CVE-2016-7101: Out-of-bounds Read (CWE-125)
value: The SGI coder in ImageMagick before 7.0.2-10 allows remote attackers to cause a denial of service (out-of-bounds read) via a large row value in an sgi file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2017-01-18T17:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/sgi.c
Commit date: 2016-08-18 19:40:03 -0400
Commit message: ...

Diff: diff --git a/coders/sgi.c b/coders/sgi.c
index 1fe65e604f..0ccd9c0313 100644
--- a/coders/sgi.c
+++ b/coders/sgi.c
@@ -338,20 +338,23 @@ static Image *ReadSGIImage(const ImageInfo *image_info,ExceptionInfo *exception)
     if ((iris_info.depth == 0) || (iris_info.depth > 4))
       ThrowReaderException(CorruptImageError,"ImproperImageHeader");
     iris_info.minimum_value=ReadBlobMSBLong(image);
     iris_info.maximum_value=ReadBlobMSBLong(image);
     iris_info.sans=ReadBlobMSBLong(image);
-    (void) ReadBlob(image,sizeof(iris_info.name),(unsigned char *)
+    count=ReadBlob(image,sizeof(iris_info.name),(unsigned char *)
       iris_info.name);
+    if (count != sizeof(iris_info.name))
+      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
     iris_info.name[sizeof(iris_info.name)-1]='\0';
     if (*iris_info.name != '\0')
       (void) SetImageProperty(image,"label",iris_info.name,exception);
     iris_info.pixel_format=ReadBlobMSBLong(image);
     if (iris_info.pixel_format != 0)
       ThrowReaderException(CorruptImageError,"ImproperImageHeader");
     count=ReadBlob(image,sizeof(iris_info.filler),iris_info.filler);
-    (void) count;
+    if (count != sizeof(iris_info.filler))
+      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
     image->columns=iris_info.columns;
     image->rows=iris_info.rows;
     image->depth=(size_t) MagickMin(iris_info.depth,MAGICKCORE_QUANTUM_DEPTH);
     if (iris_info.pixel_format == 0)
       image->depth=(size_t) MagickMin((size_t) 8*iris_info.bytes_per_pixel,
@@ -359,13 +362,11 @@ static Image *ReadSGIImage(const ImageInfo *image_info,ExceptionInfo *exception)
     if (iris_info.depth < 3)
       {
         image->storage_class=PseudoClass;
         image->colors=iris_info.bytes_per_pixel > 1 ? 65535 : 256;
       }
-    if (EOFBlob(image) != MagickFalse)
-      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
-    if ((image_info->ping != MagickFalse)  && (image_info->number_scenes != 0))
+    if ((image_info->ping != MagickFalse) && (image_info->number_scenes != 0))
       if (image->scene >= (image_info->scene+image_info->number_scenes-1))
         break;
     status=SetImageExtent(image,image->columns,image->rows,exception);
     if (status == MagickFalse)
       return(DestroyImageList(image));

Vulnerable code:     (void) ReadBlob(image,sizeof(iris_info.name),(unsigned char *)
    (void) count;
    if (EOFBlob(image) != MagickFalse)
      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
    if ((image_info->ping != MagickFalse)  && (image_info->number_scenes != 0))
Fixed code:     count=ReadBlob(image,sizeof(iris_info.name),(unsigned char *)
    if (count != sizeof(iris_info.name))
      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
    if (count != sizeof(iris_info.filler))
      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
    if ((image_info->ping != MagickFalse) && (image_info->number_scenes != 0))