ImageMagick/CVE-2020-25675.patch
2021-04-06 10:05:34 +08:00

87 lines
3.5 KiB
Diff

From 6b169173585127299f4724f7880b575879c7f033 Mon Sep 17 00:00:00 2001
From: Cristy <urban-warrior@imagemagick.org>
Date: Tue, 8 Oct 2019 19:06:11 -0400
Subject: [PATCH] https://github.com/ImageMagick/ImageMagick/issues/1731
---
magick/transform.c | 31 ++++++++++++++++++++-----------
1 file changed, 20 insertions(+), 11 deletions(-)
diff --git a/magick/transform.c b/magick/transform.c
index 9edac6210..bbf351aa8 100644
--- a/magick/transform.c
+++ b/magick/transform.c
@@ -829,14 +829,23 @@ MagickExport Image *CropImage(const Image *image,const RectangleInfo *geometry,
%
*/
-static inline double MagickRound(double x)
+static inline double ConstrainPixelOffset(double x)
+{
+ if (x < (double) -(SSIZE_MAX-512))
+ return((double) -(SSIZE_MAX-512));
+ if (x > (double) (SSIZE_MAX-512))
+ return((double) (SSIZE_MAX-512));
+ return(x);
+}
+
+static inline ssize_t PixelRoundOffset(double x)
{
/*
Round the fraction to nearest integer.
*/
if ((x-floor(x)) < (ceil(x)-x))
- return(floor(x));
- return(ceil(x));
+ return((ssize_t) floor(ConstrainPixelOffset(x)));
+ return((ssize_t) ceil(ConstrainPixelOffset(x)));
}
MagickExport Image *CropImageToTiles(const Image *image,
@@ -901,18 +910,18 @@ MagickExport Image *CropImageToTiles(const Image *image,
{
if ((flags & AspectValue) == 0)
{
- crop.y=(ssize_t) MagickRound((MagickRealType) (offset.y-
+ crop.y=PixelRoundOffset((MagickRealType) (offset.y-
(geometry.y > 0 ? 0 : geometry.y)));
offset.y+=delta.y; /* increment now to find width */
- crop.height=(size_t) MagickRound((MagickRealType) (offset.y+
+ crop.height=(size_t) PixelRoundOffset((MagickRealType) (offset.y+
(geometry.y < 0 ? 0 : geometry.y)));
}
else
{
- crop.y=(ssize_t) MagickRound((MagickRealType) (offset.y-
+ crop.y=PixelRoundOffset((MagickRealType) (offset.y-
(geometry.y > 0 ? geometry.y : 0)));
offset.y+=delta.y; /* increment now to find width */
- crop.height=(size_t) MagickRound((MagickRealType) (offset.y+
+ crop.height=(size_t) PixelRoundOffset((MagickRealType) (offset.y+
(geometry.y < 0 ? geometry.y : 0)));
}
crop.height-=crop.y;
@@ -921,18 +930,18 @@ MagickExport Image *CropImageToTiles(const Image *image,
{
if ((flags & AspectValue) == 0)
{
- crop.x=(ssize_t) MagickRound((MagickRealType) (offset.x-
+ crop.x=PixelRoundOffset((MagickRealType) (offset.x-
(geometry.x > 0 ? 0 : geometry.x)));
offset.x+=delta.x; /* increment now to find height */
- crop.width=(size_t) MagickRound((MagickRealType) (offset.x+
+ crop.width=(size_t) PixelRoundOffset((MagickRealType) (offset.x+
(geometry.x < 0 ? 0 : geometry.x)));
}
else
{
- crop.x=(ssize_t) MagickRound((MagickRealType) (offset.x-
+ crop.x=PixelRoundOffset((MagickRealType) (offset.x-
(geometry.x > 0 ? geometry.x : 0)));
offset.x+=delta.x; /* increment now to find height */
- crop.width=(size_t) MagickRound((MagickRealType) (offset.x+
+ crop.width=(size_t) PixelRoundOffset((MagickRealType) (offset.x+
(geometry.x < 0 ? geometry.x : 0)));
}
crop.width-=crop.x;