GraphicsMagick: 3 new changesets

changeset 80215ad4efa0 in /hg/GraphicsMagick
details: http://hg.GraphicsMagick.org/hg/GraphicsMagick?cmd=changeset;node=80215ad4efa0
summary: MSLStartElement(): Assure that 'msl_info->attributes[n]' is not NULL before attempting to use it.

changeset 6cdb3bd5f91d in /hg/GraphicsMagick
details: http://hg.GraphicsMagick.org/hg/GraphicsMagick?cmd=changeset;node=6cdb3bd5f91d
summary: png_get_data(): On a short read, assure that the remainder of the buffer is initialized just in case subsequent code accesses it.

changeset bda0789b88f2 in /hg/GraphicsMagick
details: http://hg.GraphicsMagick.org/hg/GraphicsMagick?cmd=changeset;node=bda0789b88f2
summary: ReadTIFFImage(): Make sure that loops using TIFFReadScanline(), etc, do quit upon first reported error.

diffstat:

 ChangeLog                              |  18 ++++++++++++++
 VisualMagick/installer/inc/version.isx |   4 +-
 coders/msl.c                           |   2 +
 coders/png.c                           |  11 +++++---
 coders/tiff.c                          |  43 +++++++++++++++++++--------------
 magick/version.h                       |   4 +-
 www/Changelog.html                     |  16 ++++++++++++
 7 files changed, 72 insertions(+), 26 deletions(-)

diffs (287 lines):

diff -r 2067faf19869 -r bda0789b88f2 ChangeLog
--- a/ChangeLog	Tue Nov 02 12:39:01 2021 -0500
+++ b/ChangeLog	Wed Nov 03 13:24:04 2021 -0500
@@ -1,3 +1,21 @@
+2021-11-03  Bob Friesenhahn  <[email protected]>
+
+        * coders/tiff.c (ReadTIFFImage): Make sure that loops using
+        TIFFReadScanline(), etc, do quit upon first reported error.  Fixes
+        oss-fuzz 39167 "graphicsmagick:coder_BIGTIFF_fuzzer:
+        Use-of-uninitialized-value in DisassociateAlphaRegion", as well as
+        other such cases.
+
+        * coders/png.c (png_get_data): On a short read, assure that the
+        remainder of the buffer is initialized just in case subsequent
+        code accesses it.
+
+        * coders/msl.c (MSLStartElement): Assure that
+        'msl_info->attributes[n]' is not NULL before attempting to use it.
+        This is assumed to eliminate oss-fuzz 40226
+        "graphicsmagick:coder_MSL_fuzzer: ASSERT: image != (Image *)
+        NULL".
+
 2021-11-02  Bob Friesenhahn  <[email protected]>
 
         * coders/msl.c (MSLStartElement): Return immediately if there is
diff -r 2067faf19869 -r bda0789b88f2 VisualMagick/installer/inc/version.isx
--- a/VisualMagick/installer/inc/version.isx	Tue Nov 02 12:39:01 2021 -0500
+++ b/VisualMagick/installer/inc/version.isx	Wed Nov 03 13:24:04 2021 -0500
@@ -10,5 +10,5 @@
 
 #define public MagickPackageName "GraphicsMagick"
 #define public MagickPackageVersion "1.4"
-#define public MagickPackageVersionAddendum ".020211102"
-#define public MagickPackageReleaseDate "snapshot-20211102"
+#define public MagickPackageVersionAddendum ".020211103"
+#define public MagickPackageReleaseDate "snapshot-20211103"
diff -r 2067faf19869 -r bda0789b88f2 coders/msl.c
--- a/coders/msl.c	Tue Nov 02 12:39:01 2021 -0500
+++ b/coders/msl.c	Wed Nov 03 13:24:04 2021 -0500
@@ -1887,6 +1887,7 @@
           {
 
             MSL_BREAK_IF_IMAGE_NULL(msl_info->image[n]);
+            MSL_BREAK_IF_IMAGE_NULL(msl_info->attributes[n]);
 
             if (attributes == (const xmlChar **) NULL)
               break;
@@ -3103,6 +3104,7 @@
         else if (LocaleCompare((char *) name, "set") == 0)
           {
             MSL_BREAK_IF_IMAGE_NULL(msl_info->image[n]);
+            MSL_BREAK_IF_IMAGE_NULL(msl_info->attributes[n]);
 
             if (attributes == (const xmlChar **) NULL)
               break;
diff -r 2067faf19869 -r bda0789b88f2 coders/png.c
--- a/coders/png.c	Tue Nov 02 12:39:01 2021 -0500
+++ b/coders/png.c	Wed Nov 03 13:24:04 2021 -0500
@@ -788,20 +788,23 @@
   image=(Image *) png_get_io_ptr(png_ptr);
   if (length)
     {
-      png_size_t
+      size_t
         check;
 
       if (length > 0x7fffffff)
         png_warning(png_ptr, "chunk length > 2G");
-      check=(png_size_t) ReadBlob(image,(size_t) length,(char *) data);
+      check=ReadBlob(image,(size_t) length,(char *) data);
       if (check != length)
         {
           char
             msg[MaxTextExtent];
 
