Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2016-10063: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Buffer overflow in coders/tiff.c in ImageMagick before 6.9.5-1 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file, related to extend validity.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 7.8
Published: 2017-03-02T21:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/tiff.c
Commit date: 2016-07-06 07:59:13 -0400
Commit message: ...

Diff: diff --git a/coders/tiff.c b/coders/tiff.c
index fa589d94f6..8acce45d04 100644
--- a/coders/tiff.c
+++ b/coders/tiff.c
@@ -1297,13 +1297,10 @@ RestoreMSCWarning
           exception));
       }
     image->columns=(size_t) width;
     image->rows=(size_t) height;
     image->depth=(size_t) bits_per_sample;
-    status=SetImageExtent(image,image->columns,image->rows,exception);
-    if (status == MagickFalse)
-      return(DestroyImageList(image));
     if (image->debug != MagickFalse)
       (void) LogMagickEvent(CoderEvent,GetMagickModule(),"Image depth: %.20g",
         (double) image->depth);
     image->endian=MSBEndian;
     if (endian == FILLORDER_LSB2MSB)
@@ -1560,10 +1557,13 @@ RestoreMSCWarning
               quantum_info=DestroyQuantumInfo(quantum_info);
               break;
             }
         goto next_tiff_frame;
       }
+    status=SetImageExtent(image,image->columns,image->rows,exception);
+    if (status == MagickFalse)
+      return(DestroyImageList(image));
     method=ReadGenericMethod;
     if (TIFFGetField(tiff,TIFFTAG_ROWSPERSTRIP,&rows_per_strip) == 1)
       {
         char
           value[MagickPathExtent];

Vulnerable code:     status=SetImageExtent(image,image->columns,image->rows,exception);
    if (status == MagickFalse)
      return(DestroyImageList(image));
Fixed code:     status=SetImageExtent(image,image->columns,image->rows,exception);
    if (status == MagickFalse)
      return(DestroyImageList(image));
CVE-2016-10070: Out-of-bounds Read (CWE-125)
value: Heap-based buffer overflow in the CalcMinMax function in coders/mat.c in ImageMagick before 6.9.4-0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted mat file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2017-03-03T18:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/mat.c
Commit date: 2016-02-20 09:51:04 -0500
Commit message: https://github.com/ImageMagick/ImageMagick/issues/131

Diff: diff --git a/coders/mat.c b/coders/mat.c
index 93a9d8710a..9bc442274a 100644
--- a/coders/mat.c
+++ b/coders/mat.c
@@ -923,10 +923,11 @@ ImportQuantumPixelsFailed:
             "  MAT failed to sync image pixels for a row %u", (unsigned)(MATLAB_HDR.SizeY-i-1));
     goto ExitLoop;
   }
       }
     } while(z-- >= 2);
+    quantum_info=DestroyQuantumInfo(quantum_info);
 ExitLoop:
 
 
     /* Read complex part of numbers here */
     if (MATLAB_HDR.StructureFlag & FLAG_COMPLEX)

Fixed code:     quantum_info=DestroyQuantumInfo(quantum_info);
CVE-2016-10071: Out-of-bounds Read (CWE-125)
value: coders/mat.c in ImageMagick before 6.9.4-0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted mat file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2017-03-02T21:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/mat.c
Commit date: 2016-02-14 09:23:34 -0500
Commit message: https://github.com/ImageMagick/ImageMagick/issues/131

Diff: diff --git a/coders/mat.c b/coders/mat.c
index b5a3f1f970..93a9d8710a 100644
--- a/coders/mat.c
+++ b/coders/mat.c
@@ -862,11 +862,11 @@ RestoreMSCWarning
     status=SetImageExtent(image,image->columns,image->rows,exception);
     if (status == MagickFalse)
       return(DestroyImageList(image));
 
   /* ----- Load raster data ----- */
-    BImgBuff = (unsigned char *) AcquireQuantumMemory((size_t) (ldblk),sizeof(unsigned char));    /* Ldblk was set in the check phase */
+    BImgBuff = (unsigned char *) AcquireQuantumMemory((size_t) (ldblk),sizeof(double));    /* Ldblk was set in the check phase */
     if (BImgBuff == NULL)
       ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
 
     MinVal = 0;
     MaxVal = 0;

Vulnerable code:     BImgBuff = (unsigned char *) AcquireQuantumMemory((size_t) (ldblk),sizeof(unsigned char));    /* Ldblk was set in the check phase */
Fixed code:     BImgBuff = (unsigned char *) AcquireQuantumMemory((size_t) (ldblk),sizeof(double));    /* Ldblk was set in the check phase */
CVE-2016-5688: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: The WPG parser in ImageMagick before 6.9.4-4 and 7.x before 7.0.1-5, when a memory limit is set, allows remote attackers to have unspecified impact via vectors related to the SetImageExtent return-value check, which trigger (1) a heap-based buffer overflow in the SetPixelIndex function or an invalid write operation in the (2) ScaleCharToQuantum or (3) SetPixelIndex functions.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 8.1
Published: 2016-12-13T15:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/wpg.c
Commit date: 2016-05-16 14:00:14 -0400
Commit message: Ensure image extent does not exceed maximum

Diff: diff --git a/coders/wpg.c b/coders/wpg.c
index b6ba8d79fe..0dfdc47f0b 100644
--- a/coders/wpg.c
+++ b/coders/wpg.c
@@ -1110,10 +1110,13 @@ static Image *ReadWPGImage(const ImageInfo *image_info,
               image->columns=BitmapHeader2.Width;
               image->rows=BitmapHeader2.Height;
               bpp=BitmapHeader2.Depth;
 
