undefined behaviors in convert

[xiedingbao]

I have found several undefined behaviors in convert.
Following is the command to reproduce them.
First you should build ImageMagick with ubsan (require gcc-4.9 or clang-3.3)
and the version I'm testing is ImageMagick-6.9.1-4.

Code: Select all

convert test_file a.ppm

Link for test files are
http://xiedingbao.github.io/tmp/1 Error information: coders/bmp.c:737:35: runtime error: division by zero
http://xiedingbao.github.io/tmp/2 Error information:coders/bmp.c:751:36: runtime error: division by zero
http://xiedingbao.github.io/tmp/3Error information: coders/bmp.c:1038:37: runtime error: shift exponent 32 is too large for 32-bit type 'unsigned int'

http://xiedingbao.github.io/tmp/4Error information: coders/bmp.c:744:37: runtime error: division by zero

[magick]

Thanks for alerting us to the problem. We'll have a fix in ImageMagick 6.9.1-5 within a few days.

[broucaries]

Could you point me the patches ? I need it in order to backport

[magick]

See

• https://github.com/ImageMagick/ImageMag ... ders/bmp.c
  https://github.com/ImageMagick/ImageMag ... /xwindow.c