Imported Upstream version 1.3.31upstream/1.3.31

Change-Id: I2c7294cf2abd64840c9513bbaed3c148dc673e1c

1 files changed, 71 insertions, 18 deletions

diff --git a/coders/mpc.c b/coders/mpc.c
index a846198..e80c398 100644
--- a/coders/mpc.c
+++ b/coders/mpc.c
@@ -1,5 +1,5 @@
 /*
-% Copyright (C) 2003-2015 GraphicsMagick Group
+% Copyright (C) 2003-2018 GraphicsMagick Group
 % Copyright (C) 2002 ImageMagick Studio
 %
 % This program is covered by multiple licenses, which are described in
@@ -128,6 +128,8 @@ static MagickBool IsMPC(const unsigned char *magick,const size_t length)
 
 #define ThrowMPCReaderException(code_,reason_,image_) \
 do { \
+  MagickFreeMemory(comment); \
+  MagickFreeMemory(values); \
   if (number_of_profiles > 0) \
     { \
       unsigned int _index; \
@@ -164,6 +166,8 @@ static Image *ReadMPCImage(const ImageInfo *image_info,ExceptionInfo *exception)
     *p;
 
   unsigned int
+    comment_count,
+    keyword_count,
     status;
 
   unsigned long
@@ -175,6 +179,10 @@ static Image *ReadMPCImage(const ImageInfo *image_info,ExceptionInfo *exception)
   unsigned int
     number_of_profiles=0;
 
+  char
+    *comment = NULL,
+    *values = NULL;
+
   /*
     Open image file.
   */
@@ -215,6 +223,8 @@ static Image *ReadMPCImage(const ImageInfo *image_info,ExceptionInfo *exception)
     image->depth=8;
     image->compression=NoCompression;
     image->storage_class=DirectClass;
+    comment_count=0;
+    keyword_count=0;
     while (isgraph(c) && (c != ':'))
     {
       register char
@@ -222,13 +232,30 @@ static Image *ReadMPCImage(const ImageInfo *image_info,ExceptionInfo *exception)
 
       if (c == '{')
         {
-          char
-            *comment;
-
           size_t
             comment_length;
 
           /*
+            Insist that format is identified prior to any comments.
+          */
+          if (id[0] == '\0')
+            {
+              (void) LogMagickEvent(CoderEvent,GetMagickModule(),
+                                    "Comment precedes format identifier (id=MagickCache)");
+              ThrowMPCReaderException(CorruptImageError,ImproperImageHeader,image);
+            }
+
+          /*
+            Insist that only one comment is provided
+          */
+          if (comment_count > 0)
+            {
+              (void) LogMagickEvent(CoderEvent,GetMagickModule(),
+                                    "Too many comments!");
+              ThrowMPCReaderException(CorruptImageError,ImproperImageHeader,image);
+            }
+
+          /*
             Read comment-- any text between { }.
           */
           comment_length=MaxTextExtent;
@@ -258,15 +285,13 @@ static Image *ReadMPCImage(const ImageInfo *image_info,ExceptionInfo *exception)
               image);
           *p='\0';
           (void) SetImageAttribute(image,"comment",comment);
+          comment_count++;
           MagickFreeMemory(comment);
           c=ReadBlobByte(image);
         }
       else
         if (isalnum(c))
           {
-            char
-              *values;
-
             size_t
               values_length;
 
@@ -289,6 +314,17 @@ static Image *ReadMPCImage(const ImageInfo *image_info,ExceptionInfo *exception)
               ThrowMPCReaderException(CorruptImageWarning,ImproperImageHeader,image);
 
             /*
+              Insist that the first keyword must be 'id' (id=MagickCache)
+            */
+            if ((keyword_count == 0) && (LocaleCompare(keyword,"id") != 0))
+              {
+                (void) LogMagickEvent(CoderEvent,GetMagickModule(),
+                                      "First keyword must be 'id' (have '%s')",
+                                      keyword);
+                ThrowMPCReaderException(CorruptImageError,ImproperImageHeader,image);
+              }
+
+            /*
               Get values.
 
