components/imagemagick/patches/CVE-2016-6491.patch
author John Beck <John.Beck@Oracle.COM>
Fri, 29 Jul 2016 06:17:40 -0700
branchs11u3-sru
changeset 6539 87c707918565
permissions -rw-r--r--
24374851 problem in UTILITY/IMAGEMAGICK
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
6539
87c707918565 24374851 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
     1
This patch comes from upstream:
87c707918565 24374851 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
     2
https://github.com/ImageMagick/ImageMagick/commit/dd84447b63a71fa8c3f47071b09454efc667767b
87c707918565 24374851 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
     3
It can be removed once we upgrade to a release that has the fix, presumably
87c707918565 24374851 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
     4
version 6.9.5-4 or later.
87c707918565 24374851 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
     5
87c707918565 24374851 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
     6
--- ImageMagick-6.9.5/magick/property.c.orig	2016-06-26 17:40:19.000000000 -0700
87c707918565 24374851 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
     7
+++ ImageMagick-6.9.5/magick/property.c	2016-07-29 05:56:23.858967297 -0700
87c707918565 24374851 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
     8
@@ -638,6 +638,11 @@
87c707918565 24374851 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
     9
     if ((count & 0x01) == 0)
87c707918565 24374851 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    10
       (void) ReadPropertyByte(&info,&length);
87c707918565 24374851 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    11
     count=(ssize_t) ReadPropertyMSBLong(&info,&length);
87c707918565 24374851 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    12
+    if ((count < 0) || ((size_t) count > length))
87c707918565 24374851 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    13
+      {
87c707918565 24374851 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    14
+        length=0; 
87c707918565 24374851 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    15
+        continue;
87c707918565 24374851 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    16
+      }
87c707918565 24374851 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    17
     if ((*name != '\0') && (*name != '#'))
87c707918565 24374851 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    18
       if ((resource == (char *) NULL) || (LocaleCompare(name,resource) != 0))
87c707918565 24374851 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    19
         {