Commit 768bdd0db for imagemagick.org
commit 768bdd0dbb9a9ad743b6a6e557126b788b325970
Author: Cristy <urban-warrior@imagemagick.org>
Date: Mon Aug 24 11:42:39 2026 -0400
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r868-pmwh-fv2c
diff --git a/coders/cut.c b/coders/cut.c
index 5d1bd8678..a558b387d 100644
--- a/coders/cut.c
+++ b/coders/cut.c
@@ -382,24 +382,24 @@ static Image *ReadCUTImage(const ImageInfo *image_info,ExceptionInfo *exception)
while((int) RunCountMasked!=0) /*end of line?*/
{
i=1;
- if((int) RunCount<0x80) i=(ssize_t) RunCountMasked;
+ if ((int) RunCount<0x80) i=(ssize_t) RunCountMasked;
offset=SeekBlob(image,TellBlob(image)+i,SEEK_SET);
if (offset < 0)
ThrowCUTReaderException(CorruptImageError,"ImproperImageHeader");
- if(EOFBlob(image) != MagickFalse) goto CUT_KO; /*wrong data*/
+ if (EOFBlob(image) != MagickFalse) goto CUT_KO; /*wrong data*/
EncodedByte-=(size_t)(i+1);
ldblk+=(ssize_t) RunCountMasked;
RunCount=(unsigned char) ReadBlobByte(image);
- if(EOFBlob(image) != MagickFalse) goto CUT_KO; /*wrong data: unexpected eof in line*/
+ if (EOFBlob(image) != MagickFalse) goto CUT_KO; /*wrong data: unexpected eof in line*/
RunCountMasked=RunCount & 0x7F;
}
- if(EncodedByte!=1) goto CUT_KO; /*wrong data: size incorrect*/
+ if (EncodedByte!=1) goto CUT_KO; /*wrong data: size incorrect*/
i=0; /*guess a number of bit planes*/
- if(ldblk==(int) Header.Width) i=8;
- if(2*ldblk==(int) Header.Width) i=4;
- if(8*ldblk==(int) Header.Width) i=1;
- if(i==0) goto CUT_KO; /*wrong data: incorrect bit planes*/
+ if (ldblk==(int) Header.Width) i=8;
+ if (2*ldblk==(int) Header.Width) i=4;
+ if (8*ldblk==(int) Header.Width) i=1;
+ if (i==0) goto CUT_KO; /*wrong data: incorrect bit planes*/
depth=i;
image->columns=Header.Width;
@@ -420,11 +420,11 @@ static Image *ReadCUTImage(const ImageInfo *image_info,ExceptionInfo *exception)
j=i;
while(--i>0)
{
- if(clone_info->filename[i]=='.')
+ if (clone_info->filename[i]=='.')
{
break;
}
- if(clone_info->filename[i]=='/' || clone_info->filename[i]=='\\' ||
+ if (clone_info->filename[i]=='/' || clone_info->filename[i]=='\\' ||
clone_info->filename[i]==':' )
{
i=j;
@@ -432,25 +432,25 @@ static Image *ReadCUTImage(const ImageInfo *image_info,ExceptionInfo *exception)
}
}
+ (void) CopyMagickString(clone_info->filename+i,".PAL",(size_t)
+ (MagickPathExtent-i));
authorized=IsPathAuthorized(ReadPolicyRights,clone_info->filename);
if (authorized == MagickFalse)
ThrowCUTReaderException(PolicyError,"NotAuthorized");
- (void) CopyMagickString(clone_info->filename+i,".PAL",(size_t)
- (MagickPathExtent-i));
- if((clone_info->file=fopen_utf8(clone_info->filename,"rb"))==NULL)
+ if ((clone_info->file=fopen_utf8(clone_info->filename,"rb")) == NULL)
{
(void) CopyMagickString(clone_info->filename+i,".pal",(size_t)
(MagickPathExtent-i));
- if((clone_info->file=fopen_utf8(clone_info->filename,"rb"))==NULL)
+ authorized=IsPathAuthorized(ReadPolicyRights,clone_info->filename);
+ if (authorized == MagickFalse)
+ ThrowCUTReaderException(PolicyError,"NotAuthorized");
+ if ((clone_info->file=fopen_utf8(clone_info->filename,"rb")) == NULL)
{
- authorized=IsPathAuthorized(ReadPolicyRights,clone_info->filename);
- if (authorized == MagickFalse)
- ThrowCUTReaderException(PolicyError,"NotAuthorized");
clone_info->filename[i]='\0';
authorized=IsPathAuthorized(ReadPolicyRights,clone_info->filename);
