Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package GraphicsMagick for openSUSE:Factory checked in at 2026-08-01 18:27:27 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/GraphicsMagick (Old) and /work/SRC/openSUSE:Factory/.GraphicsMagick.new.16738 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "GraphicsMagick" Sat Aug 1 18:27:27 2026 rev:109 rq:1368750 version:1.3.48 Changes: -------- --- /work/SRC/openSUSE:Factory/GraphicsMagick/GraphicsMagick.changes 2026-07-23 23:09:08.445755111 +0200 +++ /work/SRC/openSUSE:Factory/.GraphicsMagick.new.16738/GraphicsMagick.changes 2026-08-01 18:27:52.448819580 +0200 @@ -1,0 +2,89 @@ +Fri Jul 31 06:36:47 UTC 2026 - Petr Gajdos <[email protected]> + +- added patches + CVE-2026-56379: arbitrary MVG drawing command injection via the SVG decoder when processing specially crafted SVG files [bsc#1268878] + * GraphicsMagick-CVE-2026-56379.patch + +------------------------------------------------------------------- +Wed Jul 29 08:45:12 UTC 2026 - Petr Gajdos <[email protected]> + +- version update 1.3.48 + * Address ImageMagick CVE CVE-2026-42050, ImageMagick security + advisory GHSA-7mxf-ff4f-jj7p, which is related to an X11 display + buffer overflow. This is really a minor issue since it requires X11 + keyboard input and causes no harm. + * DCM: In RLE decoder, detect and report end of input. Reported-by: + Tristan Madani. + * DCM: Convert from ASCII numeric value to unsigned value, with error + detection. Avoid problems caused by negative values. Reported-by: + Tristan Madani. + * display: Correct bounds checking for 'filename' length. Thanks to + Petr Gajdos for a heads-up regarding the disparity. + * GradientImage(): Fix 'pixel_packets' and 'indexes' addressing logic + for NorthGravity. Addresses "[security] GraphicsMagick + GradientImage: heap-buffer-overflow READ in NorthGravity branch + reached from gm convert (magick/gradient.c:284)" from David + Korczynski. Credit to Anthropic Claude and Ada Logics. + * ImageToBlob(): Fix memory leak which may occur if WriteImage() fails. + * LOCALE: Bound the length passed to strncpy() and string + terminator. Addresses "[security] GraphicsMagick LOCALE coder: + stack-buffer-overflow WRITE in ReadConfigureFile reached from gm + convert (coders/locale.c:257)" from David Korczynski. Credit to + Anthropic Claude and Ada Logics. + * META/IPTC: Prevent reading past the end of a truncated/short IPTC + profile. + * MIFF: Correct scope of 'values' reallocation error + handling. Addresses "[security] GraphicsMagick MIFF reader: + heap-use-after-free WRITE via stale cursor on values-buffer realloc + failure (coders/miff.c:1048)" from David Korczynski. Credit to + Anthropic Claude and Ada Logics. + * MSL: Properly log warnings and errors using LogMagickEventList() + given a va_list. Reported-by: Tristan Madani. + * PCD: Over-provision the per-channel Huffman decode buffers and + detect any attempt to overflow them. Discovered and reported by + Cipher - Causal Security (https://causalsecurity.com/). + * PCX: If image has more than 256 colors, save as a DirectClass + type. Addresses "[security] GraphicsMagick PCX writer: + * PNG: Use only values from GetImageCharacteristics() since + IsMonochromeImage() and IsGrayImage() may produce different + answers. Addresses "[security] GraphicsMagick MNG re-encode: + heap-buffer-overflow WRITE in ExportGrayAlphaQuantumType reached + from gm convert (magick/export.c:1105)" as reported by David + Korczynski via email on May 28, 2026. Credit to Anthropic Claude and + Ada Logics. + * SVG: Properly log warnings and errors using LogMagickEventList() + given a va_list. Reported-by: Tristan Madani. + * TIFF: Add many more validations and safeguards to EXIF in TIFF + writer. Addresses "[security] GraphicsMagick TIFF writer: + heap-buffer-overflow WRITE in AddIFDExifFields via 32-bit count*2 + wrap on EXIF SHORT array (coders/tiff.c)" from David + Korczynski. Credit to Anthropic Claude and Ada Logics. + * TIFF: If EXIF profile string is not already NUL terminated, assure + that it is NUL terminated before passing it to libtiff. Reported-by: + Tristan Madani. + * TIFF: In AddIFDExifFields(), address possible out of bounds read (2 + bytes) beyond the end of the allocated profile buffer. Reported-by: + Tristan Madani. + * VIFF: Memory leak fix (ImageMagick CVE-2026-61870). + * configure.ac: Fixes so Freetype and zlib may be detected if + pkg-config is not available. + * PICT: Remove the attempt to intuit byteCount must be a word because + the approach used does not work reliably. This means that defective + PICT files previously written by ImageMagick or GraphicsMagick may + fail to be read. + * VIFF: Fixes so remaining Khoros VIFF sample files sample files from + the Encyclopedia Of Graphics File Formats which are based on integer + data storage types read correctly. +- deleted patches + * GraphicsMagick-CVE-2026-13606.patch (upstreamed) + * GraphicsMagick-CVE-2026-42050.patch (upstreamed) + * GraphicsMagick-CVE-2026-61870.patch (upstreamed) + +------------------------------------------------------------------- +Tue Jul 28 06:08:38 UTC 2026 - Petr Gajdos <[email protected]> + +- added patches + CVE-2026-61464: Heap Buffer Over-Write in X11 import with crafted window title [bsc#1271496] + * GraphicsMagick-CVE-2026-61464.patch + +------------------------------------------------------------------- Old: ---- GraphicsMagick-1.3.47.tar.xz GraphicsMagick-CVE-2026-13606.patch GraphicsMagick-CVE-2026-42050.patch GraphicsMagick-CVE-2026-61870.patch New: ---- GraphicsMagick-1.3.48.tar.xz GraphicsMagick-CVE-2026-56379.patch GraphicsMagick-CVE-2026-61464.patch ----------(Old B)---------- Old:- deleted patches * GraphicsMagick-CVE-2026-13606.patch (upstreamed) * GraphicsMagick-CVE-2026-42050.patch (upstreamed) Old: * GraphicsMagick-CVE-2026-13606.patch (upstreamed) * GraphicsMagick-CVE-2026-42050.patch (upstreamed) * GraphicsMagick-CVE-2026-61870.patch (upstreamed) Old: * GraphicsMagick-CVE-2026-42050.patch (upstreamed) * GraphicsMagick-CVE-2026-61870.patch (upstreamed) ----------(Old E)---------- ----------(New B)---------- New: CVE-2026-56379: arbitrary MVG drawing command injection via the SVG decoder when processing specially crafted SVG files [bsc#1268878] * GraphicsMagick-CVE-2026-56379.patch New: CVE-2026-61464: Heap Buffer Over-Write in X11 import with crafted window title [bsc#1271496] * GraphicsMagick-CVE-2026-61464.