GraphicsMagick: Fixes for JBIG reader. Fix ExportGrayQuantumTyp...
GraphicsMagick Commits <[email protected]> Fri, 08 Dec 2023 09:41:14 -0600
| Newsgroups | gmane.comp.video.graphicsmagick.cvs |
|---|---|
| Message-ID | <mailman.10685.1702050092.7940.graphicsmagick-commit@lists.sourceforge.net> |
changeset 8e80ed0df3fb in /hg/GraphicsMagick details: http://hg.GraphicsMagick.org/hg/GraphicsMagick?cmd=changeset;node=8e80ed0df3fb summary: Fixes for JBIG reader. Fix ExportGrayQuantumType() PseudoClass case when image colors != 2. diffstat: ChangeLog | 10 ++++++++++ VisualMagick/installer/inc/version.isx | 4 ++-- coders/jbig.c | 18 +++++++++++++++--- magick/export.c | 11 +++++++++++ magick/version.h | 4 ++-- www/Changelog.html | 17 +++++++++++++++++ 6 files changed, 57 insertions(+), 7 deletions(-) diffs (158 lines): diff -r 867ff859b425 -r 8e80ed0df3fb ChangeLog --- a/ChangeLog Thu Dec 07 19:54:40 2023 +0100 +++ b/ChangeLog Fri Dec 08 09:41:11 2023 -0600 @@ -1,3 +1,13 @@ +2023-12-08 Bob Friesenhahn <[email protected]> + + * coders/jbig.c (ReadJBIGImage): Add error detection. Addresses + oss-fuzz "Issue 64781: graphicsmagick:coder_JBIG_fuzzer: + Null-dereference READ in jbg_dec_getimage". + + * magick/export.c (ExportGrayQuantumType): Only use 'Special + "fast" support for two-color PsudeoClass.' case when image has two + colors. Otherwise output image is not correct! + 2023-12-07 Fojtik Jaroslav <[email protected]> * coders/wpg.c Deallocate palette when image load fails. diff -r 867ff859b425 -r 8e80ed0df3fb VisualMagick/installer/inc/version.isx --- a/VisualMagick/installer/inc/version.isx Thu Dec 07 19:54:40 2023 +0100 +++ b/VisualMagick/installer/inc/version.isx Fri Dec 08 09:41:11 2023 -0600 @@ -10,5 +10,5 @@ #define public MagickPackageName "GraphicsMagick" #define public MagickPackageVersion "1.4" -#define public MagickPackageVersionAddendum ".020231205" -#define public MagickPackageReleaseDate "snapshot-20231205" +#define public MagickPackageVersionAddendum ".020231208" +#define public MagickPackageReleaseDate "snapshot-20231208" diff -r 867ff859b425 -r 8e80ed0df3fb coders/jbig.c --- a/coders/jbig.c Thu Dec 07 19:54:40 2023 +0100 +++ b/coders/jbig.c Fri Dec 08 09:41:11 2023 -0600 @@ -39,6 +39,7 @@ #include "magick/blob.h" #include "magick/colormap.h" #include "magick/constitute.h" +#include "magick/log.h" #include "magick/magick.h" #include "magick/monitor.h" #include "magick/pixel_cache.h" @@ -145,6 +146,7 @@ if (buffer == (unsigned char *) NULL) ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,image); status=JBG_EAGAIN; + /* FIXME: Should handle JBG_EOK_INTR for multi-resolution support */ do { length=(long) ReadBlob(image,MaxBufferSize,(char *) buffer); @@ -152,13 +154,23 @@ break; p=buffer; count=0; - while ((length > 0) && ((status == JBG_EAGAIN) || (status == JBG_EOK))) + while ((length > 0) && (status == JBG_EAGAIN)) { status=jbg_dec_in(&jbig_info,p,length,&count); + if (image->logging) + (void) LogMagickEvent(CoderEvent,GetMagickModule(), + "jbg_dec_in() returns 0x%02x (\"%s\")", + status, jbg_strerror(status)); p+=count; length-=count; } - } while ((status == JBG_EAGAIN) || (status == JBG_EOK)); + } while (status == JBG_EAGAIN); + if (JBG_EOK != status) + { + jbg_dec_free(&jbig_info); + MagickFreeMemory(buffer); + ThrowReaderException(CorruptImageError,CorruptImage,image); + } /* Create