components/imagemagick/patches/CVE-2014-1958.patch
author Mike Sullivan <Mike.Sullivan@Oracle.COM>
Mon, 09 Mar 2015 23:00:55 -0700
changeset 3928 a2a4b4365139
parent 1739 7df663cb65c3
permissions -rw-r--r--
Added tag s12-70 for changeset ea48a1716c18
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
1739
7df663cb65c3 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
     1
# This comes from upstream:
7df663cb65c3 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
     2
# http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=25128
7df663cb65c3 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
     3
7df663cb65c3 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
     4
--- ImageMagick-6.8.3/coders/psd.c	2013-01-23 15:50:19.000000000 -0800
7df663cb65c3 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
     5
+++ ImageMagick-6.8.3/coders/psd.c	2014-03-03 07:53:58.415170102 -0800
7df663cb65c3 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
     6
@@ -269,13 +269,15 @@
7df663cb65c3 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
     7
   packets=(ssize_t) number_compact_pixels;
7df663cb65c3 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
     8
   for (i=0; (packets > 1) && (i < (ssize_t) number_pixels); )
7df663cb65c3 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
     9
   {
7df663cb65c3 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    10
-    length=(*compact_pixels++);
7df663cb65c3 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    11
+    length=(size_t) (*compact_pixels++);
7df663cb65c3 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    12
     packets--;
7df663cb65c3 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    13
     if (length == 128)
7df663cb65c3 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    14
       continue;
7df663cb65c3 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    15
     if (length > 128)
7df663cb65c3 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    16
       {
7df663cb65c3 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    17
         length=256-length+1;
7df663cb65c3 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    18
+        if ((ssize_t) length + i > (ssize_t) number_pixels) 
7df663cb65c3 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    19
+          length=number_pixels-(size_t) i; 
7df663cb65c3 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    20
         pixel=(*compact_pixels++);
7df663cb65c3 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    21
         packets--;
7df663cb65c3 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    22
         for (j=0; j < (ssize_t) length; j++)
7df663cb65c3 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    23
@@ -322,6 +324,8 @@
7df663cb65c3 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    24
         continue;
7df663cb65c3 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    25
       }
7df663cb65c3 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    26
     length++;
7df663cb65c3 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    27
+    if ((ssize_t) length + i > (ssize_t) number_pixels) 
7df663cb65c3 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    28
+      length=number_pixels-(size_t) i; 
7df663cb65c3 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    29
     for (j=0; j < (ssize_t) length; j++)
7df663cb65c3 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    30
     {
7df663cb65c3 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    31
       switch (depth)