MAP: Fix null pointer dereference or SEGV if input is not colormapped.
authorBob Friesenhahn <bfriesen@GraphicsMagick.org>
Sat, 22 Jul 2017 16:29:35 -0500
changeset 15093 29550606d8b9
parent 15092 30cd2b31f7e0
child 15094 db732abd9318
MAP: Fix null pointer dereference or SEGV if input is not colormapped.
ChangeLog
coders/map.c
www/Changelog.html
--- a/ChangeLog	Sat Jul 22 15:40:00 2017 -0500
+++ b/ChangeLog	Sat Jul 22 16:29:35 2017 -0500
@@ -1,5 +1,10 @@
 2017-07-22  Bob Friesenhahn  <bfriesen@simple.dallas.tx.us>
 
+	* coders/map.c (WriteMAPImage): Fix null pointer dereference or
+	segmentation violation in the MAP writer if the input image is not
+	already colormapped.  Problem was reported by LCatro via email on
+	July 18.
+
 	* coders/gray.c (WriteGRAYImage): Improve tracing and tidy up.
 
 	* coders/rgb.c (WriteRGBImage): Fix heap overwrite in raw RGB
--- a/coders/map.c	Sat Jul 22 15:40:00 2017 -0500
+++ b/coders/map.c	Sat Jul 22 16:29:35 2017 -0500
@@ -18,7 +18,7 @@
 %                            M   M  A   A  P                                  %
 %                                                                             %
 %                                                                             %
-%                 Read/Write Image Colormaps As An Image File                 %
+%                 Read/Write Image Colormaps And Image File                   %
 %                                                                             %
 %                                                                             %
 %                              Software Design                                %
@@ -349,16 +349,17 @@
   /*
     Allocate colormap.
   */
-  if (!IsPaletteImage(image,&image->exception))
-    (void) SetImageType(image,PaletteType);
+  if (SetImageType(image,PaletteType) == MagickFail)
+    ThrowMAPWriterException(ResourceLimitError,MemoryAllocationFailed,image);
   packet_size=image->depth > 8 ? 2 : 1;
-  pixels=MagickAllocateMemory(unsigned char *,image->columns*packet_size);
+  pixels=MagickAllocateArray(unsigned char *,image->columns,packet_size);
   if (pixels == (unsigned char *) NULL)
     ThrowMAPWriterException(ResourceLimitError,MemoryAllocationFailed,image);
   packet_size=image->colors > 256 ? 6 : 3;
-  colormap=MagickAllocateMemory(unsigned char *,packet_size*image->colors);
+  colormap=MagickAllocateArray(unsigned char *,packet_size,image->colors);
   if (colormap == (unsigned char *) NULL)
     ThrowMAPWriterException(ResourceLimitError,MemoryAllocationFailed,image);
+
   /*
     Write colormap to file.
   */
--- a/www/Changelog.html	Sat Jul 22 15:40:00 2017 -0500
+++ b/www/Changelog.html	Sat Jul 22 16:29:35 2017 -0500
@@ -38,6 +38,10 @@
 <p>2017-07-22  Bob Friesenhahn  &lt;<a class="reference external" href="mailto:bfriesen&#37;&#52;&#48;simple&#46;dallas&#46;tx&#46;us">bfriesen<span>&#64;</span>simple<span>&#46;</span>dallas<span>&#46;</span>tx<span>&#46;</span>us</a>&gt;</p>
 <blockquote>
 <ul class="simple">
+<li>coders/map.c (WriteMAPImage): Fix null pointer dereference or
+segmentation violation in the MAP writer if the input image is not
+already colormapped.  Problem was reported by LCatro via email on
+July 18.</li>
 <li>coders/gray.c (WriteGRAYImage): Improve tracing and tidy up.</li>
 <li>coders/rgb.c (WriteRGBImage): Fix heap overwrite in raw RGB
 writer (all output subformats) given a multiframe sequence using