ImageMagick/CVE-2025-46393.patch
starlet-dx 7dec2d7bfc Fix CVE-2025-43965 and CVE-2025-46393
(cherry picked from commit 57f3c0315f4f11bbc2019fc71ccff2075f941386)
2025-04-29 15:30:12 +08:00

37 lines
1.6 KiB
Diff

From 81ac8a0d2eb21739842ed18c48c7646b7eef65b8 Mon Sep 17 00:00:00 2001
From: Cristy <urban-warrior@imagemagick.org>
Date: Fri, 7 Feb 2025 20:57:15 -0500
Subject: [PATCH] multispectral MIFF images renders all channels in arbitrary
order
---
coders/miff.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/coders/miff.c b/coders/miff.c
index 355455bc50e..398f66d0b66 100644
--- a/coders/miff.c
+++ b/coders/miff.c
@@ -1347,10 +1347,10 @@ static Image *ReadMIFFImage(const ImageInfo *image_info,
packet_size+=image->depth/8;
if (image->colorspace == CMYKColorspace)
packet_size+=image->depth/8;
+ if (image->number_meta_channels != 0)
+ packet_size=GetImageChannels(image)*image->depth/8;
if (image->compression == RLECompression)
packet_size++;
- if (image->number_meta_channels != 0)
- packet_size+=image->number_meta_channels*image->depth/8;
compress_extent=MagickMax(MagickMax(BZipMaxExtent(packet_size*
image->columns),LZMAMaxExtent(packet_size*image->columns)),
ZipMaxExtent(packet_size*image->columns));
@@ -2171,7 +2171,7 @@ static MagickBooleanType WriteMIFFImage(const ImageInfo *image_info,
if (compression == RLECompression)
packet_size++;
if (image->number_meta_channels != 0)
- packet_size+=image->number_meta_channels*image->depth/8;
+ packet_size=GetImageChannels(image)*image->depth/8;
length=MagickMax(BZipMaxExtent(packet_size*image->columns),ZipMaxExtent(
packet_size*image->columns));
if ((compression == BZipCompression) || (compression == ZipCompression))