Completion of error handling

[elfring]

Would you like to add more error handling for return values from functions like the following?

• fputc ⇒ ConcatenateImages
• fwrite ⇒ ReadGROUP4Image

[mikayla-grace]

Thanks for your suggestion, we added additional error handling to ConcatenateImages() and ReadGROUP4Image().

[elfring]

I suggest to avoid ignorance of return values a bit more. Would you like to detect every error situation as early as possible?

How do you think about to improve static source code analysis also for this software?

[anarcat]

it looks like 933e96f wasn't backported to -6?

[mikayla-grace]

ImageMagick version 6 includes a ConcatenateImages() method in wand/convert.c and it checks for IO conditions like ConcatenateImages() of version 7. Given that, what do you mean when you suggest it was not backported.

[anarcat]

i stand corrected. it's just the commit wasn't linked to this issue so I assumed (mistakenly) that it wasn't backported.

[carnil]

Three CVEs have been assigned for those issues. AFAICT, the one for the error handling of the fwrite's in ReadGROUP4Image would still be open?

> Check return of write function
> ==============================
> 
> Debian bug: https://bugs.debian.org/845196
> Reference URL: https://security-tracker.debian.org/845196
> Upstream commit:
> - https://github.com/ImageMagick/ImageMagick/commit/933e96f01a8c889c7bf5ffd30020e86a \
>                 02a046e7
> - https://github.com/ImageMagick/ImageMagick/commit/4e914bbe371433f0590cefdf3bd5f3a5 \
> 710069f9 Upstream issue: https://github.com/ImageMagick/ImageMagick/issues/196
> Upstream version fixed: 7.0.1-10
> 
> The above fixes may be incomplete, according to the upstream issue. In
> addition, the -6 branch seems to have an incomplete fix as well.

Use CVE-2016-10060 for the issue fixed in 933e96f01a8c889c7bf5ffd30020e86a02a046e7.
Use CVE-2016-10061 for the issue fixed in 4e914bbe371433f0590cefdf3bd5f3a5710069f9.

Use CVE-2016-10062 for the fwrite issue in ReadGROUP4Image. This was
specifically noted at the beginning of issues/196, but not fixed in
either of these commits. It is not the same as the fputc issue in
ReadGROUP4Image.

Origin: https://marc.info/?l=oss-security&m=148278818528413&w=2