commit 6aa437636a348414dfba103f873684f76f9f9934
author Cristy <urban-warrior@imagemagick.org> Tue May 24 08:00:42 2016 -0400
committer Cristy <urban-warrior@imagemagick.org> Tue May 24 08:00:42 2016 -0400
tree 14c054690503577e200439bf81918fd38edf3b52
parent 3ed6c69aa54587faeaf61383a97db96a3409ed28

Security improvements to TEXT coder broke it

coders/mvg.c

diff --git a/coders/mvg.c b/coders/mvg.c
index 7b09d08..3062463 100644
--- a/coders/mvg.c
+++ b/coders/mvg.c
@@ -212,6 +212,8 @@
           draw_info->primitive[GetBlobSize(image)]='\0';
         }
      }
+  if (draw_info->primitive == (char *) NULL)
+    ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
   (void) DrawImage(image,draw_info,exception);
   draw_info=DestroyDrawInfo(draw_info);
   (void) CloseBlob(image);

coders/txt.c

diff --git a/coders/txt.c b/coders/txt.c
index 1245eaf..112ed94 100644
--- a/coders/txt.c
+++ b/coders/txt.c
@@ -156,18 +156,20 @@
 %    o exception: return any errors or warnings in this structure.
 %
 */
-static Image *ReadTEXTImage(const ImageInfo *image_info,Image *image,
-  char *text,ExceptionInfo *exception)
+static Image *ReadTEXTImage(const ImageInfo *image_info,
+  ExceptionInfo *exception)
 {
   char
     filename[MagickPathExtent],
     geometry[MagickPathExtent],
-    *p;
+    *p,
+    *text;
 
   DrawInfo
     *draw_info;
 
   Image
+    *image,
     *texture;
 
   MagickBooleanType
@@ -195,6 +197,26 @@
       image_info->filename);
   assert(exception != (ExceptionInfo *) NULL);
   assert(exception->signature == MagickCoreSignature);
+  image=AcquireImage(image_info,exception);
+  status=OpenBlob(image_info,image,ReadBinaryBlobMode,exception);
+  if (status == MagickFalse)
+    {
+      image=DestroyImageList(image);
+      return((Image *) NULL);
+    }
+  if (GetBlobStreamData(image) == (unsigned char *) NULL)
+    text=FileToString(image->filename,~0UL,exception);
+  else
+    {
+      text=(char *) AcquireMagickMemory(GetBlobSize(image)+1);
+      if (text != (char *) NULL)
+        {
+          CopyMagickMemory(text,GetBlobStreamData(image),GetBlobSize(image));
+          text[GetBlobSize(image)]='\0';
+        }
+     }
+  if (text == (char *) NULL)
+    ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
   /*
     Set the page geometry.
   */
@@ -229,7 +251,10 @@
     delta.y)+0.5);
   status=SetImageExtent(image,image->columns,image->rows,exception);
   if (status == MagickFalse)
-    return(DestroyImageList(image));
+    {
+      text=DestroyString(text);
+      return(DestroyImageList(image));
+    }
   image->page.x=0;
   image->page.y=0;
   texture=(Image *) NULL;
@@ -256,7 +281,10 @@
   (void) CloneString(&draw_info->geometry,geometry);
   status=GetTypeMetrics(image,draw_info,&metrics,exception);
   if (status == MagickFalse)
-    ThrowReaderException(TypeError,"UnableToGetTypeMetrics");
+    {
+      text=DestroyString(text);
+      ThrowReaderException(TypeError,"UnableToGetTypeMetrics");
+    }
   page.y=(ssize_t) ceil((double) page.y+metrics.ascent-0.5);
   (void) FormatLocaleString(geometry,MagickPathExtent,"%gx%g%+g%+g",(double)
     image->columns,(double) image->rows,(double) page.x,(double) page.y);
@@ -305,6 +333,7 @@
     AcquireNextImage(image_info,image,exception);
     if (GetNextImageInList(image) == (Image *) NULL)
       {
+        text=DestroyString(text);
         image=DestroyImageList(image);
         return((Image *) NULL);
       }
@@ -332,6 +361,7 @@
   if (texture != (Image *) NULL)
     texture=DestroyImage(texture);
   draw_info=DestroyDrawInfo(draw_info);
+  text=DestroyString(text);
   (void) CloseBlob(image);
   return(GetFirstImageInList(image));
 }
@@ -422,7 +452,7 @@
   (void) ResetMagickMemory(text,0,sizeof(text));
   (void) ReadBlobString(image,text);
   if (LocaleNCompare((char *) text,MagickID,strlen(MagickID)) != 0)
-    return(ReadTEXTImage(image_info,image,text,exception));
+    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   do
   {
     width=0;