CVE-2017-5507: Missing Release of Resource after Effective Lifetime (CWE-772)
value: Memory leak in coders/mpc.c in ImageMagick before 6.9.7-4 and 7.x before 7.0.4-4 allows remote attackers to cause a denial of service (memory consumption) via vectors involving a pixel cache.
CWE description: The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
CVSS v3 base score: 7.5
Published: 2017-03-24T15:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: Other
Files changed: ChangeLog, coders/mpc.c
Commit date: 2017-01-10 20:15:11 -0500
Commit message: ...

Diff: diff --git a/ChangeLog b/ChangeLog
index 21645cbf7ee..5923556f932 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,8 +1,9 @@
 2017-01-10  7.0.4-4 Cristy  <quetzlzacatenango@image...>
   * Recognize XML policy closing tags (reference
     https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=31182).
+  * Fix memory leak in the MPC format.
 
 2017-01-07  7.0.4-3 Cristy  <quetzlzacatenango@image...>
   * Release ImageMagick version 7.0.4-3, GIT revision 19329:930ca78:20170107.
 
 2017-01-04  7.0.4-3 Cristy  <quetzlzacatenango@image...>
diff --git a/coders/mpc.c b/coders/mpc.c
index e6d3473c841..c011c2bcbe7 100644
--- a/coders/mpc.c
+++ b/coders/mpc.c
@@ -64,10 +64,11 @@
 #include "MagickCore/monitor-private.h"
 #include "MagickCore/option.h"
 #include "MagickCore/profile.h"
 #include "MagickCore/property.h"
 #include "MagickCore/quantum-private.h"
+#include "MagickCore/resource.h"
 #include "MagickCore/static.h"
 #include "MagickCore/statistic.h"
 #include "MagickCore/string_.h"
 #include "MagickCore/string-private.h"
 #include "MagickCore/utility.h"
@@ -832,11 +833,13 @@ static Image *ReadMPCImage(const ImageInfo *image_info,ExceptionInfo *exception)
     if (image->storage_class == PseudoClass)
       {
         /*
           Create image colormap.
         */
-        if (AcquireImageColormap(image,image->colors,exception) == MagickFalse)
+        image->colormap=(PixelInfo *) AcquireQuantumMemory(image->colors+1,
+          sizeof(*image->colormap));
+        if (image->colormap == (PixelInfo *) NULL)
           ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
         if (image->colors != 0)
           {
             size_t
               packet_size;
@@ -921,13 +924,13 @@ static Image *ReadMPCImage(const ImageInfo *image_info,ExceptionInfo *exception)
         break;
       }
     if ((image_info->ping != MagickFalse) && (image_info->number_scenes != 0))
       if (image->scene >= (image_info->scene+image_info->number_scenes-1))
         break;
-    status=SetImageExtent(image,image->columns,image->rows,exception);
-    if (status == MagickFalse)
-      return(DestroyImageList(image));
+    if ((AcquireMagickResource(WidthResource,image->columns) == MagickFalse) ||
+        (AcquireMagickResource(HeightResource,image->rows) == MagickFalse))
+      ThrowReaderException(ImageError,"WidthOrHeightExceedsLimit");
     /*
       Attach persistent pixel cache.
     */
     status=PersistPixelCache(image,cache_filename,MagickTrue,&offset,exception);
     if (status == MagickFalse)

Vulnerable code:         if (AcquireImageColormap(image,image->colors,exception) == MagickFalse)
    status=SetImageExtent(image,image->columns,image->rows,exception);
    if (status == MagickFalse)
      return(DestroyImageList(image));
Fixed code:   * Fix memory leak in the MPC format.
#include "MagickCore/resource.h"
        image->colormap=(PixelInfo *) AcquireQuantumMemory(image->colors+1,
          sizeof(*image->colormap));
        if (image->colormap == (PixelInfo *) NULL)
    if ((AcquireMagickResource(WidthResource,image->columns) == MagickFalse) ||
        (AcquireMagickResource(HeightResource,image->rows) == MagickFalse))
      ThrowReaderException(ImageError,"WidthOrHeightExceedsLimit");