From: Cristy Date: Wed, 17 May 2023 21:06:18 -0400 Subject: CVE-2023-34151: properly cast double to size_t bug: https://github.com/ImageMagick/ImageMagick/issues/6341 --- coders/caption.c | 10 +++++----- coders/label.c | 10 +++++----- coders/pcl.c | 4 ++-- coders/pdf.c | 4 ++-- coders/ps.c | 4 ++-- coders/ps2.c | 4 ++-- coders/ps3.c | 4 ++-- coders/svg.c | 4 ++-- magick/annotate.c | 4 ++-- magick/draw.c | 8 ++++---- magick/geometry.c | 4 ++-- magick/shear.c | 10 +++++----- magick/visual-effects.c | 4 ++-- 13 files changed, 37 insertions(+), 37 deletions(-) diff --git a/coders/caption.c b/coders/caption.c index 73568fd..37a56f3 100644 --- a/coders/caption.c +++ b/coders/caption.c @@ -154,7 +154,7 @@ static Image *ReadCAPTIONImage(const ImageInfo *image_info, return(DestroyImageList(image)); (void) SetImageProperty(image,"caption",caption); draw_info=CloneDrawInfo(image_info,(DrawInfo *) NULL); - width=(size_t) floor(draw_info->pointsize*strlen(caption)+0.5); + width=CastDoubleToUnsigned(draw_info->pointsize*strlen(caption)+0.5); if (AcquireMagickResource(WidthResource,width) == MagickFalse) { caption=DestroyString(caption); @@ -239,8 +239,8 @@ static Image *ReadCAPTIONImage(const ImageInfo *image_info, status=GetMultilineTypeMetrics(image,draw_info,&metrics); if (status == MagickFalse) break; - width=(size_t) floor(metrics.width+draw_info->stroke_width+0.5); - height=(size_t) floor(metrics.height+draw_info->interline_spacing+ + width=CastDoubleToUnsigned(metrics.width+draw_info->stroke_width+0.5); + height=CastDoubleToUnsigned(metrics.height+draw_info->interline_spacing+ draw_info->stroke_width+0.5); if ((image->columns != 0) && (image->rows != 0)) { @@ -267,8 +267,8 @@ static Image *ReadCAPTIONImage(const ImageInfo *image_info, status=GetMultilineTypeMetrics(image,draw_info,&metrics); if (status == MagickFalse) break; - width=(size_t) floor(metrics.width+draw_info->stroke_width+0.5); - height=(size_t) floor(metrics.height+draw_info->interline_spacing+ + width=CastDoubleToUnsigned(metrics.width+draw_info->stroke_width+0.5); + height=CastDoubleToUnsigned(metrics.height+draw_info->interline_spacing+ draw_info->stroke_width+0.5); if ((image->columns != 0) && (image->rows != 0)) { diff --git a/coders/label.c b/coders/label.c index 81cba24..4ee719b 100644 --- a/coders/label.c +++ b/coders/label.c @@ -135,7 +135,7 @@ static Image *ReadLABELImage(const ImageInfo *image_info, return(DestroyImageList(image)); (void) SetImageProperty(image,"label",label); draw_info=CloneDrawInfo(image_info,(DrawInfo *) NULL); - width=(size_t) floor(draw_info->pointsize*strlen(label)+0.5); + width=CastDoubleToUnsigned(draw_info->pointsize*strlen(label)+0.5); if (AcquireMagickResource(WidthResource,width) == MagickFalse) { label=DestroyString(label); @@ -174,8 +174,8 @@ static Image *ReadLABELImage(const ImageInfo *image_info, status=GetMultilineTypeMetrics(image,draw_info,&metrics); if (status == MagickFalse) break; - width=(size_t) floor(metrics.width+draw_info->stroke_width+0.5); - height=(size_t) floor(metrics.height+draw_info->stroke_width+0.5); + width=CastDoubleToUnsigned(metrics.width+draw_info->stroke_width+0.5); + height=CastDoubleToUnsigned(metrics.height+draw_info->stroke_width+0.5); if ((image->columns != 0) && (image->rows != 0)) { if ((width >= image->columns) && (height >= image->rows)) @@ -204,8 +204,8 @@ static Image *ReadLABELImage(const ImageInfo *image_info, status=GetMultilineTypeMetrics(image,draw_info,&metrics); if (status == MagickFalse) break; - width=(size_t) floor(metrics.width+draw_info->stroke_width+0.5); - height=(size_t) floor(metrics.height+draw_info->stroke_width+0.5); + width=CastDoubleToUnsigned(metrics.width+draw_info->stroke_width+0.5); + height=CastDoubleToUnsigned(metrics.height+draw_info->stroke_width+0.5); if ((image->columns != 0) && (image->rows != 0)) { if ((width < image->columns) && (height < image->rows)) diff --git a/coders/pcl.c b/coders/pcl.c index f1d9a7d..b109526 100644 --- a/coders/pcl.c +++ b/coders/pcl.c @@ -333,9 +333,9 @@ static Image *ReadPCLImage(const ImageInfo *image_info,ExceptionInfo *exception) image->x_resolution,image->y_resolution); if (image_info->ping != MagickFalse) (void) FormatLocaleString(density,MagickPathExtent,"2.0x2.0"); - page.width=(size_t) floor((double) page.width*image->x_resolution/delta.x+ + page.width=CastDoubleToUnsigned((double) page.width*image->x_resolution/delta.x+ 0.5); - page.height=(size_t) floor((double) page.height*image->y_resolution/delta.y+ + page.height=CastDoubleToUnsigned((double) page.height*image->y_resolution/delta.y+ 0.5); (void) FormatLocaleString(options,MaxTextExtent,"-g%.20gx%.20g ",(double) page.width,(double) page.height); diff --git a/coders/pdf.c b/coders/pdf.c index 4fd7fe3..25077d8 100644 --- a/coders/pdf.c +++ b/coders/pdf.c @@ -1587,9 +1587,9 @@ static MagickBooleanType WritePDFImage(const ImageInfo *image_info,Image *image) (void) ParseMetaGeometry(page_geometry,&geometry.x,&geometry.y, &geometry.width,&geometry.height); scale.x=(double) (geometry.width*delta.x)/resolution.x; - geometry.width=(size_t) floor(scale.x+0.5); + geometry.width=CastDoubleToUnsigned(scale.x+0.5); scale.y=(double) (geometry.height*delta.y)/resolution.y; - geometry.height=(size_t) floor(scale.y+0.5); + geometry.height=CastDoubleToUnsigned(scale.y+0.5); (void) ParseAbsoluteGeometry(page_geometry,&media_info); (void) ParseGravityGeometry(image,page_geometry,&page_info, &image->exception); diff --git a/coders/ps.c b/coders/ps.c index b351eae..af81bbb 100644 --- a/coders/ps.c +++ b/coders/ps.c @@ -1502,9 +1502,9 @@ static MagickBooleanType WritePSImage(const ImageInfo *image_info,Image *image) (void) ParseMetaGeometry(page_geometry,&geometry.x,&geometry.y, &geometry.width,&geometry.height); scale.x=PerceptibleReciprocal(resolution.x)*geometry.width*delta.x; - geometry.width=(size_t) floor(scale.x+0.5); + geometry.width=CastDoubleToUnsigned(scale.x+0.5); scale.y=PerceptibleReciprocal(resolution.y)*geometry.height*delta.y; - geometry.height=(size_t) floor(scale.y+0.5); + geometry.height=CastDoubleToUnsigned(scale.y+0.5); (void) ParseAbsoluteGeometry(page_geometry,&media_info); (void) ParseGravityGeometry(image,page_geometry,&page_info, &image->exception); diff --git a/coders/ps2.c b/coders/ps2.c index afc60ab..3e102dc 100644 --- a/coders/ps2.c +++ b/coders/ps2.c @@ -533,9 +533,9 @@ static MagickBooleanType WritePS2Image(const ImageInfo *image_info,Image *image) (void) ParseMetaGeometry(page_geometry,&geometry.x,&geometry.y, &geometry.width,&geometry.height); scale.x=PerceptibleReciprocal(resolution.x)*geometry.width*delta.x; - geometry.width=(size_t) floor(scale.x+0.5); + geometry.width=CastDoubleToUnsigned(scale.x+0.5); scale.y=PerceptibleReciprocal(resolution.y)*geometry.height*delta.y; - geometry.height=(size_t) floor(scale.y+0.5); + geometry.height=CastDoubleToUnsigned(scale.y+0.5); (void) ParseAbsoluteGeometry(page_geometry,&media_info); (void) ParseGravityGeometry(image,page_geometry,&page_info, &image->exception); diff --git a/coders/ps3.c b/coders/ps3.c index 9a795ff..192a19d 100644 --- a/coders/ps3.c +++ b/coders/ps3.c @@ -980,9 +980,9 @@ static MagickBooleanType WritePS3Image(const ImageInfo *image_info,Image *image) (void) ParseMetaGeometry(page_geometry,&geometry.x,&geometry.y, &geometry.width,&geometry.height); scale.x=PerceptibleReciprocal(resolution.x)*geometry.width*delta.x; - geometry.width=(size_t) floor(scale.x+0.5); + geometry.width=CastDoubleToUnsigned(scale.x+0.5); scale.y=PerceptibleReciprocal(resolution.y)*geometry.height*delta.y; - geometry.height=(size_t) floor(scale.y+0.5); + geometry.height=CastDoubleToUnsigned(scale.y+0.5); (void) ParseAbsoluteGeometry(page_geometry,&media_info); (void) ParseGravityGeometry(image,page_geometry,&page_info, &image->exception); diff --git a/coders/svg.c b/coders/svg.c index 0b3364b..912c714f 100644 --- a/coders/svg.c +++ b/coders/svg.c @@ -2519,10 +2519,10 @@ static void SVGStartElement(void *context,const xmlChar *name, svg_info->view_box=svg_info->bounds; svg_info->width=0; if (svg_info->bounds.width > 0.0) - svg_info->width=(size_t) floor(svg_info->bounds.width+0.5); + svg_info->width=CastDoubleToUnsigned(svg_info->bounds.width+0.5); svg_info->height=0; if (svg_info->bounds.height > 0.0) - svg_info->height=(size_t) floor(svg_info->bounds.height+0.5); + svg_info->height=CastDoubleToUnsigned(svg_info->bounds.height+0.5); (void) FormatLocaleFile(svg_info->file,"viewbox 0 0 %.20g %.20g\n", (double) svg_info->width,(double) svg_info->height); sx=PerceptibleReciprocal(svg_info->view_box.width)*svg_info->width; diff --git a/magick/annotate.c b/magick/annotate.c index 20fbf7b..874fb8b 100644 --- a/magick/annotate.c +++ b/magick/annotate.c @@ -325,7 +325,7 @@ MagickExport MagickBooleanType AnnotateImage(Image *image, (void) CloneString(&annotate->text,textlist[i]); if ((metrics.width == 0) || (annotate->gravity != NorthWestGravity)) (void) GetTypeMetrics(image,annotate,&metrics); - height=(size_t) floor(metrics.ascent-metrics.descent+0.5); + height=CastDoubleToUnsigned(metrics.ascent-metrics.descent+0.5); if (height == 0) height=draw_info->pointsize; height+=(size_t) floor(draw_info->interline_spacing+0.5); @@ -610,7 +610,7 @@ MagickExport ssize_t FormatMagickCaption(Image *image,DrawInfo *draw_info, status=GetTypeMetrics(image,draw_info,metrics); if (status == MagickFalse) break; - width=(size_t) floor(metrics->width+draw_info->stroke_width+0.5); + width=CastDoubleToUnsigned(metrics->width+draw_info->stroke_width+0.5); if (width <= image->columns) continue; if (s != (char *) NULL) diff --git a/magick/draw.c b/magick/draw.c index 918d27f..50ed8e0 100644 --- a/magick/draw.c +++ b/magick/draw.c @@ -3447,14 +3447,14 @@ static MagickBooleanType RenderMVGContent(Image *image, (void) GetNextToken(q,&q,extent,token); if (*token == ',') (void) GetNextToken(q,&q,extent,token); - bounds.width=(size_t) floor(GetDrawValue(token,&next_token)+ + bounds.width=CastDoubleToUnsigned(GetDrawValue(token,&next_token)+ 0.5); if (token == next_token) ThrowPointExpectedException(image,token); (void) GetNextToken(q,&q,extent,token); if (*token == ',') (void) GetNextToken(q,&q,extent,token); - bounds.height=(size_t) floor(GetDrawValue(token,&next_token)+ + bounds.height=CastDoubleToUnsigned(GetDrawValue(token,&next_token)+ 0.5); if (token == next_token) ThrowPointExpectedException(image,token); @@ -3859,14 +3859,14 @@ static MagickBooleanType RenderMVGContent(Image *image, (void) GetNextToken(q,&q,extent,token); if (*token == ',') (void) GetNextToken(q,&q,extent,token); - graphic_context[n]->viewbox.width=(size_t) floor(GetDrawValue( + graphic_context[n]->viewbox.width=CastDoubleToUnsigned(GetDrawValue( token,&next_token)+0.5); if (token == next_token) ThrowPointExpectedException(image,token); (void) GetNextToken(q,&q,extent,token); if (*token == ',') (void) GetNextToken(q,&q,extent,token); - graphic_context[n]->viewbox.height=(size_t) floor(GetDrawValue( + graphic_context[n]->viewbox.height=CastDoubleToUnsigned(GetDrawValue( token,&next_token)+0.5); if (token == next_token) ThrowPointExpectedException(image,token); diff --git a/magick/geometry.c b/magick/geometry.c index 5290abe..1d6ef77 100644 --- a/magick/geometry.c +++ b/magick/geometry.c @@ -1411,8 +1411,8 @@ MagickExport MagickStatusType ParseMetaGeometry(const char *geometry,ssize_t *x, scale.y=geometry_info.sigma; if ((flags & SigmaValue) == 0) scale.y=scale.x; - *width=(size_t) floor(scale.x*former_width/100.0+0.5); - *height=(size_t) floor(scale.y*former_height/100.0+0.5); + *width=CastDoubleToUnsigned(scale.x*former_width/100.0+0.5); + *height=CastDoubleToUnsigned(scale.y*former_height/100.0+0.5); former_width=(*width); former_height=(*height); } diff --git a/magick/shear.c b/magick/shear.c index 731db09..26b0405 100644 --- a/magick/shear.c +++ b/magick/shear.c @@ -166,8 +166,8 @@ static MagickBooleanType CropToFitImage(Image **image, } geometry.x=CastDoubleToLong(ceil(min.x-0.5)); geometry.y=CastDoubleToLong(ceil(min.y-0.5)); - geometry.width=(size_t) floor(max.x-min.x+0.5); - geometry.height=(size_t) floor(max.y-min.y+0.5); + geometry.width=CastDoubleToUnsigned(max.x-min.x+0.5); + geometry.height=CastDoubleToUnsigned(max.y-min.y+0.5); page=(*image)->page; (void) ParseAbsoluteGeometry("0x0+0+0",&(*image)->page); crop_image=CropImage(*image,&geometry,exception); @@ -1787,9 +1787,9 @@ MagickExport Image *ShearRotateImage(const Image *image,const double degrees, */ width=integral_image->columns; height=integral_image->rows; - bounds.width=(size_t) floor(fabs((double) height*shear.x)+width+0.5); - bounds.height=(size_t) floor(fabs((double) bounds.width*shear.y)+height+0.5); - shear_width=(size_t) floor(fabs((double) bounds.height*shear.x)+ + bounds.width=CastDoubleToUnsigned(fabs((double) height*shear.x)+width+0.5); + bounds.height=CastDoubleToUnsigned(fabs((double) bounds.width*shear.y)+height+0.5); + shear_width=CastDoubleToUnsigned(fabs((double) bounds.height*shear.x)+ bounds.width+0.5); bounds.x=CastDoubleToLong(floor((double) ((shear_width > bounds.width) ? width : bounds.width-shear_width+2)/2.0+0.5)); diff --git a/magick/visual-effects.c b/magick/visual-effects.c index 87fd0b0..b263978 100644 --- a/magick/visual-effects.c +++ b/magick/visual-effects.c @@ -2052,8 +2052,8 @@ MagickExport Image *ShadowImage(const Image *image,const double opacity, (void) SetImageColorspace(clone_image,sRGBColorspace); (void) SetImageVirtualPixelMethod(clone_image,EdgeVirtualPixelMethod); clone_image->compose=OverCompositeOp; - border_info.width=(size_t) floor(2.0*sigma+0.5); - border_info.height=(size_t) floor(2.0*sigma+0.5); + border_info.width=CastDoubleToUnsigned(2.0*sigma+0.5); + border_info.height=CastDoubleToUnsigned(2.0*sigma+0.5); border_info.x=0; border_info.y=0; (void) QueryColorDatabase("none",&clone_image->border_color,exception);