From 2eefeef2b721cf0e2b377d857a3ad06ba69a9d01 Mon Sep 17 00:00:00 2001 From: Gyorgy Sarvari Date: Wed, 8 Oct 2025 22:59:05 +0200 Subject: [PATCH] imagemagick: patch CVE-2025-53015 Details: https://nvd.nist.gov/vuln/detail/CVE-2025-53015 Pick the patches that are mentioned in the relevant github advisory. Signed-off-by: Gyorgy Sarvari --- ...ks-to-make-sure-we-don-t-get-stuck-i.patch | 48 +++++++++++++++++++ .../0002-Added-missing-return.patch | 24 ++++++++++ .../imagemagick/imagemagick_7.1.1-43.bb | 2 + 3 files changed, 74 insertions(+) create mode 100644 meta-oe/recipes-support/imagemagick/imagemagick/0001-Added-extra-checks-to-make-sure-we-don-t-get-stuck-i.patch create mode 100644 meta-oe/recipes-support/imagemagick/imagemagick/0002-Added-missing-return.patch diff --git a/meta-oe/recipes-support/imagemagick/imagemagick/0001-Added-extra-checks-to-make-sure-we-don-t-get-stuck-i.patch b/meta-oe/recipes-support/imagemagick/imagemagick/0001-Added-extra-checks-to-make-sure-we-don-t-get-stuck-i.patch new file mode 100644 index 0000000000..6c15f43134 --- /dev/null +++ b/meta-oe/recipes-support/imagemagick/imagemagick/0001-Added-extra-checks-to-make-sure-we-don-t-get-stuck-i.patch @@ -0,0 +1,48 @@ +From aae092a403bc79933c081c6be1be1315cb231de9 Mon Sep 17 00:00:00 2001 +From: Dirk Lemstra +Date: Fri, 2 May 2025 18:33:17 +0200 +Subject: [PATCH] Added extra checks to make sure we don't get stuck in the + while loop. + +CVE: CVE-2025-53015 +Upstream-Status: Backport [https://github.com/ImageMagick/ImageMagick/commit/229fa96a988a21d78318bbca61245a6ed1ee33a0] +Signed-off-by: Gyorgy Sarvari +--- + MagickCore/image-private.h | 1 + + MagickCore/profile.c | 11 +++++++++++ + 2 files changed, 12 insertions(+) + +diff --git a/MagickCore/image-private.h b/MagickCore/image-private.h +index aa48b3cb5..a7cd99ccb 100644 +--- a/MagickCore/image-private.h ++++ b/MagickCore/image-private.h +@@ -52,6 +52,7 @@ extern "C" { + #define MAGICK_SIZE_MAX (SIZE_MAX) + #define MAGICK_SSIZE_MAX (SSIZE_MAX) + #define MAGICK_SSIZE_MIN (-SSIZE_MAX-1) ++#define MAGICK_ULONG_MAX (ULONG_MAX) + #define MatteColor "#bdbdbd" /* gray */ + #define MatteColorRGBA ScaleShortToQuantum(0xbdbd),\ + ScaleShortToQuantum(0xbdbd),ScaleShortToQuantum(0xbdbd),OpaqueAlpha +diff --git a/MagickCore/profile.c b/MagickCore/profile.c +index 7eea1d32f..85c180118 100644 +--- a/MagickCore/profile.c ++++ b/MagickCore/profile.c +@@ -2571,6 +2571,17 @@ static void GetXmpNumeratorAndDenominator(double value, + *denominator=1; + if (value <= MagickEpsilon) + return; ++ if (value > (double) MAGICK_ULONG_MAX) ++ { ++ *numerator = MAGICK_ULONG_MAX; ++ *denominator = 1; ++ return; ++ } ++ if (floor(value) == value) ++ { ++ *numerator = (unsigned long) value; ++ *denominator = 1; ++ } + *numerator=1; + df=1.0; + while(fabs(df - value) > MagickEpsilon) diff --git a/meta-oe/recipes-support/imagemagick/imagemagick/0002-Added-missing-return.patch b/meta-oe/recipes-support/imagemagick/imagemagick/0002-Added-missing-return.patch new file mode 100644 index 0000000000..def4fc881f --- /dev/null +++ b/meta-oe/recipes-support/imagemagick/imagemagick/0002-Added-missing-return.patch @@ -0,0 +1,24 @@ +From a574c6ffa818e91772a3bd37649f552b62cd416e Mon Sep 17 00:00:00 2001 +From: Dirk Lemstra +Date: Mon, 12 May 2025 22:23:48 +0200 +Subject: [PATCH] Added missing return. + +CVE: CVE-2025-53015 +Upstream-Status: Backport [https://github.com/ImageMagick/ImageMagick/commit/38631605e6ab744548a561797472cf8648bcfe26] +Signed-off-by: Gyorgy Sarvari +--- + MagickCore/profile.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/MagickCore/profile.c b/MagickCore/profile.c +index 85c180118..a68e54f14 100644 +--- a/MagickCore/profile.c ++++ b/MagickCore/profile.c +@@ -2581,6 +2581,7 @@ static void GetXmpNumeratorAndDenominator(double value, + { + *numerator = (unsigned long) value; + *denominator = 1; ++ return; + } + *numerator=1; + df=1.0; diff --git a/meta-oe/recipes-support/imagemagick/imagemagick_7.1.1-43.bb b/meta-oe/recipes-support/imagemagick/imagemagick_7.1.1-43.bb index 56f60716ba..64e81170bf 100644 --- a/meta-oe/recipes-support/imagemagick/imagemagick_7.1.1-43.bb +++ b/meta-oe/recipes-support/imagemagick/imagemagick_7.1.1-43.bb @@ -14,6 +14,8 @@ UPSTREAM_CHECK_GITTAGREGEX = "(?P([0-9][\.|_|-]?)+)" SRC_URI = "git://github.com/ImageMagick/ImageMagick.git;branch=main;protocol=https \ file://0001-Correct-out-of-bounds-read-of-a-single-byte.patch \ + file://0001-Added-extra-checks-to-make-sure-we-don-t-get-stuck-i.patch \ + file://0002-Added-missing-return.patch \ " SRCREV = "a2d96f40e707ba54b57e7d98c3277d3ea6611ace"