2017-11643 (#1475497)
Rex Dieter
8 years ago
parent
056f22f48a
commit
d022f5a445
@ -0,0 +1,187 @@
|
||||
|
||||
# HG changeset patch
|
||||
# User Bob Friesenhahn <bfriesen@GraphicsMagick.org>
|
||||
# Date 1500755954 18000
|
||||
# Node ID d00b74315a716a62386de06732afdd2822b9f1fd
|
||||
# Parent 4089bde04d744cbe15842284568b2ed086dd3832
|
||||
CMYK: Fixed heap overflow with multiple frames with varying widths.
|
||||
|
||||
diff -r 4089bde04d74 -r d00b74315a71 coders/cmyk.c
|
||||
--- a/coders/cmyk.c Sat Jul 22 13:08:14 2017 -0500
|
||||
+++ b/coders/cmyk.c Sat Jul 22 15:39:14 2017 -0500
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
-% Copyright (C) 2003 - 2015 GraphicsMagick Group
|
||||
+% Copyright (C) 2003 - 2017 GraphicsMagick Group
|
||||
% Copyright (C) 2002 ImageMagick Studio
|
||||
% Copyright 1991-1999 E. I. du Pont de Nemours and Company
|
||||
%
|
||||
@@ -92,8 +92,8 @@
|
||||
y;
|
||||
|
||||
register long
|
||||
- i,
|
||||
- x;
|
||||
+ x,
|
||||
+ i;
|
||||
|
||||
register PixelPacket
|
||||
*q;
|
||||
@@ -608,16 +608,17 @@
|
||||
*/
|
||||
static unsigned int WriteCMYKImage(const ImageInfo *image_info,Image *image)
|
||||
{
|
||||
- int
|
||||
+ long
|
||||
y;
|
||||
|
||||
register const PixelPacket
|
||||
*p;
|
||||
|
||||
unsigned char
|
||||
- *pixels;
|
||||
+ *pixels = (unsigned char *) NULL;
|
||||
|
||||
unsigned int
|
||||
+ depth,
|
||||
packet_size,
|
||||
quantum_size,
|
||||
scene,
|
||||
@@ -629,27 +630,11 @@
|
||||
ExportPixelAreaInfo
|
||||
export_info;
|
||||
|
||||
- if (image->depth <= 8)
|
||||
- quantum_size=8;
|
||||
- else if (image->depth <= 16)
|
||||
- quantum_size=16;
|
||||
- else
|
||||
- quantum_size=32;
|
||||
-
|
||||
-
|
||||
- /*
|
||||
- Allocate memory for pixels.
|
||||
- */
|
||||
assert(image_info != (const ImageInfo *) NULL);
|
||||
assert(image_info->signature == MagickSignature);
|
||||
assert(image != (Image *) NULL);
|
||||
assert(image->signature == MagickSignature);
|
||||
- packet_size=(quantum_size*4)/8;
|
||||
- if (LocaleCompare(image_info->magick,"CMYKA") == 0)
|
||||
- packet_size=(quantum_size*5)/8;
|
||||
- pixels=MagickAllocateArray(unsigned char *,packet_size,image->columns);
|
||||
- if (pixels == (unsigned char *) NULL)
|
||||
- ThrowWriterException(ResourceLimitError,MemoryAllocationFailed,image);
|
||||
+
|
||||
if (image_info->interlace != PartitionInterlace)
|
||||
{
|
||||
/*
|
||||
@@ -659,16 +644,39 @@
|
||||
if (status == False)
|
||||
ThrowWriterException(FileOpenError,UnableToOpenFile,image);
|
||||
}
|
||||
+
|
||||
+ /*
|
||||
+ Support depth in multiples of 8 bits.
|
||||
+ */
|
||||
+ if (image->depth > 16)
|
||||
+ depth=32;
|
||||
+ else if (image->depth > 8)
|
||||
+ depth=16;
|
||||
+ else
|
||||
+ depth=8;
|
||||
+
|
||||
+ if (depth <= 8)
|
||||
+ quantum_size=8;
|
||||
+ else if (depth <= 16)
|
||||
+ quantum_size=16;
|
||||
+ else
|
||||
+ quantum_size=32;
|
||||
+
|
||||
+ packet_size=(quantum_size*4)/8;
|
||||
+ if (LocaleCompare(image_info->magick,"CMYKA") == 0)
|
||||
+ packet_size=(quantum_size*5)/8;
|
||||
+
|
||||
scene=0;
|
||||
do
|
||||
{
|
||||
/*
|
||||
- Convert MIFF to CMYK raster pixels.
