CVE-2016-10066: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: Buffer overflow in the ReadVIFFImage function in coders/viff.c in ImageMagick before 6.9.4-5 allows remote attackers to cause a denial of service (application crash) via a crafted file.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 5.5
Published: 2017-03-03T17:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: MagickCore/Makefile.am, MagickCore/exception.c, MagickCore/memory-private.h, MagickCore/memory.c, Makefile.in, coders/label.c, coders/viff.c, configure
Commit date: 2016-05-29 11:37:43 -0400
Commit message: Suspend exception processing if too many exceptions

Diff: diff --git a/MagickCore/Makefile.am b/MagickCore/Makefile.am
index ca4c6e6110..1392ee2627 100644
--- a/MagickCore/Makefile.am
+++ b/MagickCore/Makefile.am
@@ -63,11 +63,10 @@ MagickCore_libMagickCore_@MAGICK_MAJOR_VERSION@_@MAGICK_ABI_SUFFIX@_la_DEPENDENC
 
 # Library base sources
 MAGICKCORE_BASE_SRCS = \
 	MagickCore/MagickCore.h \
 	MagickCore/accelerate.c \
-	MagickCore/accelerate.h \
 	MagickCore/accelerate-private.h \
 	MagickCore/animate.c \
 	MagickCore/animate.h \
 	MagickCore/animate-private.h \
 	MagickCore/annotate.c \
@@ -311,11 +310,10 @@ MAGICKCORE_PLATFORM_SRCS =
 endif # if CYGWIN_BUILD
 endif # if WIN32_NATIVE_BUILD
 
 MAGICKCORE_INCLUDE_HDRS = \
 	MagickCore/MagickCore.h \
-	MagickCore/accelerate.h \
 	MagickCore/animate.h \
 	MagickCore/annotate.h \
 	MagickCore/artifact.h \
 	MagickCore/attribute.h \
 	MagickCore/blob.h \
diff --git a/MagickCore/exception.c b/MagickCore/exception.c
index a0145e3068..cbc47a77f0 100644
--- a/MagickCore/exception.c
+++ b/MagickCore/exception.c
@@ -70,10 +70,15 @@ static void
 #endif
 
 /*
   Global declarations.
 */
+#define MaxExceptions  128
+
+/*
+  Global declarations.
+*/
 static ErrorHandler
   error_handler = DefaultErrorHandler;
 
 static FatalErrorHandler
   fatal_error_handler = DefaultFatalErrorHandler;
@@ -192,24 +197,35 @@ MagickExport void ClearMagickException(ExceptionInfo *exception)
 MagickExport void CatchException(ExceptionInfo *exception)
 {
   register const ExceptionInfo
     *p;
 
+  ssize_t
+    i;
+
   assert(exception != (ExceptionInfo *) NULL);
   assert(exception->signature == MagickCoreSignature);
   if (exception->exceptions  == (void *) NULL)
     return;
   LockSemaphoreInfo(exception->semaphore);
   ResetLinkedListIterator((LinkedListInfo *) exception->exceptions);
   p=(const ExceptionInfo *) GetNextValueInLinkedList((LinkedListInfo *)
     exception->exceptions);
-  while (p != (const ExceptionInfo *) NULL)
+  for (i=0; p != (const ExceptionInfo *) NULL; i++)
   {
-    if ((p->severity >= WarningException) && (p->severity < ErrorException))
-      MagickWarning(p->severity,p->reason,p->description);
-    if ((p->severity >= ErrorException) && (p->severity < FatalErrorException))
-      MagickError(p->severity,p->reason,p->description);
+    if (i < MaxExceptions)
+      {
+        if ((p->severity >= WarningException) && (p->severity < ErrorException))
+          MagickWarning(p->severity,p->reason,p->description);
+        if ((p->severity >= ErrorException) &&
+            (p->severity < FatalErrorException))
+          MagickError(p->severity,p->reason,p->description);
+      }
+    else
+      if (i == MaxExceptions)
+        MagickError(ResourceLimitError,"too many exceptions",
+          "exception processing is suspended");
     if (p->severity >= FatalErrorException)
       MagickFatalError(p->severity,p->reason,p->description);
     p=(const ExceptionInfo *) GetNextValueInLinkedList((LinkedListInfo *)
       exception->exceptions);
   }
diff --git a/MagickCore/memory-private.h b/MagickCore/memory-private.h
index 2b0df40ccf..5f14c732ac 100644
--- a/MagickCore/memory-private.h
+++ b/MagickCore/memory-private.h
@@ -40,10 +40,13 @@ extern "C" {
 #endif
 #else
 #define MagickAssumeAligned(address)  (address)
 #endif
 
