GraphicsMagick: ReadOnePNGImage(): Make sure that ping_num_trans...

changeset 8412d044e645 in /hg/GraphicsMagick
details: http://hg.GraphicsMagick.org/hg/GraphicsMagick?cmd=changeset;node=8412d044e645
summary: ReadOnePNGImage(): Make sure that ping_num_trans is initialized.

diffstat:

 ChangeLog                              |  6 ++++++
 Makefile.am                            |  2 ++
 Makefile.in                            |  3 +++
 VisualMagick/installer/inc/version.isx |  4 ++--
 coders/png.c                           |  8 ++++----
 magick/version.h                       |  4 ++--
 www/Changelog.html                     |  5 +++++
 7 files changed, 24 insertions(+), 8 deletions(-)

diffs (109 lines):

diff -r 8e2851bfe8c1 -r 8412d044e645 ChangeLog
--- a/ChangeLog	Tue Apr 12 15:12:48 2022 -0500
+++ b/ChangeLog	Sat Apr 16 12:11:13 2022 -0500
@@ -1,3 +1,9 @@
+2022-04-16  Bob Friesenhahn  <[email protected]>
+
+        * coders/png.c (ReadOnePNGImage): Make sure that ping_num_trans is
+        initialized.  Fixes oss-fuzz 46760 "Use-of-uninitialized-value -
+        ReadOnePNGImage".
+
 2022-04-12  Bob Friesenhahn  <[email protected]>
 
         * magick/blob.c (OpenBlob): Allocate setvbuf() buffer externally
diff -r 8e2851bfe8c1 -r 8412d044e645 Makefile.am
--- a/Makefile.am	Tue Apr 12 15:12:48 2022 -0500
+++ b/Makefile.am	Sat Apr 16 12:11:13 2022 -0500
@@ -421,6 +421,8 @@
 
 endif # HasGRAPHICSMAGICK_SNAPSHOT_COPY
 
+# FIXME: Could use info from /etc/os-release, or output from
+# lsb_release.
 [email protected]
 COVERITY_TARBALL=GraphicsMagick.xz
 COVERITY_VERSION=snapshot-@PACKAGE_CHANGE_DATE@
diff -r 8e2851bfe8c1 -r 8412d044e645 Makefile.in
--- a/Makefile.in	Tue Apr 12 15:12:48 2022 -0500
+++ b/Makefile.in	Sat Apr 16 12:11:13 2022 -0500
@@ -4923,6 +4923,9 @@
 
 # Use a hard-coded mechanism and destination path to copy snapshot files
 @HasGRAPHICSMAGICK_SNAPSHOT_COPY_FALSE@SNAPSHOT_DIRECTORY = /ftp/pub/GraphicsMagick/snapshots
+
+# FIXME: Could use info from /etc/os-release, or output from
+# lsb_release.
 COVERITY_EMAIL = [email protected]
 COVERITY_TARBALL = GraphicsMagick.xz
 COVERITY_VERSION = snapshot-@PACKAGE_CHANGE_DATE@
diff -r 8e2851bfe8c1 -r 8412d044e645 VisualMagick/installer/inc/version.isx
--- a/VisualMagick/installer/inc/version.isx	Tue Apr 12 15:12:48 2022 -0500
+++ b/VisualMagick/installer/inc/version.isx	Sat Apr 16 12:11:13 2022 -0500
@@ -10,5 +10,5 @@
 
 #define public MagickPackageName "GraphicsMagick"
 #define public MagickPackageVersion "1.4"
-#define public MagickPackageVersionAddendum ".020220412"
-#define public MagickPackageReleaseDate "snapshot-20220412"
+#define public MagickPackageVersionAddendum ".020220416"
+#define public MagickPackageReleaseDate "snapshot-20220416"
diff -r 8e2851bfe8c1 -r 8412d044e645 coders/png.c
--- a/coders/png.c	Tue Apr 12 15:12:48 2022 -0500
+++ b/coders/png.c	Sat Apr 16 12:11:13 2022 -0500
@@ -786,15 +786,15 @@
     *image;
 
   image=(Image *) png_get_io_ptr(png_ptr);
-  if (length)
+  if (length > 0)
     {
       size_t
         check;
 
       if (length > 0x7fffffff)
         png_warning(png_ptr, "chunk length > 2G");
-      check=ReadBlob(image,(size_t) length,(char *) data);
-      if (check != (size_t) length)
+      check=ReadBlob(image, length,(char *) data);
+      if (check != length)
         {
           char
             msg[MaxTextExtent];
@@ -1517,7 +1517,7 @@
     ping_interlace_method,
     ping_compression_method,
     ping_filter_method,
-    ping_num_trans;
+    ping_num_trans=0;
 
   LongPixelPacket
     transparent_color;
diff -r 8e2851bfe8c1 -r 8412d044e645 magick/version.h
--- a/magick/version.h	Tue Apr 12 15:12:48 2022 -0500
+++ b/magick/version.h	Sat Apr 16 12:11:13 2022 -0500
@@ -38,8 +38,8 @@
 #define MagickLibVersion  0x272400
 #define MagickLibVersionText  "1.4"
 #define MagickLibVersionNumber 27,24,0
-#define MagickChangeDate   "20220412"
-#define MagickReleaseDate  "snapshot-20220412"
+#define MagickChangeDate   "20220416"
+#define MagickReleaseDate  "snapshot-20220416"
 
 /*
   The MagickLibInterfaceNewest and MagickLibInterfaceOldest defines
diff -r 8e2851bfe8c1 -r 8412d044e645 www/Changelog.html
--- a/www/Changelog.html	Tue Apr 12 15:12:48 2022 -0500
+++ b/www/Changelog.html	Sat Apr 16 12:11:13 2022 -0500
@@ -35,6 +35,11 @@
 <div class="document">
 
 
+<p>2022-04-16  Bob Friesenhahn  &lt;<a class="reference external" href="mailto:bfriesen&#37;&#52;&#48;simple&#46;dallas&#46;tx&#46;us">bfriesen<span>&#64;</span>simple<span>&#46;</span>dallas<span>&#46;</span>tx<span>&#46;</span>us</a>&gt;</p>
+<blockquote>
+* coders/png.c (ReadOnePNGImage): Make sure that ping_num_trans is
+initialized.  Fixes oss-fuzz 46760 &quot;Use-of-uninitialized-value -
+ReadOnePNGImage&quot;.</blockquote>
 <p>2022-04-12  Bob Friesenhahn  &lt;<a class="reference external" href="mailto:bfriesen&#37;&#52;&#48;simple&#46;dallas&#46;tx&#46;us">bfriesen<span>&#64;</span>simple<span>&#46;</span>dallas<span>&#46;</span>tx<span>&#46;</span>us</a>&gt;</p>
 <blockquote>
 * magick/blob.c (OpenBlob): Allocate setvbuf() buffer externally