GraphicsMagick/CVE-2019-11009.patch
2019-12-24 17:48:12 +08:00

38 lines
1.5 KiB
Diff

--- a/coders/xwd.c Tue Apr 02 19:44:48 2019 -0500
+++ b/coders/xwd.c Wed Apr 03 19:42:39 2019 -0500
@@ -390,8 +390,8 @@
else
{
image->storage_class=PseudoClass;
+ image->colors=header.ncolors;
}
- image->colors=header.ncolors;
if (!image_info->ping)
{
/*
@@ -507,7 +507,7 @@
/*
Convert X image to DirectClass packets.
*/
- if (image->colors != 0)
+ if (header.ncolors != 0)
{
for (y=0; y < (long) image->rows; y++)
{
@@ -519,12 +519,15 @@
pixel=XGetPixel(ximage,(int) x,(int) y);
index_val=(unsigned short)
((pixel >> red_shift) & red_mask);
+ VerifyColormapIndexWithColors(image,index_val,header.ncolors);
q->red=ScaleShortToQuantum(colors[index_val].red);
index_val=(unsigned short)
((pixel >> green_shift) & green_mask);
+ VerifyColormapIndexWithColors(image,index_val,header.ncolors);
q->green=ScaleShortToQuantum(colors[index_val].green);
index_val=(unsigned short)
((pixel >> blue_shift) & blue_mask);
+ VerifyColormapIndexWithColors(image,index_val,header.ncolors);
q->blue=ScaleShortToQuantum(colors[index_val].blue);
q++;
}