mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-06-13 17:39:57 +00:00
Code Issues Projects Releases Wiki Activity

imagemagick: patch CVE-2025-57803

Browse Source 
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-57803

Backport the patch that is mentioned in the NVD advisory.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Gyorgy Sarvari
2026-01-08 11:53:14 +01:00
committed by Anuj Mittal
parent 29fa171a9d
commit 9d92eeacdf
2 changed files with 61 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-oe/recipes-support/imagemagick/imagemagick/CVE-2025-57803.patch
+60
View File
@@ -0,0 +1,60 @@
From 28b22daea4382d3599ea5a5369354d044c51b124 Mon Sep 17 00:00:00 2001
From: Cristy <urban-warrior@imagemagick.org>
Date: Sat, 23 Aug 2025 09:18:40 -0400
Subject: [PATCH]
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mxvv-97wh-cfmm
CVE: CVE-2025-57803
Upstream-Status: Backport [https://github.com/ImageMagick/ImageMagick/commit/2c55221f4d38193adcb51056c14cf238fbcc35d7]
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
coders/bmp.c | 20 ++++++++++++++++----
1 file changed, 16 insertions(+), 4 deletions(-)
diff --git a/coders/bmp.c b/coders/bmp.c
index e05659b22..5c75e7f23 100644
--- a/coders/bmp.c
+++ b/coders/bmp.c
@@ -516,6 +516,11 @@ static MagickBooleanType IsBMP(const unsigned char *magick,const size_t length)
%
*/
+static inline MagickBooleanType BMPOverflowCheck(size_t x,size_t y)
+{
+ return((y != 0) && (x > 4294967295UL/y) ? MagickTrue : MagickFalse);
+}
+
static Image *ReadEmbedImage(const ImageInfo *image_info,Image *image,
const char *magick,ExceptionInfo *exception)
{
@@ -609,6 +614,7 @@ static Image *ReadBMPImage(const ImageInfo *image_info,ExceptionInfo *exception)
size_t
bit,
bytes_per_line,
+ extent,
length;
ssize_t
@@ -1110,12 +1116,18 @@ static Image *ReadBMPImage(const ImageInfo *image_info,ExceptionInfo *exception)
ThrowReaderException(CorruptImageError,"ImproperImageHeader");
if (bmp_info.compression == BI_RLE4)
bmp_info.bits_per_pixel<<=1;
- bytes_per_line=4*((image->columns*bmp_info.bits_per_pixel+31)/32);
- length=(size_t) bytes_per_line*image->rows;
+ extent=image->columns*bmp_info.bits_per_pixel;
+ bytes_per_line=4*((extent+31)/32);
+ if (BMPOverflowCheck(bytes_per_line,image->rows) != MagickFalse)
+ ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
+ length=bytes_per_line*image->rows;
if ((MagickSizeType) (length/256) > blob_size)
ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
- pixel_info=AcquireVirtualMemory(image->rows,
- MagickMax(bytes_per_line,image->columns+1UL)*sizeof(*pixels));
+ extent=MagickMax(bytes_per_line,image->columns+1UL);
+ if ((BMPOverflowCheck(image->rows,extent) != MagickFalse) ||
+ (BMPOverflowCheck(extent,sizeof(*pixels)) != MagickFalse))
+ ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+ pixel_info=AcquireVirtualMemory(image->rows,extent*sizeof(*pixels));
if (pixel_info == (MemoryInfo *) NULL)
ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
pixels=(unsigned char *) GetVirtualMemoryBlob(pixel_info);
meta-oe/recipes-support/imagemagick/imagemagick_7.1.1.bb
+1
View File
@@ -21,6 +21,7 @@ SRC_URI = "git://github.com/ImageMagick/ImageMagick.git;branch=main;protocol=htt
file://CVE-2025-55154.patch \
file://CVE-2025-55160.patch \
file://CVE-2025-55212.patch \
file://CVE-2025-57803.patch \
"
SRCREV = "82572afc879b439cbf8c9c6f3a9ac7626adf98fb"