if (authorized == MagickFalse)
ThrowCUTReaderException(PolicyError,"NotAuthorized");
- if ((clone_info->file=fopen_utf8(clone_info->filename,"rb"))==NULL)
+ if ((clone_info->file=fopen_utf8(clone_info->filename,"rb")) == NULL)
{
clone_info=DestroyImageInfo(clone_info);
clone_info=NULL;
@@ -459,7 +459,7 @@ static Image *ReadCUTImage(const ImageInfo *image_info,ExceptionInfo *exception)
}
}
- if( (palette=AcquireImage(clone_info,exception))==NULL ) goto NoPalette;
+ if ( (palette=AcquireImage(clone_info,exception)) == NULL ) goto NoPalette;
status=OpenBlob(clone_info,palette,ReadBinaryBlobMode,exception);
if (status == MagickFalse)
{
@@ -470,10 +470,10 @@ static Image *ReadCUTImage(const ImageInfo *image_info,ExceptionInfo *exception)
}
- if(palette!=NULL)
+ if (palette!=NULL)
{
(void) ReadBlob(palette,2,(unsigned char *) PalHeader.FileId);
- if(strncmp(PalHeader.FileId,"AH",2) != 0) goto ErasePalette;
+ if (strncmp(PalHeader.FileId,"AH",2) != 0) goto ErasePalette;
PalHeader.Version=ReadBlobLSBShort(palette);
PalHeader.Size=ReadBlobLSBShort(palette);
PalHeader.FileType=(char) ReadBlobByte(palette);
@@ -488,18 +488,18 @@ static Image *ReadCUTImage(const ImageInfo *image_info,ExceptionInfo *exception)
if (EOFBlob(image))
ThrowCUTReaderException(CorruptImageError,"UnexpectedEndOfFile");
- if(PalHeader.MaxIndex<1) goto ErasePalette;
+ if (PalHeader.MaxIndex<1) goto ErasePalette;
image->colors=PalHeader.MaxIndex+1;
if (AcquireImageColormap(image,image->colors,exception) == MagickFalse) goto NoMemory;
- if(PalHeader.MaxRed==0) PalHeader.MaxRed=(unsigned int) QuantumRange; /*avoid division by 0*/
- if(PalHeader.MaxGreen==0) PalHeader.MaxGreen=(unsigned int) QuantumRange;
- if(PalHeader.MaxBlue==0) PalHeader.MaxBlue=(unsigned int) QuantumRange;
+ if (PalHeader.MaxRed==0) PalHeader.MaxRed=(unsigned int) QuantumRange; /*avoid division by 0*/
+ if (PalHeader.MaxGreen==0) PalHeader.MaxGreen=(unsigned int) QuantumRange;
+ if (PalHeader.MaxBlue==0) PalHeader.MaxBlue=(unsigned int) QuantumRange;
for(i=0;i<=(int) PalHeader.MaxIndex;i++)
{ /*this may be wrong- I don't know why is palette such strange*/
j=(ssize_t) TellBlob(palette);
- if((j % 512)>512-6)
+ if ((j % 512)>512-6)
{
j=((j / 512)+1)*512;
offset=SeekBlob(palette,j,SEEK_SET);
@@ -536,7 +536,7 @@ static Image *ReadCUTImage(const ImageInfo *image_info,ExceptionInfo *exception)
NoPalette:
- if(palette==NULL)
+ if (palette == NULL)
{
image->colors=256;
@@ -558,7 +558,7 @@ static Image *ReadCUTImage(const ImageInfo *image_info,ExceptionInfo *exception)
/* ----- Load RLE compressed raster ----- */
BImgBuff=(unsigned char *) AcquireQuantumMemory((size_t) ldblk,
sizeof(*BImgBuff)); /*Ldblk was set in the check phase*/
- if(BImgBuff==NULL) goto NoMemory;
+ if (BImgBuff == NULL) goto NoMemory;
(void) memset(BImgBuff,0,(size_t) ldblk*sizeof(*BImgBuff));
offset=SeekBlob(image,6 /*sizeof(Header)*/,SEEK_SET);
@@ -583,16 +583,16 @@ static Image *ReadCUTImage(const ImageInfo *image_info,ExceptionInfo *exception)
while ((int) RunCountMasked != 0)
{
- if((ssize_t) RunCountMasked>j)
+ if ((ssize_t) RunCountMasked>j)
{ /*Wrong Data*/
RunCountMasked=(unsigned char) j;
- if(j==0)
+ if (j==0)
{
break;
}
}
- if((int) RunCount>0x80)
+ if ((int) RunCount>0x80)
{
RunValue=(unsigned char) ReadBlobByte(image);
(void) memset(ptrB,(int) RunValue,(size_t) RunCountMasked);