From 7bd1473003971ecde750ee60b6b626a24bc9d031e9ea52a00b0940490954b8fd Mon Sep 17 00:00:00 2001 From: Petr Gajdos Date: Mon, 28 Dec 2020 14:31:02 +0000 Subject: [PATCH] - version update to 1.3.36 Security Fixes: * fix issues found by oss-fuzz project * WPG: Fixes for heap buffer overflow. Bug fixes: * ConstituteImage(): Set image depth appropriately based on the storage size specified by StorageType and QuantumDepth. * GetImageBoundingBox(): Fix problem that MagickTrimImage with extreme fuzz values could produce an image with negative width. * ImageToFile(): Improve error handling to avoid possible deferred deletion of temporary files, causing unexpected excessive use of temporary file space. * JNG: Add validations for alpha compression method values and use this information to enforce decoding using the appropriate sub-format (rather than auto-detecting the format). Also, address memory leaks which may occur if the sub-decoder does something other than was expected. * MagickCondSignal(): Improvements to conditional signal handler registration (which avoids over-riding signal handlers previously registered by an API user). * ModifyCache(): Fix memory leak. * ReadCacheIndexes(): Don't blunder into accessing a null pointer if the using code has ignored a previous error report bubled-up from SetNexus(). * MNG: When doing image scaling and the image width or height is 1 then always use simple pixel replication as per the MNG specification. * MVG: Fixes to 'push clip-path foo' and 'pop clip-path foo' parsing to eliminate a class of malign behavior. * MVG: Place an aribrary limit on stroke dash polygon unit maximum OBS-URL: https://build.opensuse.org/package/show/graphics/GraphicsMagick?expand=0&rev=125 --- GraphicsMagick.changes | 90 +++++++++++++++++++++++++++++ GraphicsMagick.spec | 5 +- GraphicsMagick-1.3.35.tar.xz | 3 - GraphicsMagick-1.3.36.tar.xz | 3 + GraphicsMagick-CVE-2020-12672.patch | 49 ---------------- 5 files changed, 94 insertions(+), 56 deletions(-) delete mode 100644 GraphicsMagick-1.3.35.tar.xz create mode 100644 GraphicsMagick-1.3.36.tar.xz delete mode 100644 GraphicsMagick-CVE-2020-12672.patch diff --git a/GraphicsMagick.changes b/GraphicsMagick.changes index 21346dd..ede239f 100644 --- a/GraphicsMagick.changes +++ b/GraphicsMagick.changes @@ -1,3 +1,93 @@ +------------------------------------------------------------------- +Mon Dec 28 14:27:07 UTC 2020 - pgajdos@suse.com + +- version update to 1.3.36 + Security Fixes: + * fix issues found by oss-fuzz project + * WPG: Fixes for heap buffer overflow. + Bug fixes: + * ConstituteImage(): Set image depth appropriately based on the + storage size specified by StorageType and QuantumDepth. + * GetImageBoundingBox(): Fix problem that MagickTrimImage with extreme + fuzz values could produce an image with negative width. + * ImageToFile(): Improve error handling to avoid possible deferred + deletion of temporary files, causing unexpected excessive use of + temporary file space. + * JNG: Add validations for alpha compression method values and use + this information to enforce decoding using the appropriate + sub-format (rather than auto-detecting the format). Also, address + memory leaks which may occur if the sub-decoder does something other + than was expected. + * MagickCondSignal(): Improvements to conditional signal handler + registration (which avoids over-riding signal handlers previously + registered by an API user). + * ModifyCache(): Fix memory leak. + * ReadCacheIndexes(): Don't blunder into accessing a null pointer if + the using code has ignored a previous error report bubled-up from + SetNexus(). + * MNG: When doing image scaling and the image width or height is 1 + then always use simple pixel replication as per the MNG + specification. + * MVG: Fixes to 'push clip-path foo' and 'pop clip-path foo' parsing + to eliminate a class of malign behavior. + * MVG: Place an aribrary limit on stroke dash polygon unit maximum + length in order to avoid possibly rendering "forever". + * PCL: No longer attempt to handle reading HP PCL format via the + external 'hp2xx' program since it seems worthless for that task. + * PS: Fix corrupt image when writing PseudoClass image with a colormap + larger than two entries as bilevel. + * SVG: Memory leak fixes. + * SVG reader: Now support 'ping' support so the identify command works + as expected. + * TIFF: WEBP compression only supports a depth of 8 so force that + value. + * Wand MagickSetSamplingFactors(): Correct formatting of sampling + factors string. + New Features: + * Logging is now fully programmable. + * DPX format: Support dpx:swap-samples-read define which behaves + similar to dpx:swap-samples, but is only applied when reading, as + well as dpx:swap-samples-write, which is only applied when + writing. This provides for use when there is both reading and + writing in the same operation (otherwise the final