colormap. */ @@ -170,7 +182,7 @@ if (!AllocateImageColormap(image,2)) { MagickFreeMemory(buffer); - ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,image); + } image->colormap[0].red=0; image->colormap[0].green=0; diff -r 867ff859b425 -r 8e80ed0df3fb magick/export.c --- a/magick/export.c Thu Dec 07 19:54:40 2023 +0100 +++ b/magick/export.c Fri Dec 08 09:41:11 2023 -0600 @@ -17,6 +17,7 @@ #include "magick/bit_stream.h" #include "magick/colormap.h" #include "magick/constitute.h" +#include "magick/enum_strings.h" #include "magick/floats.h" #include "magick/magick.h" #include "magick/pixel_cache.h" @@ -630,6 +631,15 @@ register unsigned int unsigned_value; +#if 0 + printf("ExportGrayQuantumType(): storage_class=%s, indexes=%p, colors=%u, number_pixels=%lu," + " quantum_size=%u, sample_type=%s, endian=%s, unsigned_scale=%u, grayscale_miniswhite=%c," + "sample_bits=%u double_minvalue=%g, double_scale=%g\n", + ClassTypeToString(image->storage_class), indexes, image->colors, + number_pixels, quantum_size, QuantumSampleTypeToString(sample_type), EndianTypeToString(endian), + unsigned_scale, grayscale_miniswhite ? 't' : 'f', sample_bits, double_minvalue, double_scale); +#endif + if (sample_type == UnsignedQuantumSampleType) { switch (quantum_size) @@ -637,6 +647,7 @@ case 1: { if ((image->storage_class == PseudoClass) && + (image->colors == 2) && (indexes != (IndexPacket *) NULL)) { /* diff -r 867ff859b425 -r 8e80ed0df3fb magick/version.h --- a/magick/version.h Thu Dec 07 19:54:40 2023 +0100 +++ b/magick/version.h Fri Dec 08 09:41:11 2023 -0600 @@ -38,8 +38,8 @@ #define MagickLibVersion 0x272404 #define MagickLibVersionText "1.4" #define MagickLibVersionNumber 27,24,4 -#define MagickChangeDate "20231205" -#define MagickReleaseDate "snapshot-20231205" +#define MagickChangeDate "20231208" +#define MagickReleaseDate "snapshot-20231208" /* The MagickLibInterfaceNewest and MagickLibInterfaceOldest defines diff -r 867ff859b425 -r 8e80ed0df3fb www/Changelog.html --- a/www/Changelog.html Thu Dec 07 19:54:40 2023 +0100 +++ b/www/Changelog.html Fri Dec 08 09:41:11 2023 -0600 @@ -37,6 +37,23 @@ </div> <div class="document"> +<p>2023-12-08 Bob Friesenhahn <<a class="reference external" href="mailto:bfriesen%40simple.dallas.tx.us">bfriesen<span>@</span>simple<span>.</span>dallas<span>.</span>tx<span>.</span>us</a>></p> +<blockquote> +<ul class="simple"> +<li><p>coders/jbig.c (ReadJBIGImage): Add error detection. Addresses +oss-fuzz "Issue 64781: graphicsmagick:coder_JBIG_fuzzer: +Null-dereference READ in jbg_dec_getimage".</p></li> +<li><p>magick/export.c (ExportGrayQuantumType): Only use 'Special +"fast" support for two-color PsudeoClass.' case when image has two +colors. Otherwise output image is not correct!</p></li> +</ul> +</blockquote> +<p>2023-12-07 Fojtik Jaroslav <<a class="reference external" href="mailto:JaFojtik%40yandex.com">JaFojtik<span>@</span>yandex<span>.</span>com</a>></p> +<blockquote> +<ul class="simple"> +<li><p>coders/wpg.c Deallocate palette when image load fails.</p></li> +</ul> +</blockquote> <p>2023-12-05 Bob Friesenhahn <<a class="reference external" href="mailto:bfriesen%40simple.dallas.tx.us">bfriesen<span>@</span>simple<span>.</span>dallas<span>.</span>tx<span>.</span>us</a>></p> <blockquote> <ul class="simple">