components/imagemagick/patches/CVE-2014-1958.patch
author Mike Sullivan <Mike.Sullivan@Oracle.COM>
Mon, 25 Aug 2014 23:01:22 -0700
branchs11-update
changeset 3289 a9439b8746a3
parent 2985 8d0f13e7dd0c
permissions -rw-r--r--
Added tag s11u3-05 for changeset dc4e788d5ef5
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
2985
8d0f13e7dd0c 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
     1
# This comes from upstream:
8d0f13e7dd0c 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
     2
# http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=25128
8d0f13e7dd0c 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
     3
8d0f13e7dd0c 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
     4
--- ImageMagick-6.8.3/coders/psd.c	2013-01-23 15:50:19.000000000 -0800
8d0f13e7dd0c 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
     5
+++ ImageMagick-6.8.3/coders/psd.c	2014-03-03 07:53:58.415170102 -0800
8d0f13e7dd0c 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
     6
@@ -269,13 +269,15 @@
8d0f13e7dd0c 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
     7
   packets=(ssize_t) number_compact_pixels;
8d0f13e7dd0c 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
     8
   for (i=0; (packets > 1) && (i < (ssize_t) number_pixels); )
8d0f13e7dd0c 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
     9
   {
8d0f13e7dd0c 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    10
-    length=(*compact_pixels++);
8d0f13e7dd0c 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    11
+    length=(size_t) (*compact_pixels++);
8d0f13e7dd0c 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    12
     packets--;
8d0f13e7dd0c 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    13
     if (length == 128)
8d0f13e7dd0c 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    14
       continue;
8d0f13e7dd0c 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    15
     if (length > 128)
8d0f13e7dd0c 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    16
       {
8d0f13e7dd0c 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    17
         length=256-length+1;
8d0f13e7dd0c 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    18
+        if ((ssize_t) length + i > (ssize_t) number_pixels) 
8d0f13e7dd0c 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    19
+          length=number_pixels-(size_t) i; 
8d0f13e7dd0c 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    20
         pixel=(*compact_pixels++);
8d0f13e7dd0c 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    21
         packets--;
8d0f13e7dd0c 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    22
         for (j=0; j < (ssize_t) length; j++)
8d0f13e7dd0c 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    23
@@ -322,6 +324,8 @@
8d0f13e7dd0c 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    24
         continue;
8d0f13e7dd0c 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    25
       }
8d0f13e7dd0c 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    26
     length++;
8d0f13e7dd0c 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    27
+    if ((ssize_t) length + i > (ssize_t) number_pixels) 
8d0f13e7dd0c 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    28
+      length=number_pixels-(size_t) i; 
8d0f13e7dd0c 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    29
     for (j=0; j < (ssize_t) length; j++)
8d0f13e7dd0c 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    30
     {
8d0f13e7dd0c 18331784 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    31
       switch (depth)