Patches for security issues and other problems.

Moi!

While preparing Debian packages of graphicsmagick, I noticed that some
of ImageMagick's recent vulnerabilities are not (or not completely)
fixed in GraphicsMagick. These are

* CAN-2004-0981 (Heap overflow in EXIF parser)
  The important change ('||' -> '&&') is missing from the patch that
  went into GraphicsMagick. Patch against 1.1.7 attached.
* CAN-2005-0397 (Format string vulnerability in magick/image.c)
  Was originally reported against ImageMagick 6.x because the affected
  function had been renamed, but also needs to be fixed in 5.x and
  GraphicsMagick. Patch against 1.1.7 attached.
* CVE-2005-4601 (Shell command injection in delegate code)
  This security bug is very recent, and I'm not aware of any attempts to
  fix it. I've confirmed that it also affects GraphicsMagick. While
  there are security concerns only when GraphicsMagick tools are used as
  helpers from other applications like mail clients, it's still a bug
  to treat filenames differently depending on whether there is an
  external delegate involved or not. See http://bugs.debian.org/345238
  for more details. (The demo "exploit" using wmf files fails when
  GraphicsMagick was built with libwmf support. dvi files worked for me,
  though.)
  I don't see a quick and simple way to plug this hole, unfortunately.
  Disallowing '"' in filenames is the quick and dirty way but obviously
  suboptimal. Escaping shell metacharacters needs someone more familiar
  with the code then me to identify all the right places, otherwise we
  might end up with escaping once too often, even when the filename
  isn't passed through shell expansion later on. I've also been thinking
  about changing format specifiers from %i, %o etc. to $i, $o and pass
  substitutions values through environment variables. This might have
  unwanted side effects, but maybe we might still choose to try is
  anyway. What's your opinion on this problem?
* Stage 1 of the ttf/read.t regression test for the Perl bindings fails
  for me because the fonts are rendered much smaller in the reference
  image. Comparing with the output from current ImageMagick on the same
  system, it looks like the font size in the reference image is
  incorrect. But then ImageMagick also renders the first three lines
  differently, so I'm not completely sure who's to blame here.
* Finally, there's a simple typo in configure.ac that leads to an empty
  HTML delegate when running without frozen paths. Patch against 1.1.7
  attached.

Regards,

Daniel.

Apply complete fix for heap overflow in EXIF parser.

--- a/magick/attribute.c	Tue Jan  3 15:21:41 2006 +0100
+++ b/magick/attribute.c	Tue Jan  3 15:23:18 2006 +0100
@@ -1311,7 +1311,7 @@
               offset;
 
             offset=(size_t) Read32u(morder,pval);
-            if ((offset < length) || (level < (DE_STACK_SIZE-2)))
+            if ((offset < length) && (level < (DE_STACK_SIZE-2)))
               {
                 /*
                   Push our current directory state onto the stack.

Backport of ImageMagick format string security fix, cf. CAN-2005-0397.

--- a/magick/image.c	Tue Jan  3 14:46:13 2006 +0100
+++ b/magick/image.c	Tue Jan  3 14:59:36 2006 +0100
@@ -6250,7 +6250,7 @@
       /*
         Rectify multi-image file support.
       */
-      FormatString(filename,image_info->filename,0);
+      FormatString(filename,"%s",image_info->filename,0);
       if ((LocaleCompare(filename,image_info->filename) != 0) &&
           (strchr(filename,'%') == (char *) NULL))
         image_info->adjoin=False;

Fix typo in HTML delegation.

--- a/configure	Tue Jan  3 16:06:58 2006 +0100
+++ b/configure	Tue Jan  3 16:09:05 2006 +0100
@@ -35374,7 +35374,7 @@
   GMDelegate="${GMDelegateDefault}"
   GnuplotDecodeDelegate="$GnuplotDecodeDelegateDefault"
   HPGLDecodeDelegate="$HPGLDecodeDelegateDefault"
-  HTMLDecodeDelegate="$HTMLDecodeDelegatDefault"
+  HTMLDecodeDelegate="$HTMLDecodeDelegateDefault"
   ILBMDecodeDelegate="$ILBMDecodeDelegateDefault"
   ILBMEncodeDelegate="$ILBMEncodeDelegateDefault"
   LPDelegate="$LPDelegateDefault"
--- a/configure.ac	Tue Jan  3 16:06:58 2006 +0100
+++ b/configure.ac	Tue Jan  3 16:09:05 2006 +0100
@@ -2370,7 +2370,7 @@
   GMDelegate="${GMDelegateDefault}"
   GnuplotDecodeDelegate="$GnuplotDecodeDelegateDefault"
   HPGLDecodeDelegate="$HPGLDecodeDelegateDefault"
-  HTMLDecodeDelegate="$HTMLDecodeDelegatDefault"
+  HTMLDecodeDelegate="$HTMLDecodeDelegateDefault"
   ILBMDecodeDelegate="$ILBMDecodeDelegateDefault"
   ILBMEncodeDelegate="$ILBMEncodeDelegateDefault"
   LPDelegate="$LPDelegateDefault"