File GraphicsMagick-CVE-2017-8350.patch of Package GraphicsMagick.7782
Index: GraphicsMagick-1.3.25/coders/png.c
===================================================================
--- GraphicsMagick-1.3.25.orig/coders/png.c 2017-06-26 09:09:48.514863798 +0200
+++ GraphicsMagick-1.3.25/coders/png.c 2017-06-26 09:16:33.973792745 +0200
@@ -2734,6 +2734,20 @@ static Image *ReadPNGImage(const ImageIn
#if defined(JNG_SUPPORTED)
+
+
+void
+DestroyJNGInfo(ImageInfo *color_image_info, ImageInfo *alpha_image_info)
+{
+ if (color_image_info != (ImageInfo *)NULL)
+ {
+ DestroyImageInfo(color_image_info);
+ }
+ if (alpha_image_info != (ImageInfo *)NULL)
+ {
+ DestroyImageInfo(alpha_image_info);
+ }
+}
/*
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% %
@@ -2902,14 +2916,7 @@ static Image *ReadOneJNGImage(MngInfo *m
if (length > PNG_MAX_UINT || count == 0)
{
- if (color_image_info != (ImageInfo *)NULL)
- {
- DestroyImageInfo(color_image_info);
- }
- if (alpha_image_info != (ImageInfo *)NULL)
- {
- DestroyImageInfo(alpha_image_info);
- }
+ DestroyJNGInfo(color_image_info,alpha_image_info);
ThrowReaderException(CorruptImageError,CorruptImage,image);
}
@@ -2919,18 +2926,14 @@ static Image *ReadOneJNGImage(MngInfo *m
{
chunk=MagickAllocateMemory(unsigned char *,length);
if (chunk == (unsigned char *) NULL)
- ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,
- image);
+ {
+ DestroyJNGInfo(color_image_info,alpha_image_info);
+ ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,
+ image);
+ }
if (ReadBlob(image,length,chunk) < length)
{
- if (color_image_info != (ImageInfo *)NULL)
- {
- DestroyImageInfo(color_image_info);
- }
- if (alpha_image_info != (ImageInfo *)NULL)
- {
- DestroyImageInfo(alpha_image_info);
- }
+ DestroyJNGInfo(color_image_info,alpha_image_info);
ThrowReaderException(CorruptImageError,CorruptImage,image);
}
p=chunk;
@@ -2941,6 +2944,8 @@ static Image *ReadOneJNGImage(MngInfo *m
{
if (length != 16)
{
+ DestroyJNGInfo(color_image_info,alpha_image_info);
+ MagickFreeMemory(chunk);
(void) ThrowException2(&image->exception,CoderWarning,
"Invalid JHDR chunk length",(char *) NULL);
return (MagickFail);
@@ -3002,6 +3007,8 @@ static Image *ReadOneJNGImage(MngInfo *m
(void) LogMagickEvent(CoderEvent,GetMagickModule(),
" JNG width or height too large: (%lu x %lu)",
jng_width, jng_height);
+ MagickFreeMemory(chunk);
+ DestroyJNGInfo(color_image_info,alpha_image_info);
ThrowReaderException(CorruptImageError,ImproperImageHeader,image);
}
@@ -3023,14 +3030,19 @@ static Image *ReadOneJNGImage(MngInfo *m
color_image_info=MagickAllocateMemory(ImageInfo *,sizeof(ImageInfo));
if (color_image_info == (ImageInfo *) NULL)
- ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,
- image);
+ {
+ DestroyJNGInfo(color_image_info,alpha_image_info);
+ ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,
+ image);
+ }
GetImageInfo(color_image_info);
color_image=AllocateImage(color_image_info);
if (color_image == (Image *) NULL)
- ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,
- image);
-
+ {
+ DestroyJNGInfo(color_image_info,alpha_image_info);
+ ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,
+ image);
+ }
if (logging)
(void) LogMagickEvent(CoderEvent,GetMagickModule(),
" Creating color_blob.");
@@ -3038,20 +3050,26 @@ static Image *ReadOneJNGImage(MngInfo *m
status=OpenBlob(color_image_info,color_image,WriteBinaryBlobMode,
exception);
if (status == MagickFalse)
- ThrowReaderException(CoderError,UnableToOpenBlob,color_image);
+ {
+ DestroyJNGInfo(color_image_info,alpha_image_info);
+ ThrowReaderException(CoderError,UnableToOpenBlob,color_image);
+ }
if (!image_info->ping && jng_color_type >= 12)
{
alpha_image_info=MagickAllocateMemory(ImageInfo *,
sizeof(ImageInfo));
if (alpha_image_info == (ImageInfo *) NULL)
- ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,
- image);
+ {
+ DestroyJNGInfo(color_image_info,alpha_image_info);
+ ThrowReaderException(ResourceLimitError,
+ MemoryAllocationFailed, image);
+ }
GetImageInfo(alpha_image_info);
alpha_image=AllocateImage(alpha_image_info);
if (alpha_image == (Image *) NULL)
{
- DestroyImage(alpha_image);
+ DestroyJNGInfo(color_image_info,alpha_image_info);
ThrowReaderException(ResourceLimitError,
MemoryAllocationFailed,
alpha_image);
@@ -3063,7 +3081,11 @@ static Image *ReadOneJNGImage(MngInfo *m
status=OpenBlob(alpha_image_info,alpha_image,WriteBinaryBlobMode,
exception);
if (status == MagickFalse)
- ThrowReaderException(CoderError,UnableToOpenBlob,image);
+ {
+ DestroyJNGInfo(color_image_info,alpha_image_info);
+ DestroyImage(alpha_image);
+ ThrowReaderException(CoderError,UnableToOpenBlob,image);
+ }
if (jng_alpha_compression_method == 0)
{
unsigned char
@@ -3331,6 +3353,7 @@ static Image *ReadOneJNGImage(MngInfo *m
Don't throw exception here since ReadImage() will already
have thrown it.
*/
+ DestroyImage(image);
return (Image *) NULL;
}
@@ -3423,13 +3446,14 @@ static Image *ReadOneJNGImage(MngInfo *m
}
/* Clean up in case we didn't earlier */
+
+ DestroyJNGInfo(color_image_info,alpha_image_info);
+
if (alpha_image != (Image *)NULL)
{
(void) LiberateUniqueFileResource(alpha_image->filename);
DestroyImage(alpha_image);
}
- if (alpha_image_info != (ImageInfo *)NULL)
- DestroyImageInfo(alpha_image_info);
if (logging)
(void) LogMagickEvent(CoderEvent,GetMagickModule(),