+MagickExport MagickBooleanType 
+  HeapOverflowSanityCheck(const size_t,const size_t) magick_alloc_sizes(1,2);
+
 #if defined(__cplusplus) || defined(c_plusplus)
 }
 #endif
 
 #endif
diff --git a/MagickCore/memory.c b/MagickCore/memory.c
index c9e27a18e3..47618a3265 100644
--- a/MagickCore/memory.c
+++ b/MagickCore/memory.c
@@ -231,26 +231,10 @@ static MagickBooleanType
 %    o count: the number of quantum elements to allocate.
 %
 %    o quantum: the number of bytes in each quantum.
 %
 */
-
-static MagickBooleanType CheckMemoryOverflow(const size_t count,
-  const size_t quantum)
-{
-  size_t
-    size;
-
-  size=count*quantum;
-  if ((count == 0) || (quantum != (size/count)))
-    {
-      errno=ENOMEM;
-      return(MagickTrue);
-    }
-  return(MagickFalse);
-}
-
 MagickExport void *AcquireAlignedMemory(const size_t count,const size_t quantum)
 {
 #define AlignedExtent(size,alignment) \
   (((size)+((alignment)-1)) & ~((alignment)-1))
 
@@ -260,11 +244,11 @@ MagickExport void *AcquireAlignedMemory(const size_t count,const size_t quantum)
     size;
 
   void
     *memory;
 
-  if (CheckMemoryOverflow(count,quantum) != MagickFalse)
+  if (HeapOverflowSanityCheck(count,quantum) != MagickFalse)
     return((void *) NULL);
   memory=NULL;
   alignment=CACHE_LINE_SIZE;
   size=count*quantum;
   extent=AlignedExtent(size,alignment);
@@ -541,11 +525,11 @@ MagickExport void *AcquireMagickMemory(const size_t size)
 MagickExport void *AcquireQuantumMemory(const size_t count,const size_t quantum)
 {
   size_t
     extent;
 
-  if (CheckMemoryOverflow(count,quantum) != MagickFalse)
+  if (HeapOverflowSanityCheck(count,quantum) != MagickFalse)
     return((void *) NULL);
   extent=count*quantum;
   return(AcquireMagickMemory(extent));
 }
 
@@ -581,11 +565,11 @@ MagickExport MemoryInfo *AcquireVirtualMemory(const size_t count,
     *memory_info;
 
   size_t
     extent;
 
-  if (CheckMemoryOverflow(count,quantum) != MagickFalse)
+  if (HeapOverflowSanityCheck(count,quantum) != MagickFalse)
     return((MemoryInfo *) NULL);
   memory_info=(MemoryInfo *) MagickAssumeAligned(AcquireAlignedMemory(1,
     sizeof(*memory_info)));
   if (memory_info == (MemoryInfo *) NULL)
     ThrowFatalException(ResourceLimitFatalError,"MemoryAllocationFailed");
@@ -914,10 +898,49 @@ MagickExport void *GetVirtualMemoryBlob(const MemoryInfo *memory_info)
 /*
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 %                                                                             %
 %                                                                             %
 %                                                                             %
++   H e a p O v e r f l o w S a n i t y C h e c k                             %
+%                                                                             %
+%                                                                             %
+%                                                                             %
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%
+%  HeapOverflowSanityCheck() returns MagickTrue if the heap allocation request
+%  does not exceed the maximum limits of a size_t otherwise MagickFalse.
+%
+%  The format of the HeapOverflowSanityCheck method is:
+%
+%      MagickBooleanType HeapOverflowSanityCheck(const size_t count,
+%        const size_t quantum)
+%
+%  A description of each parameter follows:
+%
+%    o size: the size of the memory in bytes we require.
+%
+*/
+MagickExport MagickBooleanType HeapOverflowSanityCheck(const size_t count,
+  const size_t quantum)
+{
+  size_t
+    size;
+
+  size=count*quantum;
+  if ((count == 0) || (quantum != (size/count)))
+    {
+      errno=ENOMEM;
+      return(MagickTrue);
+    }
+  return(MagickFalse);
+}
+
+/*
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%                                                                             %
+%                                                                             %
+%                                                                             %
 %   R e l i n q u i s h A l i g n e d M e m o r y                             %
 %                                                                             %
 %                                                                             %
 %                                                                             %
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
@@ -1219,11 +1242,11 @@ MagickExport void *ResizeQuantumMemory(void *memory,const size_t count,
   const size_t quantum)
 {
   size_t
     extent;
 
