From 5fb86b2fb0b030b00eeb37d83b4df4513799d2d2 Mon Sep 17 00:00:00 2001 From: Cristy Date: Sat, 31 Mar 2018 08:27:42 -0400 Subject: [PATCH] https://github.com/ImageMagick/ImageMagick/issues/1069 --- MagickCore/draw.c | 158 +++++++++++++++++++++------------------------- coders/pict.c | 2 +- 2 files changed, 74 insertions(+), 86 deletions(-) diff --git a/MagickCore/draw.c b/MagickCore/draw.c index 5595610f8..bb5faf10a 100644 --- a/MagickCore/draw.c +++ b/MagickCore/draw.c @@ -1664,8 +1664,8 @@ static MagickBooleanType DrawDashPolygon(const DrawInfo *draw_info, % */ -static size_t EllipsePoints(const PrimitiveInfo *primitive_info, - const PointInfo start,const PointInfo stop,const PointInfo degrees) +static size_t GetEllipseCoordinates(const PointInfo start,const PointInfo stop, + const PointInfo degrees) { double delta, @@ -1675,11 +1675,8 @@ static size_t EllipsePoints(const PrimitiveInfo *primitive_info, PointInfo angle; - register const PrimitiveInfo - *p; - size_t - number_points; + coordinates; /* Ellipses are just short segmented polys. @@ -1697,13 +1694,50 @@ static size_t EllipsePoints(const PrimitiveInfo *primitive_info, while (y < degrees.x) y+=360.0; angle.y=DegreesToRadians(y); - number_points=0; - for (p=primitive_info; angle.x < angle.y; angle.x+=step) - { - number_points++; - p+=p->coordinates; - } - return(number_points+1); + for (coordinates=0; angle.x < angle.y; angle.x+=step) + coordinates++; + return(coordinates+1); +} + +static size_t GetRoundRectangleCoordinates(const PointInfo start, + const PointInfo end,PointInfo arc) +{ + PointInfo + degrees, + offset, + point; + + size_t + coordinates; + + coordinates=0; + offset.x=fabs(end.x-start.x); + offset.y=fabs(end.y-start.y); + if (arc.x > (0.5*offset.x)) + arc.x=0.5*offset.x; + if (arc.y > (0.5*offset.y)) + arc.y=0.5*offset.y; + point.x=start.x+offset.x-arc.x; + point.y=start.y+arc.y; + degrees.x=270.0; + degrees.y=360.0; + coordinates+=GetEllipseCoordinates(point,arc,degrees); + point.x=start.x+offset.x-arc.x; + point.y=start.y+offset.y-arc.y; + degrees.x=0.0; + degrees.y=90.0; + coordinates+=GetEllipseCoordinates(point,arc,degrees); + point.x=start.x+arc.x; + point.y=start.y+offset.y-arc.y; + degrees.x=90.0; + degrees.y=180.0; + coordinates+=GetEllipseCoordinates(point,arc,degrees); + point.x=start.x+arc.x; + point.y=start.y+arc.y; + degrees.x=180.0; + degrees.y=270.0; + coordinates+=GetEllipseCoordinates(point,arc,degrees); + return(coordinates+1); } static inline MagickBooleanType IsPoint(const char *point) @@ -1748,7 +1782,6 @@ MagickExport MagickBooleanType DrawImage(Image *image,const DrawInfo *draw_info, double angle, factor, - points_extent, primitive_extent; DrawInfo @@ -1783,6 +1816,7 @@ MagickExport MagickBooleanType DrawImage(Image *image,const DrawInfo *draw_info, bounds; size_t + coordinates, extent, number_stops; @@ -3030,35 +3064,18 @@ MagickExport MagickBooleanType DrawImage(Image *image,const DrawInfo *draw_info, /* Speculate how many points our primitive might consume. */ - points_extent=(double) primitive_info[j].coordinates; + coordinates=primitive_info[j].coordinates; switch (primitive_type) { case RectanglePrimitive: { - points_extent*=5; + coordinates*=5; break; } case RoundRectanglePrimitive: { - double - alpha, - beta, - coordinates, - radius; - - alpha=bounds.x2-bounds.x1; - beta=bounds.y2-bounds.y1; - radius=hypot((double) alpha,(double) beta); - coordinates=ceil(MagickPI*MagickPI*radius)+6*BezierQuantum+360; - if (coordinates > 21438) - { - (void) ThrowMagickException(exception,GetMagickModule(),DrawError, - "TooManyBezierCoordinates","`%s'",token); - status=MagickFalse; - break; - } - points_extent*=5; - points_extent+=2*coordinates; + coordinates=GetRoundRectangleCoordinates(primitive_info[j].point, + primitive_info[j+1].point,primitive_info[j+2].point); break; } case