|
 |
b7c072 |
From b78822716fd79b380ddce5cbe23ce82d08e1df96 Mon Sep 17 00:00:00 2001
|
|
|
b7c072 |
From: cristy <cristy@aa41f4f7-0bf4-0310-aa73-e5a19afd5a74>
|
|
|
b7c072 |
Date: Thu, 14 Nov 2013 12:36:55 +0000
|
|
|
b7c072 |
Subject: [PATCH] Fix CVE-2014-1947, CVE-2014-2030
|
|
|
b7c072 |
|
|
|
b7c072 |
Upstream commit: r13736
|
|
|
b7c072 |
|
|
|
b7c072 |
Make layer_name large enough so that an overflow does not occur if
|
|
|
b7c072 |
there are more than 99 layers.
|
|
|
b7c072 |
---
|
|
|
b7c072 |
coders/psd.c | 12 ++++++------
|
|
|
b7c072 |
1 file changed, 6 insertions(+), 6 deletions(-)
|
|
|
b7c072 |
|
|
|
b7c072 |
diff --git a/coders/psd.c b/coders/psd.c
|
|
|
b7c072 |
index 3c0b938..5c23992 100644
|
|
|
b7c072 |
--- a/coders/psd.c
|
|
|
b7c072 |
+++ b/coders/psd.c
|
|
|
b7c072 |
@@ -2101,9 +2101,6 @@ static MagickBooleanType WritePSDImage(const ImageInfo *image_info,Image *image)
|
|
|
b7c072 |
StringInfo
|
|
|
b7c072 |
*bim_profile;
|
|
|
b7c072 |
|
|
|
b7c072 |
- unsigned char
|
|
|
b7c072 |
- layer_name[4];
|
|
|
b7c072 |
-
|
|
|
b7c072 |
/*
|
|
|
b7c072 |
Open image file.
|
|
|
b7c072 |
*/
|
|
|
b7c072 |
@@ -2361,12 +2358,15 @@ static MagickBooleanType WritePSDImage(const ImageInfo *image_info,Image *image)
|
|
|
b7c072 |
property=(const char *) GetImageProperty(next_image,"label");
|
|
|
b7c072 |
if (property == (const char *) NULL)
|
|
|
b7c072 |
{
|
|
|
b7c072 |
+ char
|
|
|
b7c072 |
+ layer_name[MaxTextExtent];
|
|
|
b7c072 |
+
|
|
|
b7c072 |
(void) WriteBlobMSBLong(image,16);
|
|
|
b7c072 |
(void) WriteBlobMSBLong(image,0);
|
|
|
b7c072 |
(void) WriteBlobMSBLong(image,0);
|
|
|
b7c072 |
- (void) FormatLocaleString((char *) layer_name,MaxTextExtent,
|
|
|
b7c072 |
- "L%06ld",(long) layer_count++);
|
|
|
b7c072 |
- WritePascalString( image, (char*)layer_name, 4 );
|
|
|
b7c072 |
+ (void) FormatLocaleString(layer_name,MaxTextExtent,"L%06ld",(long)
|
|
|
b7c072 |
+ layer_count++);
|
|
|
b7c072 |
+ WritePascalString(image,layer_name,4);
|
|
|
b7c072 |
}
|
|
|
b7c072 |
else
|
|
|
b7c072 |
{
|
|
|
b7c072 |
--
|
|
|
b7c072 |
1.8.3.1
|
|
|
b7c072 |
|