Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2019-13307: Out-of-bounds Write (CWE-787)
value: ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling rows.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2019-07-05T01:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: MagickCore/statistic.c
Commit date: 2019-06-22 08:24:14 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1615

Diff: diff --git a/MagickCore/statistic.c b/MagickCore/statistic.c
index 50d56fcf77a..b5ed38c6174 100644
--- a/MagickCore/statistic.c
+++ b/MagickCore/statistic.c
@@ -161,22 +161,21 @@ static PixelChannels **AcquirePixelThreadSet(const Image *images)
   register ssize_t
     i;
 
   size_t
     columns,
-    number_threads;
+    rows;
 
-  number_threads=(size_t) GetMagickResourceLimit(ThreadResource);
-  pixels=(PixelChannels **) AcquireQuantumMemory(number_threads,
-    sizeof(*pixels));
+  rows=MagickMax(GetImageListLength(images),
+    (size_t) GetMagickResourceLimit(ThreadResource));
+  pixels=(PixelChannels **) AcquireQuantumMemory(rows,sizeof(*pixels));
   if (pixels == (PixelChannels **) NULL)
     return((PixelChannels **) NULL);
-  (void) memset(pixels,0,number_threads*sizeof(*pixels));
-  columns=images->columns;
+  columns=MaxPixelChannels;
   for (next=images; next != (Image *) NULL; next=next->next)
     columns=MagickMax(next->columns,columns);
-  for (i=0; i < (ssize_t) number_threads; i++)
+  for (i=0; i < (ssize_t) rows; i++)
   {
     register ssize_t
       j;
 
     pixels[i]=(PixelChannels *) AcquireQuantumMemory(columns,sizeof(**pixels));

Vulnerable code:     number_threads;
  number_threads=(size_t) GetMagickResourceLimit(ThreadResource);
  pixels=(PixelChannels **) AcquireQuantumMemory(number_threads,
    sizeof(*pixels));
  (void) memset(pixels,0,number_threads*sizeof(*pixels));
  columns=images->columns;
  for (i=0; i < (ssize_t) number_threads; i++)
Fixed code:     rows;
  rows=MagickMax(GetImageListLength(images),
    (size_t) GetMagickResourceLimit(ThreadResource));
  pixels=(PixelChannels **) AcquireQuantumMemory(rows,sizeof(*pixels));
  columns=MaxPixelChannels;
  for (i=0; i < (ssize_t) rows; i++)
CVE-2019-14980: Use After Free (CWE-416)
value: In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in the UnmapBlob function that allows an attacker to cause a denial of service by sending a crafted file.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 6.5
Published: 2019-08-12T23:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: MagickCore/blob.c
Commit date: 2019-04-22 12:43:09 -0400
Commit message: https://github.com/ImageMagick/ImageMagick6/issues/43

Diff: diff --git a/MagickCore/blob.c b/MagickCore/blob.c
index 7de1023f69ce..70760a83b687 100644
--- a/MagickCore/blob.c
+++ b/MagickCore/blob.c
@@ -994,10 +994,11 @@ MagickExport void *DetachBlob(BlobInfo *blob_info)
   if (blob_info->debug != MagickFalse)
     (void) LogMagickEvent(TraceEvent,GetMagickModule(),"...");
   if (blob_info->mapped != MagickFalse)
     {
       (void) UnmapBlob(blob_info->data,blob_info->length);
+      blob_info->data=NULL;
       RelinquishMagickResource(MapResource,blob_info->length);
     }
   blob_info->mapped=MagickFalse;
   blob_info->length=0;
   blob_info->offset=0;

Fixed code:       blob_info->data=NULL;
CVE-2019-14981: Divide By Zero (CWE-369)
value: In ImageMagick 7.x before 7.0.8-41 and 6.x before 6.9.10-41, there is a divide-by-zero vulnerability in the MeanShiftImage function. It allows an attacker to cause a denial of service by sending a crafted file.
CWE description: The product divides a value by zero.
CVSS v3 base score: 6.5
Published: 2019-08-12T23:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: MagickCore/feature.c
Commit date: 2019-04-18 19:55:30 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1552

Diff: diff --git a/MagickCore/feature.c b/MagickCore/feature.c
index a0205ba158c5..a17a65b22b72 100644
--- a/MagickCore/feature.c
+++ b/MagickCore/feature.c
@@ -2286,11 +2286,11 @@ MagickExport Image *MeanShiftImage(const Image *image,const size_t width,
                     count++;
                   }
               }
           }
         }
-        gamma=1.0/count;
+        gamma=PerceptibleReciprocal(count);
         mean_location.x=gamma*sum_location.x;
         mean_location.y=gamma*sum_location.y;
         mean_pixel.red=gamma*sum_pixel.red;
         mean_pixel.green=gamma*sum_pixel.green;
         mean_pixel.blue=gamma*sum_pixel.blue;

Vulnerable code:         gamma=1.0/count;
Fixed code:         gamma=PerceptibleReciprocal(count);
CVE-2019-17547: Use After Free (CWE-416)
value: In ImageMagick before 7.0.8-62, TraceBezier in MagickCore/draw.c has a use-after-free.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 8.8
Published: 2019-10-14T02:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: MagickCore/draw.c
Commit date: 2019-08-18 08:33:19 -0400
Commit message: ...

