CVE-2019-13309: Missing Release of Memory after Effective Lifetime (CWE-401)
value: ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of mishandling the NoSuchImage error in CLIListOperatorImages in MagickWand/operation.c.
CWE description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CVSS v3 base score: 6.5
Published: 2019-07-05T01:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: MagickWand/mogrify.c, MagickWand/operation.c
Commit date: 2019-06-23 11:46:42 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1616

Diff: diff --git a/MagickWand/mogrify.c b/MagickWand/mogrify.c
index 82b3c0c1c4a..150b6792304 100644
--- a/MagickWand/mogrify.c
+++ b/MagickWand/mogrify.c
@@ -7906,10 +7906,12 @@ WandExport MagickBooleanType MogrifyImageList(ImageInfo *image_info,
                 MagickFalse,option);
             difference_image=CompareImages(image,reconstruct_image,metric,
               &distortion,exception);
             if (difference_image == (Image *) NULL)
               break;
+            reconstruct_image=DestroyImage(reconstruct_image);
+            image=DestroyImage(image);
             if (*images != (Image *) NULL)
               *images=DestroyImageList(*images);
             *images=difference_image;
             break;
           }
@@ -8293,10 +8295,11 @@ WandExport MagickBooleanType MogrifyImageList(ImageInfo *image_info,
               else
                 {
                    q=GetImageFromList(*images,index-1);
                    if (q == (Image *) NULL)
                      {
+                       p=DestroyImage(p);
                        (void) ThrowMagickException(exception,GetMagickModule(),
                          OptionError,"NoSuchImage","`%s'",argv[i+1]);
                        status=MagickFalse;
                        break;
                      }
diff --git a/MagickWand/operation.c b/MagickWand/operation.c
index 9005da58870..b8745743469 100644
--- a/MagickWand/operation.c
+++ b/MagickWand/operation.c
@@ -4169,11 +4169,14 @@ WandPrivate MagickBooleanType CLIListOperatorImages(MagickCLI *cli_wand,
             AppendImageToList(&_images,insert_image);
           else
             {
                index_image=GetImageFromList(_images,index-1);
                if (index_image == (Image *) NULL)
-                 CLIWandExceptArgBreak(OptionError,"NoSuchImage",option,arg1);
+                 {
+                   insert_image=DestroyImage(insert_image);
+                   CLIWandExceptArgBreak(OptionError,"NoSuchImage",option,arg1);
+                 }
               InsertImageInList(&index_image,insert_image);
             }
           _images=GetFirstImageInList(index_image);
           break;
         }

Vulnerable code:                  CLIWandExceptArgBreak(OptionError,"NoSuchImage",option,arg1);
Fixed code:             reconstruct_image=DestroyImage(reconstruct_image);
            image=DestroyImage(image);
                       p=DestroyImage(p);
                 {
                   insert_image=DestroyImage(insert_image);
                   CLIWandExceptArgBreak(OptionError,"NoSuchImage",option,arg1);
                 }