mirror of
git://git.openembedded.org/meta-openembedded
synced 2026-10-02 02:38:48 +00:00
5f2fdd2a49
Reference: bdae0681ad
Signed-off-by: Nitin Wankhade <nitin.wankhade333@gmail.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
24 lines
1.0 KiB
Diff
24 lines
1.0 KiB
Diff
From bdae0681ad1e572defe62df85834218f01e6d670 Mon Sep 17 00:00:00 2001
|
|
From: Dirk Lemstra <dirk@lemstra.org>
|
|
Date: Tue, 2 Dec 2025 22:49:12 +0100
|
|
|
|
Subject: [PATCH] imagemagick: Fix CVE-2025-66628
|
|
CVE: CVE-2025-66628
|
|
Upstream-Status: Backport [https://github.com/ImageMagick/ImageMagick/commit/bdae0681ad1e572defe62df85834218f01e6d670]
|
|
Signed-off-by: Nitin Wankhade <nitin.wankhade333@gmail.com>
|
|
===
|
|
diff --git a/coders/tim.c b/coders/tim.c
|
|
index 9a281b3..7b9cb1b 100644
|
|
--- a/coders/tim.c
|
|
+++ b/coders/tim.c
|
|
@@ -231,7 +231,8 @@ static Image *ReadTIMImage(const ImageInfo *image_info,ExceptionInfo *exception)
|
|
(void) ReadBlobLSBShort(image);
|
|
width=ReadBlobLSBShort(image);
|
|
height=ReadBlobLSBShort(image);
|
|
- image_size=2*width*height;
|
|
+ if (HeapOverflowSanityCheckGetSize(2*width,height,&image_size) != MagickFalse)
|
|
+ ThrowReaderException(CorruptImageError,"ImproperImageHeader");
|
|
if (image_size > GetBlobSize(image))
|
|
ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
|
|
bytes_per_line=width*2;
|