Skip to content

Commit f6240ee

Browse files
author
Cristy
committed
Check for EOF conditions for RLE image format
1 parent d4a7c38 commit f6240ee

File tree

2 files changed

+64
-26
lines changed

2 files changed

+64
-26
lines changed

Diff for: ChangeLog

+1
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=31862).
1212
* Ensure backwards compatibility for the -combine option (reference
1313
https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=31855).
14+
* Check for EOF conditions for RLE image format.
1415

1516
2017-04-24 7.0.5-5 Cristy <quetzlzacatenango@image...>
1617
* Release ImageMagick version 7.0.5-5, GIT revision 19915:12eec43:20170424.

Diff for: coders/rle.c

+63-26
Original file line numberDiff line numberDiff line change
@@ -132,6 +132,14 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
132132
#define ByteDataOp 0x05
133133
#define RunDataOp 0x06
134134
#define EOFOp 0x07
135+
#define ThrowRLEException(exception,message) \
136+
{ \
137+
if (colormap != (unsigned char *) NULL) \
138+
colormap=(unsigned char *) RelinquishMagickMemory(colormap); \
139+
if (pixel_info != (MemoryInfo *) NULL) \
140+
pixel_info=RelinquishVirtualMemory(pixel_info); \
141+
ThrowReaderException((exception),(message)); \
142+
}
135143

