GraphicsMagick: DrawImage(): Add more validity checks for color ...
GraphicsMagick Commits <[email protected]> Thu, 31 Oct 2024 15:34:31 -0500
| Newsgroups | gmane.comp.video.graphicsmagick.cvs |
|---|---|
| Message-ID | <mailman.32048.1730406884.7833.graphicsmagick-commit@lists.sourceforge.net> |
changeset 2ef812207a00 in /hg/GraphicsMagick details: http://hg.GraphicsMagick.org/hg/GraphicsMagick?cmd=changeset;node=2ef812207a00 summary: DrawImage(): Add more validity checks for color database lookup requests. diffstat: ChangeLog | 5 +++++ Magick++/drawing-primitives.txt | 31 +++++++++++++++++++++++++++++-- VisualMagick/installer/inc/version.isx | 4 ++-- magick/render.c | 18 +++++++++++------- magick/version.h | 4 ++-- www/ChangeLog.html | 7 +++++++ 6 files changed, 56 insertions(+), 13 deletions(-) diffs (208 lines): diff -r eccd8cac7612 -r 2ef812207a00 ChangeLog --- a/ChangeLog Wed Oct 30 16:18:23 2024 -0500 +++ b/ChangeLog Thu Oct 31 15:34:12 2024 -0500 @@ -1,3 +1,8 @@ +2024-10-31 Bob Friesenhahn <[email protected]> + + * magick/render.c (DrawImage): Add more validity checks for color + database lookup requests. + 2024-10-30 Bob Friesenhahn <[email protected]> * coders/jp2.c (ReadJP2Image): Trace JPEG 2000 component diff -r eccd8cac7612 -r 2ef812207a00 Magick++/drawing-primitives.txt --- a/Magick++/drawing-primitives.txt Wed Oct 30 16:18:23 2024 -0500 +++ b/Magick++/drawing-primitives.txt Thu Oct 31 15:34:12 2024 -0500 @@ -71,6 +71,15 @@ pop defs clip-path url(#%s) +use syntax +---------- + +The "use" command (based on SVG's "use")implements a macro capability, +in which the referenced object and its contents are deep-cloned into +the generated tree. + + use url + Using 'image' primitive with inlined image ------------------------------------------ @@ -87,15 +96,18 @@ ============================= affine sx,rx,ry,sy,tx,ty +angle %g (%g is an angle value) arc x0,y0 x1,y1 a0,a1 bezier x0,y0 ... xn,yn circle originX,originY perimX,perimY +class %s (class is a string value) clip-path url(#%s) (%s is the name of the clip path) clip-rule (evenodd|nonzero) clip-units (userSpace|userSpaceOnUse|objectBoundingBox) color x,y (point|replace|floodfill|filltoborder|reset) decorate (none|underline|overline|line-through) ellipse centerX,centerY radiusX,radiusY arcStart,arcEnd +encoding %s (%s is document encoding string) fill colorspec fill-opacity opacity[%] fill-rule (evenodd|nonzero) @@ -115,7 +127,8 @@ dest_x,dest_y dest_width,dest_height 'filename' line startX,startY endX,endY matte x,y (point|replace|floodfill|filltoborder|reset) -offset ??? +mask %s (%s is a mask value) +offset %g (%g is an offset value) opacity value[%] path 'SVG-compatible path arguments' point x,y @@ -125,12 +138,16 @@ pop defs pop gradient pop graphic-context +pop id +pop mask pop pattern push clip-path %s (%s is the name of the clip path) push defs push gradient id linear x1,y1 x2,y2 push gradient id radial cx,cy fx,fy r push graphic-context +push id %s (%s is the id string) +push mask %s (%s is the mask id) push pattern id x,y width,height rectangle upperLeftX,upperLeftY lowerRightX,lowerRightY rotate angle @@ -148,9 +165,19 @@ stroke-miterlimit limit stroke-opacity opacity[%] stroke-width linewidth +svg-compliant 1 +textc %s (%s is some text) +textdx %g (%s is an 'em' or 'ex' float value) +textdx %s (%s is a text value) +textdy %g (%s is an 'em' or 'ex' float value) +textdy %s (%s is a text value) +textr %g (%g is rotation angle) +textx X +texty Y text x,y "some text" +text-align %s (%s is text align argument) +text-anchor %s (%s is text anchor argument) text-antialias (0|1) text-undercolor colorspec translate x,y viewbox x1 y1 x2 y2 (e.g. "viewbox 0 0 640 480") - diff -r eccd8cac7612 -r 2ef812207a00 VisualMagick/installer/inc/version.isx --- a/VisualMagick/installer/inc/version.isx Wed Oct 30 16:18:23 2024 -0500 +++ b/VisualMagick/installer/inc/version.isx Thu Oct 31 15:34:12 2024 -0500 @@ -10,5 +10,5 @@ #define public MagickPackageName "GraphicsMagick" #define public MagickPackageVersion "1.4" -#define public MagickPackageVersionAddendum ".020241030" -#define public MagickPackageReleaseDate "snapshot-20241030" +#define public MagickPackageVersionAddendum ".020241031" +#define public MagickPackageReleaseDate "snapshot-20241031" diff -r eccd8cac7612 -r 2ef812207a00 magick/render.c --- a/magick/render.c Wed Oct 30 16:18:23 2024 -0500 +++ b/magick/render.c Thu Oct 31 15:34:12 2024 -0500 @@ -1,5 +1,5 @@ /* -% Copyright (C) 2003-2022 GraphicsMagick Group +% Copyright (C) 2003-2024 GraphicsMagick Group % Copyright (C) 2002 ImageMagick Studio % Copyright 1991-1999 E. I. du Pont de Nemours and Company % @@ -2437,6 +2437,8 @@ Extract attribute name from input stream, get attribute, and insert it's value into the input stream. Return updated pointer into input stream. Added to support new elements "use" and "class". + + FIXME: Need to add anti-recursion measures. */ static char * InsertAttributeIntoInputStream ( @@ -3897,7 +3899,8 @@ stop_color; MagickGetToken(q,&q,token,token_max_length); - (void) QueryColorDatabase(token,&stop_color,&image->exception); + if ((status &= QueryColorDatabase(token,&stop_color,&image->exception)) == MagickFail) + break; (void) GradientImage(image,&start_color,&stop_color); start_color=stop_color; MagickGetToken(q,&q,token,token_max_length); @@ -3920,8 +3923,8 @@ /* when setting new stroke color, try to preserve stroke-opacity */ Quantum StrokeOpacityOld = graphic_context[n]->stroke.opacity; - (void) QueryColorDatabase(token,&graphic_context[n]->stroke,&image->exception); - + if ((status &= QueryColorDatabase(token,&graphic_context[n]->stroke,&image->exception)) == MagickFail) + break; if (graphic_context[n]->stroke.opacity != TransparentOpacity) {/*stroke color != 'none'*/ @@ -4252,8 +4255,8 @@ if (LocaleCompare("text-undercolor",keyword) == 0) { MagickGetToken(q,&q,token,token_max_length); - (void) QueryColorDatabase(token,&graphic_context[n]->undercolor, - &image->exception); + status &= QueryColorDatabase(token,&graphic_context[n]->undercolor, + &image->exception); break; } if (LocaleCompare("translate",keyword) == 0) @@ -4274,6 +4277,7 @@ { if (LocaleCompare("use",keyword) == 0) { + /* FIXME: nothing prevents infinite recursion of "use" */ q = InsertAttributeIntoInputStream(keyword,q,&primitive,&primitive_extent, &token,&token_max_length,image, &status,MagickTrue/*UndefAttrIsError*/); @@ -4977,7 +4981,7 @@ image_info->size=AllocateString(geometry->value); *pattern=AllocateImage(image_info); DestroyImageInfo(image_info); - (void) QueryColorDatabase("none",&(*pattern)->background_color, + status &= QueryColorDatabase("none",&(*pattern)->background_color, &image->exception); (void) SetImage(*pattern,OpaqueOpacity); (void) LogMagickEvent(RenderEvent,GetMagickModule(), diff -r eccd8cac7612 -r 2ef812207a00 magick/version.h --- a/magick/version.h Wed Oct 30 16:18:23 2024 -0500 +++ b/magick/version.h Thu Oct 31 15:34:12 2024 -0500 @@ -38,8 +38,8 @@ #define MagickLibVersion 0x282502 #define MagickLibVersionText "1.4" #define MagickLibVersionNumber 28,25,2 -#define MagickChangeDate "20241030" -#define MagickReleaseDate "snapshot-20241030" +#define MagickChangeDate "20241031" +#define MagickReleaseDate "snapshot-20241031" /* The MagickLibInterfaceNewest and MagickLibInterfaceOldest defines diff -r eccd8cac7612 -r 2ef812207a00 www/ChangeLog.html --- a/www/ChangeLog.html Wed Oct 30 16:18:23 2024 -0500 +++ b/www/ChangeLog.html Thu Oct 31 15:34:12 2024 -0500 @@ -38,6 +38,13 @@ <main id="graphicsmagick-changelog"> <h1 class="title">GraphicsMagick ChangeLog</h1> +<p>2024-10-31 Bob Friesenhahn <<a class="reference external" href="mailto:bfriesen%40simple.dallas.tx.us">bfriesen<span>@</span>simple<span>.</span>dallas<span>.</span>tx<span>.</span>us</a>></p> +<blockquote> +<ul class="simple"> +<li><p>magick/render.c (DrawImage): Add more validity checks for color +database lookup requests.</p></li> +</ul> +</blockquote> <p>2024-10-30 Bob Friesenhahn <<a class="reference external" href="mailto:bfriesen%40simple.dallas.tx.us">bfriesen<span>@</span>simple<span>.</span>dallas<span>.</span>tx<span>.</span>us</a>></p> <blockquote> <ul class="simple">