CVE-2015-8958: Out-of-bounds Read (CWE-125)
value: coders/sun.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted SUN file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2017-04-20T18:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/sun.c
Commit date: 2015-01-13 12:16:28 +0000
Diff: diff --git a/coders/sun.c b/coders/sun.c
index 04915bc3d..7edf41b3a 100644
--- a/coders/sun.c
+++ b/coders/sun.c
@@ -406,11 +406,11 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
     status=SetImageExtent(image,image->columns,image->rows,exception);
     if (status == MagickFalse)
       return(DestroyImageList(image));
     if ((sun_info.length*sizeof(*sun_data))/sizeof(*sun_data) !=
         sun_info.length || !sun_info.length)
-      ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+      ThrowReaderException(ResourceLimitError,"ImproperImageHeader");
     number_pixels=(MagickSizeType) image->columns*image->rows;
     if ((sun_info.type != RT_ENCODED) && 
         ((number_pixels*sun_info.depth) > (8*sun_info.length)))
       ThrowReaderException(CorruptImageError,"ImproperImageHeader");
     bytes_per_line=sun_info.width*sun_info.depth;
@@ -422,23 +422,29 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
     if (count != (ssize_t) sun_info.length)
       ThrowReaderException(CorruptImageError,"UnableToReadImageData");
     height=sun_info.height;
     if ((height == 0) || (sun_info.width == 0) || (sun_info.depth == 0) ||
         ((bytes_per_line/sun_info.depth) != sun_info.width))
-      ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+      ThrowReaderException(ResourceLimitError,"ImproperImageHeader");
     bytes_per_line+=15;
     bytes_per_line<<=1;
     if ((bytes_per_line >> 1) != (sun_info.width*sun_info.depth+15))
-      ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+      ThrowReaderException(ResourceLimitError,"ImproperImageHeader");
     bytes_per_line>>=4;
     sun_pixels=(unsigned char *) AcquireQuantumMemory(height,
       bytes_per_line*sizeof(*sun_pixels));
     if (sun_pixels == (unsigned char *) NULL)
       ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
     if (sun_info.type == RT_ENCODED)
       (void) DecodeImage(sun_data,sun_info.length,sun_pixels,bytes_per_line*
         height);
+    else
+      {
+        if (sun_info.length > (height*bytes_per_line))
+          ThrowReaderException(ResourceLimitError,"ImproperImageHeader");
+        (void) CopyMagickMemory(sun_pixels,sun_data,sun_info.length);
+      }
     sun_data=(unsigned char *) RelinquishMagickMemory(sun_data);
     /*
       Convert SUN raster image to pixel packets.
     */
     p=sun_pixels;

Vulnerable code:       ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
      ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
      ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
Fixed code:       ThrowReaderException(ResourceLimitError,"ImproperImageHeader");
      ThrowReaderException(ResourceLimitError,"ImproperImageHeader");
      ThrowReaderException(ResourceLimitError,"ImproperImageHeader");
    else
      {
        if (sun_info.length > (height*bytes_per_line))
          ThrowReaderException(ResourceLimitError,"ImproperImageHeader");
        (void) CopyMagickMemory(sun_pixels,sun_data,sun_info.length);
      }