Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2016-7534: Out-of-bounds Read (CWE-125)
value: The generic decoder in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds access) via a crafted file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2017-04-20T18:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: MagickCore/quantum-import.c, MagickCore/quantum.c
Commit date: 2016-02-07 15:13:08 -0500
Commit message: https://github.com/ImageMagick/ImageMagick/issues/126

Diff: diff --git a/MagickCore/quantum-import.c b/MagickCore/quantum-import.c
index b04c82e724..a0085f3b73 100644
--- a/MagickCore/quantum-import.c
+++ b/MagickCore/quantum-import.c
@@ -1419,11 +1419,11 @@ static void ImportCbYCrYQuantum(const Image *image,QuantumInfo *quantum_info,
           ssize_t
             n;
 
           n=0;
           quantum=0;
-          for (x=0; x < (ssize_t) number_pixels; x+=2)
+          for (x=0; x < (ssize_t) number_pixels; x+=4)
           {
             for (i=0; i < 4; i++)
             {
               switch (n % 3)
               {
diff --git a/MagickCore/quantum.c b/MagickCore/quantum.c
index 9d8190a903..a594bb6fc2 100644
--- a/MagickCore/quantum.c
+++ b/MagickCore/quantum.c
@@ -319,10 +319,13 @@ MagickExport size_t GetQuantumExtent(const Image *image,
     case RGBAQuantum: packet_size=4; break;
     case RGBOQuantum: packet_size=4; break;
     case BGRAQuantum: packet_size=4; break;
     case CMYKQuantum: packet_size=4; break;
     case CMYKAQuantum: packet_size=5; break;
+    case CbYCrAQuantum: packet_size=4; break;
+    case CbYCrQuantum: packet_size=3; break;
+    case CbYCrYQuantum: packet_size=4; break;
     default: break;
   }
   extent=MagickMax(image->columns,image->rows);
   if (quantum_info->pack == MagickFalse)
     return((size_t) (packet_size*extent*((quantum_info->depth+7)/8)));
@@ -870,11 +873,10 @@ MagickExport void SetQuantumPack(QuantumInfo *quantum_info,
   assert(quantum_info != (QuantumInfo *) NULL);
   assert(quantum_info->signature == MagickCoreSignature);
   quantum_info->pack=pack;
 }
 
-
 /*
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 %                                                                             %
 %                                                                             %
 %                                                                             %

Vulnerable code:           for (x=0; x < (ssize_t) number_pixels; x+=2)

Fixed code:           for (x=0; x < (ssize_t) number_pixels; x+=4)
    case CbYCrAQuantum: packet_size=4; break;
    case CbYCrQuantum: packet_size=3; break;
    case CbYCrYQuantum: packet_size=4; break;
CVE-2016-7536: Improper Input Validation (CWE-20)
value: magick/profile.c in ImageMagick allows remote attackers to cause a denial of service (segmentation fault) via a crafted profile.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 6.5
Published: 2017-04-20T18:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: MagickCore/profile.c
Commit date: 2016-02-14 08:39:52 +0100
Commit message: Fixed SEGV reported in https://github.com/ImageMagick/ImageMagick/issues/130

Diff: diff --git a/MagickCore/profile.c b/MagickCore/profile.c
index 3b5048b97f..e2e437d52d 100644
--- a/MagickCore/profile.c
+++ b/MagickCore/profile.c
@@ -1440,11 +1440,12 @@ static void WriteTo8BimProfile(Image *image,const char *name,
       break;
     p=ReadResourceLong(p,&value);
     count=(ssize_t) value;
     if ((count & 0x01) != 0)
       count++;
-    if ((p > (datum+length-count)) || (count > (ssize_t) length))
+    if ((count < 0) || (p > (datum+length-count)) ||
+        (count > (ssize_t) length))
       break;
     if (id != profile_id)
       p+=count;
     else
       {

Vulnerable code:     if ((p > (datum+length-count)) || (count > (ssize_t) length))
Fixed code:     if ((count < 0) || (p > (datum+length-count)) ||
        (count > (ssize_t) length))
CVE-2016-7537: Out-of-bounds Read (CWE-125)
value: MagickCore/memory.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds access) via a crafted PDB file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2017-04-19T14:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/pdb.c
Commit date: 2016-03-07 07:13:10 -0500
Commit message: https://github.com/ImageMagick/ImageMagick/issues/143

Diff: diff --git a/coders/pdb.c b/coders/pdb.c
index ab40dd86ab..67a4c45cd9 100644
--- a/coders/pdb.c
+++ b/coders/pdb.c
@@ -413,11 +413,11 @@ static Image *ReadPDBImage(const ImageInfo *image_info,ExceptionInfo *exception)
     {
       (void) CloseBlob(image);
       return(GetFirstImageInList(image));
     }
   packets=(bits_per_pixel*image->columns+7)/8;
-  pixels=(unsigned char *) AcquireQuantumMemory(packets+256UL,image->rows*
+  pixels=(unsigned char *) AcquireQuantumMemory(packets+257UL,image->rows*
     sizeof(*pixels));
   if (pixels == (unsigned char *) NULL)
     ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
   switch (pdb_image.version & 0x07) 
   {
@@ -821,11 +821,11 @@ static MagickBooleanType WritePDBImage(const ImageInfo *image_info,Image *image,
   packets=((bits_per_pixel*image->columns+7)/8);
   runlength=(unsigned char *) AcquireQuantumMemory(9UL*packets,
     image->rows*sizeof(*runlength));
   if (runlength == (unsigned char *) NULL)
     ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
-  buffer=(unsigned char *) AcquireQuantumMemory(256,sizeof(*buffer));
+  buffer=(unsigned char *) AcquireQuantumMemory(257,sizeof(*buffer));
   if (buffer == (unsigned char *) NULL)
     ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
   packet_size=(size_t) (image->depth > 8 ? 2: 1);
   scanline=(unsigned char *) AcquireQuantumMemory(image->columns,packet_size*
     sizeof(*scanline));

