From: Cristy <urban-warrior@imagemagick.org>
Date: Sat, 10 Feb 2018 20:05:07 +0000 (-0500)
Subject: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6200
X-Git-Tag: 7.0.7-23~71
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=cb7b086a9a34958a97fc34cefcf8344030fdd597;p=imagemagick

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6200
---

diff --git a/MagickCore/magic.c b/MagickCore/magic.c
index 01e5587e6..94e2fa21b 100644
--- a/MagickCore/magic.c
+++ b/MagickCore/magic.c
@@ -253,10 +253,8 @@ static int CompareMagickInfoSize(const void *a,const void *b)
 
   ma=(MagicInfo *) a;
   mb=(MagicInfo *) b;
-
   if (ma->offset != mb->offset)
     return((int) (ma->offset-mb->offset));
-
   return((int) (mb->length-ma->length));
 }
 
diff --git a/coders/pdf.c b/coders/pdf.c
index 37f5f7eb7..ffb3d0420 100644
--- a/coders/pdf.c
+++ b/coders/pdf.c
@@ -642,27 +642,27 @@ static Image *ReadPDFImage(const ImageInfo *image_info,ExceptionInfo *exception)
   fitPage=MagickFalse;
   option=GetImageOption(image_info,"pdf:fit-page");
   if (option != (char *) NULL)
-  {
-    char
-      *page_geometry;
-
-    page_geometry=GetPageGeometry(option);
-    flags=ParseMetaGeometry(page_geometry,&page.x,&page.y,&page.width,
-      &page.height);
-    page_geometry=DestroyString(page_geometry);
-    if (flags == NoValue)
-      {
-        (void) ThrowMagickException(exception,GetMagickModule(),OptionError,
-          "InvalidGeometry","`%s'",option);
-        image=DestroyImage(image);
-        return((Image *) NULL);
-      }
-    page.width=(size_t) ceil((double) (page.width*image->resolution.x/delta.x)
-      -0.5);
-    page.height=(size_t) ceil((double) (page.height*image->resolution.y/
-      delta.y) -0.5);
-    fitPage=MagickTrue;
-  }
+    {
+      char
+        *page_geometry;
+
+      page_geometry=GetPageGeometry(option);
+      flags=ParseMetaGeometry(page_geometry,&page.x,&page.y,&page.width,
+        &page.height);
+      page_geometry=DestroyString(page_geometry);
+      if (flags == NoValue)
+        {
+          (void) ThrowMagickException(exception,GetMagickModule(),OptionError,
+            "InvalidGeometry","`%s'",option);
+          image=DestroyImage(image);
+          return((Image *) NULL);
+        }
+      page.width=(size_t) ceil((double) (page.width*image->resolution.x/delta.x)
+        -0.5);
+      page.height=(size_t) ceil((double) (page.height*image->resolution.y/
+        delta.y) -0.5);
+      fitPage=MagickTrue;
+    }
   (void) CloseBlob(image);
   if ((fabs(angle) == 90.0) || (fabs(angle) == 270.0))
     {
diff --git a/coders/ps.c b/coders/ps.c
index 6856456de..523a9ba08 100644
--- a/coders/ps.c
+++ b/coders/ps.c
@@ -448,9 +448,6 @@ static Image *ReadPSImage(const ImageInfo *image_info,ExceptionInfo *exception)
     c,
     file;
 
