184 lines
6.8 KiB
Diff
184 lines
6.8 KiB
Diff
From 1e48a746b0b1c34b2bdc2ae8cfa094d69ce50aa3 Mon Sep 17 00:00:00 2001
|
||
From: Cristy <mikayla-grace@urban-warrior.org>
|
||
Date: Thu, 25 Feb 2021 17:03:18 -0500
|
||
Subject: [PATCH] possible divide by zero + clear buffers
|
||
|
||
---
|
||
coders/thumbnail.c | 3 ++-
|
||
configure | 2 +-
|
||
magick/cipher.c | 12 ++++++------
|
||
magick/colorspace.c | 16 ++++++++--------
|
||
magick/memory.c | 21 ++++++++++++++++-----
|
||
magick/signature.c | 2 +-
|
||
6 files changed, 34 insertions(+), 22 deletions(-)
|
||
|
||
diff --git a/coders/thumbnail.c b/coders/thumbnail.c
|
||
index 21895a9..73917fc 100644
|
||
--- a/coders/thumbnail.c
|
||
+++ b/coders/thumbnail.c
|
||
@@ -198,7 +198,8 @@ static MagickBooleanType WriteTHUMBNAILImage(const ImageInfo *image_info,
|
||
break;
|
||
q++;
|
||
}
|
||
- if ((q+length) > (GetStringInfoDatum(profile)+GetStringInfoLength(profile)))
|
||
+ if ((q > (GetStringInfoDatum(profile)+GetStringInfoLength(profile))) ||
|
||
+ (length > (GetStringInfoDatum(profile)+GetStringInfoLength(profile)-q)))
|
||
ThrowWriterException(CoderError,"ImageDoesNotHaveAThumbnail");
|
||
thumbnail_image=BlobToImage(image_info,q,length,&image->exception);
|
||
if (thumbnail_image == (Image *) NULL)
|
||
diff --git a/configure b/configure
|
||
index 6f61a2f..65efc18 100755
|
||
--- a/configure
|
||
+++ b/configure
|
||
@@ -4573,7 +4573,7 @@ MAGICK_PATCHLEVEL_VERSION=67
|
||
|
||
MAGICK_VERSION=6.9.10-67
|
||
|
||
-MAGICK_GIT_REVISION=14843:618d759:20190929
|
||
+MAGICK_GIT_REVISION=16484:c5e7a8bbe:20210225
|
||
|
||
|
||
# Substitute library versioning
|
||
diff --git a/magick/cipher.c b/magick/cipher.c
|
||
index da97378..6c74c51 100644
|
||
--- a/magick/cipher.c
|
||
+++ b/magick/cipher.c
|
||
@@ -483,8 +483,8 @@ static void EncipherAESBlock(AESInfo *aes_info,const unsigned char *plaintext,
|
||
Reset registers.
|
||
*/
|
||
alpha=0;
|
||
- (void) memset(key,0,sizeof(key));
|
||
- (void) memset(text,0,sizeof(text));
|
||
+ (void) ResetMagickMemory(key,0,sizeof(key));
|
||
+ (void) ResetMagickMemory(text,0,sizeof(text));
|
||
}
|
||
|
||
/*
|
||
@@ -706,8 +706,8 @@ MagickExport MagickBooleanType PasskeyDecipherImage(Image *image,
|
||
*/
|
||
quantum_info=DestroyQuantumInfo(quantum_info);
|
||
aes_info=DestroyAESInfo(aes_info);
|
||
- (void) memset(input_block,0,sizeof(input_block));
|
||
- (void) memset(output_block,0,sizeof(output_block));
|
||
+ (void) ResetMagickMemory(input_block,0,sizeof(input_block));
|
||
+ (void) ResetMagickMemory(output_block,0,sizeof(output_block));
|
||
return(y == (ssize_t) image->rows ? MagickTrue : MagickFalse);
|
||
}
|
||
|
||
@@ -923,8 +923,8 @@ MagickExport MagickBooleanType PasskeyEncipherImage(Image *image,
|
||
*/
|
||
quantum_info=DestroyQuantumInfo(quantum_info);
|
||
aes_info=DestroyAESInfo(aes_info);
|
||
- (void) memset(input_block,0,sizeof(input_block));
|
||
- (void) memset(output_block,0,sizeof(output_block));
|
||
+ (void) ResetMagickMemory(input_block,0,sizeof(input_block));
|
||
+ (void) ResetMagickMemory(output_block,0,sizeof(output_block));
|
||
return(y == (ssize_t) image->rows ? MagickTrue : MagickFalse);
|
||
}
|
||
|
||
diff --git a/magick/colorspace.c b/magick/colorspace.c
|
||
index 4e68c21..0a3e368 100644
|
||
--- a/magick/colorspace.c
|
||
+++ b/magick/colorspace.c
|
||
@@ -737,15 +737,15 @@ MagickExport MagickBooleanType RGBTransformImage(Image *image,
|
||
if (logmap == (Quantum *) NULL)
|
||
ThrowBinaryException(ResourceLimitError,"MemoryAllocationFailed",
|
||
image->filename);
|
||
- black=pow(10.0,(reference_black-reference_white)*(gamma/density)*0.002/
|
||
- film_gamma);
|
||
