aboutsummaryrefslogtreecommitdiffstats
path: root/community/graphicsmagick/CVE-2017-11642.patch
blob: 144ed78e7ea6bb59a26a039826df2611f7b992b4 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

# HG changeset patch
# User Bob Friesenhahn <bfriesen@GraphicsMagick.org>
# Date 1500758975 18000
# Node ID 29550606d8b9bf74f9aea0637d11d19fe706871b
# Parent  30cd2b31f7e045de4861b102e3f8d83db579bc7a
MAP: Fix null pointer dereference or SEGV if input is not colormapped.

diff -r 30cd2b31f7e0 -r 29550606d8b9 coders/map.c
--- a/coders/map.c	Sat Jul 22 15:40:00 2017 -0500
+++ b/coders/map.c	Sat Jul 22 16:29:35 2017 -0500
@@ -18,7 +18,7 @@
 %                            M   M  A   A  P                                  %
 %                                                                             %
 %                                                                             %
-%                 Read/Write Image Colormaps As An Image File                 %
+%                 Read/Write Image Colormaps And Image File                   %
 %                                                                             %
 %                                                                             %
 %                              Software Design                                %
@@ -349,16 +349,17 @@
   /*
     Allocate colormap.
   */
-  if (!IsPaletteImage(image,&image->exception))
-    (void) SetImageType(image,PaletteType);
+  if (SetImageType(image,PaletteType) == MagickFail)
+    ThrowMAPWriterException(ResourceLimitError,MemoryAllocationFailed,image);
   packet_size=image->depth > 8 ? 2 : 1;
-  pixels=MagickAllocateMemory(unsigned char *,image->columns*packet_size);
+  pixels=MagickAllocateArray(unsigned char *,image->columns,packet_size);
   if (pixels == (unsigned char *) NULL)
     ThrowMAPWriterException(ResourceLimitError,MemoryAllocationFailed,image);
   packet_size=image->colors > 256 ? 6 : 3;
-  colormap=MagickAllocateMemory(unsigned char *,packet_size*image->colors);
+  colormap=MagickAllocateArray(unsigned char *,packet_size,image->colors);
   if (colormap == (unsigned char *) NULL)
     ThrowMAPWriterException(ResourceLimitError,MemoryAllocationFailed,image);
+
   /*
     Write colormap to file.
   */