-  LinkedListInfo
-    *profiles;
-
   MagickBooleanType
     cmyk,
     fitPage,
@@ -584,7 +581,6 @@ static Image *ReadPSImage(const ImageInfo *image_info,ExceptionInfo *exception)
   (void) ResetMagickMemory(command,0,sizeof(command));
   cmyk=image_info->colorspace == CMYKColorspace ? MagickTrue : MagickFalse;
   (void) ResetMagickMemory(&hires_bounds,0,sizeof(hires_bounds));
-  profiles=(LinkedListInfo *) NULL;
   columns=0;
   rows=0;
   priority=0;
@@ -627,92 +623,6 @@ static Image *ReadPSImage(const ImageInfo *image_info,ExceptionInfo *exception)
       (void) sscanf(command,Pages " %lu",&pages);
     if (LocaleNCompare(ImageData,command,strlen(ImageData)) == 0)
       (void) sscanf(command,ImageData " %lu %lu",&columns,&rows);
-    if (LocaleNCompare(ICCProfile,command,strlen(ICCProfile)) == 0)
-      {
-        unsigned char
-          *datum;
-
-        /*
-          Read ICC profile.
-        */
-        profile=AcquireStringInfo(MagickPathExtent);
-        datum=GetStringInfoDatum(profile);
-        for (i=0; (c=ProfileInteger(image,hex_digits)) != EOF; i++)
-        {
-          if (i >= (ssize_t) GetStringInfoLength(profile))
-            {
-              SetStringInfoLength(profile,(size_t) i << 1);
-              datum=GetStringInfoDatum(profile);
-            }
-          datum[i]=(unsigned char) c;
-        }
-        SetStringInfoLength(profile,(size_t) i+1);
-        if (profiles == (LinkedListInfo *) NULL)
-          profiles=NewLinkedList(0);
-        (void) AppendValueToLinkedList(profiles,AcquireString("icc"));
-        profile=DestroyStringInfo(profile);
-        continue;
-      }
-    if (LocaleNCompare(PhotoshopProfile,command,strlen(PhotoshopProfile)) == 0)
-      {
-        unsigned char
-          *q;
-
-        /*
-          Read Photoshop profile.
-        */
-        count=(ssize_t) sscanf(command,PhotoshopProfile " %lu",&extent);
-        if (count != 1)
-          continue;
-        length=extent;
-        if ((MagickSizeType) length > GetBlobSize(image))
-          ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
-        profile=BlobToStringInfo((const void *) NULL,length);
-        if (profile != (StringInfo *) NULL)
-          {
-            q=GetStringInfoDatum(profile);
-            for (i=0; i < (ssize_t) length; i++)
-              *q++=(unsigned char) ProfileInteger(image,hex_digits);
-            if (profiles == (LinkedListInfo *) NULL)
-              profiles=NewLinkedList(0);
-            (void) AppendValueToLinkedList(profiles,AcquireString("8bim"));
-            profile=DestroyStringInfo(profile);
-          }
-        continue;
-      }
-    if (LocaleNCompare(BeginXMPPacket,command,strlen(BeginXMPPacket)) == 0)
-      {
-        /*
-          Read XMP profile.
-        */
-        p=command;
-        profile=StringToStringInfo(command);
-        for (i=(ssize_t) GetStringInfoLength(profile)-1; c != EOF; i++)
-        {
-          SetStringInfoLength(profile,(size_t) i+1);
-          c=ReadBlobByte(image);
-          if (c == EOF)
-            continue;
-          GetStringInfoDatum(profile)[i]=(unsigned char) c;
-          *p++=(char) c;
-          if ((strchr("\n\r%",c) == (char *) NULL) &&
-              ((size_t) (p-command) < (MagickPathExtent-1)))
-            continue;
-          *p='\0';
-          p=command;
-          if (LocaleNCompare(EndXMPPacket,command,strlen(EndXMPPacket)) == 0)
-            break;
-        }
-        SetStringInfoLength(profile,(size_t) i);
-        if (EOFBlob(image) == MagickFalse)
-          {
-            if (profiles == (LinkedListInfo *) NULL)
-              profiles=NewLinkedList(0);
-            (void) AppendValueToLinkedList(profiles,AcquireString("xmp"));
-          }
-        profile=DestroyStringInfo(profile);
-        continue;
-      }
     /*
       Is this a CMYK document?
     */
@@ -800,7 +710,7 @@ static Image *ReadPSImage(const ImageInfo *image_info,ExceptionInfo *exception)
       if (i ==  (ssize_t) priority)
         continue;
     hires_bounds=bounds;
-    priority=i;
+    priority=(size_t) i;
   }
   if ((fabs(hires_bounds.x2-hires_bounds.x1) >= MagickEpsilon) && 
       (fabs(hires_bounds.y2-hires_bounds.y1) >= MagickEpsilon))
@@ -820,30 +730,27 @@ static Image *ReadPSImage(const ImageInfo *image_info,ExceptionInfo *exception)
   fitPage=MagickFalse;
   option=GetImageOption(image_info,"eps:fit-page");
   if (option != (char *) NULL)
-  {
-    char
-      *page_geometry;
+    {
+      char
+        *page_geometry;
 
