From aa673b2e4defc7cad5bec16c4fc8324f71e531f1 Mon Sep 17 00:00:00 2001 From: Cristy Date: Sun, 24 Sep 2023 07:28:19 -0400 Subject: [PATCH] check for BMP file size, poc provided by Hardik Shah of Vehere (Dawn Treaders team) CVE: CVE-2023-5341 Upstream-Status: Backport [https://github.com/ImageMagick/ImageMagick/commit/aa673b2e4defc7cad5bec16c4fc8324f71e531f1.patch] Comment: Refresh hunk as per codebase Signed-off-by: Sana Kazi Sana.Kazi@kpit.com --- coders/bmp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/coders/bmp.c b/coders/bmp.c index 94ec6628fdf..7e36d4f481b 100644 --- a/coders/bmp.c +++ b/coders/bmp.c @@ -625,6 +625,9 @@ static Image *ReadBMPImage(const ImageIn if (image->debug != MagickFalse) (void) LogMagickEvent(CoderEvent,GetMagickModule()," BMP size: %u", bmp_info.size); + if ((bmp_info.file_size != 0) && + ((MagickSizeType) bmp_info.file_size > GetBlobSize(image))) + ThrowReaderException(CorruptImageError,"ImproperImageHeader"); profile_data=0; profile_size=0; if (bmp_info.size == 12)