From: Cristy Date: Fri, 19 Apr 2024 14:33:05 -0400 Subject: check for value < 0, ceil() not required This patch addresses CVE-2023-34151, not a recurring bug of CVE-2022-32546. Cast from double to integer is hard to correctly and was fixed by a few patches upstream. bug: https://github.com/ImageMagick/ImageMagick/issues/6341 origin: https://github.com/ImageMagick/ImageMagick6/commit/b72508c8fce196cd031856574c202490be830649.patch --- magick/image-private.h | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/magick/image-private.h b/magick/image-private.h index 57c5159..bfc0265 100644 --- a/magick/image-private.h +++ b/magick/image-private.h @@ -67,16 +67,14 @@ static inline size_t CastDoubleToLong(const double x) if (value > ((double) MAGICK_SSIZE_MAX-1)) { errno=ERANGE; - return((size_t) MAGICK_SIZE_MAX); - } - - value=ceil(x); + return((ssize_t) MAGICK_SSIZE_MAX); + } value=ceil(x); if (value < ((double) MAGICK_SSIZE_MIN+1)) { errno=ERANGE; return(0); } - return((size_t) x); + return((ssize_t) value); } static inline QuantumAny CastDoubleToQuantumAny(const double x) @@ -106,13 +104,12 @@ static inline size_t CastDoubleToUnsigned(const double x) errno=ERANGE; return((size_t) MAGICK_SIZE_MAX); } - value=ceil(x); - if (ceil(x) < 0.0) + if (value < 0.0) { errno=ERANGE; return(0); } - return((size_t) x); + return((size_t) value); } static inline double DegreesToRadians(const double degrees)