Vulnerable code:   pixels=(unsigned char *) AcquireQuantumMemory(packets+256UL,image->rows*
  buffer=(unsigned char *) AcquireQuantumMemory(256,sizeof(*buffer));
Fixed code:   pixels=(unsigned char *) AcquireQuantumMemory(packets+257UL,image->rows*
  buffer=(unsigned char *) AcquireQuantumMemory(257,sizeof(*buffer));
CVE-2016-7538: Out-of-bounds Write (CWE-787)
value: coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2017-04-20T18:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/psd.c
Commit date: 2016-03-12 08:05:31 -0500
Commit message: https://github.com/ImageMagick/ImageMagick/issues/148

Diff: diff --git a/coders/psd.c b/coders/psd.c
index ca3ebae385..1f63ec79eb 100644
--- a/coders/psd.c
+++ b/coders/psd.c
@@ -2564,13 +2564,16 @@ static void RemoveICCProfileFromResourceBlock(StringInfo *bim_profile)
     p=PushShortPixel(MSBEndian,p,&id);
     p=PushShortPixel(MSBEndian,p,&short_sans);
     p=PushLongPixel(MSBEndian,p,&count);
     if (id == 0x0000040f)
       {
-        (void) CopyMagickMemory(q,q+PSDQuantum(count)+12,length-
-          (PSDQuantum(count)+12)-(q-datum));
-        SetStringInfoLength(bim_profile,length-(PSDQuantum(count)+12));
+        if ((q+PSDQuantum(count)+12) < (datum+length-16))
+          {
+            (void) CopyMagickMemory(q,q+PSDQuantum(count)+12,length-
+              (PSDQuantum(count)+12)-(q-datum));
+            SetStringInfoLength(bim_profile,length-(PSDQuantum(count)+12));
+          }
         break;
       }
     p+=count;
     if ((count & 0x01) != 0)
       p++;

Vulnerable code:         (void) CopyMagickMemory(q,q+PSDQuantum(count)+12,length-
          (PSDQuantum(count)+12)-(q-datum));
        SetStringInfoLength(bim_profile,length-(PSDQuantum(count)+12));
Fixed code:         if ((q+PSDQuantum(count)+12) < (datum+length-16))
          {
            (void) CopyMagickMemory(q,q+PSDQuantum(count)+12,length-
              (PSDQuantum(count)+12)-(q-datum));
            SetStringInfoLength(bim_profile,length-(PSDQuantum(count)+12));
          }
CVE-2016-7799: Out-of-bounds Read (CWE-125)
value: MagickCore/profile.c in ImageMagick before 7.0.3-2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2017-01-18T17:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: MagickCore/profile.c
Commit date: 2016-09-30 15:19:38 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/280

Diff: diff --git a/MagickCore/profile.c b/MagickCore/profile.c
index ea76057700..4239d558c6 100644
--- a/MagickCore/profile.c
+++ b/MagickCore/profile.c
@@ -2030,11 +2030,11 @@ MagickBooleanType SyncExifProfile(Image *image,StringInfo *profile)
       q=(unsigned char *) (directory+2+(12*entry));
       if (q > (exif+length-12))
         break;  /* corrupt EXIF */
       tag_value=(ssize_t) ReadProfileShort(endian,q);
       format=(ssize_t) ReadProfileShort(endian,q+2);
-      if ((format-1) >= EXIF_NUM_FORMATS)
+      if ((format < 0) || ((format-1) >= EXIF_NUM_FORMATS))
         break;
       components=(ssize_t) ReadProfileLong(endian,q+4);
       if (components < 0)
         break;  /* corrupt EXIF */
       number_bytes=(size_t) components*format_bytes[format];

Vulnerable code:       if ((format-1) >= EXIF_NUM_FORMATS)
Fixed code:       if ((format < 0) || ((format-1) >= EXIF_NUM_FORMATS))
CVE-2016-7906: Use After Free (CWE-416)
value: magick/attribute.c in ImageMagick 7.0.3-2 allows remote attackers to cause a denial of service (use-after-free) via a crafted file.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 5.5
Published: 2017-01-18T17:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: MagickCore/attribute.c
Commit date: 2016-10-01 11:18:08 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/281

Diff: diff --git a/MagickCore/attribute.c b/MagickCore/attribute.c
index d9f088ad75..f6510b7bf3 100644
--- a/MagickCore/attribute.c
+++ b/MagickCore/attribute.c
@@ -1262,11 +1262,11 @@ MagickExport MagickBooleanType SetImageType(Image *image,const ImageType type,
           quantize_info->number_colors=2;
           quantize_info->colorspace=GRAYColorspace;
           status=QuantizeImage(quantize_info,image,exception);
           quantize_info=DestroyQuantizeInfo(quantize_info);
         }
-      image->colors=2;
+      status=AcquireImageColormap(image,2,exception);
       image->alpha_trait=UndefinedPixelTrait;
       break;
     }
     case GrayscaleType:
     {

Vulnerable code:       image->colors=2;
Fixed code:       status=AcquireImageColormap(image,2,exception);
CVE-2016-9298: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Heap overflow in the WaveletDenoiseImage function in MagickCore/fx.c in ImageMagick before 6.9.6-4 and 7.x before 7.0.3-6 allows remote attackers to cause a denial of service (crash) via a crafted image.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 5.5
Published: 2017-01-27T22:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: MagickCore/fx.c, PerlMagick/demo/demo.pl
Commit date: 2016-10-31 19:49:54 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/296

