CVE-2017-12663: Missing Release of Resource after Effective Lifetime (CWE-772)
value: ImageMagick 7.0.6-2 has a memory leak vulnerability in WriteMAPImage in coders/map.c.
CWE description: The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
CVSS v3 base score: 8.8
Published: 2017-08-07T21:29Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/map.c
Commit date: 2017-07-17 13:32:16 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/573

Diff: diff --git a/coders/map.c b/coders/map.c
index 5cee5156023..5383b6d9f7c 100644
--- a/coders/map.c
+++ b/coders/map.c
@@ -389,16 +389,21 @@ static MagickBooleanType WriteMAPImage(const ImageInfo *image_info,Image *image,
   packet_size=(size_t) (image->colors > 256 ? 6UL : 3UL);
   colormap=(unsigned char *) AcquireQuantumMemory(image->colors,packet_size*
     sizeof(*colormap));
   if ((pixels == (unsigned char *) NULL) ||
       (colormap == (unsigned char *) NULL))
-    ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
+    {
+      if (colormap != (unsigned char *) NULL)
+        colormap=(unsigned char *) RelinquishMagickMemory(colormap);
+      if (pixels != (unsigned char *) NULL)
+        pixels=(unsigned char *) RelinquishMagickMemory(pixels);
+      ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
+    }
   /*
     Write colormap to file.
   */
   q=colormap;
-  q=colormap;
   if (image->colors <= 256)
     for (i=0; i < (ssize_t) image->colors; i++)
     {
       *q++=(unsigned char) ScaleQuantumToChar(image->colormap[i].red);
       *q++=(unsigned char) ScaleQuantumToChar(image->colormap[i].green);
@@ -408,13 +413,15 @@ static MagickBooleanType WriteMAPImage(const ImageInfo *image_info,Image *image,
     for (i=0; i < (ssize_t) image->colors; i++)
     {
       *q++=(unsigned char) (ScaleQuantumToShort(image->colormap[i].red) >> 8);
       *q++=(unsigned char) (ScaleQuantumToShort(image->colormap[i].red) & 0xff);
       *q++=(unsigned char) (ScaleQuantumToShort(image->colormap[i].green) >> 8);
-      *q++=(unsigned char) (ScaleQuantumToShort(image->colormap[i].green) & 0xff);;
+      *q++=(unsigned char) (ScaleQuantumToShort(image->colormap[i].green) &
+        0xff);
       *q++=(unsigned char) (ScaleQuantumToShort(image->colormap[i].blue) >> 8);
-      *q++=(unsigned char) (ScaleQuantumToShort(image->colormap[i].blue) & 0xff);
+      *q++=(unsigned char) (ScaleQuantumToShort(image->colormap[i].blue) &
+        0xff);
     }
   (void) WriteBlob(image,packet_size*image->colors,colormap);
   colormap=(unsigned char *) RelinquishMagickMemory(colormap);
   /*
     Write image pixels to file.

Vulnerable code:     ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
  q=colormap;
      *q++=(unsigned char) (ScaleQuantumToShort(image->colormap[i].green) & 0xff);;
      *q++=(unsigned char) (ScaleQuantumToShort(image->colormap[i].blue) & 0xff);
Fixed code:     {
      if (colormap != (unsigned char *) NULL)
        colormap=(unsigned char *) RelinquishMagickMemory(colormap);
      if (pixels != (unsigned char *) NULL)
        pixels=(unsigned char *) RelinquishMagickMemory(pixels);
      ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
    }
      *q++=(unsigned char) (ScaleQuantumToShort(image->colormap[i].green) &
        0xff);
      *q++=(unsigned char) (ScaleQuantumToShort(image->colormap[i].blue) &
        0xff);