GraphicsMagick: ReadBlobString(): Fix use of uninitialized value...

changeset bb6ff9f56aaf in /hg/GraphicsMagick
details: http://hg.GraphicsMagick.org/hg/GraphicsMagick?cmd=changeset;node=bb6ff9f56aaf
summary: ReadBlobString(): Fix use of uninitialized value if only one character available.

diffstat:

 ChangeLog          |   7 +++++++
 magick/blob.c      |  21 ++++++++++++---------
 www/Changelog.html |  15 +++++++++++++++
 3 files changed, 34 insertions(+), 9 deletions(-)

diffs (85 lines):

diff -r a711b71164ce -r bb6ff9f56aaf ChangeLog
--- a/ChangeLog	Fri Nov 04 00:08:01 2022 +0100
+++ b/ChangeLog	Thu Nov 03 19:22:02 2022 -0500
@@ -1,3 +1,10 @@
+2022-11-03  Bob Friesenhahn  <[email protected]>
+
+	* magick/blob.c (ReadBlobString): Fix oss-fuzz issue 53001
+	"graphicsmagick:coder_TXT_fuzzer: Use-of-uninitialized-value in
+	ReadBlobString", which occurs due a bug remaining in recent
+	changes.
+
 2022-11-04 Fojtik Jaroslav  <[email protected]>
 
         * coders/tga.c Remove junk \n from log after printing footer contents.
diff -r a711b71164ce -r bb6ff9f56aaf magick/blob.c
--- a/magick/blob.c	Fri Nov 04 00:08:01 2022 +0100
+++ b/magick/blob.c	Thu Nov 03 19:22:02 2022 -0500
@@ -4606,30 +4606,33 @@
       }
     default :
       {
-        for (i=0; i < (MaxTextExtent-2); i++)
+        i=0;
+        do
           {
             c=ReadBlobByte(image);
             if (c == EOF)
               {
-                if (i == 0)
-                  return((char *) NULL);
+                if (!blob->eof)
+                  blob->eof = MagickTrue;
                 break;
               }
-            string[i]=c;
-            if (string[i] == '\n')
+            string[i] = c;
+            i++;
+            if (c == '\n')
               break;
-          }
-        i++;
-        string[i]='\0';
+          } while (i < MaxTextExtent-2);
+        string[i] = '\0';
       }
     }
 
   /* Strip trailing NL and CR */
-  while ((i > 0) && ((string[i-1] == '\r') || (string[i-1] == '\n')))
+  while ((i > 0) && ((string[i-1] == '\r') || (string[i-1] == '\n'))) /* oss-fuzz 53001 */
     {
       --i;
       string[i] = 0;
     }
+  if ((i == 0) && (blob->eof))
+    return((char *) NULL);
 
   return(string);
 }
diff -r a711b71164ce -r bb6ff9f56aaf www/Changelog.html
--- a/www/Changelog.html	Fri Nov 04 00:08:01 2022 +0100
+++ b/www/Changelog.html	Thu Nov 03 19:22:02 2022 -0500
@@ -37,6 +37,21 @@
 </div>
 
 <div class="document">
+<p>2022-11-03  Bob Friesenhahn  &lt;<a class="reference external" href="mailto:bfriesen&#37;&#52;&#48;simple&#46;dallas&#46;tx&#46;us">bfriesen<span>&#64;</span>simple<span>&#46;</span>dallas<span>&#46;</span>tx<span>&#46;</span>us</a>&gt;</p>
+<blockquote>
+<ul class="simple">
+<li><p>magick/blob.c (ReadBlobString): Fix oss-fuzz issue 53001
+&quot;graphicsmagick:coder_TXT_fuzzer: Use-of-uninitialized-value in
+ReadBlobString&quot;, which occurs due a bug remaining in recent
+changes.</p></li>
+</ul>
+</blockquote>
+<p>2022-11-04 Fojtik Jaroslav  &lt;<a class="reference external" href="mailto:JaFojtik&#37;&#52;&#48;yandex&#46;com">JaFojtik<span>&#64;</span>yandex<span>&#46;</span>com</a>&gt;</p>
+<blockquote>
+<ul class="simple">
+<li><p>coders/tga.c Remove junk n from log after printing footer contents.</p></li>
+</ul>
+</blockquote>
 <p>2022-11-03  Fojtik Jaroslav  &lt;<a class="reference external" href="mailto:JaFojtik&#37;&#52;&#48;yandex&#46;com">JaFojtik<span>&#64;</span>yandex<span>&#46;</span>com</a>&gt;</p>
 <blockquote>
 <ul class="simple">