!153 [sync] PR-152: Fix CVE-2022-3213

From: @openeuler-sync-bot 
Reviewed-by: @small_leek 
Signed-off-by: @small_leek

CVE-2022-3213-pre1.patch

@@ -0,0 +1,53 @@
+From a854a0a8af977a1b67830f02a53d9eb4d877e10d Mon Sep 17 00:00:00 2001
+From: Cristy <urban-warrior@imagemagick.org>
+Date: Tue, 21 Jun 2022 15:06:58 -0400
+Subject: [PATCH] prevent possible buffer overflow
+
+---
+ coders/tiff.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/coders/tiff.c b/coders/tiff.c
+index 49c1677cb7..2b64958930 100644
+--- a/coders/tiff.c
++++ b/coders/tiff.c
+@@ -1903,9 +1903,9 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
+         */
+         extent=(samples_per_pixel+1)*TIFFStripSize(tiff);
+ #if defined(TIFF_VERSION_BIG)
+-        extent+=image->columns*sizeof(uint64);
++        extent+=samples_per_pixel*sizeof(uint64);
+ #else
+-        extent+=image->columns*sizeof(uint32);
++        extent+=samples_per_pixel*sizeof(uint64);
+ #endif
+         strip_pixels=(unsigned char *) AcquireQuantumMemory(extent,
+           sizeof(*strip_pixels));
+@@ -2002,11 +2002,12 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
+         number_pixels=(MagickSizeType) columns*rows;
+         if (HeapOverflowSanityCheck(rows,sizeof(*tile_pixels)) != MagickFalse)
+           ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed");
+-        extent=4*MagickMax(rows*TIFFTileRowSize(tiff),TIFFTileSize(tiff));
++        extent=(samples_per_pixel+1)*MagickMax(rows*TIFFTileRowSize(tiff),
++          TIFFTileSize(tiff));
+ #if defined(TIFF_VERSION_BIG)
+-        extent+=image->columns*sizeof(uint64);
++        extent+=samples_per_pixel*sizeof(uint64);
+ #else
+-        extent+=image->columns*sizeof(uint32);
++        extent+=samples_per_pixel*sizeof(uint32);
+ #endif
+         tile_pixels=(unsigned char *) AcquireQuantumMemory(extent,
+           sizeof(*tile_pixels));
+@@ -2101,9 +2102,9 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
+           ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed");
+         number_pixels=(MagickSizeType) image->columns*image->rows;
+ #if defined(TIFF_VERSION_BIG)
+-        number_pixels+=image->columns*sizeof(uint64);
++        number_pixels+=samples_per_pixel*sizeof(uint64);
+ #else
+-        number_pixels+=image->columns*sizeof(uint32);
++        number_pixels+=samples_per_pixel*sizeof(uint32);
+ #endif
+         generic_info=AcquireVirtualMemory(number_pixels,sizeof(uint32));
+         if (generic_info == (MemoryInfo *) NULL)

CVE-2022-3213-pre2.patch

@@ -0,0 +1,22 @@
+From b11d64704f46cedade2ca3cdcebbc8d1f315035e Mon Sep 17 00:00:00 2001
+From: Cristy <urban-warrior@imagemagick.org>
+Date: Tue, 21 Jun 2022 17:14:48 -0400
+Subject: [PATCH] correct copy/paste error
+
+---
+ coders/tiff.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/coders/tiff.c b/coders/tiff.c
+index 2b64958930..e2c6ca1093 100644
+--- a/coders/tiff.c
++++ b/coders/tiff.c
+@@ -1905,7 +1905,7 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
+ #if defined(TIFF_VERSION_BIG)
+         extent+=samples_per_pixel*sizeof(uint64);
+ #else
+-        extent+=samples_per_pixel*sizeof(uint64);
++        extent+=samples_per_pixel*sizeof(uint32);
+ #endif
+         strip_pixels=(unsigned char *) AcquireQuantumMemory(extent,
+           sizeof(*strip_pixels));

