ImageMagick/CVE-2020-25676.patch
2021-03-31 10:40:28 +08:00

52 lines
1.8 KiB
Diff

From 94aeb3c40d25aee1051ba8eb3a31601558ef2506 Mon Sep 17 00:00:00 2001
From: Cristy <urban-warrior@imagemagick.org>
Date: Tue, 8 Oct 2019 18:35:50 -0400
Subject: [PATCH] https://github.com/ImageMagick/ImageMagick/issues/1732
---
magick/pixel.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
diff --git a/magick/pixel.c b/magick/pixel.c
index 96eaf95db..1450a93e2 100644
--- a/magick/pixel.c
+++ b/magick/pixel.c
@@ -4418,6 +4418,15 @@ static inline void CatromWeights(const MagickRealType x,
(*weights)[2]=x-(*weights)[3]-gamma;
}
+static inline double ConstrainPixelOffset(double x)
+{
+ if (x < (double) -(SSIZE_MAX-512))
+ return((double) -(SSIZE_MAX-512));
+ if (x > (double) (SSIZE_MAX-512))
+ return((double) (SSIZE_MAX-512));
+ return(x);
+}
+
static inline void SplineWeights(const MagickRealType x,
MagickRealType (*weights)[4])
{
@@ -4483,8 +4492,8 @@ MagickExport MagickBooleanType InterpolateMagickPixelPacket(
assert(image->signature == MagickCoreSignature);
assert(image_view != (CacheView *) NULL);
status=MagickTrue;
- x_offset=(ssize_t) floor(x);
- y_offset=(ssize_t) floor(y);
+ x_offset=(ssize_t) floor(ConstrainPixelOffset(x));
+ y_offset=(ssize_t) floor(ConstrainPixelOffset(y));
interpolate = method;
if (interpolate == UndefinedInterpolatePixel)
interpolate=image->interpolate;
@@ -4502,8 +4511,8 @@ MagickExport MagickBooleanType InterpolateMagickPixelPacket(
if (interpolate == Average9InterpolatePixel)
{
count=3;
- x_offset=(ssize_t) (floor(x+0.5)-1);
- y_offset=(ssize_t) (floor(y+0.5)-1);
+ x_offset=(ssize_t) (floor(ConstrainPixelOffset(x)+0.5)-1);
+ y_offset=(ssize_t) (floor(ConstrainPixelOffset(y)+0.5)-1);
}
else
if (interpolate == Average16InterpolatePixel)