CVE-2017-12427: Missing Release of Resource after Effective Lifetime (CWE-772)
value: The ProcessMSLScript function in coders/msl.c in ImageMagick before 6.9.9-5 and 7.x before 7.0.6-5 allows remote attackers to cause a denial of service (memory leak) via a crafted file, related to the WriteMSLImage function.
CWE description: The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
CVSS v3 base score: 6.5
Published: 2017-08-04T09:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: Other
Files changed: ChangeLog, coders/msl.c
Commit date: 2017-08-01 07:05:17 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/636

Diff: diff --git a/ChangeLog b/ChangeLog
index 23bf6513d6b..f4000b0b29f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,9 @@
+2017-07-01  7.0.6-5 Cristy  <quetzlzacatenango@image...>
+  * Fixed numerous memory leaks (reference
+    https://github.com/ImageMagick/ImageMagick/issues).
+
 2017-07-29  7.0.6-5 Glenn Randers-Pehrson <glennrp@image...>
   * Properly set image->colorspace in the PNG decoder (previously
     it was setting image->gamma, but only setting image->colorspace
     for grayscale and gray-alpha images.  Reference
     https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=32418).
diff --git a/coders/msl.c b/coders/msl.c
index 911119f24e7..26067052c18 100644
--- a/coders/msl.c
+++ b/coders/msl.c
@@ -7897,16 +7897,29 @@ static MagickBooleanType ProcessMSLScript(const ImageInfo *image_info,
     if (msl_info.exception->severity >= ErrorException)
       break;
   }
   if (msl_info.exception->severity == UndefinedException)
     (void) xmlParseChunk(msl_info.parser," ",1,MagickTrue);
+  /*
+    Free resources.
+  */
   xmlFreeParserCtxt(msl_info.parser);
   (void) LogMagickEvent(CoderEvent,GetMagickModule(),"end SAX");
   msl_info.group_info=(MSLGroupInfo *) RelinquishMagickMemory(
     msl_info.group_info);
   if (*image == (Image *) NULL)
     *image=(*msl_info.image);
+  *msl_info.image_info=DestroyImageInfo(*msl_info.image_info);
+  msl_info.image_info=(ImageInfo **) RelinquishMagickMemory(
+    msl_info.image_info);
+  *msl_info.draw_info=DestroyDrawInfo(*msl_info.draw_info);
+  msl_info.draw_info=(DrawInfo **) RelinquishMagickMemory(msl_info.draw_info);
+  msl_info.image=(Image **) RelinquishMagickMemory(msl_info.image);
+  *msl_info.attributes=DestroyImage(*msl_info.attributes);
+  msl_info.attributes=(Image **) RelinquishMagickMemory(msl_info.attributes);
+  msl_info.group_info=(MSLGroupInfo *) RelinquishMagickMemory(
+    msl_info.group_info);
   if (msl_info.exception->severity != UndefinedException)
     return(MagickFalse);
   return(MagickTrue);
 }
 

Fixed code: 2017-07-01  7.0.6-5 Cristy  <quetzlzacatenango@image...>
  * Fixed numerous memory leaks (reference
    https://github.com/ImageMagick/ImageMagick/issues).

  /*
    Free resources.
  */
  *msl_info.image_info=DestroyImageInfo(*msl_info.image_info);
  msl_info.image_info=(ImageInfo **) RelinquishMagickMemory(
    msl_info.image_info);
  *msl_info.draw_info=DestroyDrawInfo(*msl_info.draw_info);
  msl_info.draw_info=(DrawInfo **) RelinquishMagickMemory(msl_info.draw_info);
  msl_info.image=(Image **) RelinquishMagickMemory(msl_info.image);
  *msl_info.attributes=DestroyImage(*msl_info.attributes);
  msl_info.attributes=(Image **) RelinquishMagickMemory(msl_info.attributes);
  msl_info.group_info=(MSLGroupInfo *) RelinquishMagickMemory(
    msl_info.group_info);