-  if (CheckMemoryOverflow(count,quantum) != MagickFalse)
+  if (HeapOverflowSanityCheck(count,quantum) != MagickFalse)
     {
       memory=RelinquishMagickMemory(memory);
       return((void *) NULL);
     }
   extent=count*quantum;
diff --git a/Makefile.in b/Makefile.in
index 0d52bff169..e92ef7f21f 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -389,39 +389,38 @@ Magick___lib_libMagick___@MAGICK_MAJOR_VERSION@_@MAGICK_ABI_SUFFIX@_la_LINK =  \
 @WITH_MAGICK_PLUS_PLUS_TRUE@am_Magick___lib_libMagick___@MAGICK_MAJOR_VERSION@_@MAGICK_ABI_SUFFIX@_la_rpath =  \
 @WITH_MAGICK_PLUS_PLUS_TRUE@	-rpath $(libdir)
 am__DEPENDENCIES_1 =
 am__MagickCore_libMagickCore_@MAGICK_MAJOR_VERSION@_@MAGICK_ABI_SUFFIX@_la_SOURCES_DIST =  \
 	MagickCore/MagickCore.h MagickCore/accelerate.c \
-	MagickCore/accelerate.h MagickCore/accelerate-private.h \
-	MagickCore/animate.c MagickCore/animate.h \
-	MagickCore/animate-private.h MagickCore/annotate.c \
-	MagickCore/annotate.h MagickCore/artifact.c \
-	MagickCore/artifact.h MagickCore/attribute.c \
-	MagickCore/attribute.h MagickCore/blob.c MagickCore/blob.h \
-	MagickCore/blob-private.h MagickCore/cache.c \
-	MagickCore/cache.h MagickCore/cache-private.h \
-	MagickCore/cache-view.c MagickCore/cache-view.h \
-	MagickCore/channel.c MagickCore/channel.h MagickCore/cipher.c \
-	MagickCore/cipher.h MagickCore/client.c MagickCore/client.h \
-	MagickCore/coder.c MagickCore/coder.h MagickCore/color.c \
-	MagickCore/color.h MagickCore/color-private.h \
-	MagickCore/colormap.c MagickCore/colormap.h \
-	MagickCore/colormap-private.h MagickCore/colorspace.c \
-	MagickCore/colorspace.h MagickCore/colorspace-private.h \
-	MagickCore/compare.c MagickCore/compare.h \
-	MagickCore/composite.c MagickCore/composite.h \
-	MagickCore/composite-private.h MagickCore/compress.c \
-	MagickCore/compress.h MagickCore/configure.c \
-	MagickCore/configure.h MagickCore/constitute.c \
-	MagickCore/constitute.h MagickCore/decorate.c \
-	MagickCore/decorate.h MagickCore/delegate.c \
-	MagickCore/delegate.h MagickCore/delegate-private.h \
-	MagickCore/deprecate.c MagickCore/deprecate.h \
-	MagickCore/display.c MagickCore/display.h \
-	MagickCore/display-private.h MagickCore/distort.c \
-	MagickCore/distort.h MagickCore/distribute-cache.c \
-	MagickCore/distribute-cache.h \
+	MagickCore/accelerate-private.h MagickCore/animate.c \
+	MagickCore/animate.h MagickCore/animate-private.h \
+	MagickCore/annotate.c MagickCore/annotate.h \
+	MagickCore/artifact.c MagickCore/artifact.h \
+	MagickCore/attribute.c MagickCore/attribute.h \
+	MagickCore/blob.c MagickCore/blob.h MagickCore/blob-private.h \
+	MagickCore/cache.c MagickCore/cache.h \
+	MagickCore/cache-private.h MagickCore/cache-view.c \
+	MagickCore/cache-view.h MagickCore/channel.c \
+	MagickCore/channel.h MagickCore/cipher.c MagickCore/cipher.h \
+	MagickCore/client.c MagickCore/client.h MagickCore/coder.c \
+	MagickCore/coder.h MagickCore/color.c MagickCore/color.h \
+	MagickCore/color-private.h MagickCore/colormap.c \
+	MagickCore/colormap.h MagickCore/colormap-private.h \
+	MagickCore/colorspace.c MagickCore/colorspace.h \
+	MagickCore/colorspace-private.h MagickCore/compare.c \
+	MagickCore/compare.h MagickCore/composite.c \
+	MagickCore/composite.h MagickCore/composite-private.h \
+	MagickCore/compress.c MagickCore/compress.h \
+	MagickCore/configure.c MagickCore/configure.h \
+	MagickCore/constitute.c MagickCore/constitute.h \
+	MagickCore/decorate.c MagickCore/decorate.h \
+	MagickCore/delegate.c MagickCore/delegate.h \
+	MagickCore/delegate-private.h MagickCore/deprecate.c \
+	MagickCore/deprecate.h MagickCore/display.c \
+	MagickCore/display.h MagickCore/display-private.h \
+	MagickCore/distort.c MagickCore/distort.h \
+	MagickCore/distribute-cache.c MagickCore/distribute-cache.h \
 	MagickCore/distribute-cache-private.h MagickCore/draw.c \
 	MagickCore/draw.h MagickCore/draw-private.h \
 	MagickCore/effect.c MagickCore/effect.h MagickCore/enhance.c \
 	MagickCore/enhance.h MagickCore/exception.c \
 	MagickCore/exception.h MagickCore/exception-private.h \
@@ -4139,11 +4138,10 @@ MagickCore_libMagickCore_@MAGICK_MAJOR_VERSION@_@MAGICK_ABI_SUFFIX@_la_DEPENDENC
 
