Page MenuHomeSolus

Update imagemagick to 7.0.6-5 to address CVE-2017-11750
ClosedPublic

Authored by kyrios123 on Jul 22 2017, 4:30 PM.
Referenced Files
F11069032: D686.diff
Fri, Aug 11, 10:27 PM
F10875136: D686.diff
Jun 20 2023, 4:13 AM
F10844174: D686.id.diff
Jun 10 2023, 8:14 PM
F10720364: D686.id1536.diff
May 5 2023, 8:31 PM
F10714731: D686.id.diff
May 3 2023, 10:42 PM
Subscribers
None

Details

Summary
  • Fixed numerous memory leaks reference.
  • Properly set image->colorspace in the PNG decoder (previously it was setting image->gamma, but only setting image->colorspace for grayscale and gray-alpha images. Reference.
  • CVE-2017-11750 Fix improper use of NULL in the JNG decoder. Reference.
  • Added "-define png:ignore-crc" option to PNG decoder. When you know your image has no CRC or ADLER32 errors, this can speed up decoding. It is also helpful in debugging bug reports from "fuzzers".
  • Off by one error for gradient coder reference and reference.
  • YUV coder no longer renders streaks reference.
  • Fixed numerous memory leaks reference.
  • coders/png.c: Initialized quantum_scanline and quantum_info to prevent a bad free reference.
  • Removed write_chunk_from_profile() from coders/png.c because it has not worked at least since version 6.7.6.
  • Removed many redundant checks before RelinquishMagickMemory(), which is safe to call with a NULL argument.
  • Added experimental PNG orNT chunk, to store image->orientation.
  • Removed vpAg chunk write support (we are now writing caNv instead).
  • Fixed numerous memory leaks reference.
  • The -monochrome option no longer returns a blank canvas reference.
  • Added caNv, eXIf, and pHYs to the list of PNG chunks to be removed by the "-strip" option.

Signed-off-by: Pierre-Yves <pyu@riseup.net>

Test Plan

Usual quick checks with convert, compare and mogrify

Diff Detail

Repository
R1464 imagemagick
Branch
master
Lint
No Lint Coverage
Unit
No Test Coverage

Event Timeline

kyrios123 retitled this revision from Update imagemagick to 7.0.6-2 to Update imagemagick to 7.0.6-3.

Update to 7.0.6-3

add bzip2 dependency as it is in the base image anymore.

kyrios123 retitled this revision from Update imagemagick to 7.0.6-3 to Update imagemagick to 7.0.6-4.
kyrios123 edited the summary of this revision. (Show Details)

bump to 7.0.6-4

kyrios123 retitled this revision from Update imagemagick to 7.0.6-4 to Update imagemagick to 7.0.6-5 to address CVE-2017-11750.
kyrios123 edited the summary of this revision. (Show Details)

update to 7.0.6-5 to address CVE-2017-11750

This revision is now accepted and ready to land.Aug 3 2017, 8:35 PM
This revision was automatically updated to reflect the committed changes.