On Mon, Jan 09, 2006 at 10:18:13AM -0500, Matthias Clasen wrote:
> Ah, got it now. Does this look more complete ?
Yes, but there are still a few more places to fix. The attached patch
for 6.2.4.5 should be fairly complete, apart from a few odd places in
coders/, but those fall more into the scope of CVE-2005-4601. Mind,
though, that I'm still testing the fix, so some polishing might be
needed still.
+/*
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+% %
+% %
+% %
+% F o r m a t M a g i c k S t r i n g N u m e r i c %
+% %
+% %
+% %
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%
+% Method FormatMagickStringNumeric formats output for a single numeric
+% argument. It takes into account that the format string given might be
+% untrusted user input, and returns the length of the formatted string.
+%
+% The format of the FormatMagickStringNumeric method is:
+%
+% long FormatMagickStringNumeric(char *string,const size_t length,
+% const char *format,int value)
+%
+% A description of each parameter follows.
+%
+% o string: FormatMagickStringNumeric() returns the formatted string in this
+% character buffer.
+%
+% o length: The maximum length of the string.
+%
+% o format: A string describing the format to use to write the numeric
+% argument. Only the first numeric format identifier is replaced.
+%
+% o value: Numeric value to substitute into format string.
+%
+%
+*/
+MagickExport long FormatMagickStringNumeric(char *string,const size_t length,const char *format,int value)
+{
+ char
+ *p;
+
+ (void) CopyMagickString(string, format, length);
+
+ for (p=strchr(format,'%'); p != (char *) NULL; p=strchr(p+1,'%'))
+ {
+ char
+ *q;
+
+ q=(char *) p+1;
+ if (*q == '0')
+ (void) strtol(q,&q,10);
+ if ((*q == '%') || (*q == 'd') || (*q == 'o') || (*q == 'x'))
+ {
+ char
+ c;
+
+ q++;
+ c=*q;
+ *q='\0';
+ (void) snprintf(string+(p-format),length-(p-format),p,value);
+ *q=c;
+ (void) ConcatenateMagickString(&string,q,length);
+ if (*(q-1) == '%')
+ p++;
+ else
+ break;
+ }
+ }
+ return (long)strlen(string);
}
Message-ID: <email address hidden>
Date: Tue, 10 Jan 2006 17:03:55 +0100
From: Daniel Kobras <email address hidden>
To: Matthias Clasen <email address hidden>, <email address hidden>
Subject: Re: Bug#345876: imagemagick: New format string vulnerability in SetImageInfo().
--fdj2RfSjLxBAspz7 Disposition: inline
Content-Type: text/plain; charset=us-ascii
Content-
On Mon, Jan 09, 2006 at 10:18:13AM -0500, Matthias Clasen wrote:
> Ah, got it now. Does this look more complete ?
Yes, but there are still a few more places to fix. The attached patch
for 6.2.4.5 should be fairly complete, apart from a few odd places in
coders/, but those fall more into the scope of CVE-2005-4601. Mind,
though, that I'm still testing the fix, so some polishing might be
needed still.
Regards,
Daniel.