136144
char
137145
magick[12];
@@ -206,6 +214,8 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
206214
/*
207215
Determine if this a RLE file.
208216
*/
217+
colormap=(unsigned char *) NULL;
218+
pixel_info=(MemoryInfo *) NULL;
209219
count=ReadBlob(image,2,(unsigned char *) magick);
210220
if ((count != 2) || (memcmp(magick,"\122\314",2) != 0))
211221
ThrowReaderException(CorruptImageError,"ImproperImageHeader");
@@ -214,8 +224,8 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
214224
/*
215225
Read image header.
216226
*/
217-
image->page.x=ReadBlobLSBShort(image);
218-
image->page.y=ReadBlobLSBShort(image);
227+
image->page.x=(ssize_t) ReadBlobLSBShort(image);
228+
image->page.y=(ssize_t) ReadBlobLSBShort(image);
219229
image->columns=ReadBlobLSBShort(image);
220230
image->rows=ReadBlobLSBShort(image);
221231
flags=(MagickStatusType) ReadBlobByte(image);
@@ -226,6 +236,8 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
226236
map_length=(unsigned char) ReadBlobByte(image);
227237
if (map_length >= 22)
228238
ThrowReaderException(CorruptImageError,"ImproperImageHeader");
239+
if (EOFBlob(image) != MagickFalse)
240+
ThrowRLEException(CorruptImageError,"UnexpectedEndOfFile");
229241
one=1;
230242
map_length=one << map_length;
231243
if ((number_planes == 0) || (number_planes == 2) ||
@@ -253,12 +265,7 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
253265
if ((number_planes & 0x01) == 0)
254266
(void) ReadBlobByte(image);
255267
if (EOFBlob(image) != MagickFalse)
256-
{
257-
ThrowFileException(exception,CorruptImageError,"UnexpectedEndOfFile",
258-
image->filename);
259-
break;
260-
}
261-
colormap=(unsigned char *) NULL;
268+
ThrowRLEException(CorruptImageError,"UnexpectedEndOfFile");
262269
if (number_colormaps != 0)
263270
{
264271
/*
@@ -271,8 +278,12 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
271278
p=colormap;
272279
for (i=0; i < (ssize_t) number_colormaps; i++)
273280
for (x=0; x < (ssize_t) map_length; x++)
281+
{
274282
*p++=(unsigned char) ScaleQuantumToChar(ScaleShortToQuantum(
275283
ReadBlobLSBShort(image)));
284+
if (EOFBlob(image) != MagickFalse)
285+
ThrowRLEException(CorruptImageError,"UnexpectedEndOfFile");
286+
}
276287
}
277288
if ((flags & 0x08) != 0)
278289
{
@@ -300,11 +311,7 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
300311
}
301312
}
302313
if (EOFBlob(image) != MagickFalse)
303-
{
304-
ThrowFileException(exception,CorruptImageError,"UnexpectedEndOfFile",
305-
image->filename);
306-
break;
307-
}
314+
ThrowRLEException(CorruptImageError,"UnexpectedEndOfFile");
308315
if ((image_info->ping != MagickFalse) && (image_info->number_scenes != 0))
309316
if (image->scene >= (image_info->scene+image_info->number_scenes-1))
310317
break;
@@ -359,22 +366,32 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
359366
x=0;
360367
y=0;
361368
opcode=ReadBlobByte(image);
369+
if (opcode == EOF)
370+
ThrowRLEException(CorruptImageError,"UnexpectedEndOfFile");
362371
do
363372
{
364373
switch (opcode & 0x3f)
365374
{
366375
case SkipLinesOp:
367376
{
368377
operand=ReadBlobByte(image);
378+
if (opcode == EOF)
379+
ThrowRLEException(CorruptImageError,"UnexpectedEndOfFile");
369380
if (opcode & 0x40)
370-
operand=ReadBlobLSBSignedShort(image);
381+
{
382+
operand=ReadBlobLSBSignedShort(image);
383+
if (opcode == EOF)
384+
ThrowRLEException(CorruptImageError,"UnexpectedEndOfFile");
385+
}
371386
x=0;
372387
y+=operand;
373388
break;
374389
}
375390
case SetColorOp:
376391
{
377392
operand=ReadBlobByte(image);
393+
if (opcode == EOF)
394+
ThrowRLEException(CorruptImageError,"UnexpectedEndOfFile");
378395
plane=(unsigned char) operand;
379396
if (plane == 255)
380397
plane=(unsigned char) (number_planes-1);
@@ -384,21 +401,33 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
384401
case SkipPixelsOp:
385402
{
386403
operand=ReadBlobByte(image);
404+
if (opcode == EOF)
405+
ThrowRLEException(CorruptImageError,"UnexpectedEndOfFile");
387406
if (opcode & 0x40)
388-
operand=ReadBlobLSBSignedShort(image);
407+
{
408+
operand=ReadBlobLSBSignedShort(image);
409+
if (opcode == EOF)
410+
ThrowRLEException(CorruptImageError,"UnexpectedEndOfFile");
411+
}
389412
x+=operand;
390413
break;
391414
}
392415
case ByteDataOp:
393416
{
394417
operand=ReadBlobByte(image);
418+
if (opcode == EOF)
419+
ThrowRLEException(CorruptImageError,"UnexpectedEndOfFile");
395420
if (opcode & 0x40)
396-
operand=ReadBlobLSBSignedShort(image);
397-
offset=((image->rows-y-1)*image->columns*number_planes)+x*
398-
number_planes+plane;
421+
{
422+
operand=ReadBlobLSBSignedShort(image);
423+
if (opcode == EOF)
424+
ThrowRLEException(CorruptImageError,"UnexpectedEndOfFile");
425+
}
426+
offset=(ssize_t) (((image->rows-y-1)*image->columns*number_planes)+x*
427+
number_planes+plane);
399428
operand++;
400429
if ((offset < 0) ||
401-
(offset+((size_t) operand*number_planes) > pixel_info_length))
430+
((offset+operand*number_planes) > (ssize_t) pixel_info_length))
402431
{
403432
if (number_colormaps != 0)
404433
colormap=(unsigned char *) RelinquishMagickMemory(colormap);
@@ -422,15 +451,21 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
422451
case RunDataOp:
423452
{
424453
operand=ReadBlobByte(image);
454+
if (opcode == EOF)
455+
ThrowRLEException(CorruptImageError,"UnexpectedEndOfFile");
425456
if (opcode & 0x40)
426-
operand=ReadBlobLSBSignedShort(image);
457+
{
458+
operand=ReadBlobLSBSignedShort(image);
459+
if (opcode == EOF)
460+
ThrowRLEException(CorruptImageError,"UnexpectedEndOfFile");
461+
}
427462
pixel=(unsigned char) ReadBlobByte(image);
428463
(void) ReadBlobByte(image);
429-
offset=((image->rows-y-1)*image->columns*number_planes)+x*
430-
number_planes+plane;
464+
offset=(ssize_t) (((image->rows-y-1)*image->columns*number_planes)+x*
465+
number_planes+plane);
431466
operand++;
432467
if ((offset < 0) ||
433-
(offset+((size_t) operand*number_planes) > pixel_info_length))
468+
((offset+operand*number_planes) > (ssize_t) pixel_info_length))
434469
{
435470
if (number_colormaps != 0)
436471
colormap=(unsigned char *) RelinquishMagickMemory(colormap);
@@ -452,6 +487,8 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
452487
break;
453488
}
454489
opcode=ReadBlobByte(image);
490+
if (opcode == EOF)
491+
ThrowRLEException(CorruptImageError,"UnexpectedEndOfFile");
455492
} while (((opcode & 0x3f) != EOFOp) && (opcode != EOF));
456493
if (number_colormaps != 0)
457494
{
@@ -467,7 +504,7 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
467504
if (number_colormaps == 1)
468505
for (i=0; i < (ssize_t) number_pixels; i++)
469506
{
470-
ValidateColormapValue(image,*p & mask,&index,exception);
507+
ValidateColormapValue(image,(ssize_t) (*p & mask),&index,exception);
471508
*p=colormap[(ssize_t) index];
472509
p++;
473510
}
@@ -476,7 +513,7 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
476513
for (i=0; i < (ssize_t) number_pixels; i++)
477514
for (x=0; x < (ssize_t) number_planes; x++)
478515
{
479-
ValidateColormapValue(image,(size_t) (x*map_length+
516+
ValidateColormapValue(image,(ssize_t) (x*map_length+
480517
(*p & mask)),&index,exception);
481518
*p=colormap[(ssize_t) index];
482519
p++;
@@ -570,7 +607,7 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
570607
break;
571608
for (x=0; x < (ssize_t) image->columns; x++)
572609
{
573-
SetPixelIndex(image,*p++,q);
610+
SetPixelIndex(image,(Quantum) *p++,q);
574611
q+=GetPixelChannels(image);
575612
}
576613
if (SyncAuthenticPixels(image,exception) == MagickFalse)

0 commit comments

Comments
 (0)