From a5646313975525c598527269bbfe4524909275f3 Mon Sep 17 00:00:00 2001 From: maminjie Date: Sat, 19 Sep 2020 17:59:51 +0800 Subject: [PATCH] MNG: Fix small heap overwrite or assertion if magnifying and image to be magnified has rows or columns == 1. (CVE-2020-12672) refers to http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/50395430a371 --- coders/png.c | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/coders/png.c b/coders/png.c index ebb0a4a..b8b6c2b 100644 --- a/coders/png.c +++ b/coders/png.c @@ -5571,7 +5571,28 @@ static Image *ReadMNGImage(const ImageInfo *image_info, if (logging) (void) LogMagickEvent(CoderEvent,GetMagickModule(), - " Processing MNG MAGN chunk"); + " Processing MNG MAGN chunk: MB=%u, ML=%u," + " MR=%u, MT=%u, MX=%u, MY=%u," + " X_method=%u, Y_method=%u", + mng_info->magn_mb,mng_info->magn_ml, + mng_info->magn_mr,mng_info->magn_mt, + mng_info->magn_mx,mng_info->magn_my, + mng_info->magn_methx, + mng_info->magn_methy); + + /* + If the image width is 1, then X magnification is done + by simple pixel replication. + */ + if (image->columns == 1) + mng_info->magn_methx = 1; + + /* + If the image height is 1, then Y magnification is done + by simple pixel replication. + */ + if (image->rows == 1) + mng_info->magn_methy = 1; if (mng_info->magn_methx == 1) { -- 2.23.0