You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
GraphicsMagick/GraphicsMagick-CVE-2009-188...

483 lines
19 KiB

This file contains invisible Unicode characters!

This file contains invisible Unicode characters that may be processed differently from what appears below. If your use case is intentional and legitimate, you can safely ignore this warning. Use the Escape button to reveal hidden characters.

--- GraphicsMagick/magick/xwindow.c 2009/09/16 02:13:01 1.230
+++ GraphicsMagick/magick/xwindow.c 2009/10/10 17:55:17 1.232
@@ -43,10 +43,12 @@
#include "magick/describe.h"
#include "magick/log.h"
#include "magick/magick.h"
+#include "magick/monitor.h"
#include "magick/pixel_cache.h"
#include "magick/resize.h"
#include "magick/shear.h"
#include "magick/tempfile.h"
+#include "magick/texture.h"
#include "magick/transform.h"
#include "magick/utility.h"
#include "magick/version.h"
@@ -2937,7 +2939,7 @@ MagickExport void MagickXGetImportInfo(M
% %
% %
% %
-% M a g i c k X G e t P i x e l I n f o %
+% M a g i c k X G e t P i x e l P a c k e t %
% %
% %
% %
@@ -5350,8 +5352,8 @@ MagickExport Cursor MagickXMakeCursor(Di
% The format of the MagickXMakeImage method is:
%
% unsigned int MagickXMakeImage(Display *display,
-% const MagickXResourceInfo *resource_info,MagickXWindowInfo *window,Image *image,
-% unsigned int width,unsigned int height)
+% const MagickXResourceInfo *resource_info,MagickXWindowInfo *window,
+% Image *image,unsigned int width,unsigned int height)
%
% A description of each parameter follows:
%
@@ -5376,9 +5378,49 @@ MagickExport Cursor MagickXMakeCursor(Di
%
%
*/
-MagickExport unsigned int MagickXMakeImage(Display *display,
- const MagickXResourceInfo *resource_info,MagickXWindowInfo *window,Image *image,
- unsigned int width,unsigned int height)
+static const char *
+MagickXImageFormatToString(int xformat)
+{
+ static const char
+ *formats[] =
+ {
+ "XYBitmap",
+ "XYPixmap",
+ "ZPixmap"
+ };
+
+ const char
+ *format = "Unknown";
+
+ if ((size_t) xformat < sizeof(formats)/sizeof(formats[0]))
+ format=formats[xformat];
+
+ return format;
+}
+static const char *
+MagickXByteOrderToString(int xbyte_order)
+{
+ static const char
+ *byte_orders[] =
+ {
+ "LSBFirst",
+ "MSBFirst"
+ };
+
+ const char
+ *byte_order = "Unknown";
+
+ if ((size_t) xbyte_order < sizeof(byte_orders)/sizeof(byte_orders[0]))
+ byte_order=byte_orders[xbyte_order];
+
+ return byte_order;
+}
+MagickExport unsigned int
+MagickXMakeImage(Display *display,
+ const MagickXResourceInfo *resource_info,
+ MagickXWindowInfo *window,
+ Image *image,
+ unsigned int width,unsigned int height)
{
int
depth,
@@ -5410,6 +5452,10 @@ MagickExport unsigned int MagickXMakeIma
window->destroy=False;
if (window->image != (Image *) NULL)
{
+ MonitorHandler
+ handler=(MonitorHandler) NULL;
+
+ handler=SetMonitorHandler((MonitorHandler) NULL);
if (window->crop_geometry)
{
Image
@@ -5459,44 +5505,49 @@ MagickExport unsigned int MagickXMakeIma
window->destroy=MagickTrue;
}
}
-#if 0
- if ((window->immutable == MagickFalse) &&
- (window->image->matte != MagickFalse) &&
- (window->pixel_info->colors == 0))
+ if ((window->image->matte != MagickFalse) &&
+ (window->pixel_info->colors == 0)
+ /* && (window->immutable == MagickFalse) */)
{
Image
*texture;
/*
- Tile background with texture.
