From: Cristy Date: Sat, 20 Apr 2024 06:40:49 -0400 Subject: use a different path for positive and negative values This is needed for fixing CVE-2023-34151 Cast from double to integer is hard to correctly and was fixed by a few patches upstream. origin: https://github.com/ImageMagick/ImageMagick6/commit/bc5ac19bd93895e5c6158aad0d8e49a0c50b0ebb.patch --- magick/image-private.h | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/magick/image-private.h b/magick/image-private.h index 839ed72..4e03993 100644 --- a/magick/image-private.h +++ b/magick/image-private.h @@ -63,16 +63,23 @@ static inline size_t CastDoubleToLong(const double x) errno=ERANGE; return(0); } - value=floor(x); - if (value > ((double) MAGICK_SSIZE_MAX)) + if (x < 0.0) { - errno=ERANGE; - return((ssize_t) MAGICK_SSIZE_MAX); - } value=ceil(x); - if (value < ((double) MAGICK_SSIZE_MIN)) + value=ceil(x); + if (value < ((double) MAGICK_SSIZE_MIN)) + { + errno=ERANGE; + return((ssize_t) MAGICK_SSIZE_MIN); + } + } + else { - errno=ERANGE; - return(0); + value=floor(x); + if (value > ((double) MAGICK_SSIZE_MAX)) + { + errno=ERANGE; + return((ssize_t) MAGICK_SSIZE_MAX); + } } return((ssize_t) value); }