GraphicsMagick: ReadMIFFImage(): Validate claimed bzip2-compress...

changeset 94f4bcf448ad in /hg/GraphicsMagick
details: http://hg.GraphicsMagick.org/hg/GraphicsMagick?cmd=changeset;node=94f4bcf448ad
summary: ReadMIFFImage(): Validate claimed bzip2-compressed row length prior to reading data into fixed size buffer.

diffstat:

 ChangeLog                              |   8 ++++++++
 VisualMagick/installer/inc/version.isx |   4 ++--
 coders/miff.c                          |  11 +++++++++++
 magick/version.h                       |   4 ++--
 www/Changelog.html                     |   7 +++++++
 5 files changed, 30 insertions(+), 4 deletions(-)

diffs (81 lines):

diff -r 07c1e6eeffb8 -r 94f4bcf448ad ChangeLog
--- a/ChangeLog	Tue Mar 22 18:00:04 2022 -0500
+++ b/ChangeLog	Sat Mar 26 08:32:13 2022 -0500
@@ -1,3 +1,11 @@
+2022-03-26  Bob Friesenhahn  <[email protected]>
+
+        * coders/miff.c (ReadMIFFImage): Validate claimed bzip2-compressed
+        row length prior to reading data into fixed size buffer.
+        Addresses SourceForge bug #664 "[bug]Heap buffer overflow when
+        parsing MIFF".  This severe bug only impacts builds with BZLIB
+        support.
+
 2022-03-22  Bob Friesenhahn  <[email protected]>
 
         * coders/jxl.c (ReadJXLImage): Added patch from Tobias Mark to
diff -r 07c1e6eeffb8 -r 94f4bcf448ad VisualMagick/installer/inc/version.isx
--- a/VisualMagick/installer/inc/version.isx	Tue Mar 22 18:00:04 2022 -0500
+++ b/VisualMagick/installer/inc/version.isx	Sat Mar 26 08:32:13 2022 -0500
@@ -10,5 +10,5 @@
 
 #define public MagickPackageName "GraphicsMagick"
 #define public MagickPackageVersion "1.4"
-#define public MagickPackageVersionAddendum ".020220322"
-#define public MagickPackageReleaseDate "snapshot-20220322"
+#define public MagickPackageVersionAddendum ".020220326"
+#define public MagickPackageReleaseDate "snapshot-20220326"
diff -r 07c1e6eeffb8 -r 94f4bcf448ad coders/miff.c
--- a/coders/miff.c	Tue Mar 22 18:00:04 2022 -0500
+++ b/coders/miff.c	Sat Mar 26 08:32:13 2022 -0500
@@ -1844,9 +1844,20 @@
                       else
                         {
                           length=ReadBlobMSBLong(image);
+                          if (image->logging)
+                            (void) LogMagickEvent(CoderEvent,GetMagickModule(),
+                                                  "length = %"MAGICK_SIZE_T_F"u",
+                                                  (MAGICK_SIZE_T) length);
+                          if ((length == 0) || (length > compressed_length))
+                            {
+                              (void) BZ2_bzDecompressEnd(&bzip_info);
+                              ThrowMIFFReaderException(CorruptImageError,UnableToUncompressImage,
+                                                       image);
+                            }
                           bzip_info.avail_in=(unsigned int) ReadBlob(image,length,bzip_info.next_in);
                           if ((size_t) bzip_info.avail_in != length)
                             {
+                              (void) BZ2_bzDecompressEnd(&bzip_info);
                               ThrowMIFFReaderException(CorruptImageError,UnexpectedEndOfFile,
                                                    image);
                             }
diff -r 07c1e6eeffb8 -r 94f4bcf448ad magick/version.h
--- a/magick/version.h	Tue Mar 22 18:00:04 2022 -0500
+++ b/magick/version.h	Sat Mar 26 08:32:13 2022 -0500
@@ -38,8 +38,8 @@
 #define MagickLibVersion  0x262300
 #define MagickLibVersionText  "1.4"
 #define MagickLibVersionNumber 26,23,0
-#define MagickChangeDate   "20220322"
-#define MagickReleaseDate  "snapshot-20220322"
+#define MagickChangeDate   "20220326"
+#define MagickReleaseDate  "snapshot-20220326"
 
 /*
   The MagickLibInterfaceNewest and MagickLibInterfaceOldest defines
diff -r 07c1e6eeffb8 -r 94f4bcf448ad www/Changelog.html
--- a/www/Changelog.html	Tue Mar 22 18:00:04 2022 -0500
+++ b/www/Changelog.html	Sat Mar 26 08:32:13 2022 -0500
@@ -35,6 +35,13 @@
 <div class="document">
 
 
+<p>2022-03-26  Bob Friesenhahn  &lt;<a class="reference external" href="mailto:bfriesen&#37;&#52;&#48;simple&#46;dallas&#46;tx&#46;us">bfriesen<span>&#64;</span>simple<span>&#46;</span>dallas<span>&#46;</span>tx<span>&#46;</span>us</a>&gt;</p>
+<blockquote>
+* coders/miff.c (ReadMIFFImage): Validate claimed bzip2-compressed
+row length prior to reading data into fixed size buffer.
+Addresses SourceForge bug #664 &quot;[bug]Heap buffer overflow when
+parsing MIFF&quot;.  This severe bug only impacts builds with BZLIB
+support.</blockquote>
 <p>2022-03-22  Bob Friesenhahn  &lt;<a class="reference external" href="mailto:bfriesen&#37;&#52;&#48;simple&#46;dallas&#46;tx&#46;us">bfriesen<span>&#64;</span>simple<span>&#46;</span>dallas<span>&#46;</span>tx<span>&#46;</span>us</a>&gt;</p>
 <blockquote>
 * coders/jxl.c (ReadJXLImage): Added patch from Tobias Mark to