File GraphicsMagick-CVE-2018-16645.patch of Package GraphicsMagick.9388
Index: GraphicsMagick-1.3.25/coders/bmp.c
===================================================================
--- GraphicsMagick-1.3.25.orig/coders/bmp.c 2018-09-10 10:07:54.932750905 +0200
+++ GraphicsMagick-1.3.25/coders/bmp.c 2018-09-10 10:16:46.635618769 +0200
@@ -662,6 +662,8 @@ static Image *ReadBMPImage(const ImageIn
bmp_info.x_pixels=ReadBlobLSBLong(image);
bmp_info.y_pixels=ReadBlobLSBLong(image);
bmp_info.number_colors=ReadBlobLSBLong(image);
+ if (bmp_info.number_colors > GetBlobSize(image))
+ ThrowReaderException(CorruptImageError,InsufficientImageDataInFile,image);
bmp_info.colors_important=ReadBlobLSBLong(image);
profile_data=0;
profile_size=0;
Index: GraphicsMagick-1.3.25/coders/dib.c
===================================================================
--- GraphicsMagick-1.3.25.orig/coders/dib.c 2018-09-10 10:07:54.180747056 +0200
+++ GraphicsMagick-1.3.25/coders/dib.c 2018-09-10 10:08:29.908929884 +0200
@@ -539,6 +539,8 @@ static Image *ReadDIBImage(const ImageIn
dib_info.x_pixels=ReadBlobLSBLong(image);
dib_info.y_pixels=ReadBlobLSBLong(image);
dib_info.number_colors=ReadBlobLSBLong(image);
+ if (dib_info.number_colors > GetBlobSize(image))
+ ThrowReaderException(CorruptImageError,InsufficientImageDataInFile,image);
dib_info.colors_important=ReadBlobLSBLong(image);
if (EOFBlob(image))
ThrowReaderException(CorruptImageError,UnexpectedEndOfFile,image);
@@ -1098,6 +1100,7 @@ ModuleExport void RegisterDIBImage(void)
entry->encoder=(EncoderHandler) WriteDIBImage;
entry->magick=(MagickHandler) IsDIB;
entry->adjoin=False;
+ entry->seekable_stream=True;
entry->stealth=True;
entry->description="Microsoft Windows 3.X Packed Device-Independent Bitmap";
entry->module="DIB";
@@ -1108,6 +1111,7 @@ ModuleExport void RegisterDIBImage(void)
/* entry->encoder=(EncoderHandler) WriteDIBImage; */
entry->magick=(MagickHandler) IsDIB;
entry->adjoin=False;
+ entry->seekable_stream=True;
entry->stealth=True;
entry->raw=True; /* Requires size to work correctly. */
entry->description="Microsoft Windows 3.X Packed Device-Independent Bitmap + Mask";