X-Git-Url: https://granicus.if.org/sourcecode?a=blobdiff_plain;f=coders%2Fpict.c;h=d8b953648612c611bb94f39d8a2b7e863831cdbb;hb=213770a3eff7ad7e54ab8cc3893b208abe1ebb07;hp=b59b2477fed043d8743817b3906869f05aea532c;hpb=80af6b6919ffa01b9124bdcd4012db59c52ecf15;p=imagemagick diff --git a/coders/pict.c b/coders/pict.c index b59b2477f..d8b953648 100644 --- a/coders/pict.c +++ b/coders/pict.c @@ -13,11 +13,11 @@ % Read/Write Apple Macintosh QuickDraw/PICT Format % % % % Software Design % -% John Cristy % +% Cristy % % July 1992 % % % % % -% Copyright 1999-2012 ImageMagick Studio LLC, a non-profit organization % +% Copyright 1999-2014 ImageMagick Studio LLC, a non-profit organization % % dedicated to making software imaging solutions freely available. % % % % You may not use this file except in compliance with the License. You may % @@ -95,17 +95,6 @@ ThrowReaderException(CorruptImageError,"ImproperImageHeader"); \ } -#define ReadRectangle(image,rectangle) \ -{ \ - rectangle.top=(short) ReadBlobMSBShort(image); \ - rectangle.left=(short) ReadBlobMSBShort(image); \ - rectangle.bottom=(short) ReadBlobMSBShort(image); \ - rectangle.right=(short) ReadBlobMSBShort(image); \ - if ((rectangle.left > rectangle.right) || \ - (rectangle.top > rectangle.bottom)) \ - ThrowReaderException(CorruptImageError,"ImproperImageHeader"); \ -} - typedef struct _PICTCode { const char @@ -796,6 +785,18 @@ static inline size_t MagickMax(const size_t x, return(y); } +static MagickBooleanType ReadRectangle(Image *image,PICTRectangle *rectangle) +{ + rectangle->top=(short) ReadBlobMSBShort(image); + rectangle->left=(short) ReadBlobMSBShort(image); + rectangle->bottom=(short) ReadBlobMSBShort(image); + rectangle->right=(short) ReadBlobMSBShort(image); + if ((rectangle->left > rectangle->right) || + (rectangle->top > rectangle->bottom)) + return(MagickFalse); + return(MagickTrue); +} + static Image *ReadPICTImage(const ImageInfo *image_info, ExceptionInfo *exception) { @@ -855,7 +856,6 @@ static Image *ReadPICTImage(const ImageInfo *image_info, assert(exception != (ExceptionInfo *) NULL); assert(exception->signature == MagickSignature); image=AcquireImage(image_info,exception); - image->depth=8; status=OpenBlob(image_info,image,ReadBinaryBlobMode,exception); if (status == MagickFalse) { @@ -879,7 +879,8 @@ static Image *ReadPICTImage(const ImageInfo *image_info, for (i=0; i < 508; i++) (void) ReadBlobByte(image); (void) ReadBlobMSBShort(image); /* skip picture size */ - ReadRectangle(image,frame); + if (ReadRectangle(image,&frame) == MagickFalse) + ThrowReaderException(CorruptImageError,"ImproperImageHeader"); while ((c=ReadBlobByte(image)) == 0) ; if (c != 0x11) ThrowReaderException(CorruptImageError,"ImproperImageHeader"); @@ -901,6 +902,7 @@ static Image *ReadPICTImage(const ImageInfo *image_info, Create black canvas. */ flags=0; + image->depth=8; image->columns=1UL*(frame.right-frame.left); image->rows=1UL*(frame.bottom-frame.top); image->resolution.x=DefaultResolution; @@ -919,6 +921,8 @@ static Image *ReadPICTImage(const ImageInfo *image_info, code=ReadBlobByte(image); if (version == 2) code=(int) ReadBlobMSBShort(image); + if (code < 0) + break; if (code > 0xa1) { if (image->debug != MagickFalse) @@ -943,7 +947,8 @@ static Image *ReadPICTImage(const ImageInfo *image_info, (void) ReadBlobByte(image); break; } - ReadRectangle(image,frame); + if (ReadRectangle(image,&frame) == MagickFalse) + ThrowReaderException(CorruptImageError,"ImproperImageHeader"); if (((frame.left & 0x8000) != 0) || ((frame.top & 0x8000) != 0)) break; image->columns=1UL*(frame.right-frame.left); @@ -977,7 +982,8 @@ static Image *ReadPICTImage(const ImageInfo *image_info, if (pattern != 1) ThrowReaderException(CorruptImageError,"UnknownPatternType"); length=ReadBlobMSBShort(image); - ReadRectangle(image,frame); + if (ReadRectangle(image,&frame) == MagickFalse) + ThrowReaderException(CorruptImageError,"ImproperImageHeader"); ReadPixmap(pixmap); image->depth=1UL*pixmap.component_size; image->resolution.x=1.0*pixmap.horizontal_resolution; @@ -1079,7 +1085,8 @@ static Image *ReadPICTImage(const ImageInfo *image_info, (void) ReadBlobMSBShort(image); (void) ReadBlobMSBShort(image); } - ReadRectangle(image,frame); + if (ReadRectangle(image,&frame) == MagickFalse) + ThrowReaderException(CorruptImageError,"ImproperImageHeader"); /* Initialize tile image. */ @@ -1148,8 +1155,10 @@ static Image *ReadPICTImage(const ImageInfo *image_info, } } } - ReadRectangle(image,source); - ReadRectangle(image,destination); + if (ReadRectangle(image,&source) == MagickFalse) + ThrowReaderException(CorruptImageError,"ImproperImageHeader"); + if (ReadRectangle(image,&destination) == MagickFalse) + ThrowReaderException(CorruptImageError,"ImproperImageHeader"); (void) ReadBlobMSBShort(image); if ((code == 0x91) || (code == 0x99) || (code == 0x9b)) { @@ -1326,6 +1335,8 @@ static Image *ReadPICTImage(const ImageInfo *image_info, /* Skip to next op code. */ + if (code < 0) + break; if (codes[code].length == -1) (void) ReadBlobMSBShort(image); else @@ -1372,6 +1383,8 @@ static Image *ReadPICTImage(const ImageInfo *image_info, file=fdopen(unique_file,"wb"); if ((unique_file == -1) || (file == (FILE *) NULL)) { + if (file != (FILE *) NULL) + (void) fclose(file); (void) CopyMagickString(image->filename,read_info->filename, MaxTextExtent); ThrowFileException(exception,FileOpenError, @@ -1382,7 +1395,11 @@ static Image *ReadPICTImage(const ImageInfo *image_info, length=ReadBlobMSBLong(image); for (i=0; i < 6; i++) (void) ReadBlobMSBLong(image); - ReadRectangle(image,frame); + if (ReadRectangle(image,&frame) == MagickFalse) + { + (void) fclose(file); + ThrowReaderException(CorruptImageError,"ImproperImageHeader"); + } for (i=0; i < 122; i++) (void) ReadBlobByte(image); for (i=0; i < (ssize_t) (length-154); i++) @@ -1391,6 +1408,7 @@ static Image *ReadPICTImage(const ImageInfo *image_info, (void) fputc(c,file); } (void) fclose(file); + (void) close(unique_file); tile_image=ReadImage(read_info,exception); (void) RelinquishUniqueFileResource(read_info->filename); read_info=DestroyImageInfo(read_info); @@ -1402,9 +1420,7 @@ static Image *ReadPICTImage(const ImageInfo *image_info, (void) SetImageExtent(image, MagickMax(image->columns,tile_image->columns), MagickMax(image->rows,tile_image->rows),exception); - if (IssRGBCompatibleColorspace(tile_image->colorspace) == MagickFalse) - (void) TransformImageColorspace(image,tile_image->colorspace, - exception); + (void) TransformImageColorspace(image,tile_image->colorspace,exception); (void) CompositeImage(image,tile_image,CopyCompositeOp,MagickTrue, frame.left,frame.right,exception); image->compression=tile_image->compression; @@ -1620,8 +1636,7 @@ static MagickBooleanType WritePICTImage(const ImageInfo *image_info, status=OpenBlob(image_info,image,WriteBinaryBlobMode,exception); if (status == MagickFalse) return(status); - if (IssRGBCompatibleColorspace(image->colorspace) == MagickFalse) - (void) TransformImageColorspace(image,sRGBColorspace,exception); + (void) TransformImageColorspace(image,sRGBColorspace,exception); /* Initialize image info. */ @@ -1657,9 +1672,9 @@ static MagickBooleanType WritePICTImage(const ImageInfo *image_info, storage_class=image->storage_class; if (image_info->compression == JPEGCompression) storage_class=DirectClass; - if ((storage_class == DirectClass) || (image->alpha_trait == BlendPixelTrait)) + if (storage_class == DirectClass) { - pixmap.component_count=image->alpha_trait ? 4 : 3; + pixmap.component_count=image->alpha_trait == BlendPixelTrait ? 4 : 3; pixmap.pixel_type=16; pixmap.bits_per_pixel=32; pixmap.pack_type=0x04; @@ -1670,8 +1685,8 @@ static MagickBooleanType WritePICTImage(const ImageInfo *image_info, Allocate memory. */ bytes_per_line=image->columns; - if ((storage_class == DirectClass) || (image->alpha_trait == BlendPixelTrait)) - bytes_per_line*=image->alpha_trait ? 4 : 3; + if (storage_class == DirectClass) + bytes_per_line*=image->alpha_trait == BlendPixelTrait ? 4 : 3; buffer=(unsigned char *) AcquireQuantumMemory(PictInfoSize,sizeof(*buffer)); packed_scanline=(unsigned char *) AcquireQuantumMemory((size_t) (row_bytes+MaxCount),sizeof(*packed_scanline)); @@ -1894,7 +1909,7 @@ static MagickBooleanType WritePICTImage(const ImageInfo *image_info, Write picture data. */ count=0; - if ((storage_class == PseudoClass) && (image->alpha_trait != BlendPixelTrait)) + if (storage_class == PseudoClass) for (y=0; y < (ssize_t) image->rows; y++) { p=GetVirtualPixels(image,0,y,image->columns,1,exception);