GraphicsMagick: OpenBlob(): Allocate setvbuf() buffer externally...
GraphicsMagick Commits <[email protected]>
| Newsgroups | gmane.comp.video.graphicsmagick.cvs |
|---|---|
| Message-ID | <mailman.3464.1649794387.2151.graphicsmagick-commit@lists.sourceforge.net> |
changeset 8e2851bfe8c1 in /hg/GraphicsMagick details: http://hg.GraphicsMagick.org/hg/GraphicsMagick?cmd=changeset;node=8e2851bfe8c1 summary: OpenBlob(): Allocate setvbuf() buffer externally ather than implicitly. diffstat: ChangeLog | 7 +++++++ VisualMagick/installer/inc/version.isx | 4 ++-- magick/blob.c | 9 +++++++-- magick/version.h | 4 ++-- www/Changelog.html | 6 ++++++ www/download.html | 26 ++++++++++++++++---------- www/download.rst | 28 ++++++++++++++++++---------- 7 files changed, 58 insertions(+), 26 deletions(-) diffs (181 lines): diff -r 38a83b6b75a1 -r 8e2851bfe8c1 ChangeLog --- a/ChangeLog Fri Apr 08 19:50:42 2022 -0500 +++ b/ChangeLog Tue Apr 12 15:12:48 2022 -0500 @@ -1,3 +1,10 @@ +2022-04-12 Bob Friesenhahn <[email protected]> + + * magick/blob.c (OpenBlob): Allocate setvbuf() buffer externally + rather than implicitly. I am hoping that the several oss-fuzz + reports about using uninitalized memory from glibc's + _IO_file_doallocate() go away. + 2022-04-02 Bob Friesenhahn <[email protected]> * coders/heif.c (RegisterHEIFImage): Support reading AVIF via diff -r 38a83b6b75a1 -r 8e2851bfe8c1 VisualMagick/installer/inc/version.isx --- a/VisualMagick/installer/inc/version.isx Fri Apr 08 19:50:42 2022 -0500 +++ b/VisualMagick/installer/inc/version.isx Tue Apr 12 15:12:48 2022 -0500 @@ -10,5 +10,5 @@ #define public MagickPackageName "GraphicsMagick" #define public MagickPackageVersion "1.4" -#define public MagickPackageVersionAddendum ".020220402" -#define public MagickPackageReleaseDate "snapshot-20220402" +#define public MagickPackageVersionAddendum ".020220412" +#define public MagickPackageReleaseDate "snapshot-20220412" diff -r 38a83b6b75a1 -r 8e2851bfe8c1 magick/blob.c --- a/magick/blob.c Fri Apr 08 19:50:42 2022 -0500 +++ b/magick/blob.c Tue Apr 12 15:12:48 2022 -0500 @@ -147,6 +147,9 @@ long reference_count; /* Number of times this blob is referenced. */ + char + *vbuf; /* Buffer for setvbuf() */ + unsigned long signature; /* Numeric value used to evaluate structure integrity. */ }; @@ -1059,6 +1062,7 @@ blob->first_errno=errno; } } + MagickFreeMemory(image->blob->vbuf); break; } case PipeStream: @@ -2903,9 +2907,10 @@ vbuf_size; vbuf_size=image->blob->block_size; - if (0 != vbuf_size) + image->blob->vbuf=MagickAllocateClearedMemory(char *, vbuf_size); + if ((0 != vbuf_size) && (image->blob->vbuf != (char *) NULL)) { - if (setvbuf(image->blob->handle.std,NULL,_IOFBF,vbuf_size) != 0) + if (setvbuf(image->blob->handle.std,image->blob->vbuf,_IOFBF,vbuf_size) != 0) { if (image->logging) (void) LogMagickEvent(BlobEvent,GetMagickModule(), diff -r 38a83b6b75a1 -r 8e2851bfe8c1 magick/version.h --- a/magick/version.h Fri Apr 08 19:50:42 2022 -0500 +++ b/magick/version.h Tue Apr 12 15:12:48 2022 -0500 @@ -38,8 +38,8 @@ #define MagickLibVersion 0x272400 #define MagickLibVersionText "1.4" #define MagickLibVersionNumber 27,24,0 -#define MagickChangeDate "20220402" -#define MagickReleaseDate "snapshot-20220402" +#define MagickChangeDate "20220412" +#define MagickReleaseDate "snapshot-20220412" /* The MagickLibInterfaceNewest and MagickLibInterfaceOldest defines diff -r 38a83b6b75a1 -r 8e2851bfe8c1 www/Changelog.html --- a/www/Changelog.html Fri Apr 08 19:50:42 2022 -0500 +++ b/www/Changelog.html Tue Apr 12 15:12:48 2022 -0500 @@ -35,6 +35,12 @@ <div class="document"> +<p>2022-04-12 Bob Friesenhahn <<a class="reference external" href="mailto:bfriesen%40simple.dallas.tx.us">bfriesen<span>@</span>simple<span>.</span>dallas<span>.</span>tx<span>.</span>us</a>></p> +<blockquote> +* magick/blob.c (OpenBlob): Allocate setvbuf() buffer externally +rather than implicitly. I am hoping that the several oss-fuzz +reports about using uninitalized memory from glibc's +_IO_file_doallocate() go away.</blockquote> <p>2022-04-02 Bob Friesenhahn <<a class="reference external" href="mailto:bfriesen%40simple.dallas.tx.us">bfriesen<span>@</span>simple<span>.</span>dallas<span>.</span>tx<span>.