GraphicsMagick: WritePCXImage(): Fix heap overflow when writing ...

changeset aed8f9cb12c1 in /hg/GraphicsMagick
details: http://hg.GraphicsMagick.org/hg/GraphicsMagick?cmd=changeset;node=aed8f9cb12c1
summary: WritePCXImage(): Fix heap overflow when writing more than 1023 scenes, and also eliminate use of uninitialized memory.

diffstat:

 ChangeLog          |   4 ++++
 coders/pcx.c       |  26 +++++++++++++++++---------
 www/Changelog.html |   3 +++
 3 files changed, 24 insertions(+), 9 deletions(-)

diffs (105 lines):

diff -r c2f340f17279 -r aed8f9cb12c1 ChangeLog
--- a/ChangeLog	Thu Dec 29 14:17:51 2022 -0600
+++ b/ChangeLog	Thu Dec 29 15:02:42 2022 -0600
@@ -1,5 +1,9 @@
 2022-12-29  Bob Friesenhahn  <[email protected]>
 
+	* coders/pcx.c (WritePCXImage): Fix heap overflow when writing
+	more than 1023 scenes, and also eliminate use of uninitialized
+	memory.
+
 	* coders/pnm.c (ReadPNMImage): Compute the number of threads to
 	use.
 
diff -r c2f340f17279 -r aed8f9cb12c1 coders/pcx.c
--- a/coders/pcx.c	Thu Dec 29 14:17:51 2022 -0600
+++ b/coders/pcx.c	Thu Dec 29 15:02:42 2022 -0600
@@ -1029,6 +1029,9 @@
   unsigned long
     scene;
 
+  const unsigned long
+    max_scenes = 1024UL;
+
   ImageCharacteristics
     characteristics;
 
@@ -1057,11 +1060,12 @@
       */
       write_dcx=MagickTrue;
       (void) WriteBlobLSBLong(image,0x3ADE68B1L);
-      page_table=MagickAllocateResourceLimitedMemory(ExtendedSignedIntegralType *,
-        1024*sizeof(ExtendedSignedIntegralType));
+      page_table=MagickAllocateResourceLimitedClearedArray(ExtendedSignedIntegralType *,
+                                                           max_scenes+1,
+                                                           sizeof(ExtendedSignedIntegralType));
       if (page_table == (ExtendedSignedIntegralType *) NULL)
         ThrowPCXWriterException(ResourceLimitError,MemoryAllocationFailed,image);
-      for (scene=0; scene < 1024; scene++)
+      for (scene=0; scene < max_scenes; scene++)
         (void) WriteBlobLSBLong(image,0x00000000L);
     }
   adjoin=(image_info->adjoin) && (image->next != (const Image *) NULL) && (write_dcx);
@@ -1156,11 +1160,9 @@
     /*
       Dump colormap to file.
     */
-    pcx_colormap=MagickAllocateResourceLimitedMemory(unsigned char *,3*256);
+    pcx_colormap=MagickAllocateResourceLimitedClearedArray(unsigned char *,3,256);
     if (pcx_colormap == (unsigned char *) NULL)
       ThrowPCXWriterException(ResourceLimitError,MemoryAllocationFailed,image);
-    for (i=0; i < (3*256); i++)
-      pcx_colormap[i]=0;
     q=pcx_colormap;
     if (image->storage_class == PseudoClass)
       for (i=0; i < (long) image->colors; i++)
@@ -1177,7 +1179,9 @@
     for (i=0; i < 58; i++)
       (void) WriteBlobByte(image,'\0');
     /* Allocate memory for one pixel row. */
-    pcx_pixels=MagickAllocateResourceLimitedArray(unsigned char *,bytes_per_line,pcx_info.planes);
+    pcx_pixels=MagickAllocateResourceLimitedClearedArray(unsigned char *,
+                                                         bytes_per_line,
+                                                         pcx_info.planes);
     if (pcx_pixels == (unsigned char *) NULL)
       ThrowPCXWriterException(ResourceLimitError,MemoryAllocationFailed,image);
     q=pcx_pixels;
@@ -1329,12 +1333,12 @@
     if (image->next == (Image *) NULL)
       break;
     image=SyncNextImageInList(image);
-    status=MagickMonitorFormatted(scene++,image_list_length,
+    status=MagickMonitorFormatted(scene++,Min(max_scenes,image_list_length),
                                   &image->exception,SaveImagesText,
                                   image->filename);
     if (status == False)
       break;
-    if (scene >= 1023)
+    if (scene >= max_scenes-1)
       break;
   } while (adjoin);
   if (adjoin)
@@ -1345,6 +1349,10 @@
       /*
         Write the DCX page table.
       */
+      if (logging && write_dcx && image_list_length > max_scenes)
+        (void) LogMagickEvent(CoderEvent,GetMagickModule(),
+                              "WARNING: DCX truncated to %lu scenes!",
+                              max_scenes-1);
       page_table[scene+1]=0;
       (void) SeekBlob(image,0L,SEEK_SET);
       (void) WriteBlobLSBLong(image,0x3ADE68B1L);
diff -r c2f340f17279 -r aed8f9cb12c1 www/Changelog.html
--- a/www/Changelog.html	Thu Dec 29 14:17:51 2022 -0600
+++ b/www/Changelog.html	Thu Dec 29 15:02:42 2022 -0600
@@ -40,6 +40,9 @@
 <p>2022-12-29  Bob Friesenhahn  &lt;<a class="reference external" href="mailto:bfriesen&#37;&#52;&#48;simple&#46;dallas&#46;tx&#46;us">bfriesen<span>&#64;</span>simple<span>&#46;</span>dallas<span>&#46;</span>tx<span>&#46;</span>us</a>&gt;</p>
 <blockquote>
 <ul class="simple">
+<li><p>coders/pcx.c (WritePCXImage): Fix heap overflow when writing
+more than 1023 scenes, and also eliminate use of uninitialized
+memory.</p></li>
 <li><p>coders/pnm.c (ReadPNMImage): Compute the number of threads to
 use.</p></li>
 <li><p>NEWS.txt: Update the news.</p></li>