             UnpackRaster:      
+              status=SetImageExtent(image,image->columns,image->rows,exception);
+              if (status == MagickFalse)
+                break;
               if ((image->colors == 0) && (bpp != 24))
                 {
                   image->colors=one << bpp;
                   if (!AcquireImageColormap(image,image->colors,exception))
                     {
@@ -1303,10 +1306,13 @@ static Image *ReadWPGImage(const ImageInfo *image_info,
                 default:
                   continue;  /*Ignore raster with unknown depth*/
                 }
               image->columns=Bitmap2Header1.Width;
               image->rows=Bitmap2Header1.Height;
+              status=SetImageExtent(image,image->columns,image->rows,exception);
+              if (status == MagickFalse)
+                break;
 
               if ((image->colors == 0) && (bpp != 24))
                 {
                   size_t
                     one;
@@ -1421,13 +1427,10 @@ static Image *ReadWPGImage(const ImageInfo *image_info,
     default:
       {
          ThrowReaderException(CoderError,"DataEncodingSchemeIsNotSupported");
       }
    }
-  status=SetImageExtent(image,image->columns,image->rows,exception);
-  if (status == MagickFalse)
-    return(DestroyImageList(image));
 
  Finish:
   (void) CloseBlob(image);
 
   {

Vulnerable code:   status=SetImageExtent(image,image->columns,image->rows,exception);
  if (status == MagickFalse)
    return(DestroyImageList(image));
Fixed code:               status=SetImageExtent(image,image->columns,image->rows,exception);
              if (status == MagickFalse)
                break;
              status=SetImageExtent(image,image->columns,image->rows,exception);
              if (status == MagickFalse)
                break;
CVE-2016-6491: Out-of-bounds Read (CWE-125)
value: Buffer overflow in the Get8BIMProperty function in MagickCore/property.c in ImageMagick before 6.9.5-4 and 7.x before 7.0.2-6 allows remote attackers to cause a denial of service (out-of-bounds read, memory leak, and crash) via a crafted image.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8.8
Published: 2016-12-13T15:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: MagickCore/property.c
Commit date: 2016-07-24 20:09:04 -0400
Commit message: Prevent buffer overflow (bug report from Ibrahim el-sayed)

Diff: diff --git a/MagickCore/property.c b/MagickCore/property.c
index 772f3d59fe..0b4b75c494 100644
--- a/MagickCore/property.c
+++ b/MagickCore/property.c
@@ -663,10 +663,15 @@ static MagickBooleanType Get8BIMProperty(const Image *image,const char *key,
           }
       }
     if ((count & 0x01) == 0)
       (void) ReadPropertyByte(&info,&length);
     count=(ssize_t) ReadPropertyMSBLong(&info,&length);
+    if ((count < 0) || ((size_t) count > length))
+      {
+        length=0; 
+        continue;
+      }
     if ((*name != '\0') && (*name != '#'))
       if ((resource == (char *) NULL) || (LocaleCompare(name,resource) != 0))
         {
           /*
             No name match, scroll forward and try next.

Fixed code:     if ((count < 0) || ((size_t) count > length))
      {
        length=0; 
        continue;
      }
CVE-2016-6520: Out-of-bounds Read (CWE-125)
value: Buffer overflow in MagickCore/enhance.c in ImageMagick before 7.0.2-7 allows remote attackers to have unspecified impact via vectors related to pixel cache morphology.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.1
Published: 2016-12-13T15:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: Other
Files changed: ChangeLog, MagickCore/enhance.c
Commit date: 2016-08-01 12:16:49 -0400
Commit message: Evaluate lazy pixel cache morphology to prevent buffer overflow (bug report from Ibrahim M. El-Sayed)

Diff: diff --git a/ChangeLog b/ChangeLog
index bca3aee888..4cf2e838f5 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,9 @@
+2016-07-01  7.0.2-7 Cristy  <quetzlzacatenango@image...>
+  * Evaluate lazy pixel cache morphology to prevent buffer overflow (bug report
+    from Ibrahim M. El-Sayed).
+
 2016-07-30  7.0.2-6 Cristy  <quetzlzacatenango@image...>
   * Release ImageMagick version 7.0.2-6, GIT revision 18651:df24175:20160729.
 
 2016-07-29  7.0.2-6 Cristy  <quetzlzacatenango@image...>
   * Support -region option (reference
diff --git a/MagickCore/enhance.c b/MagickCore/enhance.c
index 315cb24e45..2bd1363e4d 100644
--- a/MagickCore/enhance.c
+++ b/MagickCore/enhance.c
@@ -1047,10 +1047,12 @@ MagickExport MagickBooleanType ContrastStretchImage(Image *image,
   assert(image->signature == MagickCoreSignature);
   if (image->debug != MagickFalse)
     (void) LogMagickEvent(TraceEvent,GetMagickModule(),"%s",image->filename);
   if (SetImageGray(image,exception) != MagickFalse)
     (void) SetImageColorspace(image,GRAYColorspace,exception);
+  if (SyncImagePixelCache(image,exception) == MagickFalse)
+    return(MagickFalse);
   black=(double *) AcquireQuantumMemory(GetPixelChannels(image),sizeof(*black));
   white=(double *) AcquireQuantumMemory(GetPixelChannels(image),sizeof(*white));
   histogram=(double *) AcquireQuantumMemory(MaxMap+1UL,GetPixelChannels(image)*
     sizeof(*histogram));
   stretch_map=(double *) AcquireQuantumMemory(MaxMap+1UL,
@@ -1531,10 +1533,12 @@ MagickExport MagickBooleanType EqualizeImage(Image *image,
   if (AccelerateEqualizeImage(image,exception) != MagickFalse)
     return(MagickTrue);
 #endif
   if (image->debug != MagickFalse)
     (void) LogMagickEvent(TraceEvent,GetMagickModule(),"%s",image->filename);
+  if (SyncImagePixelCache(image,exception) == MagickFalse)
+    return(MagickFalse);
   equalize_map=(double *) AcquireQuantumMemory(MaxMap+1UL,
     GetPixelChannels(image)*sizeof(*equalize_map));
   histogram=(double *) AcquireQuantumMemory(MaxMap+1UL,GetPixelChannels(image)*
     sizeof(*histogram));
   map=(double *) AcquireQuantumMemory(MaxMap+1UL,GetPixelChannels(image)*