Diff: diff --git a/MagickCore/draw.c b/MagickCore/draw.c
index 7ad56a8bfe9f..71b9e482a36c 100644
--- a/MagickCore/draw.c
+++ b/MagickCore/draw.c
@@ -6157,12 +6157,12 @@ static MagickBooleanType TraceBezier(MVGInfo *mvg_info,
         }
       if (alpha > (double) quantum)
         quantum=(size_t) alpha;
     }
   }
-  quantum=MagickMin(quantum/number_coordinates,BezierQuantum);
   primitive_info=(*mvg_info->primitive_info)+mvg_info->offset;
+  quantum=MagickMin(quantum/number_coordinates,BezierQuantum);
   coefficients=(double *) AcquireQuantumMemory(number_coordinates,
     sizeof(*coefficients));
   points=(PointInfo *) AcquireQuantumMemory(quantum,number_coordinates*
     sizeof(*points));
   if ((coefficients == (double *) NULL) || (points == (PointInfo *) NULL))
@@ -6180,10 +6180,11 @@ static MagickBooleanType TraceBezier(MVGInfo *mvg_info,
     {
       points=(PointInfo *) RelinquishMagickMemory(points);
       coefficients=(double *) RelinquishMagickMemory(coefficients);
       return(MagickFalse);
     }
+  primitive_info=(*mvg_info->primitive_info)+mvg_info->offset;
   /*
     Compute bezier points.
   */
   end=primitive_info[number_coordinates-1].point;
   for (i=0; i < (ssize_t) number_coordinates; i++)

Vulnerable code:   quantum=MagickMin(quantum/number_coordinates,BezierQuantum);
Fixed code:   quantum=MagickMin(quantum/number_coordinates,BezierQuantum);
  primitive_info=(*mvg_info->primitive_info)+mvg_info->offset;
CVE-2019-18853: Uncontrolled Recursion (CWE-674)
value: ImageMagick before 7.0.9-0 allows remote attackers to cause a denial of service because XML_PARSE_HUGE is not properly restricted in coders/svg.c, related to SVG and libxml2.
CWE description: The product does not properly control the amount of recursion that takes place,  consuming excessive resources, such as allocated memory or the program stack.
CVSS v3 base score: 6.5
Published: 2019-11-11T15:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/svg.c
Commit date: 2019-10-23 06:01:08 -0400
Commit message: [FG-VD-19-136] ImageMagick Convert SVG MacOS Denial Of Service

Diff: diff --git a/coders/svg.c b/coders/svg.c
index 2bc3c1f6b720..1875ad04df0b 100644
--- a/coders/svg.c
+++ b/coders/svg.c
@@ -63,13 +63,14 @@
 #include "MagickCore/memory_.h"
 #include "MagickCore/memory-private.h"
 #include "MagickCore/module.h"
 #include "MagickCore/monitor.h"
 #include "MagickCore/monitor-private.h"
-#include "MagickCore/quantum-private.h"
+#include "MagickCore/option.h"
 #include "MagickCore/pixel-accessor.h"
 #include "MagickCore/property.h"
+#include "MagickCore/quantum-private.h"
 #include "MagickCore/resource_.h"
 #include "MagickCore/static.h"
 #include "MagickCore/string_.h"
 #include "MagickCore/string-private.h"
 #include "MagickCore/token.h"
@@ -3577,13 +3578,18 @@ static Image *ReadSVGImage(const ImageInfo *image_info,ExceptionInfo *exception)
   sax_handler=(&sax_modules);
   n=ReadBlob(image,MagickPathExtent-1,message);
   message[n]='\0';
   if (n > 0)
     {
+      const char
+        *value;
+
       svg_info->parser=xmlCreatePushParserCtxt(sax_handler,svg_info,(char *)
         message,n,image->filename);
-      (void) xmlCtxtUseOptions(svg_info->parser,XML_PARSE_HUGE);
+      value=GetImageOption(image_info,"svg:xml-parse-huge");
+      if ((value != (char *) NULL) && (IsStringTrue(value) != MagickFalse))
+        (void) xmlCtxtUseOptions(svg_info->parser,XML_PARSE_HUGE);
       while ((n=ReadBlob(image,MagickPathExtent-1,message)) != 0)
       {
         message[n]='\0';
         status=xmlParseChunk(svg_info->parser,(char *) message,(int) n,0);
         if (status != 0)

Vulnerable code: #include "MagickCore/quantum-private.h"
      (void) xmlCtxtUseOptions(svg_info->parser,XML_PARSE_HUGE);
Fixed code: #include "MagickCore/option.h"
#include "MagickCore/quantum-private.h"
      const char
        *value;

      value=GetImageOption(image_info,"svg:xml-parse-huge");
      if ((value != (char *) NULL) && (IsStringTrue(value) != MagickFalse))
        (void) xmlCtxtUseOptions(svg_info->parser,XML_PARSE_HUGE);
CVE-2019-7175: Missing Release of Memory after Effective Lifetime (CWE-401)
value: In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c.
CWE description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CVSS v3 base score: 7.5
Published: 2019-03-07T23:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/pcd.c
Commit date: 2019-01-20 11:11:52 -0500
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1450

