From b218117cad34d39b9ffb587b45c71c5a49b12bde Mon Sep 17 00:00:00 2001 From: Cristy Date: Fri, 31 Mar 2017 15:24:33 -0400 Subject: [PATCH] https://github.com/ImageMagick/ImageMagick/issues/415 Fixes CVE-2017-7606 Signed-off-by: Peter Korsgaard --- coders/pnm.c | 2 +- coders/rle.c | 5 +++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/coders/pnm.c b/coders/pnm.c index 9a1221d79..c525ebb8f 100644 --- a/coders/pnm.c +++ b/coders/pnm.c @@ -1979,7 +1979,7 @@ static MagickBooleanType WritePNMImage(const ImageInfo *image_info,Image *image, pixel=ScaleQuantumToChar(GetPixelRed(image,p)); else pixel=ScaleQuantumToAny(GetPixelRed(image,p), - max_value); + max_value); } q=PopCharPixel((unsigned char) pixel,q); p+=GetPixelChannels(image); diff --git a/coders/rle.c b/coders/rle.c index 2318901ec..ec071dc7b 100644 --- a/coders/rle.c +++ b/coders/rle.c @@ -271,7 +271,8 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception) p=colormap; for (i=0; i < (ssize_t) number_colormaps; i++) for (x=0; x < (ssize_t) map_length; x++) - *p++=(unsigned char) ScaleShortToQuantum(ReadBlobLSBShort(image)); + *p++=(unsigned char) ScaleQuantumToChar(ScaleShortToQuantum( + ReadBlobLSBShort(image))); } if ((flags & 0x08) != 0) { @@ -476,7 +477,7 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception) for (x=0; x < (ssize_t) number_planes; x++) { ValidateColormapValue(image,(size_t) (x*map_length+ - (*p & mask)),&index,exception); + (*p & mask)),&index,exception); *p=colormap[(ssize_t) index]; p++; } -- 2.11.0