Re: Gentoo ImageMagick BMP image buffer overflow

On Thu, Sep 09, 2004 at 11:46:10AM -0500, Bob Friesenhahn wrote:
> On Thu, 9 Sep 2004, Albert Chin wrote:
> 
> >Is GM also vulnerable:
> > http://www.gentoo.org/security/en/glsa/glsa-200409-12.xml
> > http://studio.imagemagick.org/pipermail/magick-developers/2004-August/002011.html
> 
> Yes, GM is also vulnerable.  Glenn Randers-Pehrson checked fixes into 
> both the CVS development version, and into the 1.1 branch on August 
> 24.
> 
> I also noticed a potential stack buffer overflow issue in tiff.c, 
> which is fixed in both stable and development branches.

Just to confirm, does the patch below cover both of the above?

-- 
albert chin ([email protected])

-- snip snip
--- coders/tiff.c.orig	Wed Apr 14 17:45:28 2004
+++ coders/tiff.c	Fri Sep 10 07:25:58 2004
@@ -372,6 +372,9 @@
     message[MaxTextExtent];
 
   (void) vsprintf(message,format,warning);
+
+  (void) vsnprintf(message,MaxTextExtent-2,format,warning);
+  message[MaxTextExtent-2]='\0';
   (void) strcat(message,".");
   ThrowException2(tiff_exception,CoderError,message,module);
   return(True);
@@ -436,7 +439,8 @@
   char
     message[MaxTextExtent];
 
-  (void) vsprintf(message,format,warning);
+  (void) vsnprintf(message,MaxTextExtent-2,format,warning);
+  message[MaxTextExtent-2]='\0';
   (void) strcat(message,".");
   ThrowException2(tiff_exception,CoderWarning,message,module);
   return(True);
--- coders/avi.c.orig	Fri Sep 10 07:27:19 2004
+++ coders/avi.c	Fri Sep 10 07:27:30 2004
@@ -152,17 +152,24 @@
   register unsigned char
     *q;
 
+  unsigned char
+    *end;
+
   (void) memset(pixels,0,image->columns*image->rows);
   byte=0;
   x=0;
   q=pixels;
+  end=pixels + (size_t) image->columns*image->rows;
   for (y=0; y < (long) image->rows; )
   {
+    if (q < pixels || q  >= end)
+      break;
     count=ReadBlobByte(image);
     if (count == EOF)
       break;
     if (count != 0)
       {
+        count=Min(count, end - q);
         /*
           Encoded mode.
         */
@@ -212,6 +219,7 @@
             /*
               Absolute mode.
             */
+      	    count=Min(count, end - q);
             for (i=0; i < count; i++)
             {
               if (compression == 1)
--- coders/bmp.c.orig	Fri Sep 10 07:27:58 2004
+++ coders/bmp.c	Fri Sep 10 07:28:03 2004
@@ -170,6 +170,9 @@
   register unsigned char
     *q;
 
+  unsigned char
+    *end;
+
   assert(image != (Image *) NULL);
   assert(pixels != (unsigned char *) NULL);
   (void) LogMagickEvent(CoderEvent,GetMagickModule(),"  Decoding RLE pixels");
@@ -177,13 +180,17 @@
   byte=0;
   x=0;
   q=pixels;
+  end=pixels + (size_t) image->columns*image->rows;
   for (y=0; y < (long) image->rows; )
   {
+    if (q < pixels || q  >= end)
+      break;
     count=ReadBlobByte(image);
     if (count == EOF)
       break;
     if (count != 0)
       {
+        count=Min(count, end - q);
         /*
           Encoded mode.
         */
@@ -240,6 +247,7 @@
             /*
               Absolute mode.
             */
+    	    count=Min(count, end - q);
             if (compression == BI_RLE8)
               for (i=count; i != 0; --i)
                 *q++=ReadBlobByte(image);
@@ -656,14 +664,10 @@
               "  Number of colors: %lu",bmp_info.number_colors);
           }
 
-        if ((bmp_info.compression == BI_BITFIELDS) &&
-            ((bmp_info.bits_per_pixel == 16) ||
-             (bmp_info.bits_per_pixel == 32)))
-          {
-            bmp_info.red_mask=ReadBlobLSBLong(image);
-            bmp_info.green_mask=ReadBlobLSBLong(image);
-            bmp_info.blue_mask=ReadBlobLSBLong(image);
-          }
+        bmp_info.red_mask=ReadBlobLSBLong(image);
+        bmp_info.green_mask=ReadBlobLSBLong(image);
+        bmp_info.blue_mask=ReadBlobLSBLong(image);
+
         if (bmp_info.size > 40)
           {
             double
--- coders/dib.c.orig	Fri Sep 10 07:28:22 2004
+++ coders/dib.c	Fri Sep 10 07:28:24 2004
@@ -139,19 +139,26 @@
   register unsigned char
     *q;
 
+  unsigned char
+    *end;
+
   assert(image != (Image *) NULL);
   assert(pixels != (unsigned char *) NULL);
   (void) memset(pixels,0,image->columns*image->rows);
   byte=0;
   x=0;
   q=pixels;
+  end=pixels + (size_t) image->columns*image->rows;
   for (y=0; y < (long) image->rows; )
   {
+    if (q < pixels || q  >= end)
+      break;
     count=ReadBlobByte(image);
     if (count == EOF)
       break;
     if (count != 0)
       {
+        count=Min(count, end - q);
         /*
           Encoded mode.
         */
@@ -201,6 +208,7 @@
             /*
               Absolute mode.
             */
+      	    count=Min(count, end - q);
             for (i=0; i < count; i++)
             {
               if (compression == 1)


-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM. 
Deadline: Sept. 13. Go here: http://sf.net/ppc_contest.php