GraphicsMagick: ReadMATImage(): Change 'ldblk' to size_t and che...

changeset 7f4d2d192524 in /hg/GraphicsMagick
details: http://hg.GraphicsMagick.org/hg/GraphicsMagick?cmd=changeset;node=7f4d2d192524
summary: ReadMATImage(): Change 'ldblk' to size_t and check related calculations for overflow and to avoid possible negative seek offsets.

diffstat:

 ChangeLog                              |   6 ++++++
 VisualMagick/installer/inc/version.isx |   4 ++--
 coders/mat.c                           |  25 +++++++++++++------------
 magick/version.h                       |   4 ++--
 www/Changelog.html                     |   5 +++++
 5 files changed, 28 insertions(+), 16 deletions(-)

diffs (161 lines):

diff -r ba930c1fc380 -r 7f4d2d192524 ChangeLog
--- a/ChangeLog	Sat Dec 25 19:10:32 2021 -0600
+++ b/ChangeLog	Mon Dec 27 09:57:46 2021 -0600
@@ -1,3 +1,9 @@
+2021-12-27  Bob Friesenhahn  <[email protected]>
+
+        * coders/mat.c (ReadMATImage): Change 'ldblk' to size_t and
+        check related calculations for overflow and to avoid possible
+        negative seek offsets.
+
 2021-12-25  Bob Friesenhahn  <[email protected]>
 
         * magick/profile.c (AppendImageProfile): Deprecate this function
diff -r ba930c1fc380 -r 7f4d2d192524 VisualMagick/installer/inc/version.isx
--- a/VisualMagick/installer/inc/version.isx	Sat Dec 25 19:10:32 2021 -0600
+++ b/VisualMagick/installer/inc/version.isx	Mon Dec 27 09:57:46 2021 -0600
@@ -10,5 +10,5 @@
 
 #define public MagickPackageName "GraphicsMagick"
 #define public MagickPackageVersion "1.4"
-#define public MagickPackageVersionAddendum ".020211225"
-#define public MagickPackageReleaseDate "snapshot-20211225"
+#define public MagickPackageVersionAddendum ".020211227"
+#define public MagickPackageReleaseDate "snapshot-20211227"
diff -r ba930c1fc380 -r 7f4d2d192524 coders/mat.c
--- a/coders/mat.c	Sat Dec 25 19:10:32 2021 -0600
+++ b/coders/mat.c	Mon Dec 27 09:57:46 2021 -0600
@@ -791,7 +791,7 @@
   magick_uint32_t CellType;
   ImportPixelAreaOptions import_options;
   int i;
-  long ldblk;
+  size_t ldblk;
   unsigned char *BImgBuff = NULL;
   double MinVal_c, MaxVal_c;
   unsigned z, z2;
@@ -1036,27 +1036,27 @@
         else
           image->depth = Min(QuantumDepth,8);         /* Byte type cell */
         import_options.sample_type = UnsignedQuantumSampleType;
-        ldblk = (long) MATLAB_HDR.SizeX;
+        ldblk =  MATLAB_HDR.SizeX;
         break;
       case miINT16:
       case miUINT16:
         sample_size = 16;
         image->depth = Min(QuantumDepth,16);        /* Word type cell */
-        ldblk = (long) (2 * MATLAB_HDR.SizeX);
+        ldblk = MagickArraySize(2,MATLAB_HDR.SizeX);
         import_options.sample_type = UnsignedQuantumSampleType;
         break;
       case miINT32:
       case miUINT32:
         sample_size = 32;
         image->depth = Min(QuantumDepth,32);        /* Dword type cell */
-        ldblk = (long) (4 * MATLAB_HDR.SizeX);
+        ldblk = MagickArraySize(4,MATLAB_HDR.SizeX);
         import_options.sample_type = UnsignedQuantumSampleType;
         break;
       case miINT64:
       case miUINT64:
         sample_size = 64;
         image->depth = Min(QuantumDepth,32);        /* Qword type cell */
-        ldblk = (long) (8 * MATLAB_HDR.SizeX);
+        ldblk = MagickArraySize(8,MATLAB_HDR.SizeX);
         import_options.sample_type = UnsignedQuantumSampleType;
         break;
       case miSINGLE:
@@ -1070,7 +1070,7 @@
         if (MATLAB_HDR.StructureFlag & FLAG_COMPLEX)
         {                                           /* complex float type cell */
         }
-        ldblk = (long) (4 * MATLAB_HDR.SizeX);
+        ldblk = MagickArraySize(4,MATLAB_HDR.SizeX);
         break;
       case miDOUBLE:
         sample_size = 64;
@@ -1083,7 +1083,7 @@
         if (MATLAB_HDR.StructureFlag & FLAG_COMPLEX)
         {                         /* complex double type cell */
         }
-        ldblk = (long) (8 * MATLAB_HDR.SizeX);
+        ldblk = MagickArraySize(8,MATLAB_HDR.SizeX);
         break;
       default:
         ThrowImg2MATReaderException(CoderError, UnsupportedCellTypeInTheMatrix, image)
@@ -1098,7 +1098,8 @@
 
     if(image->columns == 0 || image->rows == 0)
       goto MATLAB_KO;
-    if((unsigned long)ldblk*MATLAB_HDR.SizeY > MATLAB_HDR.ObjectSize)  /* Safety check for forged and or corrupted data. */
+    if(MagickArraySize(ldblk,MATLAB_HDR.SizeY) == 0 ||
+       MagickArraySize(ldblk,MATLAB_HDR.SizeY) > MATLAB_HDR.ObjectSize)  /* Safety check for forged and or corrupted data. */
       goto MATLAB_KO;
 
     if(CheckImagePixelLimits(image, exception) != MagickPass)
@@ -1133,7 +1134,7 @@
     }
 