+ Tile background with texture according to opacity
*/
- strlcpy(resource_info->image_info->filename,"image:checkerboard",MaxTextExtent);
+ strlcpy(resource_info->image_info->filename,"image:checkerboard",
+ sizeof(resource_info->image_info->filename));
texture=ReadImage(resource_info->image_info,&window->image->exception);
if (texture != (Image *) NULL)
{
Image
*textured_image;
- textured_image=CloneImage(window->image,window->image->columns,
- window->image->rows,MagickTrue,&window->image->exception);
+ textured_image=CloneImage(window->image,0,0,MagickTrue,
+ &window->image->exception);
if (textured_image != (Image *) NULL)
{
-/* strlcpy(window->image->filename,"textured_image.miff", MaxTextExtent); */
-/* WriteImage(resource_info->image_info,window->image); */
- TextureImage(textured_image,texture);
- textured_image->matte=MagickFalse;
- if (window->image != image)
- DestroyImage(window->image);
- window->image=textured_image;
- window->destroy=MagickTrue;
+ if (TextureImage(textured_image,texture) != MagickFail)
+ {
+ if (window->image != image)
+ DestroyImage(window->image);
+ window->image=textured_image;
+ window->destroy=MagickTrue;
+ }
+ else
+ {
+ DestroyImage(textured_image);
+ }
}
DestroyImage(texture);
texture=(Image *) NULL;
}
}
-#endif
width=(unsigned int) window->image->columns;
+ assert(width == window->image->columns);
height=(unsigned int) window->image->rows;
+ assert(height == window->image->rows);
+ (void) SetMonitorHandler(handler);
}
/*
Create X image.
@@ -5504,27 +5555,32 @@ MagickExport unsigned int MagickXMakeIma
ximage=(XImage *) NULL;
format=(depth == 1) ? XYBitmap : ZPixmap;
#if defined(HasSharedMemory)
- window->shared_memory&=XShmQueryExtension(display);
+ window->shared_memory &= XShmQueryExtension(display);
if (window->shared_memory)
{
XShmSegmentInfo
*segment_info;
+ size_t
+ shm_extent;
+
segment_info=(XShmSegmentInfo *) window->segment_info;
segment_info[1].shmid=(-1);
segment_info[1].shmaddr=NULL;
ximage=XShmCreateImage(display,window->visual,depth,format,(char *) NULL,
- &segment_info[1],width,height);
- window->shared_memory&=(ximage != (XImage *) NULL);
+ &segment_info[1],width,height);
+ window->shared_memory &= (ximage != (XImage *) NULL);
+
+ shm_extent=MagickArraySize(ximage->height,ximage->bytes_per_line);
+ window->shared_memory &= (shm_extent != 0);
if (window->shared_memory)
- segment_info[1].shmid=shmget(IPC_PRIVATE,(size_t)
- (ximage->bytes_per_line*ximage->height),IPC_CREAT | 0777);
- window->shared_memory&=(segment_info[1].shmid >= 0);
+ segment_info[1].shmid=shmget(IPC_PRIVATE,shm_extent,IPC_CREAT | 0777);
+ window->shared_memory &= (segment_info[1].shmid >= 0);
if (window->shared_memory)
segment_info[1].shmaddr=(char *) MagickShmAt(segment_info[1].shmid,0,0);
- window->shared_memory&=(segment_info[1].shmaddr != NULL);
+ window->shared_memory &= (segment_info[1].shmaddr != NULL);
if (!window->shared_memory)
{
@@ -5607,12 +5663,12 @@ MagickExport unsigned int MagickXMakeIma
if (IsEventLogging())
{
