diff -Nru imagemagick-6.7.7.10/debian/changelog imagemagick-6.7.7.10/debian/changelog --- imagemagick-6.7.7.10/debian/changelog 2012-08-28 01:47:30.000000000 +0200 +++ imagemagick-6.7.7.10/debian/changelog 2012-11-05 13:56:13.000000000 +0100 @@ -1,3 +1,13 @@ +imagemagick (8:6.7.7.10-5) unstable; urgency=high + + * Fix three security bug (Closes: #692367): + - Fix a memory leak: after setjmp used variable need to be volatile. + Fix jpeg and png coder. + - Fix a memory leak: in webp handling add a forgotten WebPPictureFree + - Fix another memory leak in case of corrupted image in magick++ read method. + + -- Bastien Roucariès Mon, 05 Nov 2012 13:55:44 +0100 + imagemagick (8:6.7.7.10-4) unstable; urgency=high * Security Bug fix: "Fails an assertion due to OpenMP related problem", diff -Nru imagemagick-6.7.7.10/debian/patches/0005-Memory-leak-after-setjmp-used-variable-need-to-be-vo.patch imagemagick-6.7.7.10/debian/patches/0005-Memory-leak-after-setjmp-used-variable-need-to-be-vo.patch --- imagemagick-6.7.7.10/debian/patches/0005-Memory-leak-after-setjmp-used-variable-need-to-be-vo.patch 1970-01-01 01:00:00.000000000 +0100 +++ imagemagick-6.7.7.10/debian/patches/0005-Memory-leak-after-setjmp-used-variable-need-to-be-vo.patch 2012-11-05 13:57:00.000000000 +0100 @@ -0,0 +1,118 @@ +From ce26253aceb1f72ffe49e12f193923e567501109 Mon Sep 17 00:00:00 2001 +From: cristy +Date: Mon, 8 Oct 2012 16:26:00 +0000 +Subject: [PATCH] Memory leak: after setjmp used variable need to be volatile + +According to POSIX setjmp manpage: + All accessible objects have values as of the time longjmp() was called, + except that the values of objects of automatic storage duration which are + local to the function containing the invocation of the corresponding + setjmp() which do not have volatile-qualified type and + which are changed between the setjmp() invocation and longjmp() call are indeterminate. + +Previous code was not safe according to this specification and could lead to memory +leak. + +If the setjmp handler is called after reading a corrupted png, ping_pixels may +be null and thus lead to a memory leak. + +Mark this kind of variable as volatile. + +git-svn-id: https://www.imagemagick.org/subversion/ImageMagick/trunk@9558 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74 + +Cherry picked rom svn revision 9558 + +Origin: upstream, http://trac.imagemagick.org/changeset/9558 +Bug: http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=22024 +--- + coders/jpeg.c | 16 ++++++++-------- + coders/png.c | 4 ++-- + 2 files changed, 10 insertions(+), 10 deletions(-) + +diff --git a/coders/jpeg.c b/coders/jpeg.c +index 38cf292..262fe11 100644 +--- a/coders/jpeg.c ++++ b/coders/jpeg.c +@@ -951,7 +951,7 @@ static Image *ReadJPEGImage(const ImageInfo *image_info, + index; + + JSAMPLE +- *jpeg_pixels; ++ *volatile jpeg_pixels; + + JSAMPROW + scanline[1]; +@@ -1240,8 +1240,8 @@ static Image *ReadJPEGImage(const ImageInfo *image_info, + */ + if (setjmp(error_manager.error_recovery) != 0) + { +- if (jpeg_pixels != (unsigned char *) NULL) +- jpeg_pixels=(unsigned char *) RelinquishMagickMemory(jpeg_pixels); ++ if (jpeg_pixels != (JSAMPLE *) NULL) ++ jpeg_pixels=(JSAMPLE *) RelinquishMagickMemory(jpeg_pixels); + jpeg_destroy_decompress(&jpeg_info); + (void) CloseBlob(image); + number_pixels=(MagickSizeType) image->columns*image->rows; +@@ -1395,7 +1395,7 @@ static Image *ReadJPEGImage(const ImageInfo *image_info, + Free jpeg resources. + */ + jpeg_destroy_decompress(&jpeg_info); +- jpeg_pixels=(unsigned char *) RelinquishMagickMemory(jpeg_pixels); ++ jpeg_pixels=(JSAMPLE *) RelinquishMagickMemory(jpeg_pixels); + (void) CloseBlob(image); + return(GetFirstImageInList(image)); + } +@@ -1992,7 +1992,7 @@ static MagickBooleanType WriteJPEGImage(const ImageInfo *image_info, + quality; + + JSAMPLE +- *jpeg_pixels; ++ *volatile jpeg_pixels; + + JSAMPROW + scanline[1]; +@@ -2513,8 +2513,8 @@ static MagickBooleanType WriteJPEGImage(const ImageInfo *image_info, + if (setjmp(error_manager.error_recovery) != 0) + { + jpeg_destroy_compress(&jpeg_info); +- if (jpeg_pixels != (unsigned char *) NULL) +- jpeg_pixels=(unsigned char *) RelinquishMagickMemory(jpeg_pixels); ++ if (jpeg_pixels != (JSAMPLE *) NULL) ++ jpeg_pixels=(JSAMPLE *) RelinquishMagickMemory(jpeg_pixels); + (void) CloseBlob(image); + return(MagickFalse); + } +@@ -2710,7 +2710,7 @@ static MagickBooleanType WriteJPEGImage(const ImageInfo *image_info, + Relinquish resources. + */ + jpeg_destroy_compress(&jpeg_info); +- jpeg_pixels=(unsigned char *) RelinquishMagickMemory(jpeg_pixels); ++ jpeg_pixels=(JSAMPLE *) RelinquishMagickMemory(jpeg_pixels); + (void) CloseBlob(image); + return(MagickTrue); + } +diff --git a/coders/png.c b/coders/png.c +index dc0cac9..8037c62 100644 +--- a/coders/png.c ++++ b/coders/png.c +@@ -2012,7 +2012,7 @@ static Image *ReadOnePNGImage(MngInfo *mng_info, + y_resolution; + + unsigned char +- *ping_pixels; ++ *volatile ping_pixels; + + ssize_t + ping_rowbytes, +@@ -7507,7 +7507,7 @@ static MagickBooleanType WriteOnePNGImage(MngInfo *mng_info, + x; + + unsigned char +- *ping_pixels; ++ *volatile ping_pixels; + + volatile int + image_colors, +-- +1.7.10.4 + diff -Nru imagemagick-6.7.7.10/debian/patches/0006-Fix-a-memory-leak-in-webp-handling.patch imagemagick-6.7.7.10/debian/patches/0006-Fix-a-memory-leak-in-webp-handling.patch --- imagemagick-6.7.7.10/debian/patches/0006-Fix-a-memory-leak-in-webp-handling.patch 1970-01-01 01:00:00.000000000 +0100 +++ imagemagick-6.7.7.10/debian/patches/0006-Fix-a-memory-leak-in-webp-handling.patch 2012-11-05 13:57:00.000000000 +0100 @@ -0,0 +1,30 @@ +From b3f3eb7602e6a0ebd83ca863089b2f87595c3b9f Mon Sep 17 00:00:00 2001 +From: cristy +Date: Wed, 26 Sep 2012 09:43:12 +0000 +Subject: [PATCH] Fix a memory leak in webp handling + +Under current code in WriteWEBPImage() they are a lacking WebPPictureFree(&picture) +thus leading to a memory leak. + +Bug: http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=21943 +Origin: Upstream, http://trac.imagemagick.org/changeset/9433 +git-svn-id: https://www.imagemagick.org/subversion/ImageMagick/trunk@9433 aa41f4f7-0bf4-0310-aa73-e5a19afd5a74 +--- + coders/webp.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/coders/webp.c b/coders/webp.c +index 44ea3f7..580c68f 100644 +--- a/coders/webp.c ++++ b/coders/webp.c +@@ -391,6 +391,7 @@ static MagickBooleanType WriteWEBPImage(const ImageInfo *image_info, + webp_status=WebPPictureImportRGBA(&picture,pixels,4*picture.width); + pixels=(unsigned char *) RelinquishMagickMemory(pixels); + webp_status=WebPEncode(&configure,&picture); ++ WebPPictureFree(&picture); + (void) CloseBlob(image); + return(webp_status == 0 ? MagickFalse : MagickTrue); + } +-- +1.7.10.4 + diff -Nru imagemagick-6.7.7.10/debian/patches/0007-Magick-fix-a-memory-leak.patch imagemagick-6.7.7.10/debian/patches/0007-Magick-fix-a-memory-leak.patch --- imagemagick-6.7.7.10/debian/patches/0007-Magick-fix-a-memory-leak.patch 1970-01-01 01:00:00.000000000 +0100 +++ imagemagick-6.7.7.10/debian/patches/0007-Magick-fix-a-memory-leak.patch 2012-11-05 13:57:00.000000000 +0100 @@ -0,0 +1,42 @@ +From 4400cc5440a48da45e083d9e38b7bd4eb928accc Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Bastien=20ROUCARI=C3=88S?= +Date: Wed, 24 Oct 2012 12:07:59 +0200 +Subject: [PATCH] Magick++ fix a memory leak + +Original code leak memory in case of corrupted image. When image->exception is thrown, the following DestroyExceptionInfo will not be executed, thus lead to a leak. + +Fix it by adding (void) DestroyExceptionInfo( &exceptionInfo ) before throwing. + +Origin: upstream, http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=21948 +Bug: http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=21948 +Author: John Cristy +Applied-Upstream: 6.8.0.1 +--- + Magick++/lib/Image.cpp | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/Magick++/lib/Image.cpp b/Magick++/lib/Image.cpp +index e0c4379..c93388b 100644 +--- a/Magick++/lib/Image.cpp ++++ b/Magick++/lib/Image.cpp +@@ -1601,11 +1601,14 @@ void Magick::Image::read ( const std::string &imageSpec_ ) + DestroyImageList( next ); + + } +- replaceImage( image ); +- throwException( exceptionInfo ); + if ( image ) +- throwException( image->exception ); ++ { ++ (void) DestroyExceptionInfo( &exceptionInfo ); ++ throwException( image->exception ); ++ } ++ throwException( exceptionInfo ); + (void) DestroyExceptionInfo( &exceptionInfo ); ++ replaceImage( image ); + } + + // Read image of specified size into current object +-- +1.7.10.4 + diff -Nru imagemagick-6.7.7.10/debian/patches/series imagemagick-6.7.7.10/debian/patches/series --- imagemagick-6.7.7.10/debian/patches/series 2012-08-28 01:47:39.000000000 +0200 +++ imagemagick-6.7.7.10/debian/patches/series 2012-11-05 13:57:00.000000000 +0100 @@ -3,3 +3,6 @@ 0002-Fix-security-bug-685903-libmagick-5-Fails-an-asserti.patch 0003-Fix-security-bug-685903-libmagick-5-Fails-an-asserti.patch 0004-Fix-security-bug-685903-libmagick-5-Fails-an-asserti.patch +0005-Memory-leak-after-setjmp-used-variable-need-to-be-vo.patch +0006-Fix-a-memory-leak-in-webp-handling.patch +0007-Magick-fix-a-memory-leak.patch