diff -Nru imagemagick-6.7.7.10/debian/changelog imagemagick-6.7.7.10/debian/changelog --- imagemagick-6.7.7.10/debian/changelog 2012-06-29 23:32:09.000000000 +0200 +++ imagemagick-6.7.7.10/debian/changelog 2012-07-30 22:48:09.000000000 +0200 @@ -1,3 +1,10 @@ +imagemagick (8:6.7.7.10-3) unstable; urgency=high + + * Bug fix: "CVE-2012-3437", ImageMagick: Magick_png_malloc() size + argument thanks to Moritz Muehlenhoff (Closes: #683285). + + -- Bastien Roucariès Mon, 30 Jul 2012 22:47:47 +0200 + imagemagick (8:6.7.7.10-2) unstable; urgency=low * Really solve the upgrade problem (Closes: #679188, #679063). diff -Nru imagemagick-6.7.7.10/debian/patches/0001-Fix-CVE-2012-3437-ImageMagick-Magick_png_malloc-size.patch imagemagick-6.7.7.10/debian/patches/0001-Fix-CVE-2012-3437-ImageMagick-Magick_png_malloc-size.patch --- imagemagick-6.7.7.10/debian/patches/0001-Fix-CVE-2012-3437-ImageMagick-Magick_png_malloc-size.patch 1970-01-01 01:00:00.000000000 +0100 +++ imagemagick-6.7.7.10/debian/patches/0001-Fix-CVE-2012-3437-ImageMagick-Magick_png_malloc-size.patch 2012-07-30 23:22:32.000000000 +0200 @@ -0,0 +1,101 @@ +From 81157cd61667708831e489dd90aa64847c94735a Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Bastien=20ROUCARI=C3=88S?= +Date: Mon, 30 Jul 2012 22:40:29 +0200 +Subject: [PATCH] Fix CVE-2012-3437 ImageMagick: Magick_png_malloc() size + argument + +Tom Lane (tgl@redhat.com) found an issue in ImageMagick. Basically +CVE-2011-3026 deals with libpng memory allocation, limitations have been +added so that a bad PNG can't cause the system to allocate a lot of +memory causing a denial of service. However on further investigation of +ImageMagick Tom Lane found that PNG malloc function (Magick_png_malloc) +in turn calls AcquireMagickMemory with an improper size argument: + +static png_voidp Magick_png_malloc(png_structp png_ptr,png_uint_32 size) +{ + (void) png_ptr; + return((png_voidp) AcquireMagickMemory((size_t) size)); +} + +This is incorrect, the size argument should be declared png_alloc_size_t +according to 1.5, or png_size_t according to 1.2. + +"As this function stands, it invisibly does the wrong thing for any request +over 4GB. On big-endian architectures it very possibly will do the wrong +thing even for requests less than that. So the reason why the hard-wired 4GB +limit prevents a core dump is that it masks the ABI mismatch here." + +So basically we have memory allocations problems that can probably lead to a +denial of service. + +Origin: upstream, http://trac.imagemagick.org/changeset/8733 +Author: John Cristy +Bug-Debian: http://bugs.debian.org/683285 +Bug-Redhat: https://bugzilla.redhat.com/show_bug.cgi?id=844101 +Applied-Upstream: commit: r8733 +Last-Update: 2012-07-30 +--- + coders/png.c | 30 +++++++++++++++++++++++++----- + 1 file changed, 25 insertions(+), 5 deletions(-) + +diff --git a/coders/png.c b/coders/png.c +index f7139d8..dc0cac9 100644 +--- a/coders/png.c ++++ b/coders/png.c +@@ -1756,7 +1756,11 @@ static void MagickPNGWarningHandler(png_struct *ping,png_const_charp message) + } + + #ifdef PNG_USER_MEM_SUPPORTED +-static png_voidp Magick_png_malloc(png_structp png_ptr,png_uint_32 size) ++#if PNG_LIBPNG_VER >= 14000 ++static png_voidp Magick_png_malloc(png_structp png_ptr,png_alloc_size_t size) ++#else ++static png_voidp Magick_png_malloc(png_structp png_ptr,png_size_t size) ++#endif + { + (void) png_ptr; + return((png_voidp) AcquireMagickMemory((size_t) size)); +@@ -7309,12 +7313,22 @@ Magick_png_write_raw_profile(const ImageInfo *image_info,png_struct *ping, + (char *) profile_type, (double) length); + } + +- text=(png_textp) png_malloc(ping,(png_uint_32) sizeof(png_text)); ++#if PNG_LIBPNG_VER >= 14000 ++ text=(png_textp) png_malloc(ping,(png_alloc_size_t) sizeof(png_text)); ++#else ++ text=(png_textp) png_malloc(ping,(png_size_t) sizeof(png_text)); ++#endif + description_length=(png_uint_32) strlen((const char *) profile_description); + allocated_length=(png_uint_32) (length*2 + (length >> 5) + 20 + + description_length); +- text[0].text=(png_charp) png_malloc(ping,allocated_length); +- text[0].key=(png_charp) png_malloc(ping, (png_uint_32) 80); ++#if PNG_LIBPNG_VER >= 14000 ++ text[0].text=(png_charp) png_malloc(ping, ++ (png_alloc_size_t) allocated_length); ++ text[0].key=(png_charp) png_malloc(ping, (png_alloc_size_t) 80); ++#else ++ text[0].text=(png_charp) png_malloc(ping, (png_size_t) allocated_length); ++ text[0].key=(png_charp) png_malloc(ping, (png_size_t) 80); ++#endif + text[0].key[0]='\0'; + (void) ConcatenateMagickString(text[0].key, + "Raw profile type ",MaxTextExtent); +@@ -10667,7 +10681,13 @@ static MagickBooleanType WriteOnePNGImage(MngInfo *mng_info, + { + if (value != (const char *) NULL) + { +- text=(png_textp) png_malloc(ping,(png_uint_32) sizeof(png_text)); ++ ++#if PNG_LIBPNG_VER >= 14000 ++ text=(png_textp) png_malloc(ping, ++ (png_alloc_size_t) sizeof(png_text)); ++#else ++ text=(png_textp) png_malloc(ping,(png_size_t) sizeof(png_text)); ++#endif + text[0].key=(char *) property; + text[0].text=(char *) value; + text[0].text_length=strlen(value); +-- +1.7.10.4 + diff -Nru imagemagick-6.7.7.10/debian/patches/series imagemagick-6.7.7.10/debian/patches/series --- imagemagick-6.7.7.10/debian/patches/series 1970-01-01 01:00:00.000000000 +0100 +++ imagemagick-6.7.7.10/debian/patches/series 2012-07-30 23:22:32.000000000 +0200 @@ -0,0 +1,2 @@ +# debian/source/git-patches exported from git by quilt-patches-deb-export-hook +0001-Fix-CVE-2012-3437-ImageMagick-Magick_png_malloc-size.patch diff -Nru imagemagick-6.7.7.10/debian/source/git-patches imagemagick-6.7.7.10/debian/source/git-patches --- imagemagick-6.7.7.10/debian/source/git-patches 1970-01-01 01:00:00.000000000 +0100 +++ imagemagick-6.7.7.10/debian/source/git-patches 2012-07-30 22:48:09.000000000 +0200 @@ -0,0 +1 @@ +upstream/$UPSTREAM_VERSION..debian-patches/$DEB_VERSION