Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2017-12877: Use After Free (CWE-416)
value: Use-after-free vulnerability in the DestroyImage function in image.c in ImageMagick before 7.0.6-6 allows remote attackers to cause a denial of service via a crafted file.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 6.5
Published: 2017-08-28T19:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/mat.c
Commit date: 2017-08-09 08:01:38 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/662

Diff: diff --git a/coders/mat.c b/coders/mat.c
index e3b80f14b9c..fc8da2b144d 100644
--- a/coders/mat.c
+++ b/coders/mat.c
@@ -1328,12 +1328,10 @@ done_reading:
 
   RelinquishMagickMemory(BImgBuff);
   if (quantum_info != (QuantumInfo *) NULL)
     quantum_info=DestroyQuantumInfo(quantum_info);
 END_OF_READING:
-  if (clone_info)
-    clone_info=DestroyImageInfo(clone_info);
   CloseBlob(image);
 
 
   {
     Image *p;
@@ -1347,10 +1345,12 @@ END_OF_READING:
     while (p != (Image *) NULL)
       {
         Image *tmp=p;
         if ((p->rows == 0) || (p->columns == 0)) {
           p=p->previous;
+          if (tmp == image2)
+            image2=(Image *) NULL;
           DeleteImageFromList(&tmp);
         } else {
           image=p;
           p=p->previous;
         }

Vulnerable code:   if (clone_info)
    clone_info=DestroyImageInfo(clone_info);
Fixed code:           if (tmp == image2)
            image2=(Image *) NULL;
CVE-2017-13139: Out-of-bounds Read (CWE-125)
value: In ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1, the ReadOneMNGImage function in coders/png.c has an out-of-bounds read with the MNG CLIP chunk.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-08-23T06:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/png.c
Commit date: 2017-07-09 22:42:32 -0400
Commit message: Skip MNG CLIP chunk with out-of-range object IDs

Diff: diff --git a/coders/png.c b/coders/png.c
index d6d33ee3603..ea6dce6ab5f 100644
--- a/coders/png.c
+++ b/coders/png.c
@@ -5897,10 +5897,13 @@ static Image *ReadOneMNGImage(MngInfo* mng_info, const ImageInfo *image_info,
                 last_object=(p[2] << 8) | p[3];
                 p+=4;
 
                 for (i=(int) first_object; i <= (int) last_object; i++)
                 {
+                  if ((i < 0) || (i >= MNG_MAX_OBJECTS))
+                    continue;
+
                   if (mng_info->exists[i] && !mng_info->frozen[i])
                     {
                       MngBox
                         box;
 

Fixed code:                   if ((i < 0) || (i >= MNG_MAX_OBJECTS))
                    continue;
CVE-2017-13143: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: In ImageMagick before 6.9.7-6 and 7.x before 7.0.4-6, the ReadMATImage function in coders/mat.c uses uninitialized data, which might allow remote attackers to obtain sensitive information from process memory.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 7.5
Published: 2017-08-23T06:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/mat.c
Commit date: 2017-01-26 11:22:42 -0500
Commit message: https://github.com/ImageMagick/ImageMagick/issues/362

Diff: diff --git a/coders/mat.c b/coders/mat.c
index e1623a82e8b..cf2190bf373 100644
--- a/coders/mat.c
+++ b/coders/mat.c
@@ -1121,10 +1121,11 @@ RestoreMSCWarning
 
   /* ----- Load raster data ----- */
     BImgBuff = (unsigned char *) AcquireQuantumMemory((size_t) (ldblk),sizeof(double));    /* Ldblk was set in the check phase */
     if (BImgBuff == NULL)
       ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+    (void) ResetMagickMemory(BImgBuff,0,ldblk*sizeof(double));
 
     MinVal = 0;
     MaxVal = 0;
     if (CellType==miDOUBLE || CellType==miSINGLE)        /* Find Min and Max Values for floats */
     {

Fixed code:     (void) ResetMagickMemory(BImgBuff,0,ldblk*sizeof(double));
CVE-2017-13145: Improper Input Validation (CWE-20)
value: In ImageMagick before 6.9.8-8 and 7.x before 7.0.5-9, the ReadJP2Image function in coders/jp2.c does not properly validate the channel geometry, leading to a crash.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 6.5
Published: 2017-08-23T06:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/jp2.c
Commit date: 2017-05-28 06:42:25 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/501

Diff: diff --git a/coders/jp2.c b/coders/jp2.c
index 94b775e1ca6..b9fe4ab0014 100644
--- a/coders/jp2.c
+++ b/coders/jp2.c
@@ -389,11 +389,11 @@ static Image *ReadJP2Image(const ImageInfo *image_info,ExceptionInfo *exception)
     if ((jp2_image->comps[0].dx == 0) || (jp2_image->comps[0].dy == 0) ||
         (jp2_image->comps[0].dx != jp2_image->comps[i].dx) ||
         (jp2_image->comps[0].dy != jp2_image->comps[i].dy) ||
         (jp2_image->comps[0].prec != jp2_image->comps[i].prec) ||
         (jp2_image->comps[0].sgnd != jp2_image->comps[i].sgnd) ||
-        (jp2_image->comps[i].data == NULL))
+        ((image->ping == MagickFalse) && (jp2_image->comps[i].data == NULL)))
       {
         opj_destroy_codec(jp2_codec);
         opj_image_destroy(jp2_image);
         ThrowReaderException(CoderError,"IrregularChannelGeometryNotSupported")
       }

Vulnerable code:         (jp2_image->comps[i].data == NULL))
Fixed code:         ((image->ping == MagickFalse) && (jp2_image->comps[i].data == NULL)))
CVE-2017-13146: Missing Release of Resource after Effective Lifetime (CWE-772)
value: In ImageMagick before 6.9.8-5 and 7.x before 7.0.5-6, there is a memory leak in the ReadMATImage function in coders/mat.c.
CWE description: The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
CVSS v3 base score: 8.8
Published: 2017-08-23T06:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/mat.c
Commit date: 2017-04-27 07:45:42 -0400
Commit message: ...

Diff: diff --git a/coders/mat.c b/coders/mat.c
index 1ff235448de..48cde36e27d 100644
--- a/coders/mat.c
+++ b/coders/mat.c
@@ -625,10 +625,11 @@ static Image *ReadMATImageV4(const ImageInfo *image_info,Image *image,
 
   unsigned int
     depth;
 
 
+  quantum_info=(QuantumInfo *) NULL;
   (void) SeekBlob(image,0,SEEK_SET);
   while (EOFBlob(image) != MagickFalse)
   {
     /*
      Object parser loop.
@@ -770,11 +771,12 @@ static Image *ReadMATImageV4(const ImageInfo *image_info,Image *image,
         if (HDR.Type[1] == 0)
           InsertComplexDoubleRow(image,(double *) pixels,y,0,0,exception);
         else
           InsertComplexFloatRow(image,(float *) pixels,y,0,0,exception);
       }
-    quantum_info=DestroyQuantumInfo(quantum_info);
+    if (quantum_info != (QuantumInfo *) NULL)
+      quantum_info=DestroyQuantumInfo(quantum_info);
     rotate_image=RotateImage(image,90.0,exception);
     if (rotate_image != (Image *) NULL)
       {
         image=DestroyImage(image);
         image=rotate_image;
@@ -888,10 +890,11 @@ static Image *ReadMATImage(const ImageInfo *image_info,ExceptionInfo *exception)
       return((Image *) NULL);
     }
   /*
      Read MATLAB image.
    */
+  quantum_info=(QuantumInfo *) NULL;
   clone_info=CloneImageInfo(image_info);
   if (ReadBlob(image,124,(unsigned char *) &MATLAB_HDR.identific) != 124)
     ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   if (strncmp(MATLAB_HDR.identific,"MATLAB",6) != 0)
     {
@@ -1288,11 +1291,12 @@ done_reading:
         }
         }
   }
 
   RelinquishMagickMemory(BImgBuff);
-  quantum_info=DestroyQuantumInfo(quantum_info);
+  if (quantum_info != (QuantumInfo *) NULL)
+    quantum_info=DestroyQuantumInfo(quantum_info);
 END_OF_READING:
   clone_info=DestroyImageInfo(clone_info);
   CloseBlob(image);
 
 

Vulnerable code:     quantum_info=DestroyQuantumInfo(quantum_info);
  quantum_info=DestroyQuantumInfo(quantum_info);
Fixed code:   quantum_info=(QuantumInfo *) NULL;
    if (quantum_info != (QuantumInfo *) NULL)
      quantum_info=DestroyQuantumInfo(quantum_info);
  quantum_info=(QuantumInfo *) NULL;
  if (quantum_info != (QuantumInfo *) NULL)
    quantum_info=DestroyQuantumInfo(quantum_info);
CVE-2017-14173: Integer Overflow or Wraparound (CWE-190)
value: In the function ReadTXTImage() in coders/txt.c in ImageMagick 7.0.6-10, an integer overflow might occur for the addition operation "GetQuantumRange(depth)+1" when "depth" is large, producing a smaller value than expected. As a result, an infinite loop would occur for a crafted TXT file that claims a very large "max_value" value.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 6.5
Published: 2017-09-07T06:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/txt.c
Commit date: 2017-09-01 09:22:37 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/713

Diff: diff --git a/coders/txt.c b/coders/txt.c
index 16e7ac2e94c..051f6bef2b2 100644
--- a/coders/txt.c
+++ b/coders/txt.c
@@ -444,11 +444,13 @@ static Image *ReadTXTImage(const ImageInfo *image_info,ExceptionInfo *exception)
       colorspace);
     if ((count != 4) || (width == 0) || (height == 0) || (max_value == 0))
       ThrowReaderException(CorruptImageError,"ImproperImageHeader");
     image->columns=width;
     image->rows=height;
-    for (depth=1; (GetQuantumRange(depth)+1) < max_value; depth++) ;
+    for (depth=1; (GetQuantumRange(depth)+1) < max_value; depth++)
+      if (depth >= 64)
+        break;
     image->depth=depth;
     status=SetImageExtent(image,image->columns,image->rows,exception);
     if (status == MagickFalse)
       return(DestroyImageList(image));
     LocaleLower(colorspace);

Vulnerable code:     for (depth=1; (GetQuantumRange(depth)+1) < max_value; depth++) ;
Fixed code:     for (depth=1; (GetQuantumRange(depth)+1) < max_value; depth++)
      if (depth >= 64)
        break;
CVE-2017-14173: Loop with Unreachable Exit Condition ('Infinite Loop') (CWE-835)
value: In the function ReadTXTImage() in coders/txt.c in ImageMagick 7.0.6-10, an integer overflow might occur for the addition operation "GetQuantumRange(depth)+1" when "depth" is large, producing a smaller value than expected. As a result, an infinite loop would occur for a crafted TXT file that claims a very large "max_value" value.
CWE description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CVSS v3 base score: 6.5
Published: 2017-09-07T06:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/txt.c
Commit date: 2017-09-01 09:22:37 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/713

Diff: diff --git a/coders/txt.c b/coders/txt.c
index 16e7ac2e94c..051f6bef2b2 100644
--- a/coders/txt.c
+++ b/coders/txt.c
@@ -444,11 +444,13 @@ static Image *ReadTXTImage(const ImageInfo *image_info,ExceptionInfo *exception)
       colorspace);
     if ((count != 4) || (width == 0) || (height == 0) || (max_value == 0))
       ThrowReaderException(CorruptImageError,"ImproperImageHeader");
     image->columns=width;
     image->rows=height;
-    for (depth=1; (GetQuantumRange(depth)+1) < max_value; depth++) ;
+    for (depth=1; (GetQuantumRange(depth)+1) < max_value; depth++)
+      if (depth >= 64)
+        break;
     image->depth=depth;
     status=SetImageExtent(image,image->columns,image->rows,exception);
     if (status == MagickFalse)
       return(DestroyImageList(image));
     LocaleLower(colorspace);

Vulnerable code:     for (depth=1; (GetQuantumRange(depth)+1) < max_value; depth++) ;
Fixed code:     for (depth=1; (GetQuantumRange(depth)+1) < max_value; depth++)
      if (depth >= 64)
        break;
CVE-2017-14341: Uncontrolled Resource Consumption (CWE-400)
value: ImageMagick 7.0.6-6 has a large loop vulnerability in ReadWPGImage in coders/wpg.c, causing CPU exhaustion via a crafted wpg image file.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 6.5
Published: 2017-09-12T17:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/wpg.c
Commit date: 2017-08-07 14:59:43 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/654

Diff: diff --git a/coders/wpg.c b/coders/wpg.c
index ae43f9cc364..4756dba3f4c 100644
--- a/coders/wpg.c
+++ b/coders/wpg.c
@@ -1033,10 +1033,12 @@ static Image *ReadWPGImage(const ImageInfo *image_info,
 
           Rec.RecType=(i=ReadBlobByte(image));
           if(i==EOF)
             break;
           Rd_WP_DWORD(image,&Rec.RecordLength);
+          if (Rec.RecordLength > GetBlobSize(image))
+            ThrowReaderException(CorruptImageError,"ImproperImageHeader");
           if(EOFBlob(image))
             break;
 
           Header.DataOffset=TellBlob(image)+Rec.RecordLength;
 

Fixed code:           if (Rec.RecordLength > GetBlobSize(image))
            ThrowReaderException(CorruptImageError,"ImproperImageHeader");
CVE-2017-15032: Missing Release of Resource after Effective Lifetime (CWE-772)
value: ImageMagick version 7.0.7-2 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c.
CWE description: The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
CVSS v3 base score: 9.8
Published: 2017-10-05T07:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/ycbcr.c
Commit date: 2017-09-13 16:36:53 +0200
Commit message: fix memory leak in ReadYCBCRImage as SetImageExtent failure

Diff: diff --git a/coders/ycbcr.c b/coders/ycbcr.c
index a2623e84298..7e7d4b45741 100644
--- a/coders/ycbcr.c
+++ b/coders/ycbcr.c
@@ -210,10 +210,11 @@ static Image *ReadYCBCRImage(const ImageInfo *image_info,
         break;
     status=SetImageExtent(image,image->columns,image->rows,exception);
     if (status == MagickFalse)
     {
       quantum_info=DestroyQuantumInfo(quantum_info);
+      canvas_image=DestroyImage(canvas_image);
       return(DestroyImageList(image));
     }
     SetImageColorspace(image,YCbCrColorspace,exception);
     switch (image_info->interlace)
     {

Fixed code:       canvas_image=DestroyImage(canvas_image);
CVE-2017-15277: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when processing a GIF file that has neither a global nor local palette. If the affected product is used as a library loaded into a process that operates on interesting data, this data sometimes can be leaked via the uninitialized palette.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 6.5
Published: 2017-10-12T08:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/gif.c
Commit date: 2017-07-21 07:54:50 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/592

Diff: diff --git a/coders/gif.c b/coders/gif.c
index 7a353ffd0aa..bbfd5b2067a 100644
--- a/coders/gif.c
+++ b/coders/gif.c
@@ -1016,10 +1016,12 @@ static Image *ReadGIFImage(const ImageInfo *image_info,ExceptionInfo *exception)
   global_colors=one << (((size_t) flag & 0x07)+1);
   global_colormap=(unsigned char *) AcquireQuantumMemory((size_t)
     MagickMax(global_colors,256),3UL*sizeof(*global_colormap));
   if (global_colormap == (unsigned char *) NULL)
     ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+  (void) ResetMagickMemory(global_colormap,0,3*MagickMax(global_colors,256)*
+    sizeof(*global_colormap));
   if (BitSet((int) flag,0x80) != 0)
     {
       count=ReadBlob(image,(size_t) (3*global_colors),global_colormap);
       if (count != (ssize_t) (3*global_colors))
         {

Fixed code:   (void) ResetMagickMemory(global_colormap,0,3*MagickMax(global_colors,256)*
    sizeof(*global_colormap));
CVE-2017-16546: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: The ReadWPGImage function in coders/wpg.c in ImageMagick 7.0.7-9 does not properly validate the colormap index in a WPG palette, which allows remote attackers to cause a denial of service (use of uninitialized data or invalid memory allocation) or possibly have unspecified other impact via a malformed WPG file.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 8.8
Published: 2017-11-05T22:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/wpg.c
Commit date: 2017-11-04 10:55:48 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/85

Diff: diff --git a/coders/wpg.c b/coders/wpg.c
index 6fbfe42664b..33c8b25a911 100644
--- a/coders/wpg.c
+++ b/coders/wpg.c
@@ -1048,11 +1048,13 @@ static Image *ReadWPGImage(const ImageInfo *image_info,
 
             case 0x0E:  /*Color palette */
               WPG_Palette.StartIndex=ReadBlobLSBShort(image);
               WPG_Palette.NumOfEntries=ReadBlobLSBShort(image);
               if ((WPG_Palette.NumOfEntries-WPG_Palette.StartIndex) >
-                  (Rec2.RecordLength-2-2) / 3)
+                  (Rec2.RecordLength-2-2)/3)
+                ThrowReaderException(CorruptImageError,"InvalidColormapIndex");
+              if (WPG_Palette.StartIndex > WPG_Palette.NumOfEntries)
                 ThrowReaderException(CorruptImageError,"InvalidColormapIndex");
               image->colors=WPG_Palette.NumOfEntries;
               if (!AcquireImageColormap(image,image->colors,exception))
                 goto NoMemory;
               for (i=WPG_Palette.StartIndex;

Vulnerable code:                   (Rec2.RecordLength-2-2) / 3)
Fixed code:                   (Rec2.RecordLength-2-2)/3)
                ThrowReaderException(CorruptImageError,"InvalidColormapIndex");
              if (WPG_Palette.StartIndex > WPG_Palette.NumOfEntries)
CVE-2017-17499: Use After Free (CWE-416)
value: ImageMagick before 6.9.9-24 and 7.x before 7.0.7-12 has a use-after-free in Magick::Image::read in Magick++/lib/Image.cpp.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 9.8
Published: 2017-12-11T02:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C++
Files changed: Magick++/lib/Image.cpp
Commit date: 2017-11-18 10:23:27 +0100
Commit message: Added missing return to avoid use after free.

Diff: diff --git a/Magick++/lib/Image.cpp b/Magick++/lib/Image.cpp
index f4fc34a6894..15d98f2d95a 100644
--- a/Magick++/lib/Image.cpp
+++ b/Magick++/lib/Image.cpp
@@ -5085,10 +5085,11 @@ void Magick::Image::read(MagickCore::Image *image,
     {
       (void) MagickCore::DestroyExceptionInfo(exceptionInfo);
       if (!quiet())
         throwExceptionExplicit(MagickCore::ImageWarning,
           "No image was loaded.");
+      return;
     }
   ThrowImageException;
 }
 
 void Magick::Image::floodFill(const ssize_t x_,const ssize_t y_,

Fixed code:       return;
CVE-2017-5506: Double Free (CWE-415)
value: Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file.
CWE description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
CVSS v3 base score: 7.8
Published: 2017-03-24T15:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: MagickCore/profile.c
Commit date: 2017-01-12 12:51:57 -0500
Commit message: https://github.com/ImageMagick/ImageMagick/issues/354

Diff: diff --git a/MagickCore/profile.c b/MagickCore/profile.c
index 91cbf4fbe93..66e742fc9b7 100644
--- a/MagickCore/profile.c
+++ b/MagickCore/profile.c
@@ -2041,11 +2041,11 @@ MagickBooleanType SyncExifProfile(Image *image,StringInfo *profile)
         {
           /*
             The directory entry contains an offset.
           */
           offset=(ssize_t)  ReadProfileLong(endian,q+8);
-          if ((size_t) (offset+number_bytes) > length)
+          if ((offset < 0) || ((size_t) (offset+number_bytes) > length))
             continue;
           if (~length < number_bytes)
             continue;  /* prevent overflow */
           p=(unsigned char *) (exif+offset);
         }

Vulnerable code:           if ((size_t) (offset+number_bytes) > length)
Fixed code:           if ((offset < 0) || ((size_t) (offset+number_bytes) > length))
CVE-2017-5510: Out-of-bounds Write (CWE-787)
value: coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted PSD file, which triggers an out-of-bounds write.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2017-03-24T15:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/psd.c
Commit date: 2017-01-08 08:37:32 -0500
Commit message: https://github.com/ImageMagick/ImageMagick/issues/348

Diff: diff --git a/coders/psd.c b/coders/psd.c
index 75ebd1d4835..eb6972dec00 100644
--- a/coders/psd.c
+++ b/coders/psd.c
@@ -2509,11 +2509,11 @@ static size_t WritePSDChannel(const PSDInfo *psd_info,
     }
   if (next_image->depth > 8)
     next_image->depth=16;
   monochrome=IsImageMonochrome(image) && (image->depth == 1) ?
     MagickTrue : MagickFalse;
-  quantum_info=AcquireQuantumInfo(image_info,image);
+  quantum_info=AcquireQuantumInfo(image_info,next_image);
   if (quantum_info == (QuantumInfo *) NULL)
     return(0);
   pixels=(unsigned char *) GetQuantumPixels(quantum_info);
 #ifdef MAGICKCORE_ZLIB_DELEGATE
   if (next_image->compression == ZipCompression)

Vulnerable code:   quantum_info=AcquireQuantumInfo(image_info,image);
Fixed code:   quantum_info=AcquireQuantumInfo(image_info,next_image);
CVE-2017-5511: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: coders/psd.c in ImageMagick allows remote attackers to have unspecified impact by leveraging an improper cast, which triggers a heap-based buffer overflow.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 9.8
Published: 2017-03-24T15:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/psd.c
Commit date: 2017-01-07 16:56:49 +0100
Commit message: Fix improper cast that could cause an overflow as demonstrated in #347.

Diff: diff --git a/coders/psd.c b/coders/psd.c
index 9249e2e9658..75ebd1d4835 100644
--- a/coders/psd.c
+++ b/coders/psd.c
@@ -1689,11 +1689,11 @@ ModuleExport MagickBooleanType ReadPSDLayers(Image *image,
                 }
               }
             /*
               Layer name.
             */
-            length=(MagickSizeType) ReadBlobByte(image);
+            length=(MagickSizeType) (unsigned char) ReadBlobByte(image);
             combined_length+=length+1;
             if (length > 0)
               (void) ReadBlob(image,(size_t) length++,layer_info[i].name);
             layer_info[i].name[length]='\0';
             if (image->debug != MagickFalse)

Vulnerable code:             length=(MagickSizeType) ReadBlobByte(image);
Fixed code:             length=(MagickSizeType) (unsigned char) ReadBlobByte(image);
CVE-2017-9098: Use of Uninitialized Resource (CWE-908)
value: ImageMagick before 7.0.5-2 and GraphicsMagick before 1.3.24 use uninitialized memory in the RLE decoder, allowing an attacker to leak sensitive information from process memory space, as demonstrated by remote attacks against ImageMagick code in a long-running server process that converts image data on behalf of multiple users. This is caused by a missing initialization step in the ReadRLEImage function in coders/rle.c.
CWE description: The product uses or accesses a resource that has not been initialized.
CVSS v3 base score: 7.5
Published: 2017-05-19T19:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/rle.c
Commit date: 2017-03-09 07:27:42 -0500
Commit message: Reset memory for RLE decoder (patch provided by scarybeasts)

Diff: diff --git a/coders/rle.c b/coders/rle.c
index 6e27f41f15d..2318901ec49 100644
--- a/coders/rle.c
+++ b/coders/rle.c
@@ -326,10 +326,11 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
     if (pixel_info == (MemoryInfo *) NULL)
       ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
     pixel_info_length=image->columns*image->rows*
       MagickMax(number_planes_filled,4);
     pixels=(unsigned char *) GetVirtualMemoryBlob(pixel_info);
+    (void) ResetMagickMemory(pixels,0,pixel_info_length);
     if ((flags & 0x01) && !(flags & 0x02))
       {
         ssize_t
           j;
 

Fixed code:     (void) ResetMagickMemory(pixels,0,pixel_info_length);
CVE-2017-9141: Improper Input Validation (CWE-20)
value: In ImageMagick 7.0.5-7 Q16, a crafted file could trigger an assertion failure in the ResetImageProfileIterator function in MagickCore/profile.c because of missing checks in the ReadDDSImage function in coders/dds.c.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 6.5
Published: 2017-05-22T14:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/dds.c
Commit date: 2017-05-15 21:11:15 +0200
Commit message: Added check to prevent image being 0x0 (reported in #489).

Diff: diff --git a/coders/dds.c b/coders/dds.c
index eb9641d0590..f1b1d8c7151 100644
--- a/coders/dds.c
+++ b/coders/dds.c
@@ -1675,20 +1675,19 @@ static Image *ReadDDSImage(const ImageInfo *image_info,ExceptionInfo *exception)
     }
   
   /*
     Initialize image structure.
   */
-  if (ReadDDSInfo(image, &dds_info) != MagickTrue) {
+  if (ReadDDSInfo(image, &dds_info) != MagickTrue)
     ThrowReaderException(CorruptImageError,"ImproperImageHeader");
-  }
-  
+
   if (dds_info.ddscaps2 & DDSCAPS2_CUBEMAP)
     cubemap = MagickTrue;
-  
+
   if (dds_info.ddscaps2 & DDSCAPS2_VOLUME && dds_info.depth > 0)
     volume = MagickTrue;
-  
+
   (void) SeekBlob(image, 128, SEEK_SET);
 
   /*
     Determine pixel format
   */
@@ -1773,11 +1772,14 @@ static Image *ReadDDSImage(const ImageInfo *image_info,ExceptionInfo *exception)
       if (dds_info.ddscaps2 & DDSCAPS2_CUBEMAP_NEGATIVEZ) num_images++;
     }
   
   if (volume)
     num_images = dds_info.depth;
-  
+
+  if (num_images < 1)
+    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+
   for (n = 0; n < num_images; n++)
   {
     if (n != 0)
       {
         /* Start a new image */

Vulnerable code:   if (ReadDDSInfo(image, &dds_info) != MagickTrue) {
  }
  
  
  
  
Fixed code:   if (ReadDDSInfo(image, &dds_info) != MagickTrue)




  if (num_images < 1)
    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
CVE-2017-9141: Reachable Assertion (CWE-617)
value: In ImageMagick 7.0.5-7 Q16, a crafted file could trigger an assertion failure in the ResetImageProfileIterator function in MagickCore/profile.c because of missing checks in the ReadDDSImage function in coders/dds.c.
CWE description: The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
CVSS v3 base score: 6.5
Published: 2017-05-22T14:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/dds.c
Commit date: 2017-05-15 21:11:15 +0200
Commit message: Added check to prevent image being 0x0 (reported in #489).

Diff: diff --git a/coders/dds.c b/coders/dds.c
index eb9641d0590..f1b1d8c7151 100644
--- a/coders/dds.c
+++ b/coders/dds.c
@@ -1675,20 +1675,19 @@ static Image *ReadDDSImage(const ImageInfo *image_info,ExceptionInfo *exception)
     }
   
   /*
     Initialize image structure.
   */
-  if (ReadDDSInfo(image, &dds_info) != MagickTrue) {
+  if (ReadDDSInfo(image, &dds_info) != MagickTrue)
     ThrowReaderException(CorruptImageError,"ImproperImageHeader");
-  }
-  
+
   if (dds_info.ddscaps2 & DDSCAPS2_CUBEMAP)
     cubemap = MagickTrue;
-  
+
   if (dds_info.ddscaps2 & DDSCAPS2_VOLUME && dds_info.depth > 0)
     volume = MagickTrue;
-  
+
   (void) SeekBlob(image, 128, SEEK_SET);
 
   /*
     Determine pixel format
   */
@@ -1773,11 +1772,14 @@ static Image *ReadDDSImage(const ImageInfo *image_info,ExceptionInfo *exception)
       if (dds_info.ddscaps2 & DDSCAPS2_CUBEMAP_NEGATIVEZ) num_images++;
     }
   
   if (volume)
     num_images = dds_info.depth;
-  
+
+  if (num_images < 1)
+    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+
   for (n = 0; n < num_images; n++)
   {
     if (n != 0)
       {
         /* Start a new image */

Vulnerable code:   if (ReadDDSInfo(image, &dds_info) != MagickTrue) {
  }
  
  
  
  
Fixed code:   if (ReadDDSInfo(image, &dds_info) != MagickTrue)




  if (num_images < 1)
    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
CVE-2017-9142: Improper Input Validation (CWE-20)
value: In ImageMagick 7.0.5-7 Q16, a crafted file could trigger an assertion failure in the WriteBlob function in MagickCore/blob.c because of missing checks in the ReadOneJNGImage function in coders/png.c.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 6.5
Published: 2017-05-22T14:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/png.c
Commit date: 2017-05-15 21:18:13 +0200
Commit message: Fixed incorrect call to WriteBlob reported in #490.

Diff: diff --git a/coders/png.c b/coders/png.c
index c194d08585c..cfd68440066 100644
--- a/coders/png.c
+++ b/coders/png.c
@@ -4780,14 +4780,15 @@ static Image *ReadOneJNGImage(MngInfo *mng_info,
 
         if (logging != MagickFalse)
           (void) LogMagickEvent(CoderEvent,GetMagickModule(),
             "    Copying JDAT chunk data to color_blob.");
 
-        (void) WriteBlob(color_image,length,chunk);
-
         if (length != 0)
-          chunk=(unsigned char *) RelinquishMagickMemory(chunk);
+          {
+            (void) WriteBlob(color_image,length,chunk);
+            chunk=(unsigned char *) RelinquishMagickMemory(chunk);
+          }
 
         continue;
       }
 
     if (memcmp(type,mng_IDAT,4) == 0)

Vulnerable code:         (void) WriteBlob(color_image,length,chunk);

          chunk=(unsigned char *) RelinquishMagickMemory(chunk);
Fixed code:           {
            (void) WriteBlob(color_image,length,chunk);
            chunk=(unsigned char *) RelinquishMagickMemory(chunk);
          }
CVE-2017-9142: Reachable Assertion (CWE-617)
value: In ImageMagick 7.0.5-7 Q16, a crafted file could trigger an assertion failure in the WriteBlob function in MagickCore/blob.c because of missing checks in the ReadOneJNGImage function in coders/png.c.
CWE description: The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
CVSS v3 base score: 6.5
Published: 2017-05-22T14:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/png.c
Commit date: 2017-05-15 21:18:13 +0200
Commit message: Fixed incorrect call to WriteBlob reported in #490.

Diff: diff --git a/coders/png.c b/coders/png.c
index c194d08585c..cfd68440066 100644
--- a/coders/png.c
+++ b/coders/png.c
@@ -4780,14 +4780,15 @@ static Image *ReadOneJNGImage(MngInfo *mng_info,
 
         if (logging != MagickFalse)
           (void) LogMagickEvent(CoderEvent,GetMagickModule(),
             "    Copying JDAT chunk data to color_blob.");
 
-        (void) WriteBlob(color_image,length,chunk);
-
         if (length != 0)
-          chunk=(unsigned char *) RelinquishMagickMemory(chunk);
+          {
+            (void) WriteBlob(color_image,length,chunk);
+            chunk=(unsigned char *) RelinquishMagickMemory(chunk);
+          }
 
         continue;
       }
 
     if (memcmp(type,mng_IDAT,4) == 0)

Vulnerable code:         (void) WriteBlob(color_image,length,chunk);

          chunk=(unsigned char *) RelinquishMagickMemory(chunk);
Fixed code:           {
            (void) WriteBlob(color_image,length,chunk);
            chunk=(unsigned char *) RelinquishMagickMemory(chunk);
          }
CVE-2017-9143: Missing Release of Resource after Effective Lifetime (CWE-772)
value: In ImageMagick 7.0.5-5, the ReadARTImage function in coders/art.c allows attackers to cause a denial of service (memory leak) via a crafted .art file.
CWE description: The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
CVSS v3 base score: 6.5
Published: 2017-05-22T14:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/art.c
Commit date: 2017-05-02 08:32:29 +0200
Commit message: Fixed memory leak reported in #456.

Diff: diff --git a/coders/art.c b/coders/art.c
index b54cde4920e..f96083245b2 100644
--- a/coders/art.c
+++ b/coders/art.c
@@ -166,11 +166,14 @@ static Image *ReadARTImage(const ImageInfo *image_info,ExceptionInfo *exception)
     if (q == (Quantum *) NULL)
       break;
     pixels=(const unsigned char *) ReadBlobStream(image,length,
       GetQuantumPixels(quantum_info),&count);
     if (count != (ssize_t) length)
-      ThrowReaderException(CorruptImageError,"UnableToReadImageData");
+      {
+        quantum_info=DestroyQuantumInfo(quantum_info);
+        ThrowReaderException(CorruptImageError,"UnableToReadImageData");
+      }
     (void) ImportQuantumPixels(image,(CacheView *) NULL,quantum_info,
       GrayQuantum,pixels,exception);
     pixels=(const unsigned char *) ReadBlobStream(image,(size_t) (-(ssize_t)
       length) & 0x01,GetQuantumPixels(quantum_info),&count);
     if (SyncAuthenticPixels(image,exception) == MagickFalse)

Vulnerable code:       ThrowReaderException(CorruptImageError,"UnableToReadImageData");
Fixed code:       {
        quantum_info=DestroyQuantumInfo(quantum_info);
        ThrowReaderException(CorruptImageError,"UnableToReadImageData");
      }
CVE-2017-9499: Reachable Assertion (CWE-617)
value: In ImageMagick 7.0.5-7 Q16, an assertion failure was found in the function SetPixelChannelAttributes, which allows attackers to cause a denial of service via a crafted file.
CWE description: The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
CVSS v3 base score: 6.5
Published: 2017-06-07T14:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/mpc.c
Commit date: 2017-05-15 21:43:29 +0200
Commit message: Added check for incorrect number of meta channels report in #492.

Diff: diff --git a/coders/mpc.c b/coders/mpc.c
index 8088da4925c..86359572d1c 100644
--- a/coders/mpc.c
+++ b/coders/mpc.c
@@ -566,10 +566,13 @@ static Image *ReadMPCImage(const ImageInfo *image_info,ExceptionInfo *exception)
                     break;
                   }
                 if (LocaleCompare(keyword,"number-meta-channels") == 0)
                   {
                     image->number_meta_channels=StringToUnsignedLong(options);
+                    if (image->number_meta_channels > MaxPixelChannels)
+                      ThrowReaderException(CorruptImageError,
+                        "ImproperImageHeader");
                     break;
                   }
                 break;
               }
               case 'o':

Fixed code:                     if (image->number_meta_channels > MaxPixelChannels)
                      ThrowReaderException(CorruptImageError,
                        "ImproperImageHeader");
CVE-2018-16323: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: ReadXBMImage in coders/xbm.c in ImageMagick before 7.0.8-9 leaves data uninitialized when processing an XBM file that has a negative pixel value. If the affected code is used as a library loaded into a process that includes sensitive information, that information sometimes can be leaked via the image data.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 6.5
Published: 2018-09-01T18:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/xbm.c
Commit date: 2018-07-24 17:31:33 -0400
Commit message: XBM coder leaves the hex image data uninitialized if hex value of the pixel is negative

Diff: diff --git a/coders/xbm.c b/coders/xbm.c
index 34344b735e8..bae47c8e59f 100644
--- a/coders/xbm.c
+++ b/coders/xbm.c
@@ -349,21 +349,27 @@ static Image *ReadXBMImage(const ImageInfo *image_info,ExceptionInfo *exception)
   if (version == 10)
     for (i=0; i < (ssize_t) (bytes_per_line*image->rows); (i+=2))
     {
       c=XBMInteger(image,hex_digits);
       if (c < 0)
-        break;
+        {
+          data=(unsigned char *) RelinquishMagickMemory(data);
+          ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+        }
       *p++=(unsigned char) c;
       if ((padding == 0) || (((i+2) % bytes_per_line) != 0))
         *p++=(unsigned char) (c >> 8);
     }
   else
     for (i=0; i < (ssize_t) (bytes_per_line*image->rows); i++)
     {
       c=XBMInteger(image,hex_digits);
       if (c < 0)
-        break;
+        {
+          data=(unsigned char *) RelinquishMagickMemory(data);
+          ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+        }
       *p++=(unsigned char) c;
     }
   if (EOFBlob(image) != MagickFalse)
     {
       data=(unsigned char *) RelinquishMagickMemory(data);

