|
 |
83ed3b |
From b78822716fd79b380ddce5cbe23ce82d08e1df96 Mon Sep 17 00:00:00 2001
|
|
|
83ed3b |
From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
|
|
|
83ed3b |
Date: Thu, 14 Nov 2013 12:36:55 +0000
|
|
|
83ed3b |
Subject: [PATCH] Fix CVE-2014-1947, CVE-2014-2030
|
|
|
83ed3b |
|
|
|
83ed3b |
Upstream commit: r13736
|
|
|
83ed3b |
|
|
|
83ed3b |
Make layer_name large enough so that an overflow does not occur if
|
|
|
83ed3b |
there are more than 99 layers.
|
|
|
83ed3b |
---
|
|
|
83ed3b |
coders/psd.c | 12 ++++++------
|
|
|
83ed3b |
1 file changed, 6 insertions(+), 6 deletions(-)
|
|
|
83ed3b |
|
|
|
83ed3b |
diff --git a/coders/psd.c b/coders/psd.c
|
|
|
83ed3b |
index 3c0b938..5c23992 100644
|
|
|
83ed3b |
--- a/coders/psd.c
|
|
|
83ed3b |
+++ b/coders/psd.c
|
|
|
83ed3b |
@@ -2101,9 +2101,6 @@ static MagickBooleanType WritePSDImage(const ImageInfo *image_info,Image *image)
|
|
|
83ed3b |
StringInfo
|
|
|
83ed3b |
*bim_profile;
|
|
|
83ed3b |
|
|
|
83ed3b |
- unsigned char
|
|
|
83ed3b |
- layer_name[4];
|
|
|
83ed3b |
-
|
|
|
83ed3b |
/*
|
|
|
83ed3b |
Open image file.
|
|
|
83ed3b |
*/
|
|
|
83ed3b |
@@ -2361,12 +2358,15 @@ static MagickBooleanType WritePSDImage(const ImageInfo *image_info,Image *image)
|
|
|
83ed3b |
property=(const char *) GetImageProperty(next_image,"label");
|
|
|
83ed3b |
if (property == (const char *) NULL)
|
|
|
83ed3b |
{
|
|
|
83ed3b |
+ char
|
|
|
83ed3b |
+ layer_name[MaxTextExtent];
|
|
|
83ed3b |
+
|
|
|
83ed3b |
(void) WriteBlobMSBLong(image,16);
|
|
|
83ed3b |
(void) WriteBlobMSBLong(image,0);
|
|
|
83ed3b |
(void) WriteBlobMSBLong(image,0);
|
|
|
83ed3b |
- (void) FormatLocaleString((char *) layer_name,MaxTextExtent,
|
|
|
83ed3b |
- "L%06ld",(long) layer_count++);
|
|
|
83ed3b |
- WritePascalString( image, (char*)layer_name, 4 );
|
|
|
83ed3b |
+ (void) FormatLocaleString(layer_name,MaxTextExtent,"L%06ld",(long)
|
|
|
83ed3b |
+ layer_count++);
|
|
|
83ed3b |
+ WritePascalString(image,layer_name,4);
|
|
|
83ed3b |
}
|
|
|
83ed3b |
else
|
|
|
83ed3b |
{
|
|
|
83ed3b |
--
|
|
|
83ed3b |
1.8.3.1
|
|
|
83ed3b |
|