CVE-2018-16643: Unchecked Return Value (CWE-252)
value: The functions ReadDCMImage in coders/dcm.c, ReadPWPImage in coders/pwp.c, ReadCALSImage in coders/cals.c, and ReadPICTImage in coders/pict.c in ImageMagick 7.0.8-4 do not check the return value of the fputc function, which allows remote attackers to cause a denial of service via a crafted image file.
CWE description: The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
CVSS v3 base score: 6.5
Published: 2018-09-06T22:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/cals.c, coders/dcm.c, coders/pict.c, coders/pwp.c
Commit date: 2018-07-05 14:29:46 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1199

Diff: diff --git a/coders/cals.c b/coders/cals.c
index 842cff4acc5..bce23e82125 100644
--- a/coders/cals.c
+++ b/coders/cals.c
@@ -255,11 +255,12 @@ static Image *ReadCALSImage(const ImageInfo *image_info,
   if (unique_file != -1)
     file=fdopen(unique_file,"wb");
   if ((unique_file == -1) || (file == (FILE *) NULL))
     ThrowImageException(FileOpenError,"UnableToCreateTemporaryFile");
   while ((c=ReadBlobByte(image)) != EOF)
-    (void) fputc(c,file);
+    if (fputc(c,file) != c)
+      break;
   (void) fclose(file);
   (void) CloseBlob(image);
   image=DestroyImage(image);
   read_info=CloneImageInfo(image_info);
   SetImageInfoBlob(read_info,(void *) NULL,0);
diff --git a/coders/dcm.c b/coders/dcm.c
index 334fd2ec898..49fe55a1928 100644
--- a/coders/dcm.c
+++ b/coders/dcm.c
@@ -3226,17 +3226,17 @@ static Image *ReadDCMImage(const ImageInfo *image_info,ExceptionInfo *exception)
         {
           if ((strncmp(implicit_vr,"OW",2) == 0) ||
               (strncmp(implicit_vr,"SS",2) == 0) ||
               (strncmp(implicit_vr,"US",2) == 0))
             quantum=2;
-          else 
+          else
             if ((strncmp(implicit_vr,"FL",2) == 0) ||
                 (strncmp(implicit_vr,"OF",2) == 0) ||
                 (strncmp(implicit_vr,"SL",2) == 0) ||
                 (strncmp(implicit_vr,"UL",2) == 0))
               quantum=4;
-            else 
+            else
               if (strncmp(implicit_vr,"FD",2) == 0)
                 quantum=8;
               else
                 quantum=1;
           if (datum != ~0)
@@ -3878,11 +3878,12 @@ static Image *ReadDCMImage(const ImageInfo *image_info,ExceptionInfo *exception)
               {
                 ThrowFileException(exception,CorruptImageError,
                   "UnexpectedEndOfFile",image->filename);
                 break;
               }
-            (void) fputc(c,file);
+            if (fputc(c,file) != c)
+              break;
           }
           (void) fclose(file);
           if (c == EOF)
             break;
           (void) FormatLocaleString(read_info->filename,MagickPathExtent,
@@ -3932,11 +3933,11 @@ static Image *ReadDCMImage(const ImageInfo *image_info,ExceptionInfo *exception)
           Compute pixel scaling table.
         */
         length=(size_t) (GetQuantumRange(info.depth)+1);
         if (length > (size_t) GetBlobSize(image))
           ThrowDCMException(CorruptImageError,"InsufficientImageDataInFile");
-        if (info.scale != (Quantum *) NULL) 
+        if (info.scale != (Quantum *) NULL)
           info.scale=(Quantum *) RelinquishMagickMemory(info.scale);
         info.scale=(Quantum *) AcquireQuantumMemory(MagickMax(length,256),
           sizeof(*info.scale));
         if (info.scale == (Quantum *) NULL)
           ThrowDCMException(ResourceLimitError,"MemoryAllocationFailed");
diff --git a/coders/pict.c b/coders/pict.c
index 8aafadec26a..35dadfeee0f 100644
--- a/coders/pict.c
+++ b/coders/pict.c
@@ -1470,11 +1470,12 @@ static Image *ReadPICTImage(const ImageInfo *image_info,
             for (i=0; i < (ssize_t) (length-154); i++)
             {
               c=ReadBlobByte(image);
               if (c == EOF)
                 break;
-              (void) fputc(c,file);
+              if (fputc(c,file) != c)
+                break;
             }
           }
         (void) fclose(file);
         (void) close(unique_file);
         tile_image=ReadImage(read_info,exception);
diff --git a/coders/pwp.c b/coders/pwp.c
index e5ae5c88051..cad42500274 100644
--- a/coders/pwp.c
+++ b/coders/pwp.c
@@ -231,11 +231,12 @@ static Image *ReadPWPImage(const ImageInfo *image_info,ExceptionInfo *exception)
     for (i=0; i < (ssize_t) filesize; i++)
     {
       c=ReadBlobByte(pwp_image);
       if (c == EOF)
         break;
-      (void) fputc(c,file);
+      if (fputc(c,file) != c)
+        break;
     }
     (void) fclose(file);
     if (c == EOF)
       {
         (void) RelinquishUniqueFileResource(filename);

Vulnerable code:     (void) fputc(c,file);
          else 
            else 
            (void) fputc(c,file);
        if (info.scale != (Quantum *) NULL) 
              (void) fputc(c,file);
      (void) fputc(c,file);
Fixed code:     if (fputc(c,file) != c)
      break;
          else
            else
            if (fputc(c,file) != c)
              break;
        if (info.scale != (Quantum *) NULL)
              if (fputc(c,file) != c)
                break;
      if (fputc(c,file) != c)
        break;