ImageMagick/CVE-2020-25665.patch
2021-03-08 15:25:50 +08:00

41 lines
1.7 KiB
Diff

From ca80e93cc887fb8971ceba2eead2c74e2b927df4 Mon Sep 17 00:00:00 2001
From: Cristy <urban-warrior@imagemagick.org>
Date: Fri, 4 Oct 2019 18:19:20 -0400
Subject: [PATCH] https://github.com/ImageMagick/ImageMagick/issues/1714
---
coders/palm.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/coders/palm.c b/coders/palm.c
index 125bab8ff..4cd5522a4 100644
--- a/coders/palm.c
+++ b/coders/palm.c
@@ -779,7 +779,7 @@ static MagickBooleanType WritePALMImage(const ImageInfo *image_info,
{
(void) TransformImageColorspace(image,sRGBColorspace);
count=GetNumberColors(image,NULL,exception);
- for (bits_per_pixel=1; (one << bits_per_pixel) < count; bits_per_pixel*=2) ;
+ for (bits_per_pixel=1; (one << bits_per_pixel) < count; bits_per_pixel*=2) ;
if (bits_per_pixel > 16)
bits_per_pixel=16;
else
@@ -879,7 +879,7 @@ static MagickBooleanType WritePALMImage(const ImageInfo *image_info,
last_row=(unsigned char *) NULL;
if (image_info->compression == FaxCompression)
{
- last_row=(unsigned char *) AcquireQuantumMemory(bytes_per_row,
+ last_row=(unsigned char *) AcquireQuantumMemory(bytes_per_row+256,
sizeof(*last_row));
if (last_row == (unsigned char *) NULL)
{
@@ -887,7 +887,7 @@ static MagickBooleanType WritePALMImage(const ImageInfo *image_info,
ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
}
}
- one_row=(unsigned char *) AcquireQuantumMemory(bytes_per_row,
+ one_row=(unsigned char *) AcquireQuantumMemory(bytes_per_row+256,
sizeof(*one_row));
if (one_row == (unsigned char *) NULL)
{