Diff: diff --git a/MagickCore/fx.c b/MagickCore/fx.c
index 09d7a2a7a0..869b07bd2f 100644
--- a/MagickCore/fx.c
+++ b/MagickCore/fx.c
@@ -5864,11 +5864,11 @@ MagickExport Image *WaveletDenoiseImage(const Image *image,
     }
   if (AcquireMagickResource(WidthResource,4*image->columns) == MagickFalse)
     ThrowImageException(ResourceLimitError,"MemoryAllocationFailed");
   pixels_info=AcquireVirtualMemory(3*image->columns,image->rows*
     sizeof(*pixels));
-  kernel=(float *) AcquireQuantumMemory(MagickMax(image->rows,image->columns),
+  kernel=(float *) AcquireQuantumMemory(MagickMax(image->rows,image->columns)+1,
     GetOpenMPMaximumThreads()*sizeof(*kernel));
   if ((pixels_info == (MemoryInfo *) NULL) || (kernel == (float *) NULL))
     {
       if (kernel != (float *) NULL)
         kernel=(float *) RelinquishMagickMemory(kernel);
diff --git a/PerlMagick/demo/demo.pl b/PerlMagick/demo/demo.pl
index 006159707a..b175bcfd34 100644
--- a/PerlMagick/demo/demo.pl
+++ b/PerlMagick/demo/demo.pl
@@ -481,11 +481,11 @@ $example->Label('Wave');
 $example->Wave('25x150');
 push(@$images,$example);
 
 print "WaveletDenoise...\n";
 $example=$model->Clone();
-$example->Label('WaveletDenoise');
+$example->Label('Wavelet Denoise');
 $example->WaveletDenoise('5%');
 push(@$images,$example);
 
 #
 # Create image montage.

Vulnerable code:   kernel=(float *) AcquireQuantumMemory(MagickMax(image->rows,image->columns),
$example->Label('WaveletDenoise');
Fixed code:   kernel=(float *) AcquireQuantumMemory(MagickMax(image->rows,image->columns)+1,
$example->Label('Wavelet Denoise');
CVE-2016-9556: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: The IsPixelGray function in MagickCore/pixel-accessor.h in ImageMagick 7.0.3-8 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted image file.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 5.5
Published: 2017-03-23T18:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/sgi.c
Commit date: 2016-11-16 15:50:12 -0500
Commit message: https://github.com/ImageMagick/ImageMagick/issues/301

Diff: diff --git a/coders/sgi.c b/coders/sgi.c
index 6b0e9eb5a8..a0eebe97df 100644
--- a/coders/sgi.c
+++ b/coders/sgi.c
@@ -330,10 +330,12 @@ static Image *ReadSGIImage(const ImageInfo *image_info,ExceptionInfo *exception)
     }
     iris_info.bytes_per_pixel=(unsigned char) ReadBlobByte(image);
     if ((iris_info.bytes_per_pixel == 0) || (iris_info.bytes_per_pixel > 2))
       ThrowReaderException(CorruptImageError,"ImproperImageHeader");
     iris_info.dimension=ReadBlobMSBShort(image);
+    if ((iris_info.dimension == 0) || (iris_info.dimension > 3)) 
+      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
     iris_info.columns=ReadBlobMSBShort(image);
     iris_info.rows=ReadBlobMSBShort(image);
     iris_info.depth=ReadBlobMSBShort(image);
     if ((iris_info.depth == 0) || (iris_info.depth > 4))
       ThrowReaderException(CorruptImageError,"ImproperImageHeader");

Fixed code:     if ((iris_info.dimension == 0) || (iris_info.dimension > 3)) 
      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
CVE-2017-11310: Missing Release of Resource after Effective Lifetime (CWE-772)
value: The read_user_chunk_callback function in coders\png.c in ImageMagick 7.0.6-1 Q16 2017-06-21 (beta) has memory leak vulnerabilities via crafted PNG files.
CWE description: The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
CVSS v3 base score: 8.8
Published: 2017-07-13T18:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: Other
Files changed: ChangeLog, coders/png.c
Commit date: 2017-06-22 13:05:22 -0400
Commit message: coders/png.c: Stop a memory leak in read_user_chunk_callback() (reference

https://github.com/ImageMagick/ImageMagick/issues/517).

Diff: diff --git a/ChangeLog b/ChangeLog
index cd7af7c90a7..c3749bd40c5 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,9 @@
+2017-06-10  7.0.6-0 Glenn Randers-Pehrson <glennrp@image...>
+  * Stop a memory leak in read_user_chunk_callback() (reference
+    https://github.com/ImageMagick/ImageMagick/issues/517).
+
 2017-06-10  7.0.6-0 Cristy  <quetzlzacatenango@image...>
   * Release ImageMagick version 7.0.6-0, GIT revision 20194:b0c0d00:20170611.
 
