Add additional checks to DCM reader to prevent data-driven faults (bug report from...

diff --git a/ChangeLog b/ChangeLog
index 70f2d014daf7309eac3f8407c4de94f53a9ae29d..de0b1fa5899430a2a09dbeffb142aebf46d9f752 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -5,6 +5,8 @@
     https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=29626).
   * Don't interpret -fx option arguments (reference
     https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=29774);
+  * Add additional checks to DCM reader to prevent data-driven faults (bug
+    report from Hanno Böck).
 
 2016-05-21  7.0.1-6 Cristy  <quetzlzacatenango@image...>
   * Release ImageMagick version 7.0.1-6, GIT revision 18241:d4f277c:20160521.

diff --git a/coders/dcm.c b/coders/dcm.c
index f86e57326570bfd66d0c3f7bc794e0be3f85d766..26125f778b6ef2702fa2da8e8e05124ab87c33a5 100644 (file)
--- a/coders/dcm.c
+++ b/coders/dcm.c
@@ -3216,6 +3216,8 @@ static Image *ReadDCMImage(const ImageInfo *image_info,ExceptionInfo *exception)
             /*
               Photometric interpretation.
             */
+            if (data == (unsigned char *) NULL)
+              break;
             for (i=0; i < (ssize_t) MagickMin(length,MagickPathExtent-1); i++)
               photometric[i]=(char) data[i];
             photometric[i]='\0';
@@ -3237,6 +3239,8 @@ static Image *ReadDCMImage(const ImageInfo *image_info,ExceptionInfo *exception)
             /*
               Number of frames.
             */
+            if (data == (unsigned char *) NULL)
+              break;
             number_scenes=StringToUnsignedLong((char *) data);
             break;
           }
@@ -3674,7 +3678,7 @@ static Image *ReadDCMImage(const ImageInfo *image_info,ExceptionInfo *exception)
       if (scale == (Quantum *) NULL)
         ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
       range=GetQuantumRange(depth);
-      for (i=0; i < (ssize_t) (GetQuantumRange(depth)+1); i++)
+      for (i=0; i <= (ssize_t) GetQuantumRange(depth); i++)
         scale[i]=ScaleAnyToQuantum((size_t) i,range);
     }
   if (image->compression == RLECompression)
@@ -3965,9 +3969,12 @@ static Image *ReadDCMImage(const ImageInfo *image_info,ExceptionInfo *exception)
                 pixel.blue&=mask;
                 if (scale != (Quantum *) NULL)
                   {
-                    pixel.red=scale[pixel.red];
-                    pixel.green=scale[pixel.green];
-                    pixel.blue=scale[pixel.blue];
+                    if (pixel.red <= GetQuantumRange(depth))
+                      pixel.red=scale[pixel.red];
+                    if (pixel.green <= GetQuantumRange(depth))
+                      pixel.green=scale[pixel.green];
+                    if (pixel.blue <= GetQuantumRange(depth))
+                      pixel.blue=scale[pixel.blue];
                   }
               }
             SetPixelRed(image,(Quantum) pixel.red,q);