File ImageMagick-CVE-2017-11640.patch of Package ImageMagick.openSUSE_Leap_42.3_Update
Index: ImageMagick-6.8.8-1/coders/tiff.c
===================================================================
--- ImageMagick-6.8.8-1.orig/coders/tiff.c 2017-11-28 15:20:07.837340433 +0100
+++ ImageMagick-6.8.8-1/coders/tiff.c 2017-11-28 15:20:07.845340567 +0100
@@ -2287,8 +2287,16 @@ static MagickBooleanType WritePTIFImage(
images=NewImageList();
for (next=image; next != (Image *) NULL; next=GetNextImageInList(next))
{
- AppendImageToList(&images,CloneImage(next,0,0,MagickFalse,
- &image->exception));
+ Image
+ *clone_image;
+
+ clone_image=CloneImage(next,0,0,MagickFalse,&image->exception);
+ if (clone_image == (Image *) NULL)
+ break;
+ clone_image->previous=NewImageList();
+ clone_image->next=NewImageList();
+ (void) SetImageProperty(clone_image,"tiff:subfiletype","none");
+ AppendImageToList(&images,clone_image);
columns=next->columns;
rows=next->rows;
resolution.x=next->x_resolution;
@@ -2311,11 +2319,15 @@ static MagickBooleanType WritePTIFImage(
/*
Write pyramid-encoded TIFF image.
*/
+ status=MagickFalse;
+ if (images != (Image *) NULL)
+ {
write_info=CloneImageInfo(image_info);
write_info->adjoin=MagickTrue;
status=WriteTIFFImage(write_info,GetFirstImageInList(images));
images=DestroyImageList(images);
write_info=DestroyImageInfo(write_info);
+ }
return(status);
}
#endif
Index: ImageMagick-6.8.8-1/magick/image.c
===================================================================
--- ImageMagick-6.8.8-1.orig/magick/image.c 2017-11-28 15:20:07.605336516 +0100
+++ ImageMagick-6.8.8-1/magick/image.c 2017-11-28 15:56:06.861606469 +0100
@@ -801,6 +801,10 @@ MagickExport Image *CloneImage(const Ima
(void) LogMagickEvent(TraceEvent,GetMagickModule(),"%s",image->filename);
assert(exception != (ExceptionInfo *) NULL);
assert(exception->signature == MagickSignature);
+ if ((image->columns == 0) || (image->rows == 0))
+ {
+ return((Image *) NULL);
+ }
clone_image=(Image *) AcquireMagickMemory(sizeof(*clone_image));
if (clone_image == (Image *) NULL)
ThrowImageException(ResourceLimitError,"MemoryAllocationFailed");
Index: ImageMagick-6.8.8-1/coders/pwp.c
===================================================================
--- ImageMagick-6.8.8-1.orig/coders/pwp.c 2017-11-28 15:20:07.697338070 +0100
+++ ImageMagick-6.8.8-1/coders/pwp.c 2017-11-28 15:20:07.849340636 +0100
@@ -171,6 +171,7 @@ static Image *ReadPWPImage(const ImageIn
status=OpenBlob(image_info,pwp_image,ReadBinaryBlobMode,exception);
if (status == MagickFalse)
return((Image *) NULL);
+ ResetMagickMemory(magick,0,sizeof(magick));
count=ReadBlob(pwp_image,5,magick);
if ((count == 0) || (LocaleNCompare((char *) magick,"SFW95",5) != 0))
ThrowReaderException(CorruptImageError,"ImproperImageHeader");