OSDN -- Développer et télécharger des logiciels Open Source
Traduction statut du Français translation status for fr
  • R/O
  • SSH
Fork

GM: Commit

Main GraphicsMagick source repository


Commit MetaInfo

Révisionbda0789b88f20d629c7adc5d88b4eb951fe7ac69 (tree)
l'heure2021-11-04 03:24:04
AuteurBob Friesenhahn <bfriesen@Grap...>
CommiterBob Friesenhahn

Message de Log

ReadTIFFImage(): Make sure that loops using TIFFReadScanline(), etc, do quit upon first reported error.

Change Summary

Modification

diff -r 6cdb3bd5f91d -r bda0789b88f2 ChangeLog
--- a/ChangeLog Wed Nov 03 11:39:32 2021 -0500
+++ b/ChangeLog Wed Nov 03 13:24:04 2021 -0500
@@ -1,5 +1,11 @@
11 2021-11-03 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
22
3+ * coders/tiff.c (ReadTIFFImage): Make sure that loops using
4+ TIFFReadScanline(), etc, do quit upon first reported error. Fixes
5+ oss-fuzz 39167 "graphicsmagick:coder_BIGTIFF_fuzzer:
6+ Use-of-uninitialized-value in DisassociateAlphaRegion", as well as
7+ other such cases.
8+
39 * coders/png.c (png_get_data): On a short read, assure that the
410 remainder of the buffer is initialized just in case subsequent
511 code accesses it.
diff -r 6cdb3bd5f91d -r bda0789b88f2 coders/tiff.c
--- a/coders/tiff.c Wed Nov 03 11:39:32 2021 -0500
+++ b/coders/tiff.c Wed Nov 03 13:24:04 2021 -0500
@@ -2590,9 +2590,9 @@
25902590 ThrowTIFFReaderException(ResourceLimitError,MemoryAllocationFailed,
25912591 image);
25922592 }
2593- for (sample=0; sample < max_sample; sample++)
2593+ for (sample=0; (status != MagickFail) && (sample < max_sample); sample++)
25942594 {
2595- for (y=0; y < image->rows; y++)
2595+ for (y=0; (status != MagickFail) && (y < image->rows); y++)
25962596 {
25972597 if (sample == 0)
25982598 q=SetImagePixelsEx(image,0,y,image->columns,1,exception);
@@ -2610,6 +2610,13 @@
26102610 */
26112611 if (TIFFReadScanline(tiff,(char *) scanline,(uint32) y,sample) == -1)
26122612 {
2613+ (void) LogMagickEvent(CoderEvent,GetMagickModule(),
2614+ "TIFFReadScanline() failed!");
2615+ status=MagickFail;
2616+ break;
2617+ }
2618+ if (image->exception.severity >= ErrorException)
2619+ {
26132620 status=MagickFail;
26142621 break;
26152622 }
@@ -2781,7 +2788,7 @@
27812788 /*
27822789 Process each plane
27832790 */
2784- for (sample=0; sample < max_sample; sample++)
2791+ for (sample=0; (status != MagickFail) && (sample < max_sample); sample++)
27852792 {
27862793 rows_remaining=0;
27872794 /*
@@ -2797,7 +2804,7 @@
27972804 status=MagickFail;
27982805 break;
27992806 }
2800- for (y=0; y < image->rows; y++)
2807+ for (y=0; (status != MagickFail) && (y < image->rows); y++)
28012808 {
28022809 /*
28032810 Access Magick pixels.
@@ -3030,7 +3037,7 @@
30303037 /*
30313038 Process each plane.
30323039 */
3033- for (sample=0; sample < max_sample; sample++)
3040+ for (sample=0; (status != MagickFail) && (sample < max_sample); sample++)
30343041 {
30353042 /*
30363043 Determine quantum parse method.
@@ -3044,9 +3051,9 @@
30443051 status=MagickFail;
30453052 break;
30463053 }
3047- for (y=0; y < image->rows; y+=tile_rows)
3054+ for (y=0; (status != MagickFail) && (y < image->rows); y+=tile_rows)
30483055 {
3049- for (x=0; x < image->columns; x+=tile_columns)
3056+ for (x=0; (status != MagickFail) && (x < image->columns); x+=tile_columns)
30503057 {
30513058 long
30523059 tile_set_columns,
@@ -3084,7 +3091,7 @@
30843091 SwabDataToBigEndian(bits_per_sample,tile,tile_size);
30853092 #endif
30863093 p=tile;
3087- for (yy=y; yy < (long) y+tile_set_rows; yy++)
3094+ for (yy=y; (status != MagickFail) && (yy < (long) y+tile_set_rows); yy++)
30883095 {
30893096 /*
30903097 Obtain pixel region corresponding to tile row.
