GraphicsMagick: ReadIdentityImage(): Limit 'order' to a maximum ...

changeset 06dd65d8c01d in /hg/GraphicsMagick
details: http://hg.GraphicsMagick.org/hg/GraphicsMagick?cmd=changeset;node=06dd65d8c01d
summary: ReadIdentityImage(): Limit 'order' to a maximum of 40

diffstat:

 ChangeLog                        |   8 ++++++++
 coders/identity.c                |  17 ++++++++++-------
 magick/command.c                 |   5 +++--
 magick/effect.c                  |   2 +-
 magick/utility.c                 |   7 +++++--
 utilities/tests/convert-cmds.txt |   1 +
 www/Changelog.html               |   6 ++++++
 7 files changed, 34 insertions(+), 12 deletions(-)

diffs (156 lines):

diff -r bb77bcdc08b0 -r 06dd65d8c01d ChangeLog
--- a/ChangeLog	Sat Mar 11 11:03:40 2023 -0600
+++ b/ChangeLog	Sat Mar 11 14:57:26 2023 -0600
@@ -1,5 +1,13 @@
 2023-03-11  Bob Friesenhahn  <[email protected]>
 
+	* coders/identity.c (ReadIdentityImage): Limit 'order' to a
+	maximum of 40, and change to unsigned type in order to avoid
+	undefined arithmetic overflow.
+
+	* magick/command.c (MogrifyImage): Handle the case where image and
+	region_image are the same.  Addresses SourceForge issue #688 "Heap
+	UAF in gm (magick/command.c:11427)".
+
 	* coders/pict.c (WritePICTImage): Fix use of
 	MagickFreeResourceLimitedMemory() on non-managed memory. Addresses
 	SourceForge issue #687 "Heap Overflow in gm
diff -r bb77bcdc08b0 -r 06dd65d8c01d coders/identity.c
--- a/coders/identity.c	Sat Mar 11 11:03:40 2023 -0600
+++ b/coders/identity.c	Sat Mar 11 14:57:26 2023 -0600
@@ -1,5 +1,5 @@
 /*
-% Copyright (C) 2009-2020 GraphicsMagick Group
+% Copyright (C) 2009-2023 GraphicsMagick Group
 %
 % This program is covered by multiple licenses, which are described in
 % Copyright.txt. You should have received a copy of Copyright.txt with this
@@ -34,7 +34,8 @@
 %  identity image.  The minimum order which may be specified is 2.  Higher
 %  order LUTs contain more colors and are therefore more accurate, but consume
 %  more memory.  Typical Hald CLUT identity images have an order of between 8
-%  (512x512) and 16 (4096x4096).  The default order is 8.
+%  (512x512) and 16 (4096x4096).   An arbitrary maximum order of 40 (a
+%  64000x64000 image) is enforced. The default order is 8.
 %
 %  The format of the ReadIdentityImage method is:
 %
@@ -63,10 +64,10 @@
     *image;
 
   unsigned long
-    cube_size;
+    cube_size,
+    order;
 
   long
-    order,
     y;
 
   unsigned long
@@ -83,14 +84,16 @@
   assert(exception != (ExceptionInfo *) NULL);
   assert(exception->signature == MagickSignature);
 
-  image=(Image *) NULL;
+  image=AllocateImage(image_info);
   order=8;
   if (image_info->filename[0] != '\0')
-    order=MagickAtoL(image_info->filename);
+    if ((status &= MagickAtoULChk(image_info->filename, &order)) != MagickPass)
+      ThrowReaderException(FileOpenError,UnableToOpenFile,image);
+  if (order > 40)
+      ThrowReaderException(FileOpenError,UnableToOpenFile,image);
   if (order < 2)
     order=8;
 
