1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
|
From: Cristy <urban-warrior@imagemagick.org>
Date: Thu, 7 Aug 2025 19:14:00 -0400
Subject: CVE-2025-55004
bug: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cjc8-g9w8-chfw
origin: https://github.com/ImageMagick/ImageMagick/commit/55d97055e00a7bc7ae2776c99824002fbb4a72aa
---
coders/png.c | 33 ++++++++++-----------------------
1 file changed, 10 insertions(+), 23 deletions(-)
diff --git a/coders/png.c b/coders/png.c
index ad756e8..9594623 100644
--- a/coders/png.c
+++ b/coders/png.c
@@ -4779,37 +4779,24 @@ static Image *ReadOneJNGImage(MngReadInfo *mng_info,
jng_image=ReadImage(alpha_image_info,exception);
if (jng_image != (Image *) NULL)
- for (y=0; y < (ssize_t) image->rows; y++)
{
- s=GetVirtualPixels(jng_image,0,y,image->columns,1,exception);
- q=GetAuthenticPixels(image,0,y,image->columns,1,exception);
- if ((s == (const Quantum *) NULL) || (q == (Quantum *) NULL))
- break;
+ image->alpha_trait=BlendPixelTrait;
+ for (y=0; y < (ssize_t) image->rows; y++)
+ {
+ s=GetVirtualPixels(jng_image,0,y,image->columns,1,exception);
+ q=GetAuthenticPixels(image,0,y,image->columns,1,exception);
+ if ((s == (const Quantum *) NULL) || (q == (Quantum *) NULL))
+ break;
- if (image->alpha_trait != UndefinedPixelTrait)
for (x=(ssize_t) image->columns; x != 0; x--)
{
SetPixelAlpha(image,GetPixelRed(jng_image,s),q);
q+=(ptrdiff_t) GetPixelChannels(image);
s+=(ptrdiff_t) GetPixelChannels(jng_image);
}
-
- else
- for (x=(ssize_t) image->columns; x != 0; x--)
- {
- Quantum
- alpha;
-
- alpha=GetPixelRed(jng_image,s);
- SetPixelAlpha(image,alpha,q);
- if (alpha != OpaqueAlpha)
- image->alpha_trait=BlendPixelTrait;
- q+=(ptrdiff_t) GetPixelChannels(image);
- s+=(ptrdiff_t) GetPixelChannels(jng_image);
- }
-
- if (SyncAuthenticPixels(image,exception) == MagickFalse)
- break;
+ if (SyncAuthenticPixels(image,exception) == MagickFalse)
+ break;
+ }
}
(void) RelinquishUniqueFileResource(alpha_image->filename);
alpha_image=DestroyImageList(alpha_image);
|
