CVE-2019-13303: Out-of-bounds Read (CWE-125)
value: ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read in MagickCore/composite.c in CompositeImage.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8.8
Published: 2019-07-05T01:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: MagickCore/composite.c
Commit date: 2019-06-18 14:13:42 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1603

Diff: diff --git a/MagickCore/composite.c b/MagickCore/composite.c
index 78d6dff9217..99e91d14704 100644
--- a/MagickCore/composite.c
+++ b/MagickCore/composite.c
@@ -652,22 +652,23 @@ MagickExport MagickBooleanType CompositeImage(Image *image,
             {
               p+=GetPixelChannels(source_image);
               q+=GetPixelChannels(image);
               continue;
             }
-          for (i=0; i < (ssize_t) GetPixelChannels(image); i++)
+          for (i=0; i < (ssize_t) GetPixelChannels(source_image); i++)
           {
-            PixelChannel channel = GetPixelChannelChannel(image,i);
-            PixelTrait traits = GetPixelChannelTraits(image,channel);
-            PixelTrait source_traits=GetPixelChannelTraits(source_image,
+            PixelChannel channel = GetPixelChannelChannel(source_image,i);
+            PixelTrait source_traits = GetPixelChannelTraits(source_image,
               channel);
-            if (traits == UndefinedPixelTrait)
+            PixelTrait traits = GetPixelChannelTraits(image,channel);
+            if (source_traits == UndefinedPixelTrait)
               continue;
-            if (source_traits != UndefinedPixelTrait)
+            if (traits != UndefinedPixelTrait)
               SetPixelChannel(image,channel,p[i],q);
-            else if (channel == AlphaPixelChannel)
-              SetPixelChannel(image,channel,OpaqueAlpha,q);
+            else
+              if (channel == AlphaPixelChannel)
+                SetPixelChannel(image,channel,OpaqueAlpha,q);
           }
           p+=GetPixelChannels(source_image);
           q+=GetPixelChannels(image);
         }
         sync=SyncCacheViewAuthenticPixels(image_view,exception);

Vulnerable code:           for (i=0; i < (ssize_t) GetPixelChannels(image); i++)
            PixelChannel channel = GetPixelChannelChannel(image,i);
            PixelTrait traits = GetPixelChannelTraits(image,channel);
            PixelTrait source_traits=GetPixelChannelTraits(source_image,
            if (traits == UndefinedPixelTrait)
            if (source_traits != UndefinedPixelTrait)
            else if (channel == AlphaPixelChannel)
              SetPixelChannel(image,channel,OpaqueAlpha,q);
Fixed code:           for (i=0; i < (ssize_t) GetPixelChannels(source_image); i++)
            PixelChannel channel = GetPixelChannelChannel(source_image,i);
            PixelTrait source_traits = GetPixelChannelTraits(source_image,
            PixelTrait traits = GetPixelChannelTraits(image,channel);
            if (source_traits == UndefinedPixelTrait)
            if (traits != UndefinedPixelTrait)
            else
              if (channel == AlphaPixelChannel)
                SetPixelChannel(image,channel,OpaqueAlpha,q);