               Values not containing spaces are terminated by the first
@@ -327,8 +363,18 @@ static Image *ReadMPCImage(const ImageInfo *image_info,ExceptionInfo *exception)
                     break;
               }
             *p='\0';
+            keyword_count++;
             (void) LogMagickEvent(CoderEvent,GetMagickModule(),
-                                  "keyword=\"%s\" values=\"%s\"",keyword,values);
+                                  "keyword[%u]=\"%s\" values=\"%s\"",keyword_count,keyword,values);
+            /*
+              Insist that the first keyword value must be 'MagickCache' (id=MagickCache)
+            */
+            if ((keyword_count == 1) && (LocaleCompare(values,"MagickCache") != 0))
+              {
+                (void) LogMagickEvent(CoderEvent,GetMagickModule(),
+                                      "First keyword/value must be 'id=MagickCache'");
+                ThrowMPCReaderException(CorruptImageError,ImproperImageHeader,image);
+              }
             /*
               Assign a value to the specified keyword.
             */
@@ -476,8 +522,8 @@ static Image *ReadMPCImage(const ImageInfo *image_info,ExceptionInfo *exception)
                   }
                 if (LocaleCompare(keyword,"grayscale") == 0)
                   {
-		    if (LocaleCompare(values,"True") == 0)
-		      image->is_grayscale=MagickTrue;
+                    if (LocaleCompare(values,"True") == 0)
+                      image->is_grayscale=MagickTrue;
                     break;
                   }
                 if (LocaleCompare(keyword,"green-primary") == 0)
@@ -535,8 +581,8 @@ static Image *ReadMPCImage(const ImageInfo *image_info,ExceptionInfo *exception)
                   }
                 if (LocaleCompare(keyword,"monochrome") == 0)
                   {
-		    if (LocaleCompare(values,"True") == 0)
-		      image->is_monochrome=MagickTrue;
+                    if (LocaleCompare(values,"True") == 0)
+                      image->is_monochrome=MagickTrue;
                     break;
                   }
                 if (LocaleCompare(keyword,"montage") == 0)
@@ -715,7 +761,7 @@ static Image *ReadMPCImage(const ImageInfo *image_info,ExceptionInfo *exception)
 
     (void) LogMagickEvent(CoderEvent,GetMagickModule(),
                           "id=\"%s\" class=%s compression=%s matte=%s "
-			  "columns=%lu rows=%lu depth=%u",
+                          "columns=%lu rows=%lu depth=%u",
                           id,ClassTypeToString(image->storage_class),
                           CompressionTypeToString(image->compression),
                           MagickBoolToString(image->matte),
@@ -759,6 +805,8 @@ static Image *ReadMPCImage(const ImageInfo *image_info,ExceptionInfo *exception)
               p=image->directory+strlen(image->directory);
             }
           c=ReadBlobByte(image);
+          if (c == EOF)
+            break;
           *p++=c;
         } while (c != '\0');
       }
@@ -930,6 +978,7 @@ ModuleExport void RegisterMPCImage(void)
   entry->encoder=(EncoderHandler) WriteMPCImage;
   entry->magick=(MagickHandler) IsMPC;
   entry->description="Magick Persistent Cache image format";
+  entry->seekable_stream=MagickTrue;
   entry->module="MPC";
   entry->coder_class=UnstableCoderClass;
   (void) RegisterMagickInfo(entry);
@@ -1012,16 +1061,19 @@ static MagickPassFail WriteMPCImage(const ImageInfo *image_info,Image *image)
 
   ImageProfileIterator
     profile_iterator;
-  
+
   const char
     *profile_name;
-  
+
   const unsigned char
     *profile_info;
-  
+
   size_t
     profile_length;
 
+  size_t
+    image_list_length;
+
   /*
     Open persistent cache.
   */
@@ -1029,6 +1081,7 @@ static MagickPassFail WriteMPCImage(const ImageInfo *image_info,Image *image)
   assert(image_info->signature == MagickSignature);
   assert(image != (Image *) NULL);
   assert(image->signature == MagickSignature);
+  image_list_length=GetImageListLength(image);
   status=OpenBlob(image_info,image,WriteBinaryBlobMode,&image->exception);
   if (status == MagickFail)
     ThrowWriterException(FileOpenError,UnableToOpenFile,image);
@@ -1229,7 +1282,7 @@ static MagickPassFail WriteMPCImage(const ImageInfo *image_info,Image *image)
       }
     /*
       Attached profiles.
-    */    
+    */
     profile_iterator=AllocateImageProfileIterator(image);
     if (profile_iterator)
       {
@@ -1352,7 +1405,7 @@ static MagickPassFail WriteMPCImage(const ImageInfo *image_info,Image *image)
     if (image->next == (Image *) NULL)
       break;
     image=SyncNextImageInList(image);
-    status=MagickMonitorFormatted(scene++,GetImageListLength(image),
+    status=MagickMonitorFormatted(scene++,image_list_length,
                                   &image->exception,SaveImagesText,
                                   image->filename);
     if (status == False)