   /* ----- Load raster data ----- */
-    BImgBuff = MagickAllocateResourceLimitedArray(unsigned char *,(size_t) (ldblk),sizeof(double));    /* Ldblk was set in the check phase */
+    BImgBuff = MagickAllocateResourceLimitedArray(unsigned char *,ldblk,sizeof(double));    /* Ldblk was set in the check phase */
     if (BImgBuff == NULL)
       goto NoMemory;
     (void) memset(BImgBuff,0,ldblk*sizeof(double));
@@ -1175,7 +1176,7 @@
               "  MAT set image pixels returns unexpected NULL on a row %u.", (unsigned)(MATLAB_HDR.SizeY-i-1));
           goto skip_reading_current;            /* Skip image rotation, when cannot set image pixels */
         }
-        if(ReadBlob(image2,ldblk,(char *)BImgBuff) != (size_t) ldblk)
+        if(ReadBlob(image2,ldblk,(char *)BImgBuff) != ldblk)
         {
           if (logging) (void)LogMagickEvent(CoderEvent,GetMagickModule(),
              "  MAT cannot read scanrow %u from a file.", (unsigned)(MATLAB_HDR.SizeY-i-1));
@@ -1251,7 +1252,7 @@
       if (CellType==miDOUBLE)
         for (i = 0; i < (long) MATLAB_HDR.SizeY; i++)
         {
-          if ((long) ReadBlobXXXDoubles(image2, ldblk, (double *)BImgBuff) != ldblk)
+          if (ReadBlobXXXDoubles(image2, ldblk, (double *)BImgBuff) != ldblk)
             ThrowImg2MATReaderException(CorruptImageError,UnexpectedEndOfFile,image);
           InsertComplexDoubleRow((double *)BImgBuff, i, image, MinVal_c, MaxVal_c);
         }
@@ -1259,7 +1260,7 @@
       if (CellType==miSINGLE)
         for (i = 0; i < (long) MATLAB_HDR.SizeY; i++)
         {
-          if ((long) ReadBlobXXXFloats(image2, ldblk, (float *)BImgBuff) != ldblk)
+          if (ReadBlobXXXFloats(image2, ldblk, (float *)BImgBuff) != ldblk)
             ThrowImg2MATReaderException(CorruptImageError,UnexpectedEndOfFile,image);
           InsertComplexFloatRow((float *)BImgBuff, i, image, MinVal_c, MaxVal_c);
         }
diff -r ba930c1fc380 -r 7f4d2d192524 magick/version.h
--- a/magick/version.h	Sat Dec 25 19:10:32 2021 -0600
+++ b/magick/version.h	Mon Dec 27 09:57:46 2021 -0600
@@ -38,8 +38,8 @@
 #define MagickLibVersion  0x262300
 #define MagickLibVersionText  "1.4"
 #define MagickLibVersionNumber 26,23,0
-#define MagickChangeDate   "20211225"
-#define MagickReleaseDate  "snapshot-20211225"
+#define MagickChangeDate   "20211227"
+#define MagickReleaseDate  "snapshot-20211227"
 
 /*
   The MagickLibInterfaceNewest and MagickLibInterfaceOldest defines
diff -r ba930c1fc380 -r 7f4d2d192524 www/Changelog.html
--- a/www/Changelog.html	Sat Dec 25 19:10:32 2021 -0600
+++ b/www/Changelog.html	Mon Dec 27 09:57:46 2021 -0600
@@ -35,6 +35,11 @@
 <div class="document">
 
 
+<p>2021-12-27  Bob Friesenhahn  &lt;<a class="reference external" href="mailto:bfriesen&#37;&#52;&#48;simple&#46;dallas&#46;tx&#46;us">bfriesen<span>&#64;</span>simple<span>&#46;</span>dallas<span>&#46;</span>tx<span>&#46;</span>us</a>&gt;</p>
+<blockquote>
+* coders/mat.c (ReadMATImage): Change 'ldblk' to size_t and
+check related calculations for overflow and to avoid possible
+negative seek offsets.</blockquote>
 <p>2021-12-25  Bob Friesenhahn  &lt;<a class="reference external" href="mailto:bfriesen&#37;&#52;&#48;simple&#46;dallas&#46;tx&#46;us">bfriesen<span>&#64;</span>simple<span>&#46;</span>dallas<span>&#46;</span>tx<span>&#46;</span>us</a>&gt;</p>
 <blockquote>
 <p>* magick/profile.c (AppendImageProfile): Deprecate this function