-            (void) sprintf(msg,"Expected %lu bytes; found %lu bytes",
-                           (unsigned long) length,(unsigned long) check);
+          (void) sprintf(msg,"Expected %" MAGICK_SIZE_T_F "u bytes;"
+                         " found %" MAGICK_SIZE_T_F "u bytes",
+                         (MAGICK_SIZE_T) length,(MAGICK_SIZE_T) check);
           png_warning(png_ptr,msg);
+          if (check < length)
+            (void) memset(data+check,0,length-check);
           png_error(png_ptr,"Read Exception");
         }
     }
diff -r 2067faf19869 -r bda0789b88f2 coders/tiff.c
--- a/coders/tiff.c	Tue Nov 02 12:39:01 2021 -0500
+++ b/coders/tiff.c	Wed Nov 03 13:24:04 2021 -0500
@@ -2590,9 +2590,9 @@
                 ThrowTIFFReaderException(ResourceLimitError,MemoryAllocationFailed,
                                          image);
               }
-            for (sample=0; sample < max_sample; sample++)
+            for (sample=0; (status != MagickFail) && (sample < max_sample); sample++)
               {
-                for (y=0; y < image->rows; y++)
+                for (y=0; (status != MagickFail) && (y < image->rows); y++)
                   {
                     if (sample == 0)
                       q=SetImagePixelsEx(image,0,y,image->columns,1,exception);
@@ -2610,6 +2610,13 @@
                     */
                     if (TIFFReadScanline(tiff,(char *) scanline,(uint32) y,sample) == -1)
                       {
+                        (void) LogMagickEvent(CoderEvent,GetMagickModule(),
+                                              "TIFFReadScanline() failed!");
+                        status=MagickFail;
+                        break;
+                      }
+                    if (image->exception.severity >= ErrorException)
+                      {
                         status=MagickFail;
                         break;
                       }
@@ -2781,7 +2788,7 @@
             /*
               Process each plane
             */
-            for (sample=0; sample < max_sample; sample++)
+            for (sample=0; (status != MagickFail) && (sample < max_sample); sample++)
               {
                 rows_remaining=0;
                 /*
@@ -2797,7 +2804,7 @@
                     status=MagickFail;
                     break;
                   }
-                for (y=0; y < image->rows; y++)
+                for (y=0; (status != MagickFail) && (y < image->rows); y++)
                   {
                     /*
                       Access Magick pixels.
@@ -3030,7 +3037,7 @@
             /*
               Process each plane.
             */
-            for (sample=0; sample < max_sample; sample++)
+            for (sample=0; (status != MagickFail) && (sample < max_sample); sample++)
               {
                 /*
                   Determine quantum parse method.
@@ -3044,9 +3051,9 @@
                     status=MagickFail;
                     break;
                   }
-                for (y=0; y < image->rows; y+=tile_rows)
+                for (y=0; (status != MagickFail) && (y < image->rows); y+=tile_rows)
                   {
-                    for (x=0; x < image->columns; x+=tile_columns)
+                    for (x=0; (status != MagickFail) && (x < image->columns); x+=tile_columns)
                       {
                         long
                           tile_set_columns,
@@ -3084,7 +3091,7 @@
                           SwabDataToBigEndian(bits_per_sample,tile,tile_size);
 #endif
                         p=tile;
-                        for (yy=y; yy < (long) y+tile_set_rows; yy++)
+                        for (yy=y; (status != MagickFail) && (yy < (long) y+tile_set_rows); yy++)
                           {
                             /*
                               Obtain pixel region corresponding to tile row.
@@ -3217,7 +3224,7 @@
             */
             i=0;
             p=0;
-            for (y=0; y < image->rows; y++)
+            for (y=0; (status != MagickFail) && (y < image->rows); y++)
               {
                 q=SetImagePixelsEx(image,0,y,image->columns,1,exception);
                 if (q == (PixelPacket *) NULL)
@@ -3239,7 +3246,7 @@
                   }
                 i--;
                 p=strip_pixels+(size_t) image->columns*i;
-                for (x=0; x < image->columns; x++)
+                for (x=0; (status != MagickFail) && (x < image->columns); x++)
                   {
                     q->red=ScaleCharToQuantum(TIFFGetR(*p));
                     q->green=ScaleCharToQuantum(TIFFGetG(*p));
@@ -3385,7 +3392,7 @@
                 ThrowTIFFReaderException(ResourceLimitError,MemoryAllocationFailed,
                                          image);
               }
-            for (y=0; y < image->rows; y+=tile_rows)
+            for (y=0; (status != MagickFail) && (y < image->rows); y+=tile_rows)
               {
                 /*
                   Retrieve a tile height's worth of rows
@@ -3411,7 +3418,7 @@
                     status=MagickFail;
                     break;
                   }
-                for (x=0; x < image->columns; x+=tile_columns)
+                for (x=0; (status != MagickFail) && (x < image->columns); x+=tile_columns)
                   {
                     register unsigned int
                       tile_column,
@@ -5904,7 +5911,7 @@
             /*
               For each plane
             */
-            for (sample=0; sample < max_sample; sample++)
+            for (sample=0; (status != MagickFail) && (sample < max_sample); sample++)
               {
                 /*
                   Determine quantum parse method.
@@ -5918,7 +5925,7 @@
                     status=MagickFail;
                     break;
                   }
-                for (y=0; y < image->rows; y++)
+                for (y=0; (status != MagickFail) && (y < image->rows); y++)
                   {
                     if ((image->matte) && (alpha_type == AssociatedAlpha))
                       p=GetImagePixels(image,0,y,image->columns,1);
@@ -6105,7 +6112,7 @@
             /*
               Process each plane.
             */
-            for (sample=0; sample < max_sample; sample++)
+            for (sample=0; (status != MagickFail) && (sample < max_sample); sample++)
               {
                 /*
                   Determine quantum parse method.
@@ -6119,9 +6126,9 @@
                     status=MagickFail;
                     break;
                   }
-                for (y=0; y < image->rows; y+=tile_rows)
+                for (y=0; (status != MagickFail) && (y < image->rows); y+=tile_rows)
                   {
-                    for (x=0; x < image->columns; x+=tile_columns)
+                    for (x=0; (status != MagickFail) && (x < image->columns); x+=tile_columns)
                       {
                         const PixelPacket
                           *p;
@@ -6149,7 +6156,7 @@
                           tile_set_rows=tile_rows;
 
