https://github.com/ImageMagick/ImageMagick/issues/1420

diff --git a/MagickCore/cache.c b/MagickCore/cache.c
index e5787ee4562efcf94cec5727d63581d44457da01..de9e9d9255dc30b2ae052cce24367cc9e5894cff 100644 (file)
--- a/MagickCore/cache.c
+++ b/MagickCore/cache.c
@@ -1112,6 +1112,7 @@ static inline void RelinquishCacheNexusPixels(NexusInfo *nexus_info)
   nexus_info->metacontent=(void *) NULL;
   nexus_info->length=0;
   nexus_info->mapped=MagickFalse;
+  nexus_info->authentic_pixel_cache=MagickFalse;
 }
 
 MagickPrivate NexusInfo **DestroyPixelCacheNexus(NexusInfo **nexus_info,
@@ -2796,11 +2797,11 @@ MagickPrivate const Quantum *GetVirtualPixelCacheNexus(const Image *image,
         MagickBooleanType
           status;
 
+        if (nexus_info->authentic_pixel_cache != MagickFalse)
+          return(q);
         /*
           Pixel request is inside cache extents.
         */
-        if (nexus_info->authentic_pixel_cache != MagickFalse)
-          return(q);
         status=ReadPixelCachePixels(cache_info,nexus_info,exception);
         if (status == MagickFalse)
           return((const Quantum *) NULL);
@@ -4963,24 +4964,25 @@ MagickPrivate void SetPixelCacheMethods(Cache cache,CacheMethods *cache_methods)
 */
 
 static inline MagickBooleanType AcquireCacheNexusPixels(
-  const CacheInfo *magick_restrict cache_info,NexusInfo *nexus_info,
-  ExceptionInfo *exception)
+  const CacheInfo *magick_restrict cache_info,const MagickOffsetType length,
+  NexusInfo *nexus_info,ExceptionInfo *exception)
 {
-  if (nexus_info->length != (MagickSizeType) ((size_t) nexus_info->length))
+  if (nexus_info->cache != (Quantum *) NULL)
+    RelinquishCacheNexusPixels(nexus_info);
+  if (length != (MagickSizeType) ((size_t) length))
     return(MagickFalse);
   if (cache_anonymous_memory <= 0)
     {
-      nexus_info->mapped=MagickFalse;
       nexus_info->cache=(Quantum *) MagickAssumeAligned(AcquireAlignedMemory(1,
-        (size_t) nexus_info->length));
+        (size_t) length));
       if (nexus_info->cache != (Quantum *) NULL)
-        (void) memset(nexus_info->cache,0,(size_t) nexus_info->length);
+        (void) memset(nexus_info->cache,0,(size_t) length);
     }
-  else
+  if (nexus_info->cache == (Quantum *) NULL)
     {
-      nexus_info->mapped=MagickTrue;
-      nexus_info->cache=(Quantum *) MapBlob(-1,IOMode,0,(size_t)
-        nexus_info->length);
+      nexus_info->cache=(Quantum *) MapBlob(-1,IOMode,0,(size_t) length);
+      if (nexus_info->cache != (Quantum *) NULL)
+        nexus_info->mapped=MagickTrue;
     }
   if (nexus_info->cache == (Quantum *) NULL)
     {
@@ -4989,6 +4991,8 @@ static inline MagickBooleanType AcquireCacheNexusPixels(
         cache_info->filename);
       return(MagickFalse);
     }
+  nexus_info->length=length;
+  nexus_info->authentic_pixel_cache=MagickFalse;
   return(MagickTrue);
 }
 
