File ImageMagick-CVE-2017-15218.patch of Package ImageMagick.openSUSE_Leap_42.3_Update
Index: ImageMagick-6.8.8-1/coders/png.c
===================================================================
--- ImageMagick-6.8.8-1.orig/coders/png.c 2018-01-12 14:24:25.733948143 +0100
+++ ImageMagick-6.8.8-1/coders/png.c 2018-01-12 14:29:30.034841341 +0100
@@ -4355,6 +4355,12 @@ static Image *ReadOneJNGImage(MngInfo *m
(p[2] << 8) | p[3]);
jng_height=(size_t) ((p[4] << 24) | (p[5] << 16) |
(p[6] << 8) | p[7]);
+ if ((jng_width == 0) || (jng_height == 0))
+ {
+ DestroyJNG(chunk,&color_image,&color_image_info,
+ &alpha_image,&alpha_image_info);
+ ThrowReaderException(CorruptImageError,"NegativeOrZeroImageSize");
+ }
jng_color_type=p[8];
jng_image_sample_depth=p[9];
jng_image_compression_method=p[10];
@@ -4445,13 +4451,20 @@ static Image *ReadOneJNGImage(MngInfo *m
color_image_info=(ImageInfo *)AcquireMagickMemory(sizeof(ImageInfo));
if (color_image_info == (ImageInfo *) NULL)
+ {
+ DestroyJNG(chunk,&color_image,&color_image_info,
+ &alpha_image,&alpha_image_info);
ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+ }
GetImageInfo(color_image_info);
color_image=AcquireImage(color_image_info);
-
if (color_image == (Image *) NULL)
+ {
+ DestroyJNG(chunk,&color_image,&color_image_info,
+ &alpha_image,&alpha_image_info);
ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+ }
if (logging != MagickFalse)
(void) LogMagickEvent(CoderEvent,GetMagickModule(),
@@ -4464,7 +4477,8 @@ static Image *ReadOneJNGImage(MngInfo *m
if (status == MagickFalse)
{
- color_image=DestroyImage(color_image);
+ DestroyJNG(chunk,&color_image,&color_image_info,
+ &alpha_image,&alpha_image_info);
return(DestroyImageList(image));
}
@@ -4475,7 +4489,8 @@ static Image *ReadOneJNGImage(MngInfo *m
if (alpha_image_info == (ImageInfo *) NULL)
{
- color_image=DestroyImage(color_image);
+ DestroyJNG(chunk,&color_image,&color_image_info,
+ &alpha_image,&alpha_image_info);
ThrowReaderException(ResourceLimitError,
"MemoryAllocationFailed");
}
@@ -4485,8 +4500,8 @@ static Image *ReadOneJNGImage(MngInfo *m
if (alpha_image == (Image *) NULL)
{
- alpha_image_info=DestroyImageInfo(alpha_image_info);
- color_image=DestroyImage(color_image);
+ DestroyJNG(chunk,&color_image,&color_image_info,
+ &alpha_image,&alpha_image_info);
ThrowReaderException(ResourceLimitError,
"MemoryAllocationFailed");
}
@@ -4782,7 +4797,12 @@ static Image *ReadOneJNGImage(MngInfo *m
color_image_info=DestroyImageInfo(color_image_info);
if (jng_image == (Image *) NULL)
+ {
+ DestroyJNG(NULL,&color_image,&color_image_info,
+ &alpha_image,&alpha_image_info);
return(DestroyImageList(image));
+ }
+
if (logging != MagickFalse)
(void) LogMagickEvent(CoderEvent,GetMagickModule(),