afa33518bc
* Fixed an obscure heap-overflow vulnerability in the PNM reader. * Avoid infinite loop if bogus XWD rad/green/blue masks are 0. Also: * Regression test fixes. * No need to remove previously installed ImageMagick. From new maintainer Bernd Ahlers <b.ahlers@ba-net.org>.
62 lines
1.9 KiB
Plaintext
62 lines
1.9 KiB
Plaintext
$OpenBSD: patch-magick_signature_c,v 1.3 2005/06/04 14:39:21 naddy Exp $
|
|
--- magick/signature.c.orig Tue May 24 00:32:49 2005
|
|
+++ magick/signature.c Sun May 29 20:00:07 2005
|
|
@@ -369,8 +369,19 @@ static void TransformSignature(Signature
|
|
T2,
|
|
W[64];
|
|
|
|
+ unsigned int
|
|
+ uT;
|
|
+
|
|
shift=32;
|
|
p=signature_info->message;
|
|
+
|
|
+ /*
|
|
+ * The original code was incorrect on sparc64 (and other arches) in that it
|
|
+ * assumes that &signature_info->message is on the appropriate boundary
|
|
+ * to cast to an unsigned long. It isn't. It causes a bus error
|
|
+ * on sparc64. This code is not much better and assumes that an
|
|
+ * unsigned int is 4 bytes long. At least it doesn't get a bus error.
|
|
+ */
|
|
if (signature_info->lsb_first == MagickFalse)
|
|
{
|
|
if (sizeof(unsigned long) <= 4)
|
|
@@ -381,12 +392,11 @@ static void TransformSignature(Signature
|
|
W[i]=Trunc32(T);
|
|
}
|
|
else
|
|
- for (i=0; i < 16; i+=2)
|
|
+ for (i=0; i < 16; i++)
|
|
{
|
|
- T=(*((unsigned long *) p));
|
|
- p+=8;
|
|
- W[i]=Trunc32(T >> shift);
|
|
- W[i+1]=Trunc32(T);
|
|
+ uT=(*((unsigned int *) p));
|
|
+ p+=4;
|
|
+ W[i]=uT;
|
|
}
|
|
}
|
|
else
|
|
@@ -399,15 +409,12 @@ static void TransformSignature(Signature
|
|
((T >> 8) & 0x0000ff00) | ((T >> 24) & 0x000000ff);
|
|
}
|
|
else
|
|
- for (i=0; i < 16; i+=2)
|
|
+ for (i=0; i < 16; i++)
|
|
{
|
|
- T=(*((unsigned long *) p));
|
|
- p+=8;
|
|
- W[i]=((T << 24) & 0xff000000) | ((T << 8) & 0x00ff0000) |
|
|
- ((T >> 8) & 0x0000ff00) | ((T >> 24) & 0x000000ff);
|
|
- T>>=shift;
|
|
- W[i+1]=((T << 24) & 0xff000000) | ((T << 8) & 0x00ff0000) |
|
|
- ((T >> 8) & 0x0000ff00) | ((T >> 24) & 0x000000ff);
|
|
+ uT=(*((unsigned int *) p));
|
|
+ p+=4;
|
|
+ W[i]=((uT << 24) & 0xff000000) | ((uT << 8) & 0x00ff0000) |
|
|
+ ((uT >> 8) & 0x0000ff00) | ((uT >> 24) & 0x000000ff);
|
|
}
|
|
/*
|
|
Copy digest to registers.
|