Diff: diff --git a/coders/pcd.c b/coders/pcd.c
index 8eb8ac6526b4..7e48c138c60b 100644
--- a/coders/pcd.c
+++ b/coders/pcd.c
@@ -202,10 +202,12 @@ static MagickBooleanType DecodeImage(Image *image,unsigned char *luma,
     pcd_table[i]=(PCDTable *) AcquireQuantumMemory(length,
       sizeof(*pcd_table[i]));
     if (pcd_table[i] == (PCDTable *) NULL)
       {
         buffer=(unsigned char *) RelinquishMagickMemory(buffer);
+        for (j=0; j < i; j++)
+          pcd_table[j]=(PCDTable *) RelinquishMagickMemory(pcd_table[j]);
         ThrowBinaryException(ResourceLimitError,"MemoryAllocationFailed",
           image->filename);
       }
     r=pcd_table[i];
     for (j=0; j < (ssize_t) length; j++)
@@ -213,10 +215,12 @@ static MagickBooleanType DecodeImage(Image *image,unsigned char *luma,
       PCDGetBits(8);
       r->length=(unsigned int) (sum & 0xff)+1;
       if (r->length > 16)
         {
           buffer=(unsigned char *) RelinquishMagickMemory(buffer);
+          for (j=0; j <= i; j++)
+            pcd_table[j]=(PCDTable *) RelinquishMagickMemory(pcd_table[j]);
           return(MagickFalse);
         }
       PCDGetBits(16);
       r->sequence=(unsigned int) (sum & 0xffff) << 16;
       PCDGetBits(8);

Fixed code:         for (j=0; j < i; j++)
          pcd_table[j]=(PCDTable *) RelinquishMagickMemory(pcd_table[j]);
          for (j=0; j <= i; j++)
            pcd_table[j]=(PCDTable *) RelinquishMagickMemory(pcd_table[j]);
CVE-2019-7395: Missing Release of Memory after Effective Lifetime (CWE-401)
value: In ImageMagick before 7.0.8-25, a memory leak exists in WritePSDChannel in coders/psd.c.
CWE description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CVSS v3 base score: 7.5
Published: 2019-02-05T00:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/psd.c
Commit date: 2019-01-20 11:04:31 -0500
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1451

Diff: diff --git a/coders/psd.c b/coders/psd.c
index 95dd4e6bb2e5..7bbd3af4ea75 100644
--- a/coders/psd.c
+++ b/coders/psd.c
@@ -2780,10 +2780,12 @@ static size_t WritePSDChannel(const PSDInfo *psd_info,
       if ((image_info->quality > 0 && image_info->quality < 10))
         level=(int) image_info->quality;
       if (deflateInit(&stream,level) != Z_OK)
         {
           quantum_info=DestroyQuantumInfo(quantum_info);
+          compressed_pixels=(unsigned char *) RelinquishMagickMemory(
+            compressed_pixels);
           return(0);
         }
     }
 #endif
   for (y=0; y < (ssize_t) next_image->rows; y++)

Fixed code:           compressed_pixels=(unsigned char *) RelinquishMagickMemory(
            compressed_pixels);
CVE-2019-7396: Missing Release of Memory after Effective Lifetime (CWE-401)
value: In ImageMagick before 7.0.8-25, a memory leak exists in ReadSIXELImage in coders/sixel.c.
CWE description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CVSS v3 base score: 7.5
Published: 2019-02-05T00:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/sixel.c
Commit date: 2019-01-20 11:01:24 -0500
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1452

Diff: diff --git a/coders/sixel.c b/coders/sixel.c
index a8a658f352ce..ae32db87490b 100644
--- a/coders/sixel.c
+++ b/coders/sixel.c
@@ -1055,10 +1055,11 @@ static Image *ReadSIXELImage(const ImageInfo *image_info,ExceptionInfo *exceptio
     Decode SIXEL
   */
   if (sixel_decode(image,(unsigned char *) sixel_buffer,&sixel_pixels,&image->columns,&image->rows,&sixel_palette,&image->colors,exception) == MagickFalse)
     {
       sixel_buffer=(char *) RelinquishMagickMemory(sixel_buffer);
+      sixel_pixels=(unsigned char *) RelinquishMagickMemory(sixel_pixels);
       ThrowReaderException(CorruptImageError,"CorruptImage");
     }
   sixel_buffer=(char *) RelinquishMagickMemory(sixel_buffer);
   image->depth=24;
   image->storage_class=PseudoClass;

Fixed code:       sixel_pixels=(unsigned char *) RelinquishMagickMemory(sixel_pixels);
CVE-2020-27560: Divide By Zero (CWE-369)
value: ImageMagick 7.0.10-34 allows Division by Zero in OptimizeLayerFrames in MagickCore/layer.c, which may cause a denial of service.
CWE description: The product divides a value by zero.
CVSS v3 base score: 3.3
Published: 2020-10-22T14:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: MagickCore/layer.c
Commit date: 2020-10-18 21:18:07 -0400
Commit message: There is a Division by Zero in function OptimizeLayerFrames (#2743)

in file MagickCore/layer.c. cur->ticks_per_seconds can be zero
with a crafted input argument *image. This is similar to
CVE-2019-13454.
Diff: diff --git a/MagickCore/layer.c b/MagickCore/layer.c
index 4ac847a1c10e..63bda6d1a761 100644
--- a/MagickCore/layer.c
+++ b/MagickCore/layer.c
@@ -1350,15 +1350,17 @@ static Image *OptimizeLayerFrames(const Image *image,const LayerMethod method,
       break;
     prev_image->background_color.alpha_trait=BlendPixelTrait;
     if ( disposals[i] == DelDispose ) {
       size_t time = 0;
       while ( disposals[i] == DelDispose ) {
-        time += curr->delay*1000/curr->ticks_per_second;
+        time +=(size_t) (curr->delay*1000*
+          PerceptibleReciprocal((double) curr->ticks_per_second));
         curr=GetNextImageInList(curr);
         i++;
       }
-      time += curr->delay*1000/curr->ticks_per_second;
+      time += (size_t)(curr->delay*1000*
+        PerceptibleReciprocal((double) curr->ticks_per_second));
       prev_image->ticks_per_second = 100L;
       prev_image->delay = time*prev_image->ticks_per_second/1000;
     }
     bgnd_image=CropImage(prev_image,&bounds[i],sans_exception);
     prev_image=DestroyImage(prev_image);

