components/imagemagick/patches/CVE-2016-6491.patch
author Mike Sullivan <Mike.Sullivan@Oracle.COM>
Sat, 30 Jul 2016 09:46:03 -0700
changeset 6533 de74a7d8f718
parent 6517 f6ceda1a08d4
permissions -rw-r--r--
Added tag s12-105.1 for changeset 611180e7af31
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
6517
f6ceda1a08d4 24374851 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
     1
This patch comes from upstream:
f6ceda1a08d4 24374851 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
     2
https://github.com/ImageMagick/ImageMagick/commit/dd84447b63a71fa8c3f47071b09454efc667767b
f6ceda1a08d4 24374851 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
     3
It can be removed once we upgrade to a release that has the fix, presumably
f6ceda1a08d4 24374851 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
     4
version 6.9.5-4 or later.
f6ceda1a08d4 24374851 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
     5
f6ceda1a08d4 24374851 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
     6
--- ImageMagick-6.9.5/magick/property.c.orig	2016-06-26 17:40:19.000000000 -0700
f6ceda1a08d4 24374851 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
     7
+++ ImageMagick-6.9.5/magick/property.c	2016-07-29 05:56:23.858967297 -0700
f6ceda1a08d4 24374851 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
     8
@@ -638,6 +638,11 @@
f6ceda1a08d4 24374851 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
     9
     if ((count & 0x01) == 0)
f6ceda1a08d4 24374851 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    10
       (void) ReadPropertyByte(&info,&length);
f6ceda1a08d4 24374851 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    11
     count=(ssize_t) ReadPropertyMSBLong(&info,&length);
f6ceda1a08d4 24374851 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    12
+    if ((count < 0) || ((size_t) count > length))
f6ceda1a08d4 24374851 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    13
+      {
f6ceda1a08d4 24374851 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    14
+        length=0; 
f6ceda1a08d4 24374851 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    15
+        continue;
f6ceda1a08d4 24374851 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    16
+      }
f6ceda1a08d4 24374851 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    17
     if ((*name != '\0') && (*name != '#'))
f6ceda1a08d4 24374851 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    18
       if ((resource == (char *) NULL) || (LocaleCompare(name,resource) != 0))
f6ceda1a08d4 24374851 problem in UTILITY/IMAGEMAGICK
John Beck <John.Beck@Oracle.COM>
parents:
diff changeset
    19
         {