@@ -3217,7 +3224,7 @@
32173224 */
32183225 i=0;
32193226 p=0;
3220- for (y=0; y < image->rows; y++)
3227+ for (y=0; (status != MagickFail) && (y < image->rows); y++)
32213228 {
32223229 q=SetImagePixelsEx(image,0,y,image->columns,1,exception);
32233230 if (q == (PixelPacket *) NULL)
@@ -3239,7 +3246,7 @@
32393246 }
32403247 i--;
32413248 p=strip_pixels+(size_t) image->columns*i;
3242- for (x=0; x < image->columns; x++)
3249+ for (x=0; (status != MagickFail) && (x < image->columns); x++)
32433250 {
32443251 q->red=ScaleCharToQuantum(TIFFGetR(*p));
32453252 q->green=ScaleCharToQuantum(TIFFGetG(*p));
@@ -3385,7 +3392,7 @@
33853392 ThrowTIFFReaderException(ResourceLimitError,MemoryAllocationFailed,
33863393 image);
33873394 }
3388- for (y=0; y < image->rows; y+=tile_rows)
3395+ for (y=0; (status != MagickFail) && (y < image->rows); y+=tile_rows)
33893396 {
33903397 /*
33913398 Retrieve a tile height's worth of rows
@@ -3411,7 +3418,7 @@
34113418 status=MagickFail;
34123419 break;
34133420 }
3414- for (x=0; x < image->columns; x+=tile_columns)
3421+ for (x=0; (status != MagickFail) && (x < image->columns); x+=tile_columns)
34153422 {
34163423 register unsigned int
34173424 tile_column,
@@ -5904,7 +5911,7 @@
59045911 /*
59055912 For each plane
59065913 */
5907- for (sample=0; sample < max_sample; sample++)
5914+ for (sample=0; (status != MagickFail) && (sample < max_sample); sample++)
59085915 {
59095916 /*
59105917 Determine quantum parse method.
@@ -5918,7 +5925,7 @@
59185925 status=MagickFail;
59195926 break;
59205927 }
5921- for (y=0; y < image->rows; y++)
5928+ for (y=0; (status != MagickFail) && (y < image->rows); y++)
59225929 {
59235930 if ((image->matte) && (alpha_type == AssociatedAlpha))
59245931 p=GetImagePixels(image,0,y,image->columns,1);
@@ -6105,7 +6112,7 @@
61056112 /*
61066113 Process each plane.
61076114 */
6108- for (sample=0; sample < max_sample; sample++)
6115+ for (sample=0; (status != MagickFail) && (sample < max_sample); sample++)
61096116 {
61106117 /*
61116118 Determine quantum parse method.
@@ -6119,9 +6126,9 @@
61196126 status=MagickFail;
61206127 break;
61216128 }
6122- for (y=0; y < image->rows; y+=tile_rows)
6129+ for (y=0; (status != MagickFail) && (y < image->rows); y+=tile_rows)
61236130 {
6124- for (x=0; x < image->columns; x+=tile_columns)
6131+ for (x=0; (status != MagickFail) && (x < image->columns); x+=tile_columns)
61256132 {
61266133 const PixelPacket
61276134 *p;
@@ -6149,7 +6156,7 @@
61496156 tile_set_rows=tile_rows;
61506157
61516158 q=tile;
6152- for (yy=y; yy < (long) y+tile_set_rows; yy++)
6159+ for (yy=y; (status != MagickFail) && (yy < (long) y+tile_set_rows); yy++)
61536160 {
61546161 /*
61556162 Obtain pixel region corresponding to tile row.
diff -r 6cdb3bd5f91d -r bda0789b88f2 www/Changelog.html
--- a/www/Changelog.html Wed Nov 03 11:39:32 2021 -0500
+++ b/www/Changelog.html Wed Nov 03 13:24:04 2021 -0500
@@ -37,6 +37,11 @@
3737
3838 <p>2021-11-03 Bob Friesenhahn &lt;<a class="reference external" href="mailto:bfriesen&#37;&#52;&#48;simple&#46;dallas&#46;tx&#46;us">bfriesen<span>&#64;</span>simple<span>&#46;</span>dallas<span>&#46;</span>tx<span>&#46;</span>us</a>&gt;</p>
3939 <blockquote>
40+<p>* coders/tiff.c (ReadTIFFImage): Make sure that loops using
41+TIFFReadScanline(), etc, do quit upon first reported error. Fixes
42+oss-fuzz 39167 &quot;graphicsmagick:coder_BIGTIFF_fuzzer:
43+Use-of-uninitialized-value in DisassociateAlphaRegion&quot;, as well as
44+other such cases.</p>
4045 <p>* coders/png.c (png_get_data): On a short read, assure that the
4146 remainder of the buffer is initialized just in case subsequent
4247 code accesses it.</p>
Afficher sur ancien navigateur de dépôt.