|
||||
+ Allocate memory for pixels.
|
||||
*/
|
||||
- (void) TransformColorspace(image,CMYKColorspace);
|
||||
- if (LocaleCompare(image_info->magick,"CMYKA") == 0)
|
||||
- if (!image->matte)
|
||||
- SetImageOpacity(image,OpaqueOpacity);
|
||||
+ MagickReallocMemory(unsigned char *,pixels,
|
||||
+ MagickArraySize(packet_size,image->columns));
|
||||
+ if (pixels == (unsigned char *) NULL)
|
||||
+ ThrowWriterException(ResourceLimitError,MemoryAllocationFailed,image);
|
||||
+
|
||||
/*
|
||||
Initialize export options.
|
||||
*/
|
||||
@@ -677,10 +685,28 @@
|
||||
export_options.endian=image->endian;
|
||||
else if (image_info->endian != UndefinedEndian)
|
||||
export_options.endian=image_info->endian;
|
||||
- if (image->logging)
|
||||
- (void) LogMagickEvent(CoderEvent,GetMagickModule(),
|
||||
- "Image depth %u bits, Endian %s",quantum_size,
|
||||
- EndianTypeToString(export_options.endian));
|
||||
+
|
||||
+ (void) LogMagickEvent(CoderEvent,GetMagickModule(),
|
||||
+ "%lu: "
|
||||
+ "Geometry %lux%lu, "
|
||||
+ "Depth %u bits, "
|
||||
+ "Endian %s, Packet Size %u, "
|
||||
+ "Row bytes %" MAGICK_SIZE_T_F "u",
|
||||
+ image->scene,
|
||||
+ image->columns,image->rows,
|
||||
+ quantum_size,
|
||||
+ EndianTypeToString(export_options.endian),
|
||||
+ packet_size,
|
||||
+ (MAGICK_SIZE_T) MagickArraySize(packet_size,image->columns));
|
||||
+
|
||||
+ /*
|
||||
+ Convert MIFF to CMYK raster pixels.
|
||||
+ */
|
||||
+ (void) TransformColorspace(image,CMYKColorspace);
|
||||
+ if (LocaleCompare(image_info->magick,"CMYKA") == 0)
|
||||
+ if (!image->matte)
|
||||
+ SetImageOpacity(image,OpaqueOpacity);
|
||||
+
|
||||
switch (image_info->interlace)
|
||||
{
|
||||
case NoInterlace:
|
||||
@@ -689,23 +715,17 @@
|
||||
/*
|
||||
No interlacing: CMYKCMYKCMYKCMYKCMYKCMYK...
|
||||
*/
|
||||
+ const QuantumType quantum_type =
|
||||
+ (LocaleCompare(image_info->magick,"CMYKA") == 0) ? CMYKAQuantum :
|
||||
+ CMYKQuantum;
|
||||
for (y=0; y < (long) image->rows; y++)
|
||||
{
|
||||
p=AcquireImagePixels(image,0,y,image->columns,1,&image->exception);
|
||||
if (p == (const PixelPacket *) NULL)
|
||||
break;
|
||||
- if (LocaleCompare(image_info->magick,"CMYKA") != 0)
|
||||
- {
|
||||
- (void) ExportImagePixelArea(image,CMYKQuantum,quantum_size,pixels,
|
||||
- &export_options,&export_info);
|
||||
- (void) WriteBlob(image,export_info.bytes_exported,pixels);
|
||||
- }
|
||||
- else
|
||||
- {
|
||||
- (void) ExportImagePixelArea(image,CMYKAQuantum,quantum_size,pixels,
|
||||
- &export_options,&export_info);
|
||||
- (void) WriteBlob(image,export_info.bytes_exported,pixels);
|
||||
- }
|
||||
+ (void) ExportImagePixelArea(image,quantum_type,quantum_size,pixels,
|
||||
+ &export_options,&export_info);
|
||||
+ (void) WriteBlob(image,export_info.bytes_exported,pixels);
|
||||
if (image->previous == (Image *) NULL)
|
||||
if (QuantumTick(y,image->rows))
|
||||
if (!MagickMonitorFormatted(y,image->rows,&image->exception,
|
||||
|
||||
Loading…
Reference in new issue