Package: graphicsmagick / 1.3.30+hg15796-1~deb9u4

CVE-2018-20189.patch Patch series | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

# HG changeset patch
# User Bob Friesenhahn <bfriesen@GraphicsMagick.org>
# Date 1545006244 21600
# Node ID 648e2b40658913b0d1e3dc9490f6a9d83abf84ea
# Parent  ed75df97bed357ad8bb1a8185e013cc41772af4f
ReadDIBImage(): DIB images claiming more than 8-bits per pixel are not colormapped.  Reject such files.

diff -r ed75df97bed3 -r 648e2b406589 coders/dib.c
--- a/coders/dib.c	Sun Dec 16 09:51:58 2018 -0600
+++ b/coders/dib.c	Sun Dec 16 18:24:04 2018 -0600
@@ -646,9 +646,11 @@
     ThrowReaderException(CorruptImageError,ImproperImageHeader,image);
   if (dib_info.colors_important > 256)
     ThrowReaderException(CorruptImageError,ImproperImageHeader,image);
+  if ((dib_info.number_colors != 0) && (dib_info.bits_per_pixel > 8))
+    ThrowReaderException(CorruptImageError,ImproperImageHeader,image);
   if ((dib_info.image_size != 0U) && (dib_info.image_size > file_size))
     ThrowReaderException(CorruptImageError,UnexpectedEndOfFile,image);
-  if ((dib_info.number_colors != 0) || (dib_info.bits_per_pixel < 16))
+  if ((dib_info.number_colors != 0) || (dib_info.bits_per_pixel <= 8))
     {
       image->storage_class=PseudoClass;
       image->colors=dib_info.number_colors;
@@ -945,7 +947,7 @@
         word;
 
       /*
-        Convert PseudoColor scanline.
+        Convert DirectColor (555 or 565) scanline.
       */
       image->storage_class=DirectClass;
       if (dib_info.compression == 1)