diff --git a/ChangeLog b/ChangeLog index f828f32b30..f67009cc4a 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,10 @@ +2021-07-26 6.9.12-20 + * Release ImageMagick version 6.9.12-20 GIT revision 16... + +2021-07-26 6.9.12-20 + * heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell). + * grayscale image write optimization + 2021-07-18 6.9.12-19 * Release ImageMagick version 6.9.12-19 GIT revision 16731:1015767a1:20210718 diff --git a/coders/tiff.c b/coders/tiff.c index d99e4efb5a..1639dcaeb4 100644 --- a/coders/tiff.c +++ b/coders/tiff.c @@ -1940,7 +1940,7 @@ static Image *ReadTIFFImage(const ImageInfo *image_info, columns_remaining=image->columns-x; if ((ssize_t) (x+columns) < (ssize_t) image->columns) columns_remaining=columns; - if (TIFFReadTile(tiff,tile_pixels,(uint32) x,(uint32) y,0,i) == 0) + if (TIFFReadTile(tiff,tile_pixels,(uint32) x,(uint32) y,0,i) == -1) break; p=tile_pixels; for (row=0; row < rows_remaining; row++) @@ -2000,8 +2000,13 @@ static Image *ReadTIFFImage(const ImageInfo *image_info, if (generic_info == (MemoryInfo *) NULL) ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed"); pixels=(uint32 *) GetVirtualMemoryBlob(generic_info); - (void) TIFFReadRGBAImage(tiff,(uint32) image->columns,(uint32) + status=TIFFReadRGBAImage(tiff,(uint32) image->columns,(uint32) image->rows,(uint32 *) pixels,0); + if (status == -1) + { + generic_info=RelinquishVirtualMemory(generic_info); + break; + } p=pixels+(image->columns*image->rows)-1; for (y=0; y < (ssize_t) image->rows; y++) {