Comment 5 for bug 27952

Message-Id: <email address hidden>
Date: Wed, 04 Jan 2006 12:04:46 -0500
From: Matthias Clasen <email address hidden>
To: <email address hidden>
Subject: a more complete fix

--=-Ejo0oJ5KgxoXRs4ep7Hm
Content-Type: text/plain
Content-Transfer-Encoding: 7bit

The same code is repeated in blob.c. Here is a more complete fix.

--=-Ejo0oJ5KgxoXRs4ep7Hm
Content-Disposition: attachment; filename=ImageMagick-6.2.5-format-string-again.patch
Content-Type: text/x-patch; name=ImageMagick-6.2.5-format-string-again.patch; charset=UTF-8
Content-Transfer-Encoding: 7bit

--- ImageMagick-6.2.5/magick/image.c.format-string-again 2005-10-22 12:17:39.000000000 -0400
+++ ImageMagick-6.2.5/magick/image.c 2006-01-04 11:37:30.000000000 -0500
@@ -2861,8 +2861,16 @@
             char
               format[MaxTextExtent];

+ /* Extract first numeric format specifier */
             (void) CopyMagickString(format,p,MaxTextExtent);
+ if (q-p+1 < MaxTextExtent)
+ format[q-p+1]='\0';
+ /* Expand format */
             (void) FormatMagickString(p,MaxTextExtent,format,image_info->scene);
+ /* Copy rest of string verbatim without further expansion */
+ (void) ConcatenateMagickString(filename,
+ image_info->filename+(q-filename)+1,
+ MaxTextExtent);
             break;
           }
       }
--- ImageMagick-6.2.5/magick/blob.c.format-string-again 2006-01-04 11:36:02.000000000 -0500
+++ ImageMagick-6.2.5/magick/blob.c 2006-01-04 11:37:32.000000000 -0500
@@ -2135,8 +2135,17 @@
             char
               format[MaxTextExtent];

+ /* Extract first numeric format specifier */
             (void) CopyMagickString(format,p,MaxTextExtent);
+ if (q-p+1 < MaxTextExtent)
+ format[q-p+1]='\0';
+ /* Expand format */
             (void) FormatMagickString(p,MaxTextExtent,format,image->scene);
+ /* Copy rest of string verbatim without further expansion */
+ (void) ConcatenateMagickString(filename,
+ image_info->filename+(q-filename)+1,
+ MaxTextExtent);
+
             break;
           }
       }

--=-Ejo0oJ5KgxoXRs4ep7Hm--