@@ -5078,9 +5082,8 @@ static Quantum *SetPixelCacheNexusPixels(const CacheInfo *cache_info,
           if (cache_info->metacontent_extent != 0)
             nexus_info->metacontent=(unsigned char *) cache_info->metacontent+
               offset*cache_info->metacontent_extent;
+          nexus_info->authentic_pixel_cache=MagickTrue;
           PrefetchPixelCacheNexusPixels(nexus_info,mode);
-          nexus_info->authentic_pixel_cache=IsPixelCacheAuthentic(cache_info,
-            nexus_info);
           return(nexus_info->pixels);
         }
     }
@@ -5092,34 +5095,23 @@ static Quantum *SetPixelCacheNexusPixels(const CacheInfo *cache_info,
     length+=number_pixels*cache_info->metacontent_extent;
   if (nexus_info->cache == (Quantum *) NULL)
     {
-      nexus_info->length=length;
-      status=AcquireCacheNexusPixels(cache_info,nexus_info,exception);
+      status=AcquireCacheNexusPixels(cache_info,length,nexus_info,exception);
       if (status == MagickFalse)
-        {
-          nexus_info->length=0;
-          return((Quantum *) NULL);
-        }
+        return((Quantum *) NULL);
     }
   else
     if (nexus_info->length < length)
       {
-        RelinquishCacheNexusPixels(nexus_info);
-        nexus_info->length=length;
-        status=AcquireCacheNexusPixels(cache_info,nexus_info,exception);
+        status=AcquireCacheNexusPixels(cache_info,length,nexus_info,exception);
         if (status == MagickFalse)
-          {
-            nexus_info->length=0;
-            return((Quantum *) NULL);
-          }
+          return((Quantum *) NULL);
       }
   nexus_info->pixels=nexus_info->cache;
   nexus_info->metacontent=(void *) NULL;
   if (cache_info->metacontent_extent != 0)
     nexus_info->metacontent=(void *) (nexus_info->pixels+
-      (cache_info->number_channels*number_pixels));
+      cache_info->number_channels*number_pixels);
   PrefetchPixelCacheNexusPixels(nexus_info,mode);
-  nexus_info->authentic_pixel_cache=IsPixelCacheAuthentic(cache_info,
-    nexus_info);
   return(nexus_info->pixels);
 }
 \f
@@ -5768,7 +5760,7 @@ static MagickBooleanType WritePixelCachePixels(
           length=extent;
           rows=1UL;
         }
-      q=cache_info->pixels+offset*cache_info->number_channels;
+      q=cache_info->pixels+cache_info->number_channels*offset;
       for (y=0; y < (ssize_t) rows; y++)
       {
         (void) memcpy(q,p,(size_t) length);

diff --git a/MagickCore/memory.c b/MagickCore/memory.c
index 2b64e9e0affbc9b5e684bec7fcf7997e5d9a7072..6181367b5b21ffb4c4ad209e0a4327e90966a18b 100644 (file)
--- a/MagickCore/memory.c
+++ b/MagickCore/memory.c
@@ -243,6 +243,7 @@ MagickExport void *AcquireAlignedMemory(const size_t count,const size_t quantum)
 {
 #define AlignedExtent(size,alignment) \
   (((size)+((alignment)-1)) & ~((alignment)-1))
+#define AlignedPowerOf2(x)  ((((x) - 1) & (x)) == 0)
 
   size_t
     alignment,
@@ -255,11 +256,9 @@ MagickExport void *AcquireAlignedMemory(const size_t count,const size_t quantum)
   if (HeapOverflowSanityCheck(count,quantum) != MagickFalse)
     return((void *) NULL);
   memory=NULL;
-  size=count*quantum;
   alignment=CACHE_LINE_SIZE;
+  size=count*quantum;
   extent=AlignedExtent(size,alignment);
-  if ((size == 0) || (alignment < sizeof(void *)) || (extent < size))
-    return((void *) NULL);
 #if defined(MAGICKCORE_HAVE_POSIX_MEMALIGN)
   if (posix_memalign(&memory,alignment,extent) != 0)
     memory=NULL;
@@ -270,15 +269,23 @@ MagickExport void *AcquireAlignedMemory(const size_t count,const size_t quantum)
     void
       *p;
 
+    if ((alignment == 0) || (alignment % sizeof (void *) != 0) ||
+        (AlignedPowerOf2(alignment/sizeof (void *)) == 0))
+      {
+        errno=EINVAL;
+        return((void *) NULL);
+      }
+    if (size > (SIZE_MAX-alignment-sizeof(void *)-1))
+      {
+        errno=ENOMEM;
+        return((void *) NULL);
+      }
     extent=(size+alignment-1)+sizeof(void *);
-    if (extent > size)
+    p=malloc(extent);
+    if (p != NULL)
       {
-        p=malloc(extent);
-        if (p != NULL)
-          {
-            memory=(void *) AlignedExtent((size_t) p+sizeof(void *),alignment);
-            *((void **) memory-1)=p;
-          }
+        memory=(void *) AlignedExtent((size_t) p+sizeof(void *),alignment);
+        *((void **) memory-1)=p;
       }
   }
 #endif