openbsd-ports/graphics/ImageMagick/patches/patch-magick_signature_c
naddy afa33518bc Update to 6.2.3:
* Fixed an obscure heap-overflow vulnerability in the PNM reader.
* Avoid infinite loop if bogus XWD rad/green/blue masks are 0.

Also:
* Regression test fixes.
* No need to remove previously installed ImageMagick.

From new maintainer Bernd Ahlers <b.ahlers@ba-net.org>.
2005-06-04 14:39:21 +00:00

62 lines
1.9 KiB
Plaintext

$OpenBSD: patch-magick_signature_c,v 1.3 2005/06/04 14:39:21 naddy Exp $
--- magick/signature.c.orig Tue May 24 00:32:49 2005
+++ magick/signature.c Sun May 29 20:00:07 2005
@@ -369,8 +369,19 @@ static void TransformSignature(Signature
T2,
W[64];
+ unsigned int
+ uT;
+
shift=32;
p=signature_info->message;
+
+ /*
+ * The original code was incorrect on sparc64 (and other arches) in that it
+ * assumes that &signature_info->message is on the appropriate boundary
+ * to cast to an unsigned long. It isn't. It causes a bus error
+ * on sparc64. This code is not much better and assumes that an
+ * unsigned int is 4 bytes long. At least it doesn't get a bus error.
+ */
if (signature_info->lsb_first == MagickFalse)
{
if (sizeof(unsigned long) <= 4)
@@ -381,12 +392,11 @@ static void TransformSignature(Signature
W[i]=Trunc32(T);
}
else
- for (i=0; i < 16; i+=2)
+ for (i=0; i < 16; i++)
{
- T=(*((unsigned long *) p));
- p+=8;
- W[i]=Trunc32(T >> shift);
- W[i+1]=Trunc32(T);
+ uT=(*((unsigned int *) p));
+ p+=4;
+ W[i]=uT;
}
}
else
@@ -399,15 +409,12 @@ static void TransformSignature(Signature
((T >> 8) & 0x0000ff00) | ((T >> 24) & 0x000000ff);
}
else
- for (i=0; i < 16; i+=2)
+ for (i=0; i < 16; i++)
{
- T=(*((unsigned long *) p));
- p+=8;
- W[i]=((T << 24) & 0xff000000) | ((T << 8) & 0x00ff0000) |
- ((T >> 8) & 0x0000ff00) | ((T >> 24) & 0x000000ff);
- T>>=shift;
- W[i+1]=((T << 24) & 0xff000000) | ((T << 8) & 0x00ff0000) |
- ((T >> 8) & 0x0000ff00) | ((T >> 24) & 0x000000ff);
+ uT=(*((unsigned int *) p));
+ p+=4;
+ W[i]=((uT << 24) & 0xff000000) | ((uT << 8) & 0x00ff0000) |
+ ((uT >> 8) & 0x0000ff00) | ((uT >> 24) & 0x000000ff);
}
/*
Copy digest to registers.