diff --git a/magick/cache-private.h b/magick/cache-private.h index 05d231f94..6f47100c6 100644 --- a/magick/cache-private.h +++ b/magick/cache-private.h @@ -249,6 +249,17 @@ typedef struct _CacheInfo height_limit; } CacheInfo; +static inline MagickBooleanType IsValidPixelOffset(const ssize_t y, + const size_t columns) +{ + if (columns == 0) + return(MagickTrue); + if ((y >= (MAGICK_SSIZE_MAX/(ssize_t) columns)) || + (y <= (MAGICK_SSIZE_MIN/(ssize_t) columns))) + return(MagickFalse); + return(MagickTrue); +} + extern MagickExport Cache AcquirePixelCache(const size_t), ClonePixelCache(const Cache), diff --git a/magick/cache.c b/magick/cache.c index fb897860f..b11b3548a 100644 --- a/magick/cache.c +++ b/magick/cache.c @@ -2930,17 +2930,6 @@ static inline MagickBooleanType IsOffsetOverflow(const ssize_t x, return(MagickTrue); } -static inline MagickBooleanType IsValidOffset(const ssize_t y, - const size_t columns) -{ - if (columns == 0) - return(MagickTrue); - if ((y >= (MAGICK_SSIZE_MAX/(ssize_t) columns)) || - (y <= (MAGICK_SSIZE_MIN/(ssize_t) columns))) - return(MagickFalse); - return(MagickTrue); -} - static inline ssize_t RandomX(RandomInfo *random_info,const size_t columns) { return((ssize_t) (columns*GetPseudoRandomValue(random_info))); @@ -3027,7 +3016,7 @@ MagickExport const PixelPacket *GetVirtualPixelCacheNexus(const Image *image, MagickTrue : MagickFalse,nexus_info,exception); if (pixels == (PixelPacket *) NULL) return((const PixelPacket *) NULL); - if (IsValidOffset(nexus_info->region.y,cache_info->columns) == MagickFalse) + if (IsValidPixelOffset(nexus_info->region.y,cache_info->columns) == MagickFalse) return((const PixelPacket *) NULL); offset=nexus_info->region.y*(MagickOffsetType) cache_info->columns; if (IsOffsetOverflow(offset,nexus_info->region.x) == MagickFalse) @@ -4416,7 +4405,7 @@ MagickExport PixelPacket *QueueAuthenticPixelCacheNexus(Image *image, "PixelsAreNotAuthentic","`%s'",image->filename); return((PixelPacket *) NULL); } - if (IsValidOffset(y,cache_info->columns) == MagickFalse) + if (IsValidPixelOffset(y,cache_info->columns) == MagickFalse) return((PixelPacket *) NULL); offset=y*(MagickOffsetType) cache_info->columns+x; if (offset < 0) @@ -4655,7 +4644,7 @@ static MagickBooleanType ReadPixelCacheIndexes( return(MagickFalse); if (nexus_info->authentic_pixel_cache != MagickFalse) return(MagickTrue); - if (IsValidOffset(nexus_info->region.y,cache_info->columns) == MagickFalse) + if (IsValidPixelOffset(nexus_info->region.y,cache_info->columns) == MagickFalse) return(MagickFalse); offset=nexus_info->region.y*(MagickOffsetType) cache_info->columns+ nexus_info->region.x; @@ -4824,7 +4813,7 @@ static MagickBooleanType ReadPixelCachePixels( if (nexus_info->authentic_pixel_cache != MagickFalse) return(MagickTrue); - if (IsValidOffset(nexus_info->region.y,cache_info->columns) == MagickFalse) + if (IsValidPixelOffset(nexus_info->region.y,cache_info->columns) == MagickFalse) return(MagickFalse); offset=nexus_info->region.y*(MagickOffsetType) cache_info->columns; if ((offset/(MagickOffsetType) cache_info->columns) != nexus_info->region.y) @@ -5220,14 +5209,19 @@ static PixelPacket *SetPixelCacheNexusPixels( return((PixelPacket *) NULL); } if (((MagickSizeType) width > cache_info->width_limit) || - ((MagickSizeType) height > cache_info->height_limit) || - (ValidatePixelOffset(x,width) == MagickFalse) || - (ValidatePixelOffset(y,height) == MagickFalse)) + ((MagickSizeType) height > cache_info->height_limit)) { (void) ThrowMagickException(exception,GetMagickModule(),ImageError, "WidthOrHeightExceedsLimit","`%s'",cache_info->filename); return((PixelPacket *) NULL); } + if ((ValidatePixelOffset(x,width) == MagickFalse) || + (ValidatePixelOffset(y,height) == MagickFalse)) + { + (void) ThrowMagickException(exception,GetMagickModule(),CorruptImageError, + "InvalidPixel","`%s'",cache_info->filename); + return((PixelPacket *) NULL); + } if (((cache_info->type == MemoryCache) || (cache_info->type == MapCache)) && (buffered == MagickFalse)) { @@ -5242,7 +5236,7 @@ static PixelPacket *SetPixelCacheNexusPixels( /* Pixels are accessed directly from memory. */ - if (IsValidOffset(y,cache_info->columns) == MagickFalse) + if (IsValidPixelOffset(y,cache_info->columns) == MagickFalse) return((PixelPacket *) NULL); offset=y*(MagickOffsetType) cache_info->columns+x; nexus_info->pixels=cache_info->pixels+offset; @@ -5772,7 +5766,7 @@ static MagickBooleanType WritePixelCacheIndexes(CacheInfo *cache_info, return(MagickTrue); if (nexus_info->indexes == (IndexPacket *) NULL) return(MagickFalse); - if (IsValidOffset(nexus_info->region.y,cache_info->columns) == MagickFalse) + if (IsValidPixelOffset(nexus_info->region.y,cache_info->columns) == MagickFalse) return(MagickFalse); offset=nexus_info->region.y*(MagickOffsetType) cache_info->columns+ nexus_info->region.x; @@ -5941,7 +5935,7 @@ static MagickBooleanType WritePixelCachePixels(CacheInfo *cache_info, if (nexus_info->authentic_pixel_cache != MagickFalse) return(MagickTrue); - if (IsValidOffset(nexus_info->region.y,cache_info->columns) == MagickFalse) + if (IsValidPixelOffset(nexus_info->region.y,cache_info->columns) == MagickFalse) return(MagickFalse); offset=nexus_info->region.y*(MagickOffsetType) cache_info->columns+ nexus_info->region.x; diff --git a/magick/colorspace.c b/magick/colorspace.c index a6e9222c1..0035fb5d2 100644 --- a/magick/colorspace.c +++ b/magick/colorspace.c @@ -917,8 +917,8 @@ MagickExport MagickBooleanType RGBTransformImage(Image *image, I and Q, normally -0.5 through 0.5, are normalized to the range 0 through QuantumRange. */ - primary_info.y=(double) (MaxMap+1.0)/2.0; - primary_info.z=(double) (MaxMap+1.0)/2.0; + primary_info.y=((double) MaxMap+1.0)/2.0; + primary_info.z=((double) MaxMap+1.0)/2.0; #if defined(MAGICKCORE_OPENMP_SUPPORT) #pragma omp parallel for schedule(static) #endif @@ -972,8 +972,8 @@ MagickExport MagickBooleanType RGBTransformImage(Image *image, Cb and Cr, normally -0.5 through 0.5, are normalized to the range 0 through QuantumRange. */ - primary_info.y=(double) (MaxMap+1.0)/2.0; - primary_info.z=(double) (MaxMap+1.0)/2.0; + primary_info.y=((double) MaxMap+1.0)/2.0; + primary_info.z=((double) MaxMap+1.0)/2.0; #if defined(MAGICKCORE_OPENMP_SUPPORT) #pragma omp parallel for schedule(static) #endif @@ -1027,8 +1027,8 @@ MagickExport MagickBooleanType RGBTransformImage(Image *image, Cb and Cr, normally -0.5 through 0.5, are normalized to the range 0 through QuantumRange. */ - primary_info.y=(double) (MaxMap+1.0)/2.0; - primary_info.z=(double) (MaxMap+1.0)/2.0; + primary_info.y=((double) MaxMap+1.0)/2.0; + primary_info.z=((double) MaxMap+1.0)/2.0; #if defined(MAGICKCORE_OPENMP_SUPPORT) #pragma omp parallel for schedule(static) #endif diff --git a/magick/pixel.c b/magick/pixel.c index f2a5b5fa8..17c1086ce 100644 --- a/magick/pixel.c +++ b/magick/pixel.c @@ -4502,6 +4502,9 @@ MagickExport MagickBooleanType InterpolateMagickPixelPacket( status=MagickTrue; x_offset=CastDoubleToLong(floor(x)); y_offset=CastDoubleToLong(floor(y)); + if ((ValidatePixelOffset(x_offset,source->columns) == MagickFalse) || + (ValidatePixelOffset(y_offset,source->rows) == MagickFalse)) + return(MagickFalse); interpolate = method; if (interpolate == UndefinedInterpolatePixel) interpolate=image->interpolate; diff --git a/magick/visual-effects.c b/magick/visual-effects.c index dc22bdcd1..6043e2885 100644 --- a/magick/visual-effects.c +++ b/magick/visual-effects.c @@ -1068,21 +1068,21 @@ MagickExport Image *ImplodeImage(const Image *image,const double amount, double distance; + IndexPacket + *magick_restrict implode_indexes; + MagickPixelPacket pixel; + PixelPacket + *magick_restrict q; + PointInfo delta; - IndexPacket - *magick_restrict implode_indexes; - ssize_t x; - PixelPacket - *magick_restrict q; - if (status == MagickFalse) continue; q=GetCacheViewAuthenticPixels(implode_view,0,y,implode_image->columns,1, @@ -1093,31 +1093,34 @@ MagickExport Image *ImplodeImage(const Image *image,const double amount, continue; } implode_indexes=GetCacheViewAuthenticIndexQueue(implode_view); - delta.y=scale.y*(double) (y-center.y); + delta.y=scale.y*((double) y-center.y); pixel=zero; for (x=0; x < (ssize_t) image->columns; x++) { /* Determine if the pixel is within an ellipse. */ - delta.x=scale.x*(double) (x-center.x); + delta.x=scale.x*((double) x-center.x); distance=delta.x*delta.x+delta.y*delta.y; if (distance < (radius*radius)) { double factor; + PointInfo + offset; + /* Implode the pixel. */ factor=1.0; if (distance > 0.0) - factor=pow(sin((double) (MagickPI*sqrt((double) distance)* - PerceptibleReciprocal(radius)/2)),-amount); + factor=pow(sin((double) (MagickPI*sqrt(distance)* + PerceptibleReciprocal(radius)/2.0)),-amount); + offset.x=factor*delta.x*PerceptibleReciprocal(scale.x)+center.x; + offset.y=actor*delta.y*PerceptibleReciprocal(scale.y)+center.y: status=InterpolateMagickPixelPacket(image,image_view, - UndefinedInterpolatePixel,(double) (factor*delta.x* - PerceptibleReciprocal(scale.x)+center.x),(double) (factor*delta.y* - PerceptibleReciprocal(scale.y)+center.y),&pixel,exception); + UndefinedInterpolatePixel,offset.x,offset.y,&pixel,exception); if (status == MagickFalse) break; SetPixelPacket(implode_image,&pixel,q,implode_indexes+x);