CVE-2015-8958: Out-of-bounds Read (CWE-125)
value: coders/sun.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted SUN file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2017-04-20T18:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/sun.c
Commit date: 2015-01-13 13:31:27 +0000
Diff: diff --git a/coders/sun.c b/coders/sun.c
index 7edf41b3a..3f71a1eda 100644
--- a/coders/sun.c
+++ b/coders/sun.c
@@ -253,12 +253,11 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
     *p;
 
   size_t
     bytes_per_line,
     extent,
-    height,
-    length;
+    height;
 
   ssize_t
     count,
     y;
 
@@ -487,17 +486,10 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
           }
       }
     else
       if (image->storage_class == PseudoClass)
         {
-          if (bytes_per_line == 0)
-            bytes_per_line=image->columns;
-          length=image->rows*(image->columns+image->columns % 2);
-          if (((sun_info.type == RT_ENCODED) &&
-               (length > (bytes_per_line*image->rows))) ||
-              ((sun_info.type != RT_ENCODED) && (length > sun_info.length)))
-            ThrowReaderException(CorruptImageError,"UnableToReadImageData");
           for (y=0; y < (ssize_t) image->rows; y++)
           {
             q=QueueAuthenticPixels(image,0,y,image->columns,1,exception);
             if (q == (Quantum *) NULL)
               break;
@@ -527,15 +519,10 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
           bytes_per_pixel=3;
           if (image->alpha_trait != UndefinedPixelTrait)
             bytes_per_pixel++;
           if (bytes_per_line == 0)
             bytes_per_line=bytes_per_pixel*image->columns;
-          length=image->rows*(bytes_per_line+bytes_per_line % 2);
-          if (((sun_info.type == RT_ENCODED) &&
-               (length > (bytes_per_line*image->rows))) ||
-              ((sun_info.type != RT_ENCODED) && (length > sun_info.length)))
-            ThrowReaderException(CorruptImageError,"UnableToReadImageData");
           for (y=0; y < (ssize_t) image->rows; y++)
           {
             q=QueueAuthenticPixels(image,0,y,image->columns,1,exception);
             if (q == (Quantum *) NULL)
               break;

Vulnerable code:     height,
    length;
          if (bytes_per_line == 0)
            bytes_per_line=image->columns;
          length=image->rows*(image->columns+image->columns % 2);
          if (((sun_info.type == RT_ENCODED) &&
               (length > (bytes_per_line*image->rows))) ||
              ((sun_info.type != RT_ENCODED) && (length > sun_info.length)))
            ThrowReaderException(CorruptImageError,"UnableToReadImageData");
          length=image->rows*(bytes_per_line+bytes_per_line % 2);
          if (((sun_info.type == RT_ENCODED) &&
               (length > (bytes_per_line*image->rows))) ||
              ((sun_info.type != RT_ENCODED) && (length > sun_info.length)))
            ThrowReaderException(CorruptImageError,"UnableToReadImageData");
Fixed code:     height;