From 5675bb2439af1c441e1c9b763339ca2094d4b298 Mon Sep 17 00:00:00 2001 From: dirk Date: Tue, 21 Jun 2016 00:06:17 +0200 Subject: [PATCH] Added extra guards to prevent out of bound access. --- MagickCore/accelerate.c | 56 +++++++++++++++++++++++++---------------- 1 file changed, 35 insertions(+), 21 deletions(-) diff --git a/MagickCore/accelerate.c b/MagickCore/accelerate.c index 3a341c44e..fb6ddee32 100644 --- a/MagickCore/accelerate.c +++ b/MagickCore/accelerate.c @@ -429,13 +429,15 @@ static Image *ComputeAddNoiseImage(const Image *image,MagickCLEnv clEnv, queue=AcquireOpenCLCommandQueue(device); if (queue == (cl_command_queue) NULL) goto cleanup; - imageBuffer=GetAuthenticOpenCLBuffer(image,device,exception); - if (imageBuffer == (cl_mem) NULL) - goto cleanup; filteredImage=CloneImage(image,image->columns,image->rows,MagickTrue, exception); if (filteredImage == (Image *) NULL) goto cleanup; + if (filteredImage->number_channels != image->number_channels) + goto cleanup; + imageBuffer=GetAuthenticOpenCLBuffer(image,device,exception); + if (imageBuffer == (cl_mem) NULL) + goto cleanup; filteredImageBuffer=GetAuthenticOpenCLBuffer(filteredImage,device,exception); if (filteredImageBuffer == (cl_mem) NULL) goto cleanup; @@ -620,13 +622,15 @@ static Image *ComputeBlurImage(const Image* image,MagickCLEnv clEnv, device=RequestOpenCLDevice(clEnv); queue=AcquireOpenCLCommandQueue(device); - imageBuffer=GetAuthenticOpenCLBuffer(image,device,exception); - if (imageBuffer == (cl_mem) NULL) - goto cleanup; filteredImage=CloneImage(image,image->columns,image->rows,MagickTrue, exception); if (filteredImage == (Image *) NULL) goto cleanup; + if (filteredImage->number_channels != image->number_channels) + goto cleanup; + imageBuffer=GetAuthenticOpenCLBuffer(image,device,exception); + if (imageBuffer == (cl_mem) NULL) + goto cleanup; filteredImageBuffer=GetAuthenticOpenCLBuffer(filteredImage,device,exception); if (filteredImageBuffer == (cl_mem) NULL) goto cleanup; @@ -4378,13 +4382,15 @@ static Image *ComputeResizeImage(const Image* image,MagickCLEnv clEnv, device=RequestOpenCLDevice(clEnv); queue=AcquireOpenCLCommandQueue(device); - imageBuffer=GetAuthenticOpenCLBuffer(image,device,exception); - if (imageBuffer == (cl_mem) NULL) - goto cleanup; filteredImage=CloneImage(image,resizedColumns,resizedRows,MagickTrue, exception); if (filteredImage == (Image *) NULL) goto cleanup; + if (filteredImage->number_channels != image->number_channels) + goto cleanup; + imageBuffer=GetAuthenticOpenCLBuffer(image,device,exception); + if (imageBuffer == (cl_mem) NULL) + goto cleanup; filteredImageBuffer=GetAuthenticOpenCLBuffer(filteredImage,device,exception); if (filteredImageBuffer == (cl_mem) NULL) goto cleanup; @@ -4595,13 +4601,15 @@ static Image* ComputeRotationalBlurImage(const Image *image,MagickCLEnv clEnv, device=RequestOpenCLDevice(clEnv); queue=AcquireOpenCLCommandQueue(device); - imageBuffer=GetAuthenticOpenCLBuffer(image,device,exception); - if (imageBuffer == (cl_mem) NULL) - goto cleanup; filteredImage=CloneImage(image,image->columns,image->rows,MagickTrue, exception); if (filteredImage == (Image *) NULL) goto cleanup; + if (filteredImage->number_channels != image->number_channels) + goto cleanup; + imageBuffer=GetAuthenticOpenCLBuffer(image,device,exception); + if (imageBuffer == (cl_mem) NULL) + goto cleanup; filteredImageBuffer=GetAuthenticOpenCLBuffer(filteredImage,device,exception); if (filteredImageBuffer == (cl_mem) NULL) goto cleanup; @@ -4793,13 +4801,15 @@ static Image *ComputeUnsharpMaskImage(const Image *image,MagickCLEnv clEnv, device=RequestOpenCLDevice(clEnv); queue=AcquireOpenCLCommandQueue(device); - imageBuffer=GetAuthenticOpenCLBuffer(image,device,exception); - if (imageBuffer == (cl_mem) NULL) - goto cleanup; filteredImage=CloneImage(image,image->columns,image->rows,MagickTrue, exception); if (filteredImage == (Image *) NULL) goto cleanup; + if (filteredImage->number_channels != image->number_channels) + goto cleanup; + imageBuffer=GetAuthenticOpenCLBuffer(image,device,exception); + if (imageBuffer == (cl_mem) NULL) + goto cleanup; filteredImageBuffer=GetAuthenticOpenCLBuffer(filteredImage,device,exception); if (filteredImageBuffer == (cl_mem) NULL) goto cleanup; @@ -4965,13 +4975,15 @@ static Image *ComputeUnsharpMaskImageSingle(const Image *image, device=RequestOpenCLDevice(clEnv); queue=AcquireOpenCLCommandQueue(device); - imageBuffer=GetAuthenticOpenCLBuffer(image,device,exception); - if (imageBuffer == (cl_mem) NULL) - goto cleanup; filteredImage=CloneImage(image,image->columns,image->rows,MagickTrue, exception); if (filteredImage == (Image *) NULL) goto cleanup; + if (filteredImage->number_channels != image->number_channels) + goto cleanup; + imageBuffer=GetAuthenticOpenCLBuffer(image,device,exception); + if (imageBuffer == (cl_mem) NULL) + goto cleanup; filteredImageBuffer=GetAuthenticOpenCLBuffer(filteredImage,device,exception); if (filteredImageBuffer == (cl_mem) NULL) goto cleanup; @@ -5117,13 +5129,15 @@ static Image *ComputeWaveletDenoiseImage(const Image *image,MagickCLEnv clEnv, device=RequestOpenCLDevice(clEnv); queue=AcquireOpenCLCommandQueue(device); - imageBuffer=GetAuthenticOpenCLBuffer(image,device,exception); - if (imageBuffer == (cl_mem) NULL) - goto cleanup; filteredImage=CloneImage(image,image->columns,image->rows,MagickTrue, exception); if (filteredImage == (Image *) NULL) goto cleanup; + if (filteredImage->number_channels != image->number_channels) + goto cleanup; + imageBuffer=GetAuthenticOpenCLBuffer(image,device,exception); + if (imageBuffer == (cl_mem) NULL) + goto cleanup; filteredImageBuffer=GetAuthenticOpenCLBuffer(filteredImage,device,exception); if (filteredImageBuffer == (cl_mem) NULL) goto cleanup; -- 2.40.0