GraphicsMagick: JNG: Reliably deallocate alpha_image. Do not us...

changeset 232cce2f8964 in /hg/GraphicsMagick
details: http://hg.GraphicsMagick.org/hg/GraphicsMagick?cmd=changeset;node=232cce2f8964
summary: JNG: Reliably deallocate alpha_image.  Do not use broken embedded PNG image.

diffstat:

 ChangeLog                              |   6 ++++++
 VisualMagick/installer/inc/version.isx |   4 ++--
 coders/png.c                           |  32 ++++++++++++++++++++------------
 magick/version.h                       |   4 ++--
 www/Changelog.html                     |   5 +++++
 5 files changed, 35 insertions(+), 16 deletions(-)

diffs (165 lines):

diff -r faf48bce6b8c -r 232cce2f8964 ChangeLog
--- a/ChangeLog	Mon Dec 20 08:39:48 2021 -0600
+++ b/ChangeLog	Tue Dec 21 11:23:54 2021 -0600
@@ -1,3 +1,9 @@
+2021-12-21  Bob Friesenhahn  <[email protected]>
+
+        * coders/png.c (DestroyJNG): Deallocate alpha_image temporary file in DestroyJNG().
+        (ReadOnePNGImage): If setjmp fires, then don't return a broken
+        image.
+
 2021-12-18  Fojtik Jaroslav  <[email protected]>
 
         * magick/wpg.c: Fix incorrect TrX and TrY elements in CTM.
diff -r faf48bce6b8c -r 232cce2f8964 VisualMagick/installer/inc/version.isx
--- a/VisualMagick/installer/inc/version.isx	Mon Dec 20 08:39:48 2021 -0600
+++ b/VisualMagick/installer/inc/version.isx	Tue Dec 21 11:23:54 2021 -0600
@@ -10,5 +10,5 @@
 
 #define public MagickPackageName "GraphicsMagick"
 #define public MagickPackageVersion "1.4"
-#define public MagickPackageVersionAddendum ".020211218"
-#define public MagickPackageReleaseDate "snapshot-20211218"
+#define public MagickPackageVersionAddendum ".020211221"
+#define public MagickPackageReleaseDate "snapshot-20211221"
diff -r faf48bce6b8c -r 232cce2f8964 coders/png.c
--- a/coders/png.c	Mon Dec 20 08:39:48 2021 -0600
+++ b/coders/png.c	Tue Dec 21 11:23:54 2021 -0600
@@ -794,7 +794,7 @@
       if (length > 0x7fffffff)
         png_warning(png_ptr, "chunk length > 2G");
       check=ReadBlob(image,(size_t) length,(char *) data);
-      if (check != length)
+      if (check != (size_t) length)
         {
           char
             msg[MaxTextExtent];
@@ -803,8 +803,6 @@
                          " found %" MAGICK_SIZE_T_F "u bytes",
                          (MAGICK_SIZE_T) length,(MAGICK_SIZE_T) check);
           png_warning(png_ptr,msg);
-          if (check < length)
-            (void) memset(data+check,0,length-check);
           png_error(png_ptr,"Read Exception");
         }
     }
@@ -1311,9 +1309,13 @@
      Note that libpng has already taken care of the CRC handling.
 
      Returns one of the following:
-         return(-n);  chunk had an error
-         return(0);  did not recognize
-         return(n);  success
+         return(-n);  An error occurred; png_chunk_error will be called.
+         return(0);   The chunk was not handled, the chunk will be discarded
+                      unless png_set_keep_unknown_chunks has been used to set
+                      a 'keep' behavior for this particular chunk, in which
+                      case that will be used.  A critical chunk will cause an
+                      error at this point unless it is to be saved.
+         return(n);  The chunk was handled, libpng will ignore/discard it.
   */
 
   (void) LogMagickEvent(CoderEvent,GetMagickModule(),
@@ -1625,6 +1627,11 @@
             CopyException(exception,&image->exception);
           image->columns=0;
         }
+      if (image)
+        {
+          DestroyImage(image);
+          image=(Image *) NULL;
+        }
       return(image);
     }
 