Vulnerable code:         time += curr->delay*1000/curr->ticks_per_second;
      time += curr->delay*1000/curr->ticks_per_second;
Fixed code:         time +=(size_t) (curr->delay*1000*
          PerceptibleReciprocal((double) curr->ticks_per_second));
      time += (size_t)(curr->delay*1000*
        PerceptibleReciprocal((double) curr->ticks_per_second));
CVE-2020-27829: Heap-based Buffer Overflow (CWE-122)
value: A heap based buffer overflow in coders/tiff.c may result in program crash and denial of service in ImageMagick before 7.0.10-45.
CWE description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CVSS v3 base score: 5.5
Published: 2021-03-26T17:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: Other
Files changed: ChangeLog, coders/tiff.c
Commit date: 2020-11-30 16:27:41 +0000
Commit message: possible TIFF related-heap buffer overflow (alert & POC by Hardik Shah)

Diff: diff --git a/ChangeLog b/ChangeLog
index a85cf222eb11..4a21e9a5c6be 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,11 @@
+2020-11-30  7.0.10-46  <quetzlzacatenango@image...>
+  * Release ImageMagick version 7.0.10-46 GIT revision 17...
+
+2020-11-30  7.0.10-45  <quetzlzacatenango@image...>
+  * possible TIFF related-heap buffer overflow (alert & POC by Hardik Shah).
+
 2020-11-30  7.0.10-45  <quetzlzacatenango@image...>
   * Release ImageMagick version 7.0.10-45 GIT revision 17972:6c0cb7f72:20201130
 
 2020-11-30  7.0.10-45  Dirk Lemstra <dirk@lem.....org>
   * added support for the farbfeld format (reference
diff --git a/coders/tiff.c b/coders/tiff.c
index e98f927abd00..1eecf17aea8a 100644
--- a/coders/tiff.c
+++ b/coders/tiff.c
@@ -1973,11 +1973,11 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
         extent+=image->columns*sizeof(uint64);
 #else
         extent+=image->columns*sizeof(uint32);
 #endif
         strip_pixels=(unsigned char *) AcquireQuantumMemory(extent,
-          sizeof(*strip_pixels));
+          2*sizeof(*strip_pixels));
         if (strip_pixels == (unsigned char *) NULL)
           ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed");
         (void) memset(strip_pixels,0,extent*sizeof(*strip_pixels));
         stride=TIFFVStripSize(tiff,1);
         strip_id=0;

Vulnerable code:           sizeof(*strip_pixels));
Fixed code: 2020-11-30  7.0.10-46  <quetzlzacatenango@image...>
  * Release ImageMagick version 7.0.10-46 GIT revision 17...

2020-11-30  7.0.10-45  <quetzlzacatenango@image...>
  * possible TIFF related-heap buffer overflow (alert & POC by Hardik Shah).

          2*sizeof(*strip_pixels));
CVE-2021-3574: Missing Release of Memory after Effective Lifetime (CWE-401)
value: A vulnerability was found in ImageMagick-7.0.11-5, where executing a crafted file with the convert command, ASAN detects memory leaks.
CWE description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CVSS v3 base score: 3.3
Published: 2022-08-26T16:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/tiff.c
Commit date: 2021-04-13 21:41:43 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/3540

Diff: diff --git a/coders/tiff.c b/coders/tiff.c
index b778aa18ef53..c6a56f3bcb6a 100644
--- a/coders/tiff.c
+++ b/coders/tiff.c
@@ -1358,10 +1358,15 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
         ((bits_per_sample <= 0) || (bits_per_sample > 32)))
       {
         TIFFClose(tiff);
         ThrowReaderException(CorruptImageError,"UnsupportedBitsPerPixel");
       }
+    if (samples_per_pixel > MaxPixelChannels)
+      {
+        TIFFClose(tiff);
+        ThrowReaderException(CorruptImageError,"MaximumChannelsExceeded");
+      }
     if (sample_format == SAMPLEFORMAT_IEEEFP)
       (void) SetImageProperty(image,"quantum:format","floating-point",
         exception);
     switch (photometric)
     {
@@ -1726,15 +1731,10 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
                 }
           }
       }
     if (image->alpha_trait != UndefinedPixelTrait)
       (void) SetImageAlphaChannel(image,OpaqueAlphaChannel,exception);
-    if (samples_per_pixel > MaxPixelChannels)
-      {
-        TIFFClose(tiff);
-        ThrowReaderException(CorruptImageError,"MaximumChannelsExceeded");
-      }
     method=ReadGenericMethod;
     rows_per_strip=(uint32) image->rows;
     if (TIFFGetField(tiff,TIFFTAG_ROWSPERSTRIP,&rows_per_strip) == 1)
       {
         char

Vulnerable code:     if (samples_per_pixel > MaxPixelChannels)
      {
        TIFFClose(tiff);
        ThrowReaderException(CorruptImageError,"MaximumChannelsExceeded");
      }
Fixed code:     if (samples_per_pixel > MaxPixelChannels)
      {
        TIFFClose(tiff);
        ThrowReaderException(CorruptImageError,"MaximumChannelsExceeded");
      }
CVE-2021-3610: Out-of-bounds Write (CWE-787)
value: A heap-based buffer overflow vulnerability was found in ImageMagick in versions prior to 7.0.11-14 in ReadTIFFImage() in coders/tiff.c. This issue is due to an incorrect setting of the pixel array size, which can lead to a crash and segmentation fault.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2022-02-24T19:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/tiff.c
Commit date: 2021-05-27 10:32:27 -0400
Commit message: eliminate heap buffer overflow vulnerability, thanks to ZhangJiaxing (@r0fm1a) from Codesafe Team of Legendsec at Qi'anxin Group

