| From b218117cad34d39b9ffb587b45c71c5a49b12bde Mon Sep 17 00:00:00 2001 |
| From: Cristy <urban-warrior@imagemagick.org> |
| Date: Fri, 31 Mar 2017 15:24:33 -0400 |
| Subject: [PATCH] https://github.com/ImageMagick/ImageMagick/issues/415 |
| |
| Fixes CVE-2017-7606 |
| |
| Signed-off-by: Peter Korsgaard <peter@korsgaard.com> |
| --- |
| coders/pnm.c | 2 +- |
| coders/rle.c | 5 +++-- |
| 2 files changed, 4 insertions(+), 3 deletions(-) |
| |
| diff --git a/coders/pnm.c b/coders/pnm.c |
| index 9a1221d79..c525ebb8f 100644 |
| --- a/coders/pnm.c |
| +++ b/coders/pnm.c |
| @@ -1979,7 +1979,7 @@ static MagickBooleanType WritePNMImage(const ImageInfo *image_info,Image *image, |
| pixel=ScaleQuantumToChar(GetPixelRed(image,p)); |
| else |
| pixel=ScaleQuantumToAny(GetPixelRed(image,p), |
| - max_value); |
| + max_value); |
| } |
| q=PopCharPixel((unsigned char) pixel,q); |
| p+=GetPixelChannels(image); |
| diff --git a/coders/rle.c b/coders/rle.c |
| index 2318901ec..ec071dc7b 100644 |
| --- a/coders/rle.c |
| +++ b/coders/rle.c |
| @@ -271,7 +271,8 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception) |
| p=colormap; |
| for (i=0; i < (ssize_t) number_colormaps; i++) |
| for (x=0; x < (ssize_t) map_length; x++) |
| - *p++=(unsigned char) ScaleShortToQuantum(ReadBlobLSBShort(image)); |
| + *p++=(unsigned char) ScaleQuantumToChar(ScaleShortToQuantum( |
| + ReadBlobLSBShort(image))); |
| } |
| if ((flags & 0x08) != 0) |
| { |
| @@ -476,7 +477,7 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception) |
| for (x=0; x < (ssize_t) number_planes; x++) |
| { |
| ValidateColormapValue(image,(size_t) (x*map_length+ |
| - (*p & mask)),&index,exception); |
| + (*p & mask)),&index,exception); |
| *p=colormap[(ssize_t) index]; |
| p++; |
| } |
| -- |
| 2.11.0 |
| |
