1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
|
From 716496e6df0add89e9679d6da9c0afca814cfe49 Mon Sep 17 00:00:00 2001
From: Cristy <urban-warrior@imagemagick.org>
Date: Sun, 3 Apr 2022 14:35:29 -0400
Subject: [PATCH] do not attempt to write a null image list (thanks to Vinay
Rohila)
CVE: CVE-2022-2719
Upstream-Status: Backport [https://github.com/ImageMagick/ImageMagick/commit/716496e6df0add89e9679d6da9c0afca814cfe49.patch]
Signed-off-by: Sana Kazi Sana.Kazi@kpit.com
---
MagickWand/operation.c | 3 ++-
coders/tim2.c | 30 ++++++++++++++----------------
2 files changed, 16 insertions(+), 17 deletions(-)
diff --git a/MagickWand/operation.c b/MagickWand/operation.c
index 383dc7c8098..95596035367 100644
--- a/MagickWand/operation.c
+++ b/MagickWand/operation.c
@@ -4893,7 +4893,8 @@ WandPrivate void CLINoImageOperator(Magi
if (IfPlusOp)
write_images=CloneImageList(_images,_exception);
write_info=CloneImageInfo(_image_info);
- (void) WriteImages(write_info,write_images,arg1,_exception);
+ if (write_images != (Image *) NULL)
+ (void) WriteImages(write_info,write_images,arg1,_exception);
write_info=DestroyImageInfo(write_info);
if (IfPlusOp)
write_images=DestroyImageList(write_images);
diff --git a/coders/tim2.c b/coders/tim2.c
index e55170d8205..110542e45ba 100644
--- a/coders/tim2.c
+++ b/coders/tim2.c
@@ -60,8 +60,7 @@
#include "MagickCore/static.h"
#include "MagickCore/string_.h"
#include "MagickCore/module.h"
-
-
+
/*
Typedef declarations
*/
@@ -123,8 +122,7 @@ typedef enum
RGB24=1,
RGBA16=2,
} TIM2ColorEncoding;
-
-
+
/*
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% %
@@ -142,7 +140,8 @@ typedef enum
%
% The format of the ReadTIM2Image method is:
%
-% Image *ReadTIM2Image(const ImageInfo *image_info,ExceptionInfo *exception)
+% Image *ReadTIM2Image(const ImageInfo *image_info,
+% ExceptionInfo *exception)
%
% A description of each parameter follows:
%
@@ -600,13 +599,13 @@ static MagickBooleanType ReadTIM2ImageData(const ImageInfo *image_info,
image_info->filename);
break;
}
- if (csm==CSM1)
+ if (csm == CSM1)
{
PixelInfo
*oldColormap;
- oldColormap=(PixelInfo *) AcquireQuantumMemory((size_t)(image->colors)+1,
- sizeof(*image->colormap));
+ oldColormap=(PixelInfo *) AcquireQuantumMemory((size_t)(image->colors)+
+ 1,sizeof(*image->colormap));
if (oldColormap == (PixelInfo *) NULL)
ThrowBinaryException(ResourceLimitError,"MemoryAllocationFailed",
image_info->filename);
@@ -617,7 +616,8 @@ static MagickBooleanType ReadTIM2ImageData(const ImageInfo *image_info,
return(status);
}
-static Image *ReadTIM2Image(const ImageInfo *image_info,ExceptionInfo *exception)
+static Image *ReadTIM2Image(const ImageInfo *image_info,
+ ExceptionInfo *exception)
{
Image
*image;
@@ -626,6 +626,7 @@ static Image *ReadTIM2Image(const ImageInfo *image_info,ExceptionInfo *exception
status;
ssize_t
+ i,
str_read;
TIM2FileHeader
@@ -685,7 +686,7 @@ static Image *ReadTIM2Image(const ImageInfo *image_info,ExceptionInfo *exception
*/
if (file_header.image_count != 1)
ThrowReaderException(CoderError,"NumberOfImagesIsNotSupported");
- for (int i=0; i < file_header.image_count; ++i)
+ for (i=0; i < (ssize_t) file_header.image_count; i++)
{
char
clut_depth,
@@ -780,8 +781,7 @@ static Image *ReadTIM2Image(const ImageInfo *image_info,ExceptionInfo *exception
break;
}
image=SyncNextImageInList(image);
- status=SetImageProgress(image,LoadImagesTag,image->scene-1,
- image->scene);
+ status=SetImageProgress(image,LoadImagesTag,image->scene-1,image->scene);
if (status == MagickFalse)
break;
}
@@ -790,8 +790,7 @@ static Image *ReadTIM2Image(const ImageInfo *image_info,ExceptionInfo *exception
return(DestroyImageList(image));
return(GetFirstImageInList(image));
}
-
-
+
/*
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% %
@@ -825,8 +824,7 @@ ModuleExport size_t RegisterTIM2Image(void)
(void) RegisterMagickInfo(entry);
return(MagickImageCoderSignature);
}
-
-
+
/*
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% %
|