-    page_geometry=GetPageGeometry(option);
-    flags=ParseMetaGeometry(page_geometry,&page.x,&page.y,&page.width,
-      &page.height);
-    if (flags == NoValue)
-      {
-        (void) ThrowMagickException(exception,GetMagickModule(),OptionError,
-          "InvalidGeometry","`%s'",option);
-        if (profiles != (LinkedListInfo *) NULL)
-          profiles=DestroyLinkedList(profiles,RelinquishMagickMemory);
-        image=DestroyImage(image);
-        return((Image *) NULL);
-      }
-    page.width=(size_t) ceil((double) (page.width*image->resolution.x/delta.x)
-      -0.5);
-    page.height=(size_t) ceil((double) (page.height*image->resolution.y/
-      delta.y) -0.5);
-    page_geometry=DestroyString(page_geometry);
-    fitPage=MagickTrue;
-  }
-  (void) CloseBlob(image);
+      page_geometry=GetPageGeometry(option);
+      flags=ParseMetaGeometry(page_geometry,&page.x,&page.y,&page.width,
+        &page.height);
+      if (flags == NoValue)
+        {
+          (void) ThrowMagickException(exception,GetMagickModule(),OptionError,
+            "InvalidGeometry","`%s'",option);
+          image=DestroyImage(image);
+          return((Image *) NULL);
+        }
+      page.width=(size_t) ceil((double) (page.width*image->resolution.x/delta.x)
+        -0.5);
+      page.height=(size_t) ceil((double) (page.height*image->resolution.y/
+        delta.y) -0.5);
+      page_geometry=DestroyString(page_geometry);
+      fitPage=MagickTrue;
+    }
   if (IssRGBCompatibleColorspace(image_info->colorspace) != MagickFalse)
     cmyk=MagickFalse;
   /*
@@ -854,8 +761,6 @@ static Image *ReadPSImage(const ImageInfo *image_info,ExceptionInfo *exception)
     {
       ThrowFileException(exception,FileOpenError,"UnableToOpenFile",
         image_info->filename);
-      if (profiles != (LinkedListInfo *) NULL)
-        profiles=DestroyLinkedList(profiles,RelinquishMagickMemory);
       image=DestroyImageList(image);
       return((Image *) NULL);
     }
@@ -887,8 +792,6 @@ static Image *ReadPSImage(const ImageInfo *image_info,ExceptionInfo *exception)
   if (delegate_info == (const DelegateInfo *) NULL)
     {
       (void) RelinquishUniqueFileResource(postscript_filename);
-      if (profiles != (LinkedListInfo *) NULL)
-        profiles=DestroyLinkedList(profiles,RelinquishMagickMemory);
       image=DestroyImageList(image);
       return((Image *) NULL);
     }
@@ -979,8 +882,6 @@ static Image *ReadPSImage(const ImageInfo *image_info,ExceptionInfo *exception)
       if (*message != '\0')
         (void) ThrowMagickException(exception,GetMagickModule(),
           DelegateError,"PostscriptDelegateFailed","`%s'",message);
-      if (profiles != (LinkedListInfo *) NULL)
-        profiles=DestroyLinkedList(profiles,RelinquishMagickMemory);
       image=DestroyImageList(image);
       return((Image *) NULL);
     }
@@ -996,6 +897,104 @@ static Image *ReadPSImage(const ImageInfo *image_info,ExceptionInfo *exception)
           postscript_image=cmyk_image;
         }
     }
+  (void) SeekBlob(image,0,SEEK_SET);
+  for (c=ReadBlobByte(image); c != EOF; c=ReadBlobByte(image))
+  {
+    /*
+      Note document structuring comments.
+    */
+    *p++=(char) c;
+    if ((strchr("\n\r%",c) == (char *) NULL) &&
+        ((size_t) (p-command) < (MagickPathExtent-1)))
+      continue;
+    *p='\0';
+    p=command;
+    /*
+      Skip %%BeginDocument thru %%EndDocument.
+    */
+    if (LocaleNCompare(BeginDocument,command,strlen(BeginDocument)) == 0)
+      skip=MagickTrue;
+    if (LocaleNCompare(EndDocument,command,strlen(EndDocument)) == 0)
+      skip=MagickFalse;
+    if (skip != MagickFalse)
+      continue;
+    if (LocaleNCompare(ICCProfile,command,strlen(ICCProfile)) == 0)
+      {
+        unsigned char
+          *datum;
+
+        /*
+          Read ICC profile.
+        */
+        profile=AcquireStringInfo(MagickPathExtent);