Fixed code: 2016-07-01  7.0.2-7 Cristy  <quetzlzacatenango@image...>
  * Evaluate lazy pixel cache morphology to prevent buffer overflow (bug report
    from Ibrahim M. El-Sayed).

  if (SyncImagePixelCache(image,exception) == MagickFalse)
    return(MagickFalse);
  if (SyncImagePixelCache(image,exception) == MagickFalse)
    return(MagickFalse);
CVE-2016-6823: Integer Overflow or Wraparound (CWE-190)
value: Integer overflow in the BMP coder in ImageMagick before 7.0.2-10 allows remote attackers to cause a denial of service (crash) via crafted height and width values, which triggers an out-of-bounds write.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 7.5
Published: 2017-01-18T17:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: Other
Files changed: ChangeLog, coders/bmp.c
Commit date: 2016-08-15 15:55:09 -0400
Commit message: Prevent buffer overflow in BMP coder (bug report from pwchen of tencent).

Diff: diff --git a/ChangeLog b/ChangeLog
index 7c9cad2e50..14b82002dc 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,8 @@
+2016-08-15  7.0.2-10 Cristy  <quetzlzacatenango@image...>
+  * Prevent buffer overflow in BMP coder (bug report from pwchen of tencent).
+
 2016-08-14  7.0.2-9 Cristy  <quetzlzacatenango@image...>
   * Release ImageMagick version 7.0.2-9, GIT revision 18707:2c02f09:20160814.
 
 2016-08-14  7.0.2-9 Cristy  <quetzlzacatenango@image...>
   * Fix compile error in opencl.c (reference
diff --git a/coders/bmp.c b/coders/bmp.c
index 85741e173a..47aeae964c 100644
--- a/coders/bmp.c
+++ b/coders/bmp.c
@@ -1680,14 +1680,17 @@ static MagickBooleanType WriteBMPImage(const ImageInfo *image_info,Image *image,
               extra_size+=16;
             }
           bmp_info.file_size+=extra_size;
           bmp_info.offset_bits+=extra_size;
         }
+    if ((image->columns != (signed int) image->columns) ||
+        (image->rows != (signed int) image->rows))
+      ThrowWriterException(ImageError,"WidthOrHeightExceedsLimit");
     bmp_info.width=(ssize_t) image->columns;
     bmp_info.height=(ssize_t) image->rows;
     bmp_info.planes=1;
-    bmp_info.image_size=(unsigned int) (bytes_per_line*image->rows);
+    bmp_info.image_size=(unsigned long) (bytes_per_line*image->rows);
     bmp_info.file_size+=bmp_info.image_size;
     bmp_info.x_pixels=75*39;
     bmp_info.y_pixels=75*39;
     switch (image->units)
     {

Vulnerable code:     bmp_info.image_size=(unsigned int) (bytes_per_line*image->rows);
Fixed code: 2016-08-15  7.0.2-10 Cristy  <quetzlzacatenango@image...>
  * Prevent buffer overflow in BMP coder (bug report from pwchen of tencent).

    if ((image->columns != (signed int) image->columns) ||
        (image->rows != (signed int) image->rows))
      ThrowWriterException(ImageError,"WidthOrHeightExceedsLimit");
    bmp_info.image_size=(unsigned long) (bytes_per_line*image->rows);
CVE-2016-7101: Out-of-bounds Read (CWE-125)
value: The SGI coder in ImageMagick before 7.0.2-10 allows remote attackers to cause a denial of service (out-of-bounds read) via a large row value in an sgi file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2017-01-18T17:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: Other
Files changed: ChangeLog, coders/sgi.c
Commit date: 2016-08-18 18:23:44 -0400
Commit message: Prevent buffer overflow in BMP & SGI coders (bug report from pwchen&rayzhong of tencent)

Diff: diff --git a/ChangeLog b/ChangeLog
index 3a9c38e2b2..ff89b2021c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,7 +1,7 @@
 2016-08-15  7.0.2-10 Cristy  <quetzlzacatenango@image...>
-  * Prevent buffer overflow in BMP coder (bug report from
+  * Prevent buffer overflow in BMP & SGI coders (bug report from
     pwchen&rayzhong of tencent).
 
 2016-08-14  7.0.2-9 Cristy  <quetzlzacatenango@image...>
   * Release ImageMagick version 7.0.2-9, GIT revision 18707:2c02f09:20160814.
 
diff --git a/coders/sgi.c b/coders/sgi.c
index cd8c2b69e1..1fe65e604f 100644
--- a/coders/sgi.c
+++ b/coders/sgi.c
@@ -352,17 +352,19 @@ static Image *ReadSGIImage(const ImageInfo *image_info,ExceptionInfo *exception)
     (void) count;
     image->columns=iris_info.columns;
     image->rows=iris_info.rows;
     image->depth=(size_t) MagickMin(iris_info.depth,MAGICKCORE_QUANTUM_DEPTH);
     if (iris_info.pixel_format == 0)
-      image->depth=(size_t) MagickMin((size_t) 8*
-        iris_info.bytes_per_pixel,MAGICKCORE_QUANTUM_DEPTH);
+      image->depth=(size_t) MagickMin((size_t) 8*iris_info.bytes_per_pixel,
+        MAGICKCORE_QUANTUM_DEPTH);
     if (iris_info.depth < 3)
       {
         image->storage_class=PseudoClass;
         image->colors=iris_info.bytes_per_pixel > 1 ? 65535 : 256;
       }
+    if (EOFBlob(image) != MagickFalse)
+      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
     if ((image_info->ping != MagickFalse)  && (image_info->number_scenes != 0))
       if (image->scene >= (image_info->scene+image_info->number_scenes-1))
         break;
     status=SetImageExtent(image,image->columns,image->rows,exception);
     if (status == MagickFalse)

