1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980 |
- From ac16bdf2d41724b5a65255d4c28fb0ec46bc42f5 Mon Sep 17 00:00:00 2001
- From: Mike Frysinger <vapier@gentoo.org>
- Date: Sat, 14 Jul 2018 13:54:08 -0400
- Subject: [PATCH] bmp: check return value in gdImageBmpPtr
- Closes #447.
- CVE-2018-1000222
- Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
- ---
- src/gd_bmp.c | 17 ++++++++++++++---
- 1 file changed, 14 insertions(+), 3 deletions(-)
- diff --git a/src/gd_bmp.c b/src/gd_bmp.c
- index bde0b9d..78f40d9 100644
- --- a/src/gd_bmp.c
- +++ b/src/gd_bmp.c
- @@ -47,6 +47,8 @@ static int bmp_read_4bit(gdImagePtr im, gdIOCtxPtr infile, bmp_info_t *info, bmp
- static int bmp_read_8bit(gdImagePtr im, gdIOCtxPtr infile, bmp_info_t *info, bmp_hdr_t *header);
- static int bmp_read_rle(gdImagePtr im, gdIOCtxPtr infile, bmp_info_t *info);
-
- +static int _gdImageBmpCtx(gdImagePtr im, gdIOCtxPtr out, int compression);
- +
- #define BMP_DEBUG(s)
-
- static int gdBMPPutWord(gdIOCtx *out, int w)
- @@ -87,8 +89,10 @@ BGD_DECLARE(void *) gdImageBmpPtr(gdImagePtr im, int *size, int compression)
- void *rv;
- gdIOCtx *out = gdNewDynamicCtx(2048, NULL);
- if (out == NULL) return NULL;
- - gdImageBmpCtx(im, out, compression);
- - rv = gdDPExtractData(out, size);
- + if (!_gdImageBmpCtx(im, out, compression))
- + rv = gdDPExtractData(out, size);
- + else
- + rv = NULL;
- out->gd_free(out);
- return rv;
- }
- @@ -141,6 +145,11 @@ BGD_DECLARE(void) gdImageBmp(gdImagePtr im, FILE *outFile, int compression)
- compression - whether to apply RLE or not.
- */
- BGD_DECLARE(void) gdImageBmpCtx(gdImagePtr im, gdIOCtxPtr out, int compression)
- +{
- + _gdImageBmpCtx(im, out, compression);
- +}
- +
- +static int _gdImageBmpCtx(gdImagePtr im, gdIOCtxPtr out, int compression)
- {
- int bitmap_size = 0, info_size, total_size, padding;
- int i, row, xpos, pixel;
- @@ -148,6 +157,7 @@ BGD_DECLARE(void) gdImageBmpCtx(gdImagePtr im, gdIOCtxPtr out, int compression)
- unsigned char *uncompressed_row = NULL, *uncompressed_row_start = NULL;
- FILE *tmpfile_for_compression = NULL;
- gdIOCtxPtr out_original = NULL;
- + int ret = 1;
-
- /* No compression if its true colour or we don't support seek */
- if (im->trueColor) {
- @@ -325,6 +335,7 @@ BGD_DECLARE(void) gdImageBmpCtx(gdImagePtr im, gdIOCtxPtr out, int compression)
- out_original = NULL;
- }
-
- + ret = 0;
- cleanup:
- if (tmpfile_for_compression) {
- #ifdef _WIN32
- @@ -338,7 +349,7 @@ cleanup:
- if (out_original) {
- out_original->gd_free(out_original);
- }
- - return;
- + return ret;
- }
-
- static int compress_row(unsigned char *row, int length)
- --
- 2.20.1
|