Commit 7e3e1d0b6 for imagemagick.org
commit 7e3e1d0b6a973106fd11f7139f8f04cb8cc74471
Author: Cristy <urban-warrior@imagemagick.org>
Date: Sat Oct 17 12:23:40 2026 -0400
throw proper exception when profile exceeds maximum
diff --git a/MagickCore/property.c b/MagickCore/property.c
index 5b601af25..adc7ddc73 100644
--- a/MagickCore/property.c
+++ b/MagickCore/property.c
@@ -434,7 +434,7 @@ static char
*TraceSVGClippath(const unsigned char *,size_t,const size_t,
const size_t);
-static void GetIPTCProperty(const Image *image,const char *key,
+static MagickBooleanType GetIPTCProperty(const Image *image,const char *key,
ExceptionInfo *exception)
{
char
@@ -455,10 +455,10 @@ static void GetIPTCProperty(const Image *image,const char *key,
if (profile == (StringInfo *) NULL)
profile=GetImageProfile(image,"8bim");
if (profile == (StringInfo *) NULL)
- return;
+ return(MagickFalse);
count=MagickSscanf(key,"IPTC:%ld:%ld",&dataset,&record);
if (count != 2)
- return;
+ return(MagickFalse);
attribute=(char *) NULL;
for (i=0; i < (ssize_t) GetStringInfoLength(profile)-5; )
{
@@ -503,12 +503,13 @@ static void GetIPTCProperty(const Image *image,const char *key,
{
if (attribute != (char *) NULL)
attribute=DestroyString(attribute);
- return;
+ return(MagickFalse);
}
attribute[strlen(attribute)-1]='\0';
(void) SetImageProperty((Image *) image,key,(const char *) attribute,
exception);
attribute=DestroyString(attribute);
+ return(MagickTrue);
}
static inline int ReadPropertyByte(const unsigned char **p,size_t *length)
@@ -601,7 +602,7 @@ static inline signed short ReadPropertyMSBShort(const unsigned char **p,
return(quantum.signed_value);
}
-static void Get8BIMProperty(const Image *image,const char *key,
+static MagickBooleanType Get8BIMProperty(const Image *image,const char *key,
ExceptionInfo *exception)
{
char
@@ -638,11 +639,11 @@ static void Get8BIMProperty(const Image *image,const char *key,
*/
profile=GetImageProfile(image,"8bim");
if (profile == (StringInfo *) NULL)
- return;
+ return(MagickFalse);
count=(ssize_t) MagickSscanf(key,"8BIM:%ld,%ld:%1024[^\n]\n%1024[^\n]",
&start,&stop,name,format);
if ((count != 2) && (count != 3) && (count != 4))
- return;
+ return(MagickFalse);
if (count < 4)
(void) CopyMagickString(format,"SVG",MagickPathExtent);
if (count < 3)
@@ -757,6 +758,7 @@ static void Get8BIMProperty(const Image *image,const char *key,
macroman_resource=DestroyString(macroman_resource);
if (resource != (char *) NULL)
resource=DestroyString(resource);
+ return(MagickTrue);
}
static inline signed int ReadPropertySignedLong(const EndianType endian,
@@ -857,8 +859,8 @@ static inline unsigned short ReadPropertyUnsignedShort(const EndianType endian,
return(value & 0xffff);
}
-static void GetEXIFProperty(const Image *image,const char *property,
- ExceptionInfo *exception)
+static MagickBooleanType GetEXIFProperty(const Image *image,
+ const char *property,ExceptionInfo *exception)
{
#define MaxDirectoryStack 16
#define EXIF_DELIMITER "\n"
@@ -1310,13 +1312,13 @@ static void GetEXIFProperty(const Image *image,const char *property,
*/
profile=GetImageProfile(image,"exif");
if (profile == (const StringInfo *) NULL)
- return;
+ return(MagickFalse);
if ((property == (const char *) NULL) || (*property == '\0'))
- return;
+ return(MagickFalse);
while (isspace((int) ((unsigned char) *property)) != 0)
property++;
if (strlen(property) <= 5)
- return;
+ return(MagickFalse);
all=0;
tag=(~0UL);
switch (*(property+5))
@@ -1352,7 +1354,7 @@ static void GetEXIFProperty(const Image *image,const char *property,
property+=6;
n=strlen(property);
if (n != 4)
- return;
+ return(MagickFalse);
/*
Parse tag specification as a hex number.
