MAP: Fix null pointer dereference or SEGV if input is not colormapped.
--- a/ChangeLog Sat Jul 22 15:40:00 2017 -0500
+++ b/ChangeLog Sat Jul 22 16:29:35 2017 -0500
@@ -1,5 +1,10 @@
2017-07-22 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
+ * coders/map.c (WriteMAPImage): Fix null pointer dereference or
+ segmentation violation in the MAP writer if the input image is not
+ already colormapped. Problem was reported by LCatro via email on
+ July 18.
+
* coders/gray.c (WriteGRAYImage): Improve tracing and tidy up.
* coders/rgb.c (WriteRGBImage): Fix heap overwrite in raw RGB
--- a/coders/map.c Sat Jul 22 15:40:00 2017 -0500
+++ b/coders/map.c Sat Jul 22 16:29:35 2017 -0500
@@ -18,7 +18,7 @@
% M M A A P %
% %
% %
-% Read/Write Image Colormaps As An Image File %
+% Read/Write Image Colormaps And Image File %
% %
% %
% Software Design %
@@ -349,16 +349,17 @@
/*
Allocate colormap.
*/
- if (!IsPaletteImage(image,&image->exception))
- (void) SetImageType(image,PaletteType);
+ if (SetImageType(image,PaletteType) == MagickFail)
+ ThrowMAPWriterException(ResourceLimitError,MemoryAllocationFailed,image);
packet_size=image->depth > 8 ? 2 : 1;
- pixels=MagickAllocateMemory(unsigned char *,image->columns*packet_size);
+ pixels=MagickAllocateArray(unsigned char *,image->columns,packet_size);
if (pixels == (unsigned char *) NULL)
ThrowMAPWriterException(ResourceLimitError,MemoryAllocationFailed,image);
packet_size=image->colors > 256 ? 6 : 3;
- colormap=MagickAllocateMemory(unsigned char *,packet_size*image->colors);
+ colormap=MagickAllocateArray(unsigned char *,packet_size,image->colors);
if (colormap == (unsigned char *) NULL)
ThrowMAPWriterException(ResourceLimitError,MemoryAllocationFailed,image);
+
/*
Write colormap to file.
*/
--- a/www/Changelog.html Sat Jul 22 15:40:00 2017 -0500
+++ b/www/Changelog.html Sat Jul 22 16:29:35 2017 -0500
@@ -38,6 +38,10 @@
<p>2017-07-22 Bob Friesenhahn <<a class="reference external" href="mailto:bfriesen%40simple.dallas.tx.us">bfriesen<span>@</span>simple<span>.</span>dallas<span>.</span>tx<span>.</span>us</a>></p>
<blockquote>
<ul class="simple">
+<li>coders/map.c (WriteMAPImage): Fix null pointer dereference or
+segmentation violation in the MAP writer if the input image is not
+already colormapped. Problem was reported by LCatro via email on
+July 18.</li>
<li>coders/gray.c (WriteGRAYImage): Improve tracing and tidy up.</li>
<li>coders/rgb.c (WriteRGBImage): Fix heap overwrite in raw RGB
writer (all output subformats) given a multiframe sequence using