Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2018-20467: Loop with Unreachable Exit Condition ('Infinite Loop') (CWE-835)
value: In coders/bmp.c in ImageMagick before 7.0.8-16, an input file can result in an infinite loop and hang, with high CPU and memory consumption. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file.
CWE description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CVSS v3 base score: 6.5
Published: 2018-12-26T03:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/bmp.c
Commit date: 2018-12-08 07:19:00 -0500
Commit message: Prevent infinite loop

Diff: diff --git a/coders/bmp.c b/coders/bmp.c
index 49fddd64362..edc5cda5462 100644
--- a/coders/bmp.c
+++ b/coders/bmp.c
@@ -658,11 +658,11 @@ static Image *ReadBMPImage(const ImageInfo *image_info,ExceptionInfo *exception)
         bmp_info.compression=ReadBlobLSBLong(image);
         bmp_info.image_size=ReadBlobLSBLong(image);
         bmp_info.x_pixels=ReadBlobLSBLong(image);
         bmp_info.y_pixels=ReadBlobLSBLong(image);
         bmp_info.number_colors=ReadBlobLSBLong(image);
-        if (bmp_info.number_colors > GetBlobSize(image))
+        if ((MagickSizeType) bmp_info.number_colors > GetBlobSize(image))
           ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
         bmp_info.colors_important=ReadBlobLSBLong(image);
         if (image->debug != MagickFalse)
           {
             (void) LogMagickEvent(CoderEvent,GetMagickModule(),
@@ -1442,17 +1442,16 @@ static Image *ReadBMPImage(const ImageInfo *image_info,ExceptionInfo *exception)
       Proceed to next image.
     */
     if (image_info->number_scenes != 0)
       if (image->scene >= (image_info->scene+image_info->number_scenes-1))
         break;
+    offset=(MagickOffsetType) bmp_info.ba_offset;
+    if (offset != 0)
+      if ((offset < TellBlob(image)) ||
+          (SeekBlob(image,offset,SEEK_SET) != offset))
+        ThrowReaderException(CorruptImageError,"ImproperImageHeader");
     *magick='\0';
-    if (bmp_info.ba_offset != 0)
-      {
-        offset=SeekBlob(image,(MagickOffsetType) bmp_info.ba_offset,SEEK_SET);
-        if (offset < 0)
-          ThrowReaderException(CorruptImageError,"ImproperImageHeader");
-      }
     count=ReadBlob(image,2,magick);
     if ((count == 2) && (IsBMP(magick,2) != MagickFalse))
       {
         /*
           Acquire next image structure.

Vulnerable code:         if (bmp_info.number_colors > GetBlobSize(image))
    if (bmp_info.ba_offset != 0)
      {
        offset=SeekBlob(image,(MagickOffsetType) bmp_info.ba_offset,SEEK_SET);
        if (offset < 0)
          ThrowReaderException(CorruptImageError,"ImproperImageHeader");
      }
Fixed code:         if ((MagickSizeType) bmp_info.number_colors > GetBlobSize(image))
    offset=(MagickOffsetType) bmp_info.ba_offset;
    if (offset != 0)
      if ((offset < TellBlob(image)) ||
          (SeekBlob(image,offset,SEEK_SET) != offset))
        ThrowReaderException(CorruptImageError,"ImproperImageHeader");
CVE-2019-10131: Off-by-one Error (CWE-193)
value: An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end of the buffer or to crash the program.
CWE description: A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
CVSS v3 base score: 7.1
Published: 2019-04-30T19:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/meta.c
Commit date: 2018-03-24 15:33:50 -0400
Commit message: ...

Diff: diff --git a/coders/meta.c b/coders/meta.c
index ec4d5d49f6d..eaebd1fc0e5 100644
--- a/coders/meta.c
+++ b/coders/meta.c
@@ -2202,11 +2202,11 @@ static int format8BIM(Image *ifile, Image *ofile)
       {
         PString=(unsigned char *) RelinquishMagickMemory(PString);
         return -1;
       }
     /* make a buffer to hold the data and snag it from the input stream */
-    str=(unsigned char *) AcquireQuantumMemory((size_t) count,sizeof(*str));
+    str=(unsigned char *) AcquireQuantumMemory((size_t) count+1,sizeof(*str));
     if (str == (unsigned char *) NULL)
       {
         PString=(unsigned char *) RelinquishMagickMemory(PString);
         return 0;
       }

Vulnerable code:     str=(unsigned char *) AcquireQuantumMemory((size_t) count,sizeof(*str));
Fixed code:     str=(unsigned char *) AcquireQuantumMemory((size_t) count+1,sizeof(*str));
CVE-2019-10714: Out-of-bounds Read (CWE-125)
value: LocaleLowercase in MagickCore/locale.c in ImageMagick before 7.0.8-32 allows out-of-bounds access, leading to a SIGSEGV.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2019-04-02T21:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: Other
Files changed: ChangeLog, MagickCore/locale.c
Commit date: 2019-03-04 19:58:00 -0500
Commit message: ...

Diff: diff --git a/ChangeLog b/ChangeLog
index eb3d33de8bd..f3ac83be4e4 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
+2019-03-05  7.0.8-32 Cristy  <quetzlzacatenango@image...>
+  * Release ImageMagick version 7.0.8-32, GIT revision ...
+
+2019-03-05  7.0.8-32 Cristy  <quetzlzacatenango@image...>
+  * Fix out-of-boundary LocaleLowerCase() @
+    https://github.com/ImageMagick/ImageMagick/issues/1495
+
 2019-03-04  7.0.8-31 Cristy  <quetzlzacatenango@image...>
   * Release ImageMagick version 7.0.8-31, GIT revision 15381:3122a669d:20190304
 