 # Library base sources
 MAGICKCORE_BASE_SRCS = \
 	MagickCore/MagickCore.h \
 	MagickCore/accelerate.c \
-	MagickCore/accelerate.h \
 	MagickCore/accelerate-private.h \
 	MagickCore/animate.c \
 	MagickCore/animate.h \
 	MagickCore/animate-private.h \
 	MagickCore/annotate.c \
@@ -4382,11 +4380,10 @@ MAGICKCORE_BASE_SRCS = \
 @WIN32_NATIVE_BUILD_TRUE@  MagickCore/nt-feature.c \
 @WIN32_NATIVE_BUILD_TRUE@  MagickCore/nt-feature.h
 
 MAGICKCORE_INCLUDE_HDRS = \
 	MagickCore/MagickCore.h \
-	MagickCore/accelerate.h \
 	MagickCore/animate.h \
 	MagickCore/annotate.h \
 	MagickCore/artifact.h \
 	MagickCore/attribute.h \
 	MagickCore/blob.h \
diff --git a/coders/label.c b/coders/label.c
index e67fbaf0c0..fb862ffaf2 100644
--- a/coders/label.c
+++ b/coders/label.c
@@ -134,11 +134,11 @@ static Image *ReadLABELImage(const ImageInfo *image_info,
   metrics.width=0;
   metrics.ascent=0.0;
   status=GetMultilineTypeMetrics(image,draw_info,&metrics,exception);
   if ((image->columns == 0) && (image->rows == 0))
     {
-      image->columns=(size_t) (metrics.width+draw_info->stroke_width+0.5);
+      image->columns=(size_t) floor(metrics.width+draw_info->stroke_width+0.5);
       image->rows=(size_t) floor(metrics.height+draw_info->stroke_width+0.5);
     }
   else
     if (((image->columns == 0) || (image->rows == 0)) ||
         (fabs(image_info->pointsize) < MagickEpsilon))
@@ -202,18 +202,20 @@ static Image *ReadLABELImage(const ImageInfo *image_info,
       draw_info=DestroyDrawInfo(draw_info);
        image=DestroyImageList(image);
        return((Image *) NULL);
      }
   if (image->columns == 0)
-    image->columns=(size_t) (metrics.width+draw_info->stroke_width+0.5);
+    image->columns=(size_t) floor(metrics.width+draw_info->stroke_width+0.5);
   if (image->columns == 0)
-    image->columns=(size_t) (draw_info->pointsize+draw_info->stroke_width+0.5);
+    image->columns=(size_t) floor(draw_info->pointsize+draw_info->stroke_width+
+      0.5);
   if (image->rows == 0)
-    image->rows=(size_t) (metrics.ascent-metrics.descent+
+    image->rows=(size_t) floor(metrics.ascent-metrics.descent+
       draw_info->stroke_width+0.5);
   if (image->rows == 0)
-    image->rows=(size_t) (draw_info->pointsize+draw_info->stroke_width+0.5);
+    image->rows=(size_t) floor(draw_info->pointsize+draw_info->stroke_width+
+      0.5);
   status=SetImageExtent(image,image->columns,image->rows,exception);
   if (status == MagickFalse)
     {
       draw_info=DestroyDrawInfo(draw_info);
       return(DestroyImageList(image));
diff --git a/coders/viff.c b/coders/viff.c