(void) LogMagickEvent(X11Event,GetMagickModule(),"XImage:");
- (void) LogMagickEvent(X11Event,GetMagickModule()," width, height: %dx%d",
+ (void) LogMagickEvent(X11Event,GetMagickModule()," width x height: %dx%d",
ximage->width,ximage->height);
- (void) LogMagickEvent(X11Event,GetMagickModule()," format: %d",
- ximage->format);
- (void) LogMagickEvent(X11Event,GetMagickModule()," byte order: %d",
- ximage->byte_order);
+ (void) LogMagickEvent(X11Event,GetMagickModule()," format: %s",
+ MagickXImageFormatToString(ximage->format));
+ (void) LogMagickEvent(X11Event,GetMagickModule()," byte order: %s",
+ MagickXByteOrderToString(ximage->byte_order));
(void) LogMagickEvent(X11Event,GetMagickModule(),
" bitmap unit, bit order, pad: %d %d %d",ximage->bitmap_unit,
ximage->bitmap_bit_order,ximage->bitmap_pad);
@@ -5629,11 +5685,13 @@ MagickExport unsigned int MagickXMakeIma
if (!window->shared_memory)
{
if (ximage->format == XYBitmap)
- ximage->data=MagickAllocateArray(char *,
- ximage->height*ximage->depth,ximage->bytes_per_line);
+ ximage->data=
+ MagickAllocateArray(char *,
+ MagickArraySize(ximage->height,ximage->bytes_per_line),
+ ximage->depth);
else
- ximage->data=MagickAllocateArray(char *,
- ximage->height,ximage->bytes_per_line);
+ ximage->data=
+ MagickAllocateArray(char *,ximage->height,ximage->bytes_per_line);
}
if (ximage->data == (char *) NULL)
{
@@ -5709,8 +5767,9 @@ MagickExport unsigned int MagickXMakeIma
/*
Allocate matte image pixel data.
*/
- length=matte_image->bytes_per_line*
- matte_image->height*matte_image->depth;
+ length=MagickArraySize(MagickArraySize(matte_image->bytes_per_line,
+ matte_image->height),
+ matte_image->depth);
matte_image->data=MagickAllocateMemory(char *,length);
if (matte_image->data == (char *) NULL)
{
@@ -7371,9 +7430,9 @@ MagickExport void MagickXMakeMagnifyImag
%
% The format of the MagickXMakePixmap method is:
%
-% void MagickXMakeStandardColormap(Display *display,XVisualInfo *visual_info,
-% MagickXResourceInfo *resource_info,Image *image,XStandardColormap *map_info,
-% MagickXPixelInfo *pixel)
+% unsigned int MagickXMakePixmap(Display *display,
+% const MagickXResourceInfo *resource_info,
+% MagickXWindowInfo *window)
%
% A description of each parameter follows:
%
--- GraphicsMagick/magick/xwindow.c 2009/10/10 17:55:17 1.232
+++ GraphicsMagick/magick/xwindow.c 2009/10/11 00:46:55 1.233
@@ -1,5 +1,5 @@
/*
-% Copyright (C) 2003, 2004 GraphicsMagick Group
+% Copyright (C) 2003 - 2009 GraphicsMagick Group
% Copyright (C) 2002 ImageMagick Studio
%
% This program is covered by multiple licenses, which are described in
@@ -808,7 +808,7 @@ static char **MagickFontToList(char *fon
for (p=font; *p != '\0'; p++)
if ((*p == ':') || (*p == ';') || (*p == ','))
fonts++;
- fontlist=MagickAllocateMemory(char **,(fonts+1)*sizeof(char *));
+ fontlist=MagickAllocateArray(char **,(fonts+1),sizeof(char *));
if (fontlist == (char **) NULL)
{
MagickError3(ResourceLimitError,MemoryAllocationFailed,
@@ -1103,7 +1103,7 @@ MagickExport void MagickXBestPixel(Displ
/*
Read X server colormap.
