[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Emacs-diffs] trunk r117482: Minor ImageMagick safety fixes.
From: |
Paul Eggert |
Subject: |
[Emacs-diffs] trunk r117482: Minor ImageMagick safety fixes. |
Date: |
Mon, 07 Jul 2014 23:25:22 +0000 |
User-agent: |
Bazaar (2.6b2) |
------------------------------------------------------------
revno: 117482
revision-id: address@hidden
parent: address@hidden
committer: Paul Eggert <address@hidden>
branch nick: trunk
timestamp: Mon 2014-07-07 16:25:13 -0700
message:
Minor ImageMagick safety fixes.
* image.c (imagemagick_compute_animated_image):
Remove useless assignment to local. Avoid problems if dest_width is 0.
(imagemagick_load_image): Use int for pixel counts that can't
exceed INT_MAX. Avoid problem if PixelGetNextIteratorRow returns
a row width greater than the image width (or greater than LONG_MAX!).
modified:
src/ChangeLog changelog-20091113204419-o5vbwnq5f7feedwu-1438
src/image.c image.c-20091113204419-o5vbwnq5f7feedwu-2969
=== modified file 'src/ChangeLog'
--- a/src/ChangeLog 2014-07-05 14:07:57 +0000
+++ b/src/ChangeLog 2014-07-07 23:25:13 +0000
@@ -1,3 +1,12 @@
+2014-07-07 Paul Eggert <address@hidden>
+
+ Minor ImageMagick safety fixes.
+ * image.c (imagemagick_compute_animated_image):
+ Remove useless assignment to local. Avoid problems if dest_width is 0.
+ (imagemagick_load_image): Use int for pixel counts that can't
+ exceed INT_MAX. Avoid problem if PixelGetNextIteratorRow returns
+ a row width greater than the image width (or greater than LONG_MAX!).
+
2014-07-04 K. Handa <address@hidden>
* coding.c (MIN_CHARBUF_SIZE): Delete it.
=== modified file 'src/image.c'
--- a/src/image.c 2014-06-24 08:10:48 +0000
+++ b/src/image.c 2014-07-07 23:25:13 +0000
@@ -8059,7 +8059,6 @@
else
composite_wand = cache->wand;
- dest_width = MagickGetImageWidth (composite_wand);
dest_height = MagickGetImageHeight (composite_wand);
for (i = max (1, cache->index + 1); i <= ino; i++)
@@ -8128,13 +8127,12 @@
{
/* Sanity check. This shouldn't happen, but apparently
also does in some pictures. */
- if (x + source_left > dest_width - 1)
+ if (x + source_left >= dest_width)
break;
/* Normally we only copy over non-transparent pixels,
but if the disposal method is "Background", then we
copy over all pixels. */
- if (dispose == BackgroundDispose ||
- PixelGetAlpha (source[x]))
+ if (dispose == BackgroundDispose || PixelGetAlpha (source[x]))
{
PixelGetMagickColor (source[x], &pixel);
PixelSetMagickColor (dest[x + source_left], &pixel);
@@ -8174,7 +8172,8 @@
unsigned char *contents, unsigned int size,
char *filename)
{
- size_t width, height;
+ int width, height;
+ size_t image_width, image_height;
MagickBooleanType status;
XImagePtr ximg;
int x, y;
@@ -8344,16 +8343,19 @@
/* Finally we are done manipulating the image. Figure out the
resulting width/height and transfer ownership to Emacs. */
- height = MagickGetImageHeight (image_wand);
- width = MagickGetImageWidth (image_wand);
+ image_height = MagickGetImageHeight (image_wand);
+ image_width = MagickGetImageWidth (image_wand);
- if (! (width <= INT_MAX && height <= INT_MAX
- && check_image_size (f, width, height)))
+ if (! (image_width <= INT_MAX && image_height <= INT_MAX
+ && check_image_size (f, image_width, image_height)))
{
image_error ("Invalid image size (see `max-image-size')", Qnil, Qnil);
goto imagemagick_error;
}
+ width = image_width;
+ height = image_height;
+
/* We can now get a valid pixel buffer from the imagemagick file, if all
went ok. */
@@ -8438,10 +8440,12 @@
image_height = MagickGetImageHeight (image_wand);
for (y = 0; y < image_height; y++)
{
- pixels = PixelGetNextIteratorRow (iterator, &width);
+ size_t row_width;
+ pixels = PixelGetNextIteratorRow (iterator, &row_width);
if (! pixels)
break;
- for (x = 0; x < (long) width; x++)
+ int xlim = min (row_width, width);
+ for (x = 0; x < xlim; x++)
{
PixelGetMagickColor (pixels[x], &pixel);
XPutPixel (ximg, x, y,
[Prev in Thread] |
Current Thread |
[Next in Thread] |
- [Emacs-diffs] trunk r117482: Minor ImageMagick safety fixes.,
Paul Eggert <=