index 5a8047e0e4..ce00f4ec2b 100644
--- a/coders/viff.c
+++ b/coders/viff.c
@@ -135,26 +135,10 @@ static MagickBooleanType IsVIFF(const unsigned char *magick,const size_t length)
 %    o image_info: the image info.
 %
 %    o exception: return any errors or warnings in this structure.
 %
 */
-
-static MagickBooleanType CheckMemoryOverflow(const size_t count,
-  const size_t quantum)
-{
-  size_t
-    size;
-
-  size=count*quantum;
-  if ((count == 0) || (quantum != (size/count)))
-    {
-      errno=ENOMEM;
-      return(MagickTrue);
-    }
-  return(MagickFalse);
-}
-
 static Image *ReadVIFFImage(const ImageInfo *image_info,
   ExceptionInfo *exception)
 {
 #define VFF_CM_genericRGB  15
 #define VFF_CM_ntscRGB  1
@@ -514,17 +498,17 @@ static Image *ReadVIFFImage(const ImageInfo *image_info,
       case VFF_TYP_DOUBLE: bytes_per_pixel=8; break;
       default: bytes_per_pixel=1; break;
     }
     if (viff_info.data_storage_type == VFF_TYP_BIT)
       {
-        if (CheckMemoryOverflow((image->columns+7UL) >> 3UL,image->rows) != MagickFalse)
+        if (HeapOverflowSanityCheck((image->columns+7UL) >> 3UL,image->rows) != MagickFalse)
           ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
         max_packets=((image->columns+7UL) >> 3UL)*image->rows;
       }
     else
       {
-        if (CheckMemoryOverflow(number_pixels,viff_info.number_data_bands) != MagickFalse)
+        if (HeapOverflowSanityCheck(number_pixels,viff_info.number_data_bands) != MagickFalse)
           ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
         max_packets=(size_t) (number_pixels*viff_info.number_data_bands);
       }
     pixels=(unsigned char *) AcquireQuantumMemory(MagickMax(number_pixels,
       max_packets),bytes_per_pixel*sizeof(*pixels));
diff --git a/configure b/configure
index 5cb9674ae9..fc63497306 100755
--- a/configure
+++ b/configure
@@ -4513,11 +4513,11 @@ MAGICK_MICRO_VERSION=1
 
 MAGICK_PATCHLEVEL_VERSION=7
 
 MAGICK_VERSION=7.0.1-7
 
-MAGICK_GIT_REVISION=18241:d4f277c:20160521
+MAGICK_GIT_REVISION=18293:89bfada:20160529
 
 
 # Substitute library versioning
 MAGICK_LIBRARY_CURRENT_MIN=`expr $MAGICK_LIBRARY_CURRENT - $MAGICK_LIBRARY_AGE`
 

Vulnerable code: 	MagickCore/accelerate.h \
	MagickCore/accelerate.h \
  while (p != (const ExceptionInfo *) NULL)
    if ((p->severity >= WarningException) && (p->severity < ErrorException))
      MagickWarning(p->severity,p->reason,p->description);
    if ((p->severity >= ErrorException) && (p->severity < FatalErrorException))
      MagickError(p->severity,p->reason,p->description);

static MagickBooleanType CheckMemoryOverflow(const size_t count,
  const size_t quantum)
{
  size_t
    size;

  size=count*quantum;
  if ((count == 0) || (quantum != (size/count)))
    {
      errno=ENOMEM;
      return(MagickTrue);
    }
  return(MagickFalse);
}

  if (CheckMemoryOverflow(count,quantum) != MagickFalse)
  if (CheckMemoryOverflow(count,quantum) != MagickFalse)
  if (CheckMemoryOverflow(count,quantum) != MagickFalse)
  if (CheckMemoryOverflow(count,quantum) != MagickFalse)
	MagickCore/accelerate.h MagickCore/accelerate-private.h \
	MagickCore/animate.c MagickCore/animate.h \
	MagickCore/animate-private.h MagickCore/annotate.c \
	MagickCore/annotate.h MagickCore/artifact.c \
	MagickCore/artifact.h MagickCore/attribute.c \
	MagickCore/attribute.h MagickCore/blob.c MagickCore/blob.h \
	MagickCore/blob-private.h MagickCore/cache.c \
	MagickCore/cache.h MagickCore/cache-private.h \
	MagickCore/cache-view.c MagickCore/cache-view.h \
	MagickCore/channel.c MagickCore/channel.h MagickCore/cipher.c \
	MagickCore/cipher.h MagickCore/client.c MagickCore/client.h \
	MagickCore/coder.c MagickCore/coder.h MagickCore/color.c \
	MagickCore/color.h MagickCore/color-private.h \
	MagickCore/colormap.c MagickCore/colormap.h \
	MagickCore/colormap-private.h MagickCore/colorspace.c \
	MagickCore/colorspace.h MagickCore/colorspace-private.h \
	MagickCore/compare.c MagickCore/compare.h \
	MagickCore/composite.c MagickCore/composite.h \
	MagickCore/composite-private.h MagickCore/compress.c \
	MagickCore/compress.h MagickCore/configure.c \
	MagickCore/configure.h MagickCore/constitute.c \
	MagickCore/constitute.h MagickCore/decorate.c \
	MagickCore/decorate.h MagickCore/delegate.c \
	MagickCore/delegate.h MagickCore/delegate-private.h \
	MagickCore/deprecate.c MagickCore/deprecate.h \
	MagickCore/display.c MagickCore/display.h \
	MagickCore/display-private.h MagickCore/distort.c \
	MagickCore/distort.h MagickCore/distribute-cache.c \
	MagickCore/distribute-cache.h \
	MagickCore/accelerate.h \
	MagickCore/accelerate.h \
      image->columns=(size_t) (metrics.width+draw_info->stroke_width+0.5);
    image->columns=(size_t) (metrics.width+draw_info->stroke_width+0.5);
    image->columns=(size_t) (draw_info->pointsize+draw_info->stroke_width+0.5);
    image->rows=(size_t) (metrics.ascent-metrics.descent+
    image->rows=(size_t) (draw_info->pointsize+draw_info->stroke_width+0.5);

static MagickBooleanType CheckMemoryOverflow(const size_t count,
  const size_t quantum)
{
  size_t
    size;

  size=count*quantum;
  if ((count == 0) || (quantum != (size/count)))
    {
      errno=ENOMEM;
      return(MagickTrue);
    }
  return(MagickFalse);
}

        if (CheckMemoryOverflow((image->columns+7UL) >> 3UL,image->rows) != MagickFalse)
        if (CheckMemoryOverflow(number_pixels,viff_info.number_data_bands) != MagickFalse)
MAGICK_GIT_REVISION=18241:d4f277c:20160521
Fixed code: #define MaxExceptions  128

/*
  Global declarations.
*/
  ssize_t
    i;

  for (i=0; p != (const ExceptionInfo *) NULL; i++)
    if (i < MaxExceptions)
      {
        if ((p->severity >= WarningException) && (p->severity < ErrorException))
          MagickWarning(p->severity,p->reason,p->description);
        if ((p->severity >= ErrorException) &&
            (p->severity < FatalErrorException))
          MagickError(p->severity,p->reason,p->description);
      }
    else
      if (i == MaxExceptions)
        MagickError(ResourceLimitError,"too many exceptions",
          "exception processing is suspended");
MagickExport MagickBooleanType 
  HeapOverflowSanityCheck(const size_t,const size_t) magick_alloc_sizes(1,2);

  if (HeapOverflowSanityCheck(count,quantum) != MagickFalse)
  if (HeapOverflowSanityCheck(count,quantum) != MagickFalse)
  if (HeapOverflowSanityCheck(count,quantum) != MagickFalse)
+   H e a p O v e r f l o w S a n i t y C h e c k                             %
%                                                                             %
%                                                                             %
%                                                                             %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
%  HeapOverflowSanityCheck() returns MagickTrue if the heap allocation request
%  does not exceed the maximum limits of a size_t otherwise MagickFalse.
%
%  The format of the HeapOverflowSanityCheck method is:
%
%      MagickBooleanType HeapOverflowSanityCheck(const size_t count,
%        const size_t quantum)
%
%  A description of each parameter follows:
%
%    o size: the size of the memory in bytes we require.
%
*/
MagickExport MagickBooleanType HeapOverflowSanityCheck(const size_t count,
  const size_t quantum)
{
  size_t
    size;

  size=count*quantum;
  if ((count == 0) || (quantum != (size/count)))
    {
      errno=ENOMEM;
      return(MagickTrue);
    }
  return(MagickFalse);
}

/*
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%                                                                             %
%                                                                             %
%                                                                             %
  if (HeapOverflowSanityCheck(count,quantum) != MagickFalse)
	MagickCore/accelerate-private.h MagickCore/animate.c \
	MagickCore/animate.h MagickCore/animate-private.h \
	MagickCore/annotate.c MagickCore/annotate.h \
	MagickCore/artifact.c MagickCore/artifact.h \
	MagickCore/attribute.c MagickCore/attribute.h \
	MagickCore/blob.c MagickCore/blob.h MagickCore/blob-private.h \
	MagickCore/cache.c MagickCore/cache.h \
	MagickCore/cache-private.h MagickCore/cache-view.c \
	MagickCore/cache-view.h MagickCore/channel.c \
	MagickCore/channel.h MagickCore/cipher.c MagickCore/cipher.h \
	MagickCore/client.c MagickCore/client.h MagickCore/coder.c \
	MagickCore/coder.h MagickCore/color.c MagickCore/color.h \
	MagickCore/color-private.h MagickCore/colormap.c \
	MagickCore/colormap.h MagickCore/colormap-private.h \
	MagickCore/colorspace.c MagickCore/colorspace.h \
	MagickCore/colorspace-private.h MagickCore/compare.c \
	MagickCore/compare.h MagickCore/composite.c \
	MagickCore/composite.h MagickCore/composite-private.h \
	MagickCore/compress.c MagickCore/compress.h \
	MagickCore/configure.c MagickCore/configure.h \
	MagickCore/constitute.c MagickCore/constitute.h \
	MagickCore/decorate.c MagickCore/decorate.h \
	MagickCore/delegate.c MagickCore/delegate.h \
	MagickCore/delegate-private.h MagickCore/deprecate.c \
	MagickCore/deprecate.h MagickCore/display.c \
	MagickCore/display.h MagickCore/display-private.h \
	MagickCore/distort.c MagickCore/distort.h \
	MagickCore/distribute-cache.c MagickCore/distribute-cache.h \
      image->columns=(size_t) floor(metrics.width+draw_info->stroke_width+0.5);
    image->columns=(size_t) floor(metrics.width+draw_info->stroke_width+0.5);
    image->columns=(size_t) floor(draw_info->pointsize+draw_info->stroke_width+
      0.5);
    image->rows=(size_t) floor(metrics.ascent-metrics.descent+
    image->rows=(size_t) floor(draw_info->pointsize+draw_info->stroke_width+
      0.5);
        if (HeapOverflowSanityCheck((image->columns+7UL) >> 3UL,image->rows) != MagickFalse)
        if (HeapOverflowSanityCheck(number_pixels,viff_info.number_data_bands) != MagickFalse)
MAGICK_GIT_REVISION=18293:89bfada:20160529