 2017-06-10  7.0.6-0 Glenn Randers-Pehrson <glennrp@image...>
   * coders/png.c: Accept exIf chunks whose data segment
diff --git a/coders/png.c b/coders/png.c
index ffc6f6d0002..e6e6f280333 100644
--- a/coders/png.c
+++ b/coders/png.c
@@ -1902,10 +1902,11 @@ static int read_user_chunk_callback(png_struct *ping, png_unknown_chunkp chunk)
         {
           if (p[1] != 'x' || p[2] != 'i' || p[3] != 'f' ||
               p[4] != '\0' || p[5] != '\0')
             {
               /* Chunk is malformed */
+              profile=DestroyStringInfo(profile);
               return(-1);
             }
          }
 
       /* copy chunk->data to profile */
@@ -1915,10 +1916,12 @@ static int read_user_chunk_callback(png_struct *ping, png_unknown_chunkp chunk)
 
       error_info=(PNGErrorInfo *) png_get_error_ptr(ping);
       (void) SetImageProfile(image,"exif",profile,
         error_info->exception);
 
+      profile=DestroyStringInfo(profile);
+
       return(1);
     }
 
   /* vpAg (deprecated, replaced by caNv) */
   if (chunk->name[0] == 118 &&
@@ -2288,10 +2291,11 @@ static Image *ReadOnePNGImage(MngInfo *mng_info,
   if (setjmp(png_jmpbuf(ping)))
     {
       /*
         PNG image is corrupt.
       */
+      printf("  destroy_read_struct\n");
       png_destroy_read_struct(&ping,&ping_info,&end_info);
 
 #ifdef IMPNG_SETJMP_NOT_THREAD_SAFE
       UnlockSemaphoreInfo(ping_semaphore);
 #endif

Fixed code: 2017-06-10  7.0.6-0 Glenn Randers-Pehrson <glennrp@image...>
  * Stop a memory leak in read_user_chunk_callback() (reference
    https://github.com/ImageMagick/ImageMagick/issues/517).

              profile=DestroyStringInfo(profile);
      profile=DestroyStringInfo(profile);

      printf("  destroy_read_struct\n");
CVE-2017-11447: Missing Release of Resource after Effective Lifetime (CWE-772)
value: The ReadSCREENSHOTImage function in coders/screenshot.c in ImageMagick before 7.0.6-1 has memory leaks, causing denial of service.
CWE description: The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
CVSS v3 base score: 6.5
Published: 2017-07-19T07:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/screenshot.c
Commit date: 2017-06-19 22:59:45 +0200
Commit message: Fixed potential memory leak.

Diff: diff --git a/coders/screenshot.c b/coders/screenshot.c
index e9223c73926..e2e6d8605ac 100644
--- a/coders/screenshot.c
+++ b/coders/screenshot.c
@@ -163,17 +163,17 @@ static Image *ReadSCREENSHOTImage(const ImageInfo *image_info,
 
       screen=AcquireImage(image_info,exception);
       screen->columns=(size_t) GetDeviceCaps(hDC,HORZRES);
       screen->rows=(size_t) GetDeviceCaps(hDC,VERTRES);
       screen->storage_class=DirectClass;
-      status=SetImageExtent(screen,screen->columns,screen->rows,exception);
-      if (status == MagickFalse)
-        return(DestroyImageList(image));
       if (image == (Image *) NULL)
         image=screen;
       else
         AppendImageToList(&image,screen);
+      status=SetImageExtent(screen,screen->columns,screen->rows,exception);
+      if (status == MagickFalse)
+        return(DestroyImageList(image));
 
       bitmapDC=CreateCompatibleDC(hDC);
       if (bitmapDC == (HDC) NULL)
         {
           DeleteDC(hDC);

Vulnerable code:       status=SetImageExtent(screen,screen->columns,screen->rows,exception);
      if (status == MagickFalse)
        return(DestroyImageList(image));
Fixed code:       status=SetImageExtent(screen,screen->columns,screen->rows,exception);
      if (status == MagickFalse)
        return(DestroyImageList(image));
CVE-2017-11448: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: The ReadJPEGImage function in coders/jpeg.c in ImageMagick before 7.0.6-1 allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted file.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 6.5
Published: 2017-07-19T07:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/jpeg.c
Commit date: 2017-07-09 09:06:00 -0400
Commit message: Zero pixel buffer

Diff: diff --git a/coders/jpeg.c b/coders/jpeg.c
index 2d1be58a923..c3a813a6e59 100644
--- a/coders/jpeg.c
+++ b/coders/jpeg.c
@@ -1316,10 +1316,12 @@ static Image *ReadJPEGImage(const ImageInfo *image_info,
     {
       jpeg_destroy_decompress(&jpeg_info);
       ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
     }
   jpeg_pixels=(JSAMPLE *) GetVirtualMemoryBlob(memory_info);
+  (void) ResetMagickMemory(jpeg_pixels,0,image->columns*
+    jpeg_info.output_components*sizeof(*jpeg_pixels));
   /*
     Convert JPEG pixels to pixel packets.
   */
   if (setjmp(error_manager.error_recovery) != 0)
     {

Fixed code:   (void) ResetMagickMemory(jpeg_pixels,0,image->columns*
    jpeg_info.output_components*sizeof(*jpeg_pixels));
CVE-2017-11522: NULL Pointer Dereference (CWE-476)
value: The WriteOnePNGImage function in coders/png.c in ImageMagick through 6.9.9-0 and 7.x through 7.0.6-1 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 6.5
Published: 2017-07-22T21:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/png.c
Commit date: 2017-07-18 18:12:58 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/58

Diff: diff --git a/coders/png.c b/coders/png.c
index f6ddf6d7c3e..c61b6874e7a 100644
--- a/coders/png.c
+++ b/coders/png.c
@@ -8268,13 +8268,15 @@ static MagickBooleanType WriteOnePNGImage(MngInfo *mng_info,
 
   logging=LogMagickEvent(CoderEvent,GetMagickModule(),
     "  Enter WriteOnePNGImage()");
 
   image = CloneImage(IMimage,0,0,MagickFalse,exception);
+  if (image == (Image *) NULL)
+    return(MagickFalse);
   image_info=(ImageInfo *) CloneImageInfo(IMimage_info);
   if (image_info == (ImageInfo *) NULL)
-     ThrowWriterException(ResourceLimitError, "MemoryAllocationFailed");
+    ThrowWriterException(ResourceLimitError, "MemoryAllocationFailed");
 
