File ImageMagick-CVE-2016-7996,7997.patch of Package ImageMagick.8768

Overview Repositories Revisions Requests Users Attributes Meta

File ImageMagick-CVE-2016-7996,7997.patch of Package ImageMagick.8768

Index: ImageMagick-6.8.9-8/coders/wpg.c
===================================================================
--- ImageMagick-6.8.9-8.orig/coders/wpg.c	2016-10-12 08:29:12.242192717 +0200
+++ ImageMagick-6.8.9-8/coders/wpg.c	2016-10-12 08:30:35.031477728 +0200
@@ -1045,7 +1045,9 @@ static Image *ReadWPGImage(const ImageIn
             case 0x0E:  /*Color palette */
               WPG_Palette.StartIndex=ReadBlobLSBShort(image);
               WPG_Palette.NumOfEntries=ReadBlobLSBShort(image);
-
+              if ((WPG_Palette.NumOfEntries-WPG_Palette.StartIndex) >
+                  (Rec2.RecordLength-2-2) / 3)
+                ThrowReaderException(CorruptImageError,"InvalidColormapIndex");
               image->colors=WPG_Palette.NumOfEntries;
               if (!AcquireImageColormap(image,image->colors))
                 goto NoMemory;
@@ -1161,8 +1163,7 @@ static Image *ReadWPGImage(const ImageIn
                       flop_image = FlopImage(image, exception);
                       if (flop_image != (Image *) NULL) {
                         DuplicateBlob(flop_image,image);
-                        (void) RemoveLastImageFromList(&image);
-                        AppendImageToList(&image,flop_image);
+                        ReplaceImageInList(&image,flop_image);
                       }
                     }
                   /* flip command */
@@ -1174,8 +1175,7 @@ static Image *ReadWPGImage(const ImageIn
                       flip_image = FlipImage(image, exception);
                       if (flip_image != (Image *) NULL) {
                         DuplicateBlob(flip_image,image);
-                        (void) RemoveLastImageFromList(&image);
-                        AppendImageToList(&image,flip_image);
+                        ReplaceImageInList(&image,flip_image);
                       }
                     }
 
@@ -1189,8 +1189,7 @@ static Image *ReadWPGImage(const ImageIn
                         0x0FFF), exception);
                       if (rotate_image != (Image *) NULL) {
                         DuplicateBlob(rotate_image,image);
-                        (void) RemoveLastImageFromList(&image);
-                        AppendImageToList(&image,rotate_image);
+                        ReplaceImageInList(&image,rotate_image);
                       }
                     }
                 }
@@ -1247,7 +1246,9 @@ static Image *ReadWPGImage(const ImageIn
             case 0x0C:    /* Color palette */
               WPG_Palette.StartIndex=ReadBlobLSBShort(image);
               WPG_Palette.NumOfEntries=ReadBlobLSBShort(image);
-
+              if ((WPG_Palette.NumOfEntries-WPG_Palette.StartIndex) >
+                  (Rec2.RecordLength-2-2) / 3)
+                ThrowReaderException(CorruptImageError,"InvalidColormapIndex");
               image->colors=WPG_Palette.NumOfEntries;
               if (AcquireImageColormap(image,image->colors) == MagickFalse)
                 ThrowReaderException(ResourceLimitError,
@@ -1357,8 +1358,7 @@ static Image *ReadWPGImage(const ImageIn
                   flop_image = FlopImage(image, exception);
                   if (flop_image != (Image *) NULL) {
                     DuplicateBlob(flop_image,image);
-                    (void) RemoveLastImageFromList(&image);
-                    AppendImageToList(&image,flop_image);
+                    ReplaceImageInList(&image,flop_image);
                   }
                   /* Try to change CTM according to Flip - I am not sure, must be checked.
                      Tx(0,0)=-1;      Tx(1,0)=0;   Tx(2,0)=0;
@@ -1374,8 +1374,7 @@ static Image *ReadWPGImage(const ImageIn
                   flip_image = FlipImage(image, exception);
                   if (flip_image != (Image *) NULL) {
                     DuplicateBlob(flip_image,image);
-                    (void) RemoveLastImageFromList(&image);
-                    AppendImageToList(&image,flip_image);
+                    ReplaceImageInList(&image,flip_image);
                   }
                   /* Try to change CTM according to Flip - I am not sure, must be checked.
                      float_matrix Tx(3,3);

Places

File ImageMagick-CVE-2016-7996,7997.patch of Package ImageMagick.8768

Places