GraphicsMagick: coders/bmp.c: Data behind declared BMP header sh...

changeset 050448a88dde in /hg/GraphicsMagick
details: http://hg.GraphicsMagick.org/hg/GraphicsMagick?cmd=changeset;node=050448a88dde
summary: coders/bmp.c: Data behind declared BMP header should not be read.

diffstat:

 ChangeLog    |   5 ++++
 coders/bmp.c |  74 ++++++++++++++++++++++++++++++++---------------------------
 2 files changed, 45 insertions(+), 34 deletions(-)

diffs (116 lines):

diff -r c6b81acd69bd -r 050448a88dde ChangeLog
--- a/ChangeLog	Tue Aug 08 08:54:25 2023 -0500
+++ b/ChangeLog	Tue Aug 08 18:26:17 2023 +0200
@@ -1,3 +1,8 @@
+2023-08-08  Fojtik Jaroslav  <[email protected]>
+
+	* coders/bmp.c: Data behind declared BMP header should not be read.
+        It could poison newly converted image with garbage.
+
 2023-08-08  Bob Friesenhahn  <[email protected]>
 
 	* coders/cineon.c (GenerateCineonTimeStamp): Correct strlcpy()
diff -r c6b81acd69bd -r 050448a88dde coders/bmp.c
--- a/coders/bmp.c	Tue Aug 08 08:54:25 2023 -0500
+++ b/coders/bmp.c	Tue Aug 08 18:26:17 2023 +0200
@@ -813,26 +813,14 @@
               "  Important colors: %u",bmp_info.colors_important);
           }
 
-        bmp_info.red_mask=ReadBlobLSBLong(image);
-        bmp_info.green_mask=ReadBlobLSBLong(image);
-        bmp_info.blue_mask=ReadBlobLSBLong(image);
-
-        if (bmp_info.size > 40)
+        if(bmp_info.size >= 52)
+        {
+          bmp_info.red_mask=ReadBlobLSBLong(image);
+          bmp_info.green_mask=ReadBlobLSBLong(image);
+          bmp_info.blue_mask=ReadBlobLSBLong(image);
+          if(bmp_info.size >= 56)
           {
             /*
-              https://learn.microsoft.com/en-us/windows/win32/api/wingdi/ns-wingdi-bitmapv4header
-            */
-            magick_uint32_t
-              v4_red_primary_x, v4_red_primary_y, v4_red_primary_z,
-              v4_green_primary_x, v4_green_primary_y, v4_green_primary_z,
-              v4_blue_primary_x, v4_blue_primary_y, v4_blue_primary_z,
-              v4_gamma_x, v4_gamma_y, v4_gamma_z;
-
-            double
-              bmp_gamma,
-              sum;
-
-            /*
               Read color management information.
             */
             bmp_info.alpha_mask=ReadBlobLSBLong(image);
@@ -840,26 +828,42 @@
               (void) LogMagickEvent(CoderEvent,GetMagickModule(),
                                     "Alpha Mask: 0x%04x",
                                     bmp_info.alpha_mask);
-            bmp_info.colorspace=(magick_int32_t) ReadBlobLSBLong(image);
-            if (image->logging)
-              (void) LogMagickEvent(CoderEvent,GetMagickModule(),
+
+           if(bmp_info.size > 64)
+            {
+             /*
+              https://learn.microsoft.com/en-us/windows/win32/api/wingdi/ns-wingdi-bitmapv4header
+            */
+              magick_uint32_t
+                v4_red_primary_x, v4_red_primary_y, v4_red_primary_z,
+                v4_green_primary_x, v4_green_primary_y, v4_green_primary_z,
+                v4_blue_primary_x, v4_blue_primary_y, v4_blue_primary_z,
+                v4_gamma_x, v4_gamma_y, v4_gamma_z;
+
+              double
+                bmp_gamma,
+                sum;
+
+              bmp_info.colorspace=(magick_int32_t) ReadBlobLSBLong(image);
+              if (image->logging)
+                (void) LogMagickEvent(CoderEvent,GetMagickModule(),
                                     "BMP Colorspace: 0x%04x",
                                     bmp_info.colorspace);
 
-            v4_red_primary_x=ReadBlobLSBLong(image);
-            v4_red_primary_y=ReadBlobLSBLong(image);
-            v4_red_primary_z=ReadBlobLSBLong(image);
-            v4_green_primary_x=ReadBlobLSBLong(image);
-            v4_green_primary_y=ReadBlobLSBLong(image);
-            v4_green_primary_z=ReadBlobLSBLong(image);
-            v4_blue_primary_x=ReadBlobLSBLong(image);
-            v4_blue_primary_y=ReadBlobLSBLong(image);
-            v4_blue_primary_z=ReadBlobLSBLong(image);
-            v4_gamma_x = ReadBlobLSBLong(image);
-            v4_gamma_y = ReadBlobLSBLong(image);
-            v4_gamma_z = ReadBlobLSBLong(image);
+              v4_red_primary_x=ReadBlobLSBLong(image);
+              v4_red_primary_y=ReadBlobLSBLong(image);
+              v4_red_primary_z=ReadBlobLSBLong(image);
+              v4_green_primary_x=ReadBlobLSBLong(image);
+              v4_green_primary_y=ReadBlobLSBLong(image);
+              v4_green_primary_z=ReadBlobLSBLong(image);
+              v4_blue_primary_x=ReadBlobLSBLong(image);
+              v4_blue_primary_y=ReadBlobLSBLong(image);
+              v4_blue_primary_z=ReadBlobLSBLong(image);
+              v4_gamma_x = ReadBlobLSBLong(image);
+              v4_gamma_y = ReadBlobLSBLong(image);
+              v4_gamma_z = ReadBlobLSBLong(image);
 
-            if (LCS_CALIBRATED_RGB == bmp_info.colorspace)
+              if (LCS_CALIBRATED_RGB == bmp_info.colorspace)
               {
                 /*
                   Decode 2^30 fixed point formatted CIE primaries.
@@ -938,6 +942,8 @@
                                             bmp_gamma, bmp_info.gamma_scale.x,
                                             bmp_info.gamma_scale.y, bmp_info.gamma_scale.z);
                   }
+                }
+              }
             }
           }
         if (bmp_info.size > 108)