Permalink
Browse files

Prevent buffer overflow in magick/draw.c

  • Loading branch information...
Cristy
Cristy committed May 4, 2016
1 parent 7230475 commit 726812fa2fa7ce16bcf58f6e115f65427a1c0950
Showing with 37 additions and 21 deletions.
  1. +3 −0 ChangeLog
  2. +34 −21 MagickCore/draw.c
View
@@ -1,3 +1,6 @@
2016-05-04 7.0.1-2 Cristy <quetzlzacatenango@image...>
* Check for buffer overflow in magick/draw.c/DrawStrokePolygon().
2016-05-03 7.0.1-1 Cristy <quetzlzacatenango@image...>
* New version 7.0.1-1, GIT revision 10723:9fc8a0c:20160503.
View
@@ -1417,7 +1417,7 @@ MagickExport MagickBooleanType DrawClipPath(Image *image,
return(MagickFalse);
(void) QueryColorCompliance("#0000",AllCompliance,
&clip_mask->background_color,exception);
clip_mask->background_color.alpha=(Quantum) TransparentAlpha;
clip_mask->background_color.alpha=(MagickRealType) TransparentAlpha;
(void) SetImageBackgroundColor(clip_mask,exception);
if (image->debug != MagickFalse)
(void) LogMagickEvent(DrawEvent,GetMagickModule(),"\nbegin clip-path %s",
@@ -1541,7 +1541,7 @@ static MagickBooleanType DrawDashPolygon(const DrawInfo *draw_info,
status=MagickTrue;
maximum_length=0.0;
total_length=0.0;
for (i=1; (i < number_vertices) && (length >= 0.0); i++)
for (i=1; (i < (ssize_t) number_vertices) && (length >= 0.0); i++)
{
dx=primitive_info[i].point.x-primitive_info[i-1].point.x;
dy=primitive_info[i].point.y-primitive_info[i-1].point.y;
@@ -1794,7 +1794,7 @@ MagickExport MagickBooleanType DrawImage(Image *image,const DrawInfo *draw_info,
/*
Interpret graphic primitive.
*/
GetNextToken(q,&q,extent,keyword);
GetNextToken(q,&q,MagickPathExtent,keyword);
if (*keyword == '\0')
break;
if (*keyword == '#')
@@ -2104,7 +2104,7 @@ MagickExport MagickBooleanType DrawImage(Image *image,const DrawInfo *draw_info,
GetNextToken(q,&q,extent,token);
weight=ParseCommandOption(MagickWeightOptions,MagickFalse,token);
if (weight == -1)
weight=StringToUnsignedLong(token);
weight=(ssize_t) StringToUnsignedLong(token);
graphic_context[n]->weight=(size_t) weight;
break;
}
@@ -2353,7 +2353,8 @@ MagickExport MagickBooleanType DrawImage(Image *image,const DrawInfo *draw_info,
(void) SetImageArtifact(image,key,token);
(void) FormatLocaleString(key,MagickPathExtent,"%s-type",name);
(void) SetImageArtifact(image,key,type);
(void) FormatLocaleString(key,MagickPathExtent,"%s-geometry",name);
(void) FormatLocaleString(key,MagickPathExtent,"%s-geometry",
name);
(void) FormatLocaleString(geometry,MagickPathExtent,
"%gx%g%+.15g%+.15g",
MagickMax(fabs(bounds.x2-bounds.x1+1.0),1.0),
@@ -4608,7 +4609,7 @@ MagickExport MagickBooleanType DrawPrimitive(Image *image,
*/
clone_info=CloneDrawInfo((ImageInfo *) NULL,draw_info);
clone_info->stroke_width=0.0;
clone_info->stroke.alpha=(Quantum) TransparentAlpha;
clone_info->stroke.alpha=(MagickRealType) TransparentAlpha;
status&=DrawPolygonPrimitive(image,clone_info,primitive_info,
exception);
clone_info=DestroyDrawInfo(clone_info);
