File GraphicsMagick-CVE-2019-19953.patch of Package GraphicsMagick.12851
Index: GraphicsMagick-1.3.29/coders/pict.c
===================================================================
--- GraphicsMagick-1.3.29.orig/coders/pict.c 2020-01-08 09:40:23.858319142 +0100
+++ GraphicsMagick-1.3.29/coders/pict.c 2020-01-08 09:41:13.234588841 +0100
@@ -692,7 +692,7 @@ static unsigned char *DecodeImage(const
%
*/
static size_t EncodeImage(Image *image,const unsigned char *scanline,
- const unsigned long bytes_per_line,unsigned char *pixels)
+ const size_t bytes_per_line,unsigned char *pixels)
{
#define MaxCount 128U
#define MaxPackbitsRunlength 128
@@ -1785,6 +1785,8 @@ static unsigned int WritePICTImage(const
bytes_per_line=image->columns;
if (storage_class == DirectClass)
bytes_per_line*=image->matte ? 4 : 3;
+ if ((bytes_per_line ==0) || (bytes_per_line > 0x7FFF))
+ ThrowPICTWriterException(CoderError,ImageColumnOrRowSizeIsNotSupported,image);
buffer=MagickAllocateMemory(unsigned char *,PictInfoSize);
packed_scanline=MagickAllocateMemory(unsigned char *,row_bytes+MaxCount);
scanline=MagickAllocateMemory(unsigned char *,row_bytes);