mirror of
git://git.openembedded.org/meta-openembedded
synced 2026-10-02 14:44:06 +00:00
b091a7cc12
Reference: 3e03307210
Signed-off-by: Nitin Wankhade <nitin.wankhade333@gmail.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
38 lines
1.4 KiB
Diff
38 lines
1.4 KiB
Diff
From 3e0330721020e0c5bb52e4b77c347527dd71658e Mon Sep 17 00:00:00 2001
|
|
From: Dirk Lemstra <dirk@lemstra.org>
|
|
Date: Sun, 4 Jan 2026 15:26:48 +0100y
|
|
|
|
Subject: [PATCH] imagemagick: Fix CVE-2026-22770
|
|
CVE: CVE-2026-22770
|
|
Upstream-Status: Backport [https://github.com/ImageMagick/ImageMagick/commit/3e0330721020e0c5bb52e4b77c347527dd71658e]
|
|
Signed-off-by: Nitin Wankhade <nitin.wankhade333@gmail.com>
|
|
===
|
|
diff --git a/MagickCore/effect.c b/MagickCore/effect.c
|
|
index bfb1363..3a44240 100644
|
|
--- a/MagickCore/effect.c
|
|
+++ b/MagickCore/effect.c
|
|
@@ -880,16 +880,21 @@ static double **AcquireBilateralThreadSet(const size_t number_threads,
|
|
double
|
|
**weights;
|
|
|
|
+ size_t
|
|
+ count;
|
|
+
|
|
ssize_t
|
|
i;
|
|
|
|
+ if (HeapOverflowSanityCheckGetSize(height,sizeof(**weights),&count) != MagickFalse)
|
|
+ return((double **) NULL);
|
|
weights=(double **) AcquireQuantumMemory(number_threads+1,sizeof(*weights));
|
|
if (weights == (double **) NULL)
|
|
return((double **) NULL);
|
|
- (void) memset(weights,0,number_threads*sizeof(*weights));
|
|
+ (void) memset(weights,0,(number_threads+1)*sizeof(*weights));
|
|
for (i=0; i <= (ssize_t) number_threads; i++)
|
|
{
|
|
- weights[i]=(double *) AcquireQuantumMemory(width,height*sizeof(**weights));
|
|
+ weights[i]=(double *) AcquireQuantumMemory(width,count);
|
|
if (weights[i] == (double *) NULL)
|
|
return(DestroyBilateralThreadSet(number_threads,weights));
|
|
}
|