GraphicsMagick: ReadMNGImage(): Can not use interpolation for fi...
GraphicsMagick Commits <[email protected]>
| Newsgroups | gmane.comp.video.graphicsmagick.cvs |
|---|---|
| Message-ID | <mailman.358.1684679880.25686.graphicsmagick-commit@lists.sourceforge.net> |
changeset 46ea1cb22544 in /hg/GraphicsMagick details: http://hg.GraphicsMagick.org/hg/GraphicsMagick?cmd=changeset;node=46ea1cb22544 summary: ReadMNGImage(): Can not use interpolation for first pixel in MNG X_method 5 diffstat: ChangeLog | 9 +++++ VisualMagick/installer/inc/version.isx | 4 +- coders/png.c | 58 ++++++++++++++++++++++++++++++--- magick/version.h | 4 +- www/Changelog.html | 11 ++++++ 5 files changed, 76 insertions(+), 10 deletions(-) diffs (148 lines): diff -r 40a065fab214 -r 46ea1cb22544 ChangeLog --- a/ChangeLog Sat May 20 12:54:08 2023 -0500 +++ b/ChangeLog Sun May 21 09:37:49 2023 -0500 @@ -1,3 +1,12 @@ +2023-05-21 Bob Friesenhahn <[email protected]> + + * coders/png.c (ReadMNGImage): Can not use interpolation for first + pixel in MNG X_method 5. Fixes oss-fuzz issue 31109 + "graphicsmagick:coder_MNG_fuzzer: Heap-buffer-overflow in + ReadMNGImage" and oss-fuzz issue 58381 + "graphicsmagick:coder_MNG_fuzzer: Heap-buffer-overflow in + ReadMNGImage". + 2023-05-20 Bob Friesenhahn <[email protected]> * coders/tiff.c (ReadTIFFImage): Verify that the bits per sample, diff -r 40a065fab214 -r 46ea1cb22544 VisualMagick/installer/inc/version.isx --- a/VisualMagick/installer/inc/version.isx Sat May 20 12:54:08 2023 -0500 +++ b/VisualMagick/installer/inc/version.isx Sun May 21 09:37:49 2023 -0500 @@ -10,5 +10,5 @@ #define public MagickPackageName "GraphicsMagick" #define public MagickPackageVersion "1.4" -#define public MagickPackageVersionAddendum ".020230520" -#define public MagickPackageReleaseDate "snapshot-20230520" +#define public MagickPackageVersionAddendum ".020230521" +#define public MagickPackageReleaseDate "snapshot-20230521" diff -r 40a065fab214 -r 46ea1cb22544 coders/png.c --- a/coders/png.c Sat May 20 12:54:08 2023 -0500 +++ b/coders/png.c Sun May 21 09:37:49 2023 -0500 @@ -5848,6 +5848,35 @@ magnify the image. http://www.libpng.org/pub/mng/spec/mng-1.0-20010209-pdg.html#mng-MAGN + + Extracted summary of magnification options: + + X_method: 1 byte + 0 or omitted: No magnification + 1: Pixel replication of color and alpha samples. + 2: Magnified intervals with linear interpolation of + color and alpha samples. + 3: Magnified intervals with replication of color and + alpha samples from the closest pixel. + 4: Magnified intervals with linear interpolation of + color samples and replication of alpha samples from + the closest pixel. + 5: Magnified intervals with linear interpolation of + alpha samples and replication of color samples from + the closest pixel. + MX: 2 bytes. X magnification factor, range 1-65535. If + omitted, MX=1. Ignored if X_method is 0 and assumed to + be 1. + MY: 2 bytes. Y magnification factor. If omitted, MY=MX. + ML: 2 bytes. Left X magnification factor. If omitted, ML=MX. + MR: 2 bytes. Right X magnification factor. If omitted, MR=MX. + MT: 2 bytes. Top Y magnification factor. If omitted, MT=MY. + Ignored if Y_method is 0 and assumed to be 1. + MB: 2 bytes. Bottom Y magnification factor. If omitted, + MB=MY. + Y_method: 1 byte. If omitted, Y_method is the same as X_method. + + */ if (((mng_info->magn_methx > 0) && (mng_info->magn_methx <= 5)) && ((mng_info->magn_methy > 0) && (mng_info->magn_methy <= 5))) @@ -6146,11 +6175,20 @@ *q=(*n); if (magn_methy == 5) { - (*q).opacity=(QM) ( + if (i == 0) + { + /* Copy */ + (*q).opacity=(*p).opacity; + } + else + { + /* Interpolate */ + (*q).opacity=(QM) ( ((long) (2*i*((*n).opacity -(*p).opacity)+m))/ ((long) (m*2))+ (*p).opacity); + } } } n++; @@ -6256,11 +6294,19 @@ *q=(*n); if (magn_methx == 5) { - /* Interpolate */ - (*q).opacity=(QM) ((2*i*((*n).opacity /* oss-fuzz 31109 buffer over-read */ - -(*p).opacity)+m)/ - ((long) (m*2)) - +(*p).opacity); + if (i == 0) + { + /* Copy */ + (*q).opacity=(*p).opacity; + } + else + { + /* Interpolate */ + (*q).opacity=(QM) ((2*i*((*n).opacity + -(*p).opacity)+m)/ + ((long) (m*2)) + +(*p).opacity); + } } } q++; diff -r 40a065fab214 -r 46ea1cb22544 magick/version.h --- a/magick/version.h Sat May 20 12:54:08 2023 -0500 +++ b/magick/version.h Sun May 21 09:37:49 2023 -0500 @@ -38,8 +38,8 @@ #define MagickLibVersion 0x272402 #define MagickLibVersionText "1.4" #define MagickLibVersionNumber 27,24,2 -#define MagickChangeDate "20230520" -#define MagickReleaseDate "snapshot-20230520" +#define MagickChangeDate "20230521" +#define MagickReleaseDate "snapshot-20230521" /* The MagickLibInterfaceNewest and MagickLibInterfaceOldest defines diff -r 40a065fab214 -r 46ea1cb22544 www/Changelog.html --- a/www/Changelog.html Sat May 20 12:54:08 2023 -0500 +++ b/www/Changelog.html Sun May 21 09:37:49 2023 -0500 @@ -37,6 +37,17 @@ </div> <div class="document"> +<p>2023-05-21 Bob Friesenhahn <<a class="reference external" href="mailto:bfriesen%40simple.dallas.tx.us">bfriesen<span>@</span>simple<span>.</span>dallas<span>.</span>tx<span>.</span>us</a>></p> +<blockquote> +<ul class="simple"> +<li><p>coders/png.c (ReadMNGImage): Can not use interpolation for first +pixel in MNG X_method 5. Fixes oss-fuzz issue 31109 +"graphicsmagick:coder_MNG_fuzzer: Heap-buffer-overflow in +ReadMNGImage" and oss-fuzz issue 58381 +"graphicsmagick:coder_MNG_fuzzer: Heap-buffer-overflow in +ReadMNGImage".</p></li> +</ul> +</blockquote> <p>2023-05-20 Bob Friesenhahn <<a class="reference external" href="mailto:bfriesen%40simple.dallas.tx.us">bfriesen<span>@</span>simple<span>.</span>dallas<span>.</span>tx<span>.</span>us</a>></p> <blockquote> <ul class="simple">