Diff: diff --git a/coders/tiff.c b/coders/tiff.c
index 277b9788be53..b88ce368ba55 100644
--- a/coders/tiff.c
+++ b/coders/tiff.c
@@ -1892,11 +1892,11 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
           *strip_pixels;
 
         /*
           Convert stripped TIFF image.
         */
-        extent=2*TIFFStripSize(tiff);
+        extent=4*TIFFStripSize(tiff);
 #if defined(TIFF_VERSION_BIG)
         extent+=image->columns*sizeof(uint64);
 #else
         extent+=image->columns*sizeof(uint32);
 #endif

Vulnerable code:         extent=2*TIFFStripSize(tiff);
Fixed code:         extent=4*TIFFStripSize(tiff);
CVE-2021-39212: Exposure of Resource to Wrong Sphere (CWE-668)
value: ImageMagick is free software delivered as a ready-to-run binary distribution or as source code that you may use, copy, modify, and distribute in both open and proprietary applications. In affected versions and in certain cases, Postscript files could be read and written when specifically excluded by a `module` policy in `policy.xml`. ex. <policy domain="module" rights="none" pattern="PS" />. The issue has been resolved in ImageMagick 7.1.0-7 and in 6.9.12-22. Fortunately, in the wild, few users utilize the `module` policy and instead use the `coder` policy that is also our workaround recommendation: <policy domain="coder" rights="none" pattern="{PS,EPI,EPS,EPSF,EPSI}" />.
CWE description: The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
CVSS v3 base score: 3.6
Published: 2021-09-13T18:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: MagickCore/static.c
Commit date: 2021-09-11 12:30:42 +0200
Commit message: Added missing policy checks in RegisterStaticModules.

Diff: diff --git a/MagickCore/static.c b/MagickCore/static.c
index 766ddf6821b6..120c39e3c819 100644
--- a/MagickCore/static.c
+++ b/MagickCore/static.c
@@ -238,11 +238,11 @@ MagickExport MagickBooleanType RegisterStaticModule(const char *module,
   assert(module != (const char *) NULL);
   (void) CopyMagickString(module_name,module,MagickPathExtent);
   p=GetCoderInfo(module,exception);
   if (p != (CoderInfo *) NULL)
     (void) CopyMagickString(module_name,p->name,MagickPathExtent);
-  rights=ReadPolicyRights;
+  rights=AllPolicyRights;
   if (IsRightsAuthorized(ModulePolicyDomain,rights,module_name) == MagickFalse)
     {
       errno=EPERM;
       (void) ThrowMagickException(exception,GetMagickModule(),PolicyError,
         "NotAuthorized","`%s'",module);
@@ -292,10 +292,13 @@ MagickExport void RegisterStaticModules(void)
   extent=sizeof(MagickModules)/sizeof(MagickModules[0]);
   for (i=0; i < (ssize_t) extent; i++)
   {
     if (MagickModules[i].registered == MagickFalse)
       {
+        if (IsRightsAuthorized(ModulePolicyDomain,AllPolicyRights,
+              MagickModules[i].module) == MagickFalse)
+          continue;
         (void) (MagickModules[i].register_module)();
         MagickModules[i].registered=MagickTrue;
       }
   }
 }

Vulnerable code:   rights=ReadPolicyRights;
Fixed code:   rights=AllPolicyRights;
        if (IsRightsAuthorized(ModulePolicyDomain,AllPolicyRights,
              MagickModules[i].module) == MagickFalse)
          continue;
CVE-2021-3962: Use After Free (CWE-416)
value: A flaw was found in ImageMagick where it did not properly sanitize certain input before using it to invoke convert processes. This flaw allows an attacker to create a specially crafted image that leads to a use-after-free vulnerability when processed by ImageMagick. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 7.8
Published: 2021-11-19T17:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/dcm.c
Commit date: 2021-11-06 09:23:02 +0100
Commit message: Moved the free to the correct position to fix #4446.

Diff: diff --git a/coders/dcm.c b/coders/dcm.c
index edc09e9f4338..c2de0b1eeb3a 100644
--- a/coders/dcm.c
+++ b/coders/dcm.c
@@ -3994,14 +3994,15 @@ static Image *ReadDCMImage(const ImageInfo *image_info,ExceptionInfo *exception)
               AppendImageToList(&images,jpeg_image);
             }
           (void) RelinquishUniqueFileResource(filename);
         }
         read_info=DestroyImageInfo(read_info);
-        RelinquishDCMMemory(&info,&map,stream_info,stack,data);
         image=DestroyImageList(image);
         if ((status == MagickFalse) && (exception->severity < ErrorException))
           ThrowDCMException(CorruptImageError,"CorruptImageError")
+        else
+          RelinquishDCMMemory(&info,&map,stream_info,stack,data);
         return(GetFirstImageInList(images));
       }
     if (info.depth != (1UL*MAGICKCORE_QUANTUM_DEPTH))
       {
         QuantumAny

Vulnerable code:         RelinquishDCMMemory(&info,&map,stream_info,stack,data);
Fixed code:         else
          RelinquishDCMMemory(&info,&map,stream_info,stack,data);
CVE-2022-0284: Out-of-bounds Read (CWE-125)
value: A heap-based-buffer-over-read flaw was found in ImageMagick's GetPixelAlpha() function of 'pixel-accessor.h'. This vulnerability is triggered when an attacker passes a specially crafted Tagged Image File Format (TIFF) image to convert it into a PICON file format. This issue can potentially lead to a denial of service and information disclosure.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.1
Published: 2022-08-29T15:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/xpm.c
Commit date: 2022-01-19 16:26:12 -0500
Commit message: https://github.com/ImageMagick/ImageMagick/issues/4729