*/
@@ -1372,7 +1374,7 @@ static void GetEXIFProperty(const Image *image,const char *property,
if ((c >= 'a') && (c <= 'f'))
tag|=(size_t) (c-('a'-10));
else
- return;
+ return(MagickFalse);
}
} while (*property != '\0');
break;
@@ -1396,10 +1398,10 @@ static void GetEXIFProperty(const Image *image,const char *property,
}
}
if (tag == (~0UL))
- return;
+ return(MagickFalse);
length=GetStringInfoLength(profile);
if (length < 6)
- return;
+ return(MagickFalse);
exif=GetStringInfoDatum(profile);
while (length != 0)
{
@@ -1418,7 +1420,7 @@ static void GetEXIFProperty(const Image *image,const char *property,
break;
}
if (length < 16)
- return;
+ return(MagickFalse);
id=(ssize_t) ReadPropertySignedShort(LSBEndian,exif);
endian=LSBEndian;
if (id == 0x4949)
@@ -1427,15 +1429,15 @@ static void GetEXIFProperty(const Image *image,const char *property,
if (id == 0x4D4D)
endian=MSBEndian;
else
- return;
+ return(MagickFalse);
if (ReadPropertyUnsignedShort(endian,exif+2) != 0x002a)
- return;
+ return(MagickFalse);
/*
This the offset to the first IFD.
*/
offset=(ssize_t) ReadPropertySignedLong(endian,exif+4);
if ((offset < 0) || (size_t) offset >= length)
- return;
+ return(MagickFalse);
/*
Set the pointer to the first IFD and follow it were it leads.
*/
@@ -1741,10 +1743,12 @@ static void GetEXIFProperty(const Image *image,const char *property,
}
} while (level > 0);
exif_resources=DestroySplayTree(exif_resources);
+ return(MagickTrue);
}
#if defined(MAGICKCORE_LCMS_DELEGATE)
-static void GetICCProperty(const Image *image,ExceptionInfo *exception)
+static MagickBooleanType GetICCProperty(const Image *image,
+ ExceptionInfo *exception)
{
const StringInfo
@@ -1760,9 +1764,9 @@ static void GetICCProperty(const Image *image,ExceptionInfo *exception)
if (profile == (StringInfo *) NULL)
profile=GetImageProfile(image,"icm");
if (profile == (StringInfo *) NULL)
- return;
+ return(MagickFalse);
if (GetStringInfoLength(profile) < 128)
- return; /* minimum ICC profile length */
+ return(MagickFalse); /* minimum ICC profile length */
icc_profile=cmsOpenProfileFromMem(GetStringInfoDatum(profile),
(cmsUInt32Number) GetStringInfoLength(profile));
if (icc_profile != (cmsHPROFILE *) NULL)
@@ -1830,6 +1834,7 @@ static void GetICCProperty(const Image *image,ExceptionInfo *exception)
#endif
(void) cmsCloseProfile(icc_profile);
}
+ return(MagickTrue);
}
#endif
@@ -1846,23 +1851,19 @@ static MagickBooleanType SkipXMPValue(const char *value)
return(MagickTrue);
}
-static void GetXMPProperty(const Image *image,const char *property)
+static MagickBooleanType GetXMPProperty(const Image *image,const char *property,
+ ExceptionInfo *exception)
{
char
*xmp_profile;
const char
- *content;
+ *content,
+ *p;
const StringInfo
*profile;
- ExceptionInfo
- *exception;
-
- const char
- *p;
-
XMLTreeInfo
*child,
*description,
@@ -1872,23 +1873,21 @@ static void GetXMPProperty(const Image *image,const char *property)
profile=GetImageProfile(image,"xmp");
if (profile == (StringInfo *) NULL)
- return;
+ return(MagickFalse);
if (GetStringInfoLength(profile) < 17)
- return;
+ return(MagickFalse);
if ((property == (const char *) NULL) || (*property == '\0'))
- return;
+ return(MagickFalse);
xmp_profile=StringInfoToString(profile);
if (xmp_profile == (char *) NULL)
- return;
+ return(MagickFalse);
for (p=xmp_profile; *p != '\0'; p++)
if ((*p == '<') && (*(p+1) == 'x'))
break;
- exception=AcquireExceptionInfo();
xmp=NewXMLTree((char *) p,exception);
xmp_profile=DestroyString(xmp_profile);
- exception=DestroyExceptionInfo(exception);