CVE-2022-3213-pre3.patch

@@ -0,0 +1,54 @@
+From 309dfda1122f08fcf349b6f611b3b6df994d9297 Mon Sep 17 00:00:00 2001
+From: Cristy <urban-warrior@imagemagick.org>
+Date: Wed, 29 Jun 2022 19:40:56 -0400
+Subject: [PATCH] eliminate possible buffer overflow
+
+---
+ coders/tiff.c | 19 ++-----------------
+ 1 file changed, 2 insertions(+), 17 deletions(-)
+
+diff --git a/coders/tiff.c b/coders/tiff.c
+index e2c6ca1093..6bf4b112e1 100644
+--- a/coders/tiff.c
++++ b/coders/tiff.c
+@@ -1901,12 +1901,7 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
+         /*
+           Convert stripped TIFF image.
+         */
+-        extent=(samples_per_pixel+1)*TIFFStripSize(tiff);
+-#if defined(TIFF_VERSION_BIG)
+-        extent+=samples_per_pixel*sizeof(uint64);
+-#else
+-        extent+=samples_per_pixel*sizeof(uint32);
+-#endif
++        extent=4*(samples_per_pixel+1)*TIFFStripSize(tiff);
+         strip_pixels=(unsigned char *) AcquireQuantumMemory(extent,
+           sizeof(*strip_pixels));
+         if (strip_pixels == (unsigned char *) NULL)
+@@ -2002,13 +1997,8 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
+         number_pixels=(MagickSizeType) columns*rows;
+         if (HeapOverflowSanityCheck(rows,sizeof(*tile_pixels)) != MagickFalse)
+           ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed");
+-        extent=(samples_per_pixel+1)*MagickMax(rows*TIFFTileRowSize(tiff),
++        extent=4*(samples_per_pixel+1)*MagickMax(rows*TIFFTileRowSize(tiff),
+           TIFFTileSize(tiff));
+-#if defined(TIFF_VERSION_BIG)
+-        extent+=samples_per_pixel*sizeof(uint64);
+-#else
+-        extent+=samples_per_pixel*sizeof(uint32);
+-#endif
+         tile_pixels=(unsigned char *) AcquireQuantumMemory(extent,
+           sizeof(*tile_pixels));
+         if (tile_pixels == (unsigned char *) NULL)
+@@ -2101,11 +2091,6 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
+         if (HeapOverflowSanityCheck(image->rows,sizeof(*pixels)) != MagickFalse)
+           ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed");
+         number_pixels=(MagickSizeType) image->columns*image->rows;
+-#if defined(TIFF_VERSION_BIG)
+-        number_pixels+=samples_per_pixel*sizeof(uint64);
+-#else
+-        number_pixels+=samples_per_pixel*sizeof(uint32);
+-#endif
+         generic_info=AcquireVirtualMemory(number_pixels,sizeof(uint32));
+         if (generic_info == (MemoryInfo *) NULL)
+           ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed");

CVE-2022-3213.patch

@@ -0,0 +1,22 @@
+From 30ccf9a0da1f47161b5935a95be854fe84e6c2a2 Mon Sep 17 00:00:00 2001
+From: Cristy <urban-warrior@imagemagick.org>
+Date: Sat, 27 Aug 2022 08:38:57 -0400
+Subject: [PATCH] squash heap-buffer-overflow, PoC TIFF from Hardik
+
+---
+ coders/tiff.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/coders/tiff.c b/coders/tiff.c
+index 132008efbf..a166bea177 100644
+--- a/coders/tiff.c
++++ b/coders/tiff.c
+@@ -1892,7 +1892,7 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
+         /*
+           Convert stripped TIFF image.
+         */
+-        extent=4*(samples_per_pixel+1)*TIFFStripSize(tiff);
++        extent=4*((image->depth+7)/8)*(samples_per_pixel+1)*TIFFStripSize(tiff);
+         strip_pixels=(unsigned char *) AcquireQuantumMemory(extent,
+           sizeof(*strip_pixels));
+         if (strip_pixels == (unsigned char *) NULL)

ImageMagick.spec

@@ -1,7 +1,7 @@
 Name:           ImageMagick
 Epoch:          1
 Version:        7.1.0.28
-Release:        3
+Release:        4
 Summary:        Create, edit, compose, or convert bitmap images
 License:        ImageMagick and MIT
 Url:            http://www.imagemagick.org/
@@ -9,6 +9,10 @@ Source0:        https://github.com/ImageMagick/ImageMagick/archive/refs/tags/7.1
 
 Patch0001: backport-fix-CVE-2022-2719.patch
 Patch0002: backport-fix-CVE-2022-1115.patch
+Patch0003: CVE-2022-3213-pre1.patch
+Patch0004: CVE-2022-3213-pre2.patch
+Patch0005: CVE-2022-3213-pre3.patch
+Patch0006: CVE-2022-3213.patch
 
 BuildRequires:  bzip2-devel freetype-devel libjpeg-devel libpng-devel perl-generators
 BuildRequires:  libtiff-devel giflib-devel zlib-devel perl-devel >= 5.8.1 jbigkit-devel
@@ -163,6 +167,9 @@ rm PerlMagick/demo/Generic.ttf
 %{_libdir}/pkgconfig/ImageMagick*
 
 %changelog
+* Thu Oct 13 2022 chenwenjie <chenwenjie@ncti-gba.cn> - 1:7.1.0.28-4
+- fix CVE-2022-3213
+
 * Fri Aug 19 2022 cenhuilin <cenhuilin@kylinos.cn> - 1:7.1.0.28-3
 - fix CVE-2022-1115