Attachment 23046 Details for Bug 59081

new patch

ImageMagick-5.5.7-bmp.patch (text/x-diff), 1.68 KB, created by Vladimir Nadvornik on 2004-08-31 00:02:29 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Vladimir Nadvornik

Created: 2004-08-31 00:02:29 UTC

Size: 1.68 KB

patch

obsolete

>--- coders/avi.c
>+++ coders/avi.c
>@@ -171,17 +171,24 @@
>   register unsigned char
>     *q;
> 
>+  unsigned char
>+    *end;
>+
>   (void) memset(pixels,0,image->columns*image->rows);
>   byte=0;
>   x=0;
>   q=pixels;
>+  end=pixels + (size_t) image->columns*image->rows;
>   for (y=0; y < (long) image->rows; )
>   {
>+    if (q < pixels || q  >= end)
>+      break;
>     count=ReadBlobByte(image);
>     if (count == EOF)
>       break;
>     if (count != 0)
>       {
>+        count=Min((unsigned long)count, end - q);
>         /*
>           Encoded mode.
>         */
>@@ -231,6 +238,7 @@
>             /*
>               Absolute mode.
>             */
>+    	    count=Min((unsigned long)count, end - q);
>             for (i=0; i < count; i++)
>             {
>               if (compression == 1)
>--- coders/bmp.c
>+++ coders/bmp.c
>@@ -187,6 +187,9 @@
>   register unsigned char
>     *q;
> 
>+  unsigned char
>+    *end;
>+
>   assert(image != (Image *) NULL);
>   assert(pixels != (unsigned char *) NULL);
>   (void) LogMagickEvent(CoderEvent,GetMagickModule(),"  Decoding RLE pixels");
>@@ -194,13 +197,17 @@
>   byte=0;
>   x=0;
>   q=pixels;
>+  end=pixels + (size_t) image->columns*image->rows;
>   for (y=0; y < (long) image->rows; )
>   {
>+    if (q < pixels || q  >= end)
>+      break;
>     count=ReadBlobByte(image);
>     if (count == EOF)
>       break;
>     if (count != 0)
>       {
>+        count=Min((unsigned long)count, end - q);
>         /*
>           Encoded mode.
>         */
>@@ -257,6 +264,7 @@
>             /*
>               Absolute mode.
>             */
>+    	    count=Min((unsigned long)count, end - q);
>             if (compression == BI_RLE8)
>               for (i=count; i != 0; --i)
>                 *q++=ReadBlobByte(image);

Actions: View

Attachments on bug 59081: 22839 | 22867 | 23046