CVE-2015-8957: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Buffer overflow in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (application crash) via a crafted SUN file.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 6.5
Published: 2017-04-20T18:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: MagickCore/composite.c, MagickCore/pixel-accessor.h, MagickCore/threshold.c, coders/sun.c
Commit date: 2015-01-09 20:02:31 +0000
Diff: diff --git a/MagickCore/composite.c b/MagickCore/composite.c
index f211a266e..9c8a5ed62 100644
--- a/MagickCore/composite.c
+++ b/MagickCore/composite.c
@@ -2303,11 +2303,11 @@ if (0)
           {
             pixel=Sc;
             break;
           }
         }
-        q[i]=ClampToQuantum(pixel);
+        q[i]=ClampPixel(pixel);
       }
       p+=GetPixelChannels(composite_image);
       channels=GetPixelChannels(composite_image);
       if (p >= (pixels+channels*composite_image->columns))
         p=pixels;
diff --git a/MagickCore/pixel-accessor.h b/MagickCore/pixel-accessor.h
index 2b9b0603b..79ddb725f 100644
--- a/MagickCore/pixel-accessor.h
+++ b/MagickCore/pixel-accessor.h
@@ -29,10 +29,23 @@
 extern "C" {
 #endif
 
 #undef index
 
+static inline Quantum ClampPixel(const MagickRealType value)
+{
+#if !defined(MAGICKCORE_HDRI_SUPPORT)
+  return((Quantum) value);
+#else
+  if (value < 0.0)
+    return((Quantum) 0.0);
+  if (value >= (MagickRealType) QuantumRange)
+    return((Quantum) QuantumRange);
+  return((Quantum) value);
+#endif
+}
+
 static inline Quantum GetPixela(const Image *restrict image,
   const Quantum *restrict pixel)
 {
   return(pixel[image->channel_map[aPixelChannel].offset]);
 }
diff --git a/MagickCore/threshold.c b/MagickCore/threshold.c
index 788e33ee6..459b1a184 100644
--- a/MagickCore/threshold.c
+++ b/MagickCore/threshold.c
@@ -683,23 +683,10 @@ MagickExport MagickBooleanType BlackThresholdImage(Image *image,
 %
 %    o exception: return any errors or warnings in this structure.
 %
 */
 
-static inline Quantum ClampPixel(const MagickRealType value)
-{
-#if !defined(MAGICKCORE_HDRI_SUPPORT)
-  return((Quantum) value);
-#else
-  if (value < 0.0f)
-    return(0.0);
-  if (value >= (MagickRealType) QuantumRange)
-    return((Quantum) QuantumRange);
-  return(value);
-#endif
-}
-
 MagickExport MagickBooleanType ClampImage(Image *image,ExceptionInfo *exception)
 {
 #define ClampImageTag  "Clamp/Image"
 
   CacheView
diff --git a/coders/sun.c b/coders/sun.c
index 8f92fc371..af1a7289b 100644
--- a/coders/sun.c
+++ b/coders/sun.c
@@ -335,10 +335,12 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
         if (AcquireImageColormap(image,image->colors,exception) == MagickFalse)
           ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
       }
     switch (sun_info.maptype)
     {
+      case RMT_NONE:
+        break;
       case RMT_EQUAL_RGB:
       {
         unsigned char
           *sun_colormap;
 

Vulnerable code:         q[i]=ClampToQuantum(pixel);
static inline Quantum ClampPixel(const MagickRealType value)
{
#if !defined(MAGICKCORE_HDRI_SUPPORT)
  return((Quantum) value);
#else
  if (value < 0.0f)
    return(0.0);
  if (value >= (MagickRealType) QuantumRange)
    return((Quantum) QuantumRange);
  return(value);
#endif
}

Fixed code:         q[i]=ClampPixel(pixel);
static inline Quantum ClampPixel(const MagickRealType value)
{
#if !defined(MAGICKCORE_HDRI_SUPPORT)
  return((Quantum) value);
#else
  if (value < 0.0)
    return((Quantum) 0.0);
  if (value >= (MagickRealType) QuantumRange)
    return((Quantum) QuantumRange);
  return((Quantum) value);
#endif
}

      case RMT_NONE:
        break;