diff --git a/CVE-2020-21679.patch b/CVE-2020-21679.patch new file mode 100644 index 0000000000000000000000000000000000000000..e4f360176aa119880bd930ecc5a7c40832b1ead2 --- /dev/null +++ b/CVE-2020-21679.patch @@ -0,0 +1,57 @@ +# HG changeset patch +# User Bob Friesenhahn +# Date 1577551727 21600 +# Node ID bd13b1d335f3d5e00f3089867475c47ac646292b +# Parent 0d2c92bd86279a83424132dc732b75344b11327d +WritePCXImage(): Fix heap overflow when bytes per line is too large. + +Origin: http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/bd13b1d335f3 + +diff -r 0d2c92bd8627 -r bd13b1d335f3 coders/pcx.c +--- a/coders/pcx.c Sat Dec 28 10:19:36 2019 -0600 ++++ b/coders/pcx.c Sat Dec 28 10:48:47 2019 -0600 +@@ -1,5 +1,5 @@ + /* +-% Copyright (C) 2003 - 2018 GraphicsMagick Group ++% Copyright (C) 2003 - 2019 GraphicsMagick Group + % Copyright (C) 2002 ImageMagick Studio + % Copyright 1991-1999 E. I. du Pont de Nemours and Company + % +@@ -1008,7 +1008,7 @@ + *q; + + size_t +- length; ++ bytes_per_line; + + unsigned char + *pcx_colormap = (unsigned char *) NULL, +@@ -1126,8 +1126,16 @@ + if (image->matte) + pcx_info.planes++; + } +- pcx_info.bytes_per_line=(unsigned short) +- (((unsigned long) image->columns*pcx_info.bits_per_pixel+7)/8); ++ ++ /* image->columns*pcx_info.bits_per_pixel+7)/8 */ ++ bytes_per_line=MagickArraySize(image->columns,pcx_info.bits_per_pixel); ++ if (bytes_per_line && (~((size_t)0)-7 > bytes_per_line)) ++ bytes_per_line += 7; ++ bytes_per_line /= 8; ++ pcx_info.bytes_per_line=(unsigned short) bytes_per_line; ++ if ((pcx_info.bytes_per_line == 0) || ++ ((size_t) pcx_info.bytes_per_line != bytes_per_line)) ++ ThrowPCXWriterException(CoderError,UnsupportedNumberOfColumns,image); + pcx_info.palette_info=1; + pcx_info.colormap_signature=0x0c; + /* +@@ -1168,8 +1176,7 @@ + for (i=0; i < 58; i++) + (void) WriteBlobByte(image,'\0'); + /* Allocate memory for one pixel row. */ +- length=(size_t) pcx_info.bytes_per_line*pcx_info.planes; +- pcx_pixels=MagickAllocateMemory(unsigned char *,length); ++ pcx_pixels=MagickAllocateArray(unsigned char *,bytes_per_line,pcx_info.planes); + if (pcx_pixels == (unsigned char *) NULL) + ThrowPCXWriterException(ResourceLimitError,MemoryAllocationFailed,image); + q=pcx_pixels; diff --git a/GraphicsMagick.spec b/GraphicsMagick.spec index bd59abc6565217eb1e3603357649f96a31593668..09d2f51e579315365a3ca6ebd1c5a85128a5adde 100644 --- a/GraphicsMagick.spec +++ b/GraphicsMagick.spec @@ -10,7 +10,7 @@ Name: GraphicsMagick Version: 1.3.30 -Release: 9 +Release: 10 Summary: Derived from ImageMagick, providing faster image generation speed and better quality License: MIT Source0: http://downloads.sourceforge.net/sourceforge/graphicsmagick/GraphicsMagick-%{version}.tar.xz @@ -33,6 +33,7 @@ Patch0013: CVE-2020-10938.patch Patch0014: CVE-2020-12672.patch Patch0015: CVE-2019-11473-CVE-2019-11474.patch Patch0016: CVE-2022-1270.patch +Patch0017: CVE-2020-21679.patch BuildRequires: bzip2-devel freetype-devel gcc-c++ giflib-devel lcms2-devel libjpeg-devel BuildRequires: libpng-devel librsvg2-devel libtiff-devel libtool-ltdl-devel libxml2-devel lpr @@ -231,6 +232,9 @@ time %make_build check ||: %changelog +* Wed Sep 13 2023 wangkai <13474090681@163.com> - 1.3.30-10 +- Fix CVE-2020-21679 + * Mon Jul 11 2022 houyingchao - 1.3.30-9 - Fix CVE-2022-1270