 2019-03-04  7.0.8-31 Cristy  <quetzlzacatenango@image...>
   * -trim is no longer sensitive to the image virtual canvas.
diff --git a/MagickCore/locale.c b/MagickCore/locale.c
index 158b7ef92d8..4bcab6df3ec 100644
--- a/MagickCore/locale.c
+++ b/MagickCore/locale.c
@@ -1519,10 +1519,12 @@ MagickExport void LocaleLower(char *string)
 %    o If c is a uppercase letter, return its lowercase equivalent.
 %
 */
 MagickExport int LocaleLowercase(const int c)
 {
+  if (c < 0)
+    return(c);
 #if defined(MAGICKCORE_LOCALE_SUPPORT)
   if (c_locale != (locale_t) NULL)
     return(tolower_l((int) ((unsigned char) c),c_locale));
 #endif
   return(tolower((int) ((unsigned char) c)));
@@ -1657,10 +1659,12 @@ MagickExport void LocaleUpper(char *string)
 %    o If c is a lowercase letter, return its uppercase equivalent.
 %
 */
 MagickExport int LocaleUppercase(const int c)
 {
+  if (c < 0)
+    return(c);
 #if defined(MAGICKCORE_LOCALE_SUPPORT)
   if (c_locale != (locale_t) NULL)
     return(toupper_l((int) ((unsigned char) c),c_locale));
 #endif
   return(toupper((int) ((unsigned char) c)));

Fixed code: 2019-03-05  7.0.8-32 Cristy  <quetzlzacatenango@image...>
  * Release ImageMagick version 7.0.8-32, GIT revision ...

2019-03-05  7.0.8-32 Cristy  <quetzlzacatenango@image...>
  * Fix out-of-boundary LocaleLowerCase() @
    https://github.com/ImageMagick/ImageMagick/issues/1495

  if (c < 0)
    return(c);
  if (c < 0)
    return(c);
CVE-2019-10714: Out-of-bounds Read (CWE-125)
value: LocaleLowercase in MagickCore/locale.c in ImageMagick before 7.0.8-32 allows out-of-bounds access, leading to a SIGSEGV.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2019-04-02T21:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: MagickCore/locale.c
Commit date: 2019-03-04 19:59:09 -0500
Commit message: ...

Diff: diff --git a/MagickCore/locale.c b/MagickCore/locale.c
index 4bcab6df3ec..943557e381e 100644
--- a/MagickCore/locale.c
+++ b/MagickCore/locale.c
@@ -1519,11 +1519,11 @@ MagickExport void LocaleLower(char *string)
 %    o If c is a uppercase letter, return its lowercase equivalent.
 %
 */
 MagickExport int LocaleLowercase(const int c)
 {
-  if (c < 0)
+  if (c == EOF)
     return(c);
 #if defined(MAGICKCORE_LOCALE_SUPPORT)
   if (c_locale != (locale_t) NULL)
     return(tolower_l((int) ((unsigned char) c),c_locale));
 #endif
@@ -1659,11 +1659,11 @@ MagickExport void LocaleUpper(char *string)
 %    o If c is a lowercase letter, return its uppercase equivalent.
 %
 */
 MagickExport int LocaleUppercase(const int c)
 {
-  if (c < 0)
+  if (c == EOF)
     return(c);
 #if defined(MAGICKCORE_LOCALE_SUPPORT)
   if (c_locale != (locale_t) NULL)
     return(toupper_l((int) ((unsigned char) c),c_locale));
 #endif

Vulnerable code:   if (c < 0)
  if (c < 0)
Fixed code:   if (c == EOF)
  if (c == EOF)
CVE-2019-10714: Out-of-bounds Read (CWE-125)
value: LocaleLowercase in MagickCore/locale.c in ImageMagick before 7.0.8-32 allows out-of-bounds access, leading to a SIGSEGV.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2019-04-02T21:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: MagickCore/locale.c
Commit date: 2019-03-04 19:25:01 -0500
Commit message: ...

Diff: diff --git a/MagickCore/locale.c b/MagickCore/locale.c
index d30960e9db3..158b7ef92d8 100644
--- a/MagickCore/locale.c
+++ b/MagickCore/locale.c
@@ -1521,13 +1521,13 @@ MagickExport void LocaleLower(char *string)
 */
 MagickExport int LocaleLowercase(const int c)
 {
 #if defined(MAGICKCORE_LOCALE_SUPPORT)
   if (c_locale != (locale_t) NULL)
-    return(tolower_l(c,c_locale));
+    return(tolower_l((int) ((unsigned char) c),c_locale));
 #endif
-  return(tolower(c));
+  return(tolower((int) ((unsigned char) c)));
 }
 
 /*
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 %                                                                             %
@@ -1659,13 +1659,13 @@ MagickExport void LocaleUpper(char *string)
 */
 MagickExport int LocaleUppercase(const int c)
 {
 #if defined(MAGICKCORE_LOCALE_SUPPORT)
   if (c_locale != (locale_t) NULL)
-    return(toupper_l(c,c_locale));
+    return(toupper_l((int) ((unsigned char) c),c_locale));
 #endif
-  return(toupper(c));
+  return(toupper((int) ((unsigned char) c)));
 }
 
 /*
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 %                                                                             %

Vulnerable code:     return(tolower_l(c,c_locale));
  return(tolower(c));
    return(toupper_l(c,c_locale));
  return(toupper(c));
Fixed code:     return(tolower_l((int) ((unsigned char) c),c_locale));
  return(tolower((int) ((unsigned char) c)));
    return(toupper_l((int) ((unsigned char) c),c_locale));
  return(toupper((int) ((unsigned char) c)));
CVE-2019-11470: Uncontrolled Resource Consumption (CWE-400)
value: The cineon parsing component in ImageMagick 7.0.8-26 Q16 allows attackers to cause a denial-of-service (uncontrolled resource consumption) by crafting a Cineon image with an incorrect claimed image size. This occurs because ReadCINImage in coders/cin.c lacks a check for insufficient image data in a file.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 6.5
Published: 2019-04-23T14:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/cin.c
Commit date: 2019-02-09 21:20:50 -0500
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1472

Diff: diff --git a/coders/cin.c b/coders/cin.c
index 6b9b4e50b12..72d6138fd9e 100644
--- a/coders/cin.c
+++ b/coders/cin.c
@@ -724,10 +724,12 @@ static Image *ReadCINImage(const ImageInfo *image_info,ExceptionInfo *exception)
   if (image_info->ping != MagickFalse)
     {
       (void) CloseBlob(image);
       return(image);
     }
+  if (((MagickSizeType) image->columns*image->rows) > GetBlobSize(image))
+    ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
   for ( ; offset < (MagickOffsetType) cin.file.image_offset; offset++)
   {
     int
       c;
 

Fixed code:   if (((MagickSizeType) image->columns*image->rows) > GetBlobSize(image))
    ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
CVE-2019-13133: Missing Release of Memory after Effective Lifetime (CWE-401)
value: ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadBMPImage in coders/bmp.c.
CWE description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CVSS v3 base score: 5.5
Published: 2019-07-01T20:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/bmp.c, coders/viff.c
Commit date: 2019-06-18 11:51:46 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1600

Diff: diff --git a/coders/bmp.c b/coders/bmp.c
index fdabac95026..c964834fe88 100644
--- a/coders/bmp.c
+++ b/coders/bmp.c
@@ -1504,11 +1504,11 @@ static Image *ReadBMPImage(const ImageInfo *image_info,ExceptionInfo *exception)
         */
         AcquireNextImage(image_info,image,exception);
         if (GetNextImageInList(image) == (Image *) NULL)
           {
             status=MagickFalse;
-            return((Image *) NULL);
+            break;
           }
         image=SyncNextImageInList(image);
         status=SetImageProgress(image,LoadImagesTag,TellBlob(image),
           GetBlobSize(image));
         if (status == MagickFalse)
diff --git a/coders/viff.c b/coders/viff.c
index 5f89ad15e30..05aac7c5564 100644
--- a/coders/viff.c
+++ b/coders/viff.c
@@ -771,12 +771,12 @@ static Image *ReadVIFFImage(const ImageInfo *image_info,
           Allocate next image structure.
         */
         AcquireNextImage(image_info,image,exception);
         if (GetNextImageInList(image) == (Image *) NULL)
           {
-            image=DestroyImageList(image);
-            return((Image *) NULL);
+            status=MagickFalse;
+            break;
           }
         image=SyncNextImageInList(image);
         status=SetImageProgress(image,LoadImagesTag,TellBlob(image),
           GetBlobSize(image));
         if (status == MagickFalse)

Vulnerable code:             return((Image *) NULL);
            image=DestroyImageList(image);
            return((Image *) NULL);
Fixed code:             break;
            status=MagickFalse;
            break;
CVE-2019-13134: Missing Release of Memory after Effective Lifetime (CWE-401)
value: ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadVIFFImage in coders/viff.c.
CWE description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CVSS v3 base score: 5.5
Published: 2019-07-01T20:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/bmp.c, coders/viff.c
Commit date: 2019-06-18 11:51:46 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1600

Diff: diff --git a/coders/bmp.c b/coders/bmp.c
index fdabac95026..c964834fe88 100644
--- a/coders/bmp.c
+++ b/coders/bmp.c
@@ -1504,11 +1504,11 @@ static Image *ReadBMPImage(const ImageInfo *image_info,ExceptionInfo *exception)
         */
         AcquireNextImage(image_info,image,exception);
         if (GetNextImageInList(image) == (Image *) NULL)
           {
             status=MagickFalse;
-            return((Image *) NULL);
+            break;
           }
         image=SyncNextImageInList(image);
         status=SetImageProgress(image,LoadImagesTag,TellBlob(image),
           GetBlobSize(image));
         if (status == MagickFalse)
diff --git a/coders/viff.c b/coders/viff.c
index 5f89ad15e30..05aac7c5564 100644
--- a/coders/viff.c
+++ b/coders/viff.c
@@ -771,12 +771,12 @@ static Image *ReadVIFFImage(const ImageInfo *image_info,
           Allocate next image structure.
         */
         AcquireNextImage(image_info,image,exception);
         if (GetNextImageInList(image) == (Image *) NULL)
           {
-            image=DestroyImageList(image);
-            return((Image *) NULL);
+            status=MagickFalse;
+            break;
           }
         image=SyncNextImageInList(image);
         status=SetImageProgress(image,LoadImagesTag,TellBlob(image),
           GetBlobSize(image));
         if (status == MagickFalse)

Vulnerable code:             return((Image *) NULL);
            image=DestroyImageList(image);
            return((Image *) NULL);
Fixed code:             break;
            status=MagickFalse;
            break;
CVE-2019-13135: Use of Uninitialized Resource (CWE-908)
value: ImageMagick before 7.0.8-50 has a "use of uninitialized value" vulnerability in the function ReadCUTImage in coders/cut.c.
CWE description: The product uses or accesses a resource that has not been initialized.
CVSS v3 base score: 8.8
Published: 2019-07-01T20:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/cut.c
Commit date: 2019-06-18 11:44:39 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1599

Diff: diff --git a/coders/cut.c b/coders/cut.c
index 69f236276b8..c4f2768cbe7 100644
--- a/coders/cut.c
+++ b/coders/cut.c
@@ -550,10 +550,11 @@ static Image *ReadCUTImage(const ImageInfo *image_info,ExceptionInfo *exception)
 
   /* ----- Load RLE compressed raster ----- */
   BImgBuff=(unsigned char *) AcquireQuantumMemory((size_t) ldblk,
     sizeof(*BImgBuff));  /*Ldblk was set in the check phase*/
   if(BImgBuff==NULL) goto NoMemory;
+  (void) memset(BImgBuff,0,(size_t) ldblk*sizeof(*BImgBuff));
 
   offset=SeekBlob(image,6 /*sizeof(Header)*/,SEEK_SET);
   if (offset < 0)
     {
       if (palette != NULL)

Fixed code:   (void) memset(BImgBuff,0,(size_t) ldblk*sizeof(*BImgBuff));
CVE-2019-13136: Integer Overflow or Wraparound (CWE-190)
value: ImageMagick before 7.0.8-50 has an integer overflow vulnerability in the function TIFFSeekCustomStream in coders/tiff.c.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 7.8
Published: 2019-07-01T20:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/tiff.c
Commit date: 2019-06-18 11:57:54 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1602

Diff: diff --git a/coders/tiff.c b/coders/tiff.c
index 7efbb970b55..97402f2cb37 100644
--- a/coders/tiff.c
+++ b/coders/tiff.c
@@ -256,10 +256,16 @@ static MagickOffsetType TIFFSeekCustomStream(const MagickOffsetType offset,
       profile->offset=offset;
       break;
     }
     case SEEK_CUR:
     {
+      if (((offset > 0) && (profile->offset > (SSIZE_MAX-offset))) ||
+          ((offset < 0) && (profile->offset < (-SSIZE_MAX-offset))))
+        {
+          errno=EOVERFLOW;
+          return(-1);
+        }
       if ((profile->offset+offset) < 0)
         return(-1);
       profile->offset+=offset;
       break;
     }

Fixed code:       if (((offset > 0) && (profile->offset > (SSIZE_MAX-offset))) ||
          ((offset < 0) && (profile->offset < (-SSIZE_MAX-offset))))
        {
          errno=EOVERFLOW;
          return(-1);
        }
CVE-2019-13137: Missing Release of Memory after Effective Lifetime (CWE-401)
value: ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadPSImage in coders/ps.c.
CWE description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CVSS v3 base score: 6.5
Published: 2019-07-01T20:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/ps.c
Commit date: 2019-06-18 11:53:27 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1601

Diff: diff --git a/coders/ps.c b/coders/ps.c
index d599ab70479..cf5fc70580c 100644
--- a/coders/ps.c
+++ b/coders/ps.c
@@ -742,10 +742,11 @@ static Image *ReadPSImage(const ImageInfo *image_info,ExceptionInfo *exception)
         &page.height);
       if (flags == NoValue)
         {
           (void) ThrowMagickException(exception,GetMagickModule(),OptionError,
             "InvalidGeometry","`%s'",option);
+          page_geometry=DestroyString(page_geometry);
           image=DestroyImage(image);
           return((Image *) NULL);
         }
       page.width=(size_t) ceil((double) (page.width*image->resolution.x/delta.x)
         -0.5);

Fixed code:           page_geometry=DestroyString(page_geometry);
CVE-2019-13295: Out-of-bounds Read (CWE-125)
value: ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a width of zero is mishandled.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8.8
Published: 2019-07-05T01:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: MagickCore/threshold.c
Commit date: 2019-06-21 16:51:38 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1608

Diff: diff --git a/MagickCore/threshold.c b/MagickCore/threshold.c
index a3bb96a2147..f9412bb52e5 100644
--- a/MagickCore/threshold.c
+++ b/MagickCore/threshold.c
@@ -210,10 +210,12 @@ MagickExport Image *AdaptiveThresholdImage(const Image *image,
   assert(exception != (ExceptionInfo *) NULL);
   assert(exception->signature == MagickCoreSignature);
   threshold_image=CloneImage(image,0,0,MagickTrue,exception);
   if (threshold_image == (Image *) NULL)
     return((Image *) NULL);
+  if (width == 0)
+    return(threshold_image);
   status=SetImageStorageClass(threshold_image,DirectClass,exception);
   if (status == MagickFalse)
     {
       threshold_image=DestroyImage(threshold_image);
       return((Image *) NULL);

Fixed code:   if (width == 0)
    return(threshold_image);
CVE-2019-13296: Missing Release of Memory after Effective Lifetime (CWE-401)
value: ImageMagick 7.0.8-50 Q16 has direct memory leaks in AcquireMagickMemory because of an error in CLIListOperatorImages in MagickWand/operation.c for a NULL value.
CWE description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CVSS v3 base score: 6.5
Published: 2019-07-05T01:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: MagickWand/operation.c
Commit date: 2019-06-18 15:17:06 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1604

Diff: diff --git a/MagickWand/operation.c b/MagickWand/operation.c
index f53cf6dca7c..2edf8d4b873 100644
--- a/MagickWand/operation.c
+++ b/MagickWand/operation.c
@@ -3866,11 +3866,14 @@ WandPrivate MagickBooleanType CLIListOperatorImages(MagickCLI *cli_wand,
           */
           image=RemoveFirstImageFromList(&_images);
           reconstruct_image=RemoveFirstImageFromList(&_images);
           /* FUTURE - produce Exception, rather than silent fail */
           if (reconstruct_image == (Image *) NULL)
-            break;
+            { 
+              image=DestroyImage(image);
+              break;
+            }
           metric=UndefinedErrorMetric;
           option=GetImageOption(_image_info,"metric");
           if (option != (const char *) NULL)
             metric=(MetricType) ParseCommandOption(MagickMetricOptions,
               MagickFalse,option);

Vulnerable code:             break;
Fixed code:             { 
              image=DestroyImage(image);
              break;
            }
CVE-2019-13297: Out-of-bounds Read (CWE-125)
value: ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a height of zero is mishandled.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8.8
Published: 2019-07-05T01:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: MagickCore/threshold.c
Commit date: 2019-06-21 17:30:31 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1609

Diff: diff --git a/MagickCore/threshold.c b/MagickCore/threshold.c
index f9412bb52e5..0c3a488d7e3 100644
--- a/MagickCore/threshold.c
+++ b/MagickCore/threshold.c
@@ -210,11 +210,11 @@ MagickExport Image *AdaptiveThresholdImage(const Image *image,
   assert(exception != (ExceptionInfo *) NULL);
   assert(exception->signature == MagickCoreSignature);
   threshold_image=CloneImage(image,0,0,MagickTrue,exception);
   if (threshold_image == (Image *) NULL)
     return((Image *) NULL);
-  if (width == 0)
+  if ((width == 0) || (height == 0))
     return(threshold_image);
   status=SetImageStorageClass(threshold_image,DirectClass,exception);
   if (status == MagickFalse)
     {
       threshold_image=DestroyImage(threshold_image);

Vulnerable code:   if (width == 0)
Fixed code:   if ((width == 0) || (height == 0))
CVE-2019-13298: Out-of-bounds Write (CWE-787)
value: ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/pixel-accessor.h in SetPixelViaPixelInfo because of a MagickCore/enhance.c error.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8.8
Published: 2019-07-05T01:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: MagickCore/enhance.c, MagickCore/pixel-accessor.h
Commit date: 2019-06-21 20:41:29 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1611

Diff: diff --git a/MagickCore/enhance.c b/MagickCore/enhance.c
index ed3202757e2..35346890a40 100644
--- a/MagickCore/enhance.c
+++ b/MagickCore/enhance.c
@@ -1971,11 +1971,11 @@ MagickExport Image *EnhanceImage(const Image *image,ExceptionInfo *exception)
           pixel.green=((aggregate.green+total_weight/2.0)/total_weight);
           pixel.blue=((aggregate.blue+total_weight/2.0)/total_weight);
           pixel.black=((aggregate.black+total_weight/2.0)/total_weight);
           pixel.alpha=((aggregate.alpha+total_weight/2.0)/total_weight);
         }
-      SetPixelViaPixelInfo(image,&pixel,q);
+      SetPixelViaPixelInfo(enhance_image,&pixel,q);
       p+=GetPixelChannels(image);
       q+=GetPixelChannels(enhance_image);
     }
     if (SyncCacheViewAuthenticPixels(enhance_view,exception) == MagickFalse)
       status=MagickFalse;
diff --git a/MagickCore/pixel-accessor.h b/MagickCore/pixel-accessor.h
index 56fba6c9784..8af0e369cfb 100644
--- a/MagickCore/pixel-accessor.h
+++ b/MagickCore/pixel-accessor.h
@@ -109,11 +109,11 @@ static inline PixelTrait GetPixelCbTraits(const Image *magick_restrict image)
 }
 
 static inline Quantum GetPixelChannel(const Image *magick_restrict image,
   const PixelChannel channel,const Quantum *magick_restrict pixel)
 {
-  if (image->channel_map[image->channel_map[channel].offset].traits == UndefinedPixelTrait)
+  if (image->channel_map[channel].traits == UndefinedPixelTrait)
     return((Quantum) 0);
   return(pixel[image->channel_map[channel].offset]);
 }
 
 static inline PixelChannel GetPixelChannelChannel(

Vulnerable code:       SetPixelViaPixelInfo(image,&pixel,q);
  if (image->channel_map[image->channel_map[channel].offset].traits == UndefinedPixelTrait)
Fixed code:       SetPixelViaPixelInfo(enhance_image,&pixel,q);
  if (image->channel_map[channel].traits == UndefinedPixelTrait)
CVE-2019-13299: Out-of-bounds Read (CWE-125)
value: ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/pixel-accessor.h in GetPixelChannel.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8.8
Published: 2019-07-05T01:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: MagickCore/pixel-accessor.h
Commit date: 2019-06-21 18:49:58 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1610

Diff: diff --git a/MagickCore/pixel-accessor.h b/MagickCore/pixel-accessor.h
index 8af0e369cfb..56fba6c9784 100644
--- a/MagickCore/pixel-accessor.h
+++ b/MagickCore/pixel-accessor.h
@@ -109,11 +109,11 @@ static inline PixelTrait GetPixelCbTraits(const Image *magick_restrict image)
 }
 
 static inline Quantum GetPixelChannel(const Image *magick_restrict image,
   const PixelChannel channel,const Quantum *magick_restrict pixel)
 {
-  if (image->channel_map[channel].traits == UndefinedPixelTrait)
+  if (image->channel_map[image->channel_map[channel].offset].traits == UndefinedPixelTrait)
     return((Quantum) 0);
   return(pixel[image->channel_map[channel].offset]);
 }
 
 static inline PixelChannel GetPixelChannelChannel(

Vulnerable code:   if (image->channel_map[channel].traits == UndefinedPixelTrait)
Fixed code:   if (image->channel_map[image->channel_map[channel].offset].traits == UndefinedPixelTrait)
CVE-2019-13300: Out-of-bounds Write (CWE-787)
value: ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling columns.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8.8
Published: 2019-07-05T01:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: MagickCore/statistic.c
Commit date: 2019-06-16 14:35:14 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1586

Diff: diff --git a/MagickCore/statistic.c b/MagickCore/statistic.c
index a649880f440..50d56fcf77a 100644
--- a/MagickCore/statistic.c
+++ b/MagickCore/statistic.c
@@ -148,37 +148,43 @@ static PixelChannels **DestroyPixelThreadSet(PixelChannels **pixels)
       pixels[i]=(PixelChannels *) RelinquishMagickMemory(pixels[i]);
   pixels=(PixelChannels **) RelinquishMagickMemory(pixels);
   return(pixels);
 }
 
-static PixelChannels **AcquirePixelThreadSet(const Image *image)
+static PixelChannels **AcquirePixelThreadSet(const Image *images)
 {
+  const Image
+    *next;
+
   PixelChannels
     **pixels;
 
   register ssize_t
     i;
 
   size_t
+    columns,
     number_threads;
 
   number_threads=(size_t) GetMagickResourceLimit(ThreadResource);
   pixels=(PixelChannels **) AcquireQuantumMemory(number_threads,
     sizeof(*pixels));
   if (pixels == (PixelChannels **) NULL)
     return((PixelChannels **) NULL);
   (void) memset(pixels,0,number_threads*sizeof(*pixels));
+  columns=images->columns;
+  for (next=images; next != (Image *) NULL; next=next->next)
+    columns=MagickMax(next->columns,columns);
   for (i=0; i < (ssize_t) number_threads; i++)
   {
     register ssize_t
       j;
 
-    pixels[i]=(PixelChannels *) AcquireQuantumMemory(image->columns,
-      sizeof(**pixels));
+    pixels[i]=(PixelChannels *) AcquireQuantumMemory(columns,sizeof(**pixels));
     if (pixels[i] == (PixelChannels *) NULL)
       return(DestroyPixelThreadSet(pixels));
-    for (j=0; j < (ssize_t) image->columns; j++)
+    for (j=0; j < (ssize_t) columns; j++)
     {
       register ssize_t
         k;
 
       for (k=0; k < MaxPixelChannels; k++)

Vulnerable code: static PixelChannels **AcquirePixelThreadSet(const Image *image)
    pixels[i]=(PixelChannels *) AcquireQuantumMemory(image->columns,
      sizeof(**pixels));
    for (j=0; j < (ssize_t) image->columns; j++)
Fixed code: static PixelChannels **AcquirePixelThreadSet(const Image *images)
  const Image
    *next;

    columns,
  columns=images->columns;
  for (next=images; next != (Image *) NULL; next=next->next)
    columns=MagickMax(next->columns,columns);
    pixels[i]=(PixelChannels *) AcquireQuantumMemory(columns,sizeof(**pixels));
    for (j=0; j < (ssize_t) columns; j++)
CVE-2019-13301: Missing Release of Memory after Effective Lifetime (CWE-401)
value: ImageMagick 7.0.8-50 Q16 has memory leaks in AcquireMagickMemory because of an AnnotateImage error.
CWE description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CVSS v3 base score: 6.5
Published: 2019-07-05T01:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: MagickCore/annotate.c
Commit date: 2019-06-15 22:02:18 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1589

Diff: diff --git a/MagickCore/annotate.c b/MagickCore/annotate.c
index a1145780aca..494720211e4 100644
--- a/MagickCore/annotate.c
+++ b/MagickCore/annotate.c
@@ -272,11 +272,15 @@ MagickExport MagickBooleanType AnnotateImage(Image *image,
   for (p=text; *p != '\0'; p++)
     if (*p == '\n')
       number_lines++;
   textlist=AcquireQuantumMemory(number_lines+1,sizeof(*textlist));
   if (textlist == (char **) NULL)
-    return(MagickFalse);
+    {
+      annotate_info=DestroyDrawInfo(annotate_info);
+      annotate=DestroyDrawInfo(annotate);
+      return(MagickFalse);
+    }
   p=text;
   for (i=0; i < number_lines; i++)
   {
     char
       *q;
@@ -301,11 +305,16 @@ MagickExport MagickBooleanType AnnotateImage(Image *image,
       (void) ParsePageGeometry(image,annotate_info->geometry,&geometry,
         exception);
       (void) ParseGeometry(annotate_info->geometry,&geometry_info);
     }
   if (SetImageStorageClass(image,DirectClass,exception) == MagickFalse)
-    return(MagickFalse);
+    {
+      annotate_info=DestroyDrawInfo(annotate_info);
+      annotate=DestroyDrawInfo(annotate);
+      textlist=(char **) RelinquishMagickMemory(textlist);
+      return(MagickFalse);
+    }
   if (IsGrayColorspace(image->colorspace) != MagickFalse)
     (void) SetImageColorspace(image,sRGBColorspace,exception);
   status=MagickTrue;
   (void) memset(&metrics,0,sizeof(metrics));
   for (i=0; textlist[i] != (char *) NULL; i++)

Vulnerable code:     return(MagickFalse);
    return(MagickFalse);
Fixed code:     {
      annotate_info=DestroyDrawInfo(annotate_info);
      annotate=DestroyDrawInfo(annotate);
      return(MagickFalse);
    }
    {
      annotate_info=DestroyDrawInfo(annotate_info);
      annotate=DestroyDrawInfo(annotate);
      textlist=(char **) RelinquishMagickMemory(textlist);
      return(MagickFalse);
    }
CVE-2019-13302: Out-of-bounds Read (CWE-125)
value: ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read in MagickCore/fourier.c in ComplexImages.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8.8
Published: 2019-07-05T01:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: MagickCore/fourier.c
Commit date: 2019-06-17 09:13:34 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1597

Diff: diff --git a/MagickCore/fourier.c b/MagickCore/fourier.c
index 24b3824201f..47c3ccd2eaa 100644
--- a/MagickCore/fourier.c
+++ b/MagickCore/fourier.c
@@ -162,10 +162,13 @@ MagickExport Image *ComplexImages(const Image *images,const ComplexOperator op,
     status;
 
   MagickOffsetType
     progress;
 
+  size_t
+    number_channels;
+
   ssize_t
     y;
 
   assert(images != (Image *) NULL);
   assert(images->signature == MagickCoreSignature);
@@ -214,10 +217,14 @@ MagickExport Image *ComplexImages(const Image *images,const ComplexOperator op,
       Br_image=images->next->next;
       Bi_image=images->next->next->next;
     }
   Cr_image=complex_images;
   Ci_image=complex_images->next;
+  number_channels=MagickMin(MagickMin(MagickMin(
+    Ar_image->number_channels,Ai_image->number_channels),MagickMin(
+    Br_image->number_channels,Bi_image->number_channels)),MagickMin(
+    Cr_image->number_channels,Ci_image->number_channels));
   Ar_view=AcquireVirtualCacheView(Ar_image,exception);
   Ai_view=AcquireVirtualCacheView(Ai_image,exception);
   Br_view=AcquireVirtualCacheView(Br_image,exception);
   Bi_view=AcquireVirtualCacheView(Bi_image,exception);
   Cr_view=AcquireAuthenticCacheView(Cr_image,exception);
@@ -261,11 +268,11 @@ MagickExport Image *ComplexImages(const Image *images,const ComplexOperator op,
     for (x=0; x < (ssize_t) Cr_image->columns; x++)
     {
       register ssize_t
         i;
 
-      for (i=0; i < (ssize_t) GetPixelChannels(Cr_image); i++)
+      for (i=0; i < (ssize_t) number_channels; i++)
       {
         switch (op)
         {
           case AddComplexOperator:
           {

Vulnerable code:       for (i=0; i < (ssize_t) GetPixelChannels(Cr_image); i++)
Fixed code:   size_t
    number_channels;

  number_channels=MagickMin(MagickMin(MagickMin(
    Ar_image->number_channels,Ai_image->number_channels),MagickMin(
    Br_image->number_channels,Bi_image->number_channels)),MagickMin(
    Cr_image->number_channels,Ci_image->number_channels));
      for (i=0; i < (ssize_t) number_channels; i++)
CVE-2019-13304: Out-of-bounds Write (CWE-787)
value: ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced assignment.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2019-07-05T01:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/pnm.c
Commit date: 2019-06-21 20:32:57 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1614

Diff: diff --git a/coders/pnm.c b/coders/pnm.c
index afaea309d56..5849388dc9f 100644
--- a/coders/pnm.c
+++ b/coders/pnm.c
@@ -1754,17 +1754,17 @@ static MagickBooleanType WritePNMImage(const ImageInfo *image_info,Image *image,
             break;
           for (x=0; x < (ssize_t) image->columns; x++)
           {
             *q++=(unsigned char) (GetPixelLuma(image,p) >= (QuantumRange/2.0) ?
               '0' : '1');
-            *q++=' ';
             if ((q-pixels+1) >= (ssize_t) sizeof(pixels))
               {
                 *q++='\n';
                 (void) WriteBlob(image,q-pixels,pixels);
                 q=pixels;
               }
+            *q++=' ';
             p+=GetPixelChannels(image);
           }
           *q++='\n';
           (void) WriteBlob(image,q-pixels,pixels);
           q=pixels;

Vulnerable code:             *q++=' ';
Fixed code:             *q++=' ';
CVE-2019-13305: Off-by-one Error (CWE-193)
value: ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced strncpy and an off-by-one error.
CWE description: A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
CVSS v3 base score: 7.8
Published: 2019-07-05T01:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/pnm.c
Commit date: 2019-06-21 20:27:29 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1613

Diff: diff --git a/coders/pnm.c b/coders/pnm.c
index a54bc60c33d..afaea309d56 100644
--- a/coders/pnm.c
+++ b/coders/pnm.c
@@ -1822,18 +1822,18 @@ static MagickBooleanType WritePNMImage(const ImageInfo *image_info,Image *image,
                   "%u ",ScaleQuantumToShort(index));
               else
                 count=(ssize_t) FormatLocaleString(buffer,MagickPathExtent,
                   "%u ",ScaleQuantumToLong(index));
             extent=(size_t) count;
-            (void) strncpy((char *) q,buffer,extent);
-            q+=extent;
-            if ((q-pixels+extent+2) >= sizeof(pixels))
+            if ((q-pixels+extent+1) >= sizeof(pixels))
               {
                 *q++='\n';
                 (void) WriteBlob(image,q-pixels,pixels);
                 q=pixels;
               }
+            (void) strncpy((char *) q,buffer,extent);
+            q+=extent;
             p+=GetPixelChannels(image);
           }
           *q++='\n';
           (void) WriteBlob(image,q-pixels,pixels);
           q=pixels;
@@ -1897,18 +1897,18 @@ static MagickBooleanType WritePNMImage(const ImageInfo *image_info,Image *image,
                 count=(ssize_t) FormatLocaleString(buffer,MagickPathExtent,
                   "%u %u %u ",ScaleQuantumToLong(GetPixelRed(image,p)),
                   ScaleQuantumToLong(GetPixelGreen(image,p)),
                   ScaleQuantumToLong(GetPixelBlue(image,p)));
             extent=(size_t) count;
-            (void) strncpy((char *) q,buffer,extent);
-            q+=extent;
             if ((q-pixels+extent+2) >= sizeof(pixels))
               {
                 *q++='\n';
                 (void) WriteBlob(image,q-pixels,pixels);
                 q=pixels;
               }
+            (void) strncpy((char *) q,buffer,extent);
+            q+=extent;
             p+=GetPixelChannels(image);
           }
           *q++='\n';
           (void) WriteBlob(image,q-pixels,pixels);
           q=pixels;

Vulnerable code:             (void) strncpy((char *) q,buffer,extent);
            q+=extent;
            if ((q-pixels+extent+2) >= sizeof(pixels))
            (void) strncpy((char *) q,buffer,extent);
            q+=extent;
Fixed code:             if ((q-pixels+extent+1) >= sizeof(pixels))
            (void) strncpy((char *) q,buffer,extent);
            q+=extent;
            (void) strncpy((char *) q,buffer,extent);
            q+=extent;
CVE-2019-13305: Out-of-bounds Write (CWE-787)
value: ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced strncpy and an off-by-one error.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2019-07-05T01:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/pnm.c
Commit date: 2019-06-21 20:27:29 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1613

Diff: diff --git a/coders/pnm.c b/coders/pnm.c
index a54bc60c33d..afaea309d56 100644
--- a/coders/pnm.c
+++ b/coders/pnm.c
@@ -1822,18 +1822,18 @@ static MagickBooleanType WritePNMImage(const ImageInfo *image_info,Image *image,
                   "%u ",ScaleQuantumToShort(index));
               else
                 count=(ssize_t) FormatLocaleString(buffer,MagickPathExtent,
                   "%u ",ScaleQuantumToLong(index));
             extent=(size_t) count;
-            (void) strncpy((char *) q,buffer,extent);
-            q+=extent;
-            if ((q-pixels+extent+2) >= sizeof(pixels))
+            if ((q-pixels+extent+1) >= sizeof(pixels))
               {
                 *q++='\n';
                 (void) WriteBlob(image,q-pixels,pixels);
                 q=pixels;
               }
+            (void) strncpy((char *) q,buffer,extent);
+            q+=extent;
             p+=GetPixelChannels(image);
           }
           *q++='\n';
           (void) WriteBlob(image,q-pixels,pixels);
           q=pixels;
@@ -1897,18 +1897,18 @@ static MagickBooleanType WritePNMImage(const ImageInfo *image_info,Image *image,
                 count=(ssize_t) FormatLocaleString(buffer,MagickPathExtent,
                   "%u %u %u ",ScaleQuantumToLong(GetPixelRed(image,p)),
                   ScaleQuantumToLong(GetPixelGreen(image,p)),
                   ScaleQuantumToLong(GetPixelBlue(image,p)));
             extent=(size_t) count;
-            (void) strncpy((char *) q,buffer,extent);
-            q+=extent;
             if ((q-pixels+extent+2) >= sizeof(pixels))
               {
                 *q++='\n';
                 (void) WriteBlob(image,q-pixels,pixels);
                 q=pixels;
               }
+            (void) strncpy((char *) q,buffer,extent);
+            q+=extent;
             p+=GetPixelChannels(image);
           }
           *q++='\n';
           (void) WriteBlob(image,q-pixels,pixels);
           q=pixels;

Vulnerable code:             (void) strncpy((char *) q,buffer,extent);
            q+=extent;
            if ((q-pixels+extent+2) >= sizeof(pixels))
            (void) strncpy((char *) q,buffer,extent);
            q+=extent;
Fixed code:             if ((q-pixels+extent+1) >= sizeof(pixels))
            (void) strncpy((char *) q,buffer,extent);
            q+=extent;
            (void) strncpy((char *) q,buffer,extent);
            q+=extent;
CVE-2019-13306: Off-by-one Error (CWE-193)
value: ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of off-by-one errors.
CWE description: A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
CVSS v3 base score: 7.8
Published: 2019-07-05T01:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/pnm.c
Commit date: 2019-06-21 20:17:04 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1612

Diff: diff --git a/coders/pnm.c b/coders/pnm.c
index f6f69bf83c2..a54bc60c33d 100644
--- a/coders/pnm.c
+++ b/coders/pnm.c
@@ -1824,11 +1824,11 @@ static MagickBooleanType WritePNMImage(const ImageInfo *image_info,Image *image,
                 count=(ssize_t) FormatLocaleString(buffer,MagickPathExtent,
                   "%u ",ScaleQuantumToLong(index));
             extent=(size_t) count;
             (void) strncpy((char *) q,buffer,extent);
             q+=extent;
-            if ((q-pixels+extent+1) >= sizeof(pixels))
+            if ((q-pixels+extent+2) >= sizeof(pixels))
               {
                 *q++='\n';
                 (void) WriteBlob(image,q-pixels,pixels);
                 q=pixels;
               }
@@ -1899,11 +1899,11 @@ static MagickBooleanType WritePNMImage(const ImageInfo *image_info,Image *image,
                   ScaleQuantumToLong(GetPixelGreen(image,p)),
                   ScaleQuantumToLong(GetPixelBlue(image,p)));
             extent=(size_t) count;
             (void) strncpy((char *) q,buffer,extent);
             q+=extent;
-            if ((q-pixels+extent+1) >= sizeof(pixels))
+            if ((q-pixels+extent+2) >= sizeof(pixels))
               {
                 *q++='\n';
                 (void) WriteBlob(image,q-pixels,pixels);
                 q=pixels;
               }

Vulnerable code:             if ((q-pixels+extent+1) >= sizeof(pixels))
            if ((q-pixels+extent+1) >= sizeof(pixels))
Fixed code:             if ((q-pixels+extent+2) >= sizeof(pixels))
            if ((q-pixels+extent+2) >= sizeof(pixels))
CVE-2019-13306: Out-of-bounds Write (CWE-787)
value: ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of off-by-one errors.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2019-07-05T01:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/pnm.c
Commit date: 2019-06-21 20:17:04 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1612

Diff: diff --git a/coders/pnm.c b/coders/pnm.c
index f6f69bf83c2..a54bc60c33d 100644
--- a/coders/pnm.c
+++ b/coders/pnm.c
@@ -1824,11 +1824,11 @@ static MagickBooleanType WritePNMImage(const ImageInfo *image_info,Image *image,
                 count=(ssize_t) FormatLocaleString(buffer,MagickPathExtent,
                   "%u ",ScaleQuantumToLong(index));
             extent=(size_t) count;
             (void) strncpy((char *) q,buffer,extent);
             q+=extent;
-            if ((q-pixels+extent+1) >= sizeof(pixels))
+            if ((q-pixels+extent+2) >= sizeof(pixels))
               {
                 *q++='\n';
                 (void) WriteBlob(image,q-pixels,pixels);
                 q=pixels;
               }
@@ -1899,11 +1899,11 @@ static MagickBooleanType WritePNMImage(const ImageInfo *image_info,Image *image,
                   ScaleQuantumToLong(GetPixelGreen(image,p)),
                   ScaleQuantumToLong(GetPixelBlue(image,p)));
             extent=(size_t) count;
             (void) strncpy((char *) q,buffer,extent);
             q+=extent;
-            if ((q-pixels+extent+1) >= sizeof(pixels))
+            if ((q-pixels+extent+2) >= sizeof(pixels))
               {
                 *q++='\n';
                 (void) WriteBlob(image,q-pixels,pixels);
                 q=pixels;
               }

Vulnerable code:             if ((q-pixels+extent+1) >= sizeof(pixels))
            if ((q-pixels+extent+1) >= sizeof(pixels))
Fixed code:             if ((q-pixels+extent+2) >= sizeof(pixels))
            if ((q-pixels+extent+2) >= sizeof(pixels))