   /* Define these outside of the following "if logging()" block so they will
    * show in debuggers.
    */
   *im_vers='\0';

Vulnerable code:      ThrowWriterException(ResourceLimitError, "MemoryAllocationFailed");
Fixed code:   if (image == (Image *) NULL)
    return(MagickFalse);
    ThrowWriterException(ResourceLimitError, "MemoryAllocationFailed");
CVE-2017-11523: Loop with Unreachable Exit Condition ('Infinite Loop') (CWE-835)
value: The ReadTXTImage function in coders/txt.c in ImageMagick through 6.9.9-0 and 7.x through 7.0.6-1 allows remote attackers to cause a denial of service (infinite loop) via a crafted file, because the end-of-file condition is not considered.
CWE description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CVSS v3 base score: 6.5
Published: 2017-07-22T21:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/txt.c
Commit date: 2017-07-19 13:16:53 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/591

Diff: diff --git a/coders/txt.c b/coders/txt.c
index c3d37fff692..16e7ac2e94c 100644
--- a/coders/txt.c
+++ b/coders/txt.c
@@ -561,10 +561,16 @@ static Image *ReadTXTImage(const ImageInfo *image_info,ExceptionInfo *exception)
         SetPixelViaPixelInfo(image,&pixel,q);
         if (SyncAuthenticPixels(image,exception) == MagickFalse)
           break;
       }
     }
+    if (EOFBlob(image) != MagickFalse)
+      {
+        ThrowFileException(exception,CorruptImageError,"UnexpectedEndOfFile",
+          image->filename);
+        break;
+      }
     (void) ReadBlobString(image,text);
     if (LocaleNCompare((char *) text,MagickID,strlen(MagickID)) == 0)
       {
         /*
           Allocate next image structure.

Fixed code:     if (EOFBlob(image) != MagickFalse)
      {
        ThrowFileException(exception,CorruptImageError,"UnexpectedEndOfFile",
          image->filename);
        break;
      }
CVE-2017-12640: Out-of-bounds Read (CWE-125)
value: ImageMagick 7.0.6-1 has an out-of-bounds read vulnerability in ReadOneMNGImage in coders/png.c.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8.8
Published: 2017-08-07T15:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/png.c
Commit date: 2017-07-06 19:20:57 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/542

Diff: diff --git a/coders/png.c b/coders/png.c
index dfe6843ac1c..860d28ec41c 100644
--- a/coders/png.c
+++ b/coders/png.c
@@ -5966,10 +5966,12 @@ static Image *ReadOneMNGImage(MngInfo* mng_info, const ImageInfo *image_info,
               last_object=(p[2] << 8) | p[3];
               p+=4;
 
               for (i=(ssize_t) first_object; i <= (ssize_t) last_object; i++)
               {
+                if ((i < 0) || (i >= MNG_MAX_OBJECTS))
+                  continue;
                 if (mng_info->exists[i] && !mng_info->frozen[i] &&
                     (p-chunk) < (ssize_t) (length-8))
                   {
                     MngPair
                       new_pair;

Fixed code:                 if ((i < 0) || (i >= MNG_MAX_OBJECTS))
                  continue;
CVE-2017-12641: Missing Release of Resource after Effective Lifetime (CWE-772)
value: ImageMagick 7.0.6-1 has a memory leak vulnerability in ReadOneJNGImage in coders\png.c.
CWE description: The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
CVSS v3 base score: 8.8
Published: 2017-08-07T15:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/png.c
Commit date: 2017-07-08 18:30:09 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/550

Diff: diff --git a/coders/png.c b/coders/png.c
index dc8be522074..080709c047c 100644
--- a/coders/png.c
+++ b/coders/png.c
@@ -4375,11 +4375,17 @@ static Image *ReadOneJNGImage(MngInfo *mng_info,
       (void) LogMagickEvent(CoderEvent,GetMagickModule(),
         "  Reading JNG chunk type %c%c%c%c, length: %.20g",
         type[0],type[1],type[2],type[3],(double) length);
 
     if (length > PNG_UINT_31_MAX || count == 0)
-      ThrowReaderException(CorruptImageError,"CorruptImage");
+      {
+        if (color_image != (Image *) NULL)
+          color_image=DestroyImage(color_image);
+        if (color_image_info != (Image *) NULL)
+          color_image_info=DestroyImageInfo(color_image_info);
+        ThrowReaderException(CorruptImageError,"CorruptImage");
+      }
 
     p=NULL;
     chunk=(unsigned char *) NULL;
 
     if (length != 0)

Vulnerable code:       ThrowReaderException(CorruptImageError,"CorruptImage");
Fixed code:       {
        if (color_image != (Image *) NULL)
          color_image=DestroyImage(color_image);
        if (color_image_info != (Image *) NULL)
          color_image_info=DestroyImageInfo(color_image_info);
        ThrowReaderException(CorruptImageError,"CorruptImage");
      }
CVE-2017-12643: Allocation of Resources Without Limits or Throttling (CWE-770)
value: ImageMagick 7.0.6-1 has a memory exhaustion vulnerability in ReadOneJNGImage in coders\png.c.
CWE description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
CVSS v3 base score: 6.5
Published: 2017-08-07T15:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/png.c
Commit date: 2017-07-08 08:16:22 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/549

