GraphicsMagick: 2 new changesets
GraphicsMagick Commits <[email protected]>
| Newsgroups | gmane.comp.video.graphicsmagick.cvs |
|---|---|
| Message-ID | <mailman.40653.1673055667.1350.graphicsmagick-commit@lists.sourceforge.net> |
changeset 96e301201ef4 in /hg/GraphicsMagick details: http://hg.GraphicsMagick.org/hg/GraphicsMagick?cmd=changeset;node=96e301201ef4 summary: WritePICTImage(): Fix use of logical operator where binary operator is needed. changeset 6276f58fac26 in /hg/GraphicsMagick details: http://hg.GraphicsMagick.org/hg/GraphicsMagick?cmd=changeset;node=6276f58fac26 summary: ReadSUNImage(): Address oss-fuzz 54810 "graphicsmagick:coder_SUN_fuzzer: Heap-buffer-overflow in ReadSUNImage" diffstat: ChangeLog | 9 + VisualMagick/installer/inc/version.isx | 4 +- coders/pict.c | 4 +- coders/sun.c | 160 +++++++++++++++++++------------- magick/version.h | 4 +- www/Changelog.html | 37 +++++++- 6 files changed, 147 insertions(+), 71 deletions(-) diffs (452 lines): diff -r 351c48be6ba2 -r 6276f58fac26 ChangeLog --- a/ChangeLog Thu Jan 05 07:48:58 2023 +0100 +++ b/ChangeLog Fri Jan 06 19:40:54 2023 -0600 @@ -1,3 +1,12 @@ +2023-01-06 Bob Friesenhahn <[email protected]> + + * coders/sun.c (ReadSUNImage): Address oss-fuzz 54810 + "graphicsmagick:coder_SUN_fuzzer: Heap-buffer-overflow in + ReadSUNImage". + + * coders/pict.c (WritePICTImage): Fix use of logical operator + where binary operator is needed. + 2023-01-05 Fojtik Jaroslav <[email protected]> * VisualMagick/installer/inc/body.isx 64 bit distribution MUST NOT be installed on pure 32 bit system. Sanity check added. diff -r 351c48be6ba2 -r 6276f58fac26 VisualMagick/installer/inc/version.isx --- a/VisualMagick/installer/inc/version.isx Thu Jan 05 07:48:58 2023 +0100 +++ b/VisualMagick/installer/inc/version.isx Fri Jan 06 19:40:54 2023 -0600 @@ -10,5 +10,5 @@ #define public MagickPackageName "GraphicsMagick" #define public MagickPackageVersion "1.4" -#define public MagickPackageVersionAddendum ".020230103" -#define public MagickPackageReleaseDate "snapshot-20230103" +#define public MagickPackageVersionAddendum ".020230106" +#define public MagickPackageReleaseDate "snapshot-20230106" diff -r 351c48be6ba2 -r 6276f58fac26 coders/pict.c --- a/coders/pict.c Thu Jan 05 07:48:58 2023 +0100 +++ b/coders/pict.c Fri Jan 06 19:40:54 2023 -0600 @@ -2285,10 +2285,10 @@ Write full size of the file, resolution, frame bounding box, and reserved. */ /* (void) WriteBlobMSBLong(image,pixmap.horizontal_resolution); */ - (void) WriteBlobMSBShort(image,pixmap.horizontal_resolution && 0xFFFF); + (void) WriteBlobMSBShort(image,pixmap.horizontal_resolution & 0xFFFF); (void) WriteBlobMSBShort(image,0x0000); /* (void) WriteBlobMSBLong(image,pixmap.vertical_resolution); */ - (void) WriteBlobMSBShort(image,pixmap.vertical_resolution && 0xFFFF); + (void) WriteBlobMSBShort(image,pixmap.vertical_resolution & 0xFFFF); (void) WriteBlobMSBShort(image,0x0000); (void) WriteBlobMSBShort(image,frame_rectangle.top); (void) WriteBlobMSBShort(image,frame_rectangle.left); diff -r 351c48be6ba2 -r 6276f58fac26 coders/sun.c --- a/coders/sun.c Thu Jan 05 07:48:58 2023 +0100 +++ b/coders/sun.c Fri Jan 06 19:40:54 2023 -0600 @@ -77,10 +77,33 @@ maplength; /* Size of the color map in bytes */ } SUNInfo; -static void LogSUNInfo(const SUNInfo *sun_info) +/* + Compute bytes per line for an unencoded + image. + + The width of a scan line is always a multiple of 16-bits, padded + when necessary. +*/ +static size_t SUNBytesPerLine(const size_t width, const size_t depth) +{ + size_t + bits; + + bits = MagickArraySize(width,depth); + if (0 != bits) + { + size_t abits = RoundUpToAlignment(bits,16); + if (abits < bits) + abits=0; + bits=abits; + } + return bits/8U; +} + +static