diff options
Diffstat (limited to 'gnu/packages/patches/graphicsmagick-CVE-2017-13775.patch')
| -rw-r--r-- | gnu/packages/patches/graphicsmagick-CVE-2017-13775.patch | 195 |
1 files changed, 195 insertions, 0 deletions
diff --git a/gnu/packages/patches/graphicsmagick-CVE-2017-13775.patch b/gnu/packages/patches/graphicsmagick-CVE-2017-13775.patch new file mode 100644 index 0000000000..83478c13b3 --- /dev/null +++ b/gnu/packages/patches/graphicsmagick-CVE-2017-13775.patch @@ -0,0 +1,195 @@ +http://openwall.com/lists/oss-security/2017/08/31/3 +http://hg.code.sf.net/p/graphicsmagick/code/raw-rev/b037d79b6ccd + +some changes were made to make the patch apply + +# HG changeset patch +# User Bob Friesenhahn <bfriesen@GraphicsMagick.org> +# Date 1503774853 18000 +# Node ID b037d79b6ccd0cfba7ba9ce09b454ed46d688036 +# Parent 198ea602ea7cc767dc3022bbcf887bcd4534158d +JNX: Fix DOS issues + +diff -r 198ea602ea7c -r b037d79b6ccd coders/jnx.c +--- a/coders/jnx.c Tue Aug 22 08:08:30 2017 -0500 ++++ b/coders/jnx.c Sat Aug 26 14:14:13 2017 -0500 +@@ -1,5 +1,5 @@ + /* +-% Copyright (C) 2012-2015 GraphicsMagick Group ++% Copyright (C) 2012-2017 GraphicsMagick Group + % + % This program is covered by multiple licenses, which are described in + % Copyright.txt. You should have received a copy of Copyright.txt with this +@@ -100,6 +100,7 @@ + + char img_label_str[MaxTextExtent]; + ++ + alloc_size = TileInfo->PicSize + 2; + + if (image->logging) +@@ -242,6 +243,9 @@ + total_tiles, + current_tile; + ++ magick_off_t ++ file_size; ++ + /* Open image file. */ + assert(image_info != (const ImageInfo *) NULL); + assert(image_info->signature == MagickSignature); +@@ -254,9 +258,8 @@ + if (status == False) + ThrowReaderException(FileOpenError, UnableToOpenFile, image); + +- memset(JNXLevelInfo, 0, sizeof(JNXLevelInfo)); +- + /* Read JNX image header. */ ++ (void) memset(&JNXHeader, 0, sizeof(JNXHeader)); + JNXHeader.Version = ReadBlobLSBLong(image); + if (JNXHeader.Version > 4) + ThrowReaderException(CorruptImageError, ImproperImageHeader, image); +@@ -266,8 +269,6 @@ + JNXHeader.MapBounds.SouthWest.lat = ReadBlobLSBLong(image); + JNXHeader.MapBounds.SouthWest.lon = ReadBlobLSBLong(image); + JNXHeader.Levels = ReadBlobLSBLong(image); +- if (JNXHeader.Levels > 20) +- ThrowReaderException(CorruptImageError, ImproperImageHeader, image); + JNXHeader.Expiration = ReadBlobLSBLong(image); + JNXHeader.ProductID = ReadBlobLSBLong(image); + JNXHeader.CRC = ReadBlobLSBLong(image); +@@ -279,7 +280,41 @@ + if (EOFBlob(image)) + ThrowReaderException(CorruptImageError,UnexpectedEndOfFile,image); + ++ file_size = GetBlobSize(image); ++ ++ (void) LogMagickEvent(CoderEvent,GetMagickModule(), ++ "JNX Header:\n" ++ " Version: %u\n" ++ " DeviceSN: %u\n" ++ " MapBounds:\n" ++ " NorthEast: lat = %u, lon = %u\n" ++ " SouthWest: lat = %u, lon = %u\n" ++ " Levels: %u\n" ++ " Expiration: %u\n" ++ " ProductID: %u\n" ++ " CRC: %u\n" ++ " SigVersion: %u\n" ++ " SigOffset: %u\n" ++ " ZOrder: %u", ++ JNXHeader.Version, ++ JNXHeader.DeviceSN, ++ JNXHeader.MapBounds.NorthEast.lat, ++ JNXHeader.MapBounds.NorthEast.lon, ++ JNXHeader.MapBounds.SouthWest.lat, ++ JNXHeader.MapBounds.SouthWest.lon, ++ JNXHeader.Levels, ++ JNXHeader.Expiration, ++ JNXHeader.ProductID, ++ JNXHeader.CRC, ++ JNXHeader.SigVersion, ++ JNXHeader.SigOffset, ++ JNXHeader.ZOrder); ++ ++ if (JNXHeader.Levels > 20) ++ ThrowReaderException(CorruptImageError, ImproperImageHeader, image); ++ + /* Read JNX image level info. */ ++ memset(JNXLevelInfo, 0, sizeof(JNXLevelInfo)); + total_tiles = 0; + current_tile = 0; + for (i = 0; i < JNXHeader.Levels; i++) +@@ -302,11 +337,23 @@ + { + JNXLevelInfo[i].Copyright = NULL; + } ++ ++ if (EOFBlob(image)) ++ ThrowReaderException(CorruptImageError,UnexpectedEndOfFile,image); ++ ++ if (image->logging) ++ (void) LogMagickEvent(CoderEvent,GetMagickModule(), ++ "Level[%u] Info:" ++ " TileCount: %4u" ++ " TilesOffset: %6u" ++ " Scale: %04u", ++ i, ++ JNXLevelInfo[i].TileCount, ++ JNXLevelInfo[i].TilesOffset, ++ JNXLevelInfo[i].Scale ++ ); + } + +- if (EOFBlob(image)) +- ThrowReaderException(CorruptImageError,UnexpectedEndOfFile,image); +- + /* Get the current limit */ + SaveLimit = GetMagickResourceLimit(MapResource); + +@@ -316,11 +363,32 @@ + /* Read JNX image data. */ + for (i = 0; i < JNXHeader.Levels; i++) + { ++ /* ++ Validate TileCount against remaining file data ++ */ ++ const magick_off_t current_offset = TellBlob(image); ++ const size_t pos_list_entry_size = ++ sizeof(magick_uint32_t) + sizeof(magick_uint32_t) + sizeof(magick_uint32_t) + ++ sizeof(magick_uint32_t) + sizeof(magick_uint16_t) + sizeof(magick_uint16_t) + ++ sizeof(magick_uint32_t) + sizeof(magick_uint32_t); ++ const magick_off_t remaining = file_size-current_offset; ++ const size_t needed = MagickArraySize(pos_list_entry_size,JNXLevelInfo[i].TileCount); ++ ++ if ((needed == 0U) || (remaining <= 0) || (remaining < (magick_off_t) needed)) ++ { ++ (void) SetMagickResourceLimit(MapResource, SaveLimit); ++ ThrowReaderException(CorruptImageError,UnexpectedEndOfFile,image); ++ } ++ + PositionList = MagickAllocateArray(TJNXTileInfo *, + JNXLevelInfo[i].TileCount, + sizeof(TJNXTileInfo)); + if (PositionList == NULL) +- continue; ++ { ++ (void) SetMagickResourceLimit(MapResource, SaveLimit); ++ ThrowReaderException(ResourceLimitError,MemoryAllocationFailed, ++ image); ++ } + + (void) SeekBlob(image, JNXLevelInfo[i].TilesOffset, SEEK_SET); + for (j = 0; j < JNXLevelInfo[i].TileCount; j++) +@@ -333,12 +401,15 @@ + PositionList[j].PicHeight = ReadBlobLSBShort(image); + PositionList[j].PicSize = ReadBlobLSBLong(image); + PositionList[j].PicOffset = ReadBlobLSBLong(image); +- } + +- if (EOFBlob(image)) +- { +- MagickFreeMemory(PositionList); +- ThrowReaderException(CorruptImageError,UnexpectedEndOfFile,image); ++ if (EOFBlob(image) || ++ ((magick_off_t) PositionList[j].PicOffset + ++ PositionList[j].PicSize > file_size)) ++ { ++ (void) SetMagickResourceLimit(MapResource, SaveLimit); ++ MagickFreeMemory(PositionList); ++ ThrowReaderException(CorruptImageError,UnexpectedEndOfFile,image); ++ } + } + + for (j = 0; j < JNXLevelInfo[i].TileCount; j++) +@@ -351,6 +422,9 @@ + image = ExtractTileJPG(image, image_info, PositionList+j, exception); + (void) SetMonitorHandler(previous_handler); + ++ if (exception->severity >= ErrorException) ++ break; ++ + current_tile++; + if (QuantumTick(current_tile,total_tiles)) + if (!MagickMonitorFormatted(current_tile,total_tiles,exception, + |