if (xmp == (XMLTreeInfo *) NULL)
- return;
+ return(MagickFalse);
rdf=GetXMLTreeChild(xmp,"rdf:RDF");
if (rdf != (XMLTreeInfo *) NULL)
{
@@ -1946,6 +1945,7 @@ static void GetXMPProperty(const Image *image,const char *property)
}
}
xmp=DestroyXMLTree(xmp);
+ return(MagickTrue);
}
static char *TracePSClippath(const unsigned char *blob,size_t length)
@@ -2343,7 +2343,7 @@ MagickExport const char *GetImageProperty(const Image *image,
{
if (LocaleNCompare("8bim:",property,5) == 0)
{
- Get8BIMProperty(image,property,exception);
+ (void) Get8BIMProperty(image,property,exception);
break;
}
break;
@@ -2353,7 +2353,7 @@ MagickExport const char *GetImageProperty(const Image *image,
{
if (LocaleNCompare("exif:",property,5) == 0)
{
- GetEXIFProperty(image,property,exception);
+ (void) GetEXIFProperty(image,property,exception);
break;
}
break;
@@ -2365,13 +2365,13 @@ MagickExport const char *GetImageProperty(const Image *image,
(LocaleNCompare("icm:",property,4) == 0))
{
#if defined(MAGICKCORE_LCMS_DELEGATE)
- GetICCProperty(image,exception);
+ (void) GetICCProperty(image,exception);
#endif
break;
}
if (LocaleNCompare("iptc:",property,5) == 0)
{
- GetIPTCProperty(image,property,exception);
+ (void) GetIPTCProperty(image,property,exception);
break;
}
break;
@@ -2381,7 +2381,7 @@ MagickExport const char *GetImageProperty(const Image *image,
{
if (LocaleNCompare("xmp:",property,4) == 0)
{
- GetXMPProperty(image,property);
+ (void) GetXMPProperty(image,property,exception);
break;
}
break;
diff --git a/MagickCore/xml-tree.c b/MagickCore/xml-tree.c
index b88110f56..942ff21e7 100644
--- a/MagickCore/xml-tree.c
+++ b/MagickCore/xml-tree.c
@@ -1149,14 +1149,15 @@ static char *ParseEntities(char *xml,char **entities,int state,
if (p == (char *) NULL)
{
(void) ThrowMagickException(exception,GetMagickModule(),
- OptionWarning,"ParseError","memmory allocation failed");
+ OptionWarning,"ParseError",
+ "memory allocation failed");
return(p);
}
if (strlen(p) > GetMaxProfileSize())
{
(void) ThrowMagickException(exception,GetMagickModule(),
- ResourceLimitError,"ProfileSizeExceedsLimit","`%.17g'",
- (double) length);
+ ResourceLimitError,"ProfileSizeExceedsLimit",
+ "`%.17g'",(double) strlen(p));
return(p == q ? ConstantString(p) : p);
}
xml=p+offset;
diff --git a/config/english.xml b/config/english.xml
index 30316ca96..881f26d9a 100644
--- a/config/english.xml
+++ b/config/english.xml
@@ -1068,6 +1068,9 @@
<message name="PixelCacheAllocationFailed">
pixel cache allocation failed
</message>
+ <message name="ProfileSizeExceedsLimit">
+ profile size exceeds limit
+ </message>
<message name="TimeLimitExceeded">
time limit exceeded
</message>
@@ -1159,9 +1162,6 @@
<message name="MemoryAllocationFailed">
memory allocation failed
</message>
- <message name="ProfileSizeExceedsLimit">
- profile size exceeds limit
- </message>
</warning>
</limit>
</resource>
diff --git a/config/francais.xml b/config/francais.xml
index d01b11334..b6cc035a4 100644
--- a/config/francais.xml
+++ b/config/francais.xml
@@ -1053,6 +1053,9 @@
<message name="PixelCacheAllocationFailed">
Échec allocation du cache pixel
</message>
+ <message name="ProfileSizeExceedsLimit">
+ la taille du profil dépasse la limite
+ </message>
<message name="TimeLimitExceeded">
time limit exceeded
</message>
@@ -1135,9 +1138,6 @@
<message name="MemoryAllocationFailed">
échec allocation mémoire
</message>
- <message name="ProfileSizeExceedsLimit">
- la taille du profil dépasse la limite
- </message>
</warning>
</limit>
</resource>