result was no + effect!). + API Updates: + * magick/api.h: Add "magick/enum_strings.h" to API headers. + * New log settings accessor C functions: SetLogDefaultFileName(), + SetLogDefaultFormat(), SetLogDefaultOutputType(), + SetLogDefaultLogMethod(), SetLogDefaultLimit(), + SetLogDefaultGenerations(), SetLogDefaultEventType(). These + functions allow a program to set the same parameters which may be + set by loading a "log.mgk" function. If a default logging callback + was provided via SetLogDefaultLogMethod() such that MethodOutput is + used, then the search for a "log.mgk" is avoided entirely. + * New log settings accessor C++ functions: SetLogDefaultFileName(), + SetLogDefaultFormat(), SetLogDefaultOutputType(), + SetLogDefaultLogMethod(), SetLogDefaultLimit(), + SetLogDefaultGenerations(), SetLogDefaultEventType(). These C++ + functions just pass through to the equivalent C functions and + provide the same benefits. + * A simple resource-limit respecting memory allocator has been + developed for internal use wherever arbitrarily-large amounts of + memory might be requested. This will gradually be added wherever it + appears to be needed. The memory resource limits are at the overall + process level. The MVG/SVG rendering code is updated to use this + new allocator. Almost all of the coders (image format + readers/writers) have now been updated to use this new allocator. + This means that '-limit memory 300MB' would be more complete and + meaningful now. Temporary allocations by the image processing + algorithms (other than for the images themselves) are still not + accounted for in the resource limiting. + * MVG Renderer / DrawImage(): Use resource-limit respecting memory + allocators for remaining large memory allocations. + * PNG writer: Don't skip optional Exif identifier code if it isn't present. + * DPX reader/writer: decode/encode of 10-bit packed DPX is now twice + as fast due to code simplification. + * TIFF reader: Apply the same resource limits to TIFF tile sizes as + apply to the image itself. +- deleted patches + - GraphicsMagick-CVE-2020-12672.patch (upstreamed) + ------------------------------------------------------------------- Tue Aug 25 09:00:35 UTC 2020 - Callum Farmer diff --git a/GraphicsMagick.spec b/GraphicsMagick.spec index 6611509..54850d8 100644 --- a/GraphicsMagick.spec +++ b/GraphicsMagick.spec @@ -30,7 +30,7 @@ %define pp_so_ver 12 %define wand_so_ver 2 Name: GraphicsMagick -Version: 1.3.35 +Version: 1.3.36 Release: 0 Summary: Viewer and Converter for Images License: MIT @@ -41,8 +41,6 @@ Source: ftp://ftp.GraphicsMagick.org/pub/%{name}/%{base_version}/%{name} Patch0: GraphicsMagick-perl-linkage.patch %endif Patch1: GraphicsMagick-disable-insecure-coders.patch -# CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c. -Patch2: GraphicsMagick-CVE-2020-12672.patch BuildRequires: cups-client BuildRequires: dcraw BuildRequires: gcc-c++ @@ -212,7 +210,6 @@ images, and to create thumbnail images. %patch0 -p1 %endif %patch1 -p1 -%patch2 -p1 %build # This shouldn't be there yet. diff --git a/GraphicsMagick-1.3.35.tar.xz b/GraphicsMagick-1.3.35.tar.xz deleted file mode 100644 index 2f205fc..0000000 --- a/GraphicsMagick-1.3.35.tar.xz +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:188a8d6108fea87a0208723e8d206ec1d4d7299022be8ce5d0a9720509250250 -size 5543224 diff --git a/GraphicsMagick-1.3.36.tar.xz b/GraphicsMagick-1.3.36.tar.xz new file mode 100644 index 0000000..c3ca7ff --- /dev/null +++ b/GraphicsMagick-1.3.36.tar.xz @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:5d5b3fde759cdfc307aaf21df9ebd8c752e3f088bb051dd5df8aac7ba7338f46 +size 5600712 diff --git a/GraphicsMagick-CVE-2020-12672.patch b/GraphicsMagick-CVE-2020-12672.patch deleted file mode 100644 index fa203d5..0000000 --- a/GraphicsMagick-CVE-2020-12672.patch +++ /dev/null @@ -1,49 +0,0 @@ -diff -r 4917a4242fc0 -r 50395430a371 coders/png.c ---- a/coders/png.c Fri May 01 13:49:13 2020 -0500 -+++ b/coders/png.c Sat May 30 10:18:16 2020 -0500 -@@ -5689,7 +5691,28 @@ - - if (logging) - (void) LogMagickEvent(CoderEvent,GetMagickModule(), -- " Processing MNG MAGN chunk"); -+ " Processing MNG MAGN chunk: MB=%u, ML=%u," -+ " MR=%u, MT=%u, MX=%u, MY=%u," -+ " X_method=%u, Y_method=%u", -+ mng_info->magn_mb,mng_info->magn_ml, -+ mng_info->magn_mr,mng_info->magn_mt, -+ mng_info->magn_mx,mng_info->magn_my, -+ mng_info->magn_methx, -+ mng_info->magn_methy); -+ -+ /* -+ If the image width is 1, then X magnification is done -+ by simple pixel replication. -+ */ -+ if (image->columns == 1) -+ mng_info->magn_methx = 1; -+ -+ /* -+ If the image height is 1, then Y magnification is done -+ by simple pixel replication. -+ */ -+ if (image->rows == 1) -+ mng_info->magn_methy = 1; - - if (mng_info->magn_methx == 1) - { -@@ -5734,12 +5757,10 @@ - Image - *large_image; - -- int -- yy; -- - long - m, -- y; -+ y, -+ yy; - - register long - x; -