GraphicsMagick: SeekBlob(): Fix SEEK_END validation.

changeset c53c2d494504 in /hg/GraphicsMagick
details: http://hg.GraphicsMagick.org/hg/GraphicsMagick?cmd=changeset;node=c53c2d494504
summary: SeekBlob(): Fix SEEK_END validation.

diffstat:

 ChangeLog                              |   6 ++++++
 VisualMagick/installer/inc/version.isx |   4 ++--
 magick/blob.c                          |  19 ++++++++++++-------
 magick/version.h                       |   4 ++--
 www/Changelog.html                     |   8 ++++++++
 5 files changed, 30 insertions(+), 11 deletions(-)

diffs (101 lines):

diff -r e6c513ee757f -r c53c2d494504 ChangeLog
--- a/ChangeLog	Wed Oct 05 19:34:43 2022 -0500
+++ b/ChangeLog	Sun Oct 09 10:34:38 2022 -0500
@@ -1,3 +1,9 @@
+2022-10-09  Bob Friesenhahn  <[email protected]>
+
+	* magick/blob.c (SeekBlob): Fix SEEK_END validation.  Addresses
+	oss-fuzz 52133 "graphicsmagick:coder_ICB_fuzzer:
+	Heap-buffer-overflow in ReadBlob".
+
 2022-10-05  Bob Friesenhahn  <[email protected]>
 
 	* scripts/changelog2rst.sh: Try to deal with the crazy mix of
diff -r e6c513ee757f -r c53c2d494504 VisualMagick/installer/inc/version.isx
--- a/VisualMagick/installer/inc/version.isx	Wed Oct 05 19:34:43 2022 -0500
+++ b/VisualMagick/installer/inc/version.isx	Sun Oct 09 10:34:38 2022 -0500
@@ -10,5 +10,5 @@
 
 #define public MagickPackageName "GraphicsMagick"
 #define public MagickPackageVersion "1.4"
-#define public MagickPackageVersionAddendum ".020221005"
-#define public MagickPackageReleaseDate "snapshot-20221005"
+#define public MagickPackageVersionAddendum ".020221009"
+#define public MagickPackageReleaseDate "snapshot-20221009"
diff -r e6c513ee757f -r c53c2d494504 magick/blob.c
--- a/magick/blob.c	Wed Oct 05 19:34:43 2022 -0500
+++ b/magick/blob.c	Sun Oct 09 10:34:38 2022 -0500
@@ -4660,29 +4660,34 @@
       return(-1);
     case BlobStream:
       {
+        magick_off_t
+          new_offset;
+
         switch (whence)
           {
           case SEEK_SET:
           default:
             {
-              if (offset < 0)
+              new_offset=offset;
+              if (new_offset < 0)
                 return(-1);
-              image->blob->offset=offset;
+              image->blob->offset=new_offset;
               break;
             }
           case SEEK_CUR:
             {
-              if ((image->blob->offset+offset) < 0)
+              new_offset=image->blob->offset+offset;
+              if (new_offset < 0)
                 return(-1);
-              image->blob->offset+=offset;
+              image->blob->offset=new_offset;
               break;
             }
           case SEEK_END:
             {
-              if ((magick_off_t)
-                  (image->blob->offset+image->blob->length+offset) < 0)
+              new_offset = ((magick_off_t) image->blob->length+offset);
+              if (new_offset < 0)
                 return(-1);
-              image->blob->offset=image->blob->length+offset;
+              image->blob->offset=new_offset;
               break;
             }
           }
diff -r e6c513ee757f -r c53c2d494504 magick/version.h
--- a/magick/version.h	Wed Oct 05 19:34:43 2022 -0500
+++ b/magick/version.h	Sun Oct 09 10:34:38 2022 -0500
@@ -38,8 +38,8 @@
 #define MagickLibVersion  0x272400
 #define MagickLibVersionText  "1.4"
 #define MagickLibVersionNumber 27,24,0
-#define MagickChangeDate   "20221005"
-#define MagickReleaseDate  "snapshot-20221005"
+#define MagickChangeDate   "20221009"
+#define MagickReleaseDate  "snapshot-20221009"
 
 /*
   The MagickLibInterfaceNewest and MagickLibInterfaceOldest defines
diff -r e6c513ee757f -r c53c2d494504 www/Changelog.html
--- a/www/Changelog.html	Wed Oct 05 19:34:43 2022 -0500
+++ b/www/Changelog.html	Sun Oct 09 10:34:38 2022 -0500
@@ -37,6 +37,14 @@
 </div>
 
 <div class="document">
+<p>2022-10-09  Bob Friesenhahn  &lt;<a class="reference external" href="mailto:bfriesen&#37;&#52;&#48;simple&#46;dallas&#46;tx&#46;us">bfriesen<span>&#64;</span>simple<span>&#46;</span>dallas<span>&#46;</span>tx<span>&#46;</span>us</a>&gt;</p>
+<blockquote>
+<ul class="simple">
+<li><p>magick/blob.c (SeekBlob): Fix SEEK_END validation.  Addresses
+oss-fuzz 52133 &quot;graphicsmagick:coder_ICB_fuzzer:
+Heap-buffer-overflow in ReadBlob&quot;.</p></li>
+</ul>
+</blockquote>
 <p>2022-10-05  Bob Friesenhahn  &lt;<a class="reference external" href="mailto:bfriesen&#37;&#52;&#48;simple&#46;dallas&#46;tx&#46;us">bfriesen<span>&#64;</span>simple<span>&#46;</span>dallas<span>&#46;</span>tx<span>&#46;</span>us</a>&gt;</p>
 <blockquote>
 <ul class="simple">