Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE
GraphicsMagick.8039
GraphicsMagick-CVE-2017-8350.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File GraphicsMagick-CVE-2017-8350.patch of Package GraphicsMagick.8039
Index: GraphicsMagick-1.3.25/coders/png.c =================================================================== --- GraphicsMagick-1.3.25.orig/coders/png.c 2017-06-26 09:09:48.514863798 +0200 +++ GraphicsMagick-1.3.25/coders/png.c 2017-06-26 09:16:33.973792745 +0200 @@ -2734,6 +2734,20 @@ static Image *ReadPNGImage(const ImageIn #if defined(JNG_SUPPORTED) + + +void +DestroyJNGInfo(ImageInfo *color_image_info, ImageInfo *alpha_image_info) +{ + if (color_image_info != (ImageInfo *)NULL) + { + DestroyImageInfo(color_image_info); + } + if (alpha_image_info != (ImageInfo *)NULL) + { + DestroyImageInfo(alpha_image_info); + } +} /* %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% % % @@ -2902,14 +2916,7 @@ static Image *ReadOneJNGImage(MngInfo *m if (length > PNG_MAX_UINT || count == 0) { - if (color_image_info != (ImageInfo *)NULL) - { - DestroyImageInfo(color_image_info); - } - if (alpha_image_info != (ImageInfo *)NULL) - { - DestroyImageInfo(alpha_image_info); - } + DestroyJNGInfo(color_image_info,alpha_image_info); ThrowReaderException(CorruptImageError,CorruptImage,image); } @@ -2919,18 +2926,14 @@ static Image *ReadOneJNGImage(MngInfo *m { chunk=MagickAllocateMemory(unsigned char *,length); if (chunk == (unsigned char *) NULL) - ThrowReaderException(ResourceLimitError,MemoryAllocationFailed, - image); + { + DestroyJNGInfo(color_image_info,alpha_image_info); + ThrowReaderException(ResourceLimitError,MemoryAllocationFailed, + image); + } if (ReadBlob(image,length,chunk) < length) { - if (color_image_info != (ImageInfo *)NULL) - { - DestroyImageInfo(color_image_info); - } - if (alpha_image_info != (ImageInfo *)NULL) - { - DestroyImageInfo(alpha_image_info); - } + DestroyJNGInfo(color_image_info,alpha_image_info); ThrowReaderException(CorruptImageError,CorruptImage,image); } p=chunk; @@ -2941,6 +2944,8 @@ static Image *ReadOneJNGImage(MngInfo *m { if (length != 16) { + DestroyJNGInfo(color_image_info,alpha_image_info); + MagickFreeMemory(chunk); (void) ThrowException2(&image->exception,CoderWarning, "Invalid JHDR chunk length",(char *) NULL); return (MagickFail); @@ -3002,6 +3007,8 @@ static Image *ReadOneJNGImage(MngInfo *m (void) LogMagickEvent(CoderEvent,GetMagickModule(), " JNG width or height too large: (%lu x %lu)", jng_width, jng_height); + MagickFreeMemory(chunk); + DestroyJNGInfo(color_image_info,alpha_image_info); ThrowReaderException(CorruptImageError,ImproperImageHeader,image); } @@ -3023,14 +3030,19 @@ static Image *ReadOneJNGImage(MngInfo *m color_image_info=MagickAllocateMemory(ImageInfo *,sizeof(ImageInfo)); if (color_image_info == (ImageInfo *) NULL) - ThrowReaderException(ResourceLimitError,MemoryAllocationFailed, - image); + { + DestroyJNGInfo(color_image_info,alpha_image_info); + ThrowReaderException(ResourceLimitError,MemoryAllocationFailed, + image); + } GetImageInfo(color_image_info); color_image=AllocateImage(color_image_info); if (color_image == (Image *) NULL) - ThrowReaderException(ResourceLimitError,MemoryAllocationFailed, - image); - + { + DestroyJNGInfo(color_image_info,alpha_image_info); + ThrowReaderException(ResourceLimitError,MemoryAllocationFailed, + image); + } if (logging) (void) LogMagickEvent(CoderEvent,GetMagickModule(), " Creating color_blob."); @@ -3038,20 +3050,26 @@ static Image *ReadOneJNGImage(MngInfo *m status=OpenBlob(color_image_info,color_image,WriteBinaryBlobMode, exception); if (status == MagickFalse) - ThrowReaderException(CoderError,UnableToOpenBlob,color_image); + { + DestroyJNGInfo(color_image_info,alpha_image_info); + ThrowReaderException(CoderError,UnableToOpenBlob,color_image); + } if (!image_info->ping && jng_color_type >= 12) { alpha_image_info=MagickAllocateMemory(ImageInfo *, sizeof(ImageInfo)); if (alpha_image_info == (ImageInfo *) NULL) - ThrowReaderException(ResourceLimitError,MemoryAllocationFailed, - image); + { + DestroyJNGInfo(color_image_info,alpha_image_info); + ThrowReaderException(ResourceLimitError, + MemoryAllocationFailed, image); + } GetImageInfo(alpha_image_info); alpha_image=AllocateImage(alpha_image_info); if (alpha_image == (Image *) NULL) { - DestroyImage(alpha_image); + DestroyJNGInfo(color_image_info,alpha_image_info); ThrowReaderException(ResourceLimitError, MemoryAllocationFailed, alpha_image); @@ -3063,7 +3081,11 @@ static Image *ReadOneJNGImage(MngInfo *m status=OpenBlob(alpha_image_info,alpha_image,WriteBinaryBlobMode, exception); if (status == MagickFalse) - ThrowReaderException(CoderError,UnableToOpenBlob,image); + { + DestroyJNGInfo(color_image_info,alpha_image_info); + DestroyImage(alpha_image); + ThrowReaderException(CoderError,UnableToOpenBlob,image); + } if (jng_alpha_compression_method == 0) { unsigned char @@ -3331,6 +3353,7 @@ static Image *ReadOneJNGImage(MngInfo *m Don't throw exception here since ReadImage() will already have thrown it. */ + DestroyImage(image); return (Image *) NULL; } @@ -3423,13 +3446,14 @@ static Image *ReadOneJNGImage(MngInfo *m } /* Clean up in case we didn't earlier */ + + DestroyJNGInfo(color_image_info,alpha_image_info); + if (alpha_image != (Image *)NULL) { (void) LiberateUniqueFileResource(alpha_image->filename); DestroyImage(alpha_image); } - if (alpha_image_info != (ImageInfo *)NULL) - DestroyImageInfo(alpha_image_info); if (logging) (void) LogMagickEvent(CoderEvent,GetMagickModule(),
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor