CVE-2019-13391: Out-of-bounds Read (CWE-125)
value: In ImageMagick 7.0.8-50 Q16, ComplexImages in MagickCore/fourier.c has a heap-based buffer over-read because of incorrect calls to GetCacheViewVirtualPixels.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8.8
Published: 2019-07-07T22:15Z
Repository: https://github.com/ImageMagick/ImageMagick6
Language: C
Files changed: magick/annotate.c, magick/fourier.c
Commit date: 2019-06-16 12:18:36 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1588

Diff: diff --git a/magick/annotate.c b/magick/annotate.c
index 757d4f8a12b..63570f89c17 100644
--- a/magick/annotate.c
+++ b/magick/annotate.c
@@ -264,10 +264,11 @@ MagickExport MagickBooleanType AnnotateImage(Image *image,
   textlist=AcquireQuantumMemory(number_lines+1,sizeof(*textlist));
   if (textlist == (char **) NULL)
     {
       annotate_info=DestroyDrawInfo(annotate_info);
       annotate=DestroyDrawInfo(annotate);
+      text=DestroyString(text);
       return(MagickFalse);
     }
   p=text;
   for (i=0; i < number_lines; i++)
   {
@@ -298,10 +299,11 @@ MagickExport MagickBooleanType AnnotateImage(Image *image,
   if (SetImageStorageClass(image,DirectClass) == MagickFalse)
     {
       annotate_info=DestroyDrawInfo(annotate_info);
       annotate=DestroyDrawInfo(annotate);
       textlist=(char **) RelinquishMagickMemory(textlist);
+      text=DestroyString(text);
       return(MagickFalse);
     }
   if (IsGrayColorspace(image->colorspace) != MagickFalse)
     (void) SetImageColorspace(image,sRGBColorspace);
   status=MagickTrue;
@@ -515,10 +517,11 @@ MagickExport MagickBooleanType AnnotateImage(Image *image,
     Relinquish resources.
   */
   annotate_info=DestroyDrawInfo(annotate_info);
   annotate=DestroyDrawInfo(annotate);
   textlist=(char **) RelinquishMagickMemory(textlist);
+  text=DestroyString(text);
   return(status);
 }
 
 /*
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
diff --git a/magick/fourier.c b/magick/fourier.c
index d833a067c86..bff711d0f61 100644
--- a/magick/fourier.c
+++ b/magick/fourier.c
@@ -243,14 +243,18 @@ MagickExport Image *ComplexImages(const Image *images,const ComplexOperator op,
     register ssize_t
       x;
 
     if (status == MagickFalse)
       continue;
-    Ar=GetCacheViewVirtualPixels(Ar_view,0,y,Ar_image->columns,1,exception);
-    Ai=GetCacheViewVirtualPixels(Ai_view,0,y,Ai_image->columns,1,exception);
-    Br=GetCacheViewVirtualPixels(Br_view,0,y,Br_image->columns,1,exception);
-    Bi=GetCacheViewVirtualPixels(Bi_view,0,y,Bi_image->columns,1,exception);
+    Ar=GetCacheViewVirtualPixels(Ar_view,0,y,
+      MagickMax(Ar_image->columns,Cr_image->columns),1,exception);
+    Ai=GetCacheViewVirtualPixels(Ai_view,0,y,
+      MagickMax(Ai_image->columns,Ci_image->columns),1,exception);
+    Br=GetCacheViewVirtualPixels(Br_view,0,y,
+      MagickMax(Br_image->columns,Cr_image->columns),1,exception);
+    Bi=GetCacheViewVirtualPixels(Bi_view,0,y,
+      MagickMax(Bi_image->columns,Ci_image->columns),1,exception);
     Cr=QueueCacheViewAuthenticPixels(Cr_view,0,y,Cr_image->columns,1,exception);
     Ci=QueueCacheViewAuthenticPixels(Ci_view,0,y,Ci_image->columns,1,exception);
     if ((Ar == (const PixelPacket *) NULL) ||
         (Ai == (const PixelPacket *) NULL) ||
         (Br == (const PixelPacket *) NULL) ||

Vulnerable code:     Ar=GetCacheViewVirtualPixels(Ar_view,0,y,Ar_image->columns,1,exception);
    Ai=GetCacheViewVirtualPixels(Ai_view,0,y,Ai_image->columns,1,exception);
    Br=GetCacheViewVirtualPixels(Br_view,0,y,Br_image->columns,1,exception);
    Bi=GetCacheViewVirtualPixels(Bi_view,0,y,Bi_image->columns,1,exception);
Fixed code:       text=DestroyString(text);
      text=DestroyString(text);
  text=DestroyString(text);
    Ar=GetCacheViewVirtualPixels(Ar_view,0,y,
      MagickMax(Ar_image->columns,Cr_image->columns),1,exception);
    Ai=GetCacheViewVirtualPixels(Ai_view,0,y,
      MagickMax(Ai_image->columns,Ci_image->columns),1,exception);
    Br=GetCacheViewVirtualPixels(Br_view,0,y,
      MagickMax(Br_image->columns,Cr_image->columns),1,exception);
    Bi=GetCacheViewVirtualPixels(Bi_view,0,y,
      MagickMax(Bi_image->columns,Ci_image->columns),1,exception);