@@ -4643,7 +4644,7 @@ MagickExport MagickBooleanType DrawPrimitive(Image *image,
}
clone_info=CloneDrawInfo((ImageInfo *) NULL,draw_info);
clone_info->stroke_width=0.0;
clone_info->stroke.alpha=(Quantum) TransparentAlpha;
clone_info->stroke.alpha=(MagickRealType) TransparentAlpha;
status&=DrawPolygonPrimitive(image,clone_info,primitive_info,
exception);
clone_info=DestroyDrawInfo(clone_info);
@@ -4743,7 +4744,7 @@ static MagickBooleanType DrawStrokePolygon(Image *image,
if (clone_info->stroke_pattern != (Image *) NULL)
clone_info->fill_pattern=CloneImage(clone_info->stroke_pattern,0,0,
MagickTrue,exception);
clone_info->stroke.alpha=(Quantum) TransparentAlpha;
clone_info->stroke.alpha=(MagickRealType) TransparentAlpha;
clone_info->stroke_width=0.0;
clone_info->fill_rule=NonZeroRule;
status=MagickTrue;
@@ -4858,7 +4859,7 @@ MagickExport void GetDrawInfo(const ImageInfo *image_info,DrawInfo *draw_info)
draw_info->miterlimit=10;
draw_info->decorate=NoDecoration;
draw_info->pointsize=12.0;
draw_info->undercolor.alpha=(Quantum) TransparentAlpha;
draw_info->undercolor.alpha=(MagickRealType) TransparentAlpha;
draw_info->compose=OverCompositeOp;
draw_info->render=MagickTrue;
draw_info->debug=IsEventLogging();
@@ -4925,7 +4926,7 @@ MagickExport void GetDrawInfo(const ImageInfo *image_info,DrawInfo *draw_info)
weight=ParseCommandOption(MagickWeightOptions,MagickFalse,option);
if (weight == -1)
weight=StringToUnsignedLong(option);
weight=(ssize_t) StringToUnsignedLong(option);
draw_info->weight=(size_t) weight;
}
exception=DestroyExceptionInfo(exception);
@@ -6021,17 +6022,29 @@ static PrimitiveInfo *TraceStrokePolygon(const DrawInfo *draw_info,
}
if (q >= (ssize_t) (max_strokes-6*BezierQuantum-360))
{
max_strokes+=6*BezierQuantum+360;
path_p=(PointInfo *) ResizeQuantumMemory(path_p,(size_t) max_strokes,
sizeof(*path_p));
path_q=(PointInfo *) ResizeQuantumMemory(path_q,(size_t) max_strokes,
sizeof(*path_q));
if ((path_p == (PointInfo *) NULL) || (path_q == (PointInfo *) NULL))
{
polygon_primitive=(PrimitiveInfo *)
RelinquishMagickMemory(polygon_primitive);
return((PrimitiveInfo *) NULL);
}
if (~max_strokes < (6*BezierQuantum+360))
{
path_p=(PointInfo *) RelinquishMagickMemory(path_p);
path_q=(PointInfo *) RelinquishMagickMemory(path_q);
}
else
{
max_strokes+=6*BezierQuantum+360;
path_p=(PointInfo *) ResizeQuantumMemory(path_p,max_strokes,
sizeof(*path_p));
path_q=(PointInfo *) ResizeQuantumMemory(path_q,max_strokes,
sizeof(*path_q));
}
if ((path_p == (PointInfo *) NULL) || (path_q == (PointInfo *) NULL))
{
if (path_p != (PointInfo *) NULL)
path_p=(PointInfo *) RelinquishMagickMemory(path_p);
if (path_q != (PointInfo *) NULL)
path_q=(PointInfo *) RelinquishMagickMemory(path_q);
polygon_primitive=(PrimitiveInfo *)
RelinquishMagickMemory(polygon_primitive);
return((PrimitiveInfo *) NULL);
}
}
dot_product=dx.q*dy.p-dx.p*dy.q;
if (dot_product <= 0.0)

0 comments on commit 726812f

Please sign in to comment.