From 26d910675e0cd1b62e988139dba8eb11931260ac Mon Sep 17 00:00:00 2001 From: Cristy Date: Sat, 30 Jan 2016 09:37:10 -0500 Subject: [PATCH] Fix out of bound in quantum handling Bug: https://github.com/ImageMagick/ImageMagick/issues/105 bug-ubuntu: https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1539053 origin: upstream, https://github.com/ImageMagick/ImageMagick/commit/c4e63ad30bc42da691f2b5f82a24516dd6b4dc70 bug-debian: https://bugs.debian.org/832506 --- magick/quantum.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/magick/quantum.c b/magick/quantum.c index 3cadc3dfa..23ea85829 100644 --- a/magick/quantum.c +++ b/magick/quantum.c @@ -68,6 +68,9 @@ #include "magick/string-private.h" #include "magick/thread-private.h" #include "magick/utility.h" + + +#define MagickMax(X,Y) ((X) > (Y) ? (X) : (Y)) /* Define declarations. @@ -304,6 +307,7 @@ MagickExport size_t GetQuantumExtent(const Image *image, const QuantumInfo *quantum_info,const QuantumType quantum_type) { size_t + extent, packet_size; assert(quantum_info != (QuantumInfo *) NULL); @@ -322,9 +326,10 @@ MagickExport size_t GetQuantumExtent(const Image *image, case CMYKAQuantum: packet_size=5; break; default: break; } + extent=MagickMax(image->columns,image->rows); if (quantum_info->pack == MagickFalse) - return((size_t) (packet_size*image->columns*((quantum_info->depth+7)/8))); - return((size_t) ((packet_size*image->columns*quantum_info->depth+7)/8)); + return((size_t) (packet_size*extent*((quantum_info->depth+7)/8))); + return((size_t) ((packet_size*extent*quantum_info->depth+7)/8)); } /* @@ -680,8 +685,9 @@ MagickExport MagickBooleanType SetQuantumDepth(const Image *image, if (quantum_info->pixels != (unsigned char **) NULL) DestroyQuantumPixels(quantum_info); quantum=(quantum_info->pad+6)*(quantum_info->depth+7)/8; - extent=image->columns*quantum; - if ((image->columns != 0) && (quantum != (extent/image->columns))) + extent=MagickMax(image->columns,image->rows)*quantum; + if ((MagickMax(image->columns,image->rows) != 0) && + (quantum != (extent/MagickMax(image->columns,image->rows)))) return(MagickFalse); return(AcquireQuantumPixels(quantum_info,extent)); }