rpms/ImageMagick/FC-5 ImageMagick-6.2.5-cve-2006-5456.patch, NONE, 1.1 ImageMagick.spec, 1.62, 1.63

[fedora-cvs-commits at redhat.com]

Author: nmurray

Update of /cvs/dist/rpms/ImageMagick/FC-5
In directory cvs.devel.redhat.com:/tmp/cvs-serv27052

Modified Files:
	ImageMagick.spec 
Added Files:
	ImageMagick-6.2.5-cve-2006-5456.patch 
Log Message:
fix BZ 210921


ImageMagick-6.2.5-cve-2006-5456.patch:
 dcm.c  |    2 +-
 palm.c |    6 +++++-
 2 files changed, 6 insertions(+), 2 deletions(-)

--- NEW FILE ImageMagick-6.2.5-cve-2006-5456.patch ---
--- ImageMagick-6.2.5/coders/dcm.c~	2004-08-30 07:33:02.000000000 +1000
+++ ImageMagick-6.2.5/coders/dcm.c	2006-11-02 16:10:42.000000000 +1000
@@ -3027,7 +3027,7 @@ static Image *ReadDCMImage(const ImageIn
             /*
               Photometric interpretation.
             */
-            for (i=0; i < (long) length; i++)
+            for (i=0; i < (long) Min(length, MaxTextExtent-1); i++)
               photometric[i]=(char) data[i];
             photometric[i]='\0';
             break;
--- ImageMagick-6.2.5/coders/palm.c~	2006-11-15 14:34:09.000000000 +1000
+++ ImageMagick-6.2.5/coders/palm.c	2006-11-15 14:42:12.000000000 +1000
@@ -398,7 +398,7 @@ static Image *ReadPALMImage(const ImageI
               image->compression=RLECompression;
               for (i=0; i < (long) bytes_per_row; )
               {
-                count=ReadBlobByte(image);
+                count=Min(ReadBlobByte(image),bytes_per_row-i);
                 byte=ReadBlobByte(image);
                 (void) ResetMagickMemory(one_row+i,(int) byte,count);
                 i+=count;
@@ -431,6 +431,8 @@ static Image *ReadPALMImage(const ImageI
       indexes=GetIndexes(image);
       if (bits_per_pixel == 16)
         {
+	  if (image->columns > 2*bytes_per_row)
+	    ThrowReaderException(CorruptImageError,"CorruptImage");
           for (x=0; x < (long) image->columns; x++)
           {
             color16=(*ptr++ << 8);
@@ -447,6 +449,8 @@ static Image *ReadPALMImage(const ImageI
           bit=8-bits_per_pixel;
           for (x=0; x < (long) image->columns; x++)
           {
+	    if (ptr - one_row >= bytes_per_row)
+	      ThrowReaderException(CorruptImageError,"CorruptImage");
             index=(IndexPacket) (mask-(((*ptr) & (mask << bit)) >> bit));
             indexes[x]=index;
             *q++=image->colormap[index];


Index: ImageMagick.spec
===================================================================
RCS file: /cvs/dist/rpms/ImageMagick/FC-5/ImageMagick.spec,v
retrieving revision 1.62
retrieving revision 1.63
diff -u -r1.62 -r1.63
--- ImageMagick.spec	22 Sep 2006 01:12:30 -0000	1.62
+++ ImageMagick.spec	22 Nov 2006 01:14:39 -0000	1.63
@@ -9,7 +9,7 @@
 %else
 Version: %{VER}
 %endif
-Release: 4.2.1.fc5.6
+Release: 4.2.1.fc5.7
 License: freeware
 Group: Applications/Multimedia
 %if "%{Patchlevel}" != ""
@@ -27,6 +27,8 @@
 Patch5: ImageMagick-6.2.2-cve-2006-4144.patch
 # 203975
 Patch6: ImageMagick-6.2.5-perl-liblink.patch
+# 
+Patch7: ImageMagick-6.2.5-cve-2006-5456.patch
 
 
 Url: http://www.imagemagick.org/
@@ -127,6 +129,7 @@
 %patch4 -p1 -b .cve-2006-3743
 %patch5 -p1 -b .cve-2006-4144
 %patch6 -p1 -b .perl-liblink
+%patch7 -p1 -b .cve-2006-5456
 
 %build
 %configure --enable-shared \
@@ -237,6 +240,9 @@
 %doc PerlMagick/demo/ PerlMagick/Changelog PerlMagick/README.txt
 
 %changelog
+* Fri Sep 22 2006 Norm Murray <nmurray at redhat.com> 6.2.5.4-4.2.1.fc5.7
+- more overflows (#210921 CVE-2006-5456)
+
 * Fri Sep 22 2006 Norm Murray <nmurray at redhat.com> 6.2.5.4-4.2.1.fc5.6
 - fix ImageMagick-perl building (#203975)