Vulnerable code:   * Prevent buffer overflow in BMP coder (bug report from
      image->depth=(size_t) MagickMin((size_t) 8*
        iris_info.bytes_per_pixel,MAGICKCORE_QUANTUM_DEPTH);
Fixed code:   * Prevent buffer overflow in BMP & SGI coders (bug report from
      image->depth=(size_t) MagickMin((size_t) 8*iris_info.bytes_per_pixel,
        MAGICKCORE_QUANTUM_DEPTH);
    if (EOFBlob(image) != MagickFalse)
      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
CVE-2016-7514: Out-of-bounds Read (CWE-125)
value: The ReadPSDChannelPixels function in coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2017-04-20T18:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/psd.c
Commit date: 2016-01-15 01:27:31 +0100
Commit message: Added missing call to ConstrainColormapIndex.

Diff: diff --git a/coders/psd.c b/coders/psd.c
index 5f5fba6c62..5a5c633807 100644
--- a/coders/psd.c
+++ b/coders/psd.c
@@ -833,11 +833,12 @@ static MagickBooleanType ReadPSDChannelPixels(Image *image,
                 for (bit=0; bit < number_bits; bit++)
                 {
                   SetPixelIndex(image,(((unsigned char) pixel) &
                     (0x01 << (7-bit))) != 0 ? 0 : 255,q);
                   SetPixelViaPixelInfo(image,image->colormap+(ssize_t)
-                    GetPixelIndex(image,q),q);
+                    ConstrainColormapIndex(image,GetPixelIndex(image,q),
+                      exception),q);
                   q+=GetPixelChannels(image);
                   x++;
                 }
                 x--;
                 continue;

Vulnerable code:                     GetPixelIndex(image,q),q);
Fixed code:                     ConstrainColormapIndex(image,GetPixelIndex(image,q),
                      exception),q);
CVE-2016-7514: Out-of-bounds Read (CWE-125)
value: The ReadPSDChannelPixels function in coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2017-04-20T18:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/psd.c
Commit date: 2016-01-15 01:13:19 +0100
Commit message: Fixed overflow.

Diff: diff --git a/coders/psd.c b/coders/psd.c
index 907e45dd5c..5f5fba6c62 100644
--- a/coders/psd.c
+++ b/coders/psd.c
@@ -2361,12 +2361,12 @@ static MagickBooleanType WriteImageChannels(const PSDInfo *psd_info,
   channels=1;
   packet_size=next_image->depth > 8UL ? 2UL : 1UL;
   compact_pixels=(unsigned char *) NULL;
   if (next_image->compression == RLECompression)
     {
-      compact_pixels=(unsigned char *) AcquireQuantumMemory(2*channels*
-        next_image->columns,packet_size*sizeof(*compact_pixels));
+      compact_pixels=(unsigned char *) AcquireQuantumMemory((2*channels*
+        next_image->columns)+1,packet_size*sizeof(*compact_pixels));
       if (compact_pixels == (unsigned char *) NULL)
         ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
     }
   if (IsImageGray(next_image) != MagickFalse)
     {

Vulnerable code:       compact_pixels=(unsigned char *) AcquireQuantumMemory(2*channels*
        next_image->columns,packet_size*sizeof(*compact_pixels));
Fixed code:       compact_pixels=(unsigned char *) AcquireQuantumMemory((2*channels*
        next_image->columns)+1,packet_size*sizeof(*compact_pixels));
CVE-2016-7514: Out-of-bounds Read (CWE-125)
value: The ReadPSDChannelPixels function in coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2017-04-20T18:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/psd.c
Commit date: 2016-01-15 11:17:30 +0100
Commit message: Added check for bit depth 1.

Diff: diff --git a/coders/psd.c b/coders/psd.c
index 5a5c633807..976d9076fb 100644
--- a/coders/psd.c
+++ b/coders/psd.c
@@ -1906,10 +1906,12 @@ static Image *ReadPSDImage(const ImageInfo *image_info,ExceptionInfo *exception)
             image->colormap[i].blue=ScaleCharToQuantum((unsigned char)
               ReadBlobByte(image));
           image->alpha_trait=UndefinedPixelTrait;
         }
     }
+  if ((image->depth == 1) && (image->storage_class != PseudoClass))
+    ThrowReaderException(CorruptImageError, "ImproperImageHeader");
   has_merged_image=MagickTrue;
   length=ReadBlobMSBLong(image);
   if (length != 0)
     {
       unsigned char

Fixed code:   if ((image->depth == 1) && (image->storage_class != PseudoClass))
    ThrowReaderException(CorruptImageError, "ImproperImageHeader");
CVE-2016-7515: Out-of-bounds Read (CWE-125)
value: The ReadRLEImage function in coders/rle.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to the number of pixels.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2017-04-19T14:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/rle.c
Commit date: 2015-10-05 22:11:31 +0200
Commit message: Fixed check for the number of pixels that will be allocated.