Diff: diff --git a/coders/png.c b/coders/png.c
index 0253c82fcfa..dc8be522074 100644
--- a/coders/png.c
+++ b/coders/png.c
@@ -4382,10 +4382,12 @@ static Image *ReadOneJNGImage(MngInfo *mng_info,
     p=NULL;
     chunk=(unsigned char *) NULL;
 
     if (length != 0)
       {
+        if (length > GetBlobSize(image))
+          ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
         chunk=(unsigned char *) AcquireQuantumMemory(length+MagickPathExtent,
           sizeof(*chunk));
 
         if (chunk == (unsigned char *) NULL)
           ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
@@ -5258,16 +5260,18 @@ static Image *ReadOneMNGImage(MngInfo* mng_info, const ImageInfo *image_info,
         p=NULL;
         chunk=(unsigned char *) NULL;
 
         if (length != 0)
           {
+            if (length > GetBlobSize(image))
+              ThrowReaderException(CorruptImageError,
+                "InsufficientImageDataInFile");
             chunk=(unsigned char *) AcquireQuantumMemory(length+
              MagickPathExtent,sizeof(*chunk));
 
             if (chunk == (unsigned char *) NULL)
-              ThrowReaderException(ResourceLimitError,
-                "MemoryAllocationFailed");
+              ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
 
             for (i=0; i < (ssize_t) length; i++)
             {
               int
                 c;

Vulnerable code:               ThrowReaderException(ResourceLimitError,
                "MemoryAllocationFailed");
Fixed code:         if (length > GetBlobSize(image))
          ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
            if (length > GetBlobSize(image))
              ThrowReaderException(CorruptImageError,
                "InsufficientImageDataInFile");
              ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
CVE-2017-12644: Missing Release of Resource after Effective Lifetime (CWE-772)
value: ImageMagick 7.0.6-1 has a memory leak vulnerability in ReadDCMImage in coders\dcm.c.
CWE description: The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
CVSS v3 base score: 8.8
Published: 2017-08-07T15:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/dcm.c
Commit date: 2017-07-09 08:10:10 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/551

Diff: diff --git a/coders/dcm.c b/coders/dcm.c
index 08d497f002b..55377c4f9cc 100644
--- a/coders/dcm.c
+++ b/coders/dcm.c
@@ -3268,11 +3268,11 @@ static Image *ReadDCMImage(const ImageInfo *image_info,ExceptionInfo *exception)
           }
         else
           if ((quantum != 0) && (length != 0))
             {
               if (length > GetBlobSize(image))
-                ThrowReaderException(CorruptImageError,
+                ThrowDCMException(CorruptImageError,
                   "InsufficientImageDataInFile");
               if (~length >= 1)
                 data=(unsigned char *) AcquireQuantumMemory(length+1,quantum*
                   sizeof(*data));
               if (data == (unsigned char *) NULL)

Vulnerable code:                 ThrowReaderException(CorruptImageError,
Fixed code:                 ThrowDCMException(CorruptImageError,
CVE-2017-12662: Missing Release of Resource after Effective Lifetime (CWE-772)
value: ImageMagick 7.0.6-2 has a memory leak vulnerability in WritePDFImage in coders/pdf.c.
CWE description: The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
CVSS v3 base score: 8.8
Published: 2017-08-07T21:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/pdf.c
Commit date: 2017-07-17 19:15:49 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/576

Diff: diff --git a/coders/pdf.c b/coders/pdf.c
index 55f32d6e72a..dc7fc6e958e 100644
--- a/coders/pdf.c
+++ b/coders/pdf.c
@@ -1987,11 +1987,15 @@ RestoreMSCWarning
             */
             length=(size_t) number_pixels;
             length*=image->colorspace == CMYKColorspace ? 4UL : 3UL;
             pixel_info=AcquireVirtualMemory(length,sizeof(*pixels));
             if (pixel_info == (MemoryInfo *) NULL)
-              ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
+              {
+                xref=(MagickOffsetType *) RelinquishMagickMemory(xref);
+                ThrowWriterException(ResourceLimitError,
+                  "MemoryAllocationFailed");
+              }
             pixels=(unsigned char *) GetVirtualMemoryBlob(pixel_info);
             /*
               Dump runoffset encoded pixels.
             */
             q=pixels;
@@ -2084,12 +2088,15 @@ RestoreMSCWarning
                 Allocate pixel array.
               */
               length=(size_t) number_pixels;
               pixel_info=AcquireVirtualMemory(length,sizeof(*pixels));
               if (pixel_info == (MemoryInfo *) NULL)
-                ThrowWriterException(ResourceLimitError,
-                  "MemoryAllocationFailed");
+                {
+                  xref=(MagickOffsetType *) RelinquishMagickMemory(xref);
+                  ThrowWriterException(ResourceLimitError,
+                    "MemoryAllocationFailed");
+                }
               pixels=(unsigned char *) GetVirtualMemoryBlob(pixel_info);
               /*
                 Dump Runlength encoded pixels.
               */
               q=pixels;

Vulnerable code:               ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
                ThrowWriterException(ResourceLimitError,
                  "MemoryAllocationFailed");
Fixed code:               {
                xref=(MagickOffsetType *) RelinquishMagickMemory(xref);
                ThrowWriterException(ResourceLimitError,
                  "MemoryAllocationFailed");
              }
                {
                  xref=(MagickOffsetType *) RelinquishMagickMemory(xref);
                  ThrowWriterException(ResourceLimitError,
                    "MemoryAllocationFailed");
                }
CVE-2017-12665: Missing Release of Resource after Effective Lifetime (CWE-772)
value: ImageMagick 7.0.6-2 has a memory leak vulnerability in WritePICTImage in coders/pict.c.
CWE description: The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
CVSS v3 base score: 8.8
Published: 2017-08-07T21:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/pict.c
Commit date: 2017-07-17 19:20:45 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/577

