ImageMagick-7.0.8-32差分

ImageMagick-7.0.8-31差分 - yoya's diaryの続き

http://www.imagemagick.org/script/download.php
The latest release of ImageMagick is version 7.0.8-32

6 系同時リリースは ImageMagick-6.9.10-32

まとめ

LocaleLowerCase() で範囲外(アクセス)の修正 (脆弱性)

気になる事

(特に無し)

差分

LocaleLowerCase() で範囲外(アクセス)の修正
- https://github.com/ImageMagick/ImageMagick/issues/1495
  - https://github.com/Dk0n9/MyFuzzy/blob/master/oob_LocaleLowercase_crash
  - MagickCore/locale.c

1523a1524,1525
>   if (c == EOF)
>     return(c);
1526c1528
<     return(tolower_l(c,c_locale));
---
>     return(tolower_l((int) ((unsigned char) c),c_locale));
1528c1530
<   return(tolower(c));
---
>   return(tolower((int) ((unsigned char) c)));
1661a1664,1665
>   if (c == EOF)
>     return(c);
1664c1668
<     return(toupper_l(c,c_locale));
---
>     return(toupper_l((int) ((unsigned char) c),c_locale));
1666c1670
<   return(toupper(c));
---
>   return(toupper((int) ((unsigned char) c)));

第一引数の c を 0〜255 の範囲に閉じ込めてる。

ChangeLog にない差分

(なし)

ChangeLog

2019-03-05  7.0.8-32 Cristy  <quetzlzacatenango@image...>
  * Release ImageMagick version 7.0.8-32, GIT revision ...

2019-03-05  7.0.8-32 Cristy  <quetzlzacatenango@image...>
  * Fix out-of-boundary LocaleLowerCase() @
    https://github.com/ImageMagick/ImageMagick/issues/1495