GraphicsMagick: MagickParseSubImageSpecification(): Fix off-by-o...

changeset f487bf6d8a4d in /hg/GraphicsMagick
details: http://hg.GraphicsMagick.org/hg/GraphicsMagick?cmd=changeset;node=f487bf6d8a4d
summary: MagickParseSubImageSpecification(): Fix off-by-one error.

diffstat:

 ChangeLog                              |   7 +++++
 VisualMagick/installer/inc/version.isx |   4 +-
 magick/image.c                         |  40 ++++++++++++++++++++++++++++-----
 magick/version.h                       |   4 +-
 www/ChangeLog.html                     |   9 +++++++
 5 files changed, 53 insertions(+), 11 deletions(-)

diffs (142 lines):

diff -r 74324747787f -r f487bf6d8a4d ChangeLog
--- a/ChangeLog	Sun Aug 18 08:45:38 2024 -0500
+++ b/ChangeLog	Sat Aug 24 15:45:08 2024 -0500
@@ -1,3 +1,10 @@
+2024-08-24  Bob Friesenhahn  <[email protected]>
+
+	* magick/image.c (MagickParseSubImageSpecification): Fix
+	SourceForge issue "#746 Off-by-one-error when converting PDF with
+	multiple pages". Also add additional sanity checking.
+	Unfortunately, this is a regression added in the 1.3.44 release.
+
 2024-08-18  Bob Friesenhahn  <[email protected]>
 
 	* www/Changes.rst: 1.3.44 is released in 2024.
diff -r 74324747787f -r f487bf6d8a4d VisualMagick/installer/inc/version.isx
--- a/VisualMagick/installer/inc/version.isx	Sun Aug 18 08:45:38 2024 -0500
+++ b/VisualMagick/installer/inc/version.isx	Sat Aug 24 15:45:08 2024 -0500
@@ -10,5 +10,5 @@
 
 #define public MagickPackageName "GraphicsMagick"
 #define public MagickPackageVersion "1.4"
-#define public MagickPackageVersionAddendum ".020240818"
-#define public MagickPackageReleaseDate "snapshot-20240818"
+#define public MagickPackageVersionAddendum ".020240824"
+#define public MagickPackageReleaseDate "snapshot-20240824"
diff -r 74324747787f -r f487bf6d8a4d magick/image.c
--- a/magick/image.c	Sun Aug 18 08:45:38 2024 -0500
+++ b/magick/image.c	Sat Aug 24 15:45:08 2024 -0500
@@ -1,5 +1,5 @@
 /*
-% Copyright (C) 2003-2024 GraphicsMagick Group
+% Copyright (C) 2003-2022 GraphicsMagick Group
 % Copyright (C) 2003 ImageMagick Studio
 % Copyright 1991-1999 E. I. du Pont de Nemours and Company
 %
@@ -2789,7 +2789,7 @@
 MagickParseSubImageSpecification(const char *subimage_spec,
                                  unsigned long *subimage_ptr,
                                  unsigned long *subrange_ptr,
-                                 MagickBool allow_geometry)
+                                 const MagickBool allow_geometry)
 {
   char
     spec[MaxTextExtent];
@@ -2803,6 +2803,7 @@
     4
     2,7,4
     4-7
+    1,3,0-2
     320x256+50+50  (only if allow_geometry)
   */
 
@@ -2850,7 +2851,20 @@
           digits=q;
           value=strtol(digits,&q,10);
           if (q <= digits) /* Parse error */
-            break;
+            {
+              status=MagickFail;
+              break;
+            }
+          if (value < 0) /* Illegal */
+            {
+              status=MagickFail;
+              break;
+            }
+          if (value > INT_MAX) /* Illegal */
+            {
+              status=MagickFail;
+              break;
+            }
           first=value;
           last=first;
           while (isspace((int)(unsigned char) *q))
@@ -2860,7 +2874,20 @@
               digits=q+1;
               value=strtol(digits,&q,10);
               if (q <= digits) /* Parse error */
-                break;
+                {
+                  status=MagickFail;
+                  break;
+                }
+              if (value < 0) /* Illegal */
+                {
+                  status=MagickFail;
+                  break;
+                }
+              if (value > INT_MAX) /* Illegal */
+                {
+                  status=MagickFail;
+                  break;
+                }
               last=value;
             }
           else if ((*q != ',') && (*q != '\0'))
@@ -2874,10 +2901,9 @@
           if (last > subrange)
             subrange=last;
         }
-      if (*q == '\0')
+      if ((status != MagickFail) && (*q == '\0'))
         {
-          if (subimage > 0)
-            subrange -= subimage-1;
+          subrange -= (long)subimage-1;
           *subimage_ptr=subimage;
           *subrange_ptr=subrange;
           status=MagickPass;
diff -r 74324747787f -r f487bf6d8a4d magick/version.h
--- a/magick/version.h	Sun Aug 18 08:45:38 2024 -0500
+++ b/magick/version.h	Sat Aug 24 15:45:08 2024 -0500
@@ -38,8 +38,8 @@
 #define MagickLibVersion  0x282501
 #define MagickLibVersionText  "1.4"
 #define MagickLibVersionNumber 28,25,1
-#define MagickChangeDate   "20240818"
-#define MagickReleaseDate  "snapshot-20240818"
+#define MagickChangeDate   "20240824"
+#define MagickReleaseDate  "snapshot-20240824"
 
 /*
   The MagickLibInterfaceNewest and MagickLibInterfaceOldest defines
diff -r 74324747787f -r f487bf6d8a4d www/ChangeLog.html
--- a/www/ChangeLog.html	Sun Aug 18 08:45:38 2024 -0500
+++ b/www/ChangeLog.html	Sat Aug 24 15:45:08 2024 -0500
@@ -38,6 +38,15 @@
 
 <main id="graphicsmagick-changelog">
 <h1 class="title">GraphicsMagick ChangeLog</h1>
+<p>2024-08-24  Bob Friesenhahn  &lt;<a class="reference external" href="mailto:bfriesen&#37;&#52;&#48;simple&#46;dallas&#46;tx&#46;us">bfriesen<span>&#64;</span>simple<span>&#46;</span>dallas<span>&#46;</span>tx<span>&#46;</span>us</a>&gt;</p>
+<blockquote>
+<ul class="simple">
+<li><p>magick/image.c (MagickParseSubImageSpecification): Fix
+SourceForge issue &quot;#746 Off-by-one-error when converting PDF with
+multiple pages&quot;. Also add additional sanity checking.
+Unfortunately, this is a regression added in the 1.3.44 release.</p></li>
+</ul>
+</blockquote>
 <p>2024-08-18  Bob Friesenhahn  &lt;<a class="reference external" href="mailto:bfriesen&#37;&#52;&#48;simple&#46;dallas&#46;tx&#46;us">bfriesen<span>&#64;</span>simple<span>&#46;</span>dallas<span>&#46;</span>tx<span>&#46;</span>us</a>&gt;</p>
 <blockquote>
 <ul class="simple">