File ImageMagick-CVE-2020-25665.patch of Package ImageMagick.30356
Index: ImageMagick-7.0.7-34/coders/palm.c
===================================================================
--- ImageMagick-7.0.7-34.orig/coders/palm.c 2018-05-20 17:55:43.000000000 +0200
+++ ImageMagick-7.0.7-34/coders/palm.c 2020-12-04 10:01:00.935818685 +0100
@@ -769,7 +769,7 @@ static MagickBooleanType WritePALMImage(
{
(void) TransformImageColorspace(image,sRGBColorspace,exception);
count=GetNumberColors(image,NULL,exception);
- for (bits_per_pixel=1; (one << bits_per_pixel) < count; bits_per_pixel*=2) ;
+ for (bits_per_pixel=1; (one << bits_per_pixel) < count; bits_per_pixel*=2) ;
if (bits_per_pixel > 16)
bits_per_pixel=16;
else
@@ -874,7 +874,7 @@ static MagickBooleanType WritePALMImage(
last_row=(unsigned char *) NULL;
if (image_info->compression == FaxCompression)
{
- last_row=(unsigned char *) AcquireQuantumMemory(bytes_per_row,
+ last_row=(unsigned char *) AcquireQuantumMemory(bytes_per_row+256,
sizeof(*last_row));
if (last_row == (unsigned char *) NULL)
{
@@ -882,7 +882,7 @@ static MagickBooleanType WritePALMImage(
ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
}
}
- one_row=(unsigned char *) AcquireQuantumMemory(bytes_per_row,
+ one_row=(unsigned char *) AcquireQuantumMemory(bytes_per_row+256,
sizeof(*one_row));
if (one_row == (unsigned char *) NULL)
{