Diff: diff --git a/coders/xpm.c b/coders/xpm.c
index 782ed732544a..5f73df8bca49 100644
--- a/coders/xpm.c
+++ b/coders/xpm.c
@@ -771,11 +771,11 @@ static MagickBooleanType WritePICONImage(const ImageInfo *image_info,
             q=GetAuthenticPixels(picon,0,y,picon->columns,1,exception);
             if (q == (Quantum *) NULL)
               break;
             for (x=0; x < (ssize_t) picon->columns; x++)
             {
-              if (GetPixelAlpha(image,q) == (Quantum) TransparentAlpha)
+              if (GetPixelAlpha(picon,q) == (Quantum) TransparentAlpha)
                 transparent=MagickTrue;
               else
                 SetPixelAlpha(picon,OpaqueAlpha,q);
               q+=GetPixelChannels(picon);
             }
@@ -802,11 +802,11 @@ static MagickBooleanType WritePICONImage(const ImageInfo *image_info,
         q=GetAuthenticPixels(picon,0,y,picon->columns,1,exception);
         if (q == (Quantum *) NULL)
           break;
         for (x=0; x < (ssize_t) picon->columns; x++)
         {
-          if (GetPixelAlpha(image,q) == (Quantum) TransparentAlpha)
+          if (GetPixelAlpha(picon,q) == (Quantum) TransparentAlpha)
             SetPixelIndex(picon,(Quantum) picon->colors,q);
           q+=GetPixelChannels(picon);
         }
         if (SyncAuthenticPixels(picon,exception) == MagickFalse)
           break;

Vulnerable code:               if (GetPixelAlpha(image,q) == (Quantum) TransparentAlpha)
          if (GetPixelAlpha(image,q) == (Quantum) TransparentAlpha)
Fixed code:               if (GetPixelAlpha(picon,q) == (Quantum) TransparentAlpha)
          if (GetPixelAlpha(picon,q) == (Quantum) TransparentAlpha)
CVE-2022-1115: Out-of-bounds Write (CWE-787)
value: A heap-buffer-overflow flaw was found in ImageMagick’s PushShortPixel() function of quantum-private.h file. This vulnerability is triggered when an attacker passes a specially crafted TIFF image file to ImageMagick for conversion, potentially leading to a denial of service.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2022-08-29T15:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/tiff.c
Commit date: 2022-03-22 20:11:47 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/4974

Diff: diff --git a/coders/tiff.c b/coders/tiff.c
index 31839f67e293..32ae00ab8120 100644
--- a/coders/tiff.c
+++ b/coders/tiff.c
@@ -1985,11 +1985,11 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
             (TIFFGetField(tiff,TIFFTAG_TILELENGTH,&rows) != 1))
           ThrowTIFFException(CoderError,"ImageIsNotTiled");
         number_pixels=(MagickSizeType) columns*rows;
         if (HeapOverflowSanityCheck(rows,sizeof(*tile_pixels)) != MagickFalse)
           ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed");
-        extent=MagickMax(rows*TIFFTileRowSize(tiff),TIFFTileSize(tiff));
+        extent=4*MagickMax(rows*TIFFTileRowSize(tiff),TIFFTileSize(tiff));
 #if defined(TIFF_VERSION_BIG)
         extent+=image->columns*sizeof(uint64);
 #else
         extent+=image->columns*sizeof(uint32);
 #endif

Vulnerable code:         extent=MagickMax(rows*TIFFTileRowSize(tiff),TIFFTileSize(tiff));
Fixed code:         extent=4*MagickMax(rows*TIFFTileRowSize(tiff),TIFFTileSize(tiff));
CVE-2022-28463: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 7.8
Published: 2022-05-08T23:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/cin.c
Commit date: 2022-03-26 09:26:57 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/4988

Diff: diff --git a/coders/cin.c b/coders/cin.c
index e266e7f3c56e..23fc17e0890e 100644
--- a/coders/cin.c
+++ b/coders/cin.c
@@ -449,10 +449,12 @@ static Image *ReadCINImage(const ImageInfo *image_info,ExceptionInfo *exception)
     ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   memset(&cin,0,sizeof(cin));
   image->endian=(magick[0] == 0x80) && (magick[1] == 0x2a) &&
     (magick[2] == 0x5f) && (magick[3] == 0xd7) ? MSBEndian : LSBEndian;
   cin.file.image_offset=ReadBlobLong(image);
+  if (cin.file.image_offset < 712)
+    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
   offset+=4;
   cin.file.generic_length=ReadBlobLong(image);
   offset+=4;
   cin.file.industry_length=ReadBlobLong(image);
   offset+=4;

Fixed code:   if (cin.file.image_offset < 712)
    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
CVE-2022-3213: Out-of-bounds Write (CWE-787)
value: A heap buffer overflow issue was found in ImageMagick. When an application processes a malformed TIFF file, it could lead to undefined behavior or a crash causing a denial of service.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2022-09-19T18:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/tiff.c
Commit date: 2022-08-27 08:40:45 -0400
Commit message: squash heap-buffer-overflow, PoC TIFF from Hardik

Diff: diff --git a/coders/tiff.c b/coders/tiff.c
index 132008efbfcc..a166bea177b7 100644
--- a/coders/tiff.c
+++ b/coders/tiff.c
@@ -1890,11 +1890,11 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
           *strip_pixels;
 