Diff: diff --git a/coders/pict.c b/coders/pict.c
index 052eff67a36..fec025bb1f2 100644
--- a/coders/pict.c
+++ b/coders/pict.c
@@ -1742,11 +1742,20 @@ static MagickBooleanType WritePICTImage(const ImageInfo *image_info,
    (row_bytes+MaxCount),sizeof(*packed_scanline));
   scanline=(unsigned char *) AcquireQuantumMemory(row_bytes,sizeof(*scanline));
   if ((buffer == (unsigned char *) NULL) ||
       (packed_scanline == (unsigned char *) NULL) ||
       (scanline == (unsigned char *) NULL))
-    ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
+    {
+      if (scanline != (unsigned char *) NULL)
+        scanline=(unsigned char *) RelinquishMagickMemory(scanline);
+      if (packed_scanline != (unsigned char *) NULL)
+        packed_scanline=(unsigned char *) RelinquishMagickMemory(
+          packed_scanline);
+      if (buffer != (unsigned char *) NULL)
+        buffer=(unsigned char *) RelinquishMagickMemory(buffer);
+      ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
+    }
   (void) ResetMagickMemory(scanline,0,row_bytes);
   (void) ResetMagickMemory(packed_scanline,0,(size_t) (row_bytes+MaxCount));
   /*
     Write header, header size, size bounding box, version, and reserved.
   */

Vulnerable code:     ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
Fixed code:     {
      if (scanline != (unsigned char *) NULL)
        scanline=(unsigned char *) RelinquishMagickMemory(scanline);
      if (packed_scanline != (unsigned char *) NULL)
        packed_scanline=(unsigned char *) RelinquishMagickMemory(
          packed_scanline);
      if (buffer != (unsigned char *) NULL)
        buffer=(unsigned char *) RelinquishMagickMemory(buffer);
      ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
    }
CVE-2017-12666: Missing Release of Resource after Effective Lifetime (CWE-772)
value: ImageMagick 7.0.6-2 has a memory leak vulnerability in WriteINLINEImage in coders/inline.c.
CWE description: The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
CVSS v3 base score: 8.8
Published: 2017-08-07T21:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/inline.c
Commit date: 2017-07-17 07:35:30 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/572

Diff: diff --git a/coders/inline.c b/coders/inline.c
index 318624e1c5f..4bf2ced92e8 100644
--- a/coders/inline.c
+++ b/coders/inline.c
@@ -314,11 +314,14 @@ static MagickBooleanType WriteINLINEImage(const ImageInfo *image_info,
   if (LocaleCompare(write_info->magick,"INLINE") == 0)
     (void) CopyMagickString(write_info->magick,image->magick,MagickPathExtent);
   magick_info=GetMagickInfo(write_info->magick,exception);
   if ((magick_info == (const MagickInfo *) NULL) ||
       (GetMagickMimeType(magick_info) == (const char *) NULL))
-    ThrowWriterException(CorruptImageError,"ImageTypeNotSupported");
+    {
+      write_info=DestroyImageInfo(write_info);
+      ThrowWriterException(CorruptImageError,"ImageTypeNotSupported");
+    }
   (void) CopyMagickString(image->filename,write_info->filename,
     MagickPathExtent);
   blob_length=2048;
   write_image=CloneImage(image,0,0,MagickTrue,exception);
   if (write_image == (Image *) NULL)

Vulnerable code:     ThrowWriterException(CorruptImageError,"ImageTypeNotSupported");
Fixed code:     {
      write_info=DestroyImageInfo(write_info);
      ThrowWriterException(CorruptImageError,"ImageTypeNotSupported");
    }
CVE-2017-12667: Missing Release of Resource after Effective Lifetime (CWE-772)
value: ImageMagick 7.0.6-1 has a memory leak vulnerability in ReadMATImage in coders\mat.c.
CWE description: The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
CVSS v3 base score: 8.8
Published: 2017-08-07T21:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/mat.c
Commit date: 2017-07-09 08:24:18 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/553

Diff: diff --git a/coders/mat.c b/coders/mat.c
index f9155c53727..388139caefa 100644
--- a/coders/mat.c
+++ b/coders/mat.c
@@ -929,11 +929,15 @@ static Image *ReadMATImage(const ImageInfo *image_info,ExceptionInfo *exception)
   }
   else
     goto MATLAB_KO;    /* unsupported endian */
 
   if (strncmp(MATLAB_HDR.identific, "MATLAB", 6))
-MATLAB_KO: ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+    {
+MATLAB_KO:
+      clone_info=DestroyImageInfo(clone_info);
+      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
+    }
 
   filepos = TellBlob(image);
   while(!EOFBlob(image)) /* object parser loop */
   {
     Frames = 1;

Vulnerable code: MATLAB_KO: ThrowReaderException(CorruptImageError,"ImproperImageHeader");
Fixed code:     {
MATLAB_KO:
      clone_info=DestroyImageInfo(clone_info);
      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
    }
CVE-2017-12668: Missing Release of Resource after Effective Lifetime (CWE-772)
value: ImageMagick 7.0.6-2 has a memory leak vulnerability in WritePCXImage in coders/pcx.c.
CWE description: The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
CVSS v3 base score: 8.8
Published: 2017-08-07T21:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/pcx.c
Commit date: 2017-07-17 19:09:14 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/575

