShortToQuantum(0xbdbd),ScaleShortToQuantum(0xbdbd),OpaqueAlpha
Index: ImageMagick-7.1.1-21/MagickCore/profile.c
===================================================================
--- ImageMagick-7.1.1-21.orig/MagickCore/profile.c
+++ ImageMagick-7.1.1-21/MagickCore/profile.c
@@ -2506,6 +2506,17 @@ static void GetXmpNumeratorAndDenominato
*denominator=1;
if (value <= MagickEpsilon)
return;
+ if (value > (double) MAGICK_ULONG_MAX)
+ {
+ *numerator = MAGICK_ULONG_MAX;
+ *denominator = 1;
+ return;
+ }
+ if (floor(value) == value)
+ {
+ *numerator = (unsigned long) value;
+ *denominator = 1;
+ }
*numerator=1;
df=1.0;
while(fabs(df - value) > MagickEpsilon)