1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
|
From: Cristy <urban-warrior@imagemagick.org>
Date: Mon, 6 Mar 2023 19:50:49 -0500
Subject: CVE-2023-1289: recursion detection fail
This is a partial revert of the detection recursion of CVE-2023-1289.
origin: https://github.com/ImageMagick/ImageMagick6/commit/1485a4c2cba8ca32981016fa25e7a15ef84f06f6.patch
---
magick/constitute.c | 7 -------
magick/draw.c | 1 -
magick/image.c | 1 -
magick/image.h | 3 ---
4 files changed, 12 deletions(-)
diff --git a/magick/constitute.c b/magick/constitute.c
index 49e8f82..410c106 100644
--- a/magick/constitute.c
+++ b/magick/constitute.c
@@ -563,16 +563,9 @@ MagickExport Image *ReadImage(const ImageInfo *image_info,
if ((thread_support & DecoderThreadSupport) == 0)
LockSemaphoreInfo(magick_info->semaphore);
status=IsCoderAuthorized(read_info->magick,ReadPolicyRights,exception);
- if (((ImageInfo *) image_info)->recursion_depth++ > MaxReadRecursionDepth)
- {
- (void) ThrowMagickException(exception,GetMagickModule(),CoderError,
- "NumberOfImagesIsNotSupported","`%s'",read_info->magick);
- status=MagickFalse;
- }
image=(Image *) NULL;
if (status != MagickFalse)
image=GetImageDecoder(magick_info)(read_info,exception);
- ((ImageInfo *) image_info)->recursion_depth--;
if ((thread_support & DecoderThreadSupport) == 0)
UnlockSemaphoreInfo(magick_info->semaphore);
}
diff --git a/magick/draw.c b/magick/draw.c
index 14774d6..c27cb9a 100644
--- a/magick/draw.c
+++ b/magick/draw.c
@@ -5452,7 +5452,6 @@ MagickExport MagickBooleanType DrawPrimitive(Image *image,
if (primitive_info->text == (char *) NULL)
break;
clone_info=AcquireImageInfo();
- clone_info->recursion_depth=draw_info->image_info->recursion_depth;
composite_images=(Image *) NULL;
if (LocaleNCompare(primitive_info->text,"data:",5) == 0)
composite_images=ReadInlineImage(clone_info,primitive_info->text,
diff --git a/magick/image.c b/magick/image.c
index 9ee22d8..1fc3617 100644
--- a/magick/image.c
+++ b/magick/image.c
@@ -1008,7 +1008,6 @@ MagickExport ImageInfo *CloneImageInfo(const ImageInfo *image_info)
clone_info->subimage=image_info->scene; /* deprecated */
clone_info->subrange=image_info->number_scenes; /* deprecated */
clone_info->channel=image_info->channel;
- clone_info->recursion_depth=image_info->recursion_depth;
clone_info->debug=IsEventLogging();
clone_info->signature=image_info->signature;
return(clone_info);
diff --git a/magick/image.h b/magick/image.h
index e71df13..ac69bef 100644
--- a/magick/image.h
+++ b/magick/image.h
@@ -499,9 +499,6 @@ struct _ImageInfo
MagickBooleanType
synchronize;
-
- size_t
- recursion_depth; /* recursion detection */
};
extern MagickExport ExceptionType
|