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ GraphicsMagick.spec ++++++ --- /var/tmp/diff_new_pack.q4KIf5/_old 2026-08-01 18:27:53.324849301 +0200 +++ /var/tmp/diff_new_pack.q4KIf5/_new 2026-08-01 18:27:53.328849437 +0200 @@ -24,7 +24,7 @@ %define pp_so_ver 12 %define wand_so_ver 2 Name: GraphicsMagick -Version: 1.3.47 +Version: 1.3.48 Release: 0 Summary: Viewer and Converter for Images License: MIT @@ -33,14 +33,12 @@ Source: https://downloads.sourceforge.net/project/graphicsmagick/graphicsmagick/%{version}/%{name}-%{version}.tar.xz Patch0: GraphicsMagick-perl-linkage.patch Patch1: GraphicsMagick-disable-insecure-coders.patch -# CVE-2026-42050: Stack buffer overflow in XTileImage [bsc#1265048] -Patch7: GraphicsMagick-CVE-2026-42050.patch # CVE-2026-46523: heap-use-after-free via a crafted MSL image [bsc#1268125] Patch8: GraphicsMagick-CVE-2026-46523.patch -# CVE-2026-13606: memory corruption via crafted Photo CD (PCD) file [bsc#1269891] -Patch9: GraphicsMagick-CVE-2026-13606.patch -# CVE-2026-61870: Memory leak in VIFF encoder when allocation fails [bsc#1271293] -Patch10: GraphicsMagick-CVE-2026-61870.patch +# CVE-2026-61464: Heap Buffer Over-Write in X11 import with crafted window title [bsc#1271496] +Patch11: GraphicsMagick-CVE-2026-61464.patch +# CVE-2026-56379: arbitrary MVG drawing command injection via the SVG decoder when processing specially crafted SVG files [bsc#1268878] +Patch12: GraphicsMagick-CVE-2026-56379.patch BuildRequires: cups-client BuildRequires: dcraw BuildRequires: gcc-c++ ++++++ GraphicsMagick-1.3.47.tar.xz -> GraphicsMagick-1.3.48.tar.xz ++++++ ++++ 5210 lines of diff (skipped) ++++++ GraphicsMagick-CVE-2026-13606.patch -> GraphicsMagick-CVE-2026-56379.patch ++++++ --- /work/SRC/openSUSE:Factory/GraphicsMagick/GraphicsMagick-CVE-2026-13606.patch 2026-07-10 17:34:57.380092279 +0200 +++ /work/SRC/openSUSE:Factory/.GraphicsMagick.new.16738/GraphicsMagick-CVE-2026-56379.patch 2026-08-01 18:27:51.948802616 +0200 @@ -1,168 +1,64 @@ # HG changeset patch # User Bob Friesenhahn <[email protected]> -# Date 1782310094 18000 -# Wed Jun 24 09:08:14 2026 -0500 -# Node ID 937cdd9920bd966517c5f7a3595397af96b6ab6f -# Parent ae36237cba6a12216b5f40ad42930152ce2ff1ac -coders/pcd.c (ReadPCDImage): Over-provision the per-channel Huffman decode buffers and detect any attempt to overflow them. -diff --git a/coders/pcd.c b/coders/pcd.c ---- a/coders/pcd.c -+++ b/coders/pcd.c -@@ -87,8 +87,10 @@ - % - % - */ --static void Upsample(const unsigned long width,const unsigned long height, -- const unsigned long scaled_width,unsigned char *pixels) -+static void Upsample(const unsigned long width, -+ const unsigned long height, -+ const unsigned long scaled_width, -+ unsigned char * restrict pixels) - { - register long - x, -@@ -198,8 +200,11 @@ - if (EOFBlob(image)) \ - break; \ - } --static MagickPassFail DecodeImage(Image *image,unsigned char *luma, -- unsigned char *chroma1,unsigned char *chroma2) -+static MagickPassFail DecodeImage(Image *image, -+ const size_t channel_alloc_size, -+ unsigned char * restrict luma, -+ unsigned char * restrict chroma1, -+ unsigned char * restrict chroma2) - { - typedef struct PCDTable - { -@@ -236,7 +241,8 @@ - length; - - unsigned char -- *buffer; -+ *buffer, -+ *plane_end; +# Date 1785438833 18000 +# Thu Jul 30 14:13:53 2026 -0500 +# Node ID d70680f531c745c6b15cda843cd3f40427c6f99f +# Parent 46a2a55679f15d1ff0bf3d3788909604023136a1 +coders/svg.c: Address ImageMagick CVE-2026-56379. + +Index: GraphicsMagick-1.3.48/coders/svg.c +=================================================================== +--- GraphicsMagick-1.3.48.orig/coders/svg.c ++++ GraphicsMagick-1.3.48/coders/svg.c +@@ -901,10 +901,10 @@ SVGStartElement(void *context,const xmlC + 'font-family' argument. Should we be concerned about that? + */ - unsigned int - bits, -@@ -332,6 +338,7 @@ - plane=0; - row=0; - q=luma; -+ plane_end=luma+channel_alloc_size; - for ( ; ; ) - { - if (IsSync) -@@ -351,12 +358,14 @@ - case 0: - { - q=luma+row*(size_t)image->columns; -+ plane_end=luma+channel_alloc_size; - /* count=(long) image->columns; */ - break; - } - case 2: +- if (strchr(value,'\'') != NULL) ++ if (strpbrk(value,"'\n\r") != NULL) { - q=chroma1+(row >> 1)*(size_t)image->columns; -+ plane_end=chroma1+channel_alloc_size; - /* count=(long) (image->columns >> 1); */ - plane--; - break; -@@ -364,6 +373,7 @@ - case 3: + (void) LogMagickEvent(CoderEvent,GetMagickModule(), +- "Skipping attribute '%s' due to quoted value (%s)\n", ++ "Skipping attribute '%s' due to invalid value (%s)\n", + keyword, value); + ThrowException(svg_info->exception,DrawError,InvalidAttributeArgument,value); + continue; +@@ -1344,10 +1344,10 @@ SVGStartElement(void *context,const xmlC + 'font-family' argument. Should we be concerned about that? + */ + +- if (strchr(value,'\'') != NULL) ++ if (strpbrk(value,"'\n\r") != NULL) { - q=chroma2+(row >> 1)*(size_t)image->columns; -+ plane_end=chroma2+channel_alloc_size; - /* count=(long) (image->columns >> 1); */ - plane--; - break; -@@ -405,6 +415,17 @@ - PCDGetBits(1); - continue; - } -+ /* Detect overflow */ -+ if (q >= plane_end) -+ { -+ if (image->logging) -+ (void) LogMagickEvent(CoderEvent,GetMagickModule(), -+ "Plane buffer overflow detected!"); -+ ThrowException(&image->exception,CorruptImageError, -+ UnableToUncompressImage,image->filename); -+ status=MagickFail; -+ goto decode_image_error; -+ } - if (r->key < 128U) - quantum=(long) (*q)+r->key; - else -@@ -564,7 +585,8 @@ + (void) LogMagickEvent(CoderEvent,GetMagickModule(), +- "Skipping attribute '%s' due to quoted value (%s)\n", ++ "Skipping attribute '%s' due to invalid value (%s)\n", + keyword, value); + ThrowException(svg_info->exception,DrawError,InvalidAttributeArgument,value); + continue; +@@ -1916,10 +1916,10 @@ SVGStartElement(void *context,const xmlC + 'font-family' argument. Should we be concerned about that? + */ - size_t - number_pixels, -- count; -+ count, -+ channel_alloc_size; +- if (strchr(value,'\'') != NULL) ++ if (strpbrk(value,"'\n\r") != NULL) + { + (void) LogMagickEvent(CoderEvent,GetMagickModule(), +- "Skipping style attribute '%s' due to quoted value (%s)\n", ++ "Skipping style attribute '%s' due to invalid value (%s)\n", + keyword, value); + ThrowException(svg_info->exception,DrawError,InvalidAttributeArgument,value); + continue; +@@ -2722,10 +2722,10 @@ void ProcessStyleClassDefs ( + 'font-family' argument. Should we be concerned about that? + */ - unsigned char - *chroma1 = NULL, -@@ -661,9 +683,13 @@ - number_pixels=MagickArraySize(image->columns,image->rows); - if (number_pixels == 0 || number_pixels+1 < number_pixels) - ThrowPCDReaderException(ResourceLimitError,MemoryAllocationFailed,image); -- chroma1=MagickAllocateResourceLimitedMemory(unsigned char *,number_pixels+1); -- chroma2=MagickAllocateResourceLimitedMemory(unsigned char *,number_pixels+1); -- luma=MagickAllocateResourceLimitedMemory(unsigned char *,number_pixels+1); -+ channel_alloc_size=MagickArraySize(number_pixels,10); -+ if (channel_alloc_size == 0 || channel_alloc_size+1 < channel_alloc_size) -+ ThrowPCDReaderException(ResourceLimitError,MemoryAllocationFailed,image); -+ channel_alloc_size++; -+ chroma1=MagickAllocateResourceLimitedClearedMemory(unsigned char *,channel_alloc_size); -+ chroma2=MagickAllocateResourceLimitedClearedMemory(unsigned char *,channel_alloc_size); -+ luma=MagickAllocateResourceLimitedClearedMemory(unsigned char *,channel_alloc_size); - if ((chroma1 == (unsigned char *) NULL) || - (chroma2 == (unsigned char *) NULL) || - (luma == (unsigned char *) NULL)) -@@ -741,6 +767,12 @@ - q->red=ScaleCharToQuantum(*yy++); - q->green=ScaleCharToQuantum(*c1++); - q->blue=ScaleCharToQuantum(*c2++); -+ if (((size_t) (yy-luma) >= channel_alloc_size) || -+ ((size_t) (c1-chroma1) >= channel_alloc_size) || -+ ((size_t) (c2-chroma2) >= channel_alloc_size)) -+ { -+ ThrowPCDReaderException(CorruptImageError,UnableToUncompressImage,image); -+ } - q++; - } - if (!SyncImagePixels(image)) -@@ -812,7 +844,7 @@ - image->rows=1024; - for (i=0; i < (4*0x800); i++) - (void) ReadBlobByte(image); -- status=DecodeImage(image,luma,chroma1,chroma2); -+ status=DecodeImage(image,channel_alloc_size,luma,chroma1,chroma2); - if ((subimage >= 5) && status) - { - /* -@@ -824,7 +856,7 @@ - image->rows=2048; - offset=TellBlob(image)/0x800+12; - (void) SeekBlob(image,offset*0x800,SEEK_SET); -- status=DecodeImage(image,luma,chroma1,chroma2); -+ status=DecodeImage(image,channel_alloc_size,luma,chroma1,chroma2); - if ((subimage >= 6) && status) +- if (strchr(value,'\'') != NULL) ++ if (strpbrk(value,"'\n\r") != NULL) { - /* -@@ -860,6 +892,12 @@ - q->red=ScaleCharToQuantum(*yy++); - q->green=ScaleCharToQuantum(*c1++); - q->blue=ScaleCharToQuantum(*c2++); -+ if (((size_t) (yy-luma) >= channel_alloc_size) || -+ ((size_t) (c1-chroma1) >= channel_alloc_size) || -+ ((size_t) (c2-chroma2) >= channel_alloc_size)) -+ { -+ ThrowPCDReaderException(CorruptImageError,UnableToUncompressImage,image); -+ } - q++; - } - if (!SyncImagePixels(image)) - + (void) LogMagickEvent(CoderEvent,GetMagickModule(), +- "Skipping class '%s' keyword '%s' due to quoted value (%s)\n", ++ "Skipping class '%s' keyword '%s' due to invalid value (%s)\n", + pClassDef->pName, keyword, value); + ThrowException(svg_info->exception,DrawError,InvalidAttributeArgument,value); + continue; ++++++ GraphicsMagick-CVE-2026-13606.patch -> GraphicsMagick-CVE-2026-61464.patch ++++++ --- /work/SRC/openSUSE:Factory/GraphicsMagick/GraphicsMagick-CVE-2026-13606.patch 2026-07-10 17:34:57.380092279 +0200 +++ /work/SRC/openSUSE:Factory/.GraphicsMagick.new.16738/GraphicsMagick-CVE-2026-61464.patch 2026-08-01 18:27:52.220811845 +0200 @@ -1,168 +1,43 @@ # HG changeset patch # User Bob Friesenhahn <[email protected]> -# Date 1782310094 18000 -# Wed Jun 24 09:08:14 2026 -0500 -# Node ID 937cdd9920bd966517c5f7a3595397af96b6ab6f -# Parent ae36237cba6a12216b5f40ad42930152ce2ff1ac -coders/pcd.c (ReadPCDImage): Over-provision the per-channel Huffman decode buffers and detect any attempt to overflow them. -diff --git a/coders/pcd.c b/coders/pcd.c ---- a/coders/pcd.c -+++ b/coders/pcd.c -@@ -87,8 +87,10 @@ - % - % - */ --static void Upsample(const unsigned long width,const unsigned long height, -- const unsigned long scaled_width,unsigned char *pixels) -+static void Upsample(const unsigned long width, -+ const unsigned long height, -+ const unsigned long scaled_width, -+ unsigned char * restrict pixels) - { - register long - x, -@@ -198,8 +200,11 @@ - if (EOFBlob(image)) \ - break; \ - } --static MagickPassFail DecodeImage(Image *image,unsigned char *luma, -- unsigned char *chroma1,unsigned char *chroma2) -+static MagickPassFail DecodeImage(Image *image, -+ const size_t channel_alloc_size, -+ unsigned char * restrict luma, -+ unsigned char * restrict chroma1, -+ unsigned char * restrict chroma2) - { - typedef struct PCDTable - { -@@ -236,7 +241,8 @@ - length; - - unsigned char -- *buffer; -+ *buffer, -+ *plane_end; - - unsigned int - bits, -@@ -332,6 +338,7 @@ - plane=0; - row=0; - q=luma; -+ plane_end=luma+channel_alloc_size; - for ( ; ; ) - { - if (IsSync) -@@ -351,12 +358,14 @@ - case 0: - { - q=luma+row*(size_t)image->columns; -+ plane_end=luma+channel_alloc_size; - /* count=(long) image->columns; */ - break; - } - case 2: - { - q=chroma1+(row >> 1)*(size_t)image->columns; -+ plane_end=chroma1+channel_alloc_size; - /* count=(long) (image->columns >> 1); */ - plane--; - break; -@@ -364,6 +373,7 @@ - case 3: - { - q=chroma2+(row >> 1)*(size_t)image->columns; -+ plane_end=chroma2+channel_alloc_size; - /* count=(long) (image->columns >> 1); */ - plane--; - break; -@@ -405,6 +415,17 @@ - PCDGetBits(1); - continue; - } -+ /* Detect overflow */ -+ if (q >= plane_end) -+ { -+ if (image->logging) -+ (void) LogMagickEvent(CoderEvent,GetMagickModule(), -+ "Plane buffer overflow detected!"); -+ ThrowException(&image->exception,CorruptImageError, -+ UnableToUncompressImage,image->filename); -+ status=MagickFail; -+ goto decode_image_error; -+ } - if (r->key < 128U) - quantum=(long) (*q)+r->key; - else -@@ -564,7 +585,8 @@ - - size_t - number_pixels, -- count; -+ count, -+ channel_alloc_size; - - unsigned char - *chroma1 = NULL, -@@ -661,9 +683,13 @@ - number_pixels=MagickArraySize(image->columns,image->rows); - if (number_pixels == 0 || number_pixels+1 < number_pixels) - ThrowPCDReaderException(ResourceLimitError,MemoryAllocationFailed,image); -- chroma1=MagickAllocateResourceLimitedMemory(unsigned char *,number_pixels+1); -- chroma2=MagickAllocateResourceLimitedMemory(unsigned char *,number_pixels+1); -- luma=MagickAllocateResourceLimitedMemory(unsigned char *,number_pixels+1); -+ channel_alloc_size=MagickArraySize(number_pixels,10); -+ if (channel_alloc_size == 0 || channel_alloc_size+1 < channel_alloc_size) -+ ThrowPCDReaderException(ResourceLimitError,MemoryAllocationFailed,image); -+ channel_alloc_size++; -+ chroma1=MagickAllocateResourceLimitedClearedMemory(unsigned char *,channel_alloc_size); -+ chroma2=MagickAllocateResourceLimitedClearedMemory(unsigned char *,channel_alloc_size); -+ luma=MagickAllocateResourceLimitedClearedMemory(unsigned char *,channel_alloc_size); - if ((chroma1 == (unsigned char *) NULL) || - (chroma2 == (unsigned char *) NULL) || - (luma == (unsigned char *) NULL)) -@@ -741,6 +767,12 @@ - q->red=ScaleCharToQuantum(*yy++); - q->green=ScaleCharToQuantum(*c1++); - q->blue=ScaleCharToQuantum(*c2++); -+ if (((size_t) (yy-luma) >= channel_alloc_size) || -+ ((size_t) (c1-chroma1) >= channel_alloc_size) || -+ ((size_t) (c2-chroma2) >= channel_alloc_size)) -+ { -+ ThrowPCDReaderException(CorruptImageError,UnableToUncompressImage,image); -+ } - q++; - } - if (!SyncImagePixels(image)) -@@ -812,7 +844,7 @@ - image->rows=1024; - for (i=0; i < (4*0x800); i++) - (void) ReadBlobByte(image); -- status=DecodeImage(image,luma,chroma1,chroma2); -+ status=DecodeImage(image,channel_alloc_size,luma,chroma1,chroma2); - if ((subimage >= 5) && status) - { - /* -@@ -824,7 +856,7 @@ - image->rows=2048; - offset=TellBlob(image)/0x800+12; - (void) SeekBlob(image,offset*0x800,SEEK_SET); -- status=DecodeImage(image,luma,chroma1,chroma2); -+ status=DecodeImage(image,channel_alloc_size,luma,chroma1,chroma2); - if ((subimage >= 6) && status) +# Date 1785181844 18000 +# Mon Jul 27 14:50:44 2026 -0500 +# Node ID 2ad7c2631513f4bc84fe5c64434c0aad0d5122f3 +# Parent 7b913a0b4186c178c3ecc9043b0f71bb98d8fd05 +magick/xwindow.c (MagickXImportImage): Avoid heap buffer overflow of image filename field if X11 window name is longer than MaxTextExtent-1. Addresses ImageMagick CVE-2026-61464 (GHSA-76q6-2p6h-xjqr). + +diff --git a/magick/xwindow.c b/magick/xwindow.c +--- a/magick/xwindow.c ++++ b/magick/xwindow.c +@@ -5147,10 +5147,27 @@ { /* -@@ -860,6 +892,12 @@ - q->red=ScaleCharToQuantum(*yy++); - q->green=ScaleCharToQuantum(*c1++); - q->blue=ScaleCharToQuantum(*c2++); -+ if (((size_t) (yy-luma) >= channel_alloc_size) || -+ ((size_t) (c1-chroma1) >= channel_alloc_size) || -+ ((size_t) (c2-chroma2) >= channel_alloc_size)) -+ { -+ ThrowPCDReaderException(CorruptImageError,UnableToUncompressImage,image); -+ } - q++; - } - if (!SyncImagePixels(image)) + Initialize image filename. ++ Ignores XTextProperty 'encoding' (e.g. STRING, COMPOUND_TEXT, UTF8_STRING) + */ +- (void) strlcpy(image->filename,(char *) window_name.value, +- (int) window_name.nitems+1); +- image->filename[window_name.nitems]='\0'; ++ if (window_name.format == 8) ++ { ++ if (window_name.nitems >= sizeof(image->filename)) ++ (void) LogMagickEvent(X11Event,GetMagickModule(), ++ "Window name length is %lu bytes but the limit is %zu!", ++ window_name.nitems, sizeof(image->filename)-1); ++ (void) strlcpy(image->filename, ++ (char *) window_name.value, ++ Min((size_t) window_name.nitems+1,sizeof(image->filename))); ++ ++ (void) LogMagickEvent(X11Event,GetMagickModule(), ++ "Window (file) name set to \"%s\"\n", image->filename); ++ } ++ else ++ { ++ (void) LogMagickEvent(X11Event,GetMagickModule(), ++ "Window name item size of %d bits is not supported!", ++ window_name.format); ++ } + } + (void) XFree((void *) window_name.value); + }