void LogSUNInfo(const SUNInfo *sun_info,const char *mode) { (void) LogMagickEvent(CoderEvent,GetMagickModule(), - "SunHeader:\n" + "%s SunHeader:\n" " Magic: 0x%04X\n" " Width: %u\n" " Height: %u\n" @@ -89,6 +112,7 @@ " Type: %u (%s)\n" " MapType: %u (%s)\n" " MapLength: %u\n", + mode, sun_info->magic, sun_info->width, sun_info->height, @@ -303,7 +327,6 @@ bytes_per_image, bytes_per_line, count, - pad, sun_data_length; SUNInfo @@ -354,7 +377,7 @@ sun_info.maptype=ReadBlobMSBLong(image); sun_info.maplength=ReadBlobMSBLong(image); if (logging) - LogSUNInfo(&sun_info); + LogSUNInfo(&sun_info, "Read"); if (EOFBlob(image)) ThrowReaderException(CorruptImageError,UnexpectedEndOfFile,image); /* @@ -512,8 +535,8 @@ break; } default: - ThrowReaderException(CoderError,ColormapTypeNotSupported,image) - } + ThrowReaderException(CoderError,ColormapTypeNotSupported,image); + } image->matte=(sun_info.depth == 32); image->columns=sun_info.width; image->rows=sun_info.height; @@ -533,21 +556,21 @@ "The width of a scan line is always 16-bits, padded when necessary." */ - bytes_per_line=MagickArraySize(sun_info.width,sun_info.depth); - if (bytes_per_line == 0) - ThrowReaderException(CorruptImageError,ImproperImageHeader,image); - - pad = sun_info.depth == 1 ? 15U : 7U; /* Pad */ - bytes_per_line += pad; - - if (bytes_per_line != ((size_t) sun_info.width*sun_info.depth+pad)) - ThrowReaderException(CorruptImageError,ImproperImageHeader,image); - - bytes_per_line /= 8U; + bytes_per_line = SUNBytesPerLine(sun_info.width,sun_info.depth); + if (logging) + (void) LogMagickEvent(CoderEvent,GetMagickModule(), + "Bytes per line: %" MAGICK_SIZE_T_F "u", + (MAGICK_SIZE_T) bytes_per_line); if (bytes_per_line == 0) ThrowReaderException(CorruptImageError,ImproperImageHeader,image); bytes_per_image=MagickArraySize(sun_info.height,bytes_per_line); + + if (logging) + (void) LogMagickEvent(CoderEvent,GetMagickModule(), + "Bytes per image: %" MAGICK_SIZE_T_F "u", + (MAGICK_SIZE_T) bytes_per_image); + if (bytes_per_image == 0) ThrowReaderException(CorruptImageError,ImproperImageHeader,image); @@ -556,6 +579,11 @@ else sun_data_length=bytes_per_image; + if (logging) + (void) LogMagickEvent(CoderEvent,GetMagickModule(), + "Sun data length: %" MAGICK_SIZE_T_F "u", + (MAGICK_SIZE_T) sun_data_length); + /* Verify that data length claimed by header is supported by file size */ @@ -564,6 +592,11 @@ if (sun_data_length < bytes_per_image/255U) ThrowReaderException(CorruptImageError,ImproperImageHeader,image); } + else + { + if ((size_t) sun_info.length < bytes_per_image) + ThrowReaderException(CorruptImageError,ImproperImageHeader,image); + } if (BlobIsSeekable(image)) { const magick_off_t file_size = GetBlobSize(image); @@ -597,7 +630,7 @@ if (sun_info.type == RT_ENCODED) { /* - Read run-length encoded raster pixels (padded to 16-bit boundary). + Read run-length encoded raster pixels */ sun_pixels=MagickAllocateResourceLimitedMemory(unsigned char *, bytes_per_image+image->rows); @@ -897,8 +930,11 @@ register const IndexPacket *indexes; - size_t - number_pixels; + unsigned char + *pixels; + + register unsigned char + *q; register long x; @@ -916,6 +952,8 @@ scene; size_t + bytes_per_image, + bytes_per_line, image_list_length; MagickBool @@ -959,11 +997,12 @@ sun_info.magic=0x59a66a95; sun_info.width=image->columns; sun_info.height=image->rows; + sun_info.depth=0; + sun_info.length=0; sun_info.type= (image->storage_class == DirectClass ? RT_FORMAT_RGB : RT_STANDARD); sun_info.maptype=RMT_NONE; sun_info.maplength=0; - number_pixels=MagickArraySize(image->columns,image->rows); if (characteristics.monochrome) { @@ -971,9 +1010,6 @@ Monochrome SUN raster. */ sun_info.depth=1; - sun_info.length=((image->columns+7U) >> 3)*image->rows; - sun_info.length+=((image->columns/8U)+(image->columns % 8U ? 