Diff: diff --git a/coders/rle.c b/coders/rle.c
index a5c27ffaf7..9809fa7f29 100644
--- a/coders/rle.c
+++ b/coders/rle.c
@@ -171,10 +171,11 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
   size_t
     bits_per_pixel,
     map_length,
     number_colormaps,
     number_planes,
+    number_planes_filled,
     one,
     offset,
     pixel_info_length;
 
   ssize_t
@@ -306,13 +307,16 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
       Allocate RLE pixels.
     */
     if (image->alpha_trait != UndefinedPixelTrait)
       number_planes++;
     number_pixels=(MagickSizeType) image->columns*image->rows;
-    if ((number_pixels*number_planes) != (size_t) (number_pixels*number_planes))
+    number_planes_filled=(number_planes % 2 == 0) ? number_planes :
+      number_planes+1;
+    if ((number_pixels*number_planes_filled) != (size_t) (number_pixels*
+         number_planes_filled))
       ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
-    pixel_info_length=image->columns*image->rows*MagickMax(number_planes,4);
+    pixel_info_length=image->columns*image->rows*number_planes_filled;
     pixel_info=AcquireVirtualMemory(pixel_info_length,sizeof(*pixels));
     if (pixel_info == (MemoryInfo *) NULL)
       ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
     pixels=(unsigned char *) GetVirtualMemoryBlob(pixel_info);
     if ((flags & 0x01) && !(flags & 0x02))

Vulnerable code:     if ((number_pixels*number_planes) != (size_t) (number_pixels*number_planes))
    pixel_info_length=image->columns*image->rows*MagickMax(number_planes,4);
Fixed code:     number_planes_filled,
    number_planes_filled=(number_planes % 2 == 0) ? number_planes :
      number_planes+1;
    if ((number_pixels*number_planes_filled) != (size_t) (number_pixels*
         number_planes_filled))
    pixel_info_length=image->columns*image->rows*number_planes_filled;
CVE-2016-7520: Out-of-bounds Read (CWE-125)
value: Heap-based buffer overflow in coders/hdr.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted HDR file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2017-04-20T18:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/hdr.c
Commit date: 2016-01-22 19:39:55 -0500
Commit message: https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1537213

Diff: diff --git a/coders/hdr.c b/coders/hdr.c
index b15c415be3..bdb343b119 100644
--- a/coders/hdr.c
+++ b/coders/hdr.c
@@ -721,11 +721,12 @@ static MagickBooleanType WriteHDRImage(const ImageInfo *image_info,Image *image,
         strtod(property,(char **) NULL));
       (void) WriteBlob(image,(size_t) count,(unsigned char *) header);
     }
   if (image->gamma != 0.0)
     {
-      count=FormatLocaleString(header,MagickPathExtent,"GAMMA=%g\n",image->gamma);
+      count=FormatLocaleString(header,MagickPathExtent,"GAMMA=%g\n",
+        image->gamma);
       (void) WriteBlob(image,(size_t) count,(unsigned char *) header);
     }
   count=FormatLocaleString(header,MagickPathExtent,
     "PRIMARIES=%g %g %g %g %g %g %g %g\n",
     image->chromaticity.red_primary.x,image->chromaticity.red_primary.y,
@@ -739,14 +740,15 @@ static MagickBooleanType WriteHDRImage(const ImageInfo *image_info,Image *image,
     (double) image->rows,(double) image->columns);
   (void) WriteBlob(image,(size_t) count,(unsigned char *) header);
   /*
     Write HDR pixels.
   */
-  pixels=(unsigned char *) AcquireQuantumMemory(image->columns,4*
+  pixels=(unsigned char *) AcquireQuantumMemory(image->columns+128,4*
     sizeof(*pixels));
   if (pixels == (unsigned char *) NULL)
     ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
+  (void) ResetMagickMemory(pixels,0,4*(image->columns+128)*sizeof(*pixels));
   for (y=0; y < (ssize_t) image->rows; y++)
   {
     p=GetVirtualPixels(image,0,y,image->columns,1,exception);
     if (p == (const Quantum *) NULL)
       break;

Vulnerable code:       count=FormatLocaleString(header,MagickPathExtent,"GAMMA=%g\n",image->gamma);
  pixels=(unsigned char *) AcquireQuantumMemory(image->columns,4*
Fixed code:       count=FormatLocaleString(header,MagickPathExtent,"GAMMA=%g\n",
        image->gamma);
  pixels=(unsigned char *) AcquireQuantumMemory(image->columns+128,4*
  (void) ResetMagickMemory(pixels,0,4*(image->columns+128)*sizeof(*pixels));
CVE-2016-7521: Out-of-bounds Read (CWE-125)
value: Heap-based buffer overflow in coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2017-04-20T18:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/psd.c
Commit date: 2016-02-02 21:03:24 +0100
Commit message: Moved check for https://github.com/ImageMagick/ImageMagick/issues/92.

Diff: diff --git a/coders/psd.c b/coders/psd.c
index 11d26ea852..9f69d8a712 100644
--- a/coders/psd.c
+++ b/coders/psd.c
@@ -485,10 +485,11 @@ static ssize_t DecodePSDPixels(const size_t number_compact_pixels,
         continue;
       }
     length++;
     for (j=0; j < (ssize_t) length; j++)
     {
+      CheckNumberCompactPixels;
       switch (depth)
       {
         case 1:
         {
           CheckNumberPixels(8);
@@ -523,11 +524,10 @@ static ssize_t DecodePSDPixels(const size_t number_compact_pixels,
           CheckNumberPixels(1);
           *pixels++=(*compact_pixels);
           break;
         }
       }
-      CheckNumberCompactPixels;
       compact_pixels++;
     }
   }
   return(i);
 }

Vulnerable code:       CheckNumberCompactPixels;
Fixed code:       CheckNumberCompactPixels;
CVE-2016-7522: Out-of-bounds Read (CWE-125)
value: The ReadPSDImage function in MagickCore/locale.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2017-04-19T14:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/psd.c
Commit date: 2016-02-02 21:15:13 +0100
Commit message: Added extra check to fix https://github.com/ImageMagick/ImageMagick/issues/93

Diff: diff --git a/coders/psd.c b/coders/psd.c
index 9f69d8a712..47c6bcf735 100644
--- a/coders/psd.c
+++ b/coders/psd.c
@@ -1934,11 +1934,11 @@ static Image *ReadPSDImage(const ImageInfo *image_info,ExceptionInfo *exception)
       blocks=(unsigned char *) AcquireQuantumMemory((size_t) length,
         sizeof(*blocks));
       if (blocks == (unsigned char *) NULL)
         ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
       count=ReadBlob(image,(size_t) length,blocks);
-      if ((count != (ssize_t) length) ||
+      if ((count != (ssize_t) length) || (length < 4) ||
           (LocaleNCompare((char *) blocks,"8BIM",4) != 0))
         {
           blocks=(unsigned char *) RelinquishMagickMemory(blocks);
           ThrowReaderException(CorruptImageError,"ImproperImageHeader");
         }