*/
- colors=MagickAllocateMemory(XColor *,number_colors*sizeof(XColor));
+ colors=MagickAllocateArray(XColor *,number_colors,sizeof(XColor));
if (colors == (XColor *) NULL)
{
MagickError3(ResourceLimitError,MemoryAllocationFailed,
@@ -2133,10 +2133,10 @@ static void MagickXDitherImage(Image *im
for (i=0; i < 2; i++)
for (j=0; j < 16; j++)
{
- red_map[i][j]=MagickAllocateMemory(unsigned char *,256*sizeof(unsigned char));
- green_map[i][j]=MagickAllocateMemory(unsigned char *,
- 256*sizeof(unsigned char));
- blue_map[i][j]=MagickAllocateMemory(unsigned char *,256*sizeof(unsigned char));
+ red_map[i][j]=MagickAllocateArray(unsigned char *,256,sizeof(unsigned char));
+ green_map[i][j]=MagickAllocateArray(unsigned char *,
+ 256,sizeof(unsigned char));
+ blue_map[i][j]=MagickAllocateArray(unsigned char *,256,sizeof(unsigned char));
if ((red_map[i][j] == (unsigned char *) NULL) ||
(green_map[i][j] == (unsigned char *) NULL) ||
(blue_map[i][j] == (unsigned char *) NULL))
@@ -3022,7 +3022,7 @@ MagickExport void MagickXGetPixelPacket(
if (pixel->pixels != (unsigned long *) NULL)
MagickFreeMemory(pixel->pixels);
pixel->pixels=
- MagickAllocateMemory(unsigned long *,packets*sizeof(unsigned long));
+ MagickAllocateArray(unsigned long *,packets,sizeof(unsigned long));
if (pixel->pixels == (unsigned long *) NULL)
MagickFatalError(ResourceLimitFatalError,MemoryAllocationFailed,
MagickMsg(XServerFatalError,UnableToGetPixelInfo));
@@ -4073,8 +4073,8 @@ static Image *MagickXGetWindowImage(Disp
*/
max_windows+=1024;
if (window_info == (WindowInfo *) NULL)
- window_info=MagickAllocateMemory(WindowInfo *,
- max_windows*sizeof(WindowInfo));
+ window_info=MagickAllocateArray(WindowInfo *,
+ max_windows,sizeof(WindowInfo));
else
MagickReallocMemory(WindowInfo *,window_info,max_windows*sizeof(WindowInfo));
}
@@ -4227,7 +4227,7 @@ static Image *MagickXGetWindowImage(Disp
/*
Get the window colormap.
*/
- colors=MagickAllocateMemory(XColor *,number_colors*sizeof(XColor));
+ colors=MagickAllocateArray(XColor *,number_colors,sizeof(XColor));
if (colors == (XColor *) NULL)
{
XDestroyImage(ximage);
@@ -4577,7 +4577,7 @@ MagickExport void MagickXGetWindowInfo(D
*segment_info;
if (window->segment_info == (void *) NULL)
- window->segment_info=MagickAllocateMemory(void *,2*sizeof(XShmSegmentInfo));
+ window->segment_info=MagickAllocateArray(void *,2,sizeof(XShmSegmentInfo));
segment_info=(XShmSegmentInfo *) window->segment_info;
segment_info[0].shmid=(-1);
segment_info[0].shmaddr=NULL;
@@ -7734,8 +7734,8 @@ MagickExport void MagickXMakeStandardCol
Define Standard Colormap for StaticGray or StaticColor visual.
*/
number_colors=image->colors;
- colors=MagickAllocateMemory(XColor *,
- visual_info->colormap_size*sizeof(XColor));
+ colors=MagickAllocateArray(XColor *,
+ visual_info->colormap_size,sizeof(XColor));
if (colors == (XColor *) NULL)
MagickFatalError3(ResourceLimitError,MemoryAllocationFailed,
UnableToCreateColormap);
@@ -7774,8 +7774,8 @@ MagickExport void MagickXMakeStandardCol
Define Standard Colormap for GrayScale or PseudoColor visual.
*/
number_colors=image->colors;
- colors=MagickAllocateMemory(XColor *,
- visual_info->colormap_size*sizeof(XColor));
+ colors=MagickAllocateArray(XColor *,
+ visual_info->colormap_size,sizeof(XColor));
if (colors == (XColor *) NULL)
MagickFatalError3(ResourceLimitFatalError,MemoryAllocationFailed,
UnableToCreateColormap);
@@ -7820,8 +7820,8 @@ MagickExport void MagickXMakeStandardCol
/*
Define Standard colormap for shared GrayScale or PseudoColor visual.