BezierPrimitive: @@ -3070,7 +3087,7 @@ MagickExport MagickBooleanType DrawImage(Image *image,const DrawInfo *draw_info, status=MagickFalse; break; } - points_extent=(double) (BezierQuantum*primitive_info[j].coordinates); + coordinates=BezierQuantum*primitive_info[j].coordinates; break; } case PathPrimitive: @@ -3080,7 +3097,7 @@ MagickExport MagickBooleanType DrawImage(Image *image,const DrawInfo *draw_info, *t; GetNextToken(q,&q,extent,token); - points_extent=1; + coordinates=1; t=token; for (s=token; *s != '\0'; s=t) { @@ -3094,75 +3111,46 @@ MagickExport MagickBooleanType DrawImage(Image *image,const DrawInfo *draw_info, t++; continue; } - points_extent++; + coordinates++; } - points_extent*=(6*BezierQuantum)+360.0; + coordinates*=(6*BezierQuantum)+360; break; } case CirclePrimitive: case ArcPrimitive: { - double - alpha, - beta, - coordinates, - radius; - - alpha=bounds.x2-bounds.x1; - beta=bounds.y2-bounds.y1; - radius=hypot(alpha,beta); - coordinates=ceil(MagickPI*MagickPI*radius)+6*BezierQuantum+360; - if (coordinates > 21438) - { - (void) ThrowMagickException(exception,GetMagickModule(),DrawError, - "TooManyBezierCoordinates","`%s'",token); - status=MagickFalse; - break; - } - points_extent=2*coordinates; + PointInfo + degrees; + + degrees.x=0.0; + degrees.y=360.0; + coordinates=GetEllipseCoordinates(primitive_info[j].point, + primitive_info[j+1].point,degrees); break; } case EllipsePrimitive: { - double - alpha, - beta, - coordinates, - radius; - - alpha=bounds.x2-bounds.x1; - beta=bounds.y2-bounds.y1; - radius=hypot(alpha,beta); - coordinates=2.0*ceil(MagickPI*MagickPI*radius)+6*BezierQuantum+360; - if (coordinates > 1048576) - { - (void) ThrowMagickException(exception,GetMagickModule(),DrawError, - "TooManyBezierCoordinates","`%s'",token); - status=MagickFalse; - break; - } - points_extent=(double) EllipsePoints(primitive_info+j, - primitive_info[j].point,primitive_info[j+1].point, - primitive_info[j+2].point); + coordinates=GetEllipseCoordinates(primitive_info[j].point, + primitive_info[j+1].point,primitive_info[j+2].point); break; } default: break; } - if (status == MagickFalse) - break; - if (((double) ((size_t) points_extent)) < points_extent) + if (coordinates > 2097152) { - (void) ThrowMagickException(exception,GetMagickModule(), - ResourceLimitError,"MemoryAllocationFailed","`%s'",image->filename); - break; + (void) ThrowMagickException(exception,GetMagickModule(),DrawError, + "TooManyBezierCoordinates","`%s'",token); + status=MagickFalse; } - if (((MagickSizeType) (i+points_extent)) >= number_points) + if (status == MagickFalse) + break; + if (((MagickSizeType) (i+coordinates)) >= number_points) { /* Resize based on speculative points required by primitive. */ - number_points+=points_extent+1; + number_points+=coordinates+1; primitive_info=(PrimitiveInfo *) ResizeQuantumMemory(primitive_info, (size_t) number_points,sizeof(*primitive_info)); if ((primitive_info == (PrimitiveInfo *) NULL) || diff --git a/coders/pict.c b/coders/pict.c index 9c2612535..589b606da 100644 --- a/coders/pict.c +++ b/coders/pict.c @@ -1163,7 +1163,7 @@ static Image *ReadPICTImage(const ImageInfo *image_info, tile_image->resolution.y=(double) pixmap.vertical_resolution; tile_image->units=PixelsPerInchResolution; if (tile_image->alpha_trait != UndefinedPixelTrait) - (void) SetImageAlpha(tile_image,OpaqueAlphaChannel,exception); + (void) SetImageAlpha(tile_image,OpaqueAlpha,exception); } if ((code != 0x9a) && (code != 0x9b)) { -- 2.40.0