         /*
           Convert stripped TIFF image.
         */
-        extent=4*(samples_per_pixel+1)*TIFFStripSize(tiff);
+        extent=4*((image->depth+7)/8)*(samples_per_pixel+1)*TIFFStripSize(tiff);
         strip_pixels=(unsigned char *) AcquireQuantumMemory(extent,
           sizeof(*strip_pixels));
         if (strip_pixels == (unsigned char *) NULL)
           ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed");
         (void) memset(strip_pixels,0,extent*sizeof(*strip_pixels));

Vulnerable code:         extent=4*(samples_per_pixel+1)*TIFFStripSize(tiff);
Fixed code:         extent=4*((image->depth+7)/8)*(samples_per_pixel+1)*TIFFStripSize(tiff);
CVE-2022-32545: Integer Overflow or Wraparound (CWE-190)
value: A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned char' at coders/psd.c, when crafted or untrusted input is processed. This leads to a negative impact to application availability or other problems related to undefined behavior.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 7.8
Published: 2022-06-16T18:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/psd.c
Commit date: 2022-03-19 06:50:38 -0400
Commit message: fix issue: outside the range of representable values of type 'unsigned int' at coders/psd.c:1025 (#4963)

* fix Division by zero in XMenuWidget() of MagickCore/widget.c

* Fix memory leak in AnimateImageCommand() of MagickWand/animate.c and DisplayImageCommand() of MagickWand/display.c

* fix Division by zero in ReadEnhMetaFile() of coders/emf.c

* Resolve conflicts

* fix issue: outside the range of representable values of type 'unsigned char' at coders/psd.c:1025

Co-authored-by: zhailiangliang <zhailiangliang@loongson.cn>
Diff: diff --git a/coders/psd.c b/coders/psd.c
index f98f2bb088b7..76e1bf7a3d9f 100644
--- a/coders/psd.c
+++ b/coders/psd.c
@@ -1020,11 +1020,11 @@ static MagickBooleanType ReadPSDChannelPixels(Image *image,const ssize_t row,
         number_bits=(ssize_t) image->columns-x;
         if (number_bits > 8)
           number_bits=8;
         for (bit = 0; bit < (ssize_t) number_bits; bit++)
         {
-          SetPSDPixel(image,channel,packet_size,(((unsigned char) pixel)
+          SetPSDPixel(image,channel,packet_size,(((unsigned char)((ssize_t)pixel))
             & (0x01 << (7-bit))) != 0 ? 0 : QuantumRange,q,exception);
           q+=GetPixelChannels(image);
           x++;
         }
         if (x != (ssize_t) image->columns)

Vulnerable code:           SetPSDPixel(image,channel,packet_size,(((unsigned char) pixel)
Fixed code:           SetPSDPixel(image,channel,packet_size,(((unsigned char)((ssize_t)pixel))
CVE-2022-32546: Integer Overflow or Wraparound (CWE-190)
value: A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned long' at coders/pcl.c, when crafted or untrusted input is processed. This leads to a negative impact to application availability or other problems related to undefined behavior.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 7.8
Published: 2022-06-16T18:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/pcl.c
Commit date: 2022-03-24 11:34:47 -0400
Commit message: Fixes #4985: 4e+26 is outside the range of representable values of type 'unsigned long' at coders/pcl.c:299 (#4986)

* fix Division by zero in XMenuWidget() of MagickCore/widget.c

* Fix memory leak in AnimateImageCommand() of MagickWand/animate.c and DisplayImageCommand() of MagickWand/display.c

* fix Division by zero in ReadEnhMetaFile() of coders/emf.c

* Resolve conflicts

* fix issue: outside the range of representable values of type 'unsigned char' at coders/psd.c:1025

* fix error: 4e+26 is outside the range of representable values of type 'unsigned long' at coders/pcl.c:299

Co-authored-by: zhailiangliang <zhailiangliang@loongson.cn>
Diff: diff --git a/coders/pcl.c b/coders/pcl.c
index c0cc213ed5aa..70d2b4b9994d 100644
--- a/coders/pcl.c
+++ b/coders/pcl.c
@@ -293,12 +293,12 @@ static Image *ReadPCLImage(const ImageInfo *image_info,ExceptionInfo *exception)
     if (count != 4)
       continue;
     /*
       Set PCL render geometry.
     */
-    width=(size_t) floor(bounds.x2-bounds.x1+0.5);
-    height=(size_t) floor(bounds.y2-bounds.y1+0.5);
+    width=(size_t)CastDoubleToLong(floor(bounds.x2-bounds.x1+0.5));
+    height=(size_t)CastDoubleToLong(floor(bounds.y2-bounds.y1+0.5));
     if (width > page.width)
       page.width=width;
     if (height > page.height)
       page.height=height;
   }

Vulnerable code:     width=(size_t) floor(bounds.x2-bounds.x1+0.5);
    height=(size_t) floor(bounds.y2-bounds.y1+0.5);
Fixed code:     width=(size_t)CastDoubleToLong(floor(bounds.x2-bounds.x1+0.5));
    height=(size_t)CastDoubleToLong(floor(bounds.y2-bounds.y1+0.5));
CVE-2022-32547: Incorrect Type Conversion or Cast (CWE-704)
value: In ImageMagick, there is load of misaligned address for type 'double', which requires 8 byte alignment and for type 'float', which requires 4 byte alignment at MagickCore/property.c. Whenever crafted or untrusted input is processed by ImageMagick, this causes a negative impact to application availability or other problems related to undefined behavior.
CWE description: The product does not correctly convert an object, resource, or structure from one type to a different type.
CVSS v3 base score: 7.8
Published: 2022-06-16T18:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: MagickCore/property.c
Commit date: 2022-04-09 08:34:03 -0400
Commit message: fix #5033: runtime error: load of misaligned address (#5034)

