CVE-2018-16640: Missing Release of Resource after Effective Lifetime (CWE-772)
value: ImageMagick 7.0.8-5 has a memory leak vulnerability in the function ReadOneJNGImage in coders/png.c.
CWE description: The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
CVSS v3 base score: 6.5
Published: 2018-09-06T22:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: Other
Files changed: coders/png.c, configure
Commit date: 2018-07-07 07:27:47 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1201

Diff: diff --git a/coders/png.c b/coders/png.c
index b3ecd890be2..d811544e311 100644
--- a/coders/png.c
+++ b/coders/png.c
@@ -4558,11 +4558,15 @@ static Image *ReadOneJNGImage(MngInfo *mng_info,
     if (length != 0)
       {
         chunk=(unsigned char *) AcquireQuantumMemory(length,sizeof(*chunk));
 
         if (chunk == (unsigned char *) NULL)
-          ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+          {
+            DestroyJNG(NULL,&color_image,&color_image_info,
+              &alpha_image,&alpha_image_info);
+            ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+          }
 
         for (i=0; i < (ssize_t) length; i++)
         {
           int
             c;
@@ -4585,17 +4589,16 @@ static Image *ReadOneJNGImage(MngInfo *mng_info,
         if (length == 16)
           {
             jng_width=(png_uint_32)mng_get_long(p);
             jng_height=(png_uint_32)mng_get_long(&p[4]);
             if ((jng_width == 0) || (jng_height == 0))
-            {
-              DestroyJNG(chunk,&color_image,&color_image_info,
-                &alpha_image,&alpha_image_info);
-
-              ThrowReaderException(CorruptImageError,
-                "NegativeOrZeroImageSize");
-            }
+              {
+                DestroyJNG(chunk,&color_image,&color_image_info,
+                  &alpha_image,&alpha_image_info);
+                ThrowReaderException(CorruptImageError,
+                  "NegativeOrZeroImageSize");
+              }
             jng_color_type=p[8];
             jng_image_sample_depth=p[9];
             jng_image_compression_method=p[10];
             jng_image_interlace_method=p[11];
 
diff --git a/configure b/configure
index f44c15ac0a7..2bc5726fab1 100755
--- a/configure
+++ b/configure
@@ -1,8 +1,8 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for ImageMagick 7.0.8-5.
+# Generated by GNU Autoconf 2.69 for ImageMagick 7.0.8-6.
 #
 # Report bugs to <https://github.com/ImageMagick/ImageMagick/issues>.
 #
 #
 # Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc.
@@ -588,12 +588,12 @@ MFLAGS=
 MAKEFLAGS=
 
 # Identity of this package.
 PACKAGE_NAME='ImageMagick'
 PACKAGE_TARNAME='ImageMagick'
-PACKAGE_VERSION='7.0.8-5'
-PACKAGE_STRING='ImageMagick 7.0.8-5'
+PACKAGE_VERSION='7.0.8-6'
+PACKAGE_STRING='ImageMagick 7.0.8-6'
 PACKAGE_BUGREPORT='https://github.com/ImageMagick/ImageMagick/issues'
 PACKAGE_URL='https://www.imagemagick.org'
 
 ac_unique_file="MagickCore/MagickCore.h"
 # Factoring default headers for most tests.
@@ -1840,11 +1840,11 @@ done
 #
 if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures ImageMagick 7.0.8-5 to adapt to many kinds of systems.
+\`configure' configures ImageMagick 7.0.8-6 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
 To assign environment variables (e.g., CC, CFLAGS...), specify them as
 VAR=VALUE.  See below for descriptions of some of the useful variables.
@@ -1915,11 +1915,11 @@ System types:
 _ACEOF
 fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of ImageMagick 7.0.8-5:";;
+     short | recursive ) echo "Configuration of ImageMagick 7.0.8-6:";;
    esac
   cat <<\_ACEOF
 
 Optional Features:
   --disable-option-checking  ignore unrecognized --enable/--with options
@@ -2202,11 +2202,11 @@ ac_abs_srcdir=$ac_abs_top_srcdir$ac_dir_suffix
 fi
 
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-ImageMagick configure 7.0.8-5
+ImageMagick configure 7.0.8-6
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
 This configure script is free software; the Free Software Foundation
 gives unlimited permission to copy, distribute and modify it.
@@ -3253,11 +3253,11 @@ fi
 } # ac_fn_cxx_check_header_mongrel
 cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by ImageMagick $as_me 7.0.8-5, which was
+It was created by ImageMagick $as_me 7.0.8-6, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
 
