1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
|
From: Cristy <urban-warrior@imagemagick.org>
Date: Fri, 7 Feb 2025 20:57:15 -0500
Subject: multispectral MIFF images renders all channels in arbitrary order
origin: https://github.com/ImageMagick/ImageMagick/commit/81ac8a0d2eb21739842ed18c48c7646b7eef65b8
bug-debian-security: https://security-tracker.debian.org/tracker/CVE-2025-46393
---
coders/miff.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/coders/miff.c b/coders/miff.c
index 887659e..47fa753 100644
--- a/coders/miff.c
+++ b/coders/miff.c
@@ -1348,10 +1348,10 @@ static Image *ReadMIFFImage(const ImageInfo *image_info,
packet_size+=image->depth/8;
if (image->colorspace == CMYKColorspace)
packet_size+=image->depth/8;
+ if (image->number_meta_channels != 0)
+ packet_size=GetImageChannels(image)*image->depth/8;
if (image->compression == RLECompression)
packet_size++;
- if (image->number_meta_channels != 0)
- packet_size+=image->number_meta_channels*image->depth/8;
compress_extent=MagickMax(MagickMax(BZipMaxExtent(packet_size*
image->columns),LZMAMaxExtent(packet_size*image->columns)),
ZipMaxExtent(packet_size*image->columns));
@@ -2172,7 +2172,7 @@ static MagickBooleanType WriteMIFFImage(const ImageInfo *image_info,
if (compression == RLECompression)
packet_size++;
if (image->number_meta_channels != 0)
- packet_size+=image->number_meta_channels*image->depth/8;
+ packet_size=GetImageChannels(image)*image->depth/8;
length=MagickMax(BZipMaxExtent(packet_size*image->columns),ZipMaxExtent(
packet_size*image->columns));
if ((compression == BZipCompression) || (compression == ZipCompression))
|