1U : 0U)) % - 2U ? image->rows : 0U; } else if (characteristics.palette) { @@ -981,8 +1017,6 @@ Colormapped SUN raster. */ sun_info.depth=8; - sun_info.length=number_pixels; - sun_info.length+=image->columns & 0x01U ? image->rows : 0; sun_info.maptype=RMT_EQUAL_RGB; sun_info.maplength=image->colors*3; } @@ -992,14 +1026,37 @@ Full color SUN raster. */ sun_info.depth=(image->matte ? 32U : 24U); - sun_info.length=(image->matte ? 4U : 3U)*number_pixels; - sun_info.length+=image->columns & 0x01U ? image->rows : 0U; } + bytes_per_line=SUNBytesPerLine(sun_info.width,sun_info.depth); + if (logging) + (void) LogMagickEvent(CoderEvent,GetMagickModule(), + "Bytes per line: %" MAGICK_SIZE_T_F "u", + (MAGICK_SIZE_T) bytes_per_line); + if (0 == bytes_per_line) + ThrowWriterException(ResourceLimitError,MemoryAllocationFailed,image); + bytes_per_image=MagickArraySize(sun_info.height,bytes_per_line); + if (logging) + (void) LogMagickEvent(CoderEvent,GetMagickModule(), + "Bytes per image: %" MAGICK_SIZE_T_F "u", + (MAGICK_SIZE_T) bytes_per_image); + sun_info.length=bytes_per_image; + if (sun_info.length != bytes_per_image) + ThrowWriterException(ResourceLimitError,MemoryAllocationFailed,image); + + /* + Allocate memory for pixels. + */ + pixels=MagickAllocateResourceLimitedClearedMemory(unsigned char *, + bytes_per_line); + if (pixels == (unsigned char *) NULL) + ThrowWriterException(ResourceLimitError,MemoryAllocationFailed, + image); + /* Write SUN header. */ - LogSUNInfo(&sun_info); + LogSUNInfo(&sun_info, "Write"); (void) WriteBlobMSBLong(image,sun_info.magic); (void) WriteBlobMSBLong(image,sun_info.width); (void) WriteBlobMSBLong(image,sun_info.height); @@ -1039,6 +1096,7 @@ p=AcquireImagePixels(image,0,y,image->columns,1,&image->exception); if (p == (const PixelPacket *) NULL) break; + q=pixels; indexes=AccessImmutableIndexes(image); bit=0; byte=0; @@ -1050,17 +1108,15 @@ bit++; if (bit == 8) { - (void) WriteBlobByte(image,byte); + *q++=byte; bit=0; byte=0; } p++; } if (bit != 0) - (void) WriteBlobByte(image,byte << (8-bit)); - if ((((image->columns/8)+ - (image->columns % 8 ? 1 : 0)) % 2) != 0) - (void) WriteBlobByte(image,0); /* pad scanline */ + *q++=(byte << (8-bit)); + (void) WriteBlob(image,bytes_per_line,pixels); if (image->previous == (Image *) NULL) if (QuantumTick(y,image->rows)) if (!MagickMonitorFormatted(y,image->rows,&image->exception, @@ -1092,14 +1148,14 @@ p=AcquireImagePixels(image,0,y,image->columns,1,&image->exception); if (p == (const PixelPacket *) NULL) break; + q=pixels; indexes=AccessImmutableIndexes(image); for (x=0; x < (long) image->columns; x++) { - (void) WriteBlobByte(image,indexes[x]); + *q++=indexes[x]; p++; } - if (image->columns & 0x01) - (void) WriteBlobByte(image,0); /* pad scanline */ + (void) WriteBlob(image,bytes_per_line,pixels); if (image->previous == (Image *) NULL) if (QuantumTick(y,image->rows)) if (!MagickMonitorFormatted(y,image->rows,&image->exception, @@ -1113,33 +1169,11 @@ /* Full color SUN raster. */ - register unsigned char - *q; - - size_t - pad; - - unsigned char - *pixels; - if (logging) (void) LogMagickEvent(CoderEvent,GetMagickModule(), "Writing SUN truecolor frame %lu...",image->scene); - /* - Allocate memory for pixels. - - Scanlines are padded to 16-bit boundary so account for padding. - */ - pad=(image->columns & 0x01 ? 