Vulnerable code:       if ((count != (ssize_t) length) ||
Fixed code:       if ((count != (ssize_t) length) || (length < 4) ||
CVE-2016-7524: Out-of-bounds Read (CWE-125)
value: coders/meta.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2020-02-06T14:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/meta.c
Commit date: 2016-01-24 19:10:07 -0500
Commit message: https://github.com/ImageMagick/ImageMagick/issues/96

Diff: diff --git a/coders/meta.c b/coders/meta.c
index 53fde4c0d0..96ad6c8f19 100644
--- a/coders/meta.c
+++ b/coders/meta.c
@@ -459,11 +459,11 @@ static ssize_t parse8BIM(Image *ifile, Image *ofile)
                     (void) WriteBlobMSBLong(ofile, (unsigned int) len);
                     outputlen += 4;
 
                     next=0;
                     outputlen += len;
-                    while (len--)
+                    while (len-- > 0)
                       (void) WriteBlobByte(ofile,(unsigned char) token[next++]);
 
                     if (outputlen & 1)
                       {
                         (void) WriteBlobByte(ofile,0x00);
@@ -490,11 +490,11 @@ static ssize_t parse8BIM(Image *ifile, Image *ofile)
                     (void) WriteBlobByte(ofile,(unsigned char) (recnum & 0xff));
                     (void) WriteBlobMSBShort(ofile,(unsigned short) len);
                     outputlen += 5;
                     next=0;
                     outputlen += len;
-                    while (len--)
+                    while (len-- > 0)
                       (void) WriteBlobByte(ofile,(unsigned char) token[next++]);
                   }
               }
           }
       state++;

Vulnerable code:                     while (len--)
                    while (len--)
Fixed code:                     while (len-- > 0)
                    while (len-- > 0)
CVE-2016-7525: Out-of-bounds Read (CWE-125)
value: Heap-based buffer overflow in coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2017-04-20T18:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/psd.c
Commit date: 2016-02-06 12:26:49 +0100
Commit message: Fixed head buffer overflow reported in: https://github.com/ImageMagick/ImageMagick/issues/98

Diff: diff --git a/coders/psd.c b/coders/psd.c
index ba9bbba660..d8fd950311 100644
--- a/coders/psd.c
+++ b/coders/psd.c
@@ -573,11 +573,11 @@ static inline MagickSizeType GetPSDSize(const PSDInfo *psd_info,Image *image)
 }
 
 static inline size_t GetPSDRowSize(Image *image)
 {
   if (image->depth == 1)
-    return((image->columns+7)/8);
+    return(((image->columns+7)/8)*GetPSDPacketSize(image));
   else
     return(image->columns*GetPSDPacketSize(image));
 }
 
 static const char *ModeToString(PSDImageType type)

Vulnerable code:     return((image->columns+7)/8);
Fixed code:     return(((image->columns+7)/8)*GetPSDPacketSize(image));
CVE-2016-7526: Out-of-bounds Write (CWE-787)
value: coders/wpg.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2017-04-20T18:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/wpg.c
Commit date: 2016-01-30 10:21:15 -0500
Commit message: https://github.com/ImageMagick/ImageMagick/issues/102

Diff: diff --git a/coders/wpg.c b/coders/wpg.c
index 4e4f8f1e89..e35a97c4d8 100644
--- a/coders/wpg.c
+++ b/coders/wpg.c
@@ -315,11 +315,11 @@ static void InsertRow(Image *image,unsigned char *p,ssize_t y,int bpp,
     case 2:  /* Convert PseudoColor scanline. */
       {
         q=QueueAuthenticPixels(image,0,y,image->columns,1,exception);
         if (q == (Quantum *) NULL)
           break;
-        for (x=0; x < ((ssize_t) image->columns-1); x+=2)
+        for (x=0; x < ((ssize_t) image->columns-1); x+=4)
         {
             index=ConstrainColormapIndex(image,(*p >> 6) & 0x3,exception);
             SetPixelIndex(image,index,q);
             SetPixelViaPixelInfo(image,image->colormap+(ssize_t) index,q);
             q+=GetPixelChannels(image);

Vulnerable code:         for (x=0; x < ((ssize_t) image->columns-1); x+=2)
Fixed code:         for (x=0; x < ((ssize_t) image->columns-1); x+=4)
CVE-2016-7527: Out-of-bounds Read (CWE-125)
value: coders/wpg.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2017-04-20T18:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/wpg.c
Commit date: 2016-02-05 21:08:44 -0500
Commit message: https://github.com/ImageMagick/ImageMagick/issues/122

Diff: diff --git a/coders/wpg.c b/coders/wpg.c
index e35a97c4d8..964530533e 100644
--- a/coders/wpg.c
+++ b/coders/wpg.c
@@ -782,11 +782,11 @@ static Image *ExtractPostscript(Image *image,const ImageInfo *image_info,
   if(magic_info == (const MagicInfo *) NULL) goto FINISH_UNL;
   /*     printf("Detected:%s  \n",magic_info->name); */
   if(exception->severity != UndefinedException) goto FINISH_UNL;     
   if(magic_info->name == (char *) NULL) goto FINISH_UNL;
     
-  (void) CopyMagickMemory(clone_info->magick,magic_info->name,MagickPathExtent);
+  (void) strncpy(clone_info->magick,magic_info->name,MagickPathExtent);
   