                         q=tile;
-                        for (yy=y; yy < (long) y+tile_set_rows; yy++)
+                        for (yy=y; (status != MagickFail) && (yy < (long) y+tile_set_rows); yy++)
                           {
                             /*
                               Obtain pixel region corresponding to tile row.
diff -r 2067faf19869 -r bda0789b88f2 magick/version.h
--- a/magick/version.h	Tue Nov 02 12:39:01 2021 -0500
+++ b/magick/version.h	Wed Nov 03 13:24:04 2021 -0500
@@ -38,8 +38,8 @@
 #define MagickLibVersion  0x252200
 #define MagickLibVersionText  "1.4"
 #define MagickLibVersionNumber 25,22,0
-#define MagickChangeDate   "20211102"
-#define MagickReleaseDate  "snapshot-20211102"
+#define MagickChangeDate   "20211103"
+#define MagickReleaseDate  "snapshot-20211103"
 
 /*
   The MagickLibInterfaceNewest and MagickLibInterfaceOldest defines
diff -r 2067faf19869 -r bda0789b88f2 www/Changelog.html
--- a/www/Changelog.html	Tue Nov 02 12:39:01 2021 -0500
+++ b/www/Changelog.html	Wed Nov 03 13:24:04 2021 -0500
@@ -35,6 +35,22 @@
 <div class="document">
 
 
+<p>2021-11-03  Bob Friesenhahn  &lt;<a class="reference external" href="mailto:bfriesen&#37;&#52;&#48;simple&#46;dallas&#46;tx&#46;us">bfriesen<span>&#64;</span>simple<span>&#46;</span>dallas<span>&#46;</span>tx<span>&#46;</span>us</a>&gt;</p>
+<blockquote>
+<p>* coders/tiff.c (ReadTIFFImage): Make sure that loops using
+TIFFReadScanline(), etc, do quit upon first reported error.  Fixes
+oss-fuzz 39167 &quot;graphicsmagick:coder_BIGTIFF_fuzzer:
+Use-of-uninitialized-value in DisassociateAlphaRegion&quot;, as well as
+other such cases.</p>
+<p>* coders/png.c (png_get_data): On a short read, assure that the
+remainder of the buffer is initialized just in case subsequent
+code accesses it.</p>
+<p>* coders/msl.c (MSLStartElement): Assure that
+'msl_info-&gt;attributes[n]' is not NULL before attempting to use it.
+This is assumed to eliminate oss-fuzz 40226
+&quot;graphicsmagick:coder_MSL_fuzzer: ASSERT: image != (Image *)
+NULL&quot;.</p>
+</blockquote>
 <p>2021-11-02  Bob Friesenhahn  &lt;<a class="reference external" href="mailto:bfriesen&#37;&#52;&#48;simple&#46;dallas&#46;tx&#46;us">bfriesen<span>&#64;</span>simple<span>&#46;</span>dallas<span>&#46;</span>tx<span>&#46;</span>us</a>&gt;</p>
 <blockquote>
 * coders/msl.c (MSLStartElement): Return immediately if there is