GraphicsMagick: OpenBlob(): Allocate setvbuf() buffer externally...

GraphicsMagick Commits <[email protected]>
Newsgroups gmane.comp.video.graphicsmagick.cvs
Message-ID <mailman.3464.1649794387.2151.graphicsmagick-commit@lists.sourceforge.net>
changeset 8e2851bfe8c1 in /hg/GraphicsMagick
details: http://hg.GraphicsMagick.org/hg/GraphicsMagick?cmd=changeset;node=8e2851bfe8c1
summary: OpenBlob(): Allocate setvbuf() buffer externally ather than implicitly.

diffstat:

 ChangeLog                              |   7 +++++++
 VisualMagick/installer/inc/version.isx |   4 ++--
 magick/blob.c                          |   9 +++++++--
 magick/version.h                       |   4 ++--
 www/Changelog.html                     |   6 ++++++
 www/download.html                      |  26 ++++++++++++++++----------
 www/download.rst                       |  28 ++++++++++++++++++----------
 7 files changed, 58 insertions(+), 26 deletions(-)

diffs (181 lines):

diff -r 38a83b6b75a1 -r 8e2851bfe8c1 ChangeLog
--- a/ChangeLog	Fri Apr 08 19:50:42 2022 -0500
+++ b/ChangeLog	Tue Apr 12 15:12:48 2022 -0500
@@ -1,3 +1,10 @@
+2022-04-12  Bob Friesenhahn  <[email protected]>
+
+        * magick/blob.c (OpenBlob): Allocate setvbuf() buffer externally
+        rather than implicitly.  I am hoping that the several oss-fuzz
+        reports about using uninitalized memory from glibc's
+        _IO_file_doallocate() go away.
+
 2022-04-02  Bob Friesenhahn  <[email protected]>
 
         * coders/heif.c (RegisterHEIFImage): Support reading AVIF via
diff -r 38a83b6b75a1 -r 8e2851bfe8c1 VisualMagick/installer/inc/version.isx
--- a/VisualMagick/installer/inc/version.isx	Fri Apr 08 19:50:42 2022 -0500
+++ b/VisualMagick/installer/inc/version.isx	Tue Apr 12 15:12:48 2022 -0500
@@ -10,5 +10,5 @@
 
 #define public MagickPackageName "GraphicsMagick"
 #define public MagickPackageVersion "1.4"
-#define public MagickPackageVersionAddendum ".020220402"
-#define public MagickPackageReleaseDate "snapshot-20220402"
+#define public MagickPackageVersionAddendum ".020220412"
+#define public MagickPackageReleaseDate "snapshot-20220412"
diff -r 38a83b6b75a1 -r 8e2851bfe8c1 magick/blob.c
--- a/magick/blob.c	Fri Apr 08 19:50:42 2022 -0500
+++ b/magick/blob.c	Tue Apr 12 15:12:48 2022 -0500
@@ -147,6 +147,9 @@
   long
     reference_count;    /* Number of times this blob is referenced. */
 
+  char
+    *vbuf;              /* Buffer for setvbuf() */
+
   unsigned long
     signature;          /* Numeric value used to evaluate structure integrity. */
 };
@@ -1059,6 +1062,7 @@
                       blob->first_errno=errno;
                   }
               }
+            MagickFreeMemory(image->blob->vbuf);
             break;
           }
         case PipeStream:
@@ -2903,9 +2907,10 @@
                     vbuf_size;
 
                   vbuf_size=image->blob->block_size;
-                  if (0 != vbuf_size)
+                  image->blob->vbuf=MagickAllocateClearedMemory(char *, vbuf_size);
+                  if ((0 != vbuf_size) && (image->blob->vbuf != (char *) NULL))
                     {
-                      if (setvbuf(image->blob->handle.std,NULL,_IOFBF,vbuf_size) != 0)
+                      if (setvbuf(image->blob->handle.std,image->blob->vbuf,_IOFBF,vbuf_size) != 0)
                         {
                           if (image->logging)
                             (void) LogMagickEvent(BlobEvent,GetMagickModule(),
diff -r 38a83b6b75a1 -r 8e2851bfe8c1 magick/version.h
--- a/magick/version.h	Fri Apr 08 19:50:42 2022 -0500
+++ b/magick/version.h	Tue Apr 12 15:12:48 2022 -0500
@@ -38,8 +38,8 @@
 #define MagickLibVersion  0x272400
 #define MagickLibVersionText  "1.4"
 #define MagickLibVersionNumber 27,24,0
-#define MagickChangeDate   "20220402"
-#define MagickReleaseDate  "snapshot-20220402"
+#define MagickChangeDate   "20220412"
+#define MagickReleaseDate  "snapshot-20220412"
 
 /*
   The MagickLibInterfaceNewest and MagickLibInterfaceOldest defines
diff -r 38a83b6b75a1 -r 8e2851bfe8c1 www/Changelog.html
--- a/www/Changelog.html	Fri Apr 08 19:50:42 2022 -0500
+++ b/www/Changelog.html	Tue Apr 12 15:12:48 2022 -0500
@@ -35,6 +35,12 @@
 <div class="document">
 
