GraphicsMagick: ReadMATImage(): Assure that corrupt/incomplete i...

changeset 10a89e6c34a6 in /hg/GraphicsMagick
details: http://hg.GraphicsMagick.org/hg/GraphicsMagick?cmd=changeset;node=10a89e6c34a6
summary: ReadMATImage(): Assure that corrupt/incomplete image is not returned.

diffstat:

 ChangeLog          |  2 ++
 coders/mat.c       |  7 +++++--
 www/Changelog.html |  4 +++-
 3 files changed, 10 insertions(+), 3 deletions(-)

diffs (63 lines):

diff -r 4e25d7adb1e3 -r 10a89e6c34a6 ChangeLog
--- a/ChangeLog	Mon Dec 27 11:49:43 2021 -0600
+++ b/ChangeLog	Mon Dec 27 13:24:15 2021 -0600
@@ -4,6 +4,8 @@
         check related calculations for overflow and to avoid possible
         negative seek offsets.
         (FixLogical): Pass 'ldblk' as size_t.
+        (ReadMATImage): Assure that corrupt/incomplete image is not
+        returned.
 
 2021-12-25  Bob Friesenhahn  <[email protected]>
 
diff -r 4e25d7adb1e3 -r 10a89e6c34a6 coders/mat.c
--- a/coders/mat.c	Mon Dec 27 11:49:43 2021 -0600
+++ b/coders/mat.c	Mon Dec 27 13:24:15 2021 -0600
@@ -650,6 +650,7 @@
       {
         if(logging) (void)LogMagickEvent(CoderEvent,GetMagickModule(),
                    "  MAT cannot read scanrow %u from a file.", (unsigned)(i));
+        ThrowException(exception,CorruptImageError,UnexpectedEndOfFile,image->filename);
         DestroyImagePixels(image);              /* The unread data contains crap in memory, erase current image data. */
         image->columns = image->rows = 0;
         goto ExitLoop;
@@ -795,7 +796,7 @@
   size_t size;
   magick_uint32_t CellType;
   ImportPixelAreaOptions import_options;
-  int i;
+  magick_uint32_t i;
   size_t ldblk;
   unsigned char *BImgBuff = NULL;
   double MinVal_c, MaxVal_c;
@@ -1178,13 +1179,15 @@
         {
           if (logging) (void)LogMagickEvent(CoderEvent,GetMagickModule(),
               "  MAT set image pixels returns unexpected NULL on a row %u.", (unsigned)(MATLAB_HDR.SizeY-i-1));
-          goto skip_reading_current;            /* Skip image rotation, when cannot set image pixels */
+          goto skip_reading_current;  /* Skip image rotation, when cannot set image pixels */
         }
         if(ReadBlob(image2,ldblk,(char *)BImgBuff) != ldblk)
         {
           if (logging) (void)LogMagickEvent(CoderEvent,GetMagickModule(),
              "  MAT cannot read scanrow %u from a file.", (unsigned)(MATLAB_HDR.SizeY-i-1));
           ThrowException(exception,CorruptImageError,UnexpectedEndOfFile,image->filename);
+          DestroyImagePixels(image);  /* The unread data contains crap in memory, erase current image data. */
+          image->columns = image->rows = 0;
           goto ExitLoop;        /* It would be great to be able to read corrupted images. */
                                 /* this goto will abort reading, but there remains not fully read image
                                    in the memory. */
diff -r 4e25d7adb1e3 -r 10a89e6c34a6 www/Changelog.html
--- a/www/Changelog.html	Mon Dec 27 11:49:43 2021 -0600
+++ b/www/Changelog.html	Mon Dec 27 13:24:15 2021 -0600
@@ -40,7 +40,9 @@
 * coders/mat.c (ReadMATImage): Change 'ldblk' to size_t and
 check related calculations for overflow and to avoid possible
 negative seek offsets.
-(FixLogical): Pass 'ldblk' as size_t.</blockquote>
+(FixLogical): Pass 'ldblk' as size_t.
+(ReadMATImage): Assure that corrupt/incomplete image is not
+returned.</blockquote>
 <p>2021-12-25  Bob Friesenhahn  &lt;<a class="reference external" href="mailto:bfriesen&#37;&#52;&#48;simple&#46;dallas&#46;tx&#46;us">bfriesen<span>&#64;</span>simple<span>&#46;</span>dallas<span>&#46;</span>tx<span>&#46;</span>us</a>&gt;</p>
 <blockquote>
 <p>* magick/profile.c (AppendImageProfile): Deprecate this function