Diff: diff --git a/coders/pcx.c b/coders/pcx.c
index 0c0dda15a9d..9dec02671a5 100644
--- a/coders/pcx.c
+++ b/coders/pcx.c
@@ -1005,11 +1005,14 @@ static MagickBooleanType WritePCXImage(const ImageInfo *image_info,Image *image,
     for (i=0; i < 58; i++)
       (void) WriteBlobByte(image,'\0');
     length=(size_t) pcx_info.bytes_per_line;
     pixel_info=AcquireVirtualMemory(length,pcx_info.planes*sizeof(*pixels));
     if (pixel_info == (MemoryInfo *) NULL)
-      ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
+      {
+        pcx_colormap=(unsigned char *) RelinquishMagickMemory(pcx_colormap);
+        ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
+      }
     pixels=(unsigned char *) GetVirtualMemoryBlob(pixel_info);
     q=pixels;
     if ((image->storage_class == DirectClass) || (image->colors > 256))
       {
         /*

Vulnerable code:       ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
Fixed code:       {
        pcx_colormap=(unsigned char *) RelinquishMagickMemory(pcx_colormap);
        ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
      }
CVE-2017-12669: Missing Release of Resource after Effective Lifetime (CWE-772)
value: ImageMagick 7.0.6-2 has a memory leak vulnerability in WriteCALSImage in coders/cals.c.
CWE description: The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
CVSS v3 base score: 8.8
Published: 2017-08-07T21:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/cals.c
Commit date: 2017-07-16 20:33:35 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/571

Diff: diff --git a/coders/cals.c b/coders/cals.c
index 70e02132b95..de326522644 100644
--- a/coders/cals.c
+++ b/coders/cals.c
@@ -555,18 +555,20 @@ static MagickBooleanType WriteCALSImage(const ImageInfo *image_info,
   (void) CopyMagickString(write_info->filename,"GROUP4:",MagickPathExtent);
   (void) CopyMagickString(write_info->magick,"GROUP4",MagickPathExtent);
   group4_image=CloneImage(image,0,0,MagickTrue,exception);
   if (group4_image == (Image *) NULL)
     {
+      write_info=DestroyImageInfo(write_info);
       (void) CloseBlob(image);
       return(MagickFalse);
     }
   group4=(unsigned char *) ImageToBlob(write_info,group4_image,&length,
     exception);
   group4_image=DestroyImage(group4_image);
   if (group4 == (unsigned char *) NULL)
     {
+      write_info=DestroyImageInfo(write_info);
       (void) CloseBlob(image);
       return(MagickFalse);
     }
   write_info=DestroyImageInfo(write_info);
   if (WriteBlob(image,length,group4) != (ssize_t) length)

Fixed code:       write_info=DestroyImageInfo(write_info);
      write_info=DestroyImageInfo(write_info);
CVE-2017-12876: Out-of-bounds Write (CWE-787)
value: Heap-based buffer overflow in enhance.c in ImageMagick before 7.0.6-6 allows remote attackers to cause a denial of service via a crafted file.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2017-08-28T19:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: MagickCore/enhance.c
Commit date: 2017-08-09 09:59:44 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/663
https://github.com/ImageMagick/ImageMagick/issues/655

Diff: diff --git a/MagickCore/enhance.c b/MagickCore/enhance.c
index 951eb0c3081..dba7880553f 100644
--- a/MagickCore/enhance.c
+++ b/MagickCore/enhance.c
@@ -43,10 +43,11 @@
 #include "MagickCore/studio.h"
 #include "MagickCore/accelerate-private.h"
 #include "MagickCore/artifact.h"
 #include "MagickCore/attribute.h"
 #include "MagickCore/cache.h"
+#include "MagickCore/cache-private.h"
 #include "MagickCore/cache-view.h"
 #include "MagickCore/channel.h"
 #include "MagickCore/color.h"
 #include "MagickCore/color-private.h"
 #include "MagickCore/colorspace.h"
@@ -1045,10 +1046,12 @@ MagickExport MagickBooleanType ContrastStretchImage(Image *image,
   */
   assert(image != (Image *) NULL);
   assert(image->signature == MagickCoreSignature);
   if (image->debug != MagickFalse)
     (void) LogMagickEvent(TraceEvent,GetMagickModule(),"%s",image->filename);
+  if (SyncImagePixelCache(image,exception) == MagickFalse)
+    return(MagickFalse);
   if (SetImageGray(image,exception) != MagickFalse)
     (void) SetImageColorspace(image,GRAYColorspace,exception);
   black=(double *) AcquireQuantumMemory(GetPixelChannels(image),sizeof(*black));
   white=(double *) AcquireQuantumMemory(GetPixelChannels(image),sizeof(*white));
   histogram=(double *) AcquireQuantumMemory(MaxMap+1UL,GetPixelChannels(image)*
@@ -1528,10 +1531,12 @@ MagickExport MagickBooleanType EqualizeImage(Image *image,
   /*
     Allocate and initialize histogram arrays.
   */
   assert(image != (Image *) NULL);
   assert(image->signature == MagickCoreSignature);
+  if (SyncImagePixelCache(image,exception) == MagickFalse)
+    return(MagickFalse);
 #if defined(MAGICKCORE_OPENCL_SUPPORT)
   if (AccelerateEqualizeImage(image,exception) != MagickFalse)
     return(MagickTrue);
 #endif
   if (image->debug != MagickFalse)

Fixed code: #include "MagickCore/cache-private.h"
  if (SyncImagePixelCache(image,exception) == MagickFalse)
    return(MagickFalse);
  if (SyncImagePixelCache(image,exception) == MagickFalse)
    return(MagickFalse);