@@ -3057,6 +3064,7 @@
   }
   if (*alpha_image)
   {
+    (void) LiberateUniqueFileResource((*alpha_image)->filename);
     DestroyImageList(*alpha_image);
     *alpha_image = (Image *)NULL;
   }
@@ -3443,7 +3451,8 @@
                 {
                   if (logging)
                     (void) LogMagickEvent(CoderEvent,GetMagickModule(),
-                                          "Unsupported Alpha_compression_method: %u",
+                                          "Unsupported Alpha_compression_method: %u"
+                                          " (returning NULL)",
                                           jng_alpha_compression_method);
                   DestroyJNG(chunk,&color_image,&color_image_info,
                              &alpha_image,&alpha_image_info);
@@ -3459,7 +3468,7 @@
                   DestroyJNG(chunk,&color_image,&color_image_info,
                     &alpha_image,&alpha_image_info);
                   (void) LogMagickEvent(CoderEvent,GetMagickModule(),
-                      "    could not allocate alpha_image_info");
+                      "    could not allocate alpha_image_info (returning NULL)");
                   ThrowException(exception,ResourceLimitError,
                                  MemoryAllocationFailed,image->filename);
                   return ((Image *)NULL);
@@ -3471,7 +3480,7 @@
                   DestroyJNG(chunk,&color_image,&color_image_info,
                     &alpha_image,&alpha_image_info);
                   (void) LogMagickEvent(CoderEvent,GetMagickModule(),
-                      "    could not allocate alpha_image");
+                      "    could not allocate alpha_image (returning NULL)");
                   ThrowException(exception,ResourceLimitError,
                                  MemoryAllocationFailed,image->filename);
                   return ((Image *)NULL);
@@ -3479,7 +3488,7 @@
               if (logging)
                 (void) LogMagickEvent(CoderEvent,GetMagickModule(),
                                       "    Creating alpha_blob.");
-              (void) AcquireUniqueFilename(alpha_image->filename);
+              (void) AcquireUniqueFilename(alpha_image->filename); /* Freed by DestroyJNG() */
               status=OpenBlob(alpha_image_info,alpha_image,WriteBinaryBlobMode,
                               exception);
               if (status == MagickFalse)
@@ -3487,7 +3496,7 @@
                   DestroyJNG(chunk,&color_image,&color_image_info,
                     &alpha_image,&alpha_image_info);
                   (void) LogMagickEvent(CoderEvent,GetMagickModule(),
-                      "    could not open alpha_image blob");
+                      "    could not open alpha_image blob (returning NULL)");
                   return ((Image *)NULL);
                 }
               if (jng_alpha_compression_method == 0)
@@ -3949,7 +3958,6 @@
                      if (!SyncImagePixels(image))
                        break;
                    }
-                 (void) LiberateUniqueFileResource(alpha_image->filename);
                  DestroyJNG(NULL,&color_image,&color_image_info,
                    &alpha_image,&alpha_image_info);
                  (void) LogMagickEvent(CoderEvent,GetMagickModule(),
diff -r faf48bce6b8c -r 232cce2f8964 magick/version.h
--- a/magick/version.h	Mon Dec 20 08:39:48 2021 -0600
+++ b/magick/version.h	Tue Dec 21 11:23:54 2021 -0600
@@ -38,8 +38,8 @@
 #define MagickLibVersion  0x262300
 #define MagickLibVersionText  "1.4"
 #define MagickLibVersionNumber 26,23,0
-#define MagickChangeDate   "20211218"
-#define MagickReleaseDate  "snapshot-20211218"
+#define MagickChangeDate   "20211221"
+#define MagickReleaseDate  "snapshot-20211221"
 
 /*
   The MagickLibInterfaceNewest and MagickLibInterfaceOldest defines
diff -r faf48bce6b8c -r 232cce2f8964 www/Changelog.html
--- a/www/Changelog.html	Mon Dec 20 08:39:48 2021 -0600
+++ b/www/Changelog.html	Tue Dec 21 11:23:54 2021 -0600
@@ -35,6 +35,11 @@
 <div class="document">
 
 
+<p>2021-12-21  Bob Friesenhahn  &lt;<a class="reference external" href="mailto:bfriesen&#37;&#52;&#48;simple&#46;dallas&#46;tx&#46;us">bfriesen<span>&#64;</span>simple<span>&#46;</span>dallas<span>&#46;</span>tx<span>&#46;</span>us</a>&gt;</p>
+<blockquote>
+* coders/png.c (DestroyJNG): Deallocate alpha_image temporary file in DestroyJNG().
+(ReadOnePNGImage): If setjmp fires, then don't return a broken
+image.</blockquote>
 <p>2021-12-18  Fojtik Jaroslav  &lt;<a class="reference external" href="mailto:JaFojtik&#37;&#52;&#48;yandex&#46;com">JaFojtik<span>&#64;</span>yandex<span>&#46;</span>com</a>&gt;</p>
 <blockquote>
 * magick/wpg.c: Fix incorrect TrX and TrY elements in CTM.