tag 414058 + patch tag 414059 + patch thanks On Mon, Mar 05, 2007 at 09:23:04AM +0200, Sami Liedes wrote: > Another SEGV in PICT coder in both imagemagicks and graphicsmagick > even with #413036-pict_segfault_fix applied.
Crash on out-of-bounds read, not exploitable. Patch attached. Daniel.
--- a/coders/pict.c Sat Mar 10 22:19:28 2007 +0100 +++ b/coders/pict.c Sat Mar 10 22:29:08 2007 +0100 @@ -65,6 +65,10 @@ pixmap.plane_bytes=ReadBlobMSBLong(image); \ pixmap.table=ReadBlobMSBLong(image); \ pixmap.reserved=ReadBlobMSBLong(image); \ + if (pixmap.bits_per_pixel <= 0 || pixmap.bits_per_pixel > 32 || \ + pixmap.component_count <= 0 || pixmap.component_count > 4 || \ + pixmap.component_size <= 0) \ + ThrowReaderException(CorruptImageError,ImproperImageHeader,image); \ } #define ReadRectangle(rectangle) \ @@ -73,6 +77,9 @@ rectangle.left=ReadBlobMSBShort(image); \ rectangle.bottom=ReadBlobMSBShort(image); \ rectangle.right=ReadBlobMSBShort(image); \ + if (rectangle.top > rectangle.bottom || \ + rectangle.left > rectangle.right) \ + ThrowReaderException(CorruptImageError,ImproperImageHeader,image); \ } typedef struct _PICTCode
