File GraphicsMagick-CVE-2017-8350.patch of Package GraphicsMagick.9821

Overview Repositories Revisions Requests Users Attributes Meta

File GraphicsMagick-CVE-2017-8350.patch of Package GraphicsMagick.9821

Index: GraphicsMagick-1.3.25/coders/png.c
===================================================================
--- GraphicsMagick-1.3.25.orig/coders/png.c	2017-06-26 09:09:48.514863798 +0200
+++ GraphicsMagick-1.3.25/coders/png.c	2017-06-26 09:16:33.973792745 +0200
@@ -2734,6 +2734,20 @@ static Image *ReadPNGImage(const ImageIn
 
 
 #if defined(JNG_SUPPORTED)
+
+
+void
+DestroyJNGInfo(ImageInfo *color_image_info, ImageInfo *alpha_image_info)
+{
+          if (color_image_info != (ImageInfo *)NULL)
+            {
+              DestroyImageInfo(color_image_info);
+            }
+          if (alpha_image_info != (ImageInfo *)NULL)
+            {
+              DestroyImageInfo(alpha_image_info);
+            }
+}
 /*
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 %                                                                             %
@@ -2902,14 +2916,7 @@ static Image *ReadOneJNGImage(MngInfo *m
 
       if (length > PNG_MAX_UINT || count == 0)
         {
-          if (color_image_info != (ImageInfo *)NULL)
-            {
-              DestroyImageInfo(color_image_info);
-            }
-          if (alpha_image_info != (ImageInfo *)NULL)
-            {
-              DestroyImageInfo(alpha_image_info);
-            }
+          DestroyJNGInfo(color_image_info,alpha_image_info);
           ThrowReaderException(CorruptImageError,CorruptImage,image);
         }
 
@@ -2919,18 +2926,14 @@ static Image *ReadOneJNGImage(MngInfo *m
         {
           chunk=MagickAllocateMemory(unsigned char *,length);
           if (chunk == (unsigned char *) NULL)
-            ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,
-                                 image);
+            {
+              DestroyJNGInfo(color_image_info,alpha_image_info);
+              ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,
+                                   image);
+            }
           if (ReadBlob(image,length,chunk) < length)
             {
-              if (color_image_info != (ImageInfo *)NULL)
-                {
-                  DestroyImageInfo(color_image_info);
-                }
-              if (alpha_image_info != (ImageInfo *)NULL)
-                {
-                  DestroyImageInfo(alpha_image_info);
-                }
+              DestroyJNGInfo(color_image_info,alpha_image_info);
               ThrowReaderException(CorruptImageError,CorruptImage,image);
             }
           p=chunk;
@@ -2941,6 +2944,8 @@ static Image *ReadOneJNGImage(MngInfo *m
         {
           if (length != 16)
             {
+              DestroyJNGInfo(color_image_info,alpha_image_info);
+              MagickFreeMemory(chunk);
               (void) ThrowException2(&image->exception,CoderWarning,
                              "Invalid JHDR chunk length",(char *) NULL);
               return (MagickFail);
@@ -3002,6 +3007,8 @@ static Image *ReadOneJNGImage(MngInfo *m
               (void) LogMagickEvent(CoderEvent,GetMagickModule(),
                  "    JNG width or height too large: (%lu x %lu)",
                   jng_width, jng_height);
+              MagickFreeMemory(chunk);
+              DestroyJNGInfo(color_image_info,alpha_image_info);
               ThrowReaderException(CorruptImageError,ImproperImageHeader,image);
             }
 
@@ -3023,14 +3030,19 @@ static Image *ReadOneJNGImage(MngInfo *m
 
           color_image_info=MagickAllocateMemory(ImageInfo *,sizeof(ImageInfo));
           if (color_image_info == (ImageInfo *) NULL)
-            ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,
-                                 image);
+            {
+              DestroyJNGInfo(color_image_info,alpha_image_info);
+              ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,
+                                   image);
+            }
           GetImageInfo(color_image_info);
           color_image=AllocateImage(color_image_info);
           if (color_image == (Image *) NULL)
-            ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,
-                                 image);
-
+            {
+              DestroyJNGInfo(color_image_info,alpha_image_info);
+              ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,
+                                   image);
+            }
           if (logging)
             (void) LogMagickEvent(CoderEvent,GetMagickModule(),
                                   "    Creating color_blob.");
@@ -3038,20 +3050,26 @@ static Image *ReadOneJNGImage(MngInfo *m
           status=OpenBlob(color_image_info,color_image,WriteBinaryBlobMode,
                           exception);
           if (status == MagickFalse)
-            ThrowReaderException(CoderError,UnableToOpenBlob,color_image);
+            {
+              DestroyJNGInfo(color_image_info,alpha_image_info);
+              ThrowReaderException(CoderError,UnableToOpenBlob,color_image);
+            }
 
           if (!image_info->ping && jng_color_type >= 12)
             {
               alpha_image_info=MagickAllocateMemory(ImageInfo *,
                                                     sizeof(ImageInfo));
               if (alpha_image_info == (ImageInfo *) NULL)
-                ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,
-                                     image);
+                {
+                  DestroyJNGInfo(color_image_info,alpha_image_info);
+                  ThrowReaderException(ResourceLimitError,
+                                       MemoryAllocationFailed, image);
+                }
               GetImageInfo(alpha_image_info);
               alpha_image=AllocateImage(alpha_image_info);
               if (alpha_image == (Image *) NULL)
                 {
-                  DestroyImage(alpha_image);
+                  DestroyJNGInfo(color_image_info,alpha_image_info);
                   ThrowReaderException(ResourceLimitError,
                                        MemoryAllocationFailed,
                                        alpha_image);
@@ -3063,7 +3081,11 @@ static Image *ReadOneJNGImage(MngInfo *m
               status=OpenBlob(alpha_image_info,alpha_image,WriteBinaryBlobMode,
                               exception);
               if (status == MagickFalse)
-                ThrowReaderException(CoderError,UnableToOpenBlob,image);
+                {
+                  DestroyJNGInfo(color_image_info,alpha_image_info);
+                  DestroyImage(alpha_image);
+                  ThrowReaderException(CoderError,UnableToOpenBlob,image);
+                }
               if (jng_alpha_compression_method == 0)
                 {
                   unsigned char
@@ -3331,6 +3353,7 @@ static Image *ReadOneJNGImage(MngInfo *m
             Don't throw exception here since ReadImage() will already
             have thrown it.
           */
+          DestroyImage(image);
           return (Image *) NULL;
         }
 
@@ -3423,13 +3446,14 @@ static Image *ReadOneJNGImage(MngInfo *m
     }
 
   /* Clean up in case we didn't earlier */
+
+  DestroyJNGInfo(color_image_info,alpha_image_info);
+
   if (alpha_image != (Image *)NULL)
     {
       (void) LiberateUniqueFileResource(alpha_image->filename);
       DestroyImage(alpha_image);
     }
-  if (alpha_image_info != (ImageInfo *)NULL)
-    DestroyImageInfo(alpha_image_info);
 
   if (logging)
     (void) LogMagickEvent(CoderEvent,GetMagickModule(),

Places

File GraphicsMagick-CVE-2017-8350.patch of Package GraphicsMagick.9821

Places