GraphicsMagick: ReadMATImageV4(): Change 'ldblk' to size_t and c...

changeset ee10270827f0 in /hg/GraphicsMagick
details: http://hg.GraphicsMagick.org/hg/GraphicsMagick?cmd=changeset;node=ee10270827f0
summary: ReadMATImageV4(): Change 'ldblk' to size_t and check related calculations for overflow and to avoid possible negative seek offsets.

diffstat:

 ChangeLog                              |   6 ++++++
 VisualMagick/installer/inc/version.isx |   4 ++--
 coders/mat.c                           |  29 ++++++++++++++++++-----------
 magick/version.h                       |   4 ++--
 www/Changelog.html                     |   5 +++++
 5 files changed, 33 insertions(+), 15 deletions(-)

diffs (154 lines):

diff -r 709540d3e246 -r ee10270827f0 ChangeLog
--- a/ChangeLog	Tue Dec 21 17:08:37 2021 -0600
+++ b/ChangeLog	Wed Dec 22 08:35:05 2021 -0600
@@ -1,3 +1,9 @@
+2021-12-22  Bob Friesenhahn  <[email protected]>
+
+        * coders/mat.c (ReadMATImageV4): Change 'ldblk' to size_t and
+        check related calculations for overflow and to avoid possible
+        negative seek offsets.
+
 2021-12-21  Bob Friesenhahn  <[email protected]>
 
         * magick/signature.c: Remove functions FinalizeSignature,
diff -r 709540d3e246 -r ee10270827f0 VisualMagick/installer/inc/version.isx
--- a/VisualMagick/installer/inc/version.isx	Tue Dec 21 17:08:37 2021 -0600
+++ b/VisualMagick/installer/inc/version.isx	Wed Dec 22 08:35:05 2021 -0600
@@ -10,5 +10,5 @@
 
 #define public MagickPackageName "GraphicsMagick"
 #define public MagickPackageVersion "1.4"
-#define public MagickPackageVersionAddendum ".020211221"
-#define public MagickPackageReleaseDate "snapshot-20211221"
+#define public MagickPackageVersionAddendum ".020211222"
+#define public MagickPackageReleaseDate "snapshot-20211222"
diff -r 709540d3e246 -r ee10270827f0 coders/mat.c
--- a/coders/mat.c	Tue Dec 21 17:08:37 2021 -0600
+++ b/coders/mat.c	Wed Dec 22 08:35:05 2021 -0600
@@ -480,7 +480,7 @@
 {
 MAT4_HDR HDR;
 Image *rotated_image;
-long ldblk;
+size_t ldblk;
 int sample_size;
 void *BImgBuff = NULL;
 double MinVal_c, MaxVal_c;
@@ -496,7 +496,7 @@
   {
     ldblk = ReadBlobLSBLong(image);
     if(EOFBlob(image)) break;
-    if(ldblk>9999 || ldblk<0) RET_CHECK(image);
+    if(ldblk>9999 /*|| ldblk<0*/) RET_CHECK(image); /* Zero is allowed! */
     HDR.Type[3] = ldblk % 10;   ldblk /= 10;    /* T digit */
     HDR.Type[2] = ldblk % 10;   ldblk /= 10;    /* P digit */
     HDR.Type[1] = ldblk % 10;   ldblk /= 10;    /* O digit */
@@ -525,6 +525,8 @@
     HDR.nRows = ReadBlobXXXLong(image);
     HDR.nCols = ReadBlobXXXLong(image);
 
+    if (HDR.nRows == 0 || HDR.nCols == 0) RET_CHECK(image);
+
     HDR.imagf = ReadBlobXXXLong(image);
     if(HDR.imagf!=0 && HDR.imagf!=1) RET_CHECK(image);
 
@@ -538,7 +540,7 @@
               image->depth = Min(QuantumDepth,32);        /* double type cell */
               import_options->sample_type = FloatQuantumSampleType;
               if(sizeof(double) != 8) RET_CHECK(image);      /* incompatible double size */
-              ldblk = (long) (8 * HDR.nRows);
+              ldblk = MagickArraySize(8,HDR.nRows);
               break;
 
       case 1: sample_size = 32;                         /* single-precision (32-bit) floating point numbers */
@@ -548,12 +550,12 @@
               if(sizeof(float) != 4)
                 ThrowMATReaderException(CoderError, IncompatibleSizeOfFloat, image);
 #endif
-              ldblk = (long) (4 * HDR.nRows);
+              ldblk = MagickArraySize(4,HDR.nRows);
               break;
 
       case 2: sample_size = 32;                         /* 32-bit signed integers */
               image->depth = Min(QuantumDepth,32);        /* Dword type cell */
-              ldblk = (long) (4 * HDR.nRows);
+              ldblk = MagickArraySize(4,HDR.nRows);
               import_options->sample_type = UnsignedQuantumSampleType;
               break;
 
