GraphicsMagick: ReadWPGImage(): If a colormap is provided, make ...

GraphicsMagick Commits <[email protected]> Tue, 17 Oct 2023 13:27:19 -0500
Newsgroups gmane.comp.video.graphicsmagick.cvs
Message-ID <mailman.9364.1697567250.1370.graphicsmagick-commit@lists.sourceforge.net>
changeset cd5a56aa3040 in /hg/GraphicsMagick
details: http://hg.GraphicsMagick.org/hg/GraphicsMagick?cmd=changeset;node=cd5a56aa3040
summary: ReadWPGImage(): If a colormap is provided, make sure that PsuedoClass indexes are initialized before promoting image to PseudoClass.

diffstat:

 ChangeLog                              |  10 ++++++++++
 VisualMagick/installer/inc/version.isx |   4 ++--
 coders/wpg.c                           |  32 ++++++++++++++++++++++++++++++++
 magick/version.h                       |   4 ++--
 www/Changelog.html                     |  12 ++++++++++++
 5 files changed, 58 insertions(+), 4 deletions(-)

diffs (106 lines):

diff -r 61280c3dc87b -r cd5a56aa3040 ChangeLog
--- a/ChangeLog	Mon Oct 16 19:53:17 2023 -0500
+++ b/ChangeLog	Tue Oct 17 13:27:16 2023 -0500
@@ -1,3 +1,13 @@
+2023-10-17  Bob Friesenhahn  <[email protected]>
+
+	* coders/wpg.c (ReadWPGImage): If a colormap is provided, make
+	sure that PsuedoClass indexes are initialized before promoting
+	image to PseudoClass. Addresses oss-fuzz issue 63335:
+	"graphicsmagick:coder_WPG_fuzzer: Use-of-uninitialized-value in
+	GrayscalePseudoClassImage".  This is a stop-gap fix until the
+	WPG reader supports a colormap independent of the image, to be
+	used when needed.
+
 2023-10-16  Bob Friesenhahn  <[email protected]>
 
 	* coders/tiff.c (WriteTIFFImage): Remove safe-guards against use
diff -r 61280c3dc87b -r cd5a56aa3040 VisualMagick/installer/inc/version.isx
--- a/VisualMagick/installer/inc/version.isx	Mon Oct 16 19:53:17 2023 -0500
+++ b/VisualMagick/installer/inc/version.isx	Tue Oct 17 13:27:16 2023 -0500
@@ -10,5 +10,5 @@
 
 #define public MagickPackageName "GraphicsMagick"
 #define public MagickPackageVersion "1.4"
-#define public MagickPackageVersionAddendum ".020231016"
-#define public MagickPackageReleaseDate "snapshot-20231016"
+#define public MagickPackageVersionAddendum ".020231017"
+#define public MagickPackageReleaseDate "snapshot-20231017"
diff -r 61280c3dc87b -r cd5a56aa3040 coders/wpg.c
--- a/coders/wpg.c	Mon Oct 16 19:53:17 2023 -0500
+++ b/coders/wpg.c	Tue Oct 17 13:27:16 2023 -0500
@@ -1374,6 +1374,38 @@
             case 0x0E:  /*Color palette */
               WPG_Palette.StartIndex=ReadBlobLSBShort(image);
               WPG_Palette.NumOfEntries=ReadBlobLSBShort(image);
+              
+              /* Make sure that indexes contain initialized data if
+                 promoting from DirectClass.  This is a stop-gap
+                 measure until independent colormap support is
+                 developed. */
+              if (PseudoClass != image->storage_class)
+                {
+                  unsigned long y;
+                  IndexPacket *indexes;
+                  PixelPacket *p;
+                  MagickBool get = GetPixelCachePresent(image);
+                  image->storage_class = PseudoClass;
+                  for (y=0; y < image->rows; y++)
+                    {
+                      if (get)
+                        p=GetImagePixels(image,0,y,image->columns,1);
+                      else
+                        p=SetImagePixels(image,0,y,image->columns,1);
+                      if (p == (const PixelPacket *) NULL)
+                        break;
+                      indexes=AccessMutableIndexes(image);
+                      if (indexes == (IndexPacket *) NULL)
+                        break;
+                      if (!get)
+                        (void) memset(p,0,sizeof(PixelPacket)*image->columns);
+                      (void) memset(indexes,0,sizeof(IndexPacket)*image->columns);
+                      if (!SyncImagePixels(image))
+                        break;
+                    }
+                  if (y != image->rows)
+                    ThrowReaderException(CacheError,UnableToGetPixelsFromCache,image);
+                }
 
               image->colors=WPG_Palette.NumOfEntries;
               if (!AllocateImageColormap(image,image->colors))
diff -r 61280c3dc87b -r cd5a56aa3040 magick/version.h
--- a/magick/version.h	Mon Oct 16 19:53:17 2023 -0500
+++ b/magick/version.h	Tue Oct 17 13:27:16 2023 -0500
@@ -38,8 +38,8 @@
 #define MagickLibVersion  0x272404
 #define MagickLibVersionText  "1.4"
 #define MagickLibVersionNumber 27,24,4
-#define MagickChangeDate   "20231016"
-#define MagickReleaseDate  "snapshot-20231016"
+#define MagickChangeDate   "20231017"
+#define MagickReleaseDate  "snapshot-20231017"
 
 /*
   The MagickLibInterfaceNewest and MagickLibInterfaceOldest defines
diff -r 61280c3dc87b -r cd5a56aa3040 www/Changelog.html
--- a/www/Changelog.html	Mon Oct 16 19:53:17 2023 -0500
+++ b/www/Changelog.html	Tue Oct 17 13:27:16 2023 -0500
@@ -37,6 +37,18 @@
 </div>
 
 <div class="document">
+<p>2023-10-17  Bob Friesenhahn  &lt;<a class="reference external" href="mailto:bfriesen&#37;&#52;&#48;simple&#46;dallas&#46;tx&#46;us">bfriesen<span>&#64;</span>simple<span>&#46;</span>dallas<span>&#46;</span>tx<span>&#46;</span>us</a>&gt;</p>
+<blockquote>
+<ul class="simple">
+<li><p>coders/wpg.c (ReadWPGImage): If a colormap is provided, make
+sure that PsuedoClass indexes are initialized before promoting
+image to PseudoClass. Addresses oss-fuzz issue 63335:
+&quot;graphicsmagick:coder_WPG_fuzzer: Use-of-uninitialized-value in
+GrayscalePseudoClassImage&quot;.  This is a stop-gap fix until the
+WPG reader supports a colormap independent of the image, to be
+used when needed.</p></li>
+</ul>
+</blockquote>
 <p>2023-10-16  Bob Friesenhahn  &lt;<a class="reference external" href="mailto:bfriesen&#37;&#52;&#48;simple&#46;dallas&#46;tx&#46;us">bfriesen<span>&#64;</span>simple<span>&#46;</span>dallas<span>&#46;</span>tx<span>&#46;</span>us</a>&gt;</p>
 <blockquote>
 <ul class="simple">