1 : 0); - pixels=MagickAllocateResourceLimitedArray(unsigned char *, - image->columns + pad, - sizeof(PixelPacket)); - if (pixels == (unsigned char *) NULL) - ThrowWriterException(ResourceLimitError,MemoryAllocationFailed, - image); - /* - Convert DirectClass packet to SUN RGB pixel. + Convert DirectClass packet to SUN (A)RGB pixel. */ for (y=0; y < (long) image->rows; y++) { @@ -1156,9 +1190,7 @@ *q++=ScaleQuantumToChar(p->blue); p++; } - if (image->columns & 0x01) - *q++=0; /* pad scanline */ - (void) WriteBlob(image,q-pixels,(char *) pixels); + (void) WriteBlob(image,bytes_per_line,pixels); if (image->previous == (Image *) NULL) if (QuantumTick(y,image->rows)) if (!MagickMonitorFormatted(y,image->rows,&image->exception, @@ -1166,8 +1198,8 @@ image->columns,image->rows)) break; } - MagickFreeResourceLimitedMemory(pixels); } + MagickFreeResourceLimitedMemory(pixels); if (image->next == (Image *) NULL) break; image=SyncNextImageInList(image); diff -r 351c48be6ba2 -r 6276f58fac26 magick/version.h --- a/magick/version.h Thu Jan 05 07:48:58 2023 +0100 +++ b/magick/version.h Fri Jan 06 19:40:54 2023 -0600 @@ -38,8 +38,8 @@ #define MagickLibVersion 0x272401 #define MagickLibVersionText "1.4" #define MagickLibVersionNumber 27,24,1 -#define MagickChangeDate "20230103" -#define MagickReleaseDate "snapshot-20230103" +#define MagickChangeDate "20230106" +#define MagickReleaseDate "snapshot-20230106" /* The MagickLibInterfaceNewest and MagickLibInterfaceOldest defines diff -r 351c48be6ba2 -r 6276f58fac26 www/Changelog.html --- a/www/Changelog.html Thu Jan 05 07:48:58 2023 +0100 +++ b/www/Changelog.html Fri Jan 06 19:40:54 2023 -0600 @@ -37,6 +37,41 @@ </div> <div class="document"> +<p>2023-01-06 Bob Friesenhahn <<a class="reference external" href="mailto:bfriesen%40simple.dallas.tx.us">bfriesen<span>@</span>simple<span>.</span>dallas<span>.</span>tx<span>.</span>us</a>></p> +<blockquote> +<ul class="simple"> +<li><p>coders/sun.c (ReadSUNImage): Address oss-fuzz 54810 +"graphicsmagick:coder_SUN_fuzzer: Heap-buffer-overflow in +ReadSUNImage".</p></li> +<li><p>coders/pict.c (WritePICTImage): Fix use of logical operator +where binary operator is needed.</p></li> +</ul> +</blockquote> +<dl class="simple"> +<dt>2023-01-05 Fojtik Jaroslav <<a class="reference external" href="mailto:JaFojtik%40yandex.com">JaFojtik<span>@</span>yandex<span>.</span>com</a>></dt> +<dd><ul class="simple"> +<li><p>VisualMagick/installer/inc/body.isx 64 bit distribution MUST NOT be installed on pure +32 bit system. Sanity check added.</p></li> +</ul> +</dd> +</dl> +<p>2023-01-05 Fojtik Jaroslav <<a class="reference external" href="mailto:JaFojtik%40yandex.com">JaFojtik<span>@</span>yandex<span>.</span>com</a>></p> +<blockquote> +<ul class="simple"> +<li><p>VisualMagick/installer/inc/body.isx</p></li> +<li><p>VisualMagick/installer/inc/files-dlls.isx +( VisualMagick/installer/redist/VC2008SP1/vcredist_x64.exe must be downloaded from www) +( VisualMagick/installer/redist/VC2008SP1/vcredist_x86.exe must be downloaded from www) +Fix graphics magick installer for Windows.</p></li> +</ul> +</blockquote> +<p>2023-01-04 Fojtik Jaroslav <<a class="reference external" href="mailto:JaFojtik%40yandex.com">JaFojtik<span>@</span>yandex<span>.</span>com</a>></p> +<blockquote> +<ul class="simple"> +<li><p>VisualMagick/tests/runtest.bat Added new tests for PGX (jp2), MAT, +uncommented test for EPDF and PICON.</p></li> +</ul> +</blockquote> <p>2023-01-03 Fojtik Jaroslav <<a class="reference external" href="mailto:JaFojtik%40yandex.com">JaFojtik<span>@</span>yandex<span>.</span>com</a>></p> <blockquote> <ul class="simple"> @@ -51,7 +86,7 @@ </ul> </blockquote> <div class="system-message"> -<p class="system-message-title">System Message: WARNING/2 (<span class="docutils literal"><string></span>, line 8)</p> +<p class="system-message-title">System Message: WARNING/2 (<span class="docutils literal"><string></span>, line 34)</p> <p>Block quote ends without a blank line; unexpected unindent.</p> </div> <ul class="simple">