--fdj2RfSjLxBAspz7 Disposition: inline; filename= "im_format_ string. diff"
Content-Type: text/plain; charset=us-ascii
Content-
diff -r 8a3cbd342315 magick/animate.c
Form filename for multi-part images. ing(filename, MaxTextExtent, ingNumeric( filename, MaxTextExtent,
image_ info->filename, scene); filename, image_info- >filename) == 0)
(void) FormatMagickStr ing(filename, MaxTextExtent, "%s[%lu] ", g(filename, image-> filename, MaxTextExtent) ; filename, '%'); p != (char *) NULL; p=strchr(p+1,'%')) MaxTextExtent] ; g(format, p,MaxTextExtent ); ing(p,MaxTextEx tent,format, image-> scene); ingNumeric( filename, MaxTextExtent, image-> filename,
( GetNextImageInL ist(image) != (Image *) NULL))
Form filename for multi-part images. ing(filename, MaxTextExtent, ingNumeric( filename, MaxTextExtent,
image_ info->filename, scene); filename, image_info- >filename) == 0)
(void) FormatMagickStr ing(filename, MaxTextExtent, "%s.%lu" , g(filename, image_info- >filename, MaxTextExtent) ; filename, '%'); p != (char *) NULL; p=strchr(p+1,'%')) MaxTextExtent] ; g(format, p,MaxTextExtent ); ing(p,MaxTextEx tent,format, image_info- >scene) ; ingNumeric( filename, MaxTextExtent, >filename, image_info- >scene) ; (filename, image_info- >filename) != 0) &&
(strchr( filename, '%') == (char *) NULL))
image_ info->adjoin= MagickFalse;
filename[ MaxTextExtent] ;
--- a/magick/animate.c Tue Jan 10 12:11:55 2006 +0100
+++ b/magick/animate.c Tue Jan 10 16:55:22 2006 +0100
@@ -604,7 +604,7 @@
/*
*/
- (void) FormatMagickStr
+ (void) FormatMagickStr
if (LocaleCompare(
diff -r 8a3cbd342315 magick/blob.c
--- a/magick/blob.c Tue Jan 10 12:11:55 2006 +0100
+++ b/magick/blob.c Tue Jan 10 16:55:22 2006 +0100
@@ -2120,25 +2120,8 @@
/*
Form filename for multi-part images.
*/
- (void) CopyMagickStrin
- for (p=strchr(
- {
- char
- *q;
-
- q=p+1;
- if (*q == '0')
- (void) strtol(q,&q,10);
- if ((*q == '%') || (*q == 'd') || (*q == 'o') || (*q == 'x'))
- {
- char
- format[
-
- (void) CopyMagickStrin
- (void) FormatMagickStr
- break;
- }
- }
+ (void) FormatMagickStr
+ image->scene);
if (image_info->adjoin == MagickFalse)
if ((image->previous != (Image *) NULL) ||
diff -r 8a3cbd342315 magick/display.c
--- a/magick/display.c Tue Jan 10 12:11:55 2006 +0100
+++ b/magick/display.c Tue Jan 10 16:55:22 2006 +0100
@@ -1984,7 +1984,7 @@
/*
*/
- (void) FormatMagickStr
+ (void) FormatMagickStr
if (LocaleCompare(
diff -r 8a3cbd342315 magick/image.c
--- a/magick/image.c Tue Jan 10 12:11:55 2006 +0100
+++ b/magick/image.c Tue Jan 10 16:55:22 2006 +0100
@@ -2869,25 +2869,8 @@
/*
Rectify multi-image file support.