-  image=AllocateImage(image_info);
   cube_size=order*order;
   image->columns=image->rows=order*order*order;
 
diff -r bb77bcdc08b0 -r 06dd65d8c01d magick/command.c
--- a/magick/command.c	Sat Mar 11 11:03:40 2023 -0600
+++ b/magick/command.c	Sat Mar 11 14:57:26 2023 -0600
@@ -1,5 +1,5 @@
 /*
-% Copyright (C) 2003 - 2022 GraphicsMagick Group
+% Copyright (C) 2003 - 2023 GraphicsMagick Group
 % Copyright (C) 2002 ImageMagick Studio
 %
 % This program is covered by multiple licenses, which are described in
@@ -10711,6 +10711,7 @@
                   region_geometry.y);
                 DestroyImage(*image);
                 *image=region_image;
+                region_image=(Image *) NULL;
               }
             if (*option == '+')
               continue;
@@ -11429,7 +11430,7 @@
         break;
     }
   }
-  if (region_image != (Image *) NULL)
+  if ((region_image != (Image *) NULL) && (region_image != *image))
     {
       /*
         Composite transformed region onto image.
diff -r bb77bcdc08b0 -r 06dd65d8c01d magick/effect.c
--- a/magick/effect.c	Sat Mar 11 11:03:40 2023 -0600
+++ b/magick/effect.c	Sat Mar 11 14:57:26 2023 -0600
@@ -1,5 +1,5 @@
 /*
-% Copyright (C) 2003-2022 GraphicsMagick Group
+% Copyright (C) 2003-2023 GraphicsMagick Group
 % Copyright (C) 2002 ImageMagick Studio
 %
 % This program is covered by multiple licenses, which are described in
diff -r bb77bcdc08b0 -r 06dd65d8c01d magick/utility.c
--- a/magick/utility.c	Sat Mar 11 11:03:40 2023 -0600
+++ b/magick/utility.c	Sat Mar 11 14:57:26 2023 -0600
@@ -1,5 +1,5 @@
 /*
-% Copyright (C) 2003-2021 GraphicsMagick Group
+% Copyright (C) 2003-2023 GraphicsMagick Group
 % Copyright (c) 2000 Markus Friedl.  All rights reserved.
 % Copyright (C) 2002 ImageMagick Studio
 % Copyright 1991-1999 E. I. du Pont de Nemours and Company
@@ -1589,7 +1589,10 @@
 %  A description of each parameter follows:
 %
 %    o flags:  Method GetGeometry returns a bitmask that indicates
-%      which of the four values were located in the geometry string.
+%      which of the values from GeometryFlags (XValue, YValue, WidthValue,
+%      HeightValue, XNegative, YNegative, PercentValue, AspectValue, LessValue,
+%      GreaterValue, AreaValue, MinimumValue) were located in the geometry
+%      string.
 %
 %    o image_geometry:  Specifies a character string representing the geometry
 %      specification.
diff -r bb77bcdc08b0 -r 06dd65d8c01d utilities/tests/convert-cmds.txt
--- a/utilities/tests/convert-cmds.txt	Sat Mar 11 11:03:40 2023 -0600
+++ b/utilities/tests/convert-cmds.txt	Sat Mar 11 14:57:26 2023 -0600
@@ -148,6 +148,7 @@
 -recolor '0.9,0,0,0,0.9,0,0,0,1.2'
 -recolor '.22,.72,.07,.22,.72,.07,.22,.72,.07'
 -density 75x75 -resample 50x50
+-region 640x480+400+500 -blur 0x6
 -resize 10%
 -resize 50%
 -resize 150%
diff -r bb77bcdc08b0 -r 06dd65d8c01d www/Changelog.html
--- a/www/Changelog.html	Sat Mar 11 11:03:40 2023 -0600
+++ b/www/Changelog.html	Sat Mar 11 14:57:26 2023 -0600
@@ -40,6 +40,12 @@
 <p>2023-03-11  Bob Friesenhahn  &lt;<a class="reference external" href="mailto:bfriesen&#37;&#52;&#48;simple&#46;dallas&#46;tx&#46;us">bfriesen<span>&#64;</span>simple<span>&#46;</span>dallas<span>&#46;</span>tx<span>&#46;</span>us</a>&gt;</p>
 <blockquote>
 <ul class="simple">
+<li><p>coders/identity.c (ReadIdentityImage): Limit 'order' to a
+maximum of 40, and change to unsigned type in order to avoid
+undefined arithmetic overflow.</p></li>
+<li><p>magick/command.c (MogrifyImage): Handle the case where image and
+region_image are the same.  Addresses SourceForge issue #688 &quot;Heap
+UAF in gm (magick/command.c:11427)&quot;.</p></li>
 <li><p>coders/pict.c (WritePICTImage): Fix use of
 MagickFreeResourceLimitedMemory() on non-managed memory. Addresses
 SourceForge issue #687 &quot;Heap Overflow in gm