https://github.com/ImageMagick/ImageMagick/issues/312

diff --git a/ChangeLog b/ChangeLog
index a4d07cb2f277c59df5ecfdd782d3b947f0fd88a3..1421a6338acc2055a847343d333ccb0b84a2a402 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,6 +1,8 @@
 2016-11-26  7.0.3-9 Cristy  <quetzlzacatenango@image...>
   * Support the compare -read-mask option.
   * Support read-masks for the -modulate option.
+  * Prevent buffer overflow when streaming an image (reference
+    https://github.com/ImageMagick/ImageMagick/issues/312).
 
 2016-11-15  7.0.3-8 Cristy  <quetzlzacatenango@image...>
   * Release ImageMagick version 7.0.3-8, GIT revision 19067:5aceded:20161125.

diff --git a/MagickCore/constitute.c b/MagickCore/constitute.c
index f3dd1ec90656c208b6789e3fef2f1d1d0324dbd4..a7a52674469fd9d2e7ce95f982d738b53dea4e4f 100644 (file)
--- a/MagickCore/constitute.c
+++ b/MagickCore/constitute.c
@@ -308,7 +308,8 @@ MagickExport Image *PingImages(ImageInfo *image_info,const char *filename,
           read_info=DestroyImageInfo(read_info);
           return(PingImage(image_info,exception));
         }
-      (void) CopyMagickString(ping_filename,read_info->filename,MagickPathExtent);
+      (void) CopyMagickString(ping_filename,read_info->filename,
+        MagickPathExtent);
       images=NewImageList();
       extent=(ssize_t) (read_info->scene+read_info->number_scenes);
       for (scene=(ssize_t) read_info->scene; scene < (ssize_t) extent; scene++)

diff --git a/MagickCore/stream.c b/MagickCore/stream.c
index b9bf4fb87174d0316999287fba091f4c6c8a8da5..009d10a267fd4bc1708b1507c4d257a3fcfc0f5e 100644 (file)
--- a/MagickCore/stream.c
+++ b/MagickCore/stream.c
@@ -811,7 +811,8 @@ MagickExport MagickBooleanType OpenStream(const ImageInfo *image_info,
   MagickBooleanType
     status;
 
-  (void) CopyMagickString(stream_info->stream->filename,filename,MagickPathExtent);
+  (void) CopyMagickString(stream_info->stream->filename,filename,
+    MagickPathExtent);
   status=OpenBlob(image_info,stream_info->stream,WriteBinaryBlobMode,exception);
   return(status);
 }
@@ -1011,7 +1012,7 @@ MagickExport Image *ReadStream(const ImageInfo *image_info,StreamHandler stream,
   read_info->stream=stream;
   image=ReadImage(read_info,exception);
   if (image != (Image *) NULL)
-    InitializePixelChannelMap(image);
+    (void) SyncImagePixelCache(image,exception);
   read_info=DestroyImageInfo(read_info);
   return(image);
 }