GraphicsMagick: ReadJXLImage(): Require that color channel depth...

changeset 43898ba76672 in /hg/GraphicsMagick
details: http://hg.GraphicsMagick.org/hg/GraphicsMagick?cmd=changeset;node=43898ba76672
summary: ReadJXLImage(): Require that color channel depth and alpha channel depth be the same.

diffstat:

 ChangeLog                              |   8 ++++++++
 VisualMagick/installer/inc/version.isx |   4 ++--
 coders/jxl.c                           |  16 +++++++++++++++-
 magick/version.h                       |   4 ++--
 www/ChangeLog.html                     |  10 ++++++++++
 5 files changed, 37 insertions(+), 5 deletions(-)

diffs (86 lines):

diff -r 0e0a3c90db2b -r 43898ba76672 ChangeLog
--- a/ChangeLog	Mon Jun 03 07:52:13 2024 -0500
+++ b/ChangeLog	Thu Jun 06 16:11:25 2024 -0500
@@ -1,3 +1,11 @@
+2024-06-06  Bob Friesenhahn  <[email protected]>
+
+	* coders/jxl.c (ReadJXLImage): Require that color channel depth
+	and alpha channel depth be the same since we don't support the
+	case where they are different.  Should address oss-fuzz issue
+	69469: "graphicsmagick:coder_JXL_fuzzer: Heap-buffer-overflow in
+	ImportViewPixelArea".
+
 2024-06-02  Bob Friesenhahn  <[email protected]>
 
 	* fuzzing/oss-fuzz-build.sh: Add a coder_TIFF_any_fuzzer which
diff -r 0e0a3c90db2b -r 43898ba76672 VisualMagick/installer/inc/version.isx
--- a/VisualMagick/installer/inc/version.isx	Mon Jun 03 07:52:13 2024 -0500
+++ b/VisualMagick/installer/inc/version.isx	Thu Jun 06 16:11:25 2024 -0500
@@ -10,5 +10,5 @@
 
 #define public MagickPackageName "GraphicsMagick"
 #define public MagickPackageVersion "1.4"
-#define public MagickPackageVersionAddendum ".020240602"
-#define public MagickPackageReleaseDate "snapshot-20240602"
+#define public MagickPackageVersionAddendum ".020240606"
+#define public MagickPackageReleaseDate "snapshot-20240606"
diff -r 0e0a3c90db2b -r 43898ba76672 coders/jxl.c
--- a/coders/jxl.c	Mon Jun 03 07:52:13 2024 -0500
+++ b/coders/jxl.c	Thu Jun 06 16:11:25 2024 -0500
@@ -613,7 +613,21 @@
               }
 
             if (basic_info.have_animation == 1)
-              ThrowJXLReaderException(CoderError, ImageTypeNotSupported, image);
+              {
+                if (image->logging)
+                  (void) LogMagickEvent(CoderEvent,GetMagickModule(),
+                                        "JXL animations are not yet supported!");
+                ThrowJXLReaderException(CoderError, ImageTypeNotSupported, image);
+              }
+
+            if ((basic_info.alpha_bits != 0) &&
+                (basic_info.alpha_bits != basic_info.bits_per_sample))
+              {
+                if (image->logging)
+                  (void) LogMagickEvent(CoderEvent,GetMagickModule(),
+                                        "Color and alpha sample depths must be the same!");
+                ThrowJXLReaderException(CoderError, ImageTypeNotSupported, image);
+              }
 
             image->columns=basic_info.xsize;
             image->rows=basic_info.ysize;
diff -r 0e0a3c90db2b -r 43898ba76672 magick/version.h
--- a/magick/version.h	Mon Jun 03 07:52:13 2024 -0500
+++ b/magick/version.h	Thu Jun 06 16:11:25 2024 -0500
@@ -38,8 +38,8 @@
 #define MagickLibVersion  0x282500
 #define MagickLibVersionText  "1.4"
 #define MagickLibVersionNumber 28,25,0
-#define MagickChangeDate   "20240602"
-#define MagickReleaseDate  "snapshot-20240602"
+#define MagickChangeDate   "20240606"
+#define MagickReleaseDate  "snapshot-20240606"
 
 /*
   The MagickLibInterfaceNewest and MagickLibInterfaceOldest defines
diff -r 0e0a3c90db2b -r 43898ba76672 www/ChangeLog.html
--- a/www/ChangeLog.html	Mon Jun 03 07:52:13 2024 -0500
+++ b/www/ChangeLog.html	Thu Jun 06 16:11:25 2024 -0500
@@ -38,6 +38,16 @@
 
 <div class="document" id="graphicsmagick-changelog">
 <h1 class="title">GraphicsMagick ChangeLog</h1>
+<p>2024-06-06  Bob Friesenhahn  &lt;<a class="reference external" href="mailto:bfriesen&#37;&#52;&#48;simple&#46;dallas&#46;tx&#46;us">bfriesen<span>&#64;</span>simple<span>&#46;</span>dallas<span>&#46;</span>tx<span>&#46;</span>us</a>&gt;</p>
+<blockquote>
+<ul class="simple">
+<li><p>coders/jxl.c (ReadJXLImage): Require that color channel depth
+and alpha channel depth be the same since we don't support the
+case where they are different.  Should address oss-fuzz issue
+69469: &quot;graphicsmagick:coder_JXL_fuzzer: Heap-buffer-overflow in
+ImportViewPixelArea&quot;.</p></li>
+</ul>
+</blockquote>
 <p>2024-06-02  Bob Friesenhahn  &lt;<a class="reference external" href="mailto:bfriesen&#37;&#52;&#48;simple&#46;dallas&#46;tx&#46;us">bfriesen<span>&#64;</span>simple<span>&#46;</span>dallas<span>&#46;</span>tx<span>&#46;</span>us</a>&gt;</p>
 <blockquote>
 <ul class="simple">