László,
Thanks for noticing this! As you surmised, these symbols were all
intended for internal use. The only one which could have been used by an
external consumer is MagickReallocStd(). However, the behavior of
MagickRealloc() (also intended for internal use) has since been modified
to behave like standard realloc() and so MagickReallocStd() was removed.
This is my analysis:
DCM_SetRescaling
Private to coders/dcm.c. DLL-exported by accident (default).
GetColorInfo
GetColorInfoArray
Declared in color_lookup-private.h. Used only by color_lookup.c
implementation. Exported by accident (default).
InsertRowHDU
Private to coders/fits.c. DLL-exported by accident (default).
MagickReallocStd
Intended for internal use, but it is theoretically usable by an
external consumer.
Added on 2023-11-05 by changeset 17283. First released in
1.3.43. Visibility removed on 2025-12-16 by changeset 17856. This
function was added for internal use. Also on 2025-12-16, in changeset
17857
MagickReallocStd() was removed and the behavior of MagickRealloc()
was changed to match standard ANSI C realloc().
WriteBlobStringEOL
WriteBlobStringWithEOL
Private to locale.c. DLL-exported by accident.
Bob
On 7/26/26 04:23, László Böszörményi (GCS) wrote:
Hi Bob,
On Sun, Jul 5, 2026 at 11:13 PM Bob Friesenhahn
<[email protected]> wrote:
I am not sure what CVE-2026-13606 is specifically about. However, there are
two recent GraphicsMagick security fixes for coders/pcd.c:
[...]
It is a shame that so much effort is needed for an extinct format that hardly
anyone uses any more.
I heard, but not investigated myself, that some entities release CVE
ids without enough information about what the correct fix is. :(
My question is, is there any possibility that the mentioned 'library
symbol remapping' multiple times has a chance to break other libraries
or binaries? It seems the following library symbols are now missing in
the 1.3.48 release: DCM_SetRescaling@Base, GetColorInfo@Base,
GetColorInfoArray@Base, InsertRowHDU@Base, MagickReallocStd@Base,
WriteBlobStringEOL@Base and WriteBlobStringWithEOL@Base.
I know that most library symbols are used by GM itself, just want to be sure.
Thanks,
Laszlo/GCS