*/
- diversity=MagickAllocateMemory(DiversityPacket *,
- image->colors*sizeof(DiversityPacket));
+ diversity=MagickAllocateArray(DiversityPacket *,
+ image->colors,sizeof(DiversityPacket));
if (diversity == (DiversityPacket *) NULL)
MagickFatalError3(ResourceLimitFatalError,MemoryAllocationFailed,
UnableToCreateColormap);
@@ -7882,8 +7882,9 @@ MagickExport void MagickXMakeStandardCol
/*
Read X server colormap.
*/
- server_colors=MagickAllocateMemory(XColor *,
- visual_info->colormap_size*sizeof(XColor));
+ server_colors=MagickAllocateArray(XColor *,
+ visual_info->colormap_size,
+ sizeof(XColor));
if (server_colors == (XColor *) NULL)
MagickFatalError3(ResourceLimitFatalError,MemoryAllocationFailed,
UnableToCreateColormap);
@@ -8023,7 +8024,7 @@ MagickExport void MagickXMakeStandardCol
/*
Allocate color array.
*/
- colors=MagickAllocateMemory(XColor *,number_colors*sizeof(XColor));
+ colors=MagickAllocateArray(XColor *,number_colors,sizeof(XColor));
if (colors == (XColor *) NULL)
MagickFatalError3(ResourceLimitFatalError,MemoryAllocationFailed,
UnableToCreateColormap);
--- GraphicsMagick/magick/memory.c 2009/10/05 23:57:54 1.54
+++ GraphicsMagick/magick/memory.c 2009/10/09 18:20:22 1.55
@@ -90,6 +90,43 @@ MagickExport void MagickAllocFunctions(M
% %
% %
% %
++ M a g i c k A r r a y Si z e %
+% %
+% %
+% %
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%
+% MagickArraySize() returnes the size of an array given two size_t arguments.
+% Zero is returned if the computed result overflows the size_t type.
+%
+% The format of the MagickArraySize method is:
+%
+% size_t MagickArraySize(const size_t count, const size_t size);
+%
+% A description of each parameter follows:
+%
+% o count: The number of elements in the array.
+%
+% o size: The size of one array element.
+%
+*/
+MagickExport size_t MagickArraySize(const size_t count, const size_t size)
+{
+ size_t
+ allocation_size;
+
+ allocation_size = size * count;
+ if ((count != 0) && (size != allocation_size/count))
+ allocation_size = 0;
+
+ return allocation_size;
+}
+
+/*
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+% %
+% %
+% %
% M a g i c k M a l l o c %
% %
% %
@@ -155,9 +192,8 @@ MagickExport void *MagickMallocArray(con
*allocation;
allocation = (void *) NULL;
- allocation_size = size * count;
- if ((count != 0) && (size != allocation_size/count))
- allocation_size = 0;
+ allocation_size=MagickArraySize(count,size);
+
if (allocation_size)
allocation = (MallocFunc)(allocation_size);
return allocation;
--- GraphicsMagick/magick/memory.h 2009/06/10 00:38:07 1.16
+++ GraphicsMagick/magick/memory.h 2009/10/09 18:20:22 1.17
@@ -22,7 +22,6 @@ extern MagickExport void
MagickAllocFunctions(MagickFreeFunc free_func,MagickMallocFunc malloc_func,
MagickReallocFunc realloc_func),
*MagickMalloc(const size_t size),
- *MagickMallocArray(const size_t count,const size_t size),
*MagickMallocCleared(const size_t size),
*MagickCloneMemory(void *destination,const void *source,const size_t size),
*MagickRealloc(void *memory,const size_t size),
@@ -30,6 +29,12 @@ extern MagickExport void
#if defined(MAGICK_IMPLEMENTATION)
+extern MagickExport void
+ *MagickMallocArray(const size_t count,const size_t size);
+
+extern MagickExport size_t
+ MagickArraySize(const size_t count,const size_t size);
+
/*
Allocate memory
*/