From 619b4845a566950d5f6a9c9194a9f5e09fb8d468 Mon Sep 17 00:00:00 2001 From: Cristy Date: Sun, 22 Apr 2018 11:01:59 -0400 Subject: [PATCH] https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7922 --- MagickCore/colormap-private.h | 10 ++++++---- MagickCore/exception.c | 16 +++++++++++----- 2 files changed, 17 insertions(+), 9 deletions(-) diff --git a/MagickCore/colormap-private.h b/MagickCore/colormap-private.h index e49dfecda..6fff7c45d 100644 --- a/MagickCore/colormap-private.h +++ b/MagickCore/colormap-private.h @@ -31,8 +31,9 @@ static inline ssize_t ConstrainColormapIndex(Image *image,const ssize_t index, { if ((index < 0) || (index >= (ssize_t) image->colors)) { - (void) ThrowMagickException(exception,GetMagickModule(),CorruptImageError, - "InvalidColormapIndex","`%s'",image->filename); + if (exception->severity != CorruptImageError) + (void) ThrowMagickException(exception,GetMagickModule(), + CorruptImageError,"InvalidColormapIndex","`%s'",image->filename); return(0); } return((ssize_t) index); @@ -43,8 +44,9 @@ static inline void ValidateColormapValue(Image *image, { if ((index < 0) || (index >= (ssize_t) image->colors)) { - (void) ThrowMagickException(exception,GetMagickModule(),CorruptImageError, - "InvalidColormapIndex","`%s'",image->filename); + if (exception->severity != CorruptImageError) + (void) ThrowMagickException(exception,GetMagickModule(), + CorruptImageError,"InvalidColormapIndex","`%s'",image->filename); *target=(Quantum) 0; } else diff --git a/MagickCore/exception.c b/MagickCore/exception.c index 5c4e2a147..46ec2d101 100644 --- a/MagickCore/exception.c +++ b/MagickCore/exception.c @@ -54,6 +54,11 @@ #include "MagickCore/utility.h" #include "MagickCore/utility-private.h" +/* + Define declarations. +*/ +#define MaxExceptionList 64 + /* Forward declarations. */ @@ -421,9 +426,10 @@ MagickExport ExceptionInfo *DestroyExceptionInfo(ExceptionInfo *exception) exception->exceptions=(void *) DestroyLinkedList((LinkedListInfo *) exception->exceptions,DestroyExceptionElement); } - else if (exception->exceptions != (void *) NULL) - ClearLinkedList((LinkedListInfo *) exception->exceptions, - DestroyExceptionElement); + else + if (exception->exceptions != (void *) NULL) + ClearLinkedList((LinkedListInfo *) exception->exceptions, + DestroyExceptionElement); relinquish=exception->relinquish; UnlockSemaphoreInfo(exception->semaphore); if (relinquish != MagickFalse) @@ -925,7 +931,7 @@ MagickExport MagickBooleanType ThrowException(ExceptionInfo *exception, assert(exception->signature == MagickCoreSignature); LockSemaphoreInfo(exception->semaphore); exceptions=(LinkedListInfo *) exception->exceptions; - if (GetNumberOfElementsInLinkedList(exceptions) > MagickMaxRecursionDepth) + if (GetNumberOfElementsInLinkedList(exceptions) > MaxExceptionList) { UnlockSemaphoreInfo(exception->semaphore); return(MagickTrue); @@ -959,7 +965,7 @@ MagickExport MagickBooleanType ThrowException(ExceptionInfo *exception, exception->description=p->description; } UnlockSemaphoreInfo(exception->semaphore); - if (GetNumberOfElementsInLinkedList(exceptions) == MagickMaxRecursionDepth) + if (GetNumberOfElementsInLinkedList(exceptions) == MaxExceptionList) (void) ThrowMagickException(exception,GetMagickModule(),ResourceLimitError, "TooManyExceptions","(exception processing is suspended)"); return(MagickTrue); -- 2.40.0