 
+<p>2022-04-12  Bob Friesenhahn  &lt;<a class="reference external" href="mailto:bfriesen&#37;&#52;&#48;simple&#46;dallas&#46;tx&#46;us">bfriesen<span>&#64;</span>simple<span>&#46;</span>dallas<span>&#46;</span>tx<span>&#46;</span>us</a>&gt;</p>
+<blockquote>
+* magick/blob.c (OpenBlob): Allocate setvbuf() buffer externally
+rather than implicitly.  I am hoping that the several oss-fuzz
+reports about using uninitalized memory from glibc's
+_IO_file_doallocate() go away.</blockquote>
 <p>2022-04-02  Bob Friesenhahn  &lt;<a class="reference external" href="mailto:bfriesen&#37;&#52;&#48;simple&#46;dallas&#46;tx&#46;us">bfriesen<span>&#64;</span>simple<span>&#46;</span>dallas<span>&#46;</span>tx<span>&#46;</span>us</a>&gt;</p>
 <blockquote>
 * coders/heif.c (RegisterHEIFImage): Support reading AVIF via
diff -r 38a83b6b75a1 -r 8e2851bfe8c1 www/download.html
--- a/www/download.html	Fri Apr 08 19:50:42 2022 -0500
+++ b/www/download.html	Tue Apr 12 15:12:48 2022 -0500
@@ -78,18 +78,24 @@
 <a class="reference external" href="https://gnupg.org/download/">https://gnupg.org/download/</a>.  The installed program on your system
 might be named 'gpg', 'gpg2', or 'gpg1'.</p>
 <p>The signing key used (currently DSA key id
-EBDFDB21B020EE8FD151A88DE301047DE1198975) may be downloaded from a
-public key server like:</p>
+EBDFDB21B020EE8FD151A88DE301047DE1198975) may be downloaded in several
+different ways.</p>
+<p>The key may be downloaded directly from
+<a class="reference external" href="http://www.simplesystems.org/users/bfriesen/public-key.txt">http://www.simplesystems.org/users/bfriesen/public-key.txt</a>, or it may
+be extracted from the text of
+<a class="reference external" href="http://www.graphicsmagick.org/security.html">http://www.graphicsmagick.org/security.html</a>.</p>
+<p>It may be also downloaded from a public key server (if you are lucky)
+like:</p>
 <pre class="literal-block">
 gpg --recv-keys EBDFDB21B020EE8FD151A88DE301047DE1198975
 </pre>
-<p>or it may be extracted from
-<a class="reference external" href="http://www.graphicsmagick.org/security.html">http://www.graphicsmagick.org/security.html</a>.</p>
-<p>If extracting the key from the web page, (rather than using a key
-server) to obtain the key, then copy the entire block of text
-including the all of the &quot;BEGIN&quot; and &quot;END&quot; lines to a file
-(e.g. <cite>gm-sigs.asc</cite>) and import it into your collection of keys.  For
-example:</p>
+<p>If extracting the key from the
+<a class="reference external" href="http://www.graphicsmagick.org/security.html">http://www.graphicsmagick.org/security.html</a> web page, then copy the
+entire block of text including the all of the &quot;BEGIN&quot; and &quot;END&quot; lines
+to a file (e.g. <cite>gm-sigs.asc</cite>).</p>
+<p>If you have chosen to download the public key to a file
+(e.g. <cite>gm-sigs.asc</cite>) you can import it into your collection of keys.
+For example:</p>
 <pre class="literal-block">
 gpg --import gm-sigs.asc
 </pre>
@@ -131,7 +137,7 @@
 provided in the release announcement.  While this is much more secure
 than doing nothing, it does not fully defend against forgery.  If
 someone is able to forge a modified release archive as well as a
-release announcment, then you could be duped!</p>
+release announcement, then you could be duped!</p>
 </div>
 </div>
 </div>
diff -r 38a83b6b75a1 -r 8e2851bfe8c1 www/download.rst
--- a/www/download.rst	Fri Apr 08 19:50:42 2022 -0500
+++ b/www/download.rst	Tue Apr 12 15:12:48 2022 -0500
@@ -48,19 +48,27 @@
 might be named 'gpg', 'gpg2', or 'gpg1'.
 
 The signing key used (currently DSA key id
-EBDFDB21B020EE8FD151A88DE301047DE1198975) may be downloaded from a
-public key server like::
+EBDFDB21B020EE8FD151A88DE301047DE1198975) may be downloaded in several
+different ways.
+
+The key may be downloaded directly from
+http://www.simplesystems.org/users/bfriesen/public-key.txt, or it may
+be extracted from the text of
+http://www.graphicsmagick.org/security.html.
+
+It may be also downloaded from a public key server (if you are lucky)
+like::
 
   gpg --recv-keys EBDFDB21B020EE8FD151A88DE301047DE1198975
 
-or it may be extracted from
-http://www.graphicsmagick.org/security.html.
+If extracting the key from the
+http://www.graphicsmagick.org/security.html web page, then copy the
+entire block of text including the all of the "BEGIN" and "END" lines
+to a file (e.g. `gm-sigs.asc`).
 
-If extracting the key from the web page, (rather than using a key
-server) to obtain the key, then copy the entire block of text
-including the all of the "BEGIN" and "END" lines to a file
-(e.g. `gm-sigs.asc`) and import it into your collection of keys.  For
-example::
+If you have chosen to download the public key to a file
+(e.g. `gm-sigs.asc`) you can import it into your collection of keys.
+For example::
 
   gpg --import gm-sigs.asc
 
@@ -102,4 +110,4 @@
 provided in the release announcement.  While this is much more secure
 than doing nothing, it does not fully defend against forgery.  If
 someone is able to forge a modified release archive as well as a
-release announcment, then you could be duped!
+release announcement, then you could be duped!
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.