 _ACEOF
@@ -4239,11 +4239,11 @@ if test -z "$CYGPATH_W"; then
 fi
 
 
 # Define the identity of the package.
  PACKAGE='ImageMagick'
- VERSION='7.0.8-5'
+ VERSION='7.0.8-6'
 
 
 cat >>confdefs.h <<_ACEOF
 #define PACKAGE "$PACKAGE"
 _ACEOF
@@ -4549,15 +4549,15 @@ MAGICK_MAJOR_VERSION=7
 
 MAGICK_MINOR_VERSION=0
 
 MAGICK_MICRO_VERSION=8
 
-MAGICK_PATCHLEVEL_VERSION=5
+MAGICK_PATCHLEVEL_VERSION=6
 
-MAGICK_VERSION=7.0.8-5
+MAGICK_VERSION=7.0.8-6
 
-MAGICK_GIT_REVISION=14506:0e75f0a50:20180703
+MAGICK_GIT_REVISION=14516:c7537dd70:20180705
 
 
 # Substitute library versioning
 MAGICK_LIBRARY_CURRENT_MIN=`expr $MAGICK_LIBRARY_CURRENT - $MAGICK_LIBRARY_AGE`
 
@@ -37630,11 +37630,11 @@ test $as_write_fail = 0 && chmod +x $CONFIG_STATUS || ac_write_fail=1
 cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # Save the log message, to keep $0 and so on meaningful, and to
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by ImageMagick $as_me 7.0.8-5, which was
+This file was extended by ImageMagick $as_me 7.0.8-6, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
   CONFIG_HEADERS  = $CONFIG_HEADERS
   CONFIG_LINKS    = $CONFIG_LINKS
@@ -37697,11 +37697,11 @@ ImageMagick home page: <https://www.imagemagick.org>."
 
 _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-ImageMagick config.status 7.0.8-5
+ImageMagick config.status 7.0.8-6
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 
 Copyright (C) 2012 Free Software Foundation, Inc.
 This config.status script is free software; the Free Software Foundation

Vulnerable code:           ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
            {
              DestroyJNG(chunk,&color_image,&color_image_info,
                &alpha_image,&alpha_image_info);

              ThrowReaderException(CorruptImageError,
                "NegativeOrZeroImageSize");
            }
# Generated by GNU Autoconf 2.69 for ImageMagick 7.0.8-5.
PACKAGE_VERSION='7.0.8-5'
PACKAGE_STRING='ImageMagick 7.0.8-5'
\`configure' configures ImageMagick 7.0.8-5 to adapt to many kinds of systems.
     short | recursive ) echo "Configuration of ImageMagick 7.0.8-5:";;
ImageMagick configure 7.0.8-5
It was created by ImageMagick $as_me 7.0.8-5, which was
 VERSION='7.0.8-5'
MAGICK_PATCHLEVEL_VERSION=5
MAGICK_VERSION=7.0.8-5
MAGICK_GIT_REVISION=14506:0e75f0a50:20180703
This file was extended by ImageMagick $as_me 7.0.8-5, which was
ImageMagick config.status 7.0.8-5
Fixed code:           {
            DestroyJNG(NULL,&color_image,&color_image_info,
              &alpha_image,&alpha_image_info);
            ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
          }
              {
                DestroyJNG(chunk,&color_image,&color_image_info,
                  &alpha_image,&alpha_image_info);
                ThrowReaderException(CorruptImageError,
                  "NegativeOrZeroImageSize");
              }
# Generated by GNU Autoconf 2.69 for ImageMagick 7.0.8-6.
PACKAGE_VERSION='7.0.8-6'
PACKAGE_STRING='ImageMagick 7.0.8-6'
\`configure' configures ImageMagick 7.0.8-6 to adapt to many kinds of systems.
     short | recursive ) echo "Configuration of ImageMagick 7.0.8-6:";;
ImageMagick configure 7.0.8-6
It was created by ImageMagick $as_me 7.0.8-6, which was
 VERSION='7.0.8-6'
MAGICK_PATCHLEVEL_VERSION=6
MAGICK_VERSION=7.0.8-6
MAGICK_GIT_REVISION=14516:c7537dd70:20180705
This file was extended by ImageMagick $as_me 7.0.8-6, which was
ImageMagick config.status 7.0.8-6