*/
- (void) CopyMagickStrin
- for (p=strchr(
- {
- char
- *q;
-
- q=(char *) p+1;
- if (*q == '0')
- (void) strtol(q,&q,10);
- if ((*q == '%') || (*q == 'd') || (*q == 'o') || (*q == 'x'))
- {
- char
- format[
-
- (void) CopyMagickStrin
- (void) FormatMagickStr
- break;
- }
- }
+ (void) FormatMagickStr
+ image_info-
if ((LocaleCompare
diff -r 8a3cbd342315 magick/log.c
--- a/magick/log.c Tue Jan 10 12:11:55 2006 +0100
+++ b/magick/log.c Tue Jan 10 16:55:22 2006 +0100
@@ -914,8 +914,8 @@
char
- (void) FormatMagickStr ing(filename, MaxTextExtent, log_info- >filename, >generation % log_info- >generations) ; ingNumeric( filename, MaxTextExtent, >filename, log_info- >generation % log_info- >generations) ;
log_ info->file= fopen(filename, "w");
Form filename for multi-part images. ing(filename, MaxTextExtent, ingNumeric( filename, MaxTextExtent,
image_ info->filename, scene); filename, image_info- >filename) == 0)
(void) FormatMagickStr ing(filename, MaxTextExtent, "%s.%lu" ,
return( (StringInfo *) NULL); string_ info);
- log_info-
+ (void) FormatMagickStr
+ log_info-
if (log_info->file == (FILE *) NULL)
{
diff -r 8a3cbd342315 magick/montage.c
--- a/magick/montage.c Tue Jan 10 12:11:55 2006 +0100
+++ b/magick/montage.c Tue Jan 10 16:55:22 2006 +0100
@@ -530,7 +530,7 @@
/*
*/
- (void) FormatMagickStr
+ (void) FormatMagickStr
if (LocaleCompare(
diff -r 8a3cbd342315 magick/string.c
--- a/magick/string.c Tue Jan 10 12:11:55 2006 +0100
+++ b/magick/string.c Tue Jan 10 16:55:22 2006 +0100
@@ -953,6 +953,75 @@
}
return(
+}
+
+/* %%%%%%% %%%%%%% %%%%%%% %%%%%%% %%%%%%% %%%%%%% %%%%%%% %%%%%%% %%%%%%% %%%%%%% %%% %%%%%%% %%%%%%% %%%%%%% %%%%%%% %%%%%%% %%%%%%% %%%%%%% %%%%%%% %%%%%%% %%%%%%% %%% ingNumeric formats output for a single numeric ingNumeric method is: ingNumeric( char *string,const size_t length, ingNumeric( ) returns the formatted string in this ingNumeric( char *string,const size_t length,const char *format,int value) g(string, format, length); format, '%'); p != (char *) NULL; p=strchr(p+1,'%')) string+ (p-format) ,length- (p-format) ,p,value) ; ckString( &string, q,length) ; string) ;
+%%%%%%
+% %
+% %
+% %
+% F o r m a t M a g i c k S t r i n g N u m e r i c %
+% %
+% %
+% %
+%%%%%%
+%
+% Method FormatMagickStr
+% argument. It takes into account that the format string given might be
+% untrusted user input, and returns the length of the formatted string.
+%
+% The format of the FormatMagickStr
+%
+% long FormatMagickStr
+% const char *format,int value)
+%
+% A description of each parameter follows.
+%
+% o string: FormatMagickStr
+% character buffer.
+%
+% o length: The maximum length of the string.
+%
+% o format: A string describing the format to use to write the numeric
+% argument. Only the first numeric format identifier is replaced.
+%
+% o value: Numeric value to substitute into format string.
+%
+%
+*/
+MagickExport long FormatMagickStr
+{
+ char
+ *p;
+
+ (void) CopyMagickStrin
+
+ for (p=strchr(
+ {
+ char
+ *q;
+
+ q=(char *) p+1;
+ if (*q == '0')
+ (void) strtol(q,&q,10);
+ if ((*q == '%') || (*q == 'd') || (*q == 'o') || (*q == 'x'))
+ {
+ char
+ c;
+
+ q++;
+ c=*q;
+ *q='\0';
+ (void) snprintf(
+ *q=c;
+ (void) ConcatenateMagi
+ if (*(q-1) == '%')
+ p++;
+ else
+ break;
+ }
+ }
+ return (long)strlen(
}
/* attribute( (format (printf,3,4))), StringList( char *,const size_t,const char *,va_list) attribute( (format (printf,3,0))), ingNumeric( char *,const size_t,const char *,int), e(const char *,const char *), re(const char *,const char *,const size_t);
diff -r 8a3cbd342315 magick/string_.h
--- a/magick/string_.h Tue Jan 10 12:11:55 2006 +0100
+++ b/magick/string_.h Tue Jan 10 16:55:22 2006 +0100
@@ -60,6 +60,7 @@
magick_
FormatMagick
magick_
+ FormatMagickStr
LocaleCompar
LocaleNCompa
--fdj2RfSjLxBAs pz7--