</span>us</a>></p> <blockquote> * coders/heif.c (RegisterHEIFImage): Support reading AVIF via diff -r 38a83b6b75a1 -r 8e2851bfe8c1 www/download.html --- a/www/download.html Fri Apr 08 19:50:42 2022 -0500 +++ b/www/download.html Tue Apr 12 15:12:48 2022 -0500 @@ -78,18 +78,24 @@ <a class="reference external" href="https://gnupg.org/download/">https://gnupg.org/download/</a>. The installed program on your system might be named 'gpg', 'gpg2', or 'gpg1'.</p> <p>The signing key used (currently DSA key id -EBDFDB21B020EE8FD151A88DE301047DE1198975) may be downloaded from a -public key server like:</p> +EBDFDB21B020EE8FD151A88DE301047DE1198975) may be downloaded in several +different ways.</p> +<p>The key may be downloaded directly from +<a class="reference external" href="http://www.simplesystems.org/users/bfriesen/public-key.txt">http://www.simplesystems.org/users/bfriesen/public-key.txt</a>, or it may +be extracted from the text of +<a class="reference external" href="http://www.graphicsmagick.org/security.html">http://www.graphicsmagick.org/security.html</a>.</p> +<p>It may be also downloaded from a public key server (if you are lucky) +like:</p> <pre class="literal-block"> gpg --recv-keys EBDFDB21B020EE8FD151A88DE301047DE1198975 </pre> -<p>or it may be extracted from -<a class="reference external" href="http://www.graphicsmagick.org/security.html">http://www.graphicsmagick.org/security.html</a>.</p> -<p>If extracting the key from the web page, (rather than using a key -server) to obtain the key, then copy the entire block of text -including the all of the "BEGIN" and "END" lines to a file -(e.g. <cite>gm-sigs.asc</cite>) and import it into your collection of keys. For -example:</p> +<p>If extracting the key from the +<a class="reference external" href="http://www.graphicsmagick.org/security.html">http://www.graphicsmagick.org/security.html</a> web page, then copy the +entire block of text including the all of the "BEGIN" and "END" lines +to a file (e.g. <cite>gm-sigs.asc</cite>).</p> +<p>If you have chosen to download the public key to a file +(e.g. <cite>gm-sigs.asc</cite>) you can import it into your collection of keys. +For example:</p> <pre class="literal-block"> gpg --import gm-sigs.asc </pre> @@ -131,7 +137,7 @@ provided in the release announcement. While this is much more secure than doing nothing, it does not fully defend against forgery. If someone is able to forge a modified release archive as well as a -release announcment, then you could be duped!</p> +release announcement, then you could be duped!</p> </div> </div> </div> diff -r 38a83b6b75a1 -r 8e2851bfe8c1 www/download.rst --- a/www/download.rst Fri Apr 08 19:50:42 2022 -0500 +++ b/www/download.rst Tue Apr 12 15:12:48 2022 -0500 @@ -48,19 +48,27 @@ might be named 'gpg', 'gpg2', or 'gpg1'. The signing key used (currently DSA key id -EBDFDB21B020EE8FD151A88DE301047DE1198975) may be downloaded from a -public key server like:: +EBDFDB21B020EE8FD151A88DE301047DE1198975) may be downloaded in several +different ways. + +The key may be downloaded directly from +http://www.simplesystems.org/users/bfriesen/public-key.txt, or it may +be extracted from the text of +http://www.graphicsmagick.org/security.html. + +It may be also downloaded from a public key server (if you are lucky) +like:: gpg --recv-keys EBDFDB21B020EE8FD151A88DE301047DE1198975 -or it may be extracted from -http://www.graphicsmagick.org/security.html. +If extracting the key from the +http://www.graphicsmagick.org/security.html web page, then copy the +entire block of text including the all of the "BEGIN" and "END" lines +to a file (e.g. `gm-sigs.asc`). -If extracting the key from the web page, (rather than using a key -server) to obtain the key, then copy the entire block of text -including the all of the "BEGIN" and "END" lines to a file -(e.g. `gm-sigs.asc`) and import it into your collection of keys. For -example:: +If you have chosen to download the public key to a file +(e.g. `gm-sigs.asc`) you can import it into your collection of keys. +For example:: gpg --import gm-sigs.asc @@ -102,4 +110,4 @@ provided in the release announcement. While this is much more secure than doing nothing, it does not fully defend against forgery. If someone is able to forge a modified release archive as well as a -release announcment, then you could be duped! +release announcement, then you could be duped!