CVE-2017-5509: Out-of-bounds Write (CWE-787)
value: coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted PSD file, which triggers an out-of-bounds write.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2017-03-24T15:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/psd.c
Commit date: 2017-01-10 09:06:29 -0500
Commit message: https://github.com/ImageMagick/ImageMagick/issues/350

Diff: diff --git a/coders/psd.c b/coders/psd.c
index eb6972dec00..1b40c9f86e7 100644
--- a/coders/psd.c
+++ b/coders/psd.c
@@ -1116,12 +1116,11 @@ static MagickBooleanType ReadPSDChannelRLE(Image *image,const PSDInfo *psd_info,
       length=(size_t) sizes[y];
 
   if (length > row_size + 256) // arbitrary number
     {
       pixels=(unsigned char *) RelinquishMagickMemory(pixels);
-      ThrowBinaryException(ResourceLimitError,"InvalidLength",
-        image->filename);
+      ThrowBinaryException(ResourceLimitError,"InvalidLength",image->filename);
     }
 
   compact_pixels=(unsigned char *) AcquireQuantumMemory(length,sizeof(*pixels));
   if (compact_pixels == (unsigned char *) NULL)
     {
@@ -1658,12 +1657,12 @@ ModuleExport MagickBooleanType ReadPSDLayers(Image *image,
                   Skip over the rest of the layer mask information.
                 */
                 if (DiscardBlobBytes(image,(MagickSizeType) (length-18)) == MagickFalse)
                   {
                     layer_info=DestroyLayerInfo(layer_info,number_layers);
-                    ThrowBinaryException(CorruptImageError,"UnexpectedEndOfFile",
-                      image->filename);
+                    ThrowBinaryException(CorruptImageError,
+                      "UnexpectedEndOfFile",image->filename);
                   }
               }
             length=ReadBlobLong(image);
             combined_length+=length+4;
             if (length != 0)
@@ -2600,12 +2599,11 @@ static unsigned char *AcquireCompactPixels(const Image *image,
   compact_pixels=(unsigned char *) AcquireQuantumMemory((9*
     image->columns)+1,packet_size*sizeof(*compact_pixels));
   if (compact_pixels == (unsigned char *) NULL)
     {
       (void) ThrowMagickException(exception,GetMagickModule(),
-        ResourceLimitError,"MemoryAllocationFailed","`%s'",
-        image->filename);
+        ResourceLimitError,"MemoryAllocationFailed","`%s'",image->filename);
     }
   return(compact_pixels);
 }
 
 static size_t WritePSDChannels(const PSDInfo *psd_info,
@@ -2632,11 +2630,11 @@ static size_t WritePSDChannels(const PSDInfo *psd_info,
   offset_length=0;
   rows_offset=0;
   compact_pixels=(unsigned char *) NULL;
   if (next_image->compression == RLECompression)
     {
-      compact_pixels=AcquireCompactPixels(image,exception);
+      compact_pixels=AcquireCompactPixels(next_image,exception);
       if (compact_pixels == (unsigned char *) NULL)
         return(0);
     }
   channels=1;
   if (separate == MagickFalse)

Vulnerable code:       ThrowBinaryException(ResourceLimitError,"InvalidLength",
        image->filename);
                    ThrowBinaryException(CorruptImageError,"UnexpectedEndOfFile",
                      image->filename);
        ResourceLimitError,"MemoryAllocationFailed","`%s'",
        image->filename);
      compact_pixels=AcquireCompactPixels(image,exception);
Fixed code:       ThrowBinaryException(ResourceLimitError,"InvalidLength",image->filename);
                    ThrowBinaryException(CorruptImageError,
                      "UnexpectedEndOfFile",image->filename);
        ResourceLimitError,"MemoryAllocationFailed","`%s'",image->filename);
      compact_pixels=AcquireCompactPixels(next_image,exception);