@@ -561,19 +563,21 @@
       case 4:                           /* 16-bit unsigned integers */
               sample_size = 16;
               image->depth = Min(QuantumDepth,16);        /* Word type cell */
-              ldblk = (long) (2 * HDR.nRows);
-             import_options->sample_type = UnsignedQuantumSampleType;
+              ldblk = MagickArraySize(2,HDR.nRows);
+              import_options->sample_type = UnsignedQuantumSampleType;
               break;
 
       case 5: sample_size = 8;          /* 8-bit unsigned integers */
               image->depth = Min(QuantumDepth,8);         /* Byte type cell */
               import_options->sample_type = UnsignedQuantumSampleType;
-              ldblk = (long) HDR.nRows;
+              ldblk = HDR.nRows;
               break;
 
       default: RET_CHECK(image);
     }
 
+    if(ldblk==0) RET_CHECK(image);
+
     image->columns = HDR.nRows;
     image->rows = HDR.nCols;
     image->colors = 1l << image->depth;
@@ -588,15 +592,18 @@
     if(image_info->ping)
     {
       unsigned long temp = image->columns;  /* The true image is rotater 90 degs. Do rotation without data. */
+      size_t offset;
       image->columns = image->rows;
       image->rows = temp;
-      if(HDR.imagf==1) ldblk *= 2;
-      SeekBlob(image, (size_t) HDR.nCols*ldblk, SEEK_CUR);
+      if(HDR.imagf==1) ldblk=MagickArraySize(2,ldblk); /*ldblk *= 2;*/
+      offset=MagickArraySize(HDR.nCols,ldblk);
+      if(offset==0) RET_CHECK(image);
+      SeekBlob(image, offset, SEEK_CUR);;
       goto skip_reading_current;
     }
 
         /* ----- Load raster data ----- */
-    BImgBuff = MagickAllocateResourceLimitedMemory(unsigned char *,(size_t) (ldblk));    /* Ldblk was set in the check phase */
+    BImgBuff = MagickAllocateResourceLimitedMemory(unsigned char *,ldblk);    /* Ldblk was set in the check phase */
     if(BImgBuff == NULL) RET_CHECK(image);
 
     if(HDR.Type[1]==0)          /* Find Min and Max Values for doubles */
diff -r 709540d3e246 -r ee10270827f0 magick/version.h
--- a/magick/version.h	Tue Dec 21 17:08:37 2021 -0600
+++ b/magick/version.h	Wed Dec 22 08:35:05 2021 -0600
@@ -38,8 +38,8 @@
 #define MagickLibVersion  0x262300
 #define MagickLibVersionText  "1.4"
 #define MagickLibVersionNumber 26,23,0
-#define MagickChangeDate   "20211221"
-#define MagickReleaseDate  "snapshot-20211221"
+#define MagickChangeDate   "20211222"
+#define MagickReleaseDate  "snapshot-20211222"
 
 /*
   The MagickLibInterfaceNewest and MagickLibInterfaceOldest defines
diff -r 709540d3e246 -r ee10270827f0 www/Changelog.html
--- a/www/Changelog.html	Tue Dec 21 17:08:37 2021 -0600
+++ b/www/Changelog.html	Wed Dec 22 08:35:05 2021 -0600
@@ -35,6 +35,11 @@
 <div class="document">
 
 
+<p>2021-12-22  Bob Friesenhahn  &lt;<a class="reference external" href="mailto:bfriesen&#37;&#52;&#48;simple&#46;dallas&#46;tx&#46;us">bfriesen<span>&#64;</span>simple<span>&#46;</span>dallas<span>&#46;</span>tx<span>&#46;</span>us</a>&gt;</p>
+<blockquote>
+* coders/mat.c (ReadMATImageV4): Change 'ldblk' to size_t and
+check related calculations for overflow and to avoid possible
+negative seek offsets.</blockquote>
 <p>2021-12-21  Bob Friesenhahn  &lt;<a class="reference external" href="mailto:bfriesen&#37;&#52;&#48;simple&#46;dallas&#46;tx&#46;us">bfriesen<span>&#64;</span>simple<span>&#46;</span>dallas<span>&#46;</span>tx<span>&#46;</span>us</a>&gt;</p>
 <blockquote>
 <p>* magick/signature.c: Remove functions FinalizeSignature,