Changeset 7321

Timestamp:

04/03/12 08:47:47 (14 months ago)

Author:

cristy

Message:

 

Location:

ImageMagick/branches/ImageMagick-6

Files:

• ChangeLog (modified) (1 diff)
• magick/colorspace.c (modified) (2 diffs)
• magick/property.c (modified) (1 diff)

ImageMagick/branches/ImageMagick-6/ChangeLog

@@ -7 +7 @@
   * Support 'orientation' property (reference
     http://www.imagemagick.org/discourse-server/viewtopic.php?f=2&t=20650).
+  * The default RGB colorspace transform is now linear (reference
+    http://www.imagemagick.org/discourse-server/viewtopic.php?p=82839#p82839).
+  * Prevent EXIF integer overflow (CVE-2012-1610).
 
 2012-03-30  6.7.6-3 Cristy  <quetzlzacatenango@image...>

ImageMagick/branches/ImageMagick-6/magick/colorspace.c

@@ -2459 +2459 @@
     }
     case YUVColorspace:
-    default:
     {
       /*
@@ -2489 +2488 @@
           MaxMap);
         z_map[i].z=0.00000f;
+      }
+      break;
+    }
+    default:
+    {
+      /*
+        Linear conversion tables.
+      */
+#if defined(MAGICKCORE_OPENMP_SUPPORT)
+      #pragma omp parallel for schedule(static)
+#endif
+      for (i=0; i <= (ssize_t) MaxMap; i++)
+      {
+        x_map[i].x=(MagickRealType) i;
+        y_map[i].x=0.0f;
+        z_map[i].x=0.0f;
+        x_map[i].y=0.0f;
+        y_map[i].y=(MagickRealType) i;
+        z_map[i].y=0.0f;
+        x_map[i].z=0.0f;
+        y_map[i].z=0.0f;
+        z_map[i].z=(MagickRealType) i;
       }
       break;

ImageMagick/branches/ImageMagick-6/magick/property.c

@@ -1287 +1287 @@
       components=(ssize_t) ((int) ReadPropertyLong(endian,q+4));
       number_bytes=(size_t) components*tag_bytes[format];
+      if (number_bytes < components)
+        break;  /* prevent overflow */
       if (number_bytes <= 4)
         p=q+8;