+ black=pow(10.0,(reference_black-reference_white)*(gamma/density)*0.002*
|
||
+ PerceptibleReciprocal(film_gamma));
|
||
#if defined(MAGICKCORE_OPENMP_SUPPORT)
|
||
#pragma omp parallel for schedule(static)
|
||
#endif
|
||
for (i=0; i <= (ssize_t) MaxMap; i++)
|
||
logmap[i]=ScaleMapToQuantum((MagickRealType) (MaxMap*(reference_white+
|
||
- log10(black+(1.0*i/MaxMap)*(1.0-black))/((gamma/density)*0.002/
|
||
- film_gamma))/1024.0));
|
||
+ log10(black+(1.0*i/MaxMap)*(1.0-black))/((gamma/density)*0.002*
|
||
+ PerceptibleReciprocal(film_gamma)))/1024.0));
|
||
image_view=AcquireAuthenticCacheView(image,exception);
|
||
#if defined(MAGICKCORE_OPENMP_SUPPORT)
|
||
#pragma omp parallel for schedule(static) shared(status) \
|
||
@@ -2396,14 +2396,14 @@ MagickExport MagickBooleanType TransformRGBImage(Image *image,
|
||
if (logmap == (Quantum *) NULL)
|
||
ThrowBinaryException(ResourceLimitError,"MemoryAllocationFailed",
|
||
image->filename);
|
||
- black=pow(10.0,(reference_black-reference_white)*(gamma/density)*0.002/
|
||
- film_gamma);
|
||
+ black=pow(10.0,(reference_black-reference_white)*(gamma/density)*0.002*
|
||
+ PerceptibleReciprocal(film_gamma));
|
||
for (i=0; i <= (ssize_t) (reference_black*MaxMap/1024.0); i++)
|
||
logmap[i]=(Quantum) 0;
|
||
for ( ; i < (ssize_t) (reference_white*MaxMap/1024.0); i++)
|
||
logmap[i]=ClampToQuantum((MagickRealType) QuantumRange/(1.0-black)*
|
||
- (pow(10.0,(1024.0*i/MaxMap-reference_white)*(gamma/density)*0.002/
|
||
- film_gamma)-black));
|
||
+ (pow(10.0,(1024.0*i/MaxMap-reference_white)*(gamma/density)*0.002*
|
||
+ PerceptibleReciprocal(film_gamma))-black));
|
||
for ( ; i <= (ssize_t) MaxMap; i++)
|
||
logmap[i]=QuantumRange;
|
||
if (image->storage_class == PseudoClass)
|
||
diff --git a/magick/memory.c b/magick/memory.c
|
||
index 487eaa7..791c1a4 100644
|
||
--- a/magick/memory.c
|
||
+++ b/magick/memory.c
|
||
@@ -1190,25 +1190,36 @@ MagickExport MemoryInfo *RelinquishVirtualMemory(MemoryInfo *memory_info)
|
||
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
||
%
|
||
% ResetMagickMemory() fills the first size bytes of the memory area pointed to
|
||
-% by memory with the constant byte c.
|
||
+% by memory with the constant byte c. We use a volatile pointer when
|
||
+% updating the byte string. Most compilers will avoid optimizing away access
|
||
+% to a volatile pointer, even if the pointer appears to be unused after the
|
||
+% call.
|
||
%
|
||
% The format of the ResetMagickMemory method is:
|
||
%
|
||
-% void *ResetMagickMemory(void *memory,int byte,const size_t size)
|
||
+% void *ResetMagickMemory(void *memory,int c,const size_t size)
|
||
%
|
||
% A description of each parameter follows:
|
||
%
|
||
% o memory: a pointer to a memory allocation.
|
||
%
|
||
-% o byte: set the memory to this value.
|
||
+% o c: set the memory to this value.
|
||
%
|
||
% o size: size of the memory to reset.
|
||
%
|
||
*/
|
||
-MagickExport void *ResetMagickMemory(void *memory,int byte,const size_t size)
|
||
+MagickExport void *ResetMagickMemory(void *memory,int c,const size_t size)
|
||
{
|
||
+ volatile unsigned char
|
||
+ *p = memory;
|
||
+
|
||
+ size_t
|
||
+ n = size;
|
||
+
|
||
assert(memory != (void *) NULL);
|
||
- return(memset(memory,byte,size));
|
||
+ while (n-- != 0)
|
||
+ *p++=(unsigned char) c;
|
||
+ return(memory);
|
||
}
|
||
|
||
/*
|
||
diff --git a/magick/signature.c b/magick/signature.c
|
||
index d8b100b..7edc295 100644
|
||
--- a/magick/signature.c
|
||
+++ b/magick/signature.c
|
||
@@ -720,7 +720,7 @@ RestoreMSCWarning
|
||
T=0;
|
||
T1=0;
|
||
T2=0;
|
||
- (void) memset(W,0,sizeof(W));
|
||
+ (void) ResetMagickMemory(W,0,sizeof(W));
|
||
}
|
||
|
||
/*
|
||
--
|
||
2.23.0
|
||
|