Vulnerable code:         break;
        break;
Fixed code:         {
          data=(unsigned char *) RelinquishMagickMemory(data);
          ThrowReaderException(CorruptImageError,"ImproperImageHeader");
        }
        {
          data=(unsigned char *) RelinquishMagickMemory(data);
          ThrowReaderException(CorruptImageError,"ImproperImageHeader");
        }
CVE-2018-16641: Missing Release of Resource after Effective Lifetime (CWE-772)
value: ImageMagick 7.0.8-6 has a memory leak vulnerability in the TIFFWritePhotoshopLayers function in coders/tiff.c.
CWE description: The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
CVSS v3 base score: 6.5
Published: 2018-09-06T22:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/tiff.c
Commit date: 2018-07-14 17:02:15 +0200
Commit message: Fixed possible memory leak reported in #1206

Diff: diff --git a/coders/tiff.c b/coders/tiff.c
index 2a042cbb5aa..b6419c6c4a6 100644
--- a/coders/tiff.c
+++ b/coders/tiff.c
@@ -3126,27 +3126,30 @@ static MagickBooleanType TIFFWritePhotoshopLayers(Image* image,
   profile.offset=0;
   profile.quantum=MagickMinBlobExtent;
   layers=AcquireStringInfo(profile.quantum);
   if (layers == (StringInfo *) NULL)
     {
+      base_image=DestroyImage(base_image);
       clone_info=DestroyImageInfo(clone_info);
       ThrowBinaryException(ResourceLimitError,"MemoryAllocationFailed",
         image->filename);
     }
   profile.data=layers;
   profile.extent=layers->length;
   custom_stream=TIFFAcquireCustomStreamForWriting(&profile,exception);
   if (custom_stream == (CustomStreamInfo *) NULL)
     {
+      base_image=DestroyImage(base_image);
       clone_info=DestroyImageInfo(clone_info);
       layers=DestroyStringInfo(layers);
       ThrowBinaryException(ResourceLimitError,"MemoryAllocationFailed",
         image->filename);
     }
   blob=CloneBlobInfo((BlobInfo *) NULL);
   if (blob == (BlobInfo *) NULL)
     {
+      base_image=DestroyImage(base_image);
       clone_info=DestroyImageInfo(clone_info);
       layers=DestroyStringInfo(layers);
       custom_stream=DestroyCustomStreamInfo(custom_stream);
       ThrowBinaryException(ResourceLimitError,"MemoryAllocationFailed",
         image->filename);

Fixed code:       base_image=DestroyImage(base_image);
      base_image=DestroyImage(base_image);
      base_image=DestroyImage(base_image);
CVE-2018-16644: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: There is a missing check for length in the functions ReadDCMImage of coders/dcm.c and ReadPICTImage of coders/pict.c in ImageMagick 7.0.8-11, which allows remote attackers to cause a denial of service via a crafted image.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 6.5
Published: 2018-09-06T22:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/dcm.c
Commit date: 2018-08-27 19:30:14 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1269

Diff: diff --git a/coders/dcm.c b/coders/dcm.c
index d44cf80d0a7..49a058a2d4d 100644
--- a/coders/dcm.c
+++ b/coders/dcm.c
@@ -3851,10 +3851,12 @@ static Image *ReadDCMImage(const ImageInfo *image_info,ExceptionInfo *exception)
             tag;
 
           tag=((unsigned int) ReadBlobLSBShort(image) << 16) |
             ReadBlobLSBShort(image);
           length=(size_t) ReadBlobLSBLong(image);
+          if (length > (size_t) GetBlobSize(image))
+            ThrowDCMException(CorruptImageError,"InsufficientImageDataInFile");
           if (tag == 0xFFFEE0DD)
             break; /* sequence delimiter tag */
           if (tag != 0xFFFEE000)
             {
               read_info=DestroyImageInfo(read_info);

Fixed code:           if (length > (size_t) GetBlobSize(image))
            ThrowDCMException(CorruptImageError,"InsufficientImageDataInFile");
CVE-2018-16645: Allocation of Resources Without Limits or Throttling (CWE-770)
value: There is an excessive memory allocation issue in the functions ReadBMPImage of coders/bmp.c and ReadDIBImage of coders/dib.c in ImageMagick 7.0.8-11, which allows remote attackers to cause a denial of service via a crafted image file.
CWE description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
CVSS v3 base score: 6.5
Published: 2018-09-06T22:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/bmp.c
Commit date: 2018-08-27 15:24:10 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1268

Diff: diff --git a/coders/bmp.c b/coders/bmp.c
index 8461e1a494a..e20085fefb2 100644
--- a/coders/bmp.c
+++ b/coders/bmp.c
@@ -659,10 +659,12 @@ static Image *ReadBMPImage(const ImageInfo *image_info,ExceptionInfo *exception)
         bmp_info.compression=ReadBlobLSBLong(image);
         bmp_info.image_size=ReadBlobLSBLong(image);
         bmp_info.x_pixels=ReadBlobLSBLong(image);
         bmp_info.y_pixels=ReadBlobLSBLong(image);
         bmp_info.number_colors=ReadBlobLSBLong(image);
+        if (bmp_info.number_colors > GetBlobSize(image))
+          ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
         bmp_info.colors_important=ReadBlobLSBLong(image);
         if (image->debug != MagickFalse)
           {
             (void) LogMagickEvent(CoderEvent,GetMagickModule(),
               "  Format: MS Windows bitmap");

Fixed code:         if (bmp_info.number_colors > GetBlobSize(image))
          ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");