+        datum=GetStringInfoDatum(profile);
+        for (i=0; (c=ProfileInteger(image,hex_digits)) != EOF; i++)
+        {
+          if (i >= (ssize_t) GetStringInfoLength(profile))
+            {
+              SetStringInfoLength(profile,(size_t) i << 1);
+              datum=GetStringInfoDatum(profile);
+            }
+          datum[i]=(unsigned char) c;
+        }
+        SetStringInfoLength(profile,(size_t) i+1);
+        (void) SetImageProfile(image,"icc",profile,exception);
+        profile=DestroyStringInfo(profile);
+        continue;
+      }
+    if (LocaleNCompare(PhotoshopProfile,command,strlen(PhotoshopProfile)) == 0)
+      {
+        unsigned char
+          *q;
+
+        /*
+          Read Photoshop profile.
+        */
+        count=(ssize_t) sscanf(command,PhotoshopProfile " %lu",&extent);
+        if (count != 1)
+          continue;
+        length=extent;
+        if ((MagickSizeType) length > GetBlobSize(image))
+          ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
+        profile=BlobToStringInfo((const void *) NULL,length);
+        if (profile != (StringInfo *) NULL)
+          {
+            q=GetStringInfoDatum(profile);
+            for (i=0; i < (ssize_t) length; i++)
+              *q++=(unsigned char) ProfileInteger(image,hex_digits);
+            (void) SetImageProfile(image,"8bim",profile,exception);
+            profile=DestroyStringInfo(profile);
+          }
+        continue;
+      }
+    if (LocaleNCompare(BeginXMPPacket,command,strlen(BeginXMPPacket)) == 0)
+      {
+        /*
+          Read XMP profile.
+        */
+        p=command;
+        profile=StringToStringInfo(command);
+        for (i=(ssize_t) GetStringInfoLength(profile)-1; c != EOF; i++)
+        {
+          SetStringInfoLength(profile,(size_t) (i+1));
+          c=ReadBlobByte(image);
+          GetStringInfoDatum(profile)[i]=(unsigned char) c;
+          *p++=(char) c;
+          if ((strchr("\n\r%",c) == (char *) NULL) &&
+              ((size_t) (p-command) < (MagickPathExtent-1)))
+            continue;
+          *p='\0';
+          p=command;
+          if (LocaleNCompare(EndXMPPacket,command,strlen(EndXMPPacket)) == 0)
+            break;
+        }
+        SetStringInfoLength(profile,(size_t) i);
+        (void) SetImageProfile(image,"xmp",profile,exception);
+        profile=DestroyStringInfo(profile);
+        continue;
+      }
+  }
+  (void) CloseBlob(image);
   if (image_info->number_scenes != 0)
     {
       Image
@@ -1011,35 +1010,6 @@ static Image *ReadPSImage(const ImageInfo *image_info,ExceptionInfo *exception)
           PrependImageToList(&postscript_image,clone_image);
       }
     }
-  if (profiles != (LinkedListInfo *) NULL)
-    {
-      const char
-        *name;
-
-      const StringInfo
-        *profile;
-
-      /*
-        Read image profiles.
-      */
-      ResetLinkedListIterator(profiles);
-      name=(const char *) GetNextValueInLinkedList(profiles);
-      while (name != (const char *) NULL)
-      {
-        profile=GetImageProfile(image,name);
-        if (profile != (StringInfo *) NULL)
-          {
-            register unsigned char
-              *p;
-
-            p=GetStringInfoDatum(profile);
-            count=ReadBlob(image,GetStringInfoLength(profile),p);
-            (void) count;
-          }
-        name=(const char *) GetNextValueInLinkedList(profiles);
-      }
-      profiles=DestroyLinkedList(profiles,RelinquishMagickMemory);
-    }
   do
   {
     (void) CopyMagickString(postscript_image->filename,filename,
diff --git a/configure b/configure
index 51eb2bd88..b34bdab08 100755
--- a/configure
+++ b/configure
@@ -4550,7 +4550,7 @@ MAGICK_PATCHLEVEL_VERSION=23
 
 MAGICK_VERSION=7.0.7-23
 
-MAGICK_GIT_REVISION=22573:84ae5bdb7:20180130
+MAGICK_GIT_REVISION=22833:ec279d071:20180210
 
 
 # Substitute library versioning