* fix Division by zero in XMenuWidget() of MagickCore/widget.c

* Fix memory leak in AnimateImageCommand() of MagickWand/animate.c and DisplayImageCommand() of MagickWand/display.c

* fix Division by zero in ReadEnhMetaFile() of coders/emf.c

* Resolve conflicts

* fix issue: outside the range of representable values of type 'unsigned char' at coders/psd.c:1025

* fix error: 4e+26 is outside the range of representable values of type 'unsigned long' at coders/pcl.c:299

* fix #5033:runtime error: load of misaligned address

Co-authored-by: zhailiangliang <zhailiangliang@loongson.cn>
Diff: diff --git a/MagickCore/property.c b/MagickCore/property.c
index 8175dd1f73fb..6e72cac157be 100644
--- a/MagickCore/property.c
+++ b/MagickCore/property.c
@@ -1543,16 +1543,16 @@ static MagickBooleanType GetEXIFProperty(const Image *image,
                 ReadPropertySignedLong(endian,p1+4));
               break;
             }
             case EXIF_FMT_SINGLE:
             {
-              EXIFMultipleValues(4,"%f",(double) *(float *) p1);
+              EXIFMultipleValues(4,"%f",(double)ReadPropertySignedLong(endian,p1));
               break;
             }
             case EXIF_FMT_DOUBLE:
             {
-              EXIFMultipleValues(8,"%f",*(double *) p1);
+              EXIFMultipleValues(8,"%f",(double)ReadPropertySignedLong(endian,p1));
               break;
             }
             case EXIF_FMT_STRING:
             default:
             {

Vulnerable code:               EXIFMultipleValues(4,"%f",(double) *(float *) p1);
              EXIFMultipleValues(8,"%f",*(double *) p1);
Fixed code:               EXIFMultipleValues(4,"%f",(double)ReadPropertySignedLong(endian,p1));
              EXIFMultipleValues(8,"%f",(double)ReadPropertySignedLong(endian,p1));
CVE-2023-1289: Improper Input Validation (CWE-20)
value: A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a remote attacker to pass a specially crafted SVG file that leads to a segmentation fault, generating many trash files in "/tmp," resulting in a denial of service. When ImageMagick crashes, it generates a lot of trash files. These trash files can be large if the SVG file contains many render actions. In a denial of service attack, if a remote attacker uploads an SVG file of size t, ImageMagick generates files of size 103*t. If an attacker uploads a 100M SVG, the server will generate about 10G.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 5.5
Published: 2023-03-23T20:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: MagickCore/draw.c
Commit date: 2023-03-06 15:26:32 -0500
Commit message: erecursion detection

Diff: diff --git a/MagickCore/draw.c b/MagickCore/draw.c
index 936e5f0ca84d..c0c76feb974f 100644
--- a/MagickCore/draw.c
+++ b/MagickCore/draw.c
@@ -5583,11 +5583,12 @@ MagickExport MagickBooleanType DrawPrimitive(Image *image,
         x1,
         y1;
 
       if (primitive_info->text == (char *) NULL)
         break;
-      clone_info=CloneImageInfo(draw_info->image_info);
+      clone_info=AcquireImageInfo();
+      clone_info->recursion_depth=draw_info->image_info->recursion_depth;
       composite_images=(Image *) NULL;
       if (LocaleNCompare(primitive_info->text,"data:",5) == 0)
         composite_images=ReadInlineImage(clone_info,primitive_info->text,
           exception);
       else

Vulnerable code:       clone_info=CloneImageInfo(draw_info->image_info);
Fixed code:       clone_info=AcquireImageInfo();
      clone_info->recursion_depth=draw_info->image_info->recursion_depth;
CVE-2023-1906: Out-of-bounds Write (CWE-787)
value: A heap-based buffer overflow issue was discovered in ImageMagick's ImportMultiSpectralQuantum() function in MagickCore/quantum-import.c. An attacker could pass specially crafted file to convert, triggering an out-of-bounds read error, allowing an application to crash, resulting in a denial of service.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2023-04-12T22:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/tiff.c
Commit date: 2023-04-01 07:33:24 -0400
Commit message: possible heap buffer overflow (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-35q2-86c7-9247)

Diff: diff --git a/coders/tiff.c b/coders/tiff.c
index a437421bcf12..1d21ee7a4134 100644
--- a/coders/tiff.c
+++ b/coders/tiff.c
@@ -1901,12 +1901,12 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
           *strip_pixels;
 
         /*
           Convert stripped TIFF image.
         */
-        extent=4*MagickMax(image->columns*(samples_per_pixel+extra_samples)*
-          (image->depth+7)/8,(size_t) TIFFStripSize(tiff));
+        extent=MagickMax(sizeof(uint32),(samples_per_pixel+extra_samples)*
+          (image->depth+7)/8)*image->columns*rows_per_strip;
         strip_pixels=(unsigned char *) AcquireQuantumMemory(extent,
           sizeof(*strip_pixels));
         if (strip_pixels == (unsigned char *) NULL)
           ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed");
         (void) memset(strip_pixels,0,extent*sizeof(*strip_pixels));

Vulnerable code:         extent=4*MagickMax(image->columns*(samples_per_pixel+extra_samples)*
          (image->depth+7)/8,(size_t) TIFFStripSize(tiff));
Fixed code:         extent=MagickMax(sizeof(uint32),(samples_per_pixel+extra_samples)*
          (image->depth+7)/8)*image->columns*rows_per_strip;