# HG changeset patch # User Bob Friesenhahn # Date 1648301533 18000 # Node ID 94f4bcf448ad29d6d8470e444038402d34fbba12 # Parent 07c1e6eeffb8cb2abb9ede843a45ba7e5435b3b0 ReadMIFFImage(): Validate claimed bzip2-compressed row length prior to reading data into fixed size buffer. --- ChangeLog | 7 +++++++ coders/miff.c | 11 +++++++++++ magick/version.h | 2 ++ www/Changelog.html | 7 +++++++ 4 files changed, 27 insertions(+) diff --git a/ChangeLog b/ChangeLog index a89c828..5116ad0 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,10 @@ +2022-03-26 Bob Friesenhahn + * coders/miff.c (ReadMIFFImage): Validate claimed bzip2-compressed + row length prior to reading data into fixed size buffer. + Addresses SourceForge bug #664 "[bug]Heap buffer overflow when + parsing MIFF". This severe bug only impacts builds with BZLIB + support. + 2019-04-17 Bob Friesenhahn * coders/xwd.c (ReadXWDImage): Added even more XWD header validation logic. Addresses problems noted by email from Hongxu diff --git a/coders/miff.c b/coders/miff.c index 00813c4..9149a15 100644 --- a/coders/miff.c +++ b/coders/miff.c @@ -1674,9 +1674,20 @@ static Image *ReadMIFFImage(const ImageInfo *image_info, else { length=ReadBlobMSBLong(image); + if (image->logging) + (void) LogMagickEvent(CoderEvent,GetMagickModule(), + "length = %"MAGICK_SIZE_T_F"u", + (MAGICK_SIZE_T) length); + if ((length == 0) || (length > compressed_length)) + { + (void) BZ2_bzDecompressEnd(&bzip_info); + ThrowMIFFReaderException(CorruptImageError,UnableToUncompressImage, + image); + } bzip_info.avail_in=(unsigned int) ReadBlob(image,length,bzip_info.next_in); if ((size_t) bzip_info.avail_in != length) { + (void) BZ2_bzDecompressEnd(&bzip_info); ThrowMIFFReaderException(CorruptImageError,UnexpectedEndOfFile, image); } diff --git a/magick/version.h b/magick/version.h index a9e0dca..1e17abc 100644 --- a/magick/version.h +++ b/magick/version.h @@ -40,6 +40,8 @@ extern "C" { #define MagickLibVersionNumber 21,18,1 #define MagickChangeDate "20190417" #define MagickReleaseDate "snapshot-20190417" +#define MagickChangeDate "20220326" +#define MagickReleaseDate "snapshot-20220326" /* The MagickLibInterfaceNewest and MagickLibInterfaceOldest defines diff --git a/www/Changelog.html b/www/Changelog.html index e5a21da..5ec8096 100644 --- a/www/Changelog.html +++ b/www/Changelog.html @@ -34,6 +34,13 @@
+

2022-03-26 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>

+
+* coders/miff.c (ReadMIFFImage): Validate claimed bzip2-compressed +row length prior to reading data into fixed size buffer. +Addresses SourceForge bug #664 "[bug]Heap buffer overflow when +parsing MIFF". This severe bug only impacts builds with BZLIB +support.

2019-04-17 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>

    -- 2.23.0