GraphicsMagick: coders/topol.c: Fix a problem when filename cont...

changeset d88ffe868452 in /hg/GraphicsMagick
details: http://hg.GraphicsMagick.org/hg/GraphicsMagick?cmd=changeset;node=d88ffe868452
summary: coders/topol.c: Fix a problem when filename contains garbage only. Reported as oss-fuzz-58544.

diffstat:

 ChangeLog      |   5 ++++
 coders/topol.c |  69 ++++++++++++++++++++++++++++++---------------------------
 2 files changed, 41 insertions(+), 33 deletions(-)

diffs (98 lines):

diff -r 3179db7ab1fb -r d88ffe868452 ChangeLog
--- a/ChangeLog	Sun Apr 30 17:57:12 2023 -0500
+++ b/ChangeLog	Tue May 02 20:41:05 2023 +0200
@@ -1,3 +1,8 @@
+2023-05-02  Fojtik Jaroslav  <[email protected]>
+
+	* coders/topol.c: Fix a problem when filename contains garbage only.
+        Reported as oss-fuzz-58544.
+
 2023-04-30  Bob Friesenhahn  <[email protected]>
 
 	* coders/heif.c (ReadHEIFImage): Change comments to C99
diff -r 3179db7ab1fb -r d88ffe868452 coders/topol.c
--- a/coders/topol.c	Sun Apr 30 17:57:12 2023 -0500
+++ b/coders/topol.c	Tue May 02 20:41:05 2023 +0200
@@ -937,46 +937,49 @@
       Image *Palette;
       ExceptionInfo exception;
 
-      i = strlen(clone_info->filename);
-      j = i;
-      while(--i > 0)
+      i = strnlen(clone_info->filename, sizeof(clone_info->filename));
+      if(i < sizeof(clone_info->filename))
       {
-        if(clone_info->filename[i]=='.')
+        j = i;
+        while(--i > 0)
         {
-          break;
+          if(clone_info->filename[i]=='.')
+          {
+            break;
+          }
+          if(clone_info->filename[i]=='/' || clone_info->filename[i]=='\\' || clone_info->filename[i]==':' )
+          {
+            i=j;
+            break;
+          }
         }
-        if(clone_info->filename[i]=='/' || clone_info->filename[i]=='\\' || clone_info->filename[i]==':' )
-        {
-          i=j;
-          break;
-        }
-      }
-      (void) strlcpy(clone_info->filename+i,".pal",sizeof(clone_info->filename)-i);
-      if((clone_info->file=fopen(clone_info->filename,"wb"))!=NULL)
-      {
-        if((Palette=AllocateImage(clone_info))!=NULL )
+        (void) strlcpy(clone_info->filename+i,".pal",sizeof(clone_info->filename)-i);
+        if((clone_info->file=fopen(clone_info->filename,"wb"))!=NULL)
         {
-          if(OpenBlob(clone_info,Palette,WriteBinaryBlobMode,&exception))
+          if((Palette=AllocateImage(clone_info))!=NULL )
           {
-            if(Header.FileType == 2)
-              j = 256;
-            else
-              j = 15;
-            WriteBlobByte(Palette,j);
-            for(i=0; i<j; i++)
+            if(OpenBlob(clone_info,Palette,WriteBinaryBlobMode,&exception))
             {
-              WriteBlobByte(Palette, i&0xFF);
-              if(i<image->colors)
+              if(Header.FileType == 2)
+                j = 256;
+              else
+                j = 15;
+              WriteBlobByte(Palette,j);
+              for(i=0; i<j; i++)
               {
-                WriteBlobByte(Palette,i);
-                WriteBlobByte(Palette,i);
-                WriteBlobByte(Palette,i);
-              }
-              else
-              {
-                WriteBlobByte(Palette,ScaleQuantumToChar(image->colormap[i].red));
-                WriteBlobByte(Palette,ScaleQuantumToChar(image->colormap[i].green));
-                WriteBlobByte(Palette,ScaleQuantumToChar(image->colormap[i].blue));
+                WriteBlobByte(Palette, i&0xFF);
+                if(i<image->colors)
+                {
+                  WriteBlobByte(Palette,i);
+                  WriteBlobByte(Palette,i);
+                  WriteBlobByte(Palette,i);
+                }
+                else
+                {
+                  WriteBlobByte(Palette,ScaleQuantumToChar(image->colormap[i].red));
+                  WriteBlobByte(Palette,ScaleQuantumToChar(image->colormap[i].green));
+                  WriteBlobByte(Palette,ScaleQuantumToChar(image->colormap[i].blue));
+                }
               }
             }
           }