mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-08-08 08:30:47 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/graphicsmagick: add patch for CVE-2025-27796

Browse Source 
Fixes the following vulnerability:

- CVE-2025-27796:
    ReadWPGImage in WPG in GraphicsMagick before 1.3.46 mishandles palette
    buffer allocation, resulting in out-of-bounds access to heap memory in
    ReadBlob.

For more information, see
  - https://www.cve.org/CVERecord?id=CVE-2025-27796
  - https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/883ebf8cae6dfa5873d975fe3476b1a188ef3

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6f9f9caa45)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Thomas Perale
2026-03-03 09:13:22 +01:00
parent 44c0deba93
commit ea8df0a72a
2 changed files with 58 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

55
package/graphicsmagick/0003-Assure-that-palette-buffer-is-allocated-and-the-current-size.patch Normal file
View File

@@ -0,0 +1,55 @@
# HG changeset patch
# User Bob Friesenhahn <bfriesen@GraphicsMagick.org>
# Date 1734634653 21600
# Thu Dec 19 12:57:33 2024 -0600
# Node ID 883ebf8cae6dfa5873d975fe3476b1a188ef3f9f
# Parent cf7cd5ebabb0ca40204de7539f4fb9ae02121958
ReadWPGImage(): Assure that palette buffer is allocated and the current size.
CVE: CVE-2025-27796
Upstream: https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/883ebf8cae6dfa5873d975fe3476b1a188ef3f9f
[thomas: remove changelog and binary]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
diff --git a/coders/wpg.c b/coders/wpg.c
--- a/coders/wpg.c
+++ b/coders/wpg.c
@@ -1704,28 +1704,23 @@
ThrowReaderException(CorruptImageError,InvalidColormapIndex,image);
}
- if(pPalette!=NULL &&
- PaletteAllocBytes < 4*(WPG_Palette.StartIndex+WPG_Palette.NumOfEntries))
- {
- MagickFreeResourceLimitedMemory(pPalette);
- PaletteAllocBytes = 0;
- }
+ /* Assure that buffer is allocated and the current size */
+ if (PaletteAllocBytes != Max(4*(WPG_Palette.StartIndex+WPG_Palette.NumOfEntries),4*256))
+ {
+ PaletteAllocBytes = Max(4*(WPG_Palette.StartIndex+WPG_Palette.NumOfEntries),4*256);
+ MagickReallocateResourceLimitedMemory(unsigned char *,pPalette,PaletteAllocBytes);
+ }
if(pPalette==NULL)
- {
- PaletteItems = WPG_Palette.NumOfEntries;
- PaletteAllocBytes = 4*(WPG_Palette.StartIndex+WPG_Palette.NumOfEntries);
- if(PaletteAllocBytes < 4*256) PaletteAllocBytes = 4*256;
- pPalette = MagickAllocateResourceLimitedMemory(unsigned char *,(size_t)PaletteAllocBytes);
- if(pPalette==NULL)
- ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,image);
- for(i=0; i<=255; i++)
+ ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,image);
+
+ PaletteItems = WPG_Palette.NumOfEntries;
+ for(i=0; i<=255; i++)
{
pPalette[4*i] = WPG1_Palette[i].Red;
pPalette[4*i+1] = WPG1_Palette[i].Green;
pPalette[4*i+2] = WPG1_Palette[i].Blue;
pPalette[4*i+3] = OpaqueOpacity;
}
- }
if(ReadBlob(image,(size_t) PaletteItems*4,pPalette+((size_t)4*WPG_Palette.StartIndex)) != (size_t) PaletteItems*4)
{
MagickFreeResourceLimitedMemory(pPalette);

3
package/graphicsmagick/graphicsmagick.mk
View File

@@ -26,6 +26,9 @@ GRAPHICSMAGICK_IGNORE_CVES += CVE-2025-27795
# 0002-ReadJXLImage-pixel_format-num_channels-needs-to-be.patch
GRAPHICSMAGICK_IGNORE_CVES += CVE-2025-32460
# 0003-Assure-that-palette-buffer-is-allocated-and-the-current-size.patch
GRAPHICSMAGICK_IGNORE_CVES += CVE-2025-27796
GRAPHICSMAGICK_INSTALL_STAGING = YES
GRAPHICSMAGICK_CONFIG_SCRIPTS = GraphicsMagick-config GraphicsMagickWand-config