http://openwall.com/lists/oss-security/2017/08/28/5
http://hg.code.sf.net/p/graphicsmagick/code/rev/3bbf7a13643d

some changes were made to make the patch apply

# HG changeset patch
# User Bob Friesenhahn <bfriesen@GraphicsMagick.org>
# Date 1503268616 18000
# Node ID 3bbf7a13643df3be76b0e19088a6cc632eea2072
# Parent  83a5b946180835f260bcb91e3d06327a8e2577e3
PNM: For binary formats, verify sufficient backing file data before memory request.

diff -r 83a5b9461808 -r 3bbf7a13643d coders/pnm.c
--- a/coders/pnm.c	Sun Aug 20 17:31:35 2017 -0500
+++ b/coders/pnm.c	Sun Aug 20 17:36:56 2017 -0500
@@ -569,7 +569,7 @@
           (void) LogMagickEvent(CoderEvent,GetMagickModule(),"Colors: %u",
                                 image->colors);
         }
-      number_pixels=image->columns*image->rows;
+      number_pixels=MagickArraySize(image->columns,image->rows);
       if (number_pixels == 0)
         ThrowReaderException(CorruptImageError,NegativeOrZeroImageSize,image);
       if (image->storage_class == PseudoClass)
@@ -858,14 +858,14 @@
		if (1 == bits_per_sample)
		  {
		    /* PBM */
-		    bytes_per_row=((image->columns+7) >> 3);
+		    bytes_per_row=((image->columns+7U) >> 3);
		    import_options.grayscale_miniswhite=MagickTrue;
		    quantum_type=GrayQuantum;
		  }
		else
		  {
		    /* PGM & XV_332 */
-		    bytes_per_row=((bits_per_sample+7)/8)*image->columns;
+		    bytes_per_row=MagickArraySize(((bits_per_sample+7U)/8U),image->columns);
		    if (XV_332_Format == format)
		      {
			quantum_type=IndexQuantum;
@@ -878,7 +878,8 @@
	      }
	    else
	      {
-		bytes_per_row=(((bits_per_sample+7)/8)*samples_per_pixel)*image->columns;
+		bytes_per_row=MagickArraySize((((bits_per_sample+7)/8)*samples_per_pixel),
+                                              image->columns);
		if (3 == samples_per_pixel)
		  {
		    /* PPM */
@@ -915,6 +916,28 @@
		    is_monochrome=MagickFalse;
		  }
	      }
+
+            /* Validate file size before allocating memory */
+            if (BlobIsSeekable(image))
+              {
+                const magick_off_t file_size = GetBlobSize(image);
+                const magick_off_t current_offset = TellBlob(image);
+                if ((file_size > 0) &&
+                    (current_offset > 0) &&
+                    (file_size > current_offset))
+                  {
+                    const magick_off_t remaining = file_size-current_offset;
+                    const magick_off_t needed = (magick_off_t) image->rows *
+                      (magick_off_t) bytes_per_row;
+                    if ((remaining < (magick_off_t) bytes_per_row) ||
+                        (remaining < needed))
+                      {
+                        ThrowException(exception,CorruptImageError,UnexpectedEndOfFile,
+                                       image->filename);
+                        break;
+                      }
+                  }
+              }

             scanline_set=AllocateThreadViewDataArray(image,exception,bytes_per_row,1);
             if (scanline_set == (ThreadViewDataSet *) NULL)
value='35'>35</option><option value='40'>40</option></select></td></tr><tr><td class='label'>space:</td><td class='ctrl'><select name='ignorews' onchange='this.form.submit();'><option value='0' selected='selected'>include</option><option value='1'>ignore</option></select></td></tr><tr><td class='label'>mode:</td><td class='ctrl'><select name='dt' onchange='this.form.submit();'><option value='0' selected='selected'>unified</option><option value='1'>ssdiff</option><option value='2'>stat only</option></select></td></tr><tr><td/><td class='ctrl'><noscript><input type='submit' value='reload'/></noscript></td></tr></table></form></div><table summary='commit info' class='commit-info'>
<tr><th>author</th><td>Marius Bakke &lt;mbakke@fastmail.com&gt;</td><td class='right'>2017-05-25 20:00:34 +0200</td></tr>
<tr><th>committer</th><td>Marius Bakke &lt;mbakke@fastmail.com&gt;</td><td class='right'>2017-05-25 20:04:32 +0200</td></tr>
<tr><th>commit</th><td colspan='2' class='oid'><a href='/guix/commit/tests/guix-environment.sh?id=2af3743bc26f2ff81187bc3c4077eb54f762e070'>2af3743bc26f2ff81187bc3c4077eb54f762e070</a> (<a href='/guix/patch/tests/guix-environment.sh?id=2af3743bc26f2ff81187bc3c4077eb54f762e070'>patch</a>)</td></tr>
<tr><th>tree</th><td colspan='2' class='oid'><a href='/guix/tree/?id=2af3743bc26f2ff81187bc3c4077eb54f762e070'>fff1415a9258f2f985d5ee98b8ccacac1d5da7d2</a> /<a href='/guix/tree/tests/guix-environment.sh?id=2af3743bc26f2ff81187bc3c4077eb54f762e070'>tests/guix-environment.sh</a></td></tr>
<tr><th>parent</th><td colspan='2' class='oid'><a href='/guix/commit/tests/guix-environment.sh?id=acc417ca36dc2c1c48ebd7d5b10725dbc26e6081'>acc417ca36dc2c1c48ebd7d5b10725dbc26e6081</a> (<a href='/guix/diff/tests/guix-environment.sh?id=2af3743bc26f2ff81187bc3c4077eb54f762e070&amp;id2=acc417ca36dc2c1c48ebd7d5b10725dbc26e6081'>diff</a>)</td></tr><tr><th>download</th><td colspan='2' class='oid'><a href='/guix/snapshot/guix-2af3743bc26f2ff81187bc3c4077eb54f762e070.tar.gz'>guix-2af3743bc26f2ff81187bc3c4077eb54f762e070.tar.gz</a><br/><a href='/guix/snapshot/guix-2af3743bc26f2ff81187bc3c4077eb54f762e070.zip'>guix-2af3743bc26f2ff81187bc3c4077eb54f762e070.zip</a><br/></td></tr></table>
<div class='commit-subject'>gnu: strace: Update to 4.17.</div><div class='commit-msg'>* gnu/packages/linux.scm (strace): Update to 4.17.
</div><div class='diffstat-header'><a href='/guix/diff/?id=2af3743bc26f2ff81187bc3c4077eb54f762e070'>Diffstat</a> (limited to 'tests/guix-environment.sh')</div><table summary='diffstat' class='diffstat'>