     /* Read nested image */
   /*FormatString(clone_info->filename,"%s:%s",magic_info->name,postscript_file);*/
   FormatLocaleString(clone_info->filename,MagickPathExtent,"%s",postscript_file);
   image2=ReadImage(clone_info,exception);

Vulnerable code:   (void) CopyMagickMemory(clone_info->magick,magic_info->name,MagickPathExtent);
Fixed code:   (void) strncpy(clone_info->magick,magic_info->name,MagickPathExtent);
CVE-2016-7528: Out-of-bounds Read (CWE-125)
value: The ReadVIFFImage function in coders/viff.c in ImageMagick allows remote attackers to cause a denial of service (segmentation fault) via a crafted VIFF file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2017-04-19T14:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/viff.c
Commit date: 2016-01-24 17:43:46 -0500
Commit message: https://github.com/ImageMagick/ImageMagick/issues/99

Diff: diff --git a/coders/viff.c b/coders/viff.c
index 27d1412b2b..2c72812280 100644
--- a/coders/viff.c
+++ b/coders/viff.c
@@ -500,12 +500,12 @@ static Image *ReadVIFFImage(const ImageInfo *image_info,
     }
     if (viff_info.data_storage_type == VFF_TYP_BIT)
       max_packets=((image->columns+7UL) >> 3UL)*image->rows;
     else
       max_packets=(size_t) (number_pixels*viff_info.number_data_bands);
-    pixels=(unsigned char *) AcquireQuantumMemory(max_packets,
-      bytes_per_pixel*sizeof(*pixels));
+    pixels=(unsigned char *) AcquireQuantumMemory(MagickMax(number_pixels,
+      max_packets),bytes_per_pixel*sizeof(*pixels));
     if (pixels == (unsigned char *) NULL)
       ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
     count=ReadBlob(image,bytes_per_pixel*max_packets,pixels);
     lsb_first=1;
     if (*(char *) &lsb_first &&

Vulnerable code:     pixels=(unsigned char *) AcquireQuantumMemory(max_packets,
      bytes_per_pixel*sizeof(*pixels));
Fixed code:     pixels=(unsigned char *) AcquireQuantumMemory(MagickMax(number_pixels,
      max_packets),bytes_per_pixel*sizeof(*pixels));
CVE-2016-7529: Out-of-bounds Read (CWE-125)
value: coders/xcf.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted XCF file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2017-04-19T14:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/xcf.c
Commit date: 2016-01-30 09:51:24 -0500
Commit message: https://github.com/ImageMagick/ImageMagick/issues/104

Diff: diff --git a/coders/xcf.c b/coders/xcf.c
index 0fdc546561..b8075bb682 100644
--- a/coders/xcf.c
+++ b/coders/xcf.c
@@ -345,11 +345,12 @@ static MagickBooleanType load_tile(Image *image,Image *tile_image,
 
   XCFPixelInfo
     *xcfdata,
     *xcfodata;
 
-  xcfdata=(XCFPixelInfo *) AcquireQuantumMemory(data_length,sizeof(*xcfdata));
+  xcfdata=(XCFPixelInfo *) AcquireQuantumMemory(MagickMax(data_length,
+    tile_image->columns*tile_image->rows),sizeof(*xcfdata));
   if (xcfdata == (XCFPixelInfo *) NULL)
     ThrowBinaryException(ResourceLimitError,"MemoryAllocationFailed",
       image->filename);
   xcfodata=xcfdata;
   graydata=(unsigned char *) xcfdata;  /* used by gray and indexed */

Vulnerable code:   xcfdata=(XCFPixelInfo *) AcquireQuantumMemory(data_length,sizeof(*xcfdata));
Fixed code:   xcfdata=(XCFPixelInfo *) AcquireQuantumMemory(MagickMax(data_length,
    tile_image->columns*tile_image->rows),sizeof(*xcfdata));
CVE-2016-7530: Divide By Zero (CWE-369)
value: The quantum handling code in ImageMagick allows remote attackers to cause a denial of service (divide-by-zero error or out-of-bounds write) via a crafted file.
CWE description: The product divides a value by zero.
CVSS v3 base score: 6.5
Published: 2017-04-20T18:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: MagickCore/quantum.c
Commit date: 2016-01-30 09:37:10 -0500
Commit message: https://github.com/ImageMagick/ImageMagick/issues/105

Diff: diff --git a/MagickCore/quantum.c b/MagickCore/quantum.c
index ae65605543..9d8190a903 100644
--- a/MagickCore/quantum.c
+++ b/MagickCore/quantum.c
@@ -302,10 +302,11 @@ static void DestroyQuantumPixels(QuantumInfo *quantum_info)
 */
 MagickExport size_t GetQuantumExtent(const Image *image,
   const QuantumInfo *quantum_info,const QuantumType quantum_type)
 {
   size_t
+    extent,
     packet_size;
 
   assert(quantum_info != (QuantumInfo *) NULL);
   assert(quantum_info->signature == MagickCoreSignature);
   packet_size=1;
@@ -320,13 +321,14 @@ MagickExport size_t GetQuantumExtent(const Image *image,
     case BGRAQuantum: packet_size=4; break;
     case CMYKQuantum: packet_size=4; break;
     case CMYKAQuantum: packet_size=5; break;
     default: break;
   }
+  extent=MagickMax(image->columns,image->rows);
   if (quantum_info->pack == MagickFalse)
-    return((size_t) (packet_size*image->columns*((quantum_info->depth+7)/8)));
-  return((size_t) ((packet_size*image->columns*quantum_info->depth+7)/8));
+    return((size_t) (packet_size*extent*((quantum_info->depth+7)/8)));
+  return((size_t) ((packet_size*extent*quantum_info->depth+7)/8));
 }
 
 /*
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 %                                                                             %
@@ -681,12 +683,13 @@ MagickExport MagickBooleanType SetQuantumDepth(const Image *image,
           quantum_info->depth=16;
     }
   if (quantum_info->pixels != (unsigned char **) NULL)
     DestroyQuantumPixels(quantum_info);
   quantum=(quantum_info->pad+6)*(quantum_info->depth+7)/8;
-  extent=image->columns*quantum;
-  if ((image->columns != 0) && (quantum != (extent/image->columns)))
+  extent=MagickMax(image->columns,image->rows)*quantum;
+  if ((MagickMax(image->columns,image->rows) != 0) &&
+      (quantum != (extent/MagickMax(image->columns,image->rows))))
     return(MagickFalse);
   return(AcquireQuantumPixels(quantum_info,extent));
 }
 
 /*

Vulnerable code:     return((size_t) (packet_size*image->columns*((quantum_info->depth+7)/8)));
  return((size_t) ((packet_size*image->columns*quantum_info->depth+7)/8));
  extent=image->columns*quantum;
  if ((image->columns != 0) && (quantum != (extent/image->columns)))
Fixed code:     extent,
  extent=MagickMax(image->columns,image->rows);
    return((size_t) (packet_size*extent*((quantum_info->depth+7)/8)));
  return((size_t) ((packet_size*extent*quantum_info->depth+7)/8));
  extent=MagickMax(image->columns,image->rows)*quantum;
  if ((MagickMax(image->columns,image->rows) != 0) &&
      (quantum != (extent/MagickMax(image->columns,image->rows))))
CVE-2016-7532: Out-of-bounds Read (CWE-125)
value: coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2017-04-20T18:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/psd.c
Commit date: 2016-02-02 21:35:45 +0100
Commit message: Added check for out of bounds read (https://github.com/ImageMagick/ImageMagick/issues/108).

Diff: diff --git a/coders/psd.c b/coders/psd.c
index 47c6bcf735..ba9bbba660 100644
--- a/coders/psd.c
+++ b/coders/psd.c
@@ -2603,32 +2603,37 @@ static void RemoveResolutionFromResourceBlock(StringInfo *bim_profile)
   for (p=datum; (p >= datum) && (p < (datum+length-16)); )
   {
     register unsigned char
       *q;
 
+    ssize_t
+      cnt;
+
     q=(unsigned char *) p;
     if (LocaleNCompare((const char *) p,"8BIM",4) != 0)
-      break;
+      return;
     p=PushLongPixel(MSBEndian,p,&long_sans);
     p=PushShortPixel(MSBEndian,p,&id);
     p=PushShortPixel(MSBEndian,p,&short_sans);
     p=PushLongPixel(MSBEndian,p,&count);
-    if ((id == 0x000003ed) && (PSDQuantum(count) < (ssize_t) (length-12)))
+    cnt=PSDQuantum(count);
+    if (cnt < 0)
+      return;
+    if ((id == 0x000003ed) && (cnt < (ssize_t) (length-12)))
       {
-        (void) CopyMagickMemory(q,q+PSDQuantum(count)+12,length-
-          (PSDQuantum(count)+12)-(q-datum));
-        SetStringInfoLength(bim_profile,length-(PSDQuantum(count)+12));
+        (void) CopyMagickMemory(q,q+cnt+12,length-(cnt+12)-(q-datum));
+        SetStringInfoLength(bim_profile,length-(cnt+12));
         break;
       }
     p+=count;
     if ((count & 0x01) != 0)
       p++;
   }
 }
 
-static MagickBooleanType WritePSDImage(const ImageInfo *image_info,Image *image,
-  ExceptionInfo *exception)
+static MagickBooleanType WritePSDImage(const ImageInfo *image_info,
+  Image *image,ExceptionInfo *exception)
 {
   const char
     *property;
 
   const StringInfo

Vulnerable code:       break;
    if ((id == 0x000003ed) && (PSDQuantum(count) < (ssize_t) (length-12)))
        (void) CopyMagickMemory(q,q+PSDQuantum(count)+12,length-
          (PSDQuantum(count)+12)-(q-datum));
        SetStringInfoLength(bim_profile,length-(PSDQuantum(count)+12));
static MagickBooleanType WritePSDImage(const ImageInfo *image_info,Image *image,
  ExceptionInfo *exception)
Fixed code:     ssize_t
      cnt;

      return;
    cnt=PSDQuantum(count);
    if (cnt < 0)
      return;
    if ((id == 0x000003ed) && (cnt < (ssize_t) (length-12)))
        (void) CopyMagickMemory(q,q+cnt+12,length-(cnt+12)-(q-datum));
        SetStringInfoLength(bim_profile,length-(cnt+12));
static MagickBooleanType WritePSDImage(const ImageInfo *image_info,
  Image *image,ExceptionInfo *exception)
CVE-2016-7533: Out-of-bounds Read (CWE-125)
value: The ReadWPGImage function in coders/wpg.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WPG file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2017-04-19T14:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/wpg.c
Commit date: 2016-02-05 21:20:42 -0500
Commit message: https://github.com/ImageMagick/ImageMagick/issues/120

Diff: diff --git a/coders/wpg.c b/coders/wpg.c
index 964530533e..b01dcf9cc6 100644
--- a/coders/wpg.c
+++ b/coders/wpg.c
@@ -1329,11 +1329,11 @@ static Image *ReadWPGImage(const ImageInfo *image_info,
                 {
                 case 0:    /*Uncompressed raster*/
                   {
                     ldblk=(ssize_t) ((bpp*image->columns+7)/8);
                     BImgBuff=(unsigned char *) AcquireQuantumMemory((size_t)
-                      ldblk,sizeof(*BImgBuff));
+                      ldblk+1,sizeof(*BImgBuff));
                     if (BImgBuff == (unsigned char *) NULL)
                       goto NoMemory;
 
                     for(i=0; i< (ssize_t) image->rows; i++)
                       {

Vulnerable code:                       ldblk,sizeof(*BImgBuff));
Fixed